Hacking the RFID Network 213
An anonymous reader writes "The world's largest retailers are developing the EPC Network as the infrastructure for a global rollout of item-level RFID. In many ways this 'Internet of Things' resembles the ISBN system or CueCat's codes-to-content. But the network built for tracking consumer goods could also be used for intangible items: airline seats, music tracks or service calls."
Sounds like they're working (Score:5, Insightful)
Track music downloads and service calls? That's billions of unique items every year. How many items do these RFID tags support?
Re:Sounds like they're working (Score:2, Informative)
Google says that in here [kisseyet.co.uk] (maybe here? [216.239.41.104]) there's a claim of supporting up to 550 billion unique ID codes with this manufacturer.
It seems to vary significantly depending on which provider you choose, but that's 91.6 RFIDs per human being on Earth. It's about 1800 RFIDs per human being in the United States.
(PSA [anti-slash.org] of anti-slash)
Re:Sounds like they're working (Score:3, Interesting)
Re:Sounds like they're working (Score:2)
Re:Sounds like they're working (Score:2, Funny)
Re:Sounds like they're working (Score:2)
Re:Sounds like they're working (Score:3, Insightful)
On the other hand selling RFID stamps kind of makes sense - they don't get postmarked, just used once, and can be used for routing along the way ... urgh - that means that junk mail doesn't even need to print addresses on the outside, just stick a stamp addressed to you ....
Re:Sounds like they're working (Score:2, Interesting)
What might make sense is to reserve a pool that expire every X number of years. Use that for perishables or disposables. Probably would need interim periods between expiration and re-activation.
BTW the cost of putting RFID on mail, at least in the forseeable future, is prohibitive. Not for UPS style
Re:Sounds like they're working (Score:2)
Make that three. Unfortunately, that happens, although it is very rare. However, how many bits are there in a MAC address? How many bits will there be in the RFIDs? Using totally BS statistics, if the MACs had had one more bit on the right-hand side, you might have only met one person with a collision. If they had 3 more, you probably never would have met one.
Is there a predetermined ID length for the RFIDs?
Re:Sounds like they're working (Score:5, Informative)
Re:Sounds like they're working (Score:5, Funny)
Re:Sounds like they're working (Score:2)
Ask Bill (Score:2)
640k items should be enough for everybody
So this means.... (Score:5, Funny)
Airline seats are intangible? (Score:5, Funny)
Since the article summary is cryptic... (Score:5, Informative)
What they're saying is that RFID can be applied to intangible information - content rather than the physical media - just like ISBN/Library_of_Congress system uses an identifier for a book rather than an instance of it.
In other words: RFID can be extended to apply to an entire class, rather than instances of it, as is usually done.
Bet somebody'll mention how this is great for pr0n in the next 5 minutes.
Re:Since the article summary is cryptic... (Score:2)
By the way, there's a difference between "cryptic" and "written by an idiot". Thanks for answering the question I was about to post, which was: "The story here is what?"
FINALLY (Score:5, Funny)
Re:FINALLY (Score:5, Funny)
Re:FINALLY (Score:2)
You got modded "funny" but really that *is* the point.
Re:FINALLY (Score:2)
RFID for finding all those misplaced things. (Score:2)
Then there's the problem of misplacing the reader. I think I'd want to have it "want" to be in a docking station in a fixed location, and start making noise after a few minutes "away from home".
Re:RFID for finding all those misplaced things. (Score:2, Insightful)
Assuming for the moment that we're talking about the passive RFID tags (such as those produced by Alien and Matrics), then the tiny chip on the tag gets its power by receiving the RF signal generated by the transmitter, and uses that power to send back a signal saying "here's my data".
Now assuming the usual inverse square stuff, and allowing that the signal back from the chip is being sent with about 30 dB attenuation,
Re:RFID for finding all those misplaced things. (Score:2)
Wow! Finally, a job for all those who never progressed beyond "Hello, world!"
Hmmm (Score:3, Insightful)
What does "hacking" have to do with any of this?
Re: (Score:2)
Re:Hmmm (Score:2, Funny)
The requirement for shirt, shoes and a minimum age of 18 to be served alcohol.
