Until recently, radio frequency identification devices were only used as tags for merchandise, shipping containers and livestock. These devices are small chips that transmit data about tagged items via radio signals to readers that record the data. RFID use has its benefits, one being that RFID-enabled containers are automating the inventory-tracking process; goods no longer have to be manually logged as the RFID system automatically relays that data to supply chain management. But the same convenience also extends to thieves, who can exploit RFID security weaknesses to either spoof shipments or track shipments themselves to steal tagged goods.
RFID security concerns
Now that RFID chips are embedded with some credit cards, the possibility for credit card fraud is opened up. Security and privacy experts say their worst fears may have been realized with RFID cards that can openly "spray" personal information through the air; some fear a malicious user could build a reader to steal credit card numbers from cards, even while supposedly safely tucked away in a wallet.
The University of Massachusetts' findings did not help. In an experiment, the school successfully "sniffed" the names and account numbers from a sample batch of RFID-enabled credit cards using only $150 worth of homemade equipment. In an effort to quell fears, credit card companies responded by refuting the findings.
First, they argued their customer information is adequately protected. They claim that RFID signals are 128-bit encrypted, and that actual names and card numbers aren't transmitted. Instead, they use a dummy number that can be translated into the card holder's account information during processing at their facilities. However, the researchers countered that the cards they checked -- Visa's 'Contactless', MasterCard's 'OneSmart' and American Express ExpressPay -- all emitted actual names and account numbers without encryption.
Then the card companies claimed the researchers' sample -- only 20 cards -- was too small and that there hadn't yet been any reports of such attacks, or devices like the one the researchers built. But that's security by obscurity, and security by obscurity is no security at all.
RFID security challenges
Still, there are some inherent security challenges in RFID chips on credit cards that need to be understood. An RFID chip is tiny and has an equally small amount of memory and capacity. That limits the number and length of encryption keys that it can hold, making it a challenge to implement things like public-private key exchanges needed for strong encryption.
It also helps that for the most part RFID chips are static. Again, their small capacity makes it hard to build a programmable chip that can be finely tuned. Once data has been burned on a chip, it's there for good and is hard, if not impossible, to change. Some chips have a limited ability to be programmed remotely, but not much.
Securing RFID credit cards: Best practices
Instead of delving further into the debate, let's examine some best practices for securing RFID credit cards. Unfortunately, for the consumer who already has such a card, there isn't much protection available, since security for these cards still isn't mature. Using a Faraday cage (a box with a wire mesh to block radio signals) to carry cards isn't a realistic option for most card users, nor is taking a knife and cutting the chip out of the card altogether.
However, it is possible to perform due diligence before filling out an application to see if such a card meets certain minimum security standards. Here are four questions an RFID card applicant should ask the issuer before signing an agreement:
- What data is actually being sent? Is it the credit card number or a dummy representation of it? RFID chips can be programmed to send dummy numbers that are matched to accounts on the card processor's back-end system. If the dummy number were sniffed, it would be useless to the casual credit card thief.
- Is the data transmitted from the card encrypted and, if so, what is its strength? If the card transmits real customer information -- including the cardholder's name, account number and expiration date -- then all data should be sent encrypted. Only strong encryption -- a minimum of 128 bits -- should be used.
- How far does the card transmit data? RFID chips should only be able to transmit a few feet, not out to the parking lot. The shorter the distance, the lesser the risk of malicious capture of data en route.
- Does the issuer have back-end fraud-detection systems? Check if the issuer uses a fraud-detection system, like Fair Issac Corp.'s Falcon Fraud Manager on its back end to check transactions during processing. This doesn't protect the loss of data from the card itself, but it still can block fraudulent transactions by numbers sniffed maliciously from RFID cards.
Remember, RFID credit cards security is still evolving. While these suggestions might not provide total RFID security, they offer some mitigating controls and protections to cardholders in the meantime.
About the author: This was first published in November 2006
Joel Dubin, CISSP, is an independent computer security consultant. He is a Microsoft MVP in developer security, specializing in Web and application security, and the author of The Little Black Book of Computer Security available from Amazon.
This was first published in November 2006