Abstract
In this thesis, the security concerning the near-field communication and its applications will be investigated. A thorough risk assessment is performed on the threats, attacks and the fraud scenarios related to NFC. It goes on to argue against the statement as per the standard that NFC is safe by its design, because it works in close proximity only. It discusses the possibility of eavesdropping along with other possible hack attacks. The impact of the attacks is analyzed and the best possible solutions are discussed. It goes without any debate that the first and the foremost authentication that needs to be added is encryption of the data being transferred. However, looking at the nature of the data that is being dealt here, single authentication is not enough. We discuss about the possibility of adding another level of authentication that is securer and attack proof in many ways – biometrics.
Keywords: NFC, security, attack, eavesdropping, sensitive, biometrics, authentication, encryption, RFID
- Introduction
Near-field, aka NFC, is a wireless data transmission and communication technology that aids in exchange of data between two devices up to about a distance of 10 cm. It operates using the high frequency waves of short wavelength. The technology evolved and upgraded from RFID (Radio Frequency Identification), which transfers data between two devices held close to each other. Hence, inheriting the features of RFID, it combines the interface of a smartcard and a smartcard reader into a single chip. It can effectively turn the device into an e-ticket or an e-wallet capable of being used as a credit card itself for making the payments.
However, with that kind of power in a chip, how actually secure our devices are? There can be grave consequences if the communication channel gets interrupted, or if the information gets tempered during the transfer, or worse if the phone gets stolen. Since NFC is used for security-sensitive applications, the security of NFC is all the way more important. With the extensive use that this technology intends to find, one major attack is enough to destroy the reputation of a mobile company or a bank and to put all the hard research work, which has gone into the technology, on to the back burner.
This thesis addresses the risks and the security issues that come hand-in-hand with this technology, with a primary focus on the payment scope, and how best to counter those problems. NFC is a comparatively young technology, and thus it comes with a steep security learning curve. It demands extreme caution from the manufacturers and the users in order to protect the data and let the technology grow comfortably.
- Project Objectives
Since this technology operates on a short distance, for a long time it has led experts to think that the channel cannot be tempered with. Hence, the protocol incorporates only few, if any, security measures. Over the past couple of years, NFC has gained much attention and has resulted in an interesting collaboration of mobile operators, manufacturers and the electronics industry. Companies have already started manufacturing NFC enabled mobiles phones and applications to utilize the hardware have also been out. And so are the hackers to exploit the vulnerabilities of this young technology.
In this thesis, we will explore the different types of attacks that can take place over NFC and their impact on the users. Along with the issues, we will also seek to propose the best possible solutions for addressing those problems and creating a secure cashless world. The research will revolve around these sub-questions:
- What are the risks and vulnerabilities in using NFC-enabled smartphones?
- In what ways can they be exploited?
- What are the solutions for the risks posed by these attacks?
- Project Activities
NFC has found its use in a wide range of applications and is penetrating into the market. It aims at turning the world cashless. Every bit of information, ranging from personal to the payment information, will be stored on a smartphone and that is all you need to carry along with yourself. However, it also makes the security landscape very large. We tread a difficult way when we talk of getting the whole world in a smartphone. It is to be kept in mind that the technology is relatively young and there is a steep learning curve from the security point of view. With this kind of information, it becomes extremely important that security remains the primary point of focus.
The experts have thought for a long time now that the close proximity over which this technology operates is almost attack-proof. f However, it has become known over time that it is indeed possible to pick up the information sent over this radio channel, corrupt or manipulate it or to insert new messages, if there is no security applied.
- Threats and Attacks on NFC
Since its inception, NFC has come a long way. And as with any technology, NFC is equally prone to hack attacks. There is nothing more luring for cyber criminals than a protocol used for payments with minimal or no security. Also, the previous attacks on RFID technology [2, 3] like content falsification, eavesdropping, unauthorized access, make NFC an interesting target. Hoepman and Siljee [4] point out eight major issues in the whole NFC security landscape:
- All NFC devices are readers and/or writers.
- NFC devices can easily emulate a tag.
- The short range of NFC, which is considered its USP, is not enforced by the standard.
- NFC is an interface or a gateway to the device it is attached to.
- A single device being used to run multiple NFC applications.
- Security has not been built into the design of NFC standard.
- Existence of possibility to connect to an NFC device unintentionally.
- Data sent over NFC is not mandated to be encrypted, hence the privacy of the user is at grave risk.
Until recently, the experts have believed it to be extremely difficult for a hacker to hack an NFC device. Given the extremely short range of NFC communication, the hacker has to be in very, very close proximity of the user to gain access to the device and in such cases, the user will know. However, various types of attacks have been encountered in the recent times. Some of the common attacks are:
- Eavesdropping: Since the devices communicate using RF waves, they can be easily intercepted. The attackers deploy an antenna in between two devices communicating with each other and intercept the data being exchanged.
Another factor defining the vulnerability is the mode, in which the sender is sending the data, i.e. whether it is generating its own RF field, or is it using the RF field generated by the passive device. Both the modes differ in the way the data is transmitted and sending the data in passive mode is comparatively much safer than the other way round.
- Data Corruption: While in most cases, the motive is to steal the information, it is not always true. In some cases, the attacker’s sole aim may be to corrupt the data being exchanged, rendering it useless. The motive may be as simple as disturbing the communication in a way that the receiver is not able to understand the information being received. To undertake this attack, the attacker needs to have a good understanding of coding and modulation techniques. However, by this practice, the attacker can only corrupt the data, but not manipulate it. This is also called a denial of service attack.
- Data modification: This is different from data corruption in the sense that, in this type of attack, the attacker wants the receiver to receive some valid, but manipulated data. The success rate of this attack depends upon the strength of the amplitude modulation applied.
