What do you get when you combine a $250 used RFID scanner purchased on eBay and a low-profile antenna stashed in your car as you drive around Fisherman’s Wharf in San Francisco? Well, if you’re Chris Paget, you get a half-dozen or so electronic passports within one hour. And thousands of viewers to your video on YouTube and numerous comments on Engadget.
Oh yea, and many articles about your successful hack as well. Including one by Kelly Jackson Higgins of Dark Reading, who explains that, “The security weaknesses of the EPC Gen 2 RFID tags, which lack encryption and true authentication, have been well-known and of concern to privacy advocates for some time. These tags are being used in the new wallet-sized passport cards that the U.S. Department of Homeland Security offers under the new Western Hemisphere Travel Initiative for travel to and from Western Hemisphere countries.”
An article by Dan Kaplan of SC Magazine quotes Paget as stating, “I personally believe that RFID is very unsuitable for tagging people, so I don’t believe that we should have any kind of ID documents with RFID tags on them,” he said. “So my dream for this research would be to see the entire Western Hemisphere Travel Initiative just be scrapped.”
Pretty harsh words across the board. As Vantage has a number of RFID clients, I decided to ask Vivek Khandelwal, Director of Marketing for Verayo, for his opinion on the subject. Vivek said, “I wouldn’t agree that RFID itself is inappropriate for the WHTI application. I firmly believe that RFID is a great technology for identification application if it ensures that it can prevent unauthorized access to the identity information and protect information stored in the identity document, even if it lands in unauthorized entities.”
According to Vivek, the problem is with the technology currently used. “Unfortunately, the current WHTI cards issued so far are based on long read range RFID (UHF). And even worse, these long read range RFID chips don’t have security of any kind, they can be cloned and they emit all information in the clear to any sneaking reader. But technology exists today that can perhaps be incorporated into the future versions of these cards that can address the security issues.”
He went on to say, “Verayo provides a silicon ‘biometric’ technology that makes these ID chips effectively ‘unclonable.’ Verayo’s silicon biometrics technology works just like human biometric technology, such as fingerprints or DNA. With Verayo’s technology, DHS could collect silicon fingerprints of the ID chip in each WHTI card they issued, and then authenticate the card at the port-of-entry by comparing the ID chip’s silicon fingerprints with those they collected before issuing. It is effectively impossible to copy or model these silicon fingerprints from one ID chip to the other, making these ID chips effectively unclonable.”
So it turns out that there really is a debate over the security of RFID. I look forward to continuing the discussion.
Written by Tory Klaubo Patrick