At H2K2 there was a panel on proximity cards. For those who don't know these are those plastic ID type cards you typically wave by a "pad" to open secure doors, etc. They use the same technology as RFID tags.

One speaker demonstrated a small "device" he assembled consisting of a laptop computer, a HID prox reader and a Wiegand-to-serial converter in a briefcase. He not only demenstrated it, but told how he was able to carry it through a mass transit system and and collect a number of prox ID numbers just walking past people.

Now some of these systems are secure, they use more of an encrypted challenge/response type of protocol, but those systems are more expensive. Most systems just query for an ID number. The typical RFID, because of cost and size, just spits back a number

The same technology can be employed against credit cards/documents using RFID unless they use a more secure system.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/169/20633#20633