Link.

Last week, at the Black Hat Federal security conference, Chris Paget of IOActive was scheduled to present an ironically titled presentation “RFID for Beginners”. In this presentation, according to the abstract and interviews with Chris, he was going to present how to build a working RFID clone from $20 worth of off-the-shelf electronic parts, mostly from eBay. The maker of the target chip is HID, who threatened lawsuits and otherwise made it ugly and consequently IOActive decided to cancel the presentation, citing the difficulty of bringing these difficulties to a small company.

The chip “hack” he was going to speak about would have allowed for the surreptitious, non-secure reading of the HID chip. HID’s comments include one about protecting against a “major upheaval”among customers. A representative also said someone would have to get “within 2-3 inches and get into the same plane as the card.” Well, if they’re saying it’s not practical, why did they threaten lawsuits about the presentation?

However you look at it, the situation highlights security concerns dogging RFID progress.

Anyway, what do you think? Is the repackaging and sharing of one’s own research public domain? Or is it irresponsible to demonstrate the security vulnerabilities of a supposedly secure market product?

Technorati tags: RFID