Follow Slashdot stories on Twitter

 


Forgot your password?
Close
typodupeerror
×
Privacy Security The Media

Help a Journalist With An NFC Chip Implant Violate His Own Privacy and Security 142

Posted by Soulskill from the what-could-possibly-go-wrong dept.
An anonymous reader writes: His wife thinks he's crazy, but this guy got an NFC chip implanted in his arm, where it will stay for at least a year. He's inviting everyone to come up with uses for it. Especially ones that violate his privacy and security. There must be something better to do than getting into the office or unlocking your work PC.

He says, "The chip we are using is the xNTi, an NFC type 2 NTAG216, which is about the size of a grain of rice and is manufactured by the Dutch semiconductor company NXP, maker of the NFC chip for the new iPhone. It is a glass transponder with an operating frequency of 13.56MHz, developed for mass-market applications such as retail, gaming and consumer electronics. ... The chip's storage capacity is pretty limited, the UID (unique identifier) is 7 bytes, while the read/write memory is 888 bytes. It can be secured with a 32-bit password and can be overwritten about 100,000 times, by which point the memory will be quite worn. Data transmission takes place at a baud rate of 106 kbit/s and the chip is readable up to 10 centimeters, though it is possible to boost that distance."
This discussion has been archived. No new comments can be posted.

Help a Journalist With An NFC Chip Implant Violate His Own Privacy and Security More

Help a Journalist With An NFC Chip Implant Violate His Own Privacy and Security

Comments Filter:

  • Small Government Mandate (Score:4, Funny)

    by howzermyhamit ( 3876925 ) on Wednesday October 29, 2014 @12:15AM (#48257997)

    I'm sure our local superhero cold fjord can tell us why a Small, Libertarian-Approved State should mandate the installation of these on all citizens and civilians.

    Well? We're waiting, my friend.

    • Re: (Score:2, Funny)

      by Anonymous Coward

      Bennett Hasselhoff, a frequency counter, will be along shortly to provide Insight.

      • Bennett Hasselhoff, a frequency counter, will be along shortly to provide Insight.

        I knew he was a frequent contributor, but I didn't know he was a frequency counter too.

    • A libertarian state would never permit, much less mandate, such a thing.

      • Re:Small Government Mandate (Score:5, Insightful)

        by AK Marc ( 707885 ) on Wednesday October 29, 2014 @01:33AM (#48258245)
        A libertarian state would pass laws banning people from having the freedom to implant themselves with an RFID? What a totalitarian distopian libertarian world you long for.

      • There is no "permit" in Libertarian ideals. You're free to be stupid enough to install such a thing. But likewise you're right, there would be no mandate either. And before anyone jumps to the obvious conclusion, yes, if corporations indirectly mandate it by insisting you need one of these installed to buy services or goods, that's still a mandate and should be opposed by the Libertarian party. Chains are chains. The wall they secure you to is irrelevant.

        The fake Libertarians in the Republican party may hav

        • Re:Small Government Mandate (Score:5, Insightful)

          by Wootery ( 1087023 ) on Wednesday October 29, 2014 @08:26AM (#48259395)

          The fake Libertarians in the Republican party may have other ideas, I wouldn't know.

          Sure you do. You've heard of the Iraq War, right? The principle of minimal government ceases to apply when it's a cause you happen to like, such as pre-emptive war or corporate subsidies.

          • The fake Libertarians in the Republican party may have other ideas, I wouldn't know.

            Sure you do. You've heard of the Iraq War, right? The principle of minimal government ceases to apply when it's a cause you happen to like, such as pre-emptive war or corporate subsidies.

            You basically just restated what I'd said. They pick and choose whichever political affiliation suits their current knee jerk reaction. My point was that, often when discussing Libertarian principles, people get the party confused with the republicans who seem to support some of these principles when they suit their agenda. For example they'd like to free us from big government but seem to have no problem with control by big business.

            And don't pretend like the democrats are any different. If you hadn't noti

            • My point was that, often when discussing Libertarian principles, people get the party confused with the republicans who seem to support some of these principles when they suit their agenda. For example they'd like to free us from big government but seem to have no problem with control by big business.

              Pretty much this. The problem is that many people who talk about Libertarians wouldn't know an actual Libertarian principle if it bit them on the ass, because the other parties have deliberately distorted what those principles are.

              The worst offenders in that respect are clearly the Democrats, because Libertarians will never, ever, agree with them about big government. In that respect Republicans have at least some overlap of views.

              But the Democrats shoot themselves in the foot by demonizing Libertaria

    • No libertarian wants that. Libertarianism is the exact opposite of big government surveillance. Hell, even Obama and Nancy Pelosi probably wouldn't approve of gov't implanting chips on citizens.