- Data Insertion: This attack practice is used when the attacker wants to insert messages in between the data being transmitted. However, in this attack, the timing is very important and can achieve success only if the answering device is taking a lot of time to answer. In such case, the attacker can insert a message and has to ensure that the message is received before the answering device starts to answer. If the timing mismatches, the data will be corrupted.
- Man in the middle attack: In this attack, the attacker tricks the two parties willing to communicate with each other into a three-party conversation. In this setup, both the sender and receiver are unaware of the presence of a third party in between and that they are actually sending and receiving messages from the attacker. This can take place if the sender and receiver send a secret key to establish a secure conversation channel between them, and the attacker eavesdrop on the secret key. This way, the attacker can establish a separate communication channel with the sender and a separate channel with the receiver.
- Viruses: With more personal and confidential data being stored on smartphones, the devices become more and more vulnerable to virus attacks on a daily basis.
- Theft: If a phone is stolen, no amount of encryption can protect the data. Getting hold of a NFC chip-enabled phone, the thief can use it to purchase using the credit card information stored in the phone or steal the confidential and personal information.
- Solutions
NFC devices are capable of detecting data corruption attacks, since they can check the RF field, while the data is being transmitted. The power that is required to corrupt the data is way bigger than the power detected by NFC devices during data transmission. Hence, almost every data corruption attack should be detectable and the data transfer can be stopped as soon as such an attack is detected.
Answering the messages without any delay can prevent attacks like data insertions. Caution should be exercised to ensure that in no way, an attacker, if any, should be faster than the receiver in answering. At the worst, he should be only as fast as the receiver, so that both the messages overlap and no correct message received. Another way could be for the answering machine to listen to the channel all the while it is open and the point where the transmission started. By continually listening, the attacker can be detected.
The NFC-enabled devices cannot protect themselves against eavesdropping on their own. Transmitting the data in passive mode can be a major obstacle to the attack, but may not be sufficient in countering it. Eavesdropping can only be prevented by establishing a secure channel of transmission.
Any standard key agreement protocol based on either RSA or Elliptic Curves model, like Diffie-Hellman, will do the job. It will establish a shared secret between the sender and the receiver, which can then be used to derive a symmetric key, like AES. This key is used in providing confidentiality, authenticity and integrity of the data to be transmitted.
However, as with any technology, we know this is not fail-proof and only data encryption may not achieve the highest level of security standard. What we need is a two-step authentication. To achieve this two-factor authentication, encryption of payment modules can be combined with biometrics. Biometrics identifies the unique physical characteristics of a person, such as iris scan, fingerprints and/or facial features to identify the person using the device is the original owner. The biometric template for feature recognition, say iris recognition, can be loaded into a smartphone and presented for authentication by holding the camera of the phone in front of the eye. Since these are the marks or identifications that cannot be stolen, forgotten, lost or borrowed, and are unique for every individual, they provide a strong and confident authentication mechanism. Biometrics does not depend on pin codes or passwords and is way too complex to be hacked or forged.
- Environment
The applications utilizing the NFC interface will need to be run on an NFC-enabled smartphone. The phone should be capable of searching for NFC tags automatically in its vicinity as soon as the NFC function in enabled. Most easily available NFC apps are available on Android OS. The phone should suffice these minimum requirements:
- NFC chip activated
- Running on Android OS
- Minimum of 512 MB RAM
- Project Results
In the thesis, we will discuss about the technology of NFC and its emergence into the market. With the growing use of smartphones and intent of the market to go cashless, various applications using NFC interface have come up. However, in the cases which use personal data and information, like credit card details for making contactless purchases, it becomes extremely important that this data is protected with utmost care. The threats to this young technology will be discussed and addressed. We will be focusing on following some best practices, by which we can hinder the attack for a while. However, for providing the best level of security, a two-factor authentication must be employed. Data encryption using AES standards and various cryptic and decrypt algorithms will be analyzed and biometrics, as the second level and the best form of authentication available till date, will be argued.
- Project Schedule
Bibliography
International Organization for Standardization/International Electrotechnical Commission,
ISO/IEC 18092 Information technology — Telecommunications and information exchange
between systems — Near Field Communication — Interface and Protocol (NFCIP-1),
ISO/IEC 18092:2004(E) (2004).
L. Francis, G. Hancke, K. Mayes, K. Markantonakis, Practical NFC peer-to-peer relay attack
using mobile phones, in: Sixth International Conference on Radio Frequency Identification:
Security and Privacy Issues (RFIDSec 2010), Springer-Verlag, 2010, pp. 35–49.
[1] NFC Forum, NFC Data Exchange Format (NDEF) Technical Specification (2006).[2] A. Juels, RFID security and privacy: a research survey, IEEE Journal on Selected Areas in
Communications 24 (2) (2006) 381–394.
[3] C. Mulliner, Vulnerability analysis and attacks of nfc-enabled mobile phones, Fourth International Conference on Availability, Reliability and Security (ARES 2009) (2009) 695 – 700.
[4] J.-H. Hoepman, J. Siljee, Beyond RFID: the NFC security Landscape (2007) 15.
C. Miller, Exploring the NFC attack surface, in: Blackhat 2012 whitepaper, 2012, p. 44.
L. Francis, G. Hancke, K. Mayes, K. Markantonakis, Practical NFC peer-to-peer relay attack
using mobile phones, in: Sixth International Conference on Radio Frequency Identification:
Security and Privacy Issues (RFIDSec 2010), Springer-Verlag, 2010, pp. 35–49.
A. Juels, RFID security and privacy: a research survey, IEEE Journal on Selected Areas in
Communications 24 (2) (2006) 381–394.
E. Lee, NFC Hacking: The Easy Way, in: DEFCON 20, 2012.
