Someone set up an RFID scanner and camera at DefCon, a convention for high tech conference where such hijinks are common. Most RFID cards don’t identify the holder by name, but by taking a photo of the holder, it’s possible to identify that person later.
If the RFID is an employee’s access card, it can be cloned, the identity of the employee verified, and then educated guesses can be made (by those who are educated) about adjacent RFID serial numbers (remember the definition of serial?). Other cards can then be generated, giving greater access to buildings and their contents (especially interesting is that access to some computers is controlled by RFID cards).
Sitting outside an office building and scanning people as the enter and leave could be profitable. And if everyone then is required to wear Faraday-shielded ID holders, what’s the point of having RFID?
If you have an RFID passport, I strongly advise carrying it in a shielded holder. RFID scanners fit in backpacks (the surreptitious scanners at DefCon were scanning from their backpacks), and it is trivially easy to scan your passport as you walk in line to the security checkpoint.
3 months ago
•
0 notes