      • Re: (Score:2)

        by AK Marc ( 707885 )
        Why is Nancy Pelosi the demon of all conservatives? I just saw the NRA campaign against Staci Appel. Plastered all over the conservative blogs. Why do the conservatives hate women? I haven't met a conservative that didn't hate Nancy Pelosi or Hillary Clinton. Women should stay home with the kids?

        • Re: (Score:2, Insightful)

          by Anonymous Coward

          Conservatives hate Nancy Pelosi and Hillary Clinton.
          Nancy Pelosi and Hillary Clinton are women.
          Therefore, conservatives hate women.

          Additionally,
          the conservatives I know hate Nancy Pelosi and Hillary Clinton.
          Therefore, ALL conservatives hate women.

          You, my friend, are going into my lecture about logic. I suspect my high school students will do better than you did just here.

          • Re: (Score:2)

            by AK Marc ( 707885 )
            Conservatives single out the women in congress to attack. Why?

            • possibly group bias - same reason women get attacked on twitter.

              If I know there are people out there who will attack women for no reason, then I can happily attack women knowing that I will get a ton of others joining in. It validates my sense of importance within a group and gives me the sense of safety from my actions because they are shared by a large number of others.

              This self-fulfilment is why I think it happens, and why the bully only attacks the weak - they know they will get other bullies joining in

            • do they? I had no idea bill clinton was a woman... or obama... or harry reid...

        • Nancy Pelosi was Speaker of the House, and generally considered the second most powerful democrat behind Obama. You can't figure out why conservatives might have a problem with top democrats? You may have noticed Obama wasn't very involved with the drafting of the ACA, that was spearheaded by Pelosi. It would be more accurate to call it Pelosicare rather than Obamacare. The first draft, the last time the Democrats controlled the White House, was called Hillarycare.

          For those conservatives of a more libert

          • Re: (Score:3, Informative)

            by azereal ( 1690964 )
            Technically Obamacare IS Rommneycare, a Republican alternative to a single payer system (single payer is a much better system BTW). When the Democrats proposed it the Republicans simply lurched further to the right and declared it terrible.
            • no, its not. stop being disengenious. Romney care was a single state issue, which makes it constitutional according to the 10th. This is not the same thing at all.

              now, if another state implemented it (not the fed) you could still call it romney care
        • do you not remember all the sarah palin hate? why do democrats hate women???

          the rand hate above, why all the women hate???

          long story short, just stop. you sound like an idiot when you make disingenuous statements to try and prove your point

          • Or how about the "'Escort whore out the door'..." comment recently made by Democratic gubernatorial candidate Vincet Sheheent about Republican Gov. Nikki Haley (the "whore").

            Where is NOW? Where is Eric Holder looking for violations of Civil Rights Laws? Where is the front page outrage on the NYT? Where is "war on women" battle cry?

            Democrats don't care about women. They care about Liberal Women, and only liberal women. All others are not worthy. The most sexist people I know are liberals who view women as ob

      • Re:Small Government Mandate (Score:5, Insightful)

        by Capsaicin ( 412918 ) * on Wednesday October 29, 2014 @01:42AM (#48258277)

        Hell, even Obama and Nancy Pelosi probably wouldn't approve of gov't implanting chips on citizens.

        Hell, who needs implants when people voluntarily carry around Android and/or iOS devices everywhere they go?

        • Re: (Score:1)

          by Anonymous Coward

          Hell, even Obama and Nancy Pelosi probably wouldn't approve of gov't implanting chips on citizens.

          Hell, who needs implants when people voluntarily carry around Android and/or iOS devices everywhere they go?

          This.

          Never in the history of the agency has work been so fucking easy for the likes of the CIA, FBI, and NSA. It's rather sad they still have to break so many laws to do their job.

          It's downright disgusting how much We the People give a shit that they do.

    • Re:Small Government Mandate (Score:5, Insightful)

      by stephanruby ( 542433 ) on Wednesday October 29, 2014 @04:39AM (#48258671)

      A chip embedded in your arm is meaningless without context. Take for example, an Holocaust survivor with a tattooed number on his arm. Or take a person with a safety tattoo listing all the things he's deadly allergic to. Neither of those things are the same as a journalist being tattooed with a meaningless number on his arm.

      If those ten volunteers were really serious about testing the technology in a negative light, they should just spent some time as prisoners in a real prison where everything gets tracked and counted by NFC readers at the very least. The Type II tag itself has such a small amount of memory, it can't really be used for any serious authentication outside of a closed loop system like a prison environment.

