RFID stands for Radio Frequency Identification, and it is a form of short-range communication between RFID-enabled data chips (like the ones in employee badges or credit cards) and RFID-enabled readers (like electronic access control for doors or credit card readers).
This technology has been around in a rudimentary form since 1945, when a Soviet scientist invented what was essentially the first covert listening device in order to spy on the US during the burgeoning Cold War.
In 1996, RFID was patented in its modern form of a batteryless data tag that can receive radio signals.
And since then, this versatile and cost-effective technology has come to be used in a number of ways including:
- tracking inventory
- contactless credit cards
- toll collection
- security applications
- access control
- employee identification
But as with any technology, with greater usage comes greater opportunity to exploit its weaknesses, and RFID is no exception.
How Does RFID Get Hacked?
Data chips with RFID can be scanned from a distance. This is what makes them so useful, and also vulnerable to hackers.
Long Distance Information Capture
RFID scanners that capture and record ID information are certainly not legal, but for those with the proper skills, they’re easy to build.
Hackers use a long-range reader to silently steal this ID info from any RFID cards that happen to walk by.
For example, a hacker can simply have this device in a messenger bag on a busy morning bus, or sitting outside a targeted workplace, and the reader will harvest information as employees walk past with their badges.
This all happens without leaving any digital trace.
Making a Copy
Once the information has been captured by the hacker, the next step is to make a copy of that card or cards. This is known as “cloning” or “spoofing.”
The cloned card will give the hacker the same digital ID profile as the original, meaning that the hacker then has the same authorization and level of access.
You can see how this could escalate quickly from a hacker simply making it in the front door of the building, to unlocking an access-controlled computer or server room and commencing to do whatever damage they please.
Active Jamming
Hackers can and have jammed RFID cards and tags from working simply by being nearby and generating a signal that is stronger than the one being put out by the RFID reader.
This can make it impossible to track inventory using RFID, while also creating general havoc by preventing access using ID cards.
Eavesdropping
Hackers can also use an antenna to record the communications between real RFID tags and RFID readers. This “eavesdropping” gathers data on how and where RFID tags are used, which the hacker can use to plan and launch bigger attacks later on.
How To Prevent RFID Hacking
There is no single silver bullet to prevent RFID hacking. But there are a matrix of solutions that can be combined for greater security and data protection to protect against RFID hacking.
Use Passive RFID
RFID tags that are classified as “passive” have a much weaker signal than one that is “active.”
While this means that the tag needs to be much closer to a reader in order to work, it also means that long-range hacker scanners are too far away to collect information from a passive RFID tag.
Use RFID Protection Outside the Building
One low-cost, low-tech way to lessen card cloning is by keeping RFID cards and RFID-enabled devices in special pouches or bags that block RFID signals. These prevent the cards from being scanned by a hacker, but they also keep the card from being scanned by legitimate readers, so this solution is best when the card is outside the building and not in frequent use.
Use The Most Secure Cards On The Market
Choose proximity cards that have extra security features that resist hacking and tampering, like the HID Seos product line. (We’ve also talked more about the different cards from the HID brand here.) These cards and their readers have cryptographic algorithms that wrap another layer of protection around the data they contain, essentially equipping them with two-factor identification that makes them much more difficult to hack with a long-range scanner.
Data Correlation to Prevent Card Doubles
To prevent cloned cards from getting in the door, leverage access control technology to your advantage by setting protocols in your access control that disallows duplicates. An RFID card that is already “checked in” and present in the database cannot be checked in again without being checked out first.
Penetration Testing
This is the term for a security exercise where a skilled “white hat” or good-guy hacker deliberately tests your system to see where it has weaknesses and how it could be exploited.
Pen testing is extremely useful because it tests and measures the existent security using the same tactics that a “black hat” or bad-guy hacker would use in a way that is specific to your systems’ layout, access points, and technology. Your security team can then take that feedback and create solutions and protocols to deal with any identified vulnerabilities.
Use Wired Network and Authorizations for Sensitive Information and Equipment
Wireless devices that use RFID access control are convenient, but they are by nature less secure than wired connections, which are far more difficult for hackers to gain access to and infiltrate. So make wired connectivity a must for the most sensitive parts of your network: things like server rooms that store customer info, proprietary information, or operational consoles for important equipment.
Robust Physical Security
Don’t rely on RFID cards to protect your employees, assets, or equipment. A strong physical security system in addition to prox cards and RFID tags is a must for true security in a commercial setting. Access control using prox cards can be reinforced with video surveillance, biometric readers, PIN pads, and other obstacles. All together, these security measures turn your business from a soft target, with multiple weaknesses that can be easily exploited, to a hard target, with a few weak points that are well shored up with secondary safety measures.
