*Boy, this is some kinda class project. I can remember a
quieter, calmer world when nice blue-haired girls from
Florida didn't even go to Amsterdam to write RFID viruses.
Melanie Rieback's home page:
http://www.cs.vu.nl/~melanie/
Our Melanie digging the Florida sunset, hanging out at the Renaissance Festival, etc.
http://www.cs.vu.nl/~melanie/photos.htm
Melanie's still mostly-conjectural, thank God, classes
of arphid malware.
http://www.rfidvirus.org/malware.html
The RFID Guardian Project. No, they don't yet exist and
you can't buy one.
http://www.rfidguardian.org/
RFID Guardian: A Battery-Powered Mobile
Device for RFID Privacy Management
by
Melanie R. Rieback, Bruno Crispo, and Andrew S. Tanenbaum
Abstract. (...) A world in which practically everything is tagged and can be read at a modest distance by anyone who wants to buy an RFID reader introduces serious security and privacy issues. For example, women walking down the street may be effectively broadcasting the sizes of their RFID-tagged bras and medical data without realizing it. To protect people in this environment, we propose developing a compact, portable, electronic device called an RFID Guardian, which people can carry with them. In the future, it could be integrated into PDAs or cell phones. The RFID Guardian looks for, records, and displays all RFID tags and scans in the vicinity, manages RFID keys, authenticates nearby RFID readers, and blocks attempted accesses to the user's RFID tags from unauthorized readers. In this way, people can find out what RFID activity is occuring around them and take corrective action if need be.
(...)
A growing number of countermeasures to these RFID security and privacy threats have been suggested, which fall into different categories:
permanent tag deactivation (tag removal, destruction, or SW-initiated tag "killing"),
temporary tag deactivation (Faraday cages, sleep/wake modes),
on-tag cryptographic primitives (stream ciphers, reduced AES, reduced NTRU),
on-tag access control (hash locks, pseudonyms),
off-tag access control (blocker tags),
and tag-reader authentication (lighweight protocols, adapted air interfaces).
Unfortunately, this rich variety of solutions still faces a number of problems.
(((Yeah, I would think that 'rich variety' could be keeping any number of variously motivated people busy in the ol' lab for quite a while.)))
