Home Internet of Things Aerospace Apparel Energy Defense Health Care Logistics Manufacturing Retail

Can Tag Viruses Infect RFID Systems?

A group of European computer researchers have issued a study warning that RFID middleware and applications are vulnerable to viruses encoded into a tag's memory.
By Jonathan Collins
Tags: Standards
"A lot of these attacks are common knowledge to IT security professionals, but what is different is that no one expects these attacks to come from an RFID tag," says Melanie Rieback, a Vrije University Ph.D. student who presented the group's findings today in a paper at the IEEE conference Pervasive Computing and Communications (IEEE PerCom) in Pisa, Italy. The paper, entitled "Is Your Cat Infected With a Computer Virus?," is available at the group's Web site.

The goal of the group's work, says Rieback, is to ensure that commercial RFID middleware developers, as well as RFID deployers developing their own middleware, address the potential of security attacks emanating from tags. "It is early enough not to cause too much damage," she says. "What would have been worse is if this threat had been discovered only through the work of a malicious hacker in five years' time, when many RFID systems have been deployed."

According to Ashton, the group's development of its own middleware to test the system underestimates the security built into commercially developed RFID middleware. "The RFID industry is an offshoot of the IT industry, and that industry has always taken security very seriously," he says. "Some of the earliest work at the Auto-ID Center addressed security."

"We've built security features into every part of the EPCglobal Network," says Hutchinson, "not just in the air-interface protocol, but also into the application-level events protocol and into the higher-level [elements] used for data discovery and track-and-trace applications."

While such virus attacks may be possible in theory, says Ashton, good software development practices would ensure that these vulnerabilities would be extremely unlikely to be found in any RFID network. "There are any number of hurdles that a piece of malicious code would have to overcome [to do any damage]," he claims, adding that RFID interrogators alone would detect rogue tags or rogue software on tags as part of the verification process of reading them.

Nonetheless, Tanenbaum believes a system using read-write tags are at the greatest risk because a system compromised by a single malicious tag could be used to create many more infected tags. One example is the tag used in RFID-enabled baggage-handling systems already in operation at Las Vegas' McCarran Airport. Once infected, Tanenbaum claims, baggage tags could be used to infect baggage-handling systems worldwide as bags with infected tags move to and are read at other airports.

The potential threat from RFID viruses is compounded further, say the researchers, by the interaction RFID tags enable between physical objects and events and computer systems. "In the past, if these attacks were used on a PC, then it might crash the computer, but RFID merges the real world and the virtual world, and so there is the potential for real and much more severe consequences," Tanenbaum says.

Ashton, however, asserts that the comparison with PC systems underlines a problem in the research group's work. "RFID systems are built using middleware, software and database systems, as well as custom software to act as a glue between these elements," he explains. "Every [RFID system] is unique, not like a PC desktop system. There would have to be stupid holes in the system vulnerable to attack, and the attacker would need intimate knowledge of those holes. If that were ever the case, the attacker wouldn't use RFID as a weapon of choice."


Attila Kis 2006-03-17 11:03:13 AM
the Virus in RFID tags article indicates wrong approach The article makes one think the industry is taking the wrong approach. It speaks of the defense that the RFID tags don't have sufficient capacity to transmit a virus. The limitation on the capability of the normal tags is not a defense to an attack by a sophisticated attack computer system, which has unlimited capability, sending a virus containing message to the global readers. The limitation is only relevant in (possibly) setting up a defense that the reader won't accept and transmit any information message above a certain number of bytes. Then you address whether the virus can be transmitted within that size message.
Mari Lathrop 2006-03-21 12:08:05 PM
Tag viruses With this issue, as in most situations, perception trumps reality. Many people outside the industry get their news and form their opinions from sound bites. With headlines of identity theft and database hacking a daily staple, negative news from a credible source will be enough to begin grassroots oppostion that gets legislative attention. BusinessWeek just covered this very subject. While I am not qualified to argue the merits, I know enough to suggest that those who can show that tags can be compromised need to be invited to debate our industry experts in an open forum covered by the national press, such as RFID Journal Live. Answering these claims in an industry newsletter will not convince anyone outside our little sphere

Login and post your comment!

Not a member?

Signup for an account now to access all of the features of RFIDJournal.com!

Case Studies Features Best Practices How-Tos
Live Events Virtual Events Webinars
Simply enter a question for our experts.
RFID Journal LIVE! RFID in Health Care LIVE! LatAm LIVE! Brasil LIVE! Europe RFID Connect Virtual Events RFID Journal Awards Webinars Presentations