Blog: William McKnight

Main

March 3, 2007

RFID chip hacking presentation pulled from conference under threat of lawsuit

Link.

Last week, at the Black Hat Federal security conference, Chris Paget of IOActive was scheduled to present an ironically titled presentation “RFID for Beginners”. In this presentation, according to the abstract and interviews with Chris, he was going to present how to build a working RFID clone from $20 worth of off-the-shelf electronic parts, mostly from eBay. The maker of the target chip is HID, who threatened lawsuits and otherwise made it ugly and consequently IOActive decided to cancel the presentation, citing the difficulty of bringing these difficulties to a small company.

The chip “hack” he was going to speak about would have allowed for the surreptitious, non-secure reading of the HID chip. HID’s comments include one about protecting against a “major upheaval”among customers. A representative also said someone would have to get “within 2-3 inches and get into the same plane as the card.” Well, if they’re saying it’s not practical, why did they threaten lawsuits about the presentation?

However you look at it, the situation highlights security concerns dogging RFID progress.

Anyway, what do you think? Is the repackaging and sharing of one’s own research public domain? Or is it irresponsible to demonstrate the security vulnerabilities of a supposedly secure market product?

Technorati tags: RFID

Posted by William McKnight at 3:36 PM | Permalink | Comments (0)

February 20, 2007

Can RFID be this small?

Next time you reach for the pepper shaker, you may have to wonder if it has a little something extra in it. APPARENTLY Hitachi has developed powder-size RFID tags, the pictures of which are all over the internet showing this little spec on a finger and a bunch of specs around an enlarged human hair (example link). However, after an exhaustive search for a legitimate news item on this, I am beginning to wonder if this story is real. Maybe it’s because I reported on the chips in coins, which turned out to be untrue, but I’m just skeptical about this one.

The reported size is 0.05mm x 0.05mm and the suggested use is not actually for ingesting, but for anti-counterfeit measures.

If you have any information, links or opinions on the feasibility of these chips, please comment here.

Continue reading "Can RFID be this small?" »

Posted by William McKnight at 5:11 PM | Permalink | Comments (1)

December 8, 2006

Ripping off the antenna

Are you tired of searching for those RFID tags on your clothing? According to this article, IBM has developed a chipped tag, adopted by Marnien Management Ltd., that allows you to remove the antenna from the tag easily. I note that the chip itself will remain on the item, so reading will still be possible, but the read range will be limited without the antenna.

Perhaps this is a workable middle ground in the emerging battle between industry and privacy. It does clearly expose the tag to the consumer, which should be more important to privacy advocates than the easy ability to "rip off" the antenna. After all, most consumers are unaware of the tag. This would be a blow to data collection since many would get ripped off and put the consumer in more control of when their tag is read although surreptitious reads are still possible without an antenna.

Continue reading "Ripping off the antenna" »

Posted by William McKnight at 3:35 PM | Permalink | Comments (0)

July 14, 2006

RFID for the Information Management Professional

Why push RFID now to the information management market? Waiting for RFID to be 100% proven and standardized is missing opportunities now for ROI. Instead of taking the Wal-Mart mandate and doing the bare minimum, it's a good time to leverage the mandate and incorporate tracking information into the entire supply chain process.

I tend to focus on the things that information management professionals will get into and treat information management as the profession, not data warehouse, or other architectural construct, management. Over just the past few years, that has included DW and CRM (with arguments about which came first), ERP, clickstream, data quality and master data management - anything to do with large volumes of data. In other words, these are the things that an information management career can easily consist of. I'm anticipating adding RFID data management to this list.

As for organizations venturing into RFID, we're talking about innovation. What strikes me is the high variation in RFID applications - it's everything from experimental gadgetry to bet-your-business risk prevention and supply chain management. Whether this data gets added to the data warehouse or, more likely, an ODS-type structure, it's us, the information management professionals, that will manage it.

Organizations should think about "what is causing my sub-par decisions?" and if any of that be alleviated with an RFID approach. Chips can be in practically anything. Does having chips on many things sound far-fetched? IIn 1981, we thought of the personal computer this way.

Posted by William McKnight at 7:22 PM | Permalink | Comments (0)