Re:Hmmm (Score:2)
Re:Hmmm (Score:3, Interesting)
Re:Hmmm (Score:2)
Re:Hmmm (Score:2)
How close did it have to be to the tag? Would you first have to find out exactly where the tag was to kill it? (How hard is that, anyway?) I suppose you could just keep zapping different areas until the receiver stopped getting a signal, but that could be rather tedious.
Re:Hmmm (Score:2)
It is possible, but quite difficult. The main problem is that they are noisy, making it quite difficult to do it sneakily -- especially when the target notices a giant weaving contraption floating above their head.
Re:Hmmm (Score:2)
Excuse me, but put your tinfoil hat back on, buddy. That extra "power" is the ability to read basically the same info without having to physically touch the item. That's about it. Instead of putting the reader an inch away from a specific location printed on a box, you just prance around the warehouse, waving your "wand" to do inventory. Certainly more fun than barcodes.
Also, unless there are RFID readers every 10 feet on every street, there's not
So what happens .... (Score:5, Funny)
"err sir ... you appear to be stealing an elephant from our store .... err um please turn out your pockets ... wait I was wrong you appear to be carrying the entire housewares department ..."
Re:So what happens .... (Score:4, Insightful)
Could anyone who understands RFID perhaps enlighten us about what sorts of security is built into the system?
Re:So what happens .... (Score:5, Interesting)
I'm not sure about security on the password exchange, but with how little thought seems to have gone into the other "standards", I wouldn't be surprised if it was plaintext.
Hamster
Re:So what happens .... (Score:2)
For devices that small, I don't necessarily think that it would be a password, per se, but just a short string of bits. In addition, these things aren't exactly PCs, with the power to handle encryption, so I believe it wouldn't really be a viable option.
More likely, the RFIDs are premade with the n bit security key and if it 'hears' that key, it starts writing the next packet to its own memory, if it reads a respond request, it sends its ow
Re:So what happens .... (Score:4, Interesting)
Not only could you drive any Walmart's system into the ground (allowing someone to get away with shoplifting), but you could sabotage someone else, sending them into a no-cameras room for a visit with store security. I confess to some degree of ignorance here, but are there any mechanisms in place in RFID systems to prevent such sabotage/DOS attacks?
One more point--what's to prevent ME from bugging the store and datamining everyone's shopping habits? I imagine an RFID detector would be simple to build, require little power, take little room, be easy to hide by the doors of a store, and would be able to intercept all radio traffic between the RFID tags and store equipment.(/me thinks for a second) Wow, that's kind of scary.
Re:So what happens .... (Score:2)
RFID means it can actively search out the things I want it to find, without having to be so heavy on the remote control.
Re:So what happens .... (Score:2)
Yes, it may look invisible, but security may become suspicious seeing a stereo walk off by itself.
Re:So what happens .... (Score:5, Informative)
In answer to your first question, fairly difficult. You'd need an active device which listens for a query from a reader, and responds as though it were a tag. Also, the tag is just responding with essentially the same data as a barcode; any code that isn't in the master database in the sky will be ignored. And the readers can handle a large number of tags (read rate for some readers is >1000 tags/sec, and will only get better), so a DoS will be pretty difficult. Not something you'd wire-wrap in your garage.
Hamster
Re:So what happens .... (Score:2)
Re:So what happens .... (Score:2)
433 MHz is a band for industrial comtrol/communication systems, I don't think it is used for RFID purposes. (I may be wrong, but I think they are typically using lower frequencies.)
But don't worry about Walmart. They cause enough problems around them (car traffic, pollution, waste, damage to previous retail infrastruc
Re:So what happens .... (Score:2)
Also, we're ignoring the antenna length. If the tag has a 1/16" antenna, you'll be lucky to read the tag from two inches away, much less from half the width of the currently-installed gateways.
Hamster
Re:So what happens .... (Score:2)
Practicality, perhaps? Odds are you don't care about an individual's shopping habits, or you'd be stalking him. So if you need to know what Walmart customers are buying lots of, why not just buy lunch for a Walmart stock clerk and ask him? Easier, and probably a lot more effective.