      At best outside of prison use, this NFC tag could link to a shortened url, or contain such information as a Twitter handle, or a LinkedIn user name.

      • Re: (Score:2)

        by skids ( 119237 )

        As long as the contents can be linked back to the individual, it just takes NFC communicators next to places where people put their hands to track the individual's actions. The short range gives you a bit more information than just tracing their smartphone -- e.g. if you have an NFC collector tacked to the bottom of a public keypad, you can be pretty sure that person was using that keypad, as opposed to just standing around in the region. Granted given most places can also be covered with a camera and nob

        • -- e.g. if you have an NFC collector tacked to the bottom of a public keypad, you can be pretty sure that person was using that keypad,

          Actually, in this case you couldn't. With RFID yes, but with NFC no.

          Even if the user was actually left-handed and even if the keypad NFC scanner was really powerful, with the small geometric size of the tag, the tag would need to be placed at the finger tip for that kind of thing to work (without the user knowing that he was being scanned), or the embedded tag would have to be bigger.

          Either, your main point still remains. All you would need is indeed a unique id.

          • Re: (Score:2)

            by skids ( 119237 )

            Well, IIRC it is stated in TFA with the right equipment the range could be extended up to several centimeters or perhaps more. Not sure how accurate that statement is though.

            Enough to, say, be pretty disturbing if coupled to a sensor for metabolites in a urinal.

    • and then the mark of the beast people will sue to stop that from happening.

    • a libertarian state would never do such a think. you have libertarian and totalitarian mixed up

      and cold is no libertarian, he is an authoritarian

  • 888 bytes is a pretty fair amount. (Score:5, Interesting)

    by wierd_w ( 1375923 ) on Wednesday October 29, 2014 @12:33AM (#48258035)

    It seems small, when we think about data these days being in the multi-gigabytes, but 888 bytes is AMPLE to completely destroy the security of your legal identity.

    Say, a social security number: 9 bytes.
    A telephone number, with area code: 10 bytes
    Full name, assuming a null padded, 3 entry struct with 15char max strings and 2 delimiter bytes: 47 bytes
    Address, assuming 4 lines with 20 chars each (with null padding as needed)-- 40 bytes.

    All that, and we are only about 1/7 to 1/8th of the data memory, or about 106 bytes.

    One could squeeze a shortened URL to a facebook page, and quite a bit else in that space, such as DL number, credit card number, cellphone number, email address, and whatnot.

    888 bytes can hold a LOT of very dangerous information.

    • Correction--- 4 lines, 20 chars each is 80 bytes, not 40. So, about 146 bytes. About 1/6th the space.

      • 888 bytes can hold a LOT of very dangerous information.

        Not only that, but people are misled by comments such as this by OP:

        and the chip is readable up to 10 centimeters, though it is possible to boost that distance

        Nonsense. The chip is readable at any arbitrary distance, dependent primarily on your ability to build a big enough antenna.

        Security researcher Christopher whats-his-name showed, even before NFC was very common in phones, that $200 of equipment, concealed on your person, can read sesitive NFC data from chips in phones from several feet away... including intercepting financial transactions.

    • With the exception of the SS#, most of that data is publicly available on the internet for most people. If you know someones name, it's very easy to find someones phone#, address, birth date, relatives, former addresses, etc.

      We don't live in as private a world as you're assuming.

      • Oh, I know most information is available with much digging online. The point here, was that the journalist WANTS to advertise his personal data, to create a story sensation.

        Putting a live credit card number ( for a prepaid card, obviously) and some other interesting tidbits on that thing, with a tinyURL shortened web address to basically an otherwise unpublicised hit counter that then forwards again to a facebook page would let him get not only some analytics on how many actual people have accessed his NFC

      • really? My name is Jonathan Smith... go ahead punk, find me.

        You need a bit more information that that, usually a partial address to narrow things down, but other item such as phone number will readily identify you (but if you have the phone number, you're pretty much uniquely identified already, who needs name)

    • I agree fully that 888 bytes is enough to cause someone damage via identity theft. The problem with this phase of trying to "test" the security of these devices is that there is very little to interface with, which is going to create a false sense of security (I'll argue this is part of the reason for the early advertising and testing)

      888 bytes is enough to hold your gender, religion, ethnic background, political affiliation, and at least your last few coordinates. Lots of stuff to discriminate, or tamper

      • The "limited utilities" statement relies on "obscurity". It does not make the data any less secure. This device transmits clear text data, and attacks against NFC devices are well known to exist in the wild.

        This device is a type II NFC device, which is fully readable by smartphones, and other NFC readers. There is already profusion and interest in this technology by credit card companies, and credit card thieves, as the same NFC technology is used in NFC enabled credit cards.

