Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why the Mythbusters won't do RFID (2008)

youtube.com

Post reply on HN
Print view View original

61–66 of 66 posts

Re: Why the Mythbusters won't do RFID (2008)

#61

Post by adulau »

etm117 wrote: post #56

Johns Hopkins University researchers did a video where they got the RFID code from one of those gasoline auto-passes that you put on your keychain. It was a video where they sit next to someone with the RFID pass in their pocket, scan it with their laptop and then use the code at a gas station. I am at work and the link it blocked, but I do believe this here is the video and information. http://rfidanalysis.org/

The link is now squatted but still available in archive.org :

http://web.archive.org/web/20061109232923/http://www.rfidana...

Re: Why the Mythbusters won't do RFID (2008)

#63

Post by [deleted] »

kaib wrote: post #50
michaelaiello wrote: post #39

I'm the founder of a company that sells RFID blocking wallets and passport cases http://www.difrwear.com . I met with Adam briefly back in 2008 at HOPE when he gave this talk and gave him one of our wallets. I ended up quite dissaponited they couldn't air the show. Would have brought a lot of awareness to the issue. It is really easy to copy RFID credit cards... all you need to do is go buy a point of sale terminal f…

I totally want to buy one of your wallets but you are currently out of stock on everything except the garish pink ones..

[deleted]

Re: Why the Mythbusters won't do RFID (2008)

#64

Post by doki_pen »

moe wrote: post #48
mseebach wrote: post #47

Earlier quoted context omitted.

> d) The only thing that should (ideally) be stored on any RFID chip is a unique number I disagree. This is basically where RFID has its benefits. Transport for London has the Oyster card, which I'm pretty sure is "electronic cash", i.e. your balance is stored on the card. This allows the system to work without the huge point of failure that is a central database and the connections to it. They have millions of peopl…

Transport for London has the Oyster card, which I'm pretty sure is "electronic cash", i.e. your balance is stored on the card. I wonder why people rolling out such systems never seem to see the obvious(?) writing on the wall: 1. Someone comes up with an "infinite balance"-hack. 2. Infinite balance cards are sold on a growing scale. 3. Transport company is forced to apply expensive bandaids to contain the problem. Mor…

This already has happened in Boston.

http://joshuamcginnis.com/2008/08/09/wow-how-to-hack-boston-...

It's really shocking that people think storing MONEY on a card that everyone has read/write access to is a GOOD idea.

Re: Why the Mythbusters won't do RFID (2008)

#65

Post by superuser2 »

pyre wrote: post #15
Groxx wrote: post #11

Earlier quoted context omitted.

a) it's a radio signal. However low power it is, it gets transmitted huge distances while still being detectable (especially if you capture it multiple times to read through noise). I'd love to take a massive dish (say, 20 foot diameter) & see how many can be captured from inside a neighboring building. b) I have yet to hear of a single RFID card which has a switch on it to address this. It's a big security problem.…

> I'd love to take a massive dish (say, 20 foot > diameter) & see how many can be captured from > inside a neighboring building. Are you talking about active or passive RFID? I was under the impression that most RFID in use is passive. In that case, you'd have to transmit something to get a response, unless you're talking about camping out in an area where lots of cards are going be activated by various things other…

When I first heard of this attack I'm pretty sure the solution to that is a high-gain antenna. I don't know how often that actually works, but it's theoretically supposed to.

Re: Why the Mythbusters won't do RFID (2008)

#66

Post by pyre »

fragmede wrote: post #28
pyre wrote: post #15

Earlier quoted context omitted.

> I'd love to take a massive dish (say, 20 foot > diameter) & see how many can be captured from > inside a neighboring building. Are you talking about active or passive RFID? I was under the impression that most RFID in use is passive. In that case, you'd have to transmit something to get a response, unless you're talking about camping out in an area where lots of cards are going be activated by various things other…

So say a 5-foot range. Find a group of employees out for lunch together and I walk past the table with a backpack on. Hardly suspicious, and I've probably got most of their building access cards.

I was responding to someone to someone talking about a 20-foot dish though. That's not something you stuff in a backpack. I was commenting on his desire to listen with a huge dish at a distance.
Post reply on HN