Verichip - Is it all that Secure?

I was amazed at the following piece reporting on the effortless manner, "Verichip's" security could be breeched. This, during a time when the world is placing so much effort on Tracking abilities for it's chattel.

Demo: Cloning a Verichip
cq.cx...

In Brief: Verichip markets their product for access control. This means that you could have a chip implanted, and then your front door would unlock when your shoulder got close to the reader. Let us imagine that you did this; then, I could sit next to you on the subway, and read your chip's ID. This takes less than a second. At this point I can break in to your house, by replaying that ID. So now you have to change your ID; but as far as I know, you cannot do this without surgery.

Now, this makes me wonder.

If this young lady can acquire this information using simple readers as this, what sort of details can be lifted off "Other RFID's" such as Passports, or Identity Cards, containing Proximity Scanning Chips. Could these be "Breeched" with such ease?

And if so, there goes the whole arguement for this I.D. push.

And here's another report regarding this.
blogs.reuters.com...


Ciao

Shane


[edit on 28-7-2006 by Shane]

And it did not take much, to find another situation that is becoming possible.

RFID Chips: Hacking Demo Shows Threat to Databases
by SPYCHIPS.COM
www.conspiracyplanet.com...

Privacy and civil liberties advocates have long been opposed to the use of RFID technology on consumer items and government documents because it can be used to track people without their knowledge or consent. But now security researchers are warning RFID systems are vulnerable to viruses that could wreak havoc on databases around the world and potentially facilitate a terrorist attack.

Melanie Rieback, a Ph.D.student at the Vrije Universiteit in Amsterdam,gave a live demonstration of how a hacker could deploy a single rogue RFID tag and infect associated databases at the Fourth Annual IEEE Conference on Pervasive Computing and Communications held in Pisa, Italy, March 15........

....Radio Frequency IDentification (RFID) is a controversial technology that uses tiny microchips to track items from a distance. These RFID microchips have earned the nickname "spychips" because each contains a unique identification number, like a Social Security number for things, that can be read silently and invisibly by radio waves. Security experts have theorized that RFID would be targeted by hackers, but until now, most considered the limited memory on the tags insufficient to deliver such attacks.........

......This damage could start with one attacker writing malicious code onto
his cat's microchip and exposing it to the vet's system, she claims. But that's just the start. Her university's press release about the
discovery points out how such malicious code could infect retail
databases and even RFID-based airport baggage systems, leading to more
serious consequences, like a terrorist debilitating a baggage database
in order to slip in a lethal suitcase:

"A malicious individual could put an infected RFID tag on his suitcase
(or someone else's suitcase). The bag will be scanned when approaching a Y-junction, to determine which direction it should go. However the mere act of scanning could infect the airport's baggage database, and as a result, all bags checked in after could receive infected baggage labels.

As these bags move to other airports, they would be rescanned -- and
within 24 hours, hundreds of airports could be infected worldwide. A
smuggler or terrorist using this technique could hide baggage from
airline and government officials.".........

......"We've long contended that RFID will put all of us at risk," says
McIntyre. "This is a wake-up call to RFID proponents who are recklessly rushing the technology into the marketplace before the serious societal consequences of tracking everyday objects and people with this technology can be fully explored."

So, this is getting worst. Now the Whole Data System could also be vulnerable.

Wonderful news.

And these other Young Ladies have a Site specific to this problem at the following.
www.spychips.com...

Quite a bit of interesting reading in here.

Ciao

Shane

As the article states, Verichip is a dog tag. Having security in an animal identification system is counterproductive, therefore, anyone can interrogate for the serial number it contains.

Other systems have security, some more aggressive than others. TIRIS, for example, can be broken with a brute-force attack using DSPs or a vector engine. You see TIRIS in those gas station dongles.

The passport ICs have the ability to use incredibly strong security. Whether or not they DO is up to the system implementors. I don't know how much of it they use. But the parts have very strong hardware encryption engines, and the part itself can mount quite a good defense against basic SIGINT attacks, if it's enabled to do so.

The tracking aspect of it is wildly overblown, especially by the young ladies at www.spychip.com. Of course, they're using their own viral marketing technique to sell their somewhat less than technically accurate book.

But it is darn fine reading, if you don't care so much about the reality aspect.

The "virus" thing isn't quite right. They're stretching it like a Gumby. But there is an issue. First, that comment about the cat tag is bogus. The Verichips have a simple numeric code. That's like saying I could walk up to you and say "11332433422" and you'd go insane. Sorry.