        This device is fully readable by

    • An SS number is 9 digits. That's 30 bits (round to 4 bytes if you want), not 9.
      A telephone number is 34 bits (5 bytes if you want to round)

      • Thats assuming efficient encoding, and not clear text encoding. Clear text encoding would consume the full 9 bytes, as each digit consumes a full byte.

        You will still have to include a delimiter or other landmark termination byte, such as a null terminator, to indicate the end of the string to make sensible use of efficiently packed data.

        • Re: (Score:2)

          by AK Marc ( 707885 )
          A SSN is between 1-1,000,000,000. Code the number as an integer, a 26 bit integer. No delimiter needed, and under 4 bytes. There are less than 700 valid area codes, and many fewer than that in use. If one were to "encode" the phone number, one could compress the phone numbers into fewer bits. Efficient packing in fixed length would work for everything but open strings, like addresses, unless you want to code against the USPS database of addresses. I have no idea how many are in that database, but if y

    • Re:888 bytes is a pretty fair amount. (Score:5, Interesting)

      by mysidia ( 191772 ) on Wednesday October 29, 2014 @01:50AM (#48258301)

      Let's change that up slightly, to use 3715 bits out of the 7104 available, approximately 50%:

      • E-mail address = 40 bytes
      • Social Security Number binary encoded - 9 digits = 29 bits.
      • Health Insurance Provider Name - 16 alphanumeric characters = 12 bytes
      • Health Plan ID - Encoded 6 bits per symbol 8 symbols = 48 bits.
      • ZIP CODE of City of birth = 15 bits
      • GPS Latitude and Longitude of current primary workplace (two 32-bit floats) = 64 bits
      • Employer company name - 16 alphanumeric characters (encoded 6 bits per character) = 12 bytes
      • Driver's License Number - 10 digits = 32 bits.
      • Driver's license State (number from 00 to 49)= 6 bits
      • Driver's license Expiration date (Number of days Since Jan 1, 1970) = 15 bits
      • Current vehicle license plate 9 alphanumeric characters (encoded 6 bits per character) = 54 bits
      • Current vehicle VIN number 17 alphanumeric characters (encoded 6 bits per character) = 102 bits
      • Job Title - 16 alphanumeric characters = 12 bytes
      • Annual Income in US Dollars - 1 to 14 digits = 47 bits
      • Mother's maiden name (max: 20 characters) = 15 bytes
      • Date of birth = 15 bits
      • Telephone number with area code - 10 digits = 34 bits
      • Full name - Encoded using 6 bits per character, Uppercase alphabetic characters, digits, spaces, field separator, and NULs only 50 characters = 37 bytes
      • ZIP CODE of Previous residence = 15 bits
      • Date moved into current residence = 15 bits
      • ZIP CODE of Current residence = 15 bits
      • GPS Latitude and Longitude of current residence (two 32-bit floats) = 64 bits
      • Street name and house number of current resident Address (6 bits per character ) = max 20 bytes
      • Apartment number or suite number = max 20 bytes
      • Bank1 - Account number = 29 bits
      • Bank1 - Routing number 12 digits = 37 bits
      • Bank2 - Account number = 29 bits
      • Bank2 - Routing number 12 digits = 37 bits
      • Credit card 1 - primary account number - 12 digits = 37 bits
      • Credit card 1 - CVV number - 3 digits = 10 bits
      • Credit card 1 - Track 1 data 79 alphanumeric characters = 60 bytes
      • Credit card 1 - Track 2 data 40 digits = 17 bytes
      • Credit card 2 - primary account number - 12 digits = 37 bits
      • Credit card 2 - CVV number - 3 digits = 10 bits
      • Credit card 2 - Track 1 data 79 alphanumeric characters = 60 bytes
      • Credit card 2 - Track 2 data 40 digits = 17 bytes
      • Credit card 3 - primary account number - 12 digits = 37 bits
      • Credit card 3 - CVV number - 3 digits = 10 bits
      • Credit card 3 - Track 1 data 79 alphanumeric characters = 60 bytes
      • Credit card 3 - Track 2 data 40 digits = 17 bytes

      • Re: (Score:2)

        by rvw ( 755107 )

        Regardless of your US centric view, it is interesting to see what is possible. It reminds me of the days of the ZX80 and the 1KB program challenges.

      • Re: (Score:2)

        by mysidia ( 191772 )

        P.S. Alternatively, the information can be uploaded in encrypted format + Base64 to places such as Pastebin, or Freenet, or other massively distributed publication platform.

        The card can then contain just a few 40-character URLs followed by 512-bits worth of cryptocurrency wallet addresses.