Re:So what happens .... (Score:2, Insightful)
Hmm. How likely is that to ever happen?
Re:So what happens .... (Score:2, Interesting)
A friend of mine got into a situation a bit like this and was about to sue someone (she just couldn't figure out who) .... people kept cutting up her credit cards and bank cards, BART (magnetic train) tickets would also stop working etc etc when she explained this to me at the movies once my immediate questio
Their "Object Name Service"... (Score:5, Informative)
Re:Their "Object Name Service"... (Score:2)
ae99d2b01957e827e4b4eea0f5520d6e ons-1.0.tar.gz
596126f77a460818902d4253c3927feb ons-content-server-1.0.tar.gz
b65115
And no doubt, trackable. (Score:5, Insightful)
Then we've got the registering everything idea. If we put RFID tags on everything that can go for 100 feet, and if everything has a unique identification code, then the government can ask for a list of which codes are associated with which objcts. Then, as stuff is baught, you swipe through your drivers lisence and a database is updated with what you have. Combine this with bank account data, wifi hotspots on poles that are constantly pinging devices, garbage trucks equiped with rfid scanning technology, and other pieces of information, and you've got one hell of a spying system. All those evil laws the people in power dream of would be possible.
If there was a law that said the RFID tags could only be put on removable stickers, and must have a range limited to less than 5 feet, then it'd be ok. It's the "weaving them into products" thing that's got everyone upset. Infact, if that weaving thing didn't exist, I think RFID tags would be pretty neat; you could buy a bunch of food and query it through your house, which could download and update a database of recipe's which could be setup on some kind of whacky algoritm that figures out which is going to go bad first.
The only problem there is that as the chips evolve, we'll be throwing small flash cards on em with advertising or more complicated systems of ensuring produce hasn't been tampered with, which if the laws don't change, will require licensing since you're copying; licensing to eat, not a good thing.
AS far as tracking people is conserned, we all know of the mark of the beast, and we all know that tracking accounts with rfid tags is just plain stupid. If you're going to track a person, have them wear a wrist band or something; even the guys on star trek didn't have that little pin thingy embedded in their forhead.
Re: (Score:3, Insightful)
Re:And no doubt, trackable. (Score:2)
I wouldn't have a problem with RFID if I could take the tag off of whatever I bought and dispose
Re:And no doubt, trackable. (Score:5, Funny)
Re:And no doubt, trackable. (Score:3, Informative)
Please do not use GPS as an example. The signal for GPS is sent by satellites, presumably with large antennae. The signal for RFID is sent by the RFID tag (at least, the signal you're interested in reading) which has a small antenna and operates with very low power. The GPS [transmission] antenna only needs to handle a certain range of orientations of receiver to sender, and RFID must broadcast omnidirectionally because you cannot guarantee the orientation of the tag.
What scares me is that eventually sh
Re:"FUD" -- not! (Score:2)
I know one thing about the sellers; they are profit driven and they must do so by law. They bribe government officials to pass laws, have no problem knowingly buying goods produced out of slave labour at insane profits, and finally, they have no
Re:"FUD" -- not! (Score:2)
I know you weren't asking me, but I do not agree with that statement. Privacy demands the right to go about our business, however we see fit, without having someone TRACKING any tags we might have on our person. Having a GPS device does not automatically make you less private. When a privacy invas
Re:And no doubt, trackable. (Score:2)
Re:And no doubt, trackable. (Score:2)
Re:Use a thermo-bag for your groceries (Score:2)
Not to invalidate your opinion in any way, but I seriously doubt Al-Qaida is getting off on the thought of temporarily disrupting the St. Louis WalMart's inventory control system. The effort to make a microwave bomb would be much better spent doing something else. Although, I would prefer they do that over sinking a cruise ship...
intangible: airline seats and japanese children! (Score:4, Interesting)
i, for one, welcome our rfid tagged japanese overlords.
Re:intangible: airline seats and japanese children (Score:5, Insightful)
Dear lord...that'd be one screwed up place...
Re:intangible: airline seats and japanese children (Score:2)
I'm not sure I agree with that one. It ignores the vastly different cultures and the effects they have on people. The Japanese live in a rather different society than you or I.
