Software to Hack RFID Tags

Filed in archive Tags and Readers on August 6, 2004

Someone has developed software to "hack into" RFID tags and change the data stored on them.

A German software consultant developed the software, called RFDump, and released it at the recent BlackHat Security Conference.

Forbes magazine had this report about how the hack would work:

"A would-be scofflaw heads into a grocery store where all the products have RFID tags on them. Rather than paying $7 for a bottle of shampoo, he'd rather pay $3. To make that happen, he whips out a PDA equipped with an RFID reader and scans the tag on the shampoo. He replaces that information with data from the tag on a $3 carton of milk and uploads it to the shampoo bottle tag. When he reaches the check-out stand--which just happens to be automated--he gets charged $3 instead of $7, with the store's computer systems none the wiser."

But, there's more to this story.

I first learned about this story via this post over at the MIT Technology Review blog. Now the really interesting point is in the comments section. A number of commenters suggest the tags are probably going to be read-only (versus read-write) and therefore could not be hacked. Anyone have additional thoughts on this point?

UPDATE AUGUST 6: Anders pointed me to a good collection of links he's assembled over at RFID Buzz.