Evan Schuman's StorefrontBacktalk

Accusations that RFID-based contactless credit cards can be easily read by thieves are nothing new, but this time, a group of scientists at the Univ. of Mass. has gone quite far to try and prove it.

The group?calling itself the RFID Consortium for Security and Privacy–is a group of computer scientists from the University of Massachusetts at Amherst, RSA Laboratories and Innealta with some non-traditional partners, including the San Francisco Bay Area Rapid Transit District (BART), the MIT Auto-ID Labs and the Programme for Advanced Contactless Technology (PROACT) at Graz University of Technology, Austria. The National Science Foundation funds much of the research, according to the group’s Web site.

The group tested about 20 samples from various contactless credit cards and concluded that “the cardholder’s name and often credit card number and expiration are leaked in plaintext to unauthenticated readers” and “our homemade device costing around $150 effectively clones one type of skimmed cards.” Perhaps of greatest concern is the report’s conclusion that “RFID-enabled credit cards are susceptible in various degrees to a range of other traditional RFID attacks such as skimming and relaying.”

Representatives of contactless companies and credit card firms have made the argument that the information intercepted by the techniques used in the Univ. of Mass. study are insufficient to make a purchase, that other information related to the specific purchase?coupled with data identifying the exact time and location of the purchase?is necessary to buy something. They also add that the non-embossed verification number on the card?known in the industry as the card-validation code (CVC)?is not intercepted by such techniques, a claim confirmed by the researchers.

“With any data that you can gather from a contactless card, you are not able to do a transaction,” said Mohammad Khan, president and founder of ViVOtech, a vendor that sells contactless/NFC payment software, transaction management systems and readers.

But there are two problems with those defenses. The first is that the CVC number is not universally required, although more and more merchants are insisting on it, especially online. The second problem is that not all cards use such an encrypted verification system, which the researchers proved by making an actual purchase with data they had skimmed from one of the evaluated cards.

As a practical matter, both sides concede, the current risk is not especially high for actual fraudulent activity with contactless over the long term. Today’s cards are very much first-generation and subsequent cards are likely to use strong encryption?which slows down the card’s processing speed?much more than the initial proof-of-concept offerings.

Also, there are many easier and faster methods for credit card fraud than what the researchers tried, including tricking consumers into revealing their information.

But the risk with weak contactless security is not limited to credit-card fraud: it’s also an issue with identify theft and privacy. That is a much greater concern with the contactless security holes and even contactless industry advocate Khan concedes that changes are needed, including the possible removal of the name from the visible data stream. “Card issuers have a choice to not put the name of the card,” Khan said, who was careful to not directly say that he wanted the name removed. “The industry may well decide they should stop putting the name on the (card’s data stream). It’s controversial, but it might be the appropriate thing to do. It might be better to not have the name on the card. The only downside is that your receipt won’t have your name on it.”

The identity theft fear is that a thief could identify people by simply getting near them?or near their mail?with a hidden reader. If a thief sees someone in a store buying expensive items and thinks they would make an attractive target, a discrete credit card scan could provide a name, which would make tracking them person later a lot easier. An even more frightening scenario is for physical attacks, where a violent criminal might see a good target for an assault and could easily identify the potential victim’s name for later pursuit.

The techniques the scientist researchers used were quite straight-forward. “We reverse-engineered the protocols and constructed inexpensive devices that emulate both credit cards and readers. The experiments indicate that all the cards are susceptible to live relay attacks, all the cards are susceptible to disclosure of personal information, and many of the cards are susceptible to various types of replay attacks,” the report said. “In addition, we successfully completed a cross-contamination attack against the magstripe of one card. All but one of the other cards tested appear to be susceptible to the cross-contamination attack as well.”

A core industry defense to the security-hole in contactless cards criticism has been that the card’s data can only be read from a very short distance. But previously-reported research?including material last year from Shell Canada and more recent concerns about Citbank’s contactless fob deployment–were confirmed by the researchers that data can be read from a much longer distance. Besides, readers are so small that a customer standing in line could be close enough or someone putting brochures into mailboxes could be near mailed credit cards.

“RFID tags do not have a single, definitive read range. While the nominal read range of an RFID tag may be quite short, on the order of several centimeters, for example, a non-standard reader or large antenna can provide a significant boost in range at which an attacker can skim an RFID tag,” the report said, adding that a New York City Transit Authority report “recently demonstrated skimming ranges of over 20-centimenters for RFID systems in which most readers operate at a distance of only several centimeters” and others have demonstrated “a possible skimming range of up to 50-centimenters” and that “while skimming requires that a reader power the targeted tag, an attacker performing passive eavesdropping on a session between a legitimate reader and RFID tag can potentially harvest tag data at a considerably longer range. Claims have surfaced of tests in which e-passports, which rely on ISO 14443-A and 14443-B, were read at a distance of 30 feet and detected at a distance of 20 meters.”

The report adds this certainly does not resolve the contactless read-distance debate but it makes clear that much more needs to be known and that neither side is that sure of its facts. “We make no claims in this paper about the read ranges of RFID-enabled credit cards beyond the fact that characterization of these ranges is not straightforward and constitutes an important open research question.”

The report points out that, unlike older-style magstripe-only credit cards, the “security envelopes” that hide current credit cards are not effective in a contactless world. Or, in the vernacular of the report: “Containers that are visually-opaque and not necessarily RF-opaque.”