-Erwos
Re:intangible: airline seats and japanese children (Score:2)
Their society is decaying in much the same way ours is. They are a different people, but all people's on the planet have the same values, but different ways of going about it. You can worship a non-existant god
Re:intangible: airline seats and japanese children (Score:2)
Services (Score:2)
Tag your plumber.
Just how intangible .. (Score:5, Interesting)
Re:Just how intangible .. (Score:3, Funny)
Re:Just how intangible .. (Score:2)
I was just about to embark on a flame when my sarcasm sensor finally kicked in, and I remembered all of the rape/schoolgirl shit from their comics. Indeed. They like their young girls in Japan.
Re:Just how intangible .. (Score:2)
RFID/UPC/IP6 ? (Score:2)
I'd like to scan in that barcode at the bottom of a Walmart Reciept and import all the tag information about what I bought to my home database and/or spreadsheet.
ISBN, UPC, VIN are all fairly standard. The artical wants a standard for reusable resellabl items. Bus tickets, subway tickets, airplane tickets, and movie tickets all come to mind.
I'd love to be able to track/search/use all this information for my own personal use.
RFID identity dilution (Score:3, Insightful)
When people get tired of or wear out their RFID clothes and then give them to Goodwill or sell them through consignment stores, tracking systems will think they're in multiple places at the same time.
So does this mean I should or should *not* start buying all my clothes at the second-hand store when RFID rolls out?
nn
Re:RFID identity dilution (Score:2)
intangible seats? (Score:2, Funny)
Instead of RFID tracking everything why not.. (Score:4, Funny)
Imagine a super beowulf cluster of those...
Er wait...
Sorry . . . (Score:2)
Open Source RFID (Score:2, Interesting)
A good use for existing RFID tags (Score:5, Interesting)
I think a good idea would be to make pet doors that can "learn" to unlock only when certain RFID tags are within 4 or five feet. You could set it for the pets you own, and other pets (and/or other critters) wouldn't be able to get in.
Also, if your pets didn't have the chips implanted, you could just get a chip on a collar.
Alaska Jack
Re:A good use for existing RFID tags (Score:3, Informative)
Magnetic [pet-dog-ca...-store.com]
Infrared [pet-dog-ca...-store.com]
Re:A good use for existing RFID tags (Score:2)
I came VERY close to doing almost exactly this a few years back. We have two cats, each with kidney issues requiring a special diet. The kicker is, they each had their own food, and eating the other's would just make their own problem worse. So we had to pour out their food, stand there and watch them eat, then when it looked like they were done, take it away.
So I was all se
Re:A good use for existing RFID tags (Score:2, Insightful)
Security at the beginning (Score:5, Interesting)
I remember a commercial where a shifty guy walks through a store stuffing things in his jacket, and then walks out of the door to be stopped by security. The guard informs him that he forgot his receipt, hands it to him, and sends him on his way. I'm all for putting checkers out of work, but if such an environment existed, it would also be profitable to spoof the system.
As they are currenly used, I suppose the only profit would be to either disable the tags or somehow make the store think it has already been purchased. That brings me to the next issue. I assume most people have tried to walk out of a store with a purchased tagged item where the checker forgot to take off the tag. It is annoying and embarassing. Imagine if this could happen with every article of clothing that you own because the store database gets screwed up.
Re:Security at the beginning (Score:2)
There's password protection to avoid the obvious method of theft, but I'm not sure how secure that is. Plus, it would be easily detectable if someone were using an unauthorized reader inside the store; they're literally broadcasting their position and
Re:Security at the beginning (Score:2)
If the store is equipped to detect this. You can also use a limited-range transmitter, trading radiated power for distance, and using highly directional antenna, further reducing the necessary radiated power.
Another method is a pulse transmitter keyed by the preamble of the tag response, forcing collision into every tag answer. You
Seek and destroy (Score:4, Interesting)
Is there any way to destroy such a tag embedded in electronics? Would it be possible to make the tag a vital part of the electronics in such a way that its destruction would lead to immediate equipment failure?
Are the signals easy to spoof?
