[Zixem]

[img]http://img24.imageshack.us/img24/1800/5o9x.png[/img]

Hello, today I'm going to write about a "new" technology which still not very popular, but it's getting attention in the last years.
It's called RFID. RFID stands for Radio Frequency Identification.
Actually, this is a little device(some sort of a sticker) which attached to an object(a card club, for example). The interesting idea behind this sticker is the radio thing - the sticker sending\broadcasting its identification wirelessly on the radio wave to the RFID reader(we'll talk about this later).

So, why did I write the word "new" in double-quotes(1st line)? Because that technology has been around for a long time. Actually, it was invented almost 100 years ago.

A little introduction

About six years ago, Ministry of Communications allowed a civil use of RFID(at least in my country). The frequency range 915-917MHz was approved. And then the market started to grow.

The whole "system" divided into two main parts: transponder and interrogator.

• Transponder(The tag)
  
  It's a little tag which can broadcast its stored information wirelessly. Every tag like this is made from two main parts: a little chip and internal\external antenna which stands for broadcast the data on the chip. Usually, the tag won't be connected to any energy source and it'll use the energy which it gets from the electro-magnetic field which the RFID-Reader makes. But it doesn't always like that.
  On every tag, there's a kind of chip: read-only chip, write-only chip and a read-and-write chip. It has 2MB memory space. But to every chip which we can write, there's a sector that contains a unique data of the chip which can't be overwritten.
  
  There are three types of RFID transponders: Passive, Active and semi-passive.
  
  • Passive RFID TAG
    Transponders with passive RFID system don’t have power source(like, duh! passive...). It's powered by electromagnetic field which generated by reader.
    
    ‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰ ‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰ ‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰ ‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰ ‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰ ‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰ ‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰ ‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰ ‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰ ‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰ ‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰ ‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰ ‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰ ‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰ ‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰
    
  • Active RFID TAG
    RFID tag attached to an energy source, so it can transmit its information at any time and from a long distance of the electromagnetic field.
    
    ‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰ ‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰ ‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰ ‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰ ‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰ ‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰ ‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰ ‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰ ‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰ ‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰ ‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰ ‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰ ‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰ ‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰ ‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰
    
  • Semi Active TAG
    RFID tag which uses a small battery, but the data transmission
    made by using external energy, such as the electromagnetic field of the reader.
    
    
  ‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰ ‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰ ‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰ ‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰ ‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰ ‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰ ‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰ ‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰ ‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰ ‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰ ‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰ ‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰ ‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰ ‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰ ‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰‰
  
• Interrogator(The reader)
  This is the tag reader, it attached to an internal\external antenna.
  The reader generates an electromagnetic field in a specific frequency which big enough to supply an energy source for the transponders around.
  

The attack

This is how the whole method of using RFID works:

1. A RFID tag is attached to an object(a card, for example). This tag contains a unique code which allows to the interrogator read it.
   
2. If it's an Active-Tag, the tag will send the code without stopping, if it's a Passive\Semi-Active tag, the tag won't send the code, but when it'll be in an electromagnetic field which generated by the reader, the reader gets the code.
   
3. The tag reader is set and ready to receive data from the tag on the same frequency.
   
4. The card reader transmit the data which it received from the RFID tag to a computer that its job is to manage\use the information(bank system, access cards, items in a shop, etc.)
   

Now imagine the scenario: we want to enter a building, but we have to get an access card.
Attacking sequence
In order to attack some target, we'll have to get some tools. They're pretty cheap and totally legal:

• RFID Reader\Writer(Point-RX, S300, XR-400, J168)
  
  
• RFID Cable(SM8836, SM8837, SM8838)
  
  
• Driver for the RFID Reader\Writer
  -no pic-
  

• First step - getting the information
  This step is pretty hard(people who saw Prison Break last season will know, lol).
  You should turn on the reader and get close to the target(some card holder). After the reader finished to read the tag's data, we can move on to step two.
  
  
• Step two - Card issuance
  Now, the program that came with the reader\writer's driver will save the data and write it in our clear new card.
  Just for the record: You can also use RFDump to write\read raw data of the tag(in XML format).
  
  
• Step three - using our fake card
  This is where the fun begins(unless the tag wasn't encrypted), we'll go to the building's door, put our card and...let the party begin.
  It's just like breaking into someone's house: we take the key's print, make a copy and enter the house.
  Btw. not only cards use the RFID technology. Car keys, hotel doors, phones and a lot of stuff are being used with RFID.
  

How to protect yourself

So, what can we do in order to get some protection from being a RFID Hijacking victim?

• Use RFID tags based on a smart identification mechanism which is located before the broadcast information such as CryptoRF tags.
  
• Use RFID tags which are realizing the RSA principle, and thus actually prevent from different sources to get to the non-encrypted information.
  
• Use token based RFID tags
  
• Use RFID tag which based on encryption keys of 128-bit and more(BUSlink, for example)
  

Some relevant links

http://www.rfidjournal.com/articles/view?1415
http://www.videogold.de/iw/chaos-communi...-security/
http://www.altera.com/products/devkits/a...2C20N.html
http://tv.boingboing.net/2008/03/19/how-...rfide.html
http://rfidiot.org/

shouts to Th3PonyWizard, peace.
Spoiler (Click to View)
p.s: sorry for grammar mistakes.

[Bewbs]

Wow this is actually a nice and fking interested tutorial!
Thanks :)

[Keeper]

I'd lie if I say that I'm gonna read it since I'm not into hardware but anyway nice to see something new.

[-๖ۣۜDivine-]

Looking good mate. Very nicely written.

[ida]

This looks interesting, and I will definitely read more about this.

[nicksaban1]

Nice tutorial, but RFID has been around for years. It's not mainstream because it is not useful at home. RFID has a range of up to 200 meters on the 3 GHz band, but doesn't go through walls. The Soviet Union used it to track its own agents to see if they were double crossers.
This post might have helped a little when I did a term paper on RFID.

Another useful tidbit is that the Govn't is injecting these in citizens to track them (without their knowing by having surgeons and dentists inject them) /
edit- saw "new" sry

[axmetmcl]

thanks for this nice tutorial, i am sure i will try it in a short time :)

[mmuzammil]

I remember a few years ago, this attack also happend.
It was in London Picadilly circus, there were some Paki's parked in a car with all these things, and they were getting everybody's details of there bankpas.

They made 2,3 million and after that they got caught by the FBI.

[SIM-1808688]

I must admit this is a very interesting tut, looking forward to see more :-)

[Mad76e]

Now things getting interesting.. Good work!

[WealthyHustler]

This is actually getting really scaring knowing that this is starting to get popular :O

[Zixem]

thanks everyone

Nice tutorial, but RFID has been around for years. It's not mainstream because it is not useful at home. RFID has a range of up to 200 meters on the 3 GHz band, but doesn't go through walls. The Soviet Union used it to track its own agents to see if they were double crossers.
This post might have helped a little when I did a term paper on RFID.

Another useful tidbit is that the Govn't is injecting these in citizens to track them (without their knowing by having surgeons and dentists inject them) /
edit- saw "new" sry

no worries :3
glad you liked it

This is actually getting really scaring knowing that this is starting to get popular :O

indeed ._.

[Shanks]

I really.. don't understand this kind of things but looks like a very well written guide and will probably help a lot of users.
Good work!

[.Cobra.]

thanks for this nice tutorial, i am sure i will try it

[Ergo]

Finally, something that isn't a "RAT Setup" or another pointless "SQLi Tutorial".
Nice tutorial.