The threat here involves easy access to mailboxes?the report cites dormitory or apartment mailrooms and side-of-the-road mailboxes as especially risky?along with crowded lines, elevators and subways. The report makes an interesting observation that the way consumers have been trained to protect their credit-card information may actually make their contactless data less secure because consumers aren’t sensitive to confidential data that isn’t human-eye-readable.

“Even if the read ranges of RFID-enabled credit cards are short, their new uses and form factors will engender new opportunities for attack. Cards that support sufficient read range may tempt consumers to hold their wallets up to readers, rather than to remove their cards first. For instance, consumers are trained to present ATM cards to devices that look like ATMs. A compromised reader at a parking garage could skim customers? credit-card information at the same time that they read the parking pass,” the report said. “Fob-type RFID credit cards are now available for attachment to key rings, exposing them to attack when consumers leave their keys unattended. This behavior is seen most often in valet-parking situations or in gymnasiums where it is common for users to leave their keys together in an unsecured box by the door. The fact that such cards may not bear embossed numbers can create a false sense of security in addition to the fact that consumers are skilled at protecting their wallets, but as we have seen, often leave their keys exposed.”

From the thief’s perspective, there is a huge value in capturing the data from the card before the consumer has seen it. If a criminal grabs the data “and then replays that transaction to the network before the legitimate user has a chance to use their card, then the charge-processing network should accept the (criminal?s) transactions and actually decline the legitimate ones<' the report said. "Therefore, even if the counter and codes are cryptographically secure, these cards should still be susceptible to this attack. It?s true that the attacker is faced with a counter synchronization problem, but these are far easier than the cryptographic problems on which we prefer to base our security whenever possible."

Beyond gathering data from the contactless credit-card directly, the report discovered substantial weaknesses when they tried eavesdropping on contactless transactions at POS locations. The equipment consisted “simply of a tuned 13.56-MHz antenna connected to an oscilloscope. Using this setup, we obtained oscilloscope traces of complete transactions between various RFID credit cards and our various commercial readers.”

What was captured? “Examination of data obtained through these means immediately demonstrated the efficacy of the simple eavesdropping attack, since the full cardholder name and card expiration date were present in clear-text in all transactions,” the report said.

Worse yet, the study looked at one of the more sophisticated contactless credit card defenses?a challenge-response protocol?and quickly came up with an easy way to thwart it using a relay attack and two culprits.

One thief is armed with a clandestine credit card reader emulator with a non-RFID link to a clandestine credit card emulator being used by the second thief. Thief One sits or stands next to the victim and quickly discovers the victim’s contactless credit card. Thief One beams the captured signal to Thief Two.

Thief Two then approaches the merchant’s POS and uses his device to receive commands from the POS terminal, which are forwarded to Thief One’s device, which shares them with the victim’s contactless card. The card’s responses are processed through Thief One’s device into Thief Two’s device, which gives the proper authenticated response to the POS terminal.

“The purchase should succeed and the cost will be charged to (the victim). Observe that even with application-layer challenge-response or transaction-counter protocols, this attack will still succeed as protocol messages will simply be relayed between the card and reader,” the report said.

The report also described a cross-contamination attack, which involved adding easily-obtained information into the wireless mix.

“We combined the data thus obtained with address and telephone information looked up in the telephone directory given the cardholder name transmitted through the envelope. For postal mail, the attacker already knows the cardholder address,” the report said. “Using only this information, we placed an online purchase for electronic parts from one of our major research-parts suppliers. Our purchase was successful” and added that this tactic should work against most contactless card types in conjunction with any merchant that doesn’t require a CVC.

The author recommend a couple of different ways to defend against such attacks, including simple RFID blocking covers for the cards, such as some crudely-made one by consumers and some marketing-driven Kello, Kitty RFID-blockers being sold in Japan, officially some sort of Faraday cage. “Note that this countermeasure is useless when the card is in use, since a card must be removed from a shielded wallet before an RF purchase can be made. It is clear, however, that credit card companies should at least ship cards through the mail enclosed in a Faraday cage to obviate the dangers” of unauthorized data-capture, the report said.

The authors also suggest some more complicated defenses, such as blocker tags that “exploits RFID anti-collision protocols in order to simulate a vast collection of non-existent RFID devices, thereby obscuring real RFID tags in its vicinity. In principle, a consumer could confer protection on RFID-enabled credit cards in an ordinary wallet or purse by positioning a blocker tag near them,” the report said. “On removal from the protected environment, a credit card would then operate normally. Or perhaps the blocker could contain a button or other means for a consumer to authorize card use.”

Ultimately, the report said, improved cryptography and more sophisticated means of signaling consumer intent would make such approaches unnecessary.

“It is possible, of course, to modify the credit cards themselves so that they activate only on indication of user intent. A simple push-button would serve this purpose, but more sophisticated sensors might serve the same purpose, such as light sensors that render cards inactive in the dark, heat sensors that detect the proximity of the human hand, motion sensors that detect a telltale ‘tap-and-go’ trajectory, etc.,” the report said. “Ultimately, credit-card functionality will see incorporation into higher-powered consumer devices, such as NFC-ready mobile phones and will benefit from the security protections of these host devices, such as biometric sensors and increased computational capacity.”