Like other security devices, RFID-devices are not as secure. Although RFID-devices are widely used, the security threats they require require us to resolve them before deployment.

01RFID forgery

Depending on computing power, RFID can be divided into three categories: normal labels; labels that use symmetric keys; and labels that use asymmetric keys.

Among them, ordinary tags do not perform any encryption operations, and are easy to forge. But ordinary tags are widely used in logistics management and tourism. Attackers can easily write information into a blank RFID tag or modify an existing one. The label to obtain the access rights corresponding to the authentication system using the RFID tag.

02RFID sniffing

RFID-sniffering is a major problem in RFID-systems. RFID readers always send information requesting authentication to the tag. When the reader receives the authentication information sent by the tag, it uses the back-end database to verify the tag authentication information. legality,

But unfortunately , most RFID tags do not authenticate the legitimacy of RFID readers . Then attackers can use their own readers to retrieve the contents of the tag.

03 tracking

By reading the contents of the tag, the attacker can track the movement of an object or person. When a tag enters the range readable by the reader, the reader can identify the tag and record the current position of the tag.

Whether or not the communication between the tag and the reader is encrypted, the fact that the tag is being tracked cannot be evaded. The attacker can use the mobile robot to track the position of the tag.

04 Refusal Service

When the reader receives the authentication information from the tag, it compares the authentication information with the information in the back-end database. Both the reader and the back-end database are vulnerable to denial of service attacks.

When a denial of service attack occurs, the reader will not be able to complete the authentication of the label and cause other services to be interrupted. Therefore, it is necessary to ensure that there is a corresponding mechanism for preventing denial of service attacks between the reader and the backend database.

05 deception

In a spoofing attack, the attacker often fakes himself as a legitimate user. Sometimes, the attacker will fake himself as the administrator of the back-end database. If the forgery is successful, the attacker can do whatever he wants, for example. : Corresponding invalid request, changing the RFID ID, rejecting the normal service or simply implanting malicious code directly into the system.

06 denied

The so-called denial is that when a user refuses to admit that he has done it after performing an operation, when denying the sending, the system has no way to verify whether the user has done this operation.

In the use of RFID, there are two possible denials: one is that the sender or receiver may deny an operation, such as issuing an RFID request, at this time we have no evidence to prove whether the sender or receiver has issued RFID requests; the other is that the owner of the database may deny that they have given any request for an item or person.

07 insertion attack

In this type of attack, the attacker attempts to send a system command to the RFID system instead of the original normal data content. A simplest example is that the attacker inserts the attack command into the normal data stored in the tag.

08 retransmission attack

The attacker intercepts the message with the reader by intercepting the communication between the tag and the reader, and then retransmits the message to the reader afterwards. An example of a retransmission attack is that the attacker records the tag. Information for authentication between the reader and the reader.

09 physical attack

Physical attacks send information that an attacker can physically touch a tag and tamper with the tag. Physical attacks can occur in a variety of ways, such as: using micro-probes to read and modify tag content, using X-rays or other rays to destroy tag content, using Electromagnetic interference destroys the communication between the tag and the reader.

In addition, anyone can easily use a knife or other tool to manually destroy the tag so that the reader can't recognize the tag.

10 virus

Like other information systems, RFID systems are vulnerable to virus attacks. In most cases, the target of the virus is the back-end database. RFID viruses can destroy or leak the contents of tags stored in the back-end database, reject or interfere with the reader and Communication between the end databases. In order to protect the backend database, it is necessary to fix database vulnerabilities and other risks in a timely manner.