Re: RFID Flap Silences Security Researchers

["Bill Kearney" <wkearney-99@hot-mail-com>]

> RFID devices used in more public places
> might be easier to compromise, given the
> right hardware and know-how.  But those
> used for single-family residential access
> control should be relatively safe from this
> sort of compromise.

What's troubling about RFID entry systems is the reduction in physical
effort necessary to compromise a wide range of facilities.  For example, a
thief can get key blanks quite easily, but carrying enough of them to allow
easy entry becomes problem.  Size, noise and likelihood of drawing suspicion
make it impractical.  I'm sure there's an argument to be made about how
many/few combinations are actually needed, or that there are various types
of 'more secure' key blanks.  That's not the point.  The point is by using a
programmer it becomes possible for a relatively small box to be capable of
compromising literally millions of systems.

Tangentally there's the problem of notification.  There's really very little
in the way of effective notifcation streams for the residence.  There's no
good and consistent way to know how to notify the occupant when important
things occur.  There's a mish-mash of possibilities, but nothing that's very
practical at this point to appeal to the non-technical individual.  So if
the entry system senses being polled (sorta like too many login requests)
there's no process for letting the occupant know about it.

So combine the lack of feedback/notification with condensed ease of abuse
and it's a big problem.

-Bill Kearney