RFIDs and Secret Handshakes: Defending Against Ghost-and-Leech Attacks and Unauthorized Reads with Context-Aware Communications Alexei Czeskis Karl Koscher University of Washington University of Washington
[email protected] [email protected] Joshua R. Smith Tadayoshi Kohno Intel Research Seattle University of Washington
[email protected] [email protected] ABSTRACT 1. INTRODUCTION We tackle the problem of defending against ghost-and-leech Radio frequency identification tags (RFIDs) and other con- (a.k.a. proxying, relay, or man-in-the-middle) attacks against tactless cards (like proximity cards and contactless smart- RFID tags and other contactless cards. The approach we cards) are increasing in ubiquity. For example, large corpo- take — which we dub secret handshakes — is to incorpo- rations often use RFIDs or proximity cards to regulate build- rate gesture recognition techniques directly on the RFID ing access. American Express, VISA, and MasterCard all tags or contactless cards. These cards will only engage in produce credit cards with embedded RFID tags. Many car wireless communications when they internally detect these keys also have embedded RFID tags to help protect against secret handshakes. We demonstrate the effectiveness of this hot-wiring. While the security community has invested sig- approach by implementing our secret handshake recognition nificant resources in understanding and addressing the se- system on a passive WISP RFID tag with a built-in ac- curity deficiencies of such cards — including documented celerometer. Our secret handshakes approach is backward attacks against and defensive recommendations for each of compatible with existing deployments of RFID tag and con- the above examples [2, 11, 13] — there exists one class of tactless card readers.