Contactless snooping: Assessing the real threats

Transcription

1 Thomas P. Diakos 1 Johann A. Briffa 1 Tim W. C. Brown 2 Stephan Wesemeyer 1 1 Department of Computing,, Guildford 2 Centre for Communication Systems Research,, Guildford Tomorrow s Transactions forum, London, March 19, 2014

2 Outline Near Field Communication Eavesdropping Antennas Experimental Work Quantitative Analysis Conclusions and Future Work

3 Near Field Contactless Transactions RFID Technology Near Field Communication Coupling Element Reader Chip Reader's magnetic field Contactless card HF MHz radio Short range of operation (< 10 cm) Near-field region Contactless cards or NFC devices

4 Near Field Contactless Transactions Near Field Communication Near Field Contactless Transactions Marketed as ideal for quick, convenient transactions 23 million cards in the UK alone 13.32% of smartphones with access to the WWW

5 Near Field Contactless Transactions Near Field Communication Near Field Contactless Transactions Marketed as ideal for quick, convenient transactions 23 million cards in the UK alone 13.32% of smartphones with access to the WWW What s the catch? Because the transmission range is so short, NFC-enabled transactions are inherently secure.

6 Near Field Contactless Transactions Research Motivation Eavesdropping - Our Attack Vector 20 Eavesdropping system PoS Customer pays with contactless tag Electromagnetic field generated during transaction

7 Near Field Contactless Transactions Research Motivation Eavesdropping - Our Attack Vector 20 Eavesdropping system PoS Customer pays with contactless tag Electromagnetic field generated during transaction Inherently secure? Difficult to defend against Contact world heritage

8 Near Field Contactless Transactions Motivation Eavesdropping - Past work Expensive, cumbersome equipment No control over transmit power Traces on a scope Our contribution

9 Near Field Contactless Transactions Motivation Eavesdropping - Past work Expensive, cumbersome equipment No control over transmit power Traces on a scope Our contribution Relatively inexpensive, inconspicuous equipment Varying Magnetic field strength measurements Quantitative analysis

10 Eavesdropping Antennas Design Factors The ideal eavesdropping antenna Maximise Signal-Noise-Ratio Resonance Suitable Q factor H-Antenna Conclusions

11 Eavesdropping Antennas Design Factors The ideal eavesdropping antenna Maximise Signal-Noise-Ratio Resonance Suitable Q factor H-Antenna Conclusions Low Inductance High load Resistance

12 Eavesdropping Antennas Large Metallic structures The shopping trolley Far End Middle End Leg End Ground Point Near End Scenario Inductance Resistance (µh) (Ω) Near End Middle End Leg End Far End

13 Introduction Eavesdropping Antennas Experimental Work Results Conclusions Eavesdropping Antennas Shopping Trolley Antenna Pros I Short connection points I Ease of execution I High load resistance

14 Eavesdropping Antennas Shopping Trolley antenna Cons Trolley resistance Noise susceptibility Not an ideal H-antenna

15 Eavesdropping Antennas Eavesdropping Antenna Benchmarks Eavesdropping H-fields H-loop antenna used as a transmitter Signal generator and power amplifier Three types of eavesdropping antennas Path Loss & background noise measurements

16 Eavesdropping Antennas NFC Antenna Design Principles H-Loop Antenna Matched to 50 Ω with a resistor (10 Ω) in series

17 Eavesdropping Antennas Quarter Wavelength Antenna Worn over body Water content of body reduces efficiency

18 Eavesdropping Antennas Path Loss Measurements Trolley Power Level (dbm) Trolley Path Loss 4.5 A/m Front 4.5 A/m Side 1.5 A/m Front 0.5 A/m Front Theoretical curve Distance (m)

19 Eavesdropping Antennas Path Loss Measurements Summary H-loop and trolley are most efficient Antenna orientation H-field strength Quantitative Analysis

20 Experimental Work Near Field Contactless Transactions ISO Type A Communication PHY layer based on ISO standard Manchester encoded baseband 847 khz Subcarrier modulation (OOK)

21 Experimental Work Eavesdropping Near Field Contactless Transactions Computing Frame Error Rates A known (randomly generated) long sequence Transmitter / Receiver Processing and computation

22 Experimental Work Eavesdropping Near Field Contactless Transactions Transmitter Arrangement Signal Generator PC Data Card Pad Attenuator IQ Modulator Coil Antenna RF Amp Step Attenuator Synthetic data, 60 bytes per frame Subcarrier generated in software External trigger signal at 1.7 MHz

23 Experimental Work Eavesdropping Near Field Contactless Transactions Sequence of 5 bits Binary stream, Manchester encoded and modulated with 847 KHz subcarrier 1 Voltage / V binary sequence Manchester encoded OOK modulated subcarrier Samples 64 80

24 Experimental Work Eavesdropping Near Field Contactless Transactions Receiver Arrangement Covert Antenna LNA RF Amp BPF MHz Notch Filter PC Data Card Peak Detector LNA maximises SNR Band Pass Filter MHz Logarithmic peak detector

25 Introduction Eavesdropping Antennas Experimental Work Results Conclusions Experimental Work Eavesdropping Near Field Contactless Transactions Receiver Arrangement

26 Experimental Work Eavesdropping Near Field Contactless Transactions Noise Corruption 1.8 Eavesdropped Samples Voltage / V Number of Samples Frame synchronisation becomes challenging

27 Experimental Work Eavesdropping Near Field Contactless Transactions Noise Corruption 1.8 Eavesdropped Samples Voltage / V Number of Samples Frame synchronisation becomes challenging Variance computing sliding window Threshold crossing

28 Experimental Work Eavesdropping Near Field Contactless Transactions Variance Sliding Window Binary sequence binary sequence modulated subcarrier window size = 32 window size = Samples Amplitude / V Amplitude / V Variance Value

29 Experimental Work Eavesdropping