RFID: the blabbermouth in your pocket
The story has been making the rounds of a security researcher who was able to drive around and swipe information from RFID passports and ID cards. It’s scary stuff, and it got me thinking.
RFID chips are widely misunderstood. Many people envision them as broadcasting information, even spying on the carrier. But they’re not that energetic. The majority of them just pick up some inducted power from a handheld reader, then broadcast an identifying number in response, back to the reader. The problem is that the range (normally a few inches or feet) can be significantly enhanced if the reader is modified with a directional antenna. So if you could interrupt the induction power signal, and further interrupt the broadcast response, you’d greatly limit the range of the RFID chip.
I just happened to have a crude, if somewhat specialized signal-strength meter in my pocket; a cell phone. The picture above shows I have really good signal in my kitchen; five bars. Drop the phone in a silver anti-static bag, though, and it drops to one bar. (The bright part on the second picture is just a reflection of my ceiling lamp off the silver bag.)
For a device like an RFID chip, that would be one-fifth the power, plus attenuating the resulting broadcast response by four-fifths as well. Schlepp that through the inverse-square law and the bad guy would have to start carrying an awfully large antenna. He’d have to aim it very carefully, too.
This is just a crappy, ‘materials-on-hand’ demonstration. Silver anti-static bags, like the kind electronic parts come in, aren’t made for RF shielding; they just need to be slightly conductive on the surface, to dissipate static electricity before it can zap delicate components. A ‘full metal jacket’, like an aluminum-foil lined bag, should stop RF communication cold. I wonder if that’ll become standard for passport folders and wallets someday?
This is not to say that RFID chips in cards are a good idea; they’re not. Chips in cards are fine, but chips at a distance, no thank you. I suggest you take the foil wrapper from a Hershey bar and wrap it around your RFID cards.