How to Build a Low-Cost,
Extended-Range RFID Skimmer
Ilan Kirschenbaum & Avishai Wool
15th Usenix Security Symposium,2006
Kishore Padma Raju
OVERVIEW
BACKGROUND
• RFID uses ISO-14443 standard
– Increased security
– Very short range (5-10cm)
• Goals
– Build extended-range RFID skimmer
– Collects mass info from RFID devices
OUTLINE
• RFID
• System design
– Building
– Tuning methods
• Results
• Conclusions
RFID Technology
• Many applications
– Contactless credit-cards
– National ID cards
– E-passports
– Other access cards
• Very short range
• Security vulnerabilities
Attacks on RFID
• Relay attack
Attacks on RFID
• Relay attack
Attacks on RFID
• German Hacker
– PDA and RFID read/write device
– Changed shampoo prices from $7 to $3
• Johns Hopkins Univ.
– Sniffs info from RFID-based car keys
– Purchased gasoline for free
ISO-14443
• Proximity card used for identification
– Very short range (5-10 cm)
– Embedded microcontroller
– Magnetic loop antenna (13.56 MHz)
• Security
– Cryptographically-signed file format
RFID Skimmer
• Collect info from RFID tags
– Signal/query RFID tags
– Record responses
• Some uses:
– Retrieve info from remote car keys
– Obtain credit card numbers
System Design Goals
•
•
•
•
•
Low power
Low noise
Large read range
Simple design
Cheap
System Design
Part #1 - RFID Reader
• TI S4100 Multi-Function
reader
– Cost: $60
– Built in RF
power amplifier
– Sends approx.
200mW into small antenna
Part #2 - RFID Antenna
• Antenna range ≈ length
• 39 cm copper tube loop
• Antenna inductance ≈ 1 μH
Part #3 - Power amplifier
Amplifier interfaced directly to
module’s output stage
• Powered by FET voltage
•
•
•
Field-effect transistor
Did not match impedances
between amp and output
Part #4 - Receiver Buffer
• Load Modulation Receive Buffer
– HF reader system
– Receiver input directly connected to reader’s
antenna
• Attenuate signals before feeding them back to
the TI module
– Avoid potential reader damage
– Still deliver input signals to receiver
Part #4 - Receiver Buffer
Part #5 -Power supply
• Powers the large loop antenna
• Maintain “smooth” DC supply
– Clean power supply
– Low ripples (power variance)
– Improves detection range
SYSTEM BUILDING
• Copper Tube Loop Antenna
– Ideal: 40x40 cm
– Copper-tube
• Constructed their own
– Cheaper copper tube,
used for cooking gas
– Pre-made in circular coils
SYSTEM BUILDING
• Copper-tube loop and PCB antennas
SYSTEM BUILDING
• RFID Base Board
– Decon DALO 33 Blue PC Etch pen
– Protected ink used to draw leads on tablet
SYSTEM BUILDING
• RFID Base Board and power amp
SYSTEM BUILDING
• Power Amplifier
– Based on Melexis
application note
– Input driven from
reader output
– Ideal: high voltage
rating capacitors
– Used cheaper, but
low voltage
SYSTEM BUILDING
• Load Modulation Receive Path Buffer
– Signals are looped back
– Buffer needed to hold correct signals
SYSTEM TUNING
• RF Network Analyzer
– Measure magnitude and phase of input
• Measure Voltage Standing Wave Radio
– Adjust antenna’s impedance to match amplifier
output
• RF power meter
– Measures power reception
– Ideal: measure actual amplification
RESULTS
RESULTS
• Close to theoretical predictions
CONTRIBUTIONS
• Built RFID skimmer  validated basic concept
of an RFID “Leech”
• RFID tags can be read from greater distances
(25 cm)
• Halfway towards full implementation of a
relay-attack
Strengths
• Created a portable, RFID skimmer
• Step-by-step instructions
• Low system cost ($110)
Weaknesses
• Not developed for large scale production
• Cheap design = less efficient results
• Expensive system tuning methods
Improvements
• Better equipment
• High rating components
– More powerful RF test equipment