A relay attack is an attack where the attacker extends the communication range of an RFID/NFC system. The attack usually involves two dedicated and malicious devices, one on the side of the actual tag, and the other on the side of the actual reader; the first pretends to be a reader, the second to be a tag. The two devices then communicate and thus bridge the physical gap between the actual tag and the actual reader.
We investigated various possibilities for implementing a relay attack and, based on the findings, created our own tool for performing them. The tool can modify exchanged messages and thus gain additional time; a crucial capability in such attacks. The tool works best with most common systems in practice, that is, those based on ISO/IEC 14443-4A standard. In our solution, the malicious devices communicate via a wireless connection. We have also created a graphical user interface through which one can change settings, view communication history, read logs, etc. Finally, we tested the tool on a few real-world systems. We measured the delay that an attack introduces, and we probed systems for the maximum delays allowed. We found that in some cases these are so high that we can delay communication by several seconds.
|
