Back in the 1990's when web servers first came about we used to warn about things like buffer overflows. The web types would say "those form fields are just ASCII, nothing to do with executables." The operating system vendors would say "those input functions are just accepting URLs or data - no executables."
This is pretty much what happens with every new technology, with every new protocol: the good guys get together and design something to work efficiently and maybe at the end try to sprinkle on some security. The good guys are thinking about how legitimate users will legitimately use the system to make it do what it is supposed to do. They are largely unable to comprehend how malicious users will make the system do things it is not supposed to do.
The RFID industry (see article below) is just the latest to repeat this pattern.
11-05-2006
RFID Viruses Pose No Threat for Access Control Applications
IRVINE, Calif. (USA)"RFID is a broad term that encompasses everything from simple devices that contain a few thousand transistors and feature little or no security to contactless smart cards which are tiny computers that contain several million transistors and incorporate military grade security," said Peter Lowe, Chief Technology Officer for HID Global, the premier manufacturer of contactless access control cards and readers for the security industry, in response to recent claims that RFID technology can spread viruses.
The current research on RFID viruses focuses on read/write RFID tags used for such applications as animal tagging and product identification in retail, and asserts that readers could interpret data stored on RFID cards as executable instructions. According to Lowe, the reality is that readers never interpret the contents of a card as executable code; they always interpret the contents as data only.
Lowe added that some smart cards do use read/write technology, such as those using HID Global's iCLASS® technology. "The benefit of this technology lies in the enhanced security it offers through encryption and mutual authentication, making it less susceptible to tampering. Other techniques such as the use of digital signatures can be employed to verify the authenticity of data on a card and that the data came from a trusted source," he said.
Lowe also cited statements made by RFID scientists and experts from the International Organization for Standardization (ISO) at a recent AIM Global meeting in Kyoto, Japan. The scientists and experts, responding to the research, emphasized "that there are two broad types of RFID tags, ones that have pre-encoded, or fixed data, and ones that have data that can be changed. Systems with fixed data such as those used to identify pets cannot be changed and therefore are immune to infection by a virus."
Furthermore, most readers that control doors remain read-only and could not rewrite a card. "Comparing RFID tags used in animal identification and supply chain applications to contactless smart cards used in our industry is like comparing go-carts to military tanks," concluded Lowe.
For more information: www.HIDCorp.com
Comments