Battle brewing over RFID chip-hacking demo

27.02.2007

"These systems are installed all over the place. It's not just HID, but lots of companies, and there hasn't been a problem. Now we've got a person who's saying let's get publicity for our company and show everyone how to do it, and it puts everyone at risk. Where's the sense of responsibility?" Carroll said.

According to Moss, HID has charged Paget with patent infringement over his presentation, but has not laid out any particular remedies or threatened actions, making it difficult to ascertain what the company might do -- if anything -- to block the presentation.

Security problems with implementations of RFID are well known and have been publicized before. In 2005, security consultant Jonathan Westhues detailed attacks against implanted VeriChip RFID chips. More recently, in January, Westhues posted for an RFID hacking device that can act as a reader, eavesdrop on RFID transactions between reader and a tag, analyze the signal received over the air, or impersonate a tag.'

In 2005, Avi Rubin and other researchers at Johns Hopkins also sounded the alarm about weak security in RFID implementations by that is used in late model car ignition systems and electronic payment systems, as well.

All that attention hasn't sparked much change at companies like HID, which makes fifteen different types of proximity cards in their Prox Products and Indala Prox Products lines, all of which are believed to be vulnerable to cloning, according to Paget.