full-disclosure - RFID Attack theory

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <7d85153f0606292001y39a52154rbe901cf01f102b84@mail.gmail.com>
Date: Fri Jun 30 04:02:02 2006
From: joshuaperrymon at gmail.com (Josh L. Perrymon)
Subject: RFID Attack theory

I have read more since the initial post in regards to RFID hacking.

"session replay" would probably be the best approach if you wanted to clone
the contents of an RFID Proximity Card, Access Card, so on..  Basically
anything that uses static data on the card for identification. I have been
informed that each RFID chip/card has a UID burned in similar to MAC's on
network cards.. so it's easier to replay this than to locate a blank card
and burn the data.

So most of the research has been done here already.. Which brings me to the
work done by www.rfidvirus.org
They have some really good ideas about attacking the middleware using SQL
injections, SSL includes, and buffer overflows on the reader to middle ware
interface. Some really good stuff.

What about attacking the reader itself and not the middleware... you
wouldn't have to worry about "cloning" or "session-replay" at this point.
The ISO defines the protocol used to communicate from the reader to the
card. Then the reader to the middleware so on...  What if you would attack
the reader and exploit it directly before even going to the middleware to
the app logic...??

I'm thinking that the middleware will send some type of confirmation to open
a door for instance. So if you could reproduce this by exploiting the
communication between the card and the reader you could open the door.

My thinking was more along the lines of when certain types of authentication
of encryption is used.. that if you could exploit the communication protocol
itself then you could bypass the proposed layers of security.

JP
www.packetfocus.com
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20060630/fc647e16/attachment.html