A group of European computer researchers have demonstrated that it is possible to insert a software virus into RFID tags, infecting a portion of the memory in the chip.
This was previously considered impossible, due to the limited memory capacity of the tags.
According to a PhD candidate and her supervisor at the Vrije Universiteit Amsterdam, a single infected RFID tag is capable of disrupting an entire system with disastrous consequences.
For instance, when an item carrying an infected RFID tag is scanned, the tag will be able to invade the central database and all subsequent items scanned will also become infected. As these infected tags are scanned at various stages along the supply chain, databases throughout the world could be infected.
While RFID tags have power constraints that inherently limit complexity, the backend RFID middleware systems may contain hundreds of thousands, if not millions, of lines of source code. If the number of software bugs averages between 6-16 per 1,000 lines of code, RFID middleware is likely to have lots of exploitable holes.
The essence of RFID is automated data collection, and databases are not only susceptible to security breaches, they have their own unique classes of attacks.
The majority of hack attacks exploit easy targets, and RFID systems are likely to be vulnerable because nobody expects RFID malware (yet), especially not in offline RFID systems.
One of the aims of the study was to encourage RFID middleware developers to take measures to secure their systems.
The research paper has been published at www.rfidvirus.org/papers/percom06.pdf
