Access Without Permission: A Practical RFID Relay Attack

Roman Silberschneider; Thomas Korak; Michael Hutter

Access Without Permission: A Practical RFID Relay Attack

Roman Silberschneider, Thomas Korak, Michael Hutter

Institut für Angewandte Informationsverarbeitung und Kommunikationstechnologie (7050)

Publikation: Beitrag in Buch/Bericht/Konferenzband › Beitrag in einem Konferenzband › Begutachtung

Abstract

n this paper, we present a practical relay attack that can be mounted on RFID systems found in many applications nowadays. The described attack uses a self-designed proxy device to forward the RF communication from a reader to a modern NFC-enabled smart phone (Google Nexus S). The phone acts as a mole to inquire a victim’s card in the vicinity of the system. As a practical demon-
stration of our attack, we target a widely used access control application that usually grants access to office
buildings using a strong AES authentication feature. Our attack successfully relays this authentication process via a Bluetooth channel (> 50 meters) within several hundred milliseconds. As a result, we were able to impersonate an
authorized user and to enter the building without being
detected.

Originalsprache	englisch
Titel	Austrochip 2013, 21st Austrian Workshop on Microelectronics, Linz, Austria, October 10, 2013, Proceedings
Erscheinungsort	Linz
Herausgeber (Verlag)	.
Seiten	59-64
Publikationsstatus	Veröffentlicht - 2013
Veranstaltung	21st Austrian Workshop on Microelectronics: Austrochip 2013 - Linz, Österreich Dauer: 10 Okt. 2013 → 10 Okt. 2013

Workshop

Workshop	21st Austrian Workshop on Microelectronics
Land/Gebiet	Österreich
Ort	Linz
Zeitraum	10/10/13 → 10/10/13

Fields of Expertise

Information, Communication & Computing

Treatment code (Nähere Zuordnung)

Application

Zugriff auf Dokument

austrochip13_relay.pdfEingereichtes Manuskript, 2,32 MB

SeCoS - Verbundene Welt [Original in Englisch: Secure Contactless Sphere Smart RFID-Technologies for a Connected World]
Bösch, W., Wenger, E., Khan, H. N., Schmidt, J., Gadringer, M. E., Spreitzer, R. C., Mendel, F., Gruss, D., Hutter, M., Freidl, P. F., Görtschacher, L. J., Mangard, S. & Grosinger, J.
1/01/13 → 31/12/15
Projekt: Forschungsprojekt
FWF -ReSIT - Umsetzung eines sicheren Internets der Dinge
Hutter, M., Wenger, E., Schmidt, J., Mendel, F., Mangard, S. & Posch, R.
1/07/12 → 31/05/16
Projekt: Forschungsprojekt
RFID Security
Wenger, E., Hutter, M., Oswald, M. E., Posch, K., Plos, T., Herbst, C., Schmidt, J., Feldhofer, M., Szekely, A., Dominikus, S., Aigner, M. J., Kirschbaum, M., Medwed, M. & Posch, R.
1/01/05 → 15/07/19
Projekt: Arbeitsgebiet

Dieses zitieren

@inproceedings{c6fcc8d13b344ca79ada34c6be070cd1,

title = "Access Without Permission: A Practical RFID Relay Attack",

abstract = "n this paper, we present a practical relay attack that can be mounted on RFID systems found in many applications nowadays. The described attack uses a self-designed proxy device to forward the RF communication from a reader to a modern NFC-enabled smart phone (Google Nexus S). The phone acts as a mole to inquire a victim{\textquoteright}s card in the vicinity of the system. As a practical demon-stration of our attack, we target a widely used access control application that usually grants access to officebuildings using a strong AES authentication feature. Our attack successfully relays this authentication process via a Bluetooth channel (> 50 meters) within several hundred milliseconds. As a result, we were able to impersonate anauthorized user and to enter the building without beingdetected.",

author = "Roman Silberschneider and Thomas Korak and Michael Hutter",

year = "2013",

language = "English",

pages = "59--64",

booktitle = "Austrochip 2013, 21st Austrian Workshop on Microelectronics, Linz, Austria, October 10, 2013, Proceedings",

publisher = ".",

note = "Austrochip 2013, 21st Austrian Workshop on Microelectronics : Austrochip 2013 ; Conference date: 10-10-2013 Through 10-10-2013",

}

TY - GEN

T1 - Access Without Permission: A Practical RFID Relay Attack

AU - Silberschneider, Roman

AU - Korak, Thomas

AU - Hutter, Michael

PY - 2013

Y1 - 2013

N2 - n this paper, we present a practical relay attack that can be mounted on RFID systems found in many applications nowadays. The described attack uses a self-designed proxy device to forward the RF communication from a reader to a modern NFC-enabled smart phone (Google Nexus S). The phone acts as a mole to inquire a victim’s card in the vicinity of the system. As a practical demon-stration of our attack, we target a widely used access control application that usually grants access to officebuildings using a strong AES authentication feature. Our attack successfully relays this authentication process via a Bluetooth channel (> 50 meters) within several hundred milliseconds. As a result, we were able to impersonate anauthorized user and to enter the building without beingdetected.

AB - n this paper, we present a practical relay attack that can be mounted on RFID systems found in many applications nowadays. The described attack uses a self-designed proxy device to forward the RF communication from a reader to a modern NFC-enabled smart phone (Google Nexus S). The phone acts as a mole to inquire a victim’s card in the vicinity of the system. As a practical demon-stration of our attack, we target a widely used access control application that usually grants access to officebuildings using a strong AES authentication feature. Our attack successfully relays this authentication process via a Bluetooth channel (> 50 meters) within several hundred milliseconds. As a result, we were able to impersonate anauthorized user and to enter the building without beingdetected.

M3 - Conference paper

SP - 59

EP - 64

BT - Austrochip 2013, 21st Austrian Workshop on Microelectronics, Linz, Austria, October 10, 2013, Proceedings

PB - .

CY - Linz

T2 - Austrochip 2013, 21st Austrian Workshop on Microelectronics

Y2 - 10 October 2013 through 10 October 2013

ER -

Access Without Permission: A Practical RFID Relay Attack

Abstract

Workshop

Fields of Expertise

Treatment code (Nähere Zuordnung)

Zugriff auf Dokument

Fingerprint

Projekte

SeCoS - Verbundene Welt [Original in Englisch: Secure Contactless Sphere Smart RFID-Technologies for a Connected World]

FWF -ReSIT - Umsetzung eines sicheren Internets der Dinge

RFID Security

Dieses zitieren