        Then a couple of 256-bit decryption keys for the coded messages and the rest of the card can be used for a list of randomly generated initialization vectors that will be used for further encrypted messages.

  • Why does it matter what his wife thinks? And if she truly did suspect he is crazy, wouldn't he divorced right about now and caring a lot less about the chip in his arm?

    • Re: (Score:2, Insightful)

      by Anonymous Coward

      Crazy is pretty low on the "reasons to divorce your spouse"big totem pole after a while. We're all a little crazy by spousal standards, and I've not had papers served to me for thirty years and countin!

    • Why does it matter what his wife thinks? And if she truly did suspect he is crazy, wouldn't he divorced right about now and caring a lot less about the chip in his arm?

      You didn't read the part where he put an NFC controlled chastity belt on her.

    • Re: (Score:3)

      by Rashdot ( 845549 )

      Maybe his wife has a chip on her shoulder.

  • Wrong Hand (Score:4, Interesting)

    by BlackHawk-666 ( 560896 ) on Wednesday October 29, 2014 @01:08AM (#48258163)

    Dude's doing it all wrong, it's meant to go in your right hand or your forehead! ^-^

  • There's a couple schools of thought about chipping pets - one is the cancer risk is minimal, the other is that it isn't minimal.

    So I'll say that a good use of his chip will be to see if he gets cancer.

    • Do these schools of thought know that the chip is inside a piece of glass? Are they suggesting that glass causes cancer? They can't possibly be thinking of effects related to the radio emissions, as the chip has no local power source -- it is only active when powered by a fairly strong emitter and most pets spend well less than 0.0001% of their time in such a situation even if their chip is read many times each year.

    • There's a couple schools of thought about chipping pets - one is the cancer risk is minimal, the other is that it isn't minimal.

      So I'll say that a good use of his chip will be to see if he gets cancer.

      The RFID chip just pulled a number.

      It's 37.

      His body is still serving cancer to #4 on the list (diet sodas). Get in line.

      And good luck proving who or what killed him in the end.

  • journalist in need of (Score:1)

    by Anonymous Coward

    You mean help this journalist come up with some stories to write about

  • Just install a reader for this chip in the wife and you'll get all of your privacy and security and many other things violated...

  • Huh (Score:3)

    by Hognoxious ( 631665 ) on Wednesday October 29, 2014 @04:02AM (#48258581) Homepage Journal

    Didn't some guy (a university professor) in the UK do this about ten years ago? He was a bit of a publicity seeking knob too, IIRC.

  • Just wait (Score:3)

    by mwvdlee ( 775178 ) on Wednesday October 29, 2014 @04:54AM (#48258711) Homepage

    Just wait 364 days, until he's locked all his authentication to the NFC, then some chloroform and a scalpel will give him all the privacy and security violation he's asking for.

  • Please take a MRI scan. (Score:1)

    by Anonymous Coward

    I want to visually see that chip, together with the other one implanted at birth.

    --ac

    • an MRI scan is .... ill advised.

      MRI == Magnetic Resonance Imaging. anything metallic will develop EM eddy currents in them, will heat up, and or-- be yanked forcibly out of the patient by the very strong oscillating magnetic fields being employed to produce the image. Yes-- the NFC chip contains metallic components in the wound wire antenna that is all spooled up inside that glass bead.

      You want a PET scan instead.
      PET == Positron Emission Tomography
      It uses injected radioactive glucose (uses carbon 11 atoms

  • Why doesn't he use a Cattle Ear Tag [wikipedia.org] then everyone can read it even when they doesn't have a nfc capable device. Seriously, I think it's not smart to give up you privacy like this, via an NFC tag.

  • No fly list (Score:4, Funny)

    by DocSavage64109 ( 799754 ) on Wednesday October 29, 2014 @08:28AM (#48259407)
    If we can get the reporter's uid on the no-fly-list it should be pretty entertaining to listen to his rants.

  • Welcome to 10 years ago (Score:5, Informative)

    by Enry ( 630 ) <enry@@@wayga...net> on Wednesday October 29, 2014 @09:29AM (#48259943) Journal

    http://geekdoctor.blogspot.com... [blogspot.com]

  • So just what uses can we contrive? I kind of favour using it as a proximity sensor in or near steering wheels that disables his mobile phone if the car is running, while leaving the passenger's phone functional. Of course Big Wireless may not like the hit on their bottom line.
    The storage issue is a red herring. It just needs enough to store a short URI where everything else can be found. Probably want a private key too, to be used only for generating signatures within the chip.

Slashdot Top Deals

Math is like love -- a simple idea but it can get complicated. -- R. Drabek

Close