Cited by 81RFID technology advancementsCryptographic Implementations and SecurityAdvanced Authentication Protocols Security

Reverse engineering and security evaluation of commercial tags for RFID-based IoT applications

Open access
Fernández-Caramés, Tiago, Fraga-Lamas, Paula, Suárez-Albela, Manuel, Castedo, Luis·2016·Sensors

Abstract

The Internet of Things (IoT) is a distributed system of physical objects that requires the seamless integration of hardware (e.g., sensors, actuators, electronics) and network communications in order to collect and exchange data. IoT smart objects need to be somehow identified to determine the origin of the data and to automatically detect the elements around us. One of the best positioned technologies to perform identification is RFID (Radio Frequency Identification), which in the last years has gained a lot of popularity in applications like access control, payment cards or logistics. Despite its popularity, RFID security has not been properly handled in numerous applications. To foster security in such applications, this article includes three main contributions. First, in order to establish the basics, a detailed review of the most common flaws found in RFID-based IoT systems is provided, including the latest attacks described in the literature. Second, a novel methodology that eases the detection and mitigation of such flaws is presented. Third, the latest RFID security tools are analyzed and the methodology proposed is applied through one of them (Proxmark 3) to validate it. Thus, the methodology is tested in different scenarios where tags are commonly used for identification. In such systems it was possible to clone transponders, extract information, and even emulate both tags and readers. Therefore, it is shown that the methodology proposed is useful for auditing security and reverse engineering RFID communications in IoT applications. It must be noted that, although this paper is aimed at fostering RFID communications security in IoT applications, the methodology can be applied to any RFID communications protocol.

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

Crossref · 10.3390/s17010028

Cites

66 of 66 references verified0 citation errors · 0 not checkable

Statistics

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • An example in the railway station could be ticket validation equipment based on LF, 125-135 kHz, and HF, 13.56 MHz RFID bands, or vehicle tagging based on UHF RFID solutions in the 865-869 MHz band.

    “An example in the railway station could be the ticket validation equipment based on Low Frequency (LF), 125–135 kHz, and High Frequency (HF), 13.56 MHz RFID bands, or vehicle tagging based on Ultra High Frequency (UHF) RFID solutions [40] in the 865–869 MHz band.”

    From Towards the Internet of Smart Trains: A Review on Industrial IoT-Connected Railways (2017) · cites this paper as [40]

    Section 2.1 (page not provided) gives the LF and HF operating frequencies, identifies ticketing as an HF application, and describes UHF RFID for item tracking. It gives a broad UHF operating range of around 860–960 MHz, but does not specifically identify vehicle tagging or the 865–869 MHz band. (LLM, conf=0.85)

    Experimental — accuracy not yet measured
  • Several smart cards used in public transportation present faults.

    “considering that several smart cards used in public transportation present faults [39,40]”

    From Towards the Internet of Smart Trains: A Review on Industrial IoT-Connected Railways (2017) · cites this paper as [40]

    Section 3.1 reports multiple vulnerabilities in a commercial RFID system used daily for transportation, supporting the claim that a transport-card system had security faults. It does not establish that several distinct public-transport smart cards had faults. No page number is available in our copy. (LLM, conf=0.84)

    Experimental — accuracy not yet measured
  • This is essential in critical infrastructures and defense, whose data have to be stored through trusted service providers, especially in countries where data privacy and security are not guaranteed.

    “This is essential in the case of critical infrastructures [34], [35] and defense [36], whose data, due to legal and privacy concerns (e.g., certain defense data are considered strategic and therefore classified), have to be stored through trusted service providers, especially in countries where data privacy and security are not guaranteed [37].”
  • Security in IoT and fog computing systems is often overlooked or not completely addressed, slowing down the broad adoption of IoT.

    “security in IoT and fog computing systems is often overlooked or not completely addressed [18,21,22], slowing down the broad adoption of IoT.”

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Cites

Flagged first, then by citations

Research works printed but not linked: 5

  1. [5]Feng T. An agri-food supply chain traceability system for China based on RFID and blockchain technology Proceedings of the 13th International Conference on Service Systems and Service Management Kumming, China 24–26 June 2016 1 6
  2. [7]Barro-Torres S.J. Fernández-Caramés T.M. Gonález-López M. Escudero-Cascón C.J. Maritime Freight Container Management System Using RFID Proceedings of the 3rd International EURASIP Workshop on RFID Technology La Manga del Mar Menor, Spain 6–7 September 2010
  3. [22]Nohl K. Evans D. Plötz S. Plötz H. Reverse-engineering a cryptographic RFID tag Proceedings of the 17th USENIX Security Symposium San José, CA, USA 28 July–1 August 2008 185 193
  4. [46]Garcia F.D. Gans G.K. Muijrers R. Rossum P. Verdult R. Schreur R.W. Jacobs B. Dismantling MIFARE card Proceedings of the European Symposium on Research in Computer Security Torremolinos, Spain 6–8 October 2008 97 114
  5. [60]Weiß M. Performing Relay Attacks on ISO 14443 Contactless Smart Cards Using NFC Mobile Equipment Master’s Thesis Technische Universität München Munich, Germany 2010

Cited by

Sorted by citations

Authors
Fernández-Caramés, T., Fraga-Lamas, P., Suárez-Albela, M., & Castedo, L.
Affiliations
  • Department of Electronics and Systems, Faculty of Computer Science, Universidade da Coruña, 15071 A Coruña, Spain
  • Universidade da Coruña (ES)
Venue
Sensors
Publisher
MDPI AG
Published
2016-12-24
Volume
17
Issue
1
Pages
28
ISSN
1424-8220 (ISSN-L)
OpenAlex
W2567447968
Cited by
81
References
66
Citations by year
2026: 4 · 2025: 3 · 2024: 4 · 2023: 11 · 2022: 6 · 2021: 6 · 2020: 8 · 2019: 11 · 2018: 17 · 2017: 11
FWCI
14.01
Type
journal article
Language
en
Open access
Locations
  • Sensors (publishedVersion, cc-by)
  • PubMed Central (publishedVersion, cc-by)
  • PubMed (publishedVersion)
  • arXiv (Cornell University) (submittedVersion, cc-by)
  • LA Referencia (Red Federada de Repositorios Institucionales de Publicaciones Científicas) (submittedVersion, cc-by)
  • DOAJ (DOAJ: Directory of Open Access Journals) (submittedVersion, cc-by-sa)
  • RUC (Universidade Da Coruña) (submittedVersion, cc-by)
  • arXiv (Cornell University) (cc-by)
Funders
Ministerio de Economía y Competitividad (TEC2013-47141-C4-1-R, TEC2016-75067-C4-1-R)
Topics
  • Physical Sciences › Engineering › Media Technology › RFID technology advancements
  • Physical Sciences › Computer Science › Artificial Intelligence › Cryptographic Implementations and Security
  • Physical Sciences › Computer Science › Computer Networks and Communications › Advanced Authentication Protocols Security
Keywords
RFID security, Internet of Things, RFID tags, reverse engineering, RFID attacks, security assessment methodology

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review