Reverse Engineering and Security Evaluation of Commercial Tags for RFID-Based IoT Applications

Abstract

The Internet of Things (IoT) is a distributed system of physical objects that requires the seamless integration of hardware (e.g., sensors, actuators, electronics) and network communications in order to collect and exchange data. IoT smart objects need to be somehow identified to determine the origin of the data and to automatically detect the elements around us. One of the best positioned technologies to perform identification is RFID (Radio Frequency Identification), which in the last years has gained a lot of popularity in applications like access control, payment cards or logistics. Despite its popularity, RFID security has not been properly handled in numerous applications. To foster security in such applications, this article includes three main contributions. First, in order to establish the basics, a detailed review of the most common flaws found in RFID-based IoT systems is provided, including the latest attacks described in the literature. Second, a novel methodology that eases the detection and mitigation of such flaws is presented. Third, the latest RFID security tools are analyzed and the methodology proposed is applied through one of them (Proxmark 3) to validate it. Thus, the methodology is tested in different scenarios where tags are commonly used for identification. In such systems it was possible to clone transponders, extract information, and even emulate both tags and readers. Therefore, it is shown that the methodology proposed is useful for auditing security and reverse engineering RFID communications in IoT applications. It must be noted that, although this paper is aimed at fostering RFID communications security in IoT applications, the methodology can be applied to any RFID communications protocol.

Unmanned aerial vehicle for internet of everything: Opportunities and challenges

“…Hence, it can perform flexible and low-cost peer-to-peer communications. In practice, it has been widely used in myriad applications such as mobile identification systems and logistic monitoring systems [36].…”

Towards The Internet of Smart Clothing: A Review on IoT Wearables and Garments for Creating Intelligent Connected E-Textiles

“…Retailers will have to work out how the changing room will look like and how to promote the features of smart clothes. • Smart environments rely on a ensuring high-security against cyber threats [260][261][262], and on the constant availability of sensor and actuator devices, whose power consumption is a concern due to the large number of sensor nodes to be deployed. IoT devices require high-security lightweight protocols [263] and cipher suites [264] that optimize the use of resources and the energy consumption.…”

A Practical Evaluation of a High-Security Energy-Efficient Gateway for IoT Fog Computing Applications

“…IoT gateways can be improved in different ways to reduce power consumption, but, in this paper, how to increase energy efficiency and maximize data throughput while guaranteeing high security in the communications between IoT gateways and with the cloud is analyzed. Note that, although this improvement in the energy efficiency is especially useful for battery-operated gateways, the increase on the level of security may also benefit other IoT applications like home automation [ 13 , 14 , 15 ], defense and public safety [ 16 ], transportation and connected vehicles [ 17 ], or healthcare, where security issues can pose risks for human safety and privacy [ 18 , 19 ] and which can be the target of cyberwarfare attacks [ 20 ].…”

“…It is also important to emphasize that security in IoT and fog computing systems is often overlooked or not completely addressed [ 18 , 21 , 22 ], slowing down the broad adoption of IoT. Furthermore, one of the main barriers for not implementing security mechanisms to protect the communications is the low computing capabilities of most IoT nodes, which is a topic to be researched in the next years.…”