SMB - BLACK HAT - Lawsuits, patent claims silence talk

27.02.2007
A planned talk on RFID security by a security researcher has been pulled from this week's Black Hat Federal security conference after secure card maker HID claimed the talk violated the company's patent rights and threatened to take legal action against Chris Paget, the researcher, and IOActive, Paget's employer, if the talk went forward.

The company decided to cancel the talk after all-night negotiations with HID collapsed, said Josh Pennell, CEO of IOActive. In response, Black Hat organizers were forced to tear materials out of printed show proceedings and will instead present a discussion by a representative of the ACLU on the criticality of RFID security, said Jeff Moss, founder and director of Black Hat.

A spokeswoman for HID did not immediately respond to a request for comment.

The incident recalled a 2005 involving Cisco Systems and Michael Lynn, a security researcher who worked for Internet Security Systems at the time.

IOActive's decision to abort their presentation follows days of , after HID became alarmed about Paget's discussion, "RFID for beginners," which was to address widespread security issues with the implementation of RFID in proximity cards that are sold by HID and other companies. Paget's RFID cloning device was , where he how the device could be used to steal access codes from HID brand proximity cards, store them, then use the stolen codes to fool a HID card reader.

Paget's presentation at Black Hat Federal would have included'schematics and source code that attendees could use to create their own cloning device, and a discussion of vulnerable implementations of RFID technology in a wide variety of devices, Paget told InfoWorld at RSA earlier this month.