Re:Seek and destroy (Score:2)
If you're microwaving water beware of superheating [snopes.com]
With regard to electronics, RFID's can be remotely killed without the use of a microwave by sending a specific signal. Thi
Re:Seek and destroy (Score:2)
AFAIK only the writable part of only some tags can be written to, not the laser-burned unique ID and all RO tags work till they fail from mechanical stress.
Re:Seek and destroy (Score:2)
Re:Seek and destroy (Score:2)
Don't worry, there is a device in development for remote disabling of car engine control computer, using a microwave beam; effectively an EMP gun. I suppose it could be used for frying RFID tags, either on its own, or after tweaking its output frequency to hit the tag's resonance frequency.
We don't have to design anything ourselves. We just have to wait a while, until both RFID and EMP technologies hit the road, then put the
Re:Seek and destroy (Score:2)
In other news, Diesel engines are making a comeback!
Those activists aren't too bright. (Score:4, Interesting)
Maybe I'm just spoiled being a hardware engineer, but it seems to me that the people who are crying about these RFID tags and privacy are just plain ignorant.
I can tell you it will be trivially easy to build a jammer for them. Maybe a little harder to build an RF source with enough energy to burn out their cute little itty-bitty diodes. And until they get wise and start putting challenge/responce encryption in them, building a box to spoof them would be a weekend project for your average Radio Shack hobbyist.
Will someone please educate them about the technology so they can devote their time to something that really matters? (If they want something to bitch about, they can read my blog for ideas. [blogspot.com])
I might just wait until they're manditory in license plates and walk parking lots blowing them all out, (but probably not being a grownup and all.) Perhaps I should have posted as AC just for suggesting it. (Damned Patriot Act bastards.)
Re:Those activists aren't too bright. (Score:2)
Yeah, it might interfere with your AM radio...
Seriously, why?
Re:"Excessive? Consider the usages" (Score:2, Insightful)
It's not the merchants' _ostensible_intended_ usages which are excessive, Virginia; it's the _potential_ uses, by corporations, hackers, private snoops, governments, etc.
Jeez, things are going way beyond Ben Franklin's famous saying about trading liberty for security. Lately, I've been seeing way too many of these examples of people being nai
how to make money off all this... (Score:2)
Someone needs to make an RFID jammer. A little keychain size device that jams any RFID traffic within one's personal space, rendering any RFID tags you're carrying to be effectively inert. Surely something like this should not be hard to make.
I'd buy one.
Re:how to make money off all this... (Score:2)
Re:how to make money off all this... (Score:2)
A bit off-topic
Re:how to make money off all this... (Score:2)
Unless you are successful at assaulting yourself... Suicide is illegal.
Also, even if assaulting yourself isn't illegal, there's a chance you will be detained anyway -- for psychiatric evaluation.
better than hacking, would be simply more tags (Score:2, Funny)
Overwhelm the system and it becomes useless.
Re:Tags are disabled after use (Score:2)
How hard would it be for an evil government to place a reader under every stripe of every zebra crossing, in the middle of every roundabout and under the threshold to every entrance to every single public building in the country? Public transports could also use some tracking devices...
Hook 'em all up on a country-wide radio network, link tracking requests to credit c
Re:Mexican Officials Get Chipped - Assinine Idea (Score:2)
More likely implementation: a proximity landmine or a roadside bomb, with his "name" written in. Maybe, with more high-tech adversary, even a homing missile or a drone.
I can pretty well imagine one of those little UAVs that were described here on Slashdot couple weeks ago, autonomous, loaded with a RFID scanner and a small shaped charge (and a camera in order to double as a one of the Eyes in the sky),
Re:RFID Database (Score:2, Interesting)
Why not? The idea with the ONS is that someone (VeriSign, per the contract that EPCglobal let) will run a fairly small (and replicated by others) root service to say, "If you want to know about EPC=XXXXXX..., you need to look over there," and give a pointer to PepsiCo. At PepsiCo (or some agent of PepsiCo's choosing, say IBM, or GXS, or whomever), there'll be services to further parse the request, and direct it to an appropriate target. PepsiCo could choose to construct a single huge database with entrie