NYT: Study says RFID tags are vulnerable to viruses

[harpo]

By John Markoff
The New York Times

Published: March 14, 2006, 11:05 PM PST

A group of European computer researchers have demonstrated that it is possible to insert a software virus into radio frequency identification tags, part of a microchip-based tracking technology in growing use in commercial and security applications.

In a paper to be presented Wednesday at an academic computing conference in Pisa, Italy, the researchers plan to demonstrate how it is possible to infect a tiny portion of memory in the chip, which can hold as little as 128 characters of information.

Until now, most computer security experts have discounted the possibility of using such tags, known as RFID chips, to spread a computer virus because of the tiny amount of memory on the chips.

http://news.com.com/Study+says+RFID+tags+are+vulnerable+to+viruses/2100-1029_3-6049872.html?tag=nefd.top

[soothsayer]

1. Good!

[Gormy Cuss]

5. Heh!

I hope they're only slightly more prone to viruses than MS operating systems.
:evilgrin:

[rpgamerd00d]

2. Unless they are magic RFID tags, they are also vulnerable to...

... electro-magnets.

One good de-gaussing and they are fried and useless just like any other pieces of computer hardware.

[tanyev]

3. Hmmm...isn't Wal-Mart using these things extensively?

It sure would be a shame if something crashed their entire system.

[harpo]

12. yes they are...I want a "perimiter zapper" so I can...

go walk through one of their stores and zap all their crap

[libertypirate]

4. Something that might be possible in the future

Software errors

"We have not found specific flaws" in the commercial RFID software, Tanenbaum said, but "experience shows that software written by large companies has errors in it."

Fear Fear Fear....

Does any really understand how many characters 128 are? This includes spaces.

This post is more than 128 characters.

[leveymg]

6. What kind of a virus can exploit such small memory chips?

All it could do, I suspect, is corrupt the signal. Wouldn't you need some long lines of code to change the RFID message in a meaningful way, and how would one change the coding after the chip is implanted?

[rpgamerd00d]

7. Observe, Grasshopper. :)

128 characters.
A "character" is actually a byte. A byte its two bits.
That's 256 bits of code.
In assembler language, you could read the rfid code and change it randomly, with about 100 bits of code.

The problem would be distributing the virus, since RFID chips don't talk with each other.

[leveymg]

8. So, it could corrupt the code, but not in any meaningful way?

[rpgamerd00d]

9. Meaningful, because the RFID tag is now useless.

You now have 10,000 unmarked packages which you must sort by hand instead of by computer.

FUBAR.

[leveymg]

10. But, you can't change the ID of package A so it reads as Package B?

[rpgamerd00d]

13. Depends. If it added 1 to all tags, then yes, A could read as B, etc.

[harpo]

14. so instead of paying for for productA with productA pricing, it thinks

its productB which may be a different price

[harpo]

11. or 10,000 pounds of nuclear material that is now missing

that was bound for India. That's what can and will happen if they start relying on this technology as the only means to track...aka saving someone money by eliminating the "person" that would normally watch and keep an eye on it.

[Harald Ragnarsson]

16. Or maybe insert RFID info of the $1000 TV set into the $3000 one.

The modern technological equivalent of switching price tags on items?

[Deja Q]

15. Duh