RFID chips can carry viruses

A surprising bit of research from the Netherlands has found that RFID systems …

It can sometimes be forgotten that computer viruses are not a Windows-only problem, but the recent announcement that RFID chips may be vulnerable to viral attack underscores the threat that malicious code can pose to all types of systems. A group of researchers at Vrije Universiteit in Amsterdam have just presented a paper (PDF) at the Pervasive Computing and Communications Conference in Pisa, Italy that demonstrates just how such a virus might work.

In a website designed to showcase their work, the research team describes how simple vulnerabilities in the backend database software (particularly buffer overflows) can be exploited by maliciously-designed RFID chips. Once this has happened, the virus is then able to propagate itself to other chips when their data is queried by an RFID reader.

"Up until now, everyone working on RFID technology has tacitly assumed that the mere act of scanning an RFID tag cannot modify back-end software, and certainly not in a malicious way. Unfortunately, they are wrong. In our research, we have discovered that if certain vulnerabilities exist in the RFID software, an RFID tag can be (intentionally) infected with a virus and this virus can infect the backend database used by the RFID software. From there it can be easily spread to other RFID tags. No one thought this possible until now. Later in this website we provide all the details on how to do this and how to defend against it in order to warn the designers of RFID systems not to deploy vulnerable systems."

If the group's claim holds up, it represents a potentially massive blow to the current RFID industry, which would need to get far more serious about security. Currently, most RFID systems have little in the way of encryption or other security features, in part because it was not believed that the tags could be remotely modified, or that they could cause much economic damage. But imagine what could happen to a company like Wal-Mart, which has forced most of its suppliers to adopt RFID technology already. A malicious disruption of Wal-Mart's supply chain could cost the company millions. Or take the group's own example, that of RFID tags on luggage at airports.

"Consider a malicious traveler who attaches a tiny RFID tag, pre-initialized with a virus, to a random person's suitcase before he checks it in. When the baggage-handling system's RFID reader scans the suitcase at a Y-junction in the conveyor-belt system to determine where to route it, the tag responds with the RFID virus, which could infect the airport's baggage database. Then, all RFID tags produced as new passengers check in later in the day may also be infected. If any of these infected bags transit a hub, they will be rescanned there, thus infecting a different airport. Within a day, hundreds of airport databases all over the world could be infected. Merely infecting other tags is the most benign case. An RFID virus could also carry a payload that did other damage to the database, for example, helping drug smugglers or terrorists hide their baggage from airline and government officials, or intentionally sending baggage destined for Alaska to Argentina to create chaos (e.g., as revenge for a recently fired airline employee)."

That would be bad enough, but it gets even scarier when you consider that the State Department has already begun to issue RFID-enabled passports. Think for a moment about all the places that RFID systems are deployed, and it quickly becomes clear that this is not simply an economic issue, but a security one as well. So why would the researchers so openly publicize this new vulnerability? In their own words, it's because people "often dismiss security concerns as academic, unrealistic, and unworthy of spending any money on countering." The researchers want to prod the RFID industry into action, and so in addition to showing how to create an RFID worm, they also show people how to prevent one from spreading.

Now, so as not to seem too alarmist, it's important to note that traditional computer systems are vulnerable to viruses as well. Still, we use them all the time, including for mission-critical applications. Hopefully, the new research will encourage the industry to beef up the security of tags, readers, and backend systems before RFID viruses move from theory into practice.

Expand full story

You must to comment.