By Robert Vamosi
Defense in Depth
February 21, 2008
WASHINGTON D.C. -- Adam Laurie, an RFID security expert, used the Black
Hat DC 2008 conference here, to demonstrate a new Python script he's
working on to read the contents of smart-chip-enabled credit cards.
As part of his presentation Wednesday, Laurie asked for someone from the
audience to volunteer a smart card. Without taking the card out of the
volunteer's wallet, Laurie both read and displayed its contents on the
presentation screen--the person's name, account number, and expiration
Demonstrations like that show the potential misuse of RFID technology in
the near future. Without touching someone, a thief could sniff the
contents of an RFID-enabled credit card just in passing. The same is
true for embedded RFID chips in the human body, work access badges, some
public transit cards, and even the new passports in use in more than 45
As a disclaimer, Laurie said he spoke to American Express, the company
that issued the volunteer's card. Laurie said that American Express told
him: "We are comfortable with the security of our product." Laurie added
that the company told him the number he displayed on the presentation
screen was not the account number printed on the card, which Laurie
proved by opening the wallet and comparing. However, Laurie noted that
the captured account number could still be used for online transactions.
The credit card industry has argued that use of the RFID-enabled cards
will save customers time when processing payments.
An extreme example can be found in Spain. Laurie said a public beach
there encourages visitors to have RFID tags injected into their bodies.
The point? Merchants along the beach scan your wrist to obtain a unique
ID from which they can debit your account. The advantage? You won't have
to go to the beach with your wallet, which might get stolen.
Laurie, who has an injected RFID-tag, showed how easy it was not only to
read the tag, but also to re-write the tag. During his demo, he used the
coding sequence reserved for animal tagging to have his RFID chip
declare him an animal.
On his RFIDiot Web site, Laurie offers the Python scripts free of charge
and also sells the hardware necessary to read and write to RFID tags and
Subscribe to InfoSec News