RFID security concerns aren't new. However, when American Express Co. and Chase Corp. began issuing RFID-enabled credit cards last year, those worries grew. Then, in October, when researchers at the University of Massachusetts announced that they successfully compromised credit card RFID security, concerns escalated further.
RFID use
Until recently, radio frequency identification devices were only used as tags for merchandise, shipping containers and livestock. These devices are small chips that transmit data about tagged items via radio signals to readers that record the data. RFID use has its benefits, one being that RFID-enabled containers are automating the inventory-tracking process; goods no longer have to be manually logged as the RFID system automatically relays that data to supply chain management. But the same convenience also extends to thieves, who can exploit RFID security weaknesses to either spoof shipments or track shipments themselves to steal tagged goods.
RFID security concerns
Now that RFID chips are embedded with some credit cards, the possibility for credit card fraud is opened up. Security and privacy experts say their worst fears may have been realized with RFID cards that can openly "spray" personal information through the air; some fear a malicious user could build a reader to steal credit card numbers from cards, even while supposedly safely tucked away in a wallet.
The University of Massachusetts' findings did not help. In an experiment, the school successfully "sniffed" the names and account numbers from a sample batch of RFID-enabled credit cards using only $150 worth of homemade equipment. In an effort to quell fears, credit card companies responded by refuting the findings.
First, they argued their customer information is adequately protected. They claim that RFID signals are 128-bit encrypted, and that actual names and card numbers aren't transmitted. Instead, they use a dummy number that
To continue reading for free, register below or login
To read more you must become a member of SearchSecurity.com
can be translated into the card holder's account information during processing at their facilities. However, the researchers countered that the cards they checked -- Visa's 'Contactless', MasterCard's 'OneSmart' and American Express ExpressPay -- all emitted actual names and account numbers without encryption.
Then the card companies claimed the researchers' sample -- only 20 cards -- was too small and that there hadn't yet been any reports of such attacks, or devices like the one the researchers built. But that's security by obscurity, and security by obscurity is no security at all.
RFID security challenges
Still, there are some inherent security challenges in RFID chips on credit cards that need to be understood. An RFID chip is tiny and has an equally small amount of memory and capacity. That limits the number and length of encryption keys that it can hold, making it a challenge to implement things like public-private key exchanges needed for strong encryption.
It also helps that for the most part RFID chips are static. Again, their small capacity makes it hard to build a programmable chip that can be finely tuned. Once data has been burned on a chip, it's there for good and is hard, if not impossible, to change. Some chips have a limited ability to be programmed remotely, but not much.
Securing RFID credit cards: Best practices
Instead of delving further into the debate, let's examine some best practices for securing RFID credit cards. Unfortunately, for the consumer who already has such a card, there isn't much protection available, since security for these cards still isn't mature. Using a Faraday cage (a box with a wire mesh to block radio signals) to carry cards isn't a realistic option for most card users, nor is taking a knife and cutting the chip out of the card altogether.
However, it is possible to perform due diligence before filling out an application to see if such a card meets certain minimum security standards. Here are four questions an RFID card applicant should ask the issuer before signing an agreement:
Remember, RFID credit cards security is still evolving. While these suggestions might not provide total RFID security, they offer some mitigating controls and protections to cardholders in the meantime.
About the author:
Joel Dubin, CISSP, is an independent computer security consultant. He is a Microsoft MVP in developer security, specializing in Web and application security, and the author of The Little Black Book of Computer Security available from Amazon.