The more complex tags that can return strings, if the system programmer is a total retard, can in fact cause damage to databases. This is a case of the programmer not doing any data validation whatsoever. Sadly, that happens a lot (Windows, anyone?) and this is yet another example of the problems that result.

For example, a lot of the same buffer overflow attacks that C is so prone to can be used if the tag is returning a lot of data. Another example, if you expect the tag to have identification data that is fed to SQL, and as the happy, trusting, programmer you are, you don't expect to EVER get any bad data from the tag, you just pass it to SQL unscreened.

So the hacker writes into the tag (this also assumes the hardware implementor is a retard and didn't lock the tag or implement any basic security) an SQL string that has a false terminator and a new command string. Yay! Since SQL is an interpreter, it will interpret that just as if it were a line of code. Now you can erase the tables, alter them, you name it. In some SQL's I can cause a program to execute.

Their "virus scenario" assumes that someone has managed to write a file full of malicious code to the computer but can't get it to run. So the tag issues an execute command from a high privilege that runs the file, using the bogus command trick.

That's maybe a big stretch. But the problem is real, IF the implementors don't use any security in the tags so that anyone can rewrite one, IF they don't lock the tags against further mods, IF the programmer doesn't screen the tag data etc etc.

That's a lot of if's, but I have seen many a website that sends data structures to the client, including java and _javascript, that a malicious client can alter, allowing it to return unexpected responses. You should never ever let the client side have the chance to do that. But many many websites do. For example, maybe ATS's login script does a fetch using _javascript to see if you are banned. If you are, then the script prevents you from logging in. But with a quick tweak, I can simply bypass that. I've seen websites that work that way. Hell, some shopping carts will allow me to mod the prices that way. Sloppy programming can ruin anything. The tag processing code should NEVER EVER just stuff the tag return into a string and use it without doing some basic checks.

So Tom Bedlam

1: You are suggesting that Verichip's Dog Tag, is less the Security Features, WE WOULD EXPECT, since it's simply a Dog Tag. That's possible, I guess.

There hasn't been any "DOCUMENTED" diffierences in the Designs so far from the One Application (Dog Tags) to the other Application (People Tags), but maybe they are just keeping this to themselves, (Verichip)

2: Security should be higher, with other RFID's as well, so that Corruption would be extremely difficult in a Database.

Well, I would also hope, that was the case.

And thanks for giving an excellent reply to this matter. You seem to have a grasp on the workings of these Tracking Devices.

And you comments are understood. There is ample room to fill a Post full of IF's.

But it still makes me wonder, since all will be tied within the Framework of the SIS II Database, and implemented Globally, you have to think a lot of people will have access to those Data Bases, and Stupid in, Stupid Out, seems like a possibility as well.

I have another Topic about this, I have been working on at the following, which ties the intent together, in the case of the Database. Have a look if you wish.
www.abovetopsecret.com...

And Thanks again Tom.

Ciao

Shane

Shane:

Yeah, I come by it dishonestly: a big handful of us co-own a business that primarily does military contract design and "non-cooperative system integration" or as the Genl put it, you guys are hired gun trouble-shooters.

As part of that, I have done quite a few RFID designs. So I'm pretty conversant with it, although that's more hardware side than software. I can trudge through the software parts. We have guys that do that more efficiently than I do. But I have done my share of coding. Maybe it's my distrusting nature but in a military setting I'd never think to pass unscreened responses to the rest of the system.

However, that's what a lot of C programmers do in the commercial world. The nature of C sort of provokes it, I guess, especially for strings. Still, a nice input filter would work wonders for stopping this sort of crap.

The tracking aspect of it is much less than you'd expect. That book has a great deal of intentional mis-scoping. It's sort of like saying it's dangerous to own a cat, because cats are known to kill and eat people. Yes, but at the front of the sentence you're talking about Mr Whiskers, and at the end you're talking lion. Well, true, they're both cats, but they're not both HOUSECATS for God's sake.

There are a lot of very different animals called 'RFID tags'. Some are housecats.

The Verichip is an example of an H-field passive tag. It cannot be read at a distance. Period. To get so much as 24" of read distance, you'd need a very complex interrogator. Yes, I could scrape up against you, IF I knew where your tag was implanted, and get the tag's data if it weren't protected against such interrogation. But I couldn't, say, read it from across the street, or from an airplane or whatever.

Since we have a SCIF, we have to have entry control. Among other things, that means RFID tags. I have one in my pocket and another on a dogtag. Mine aren't so easily copiable as the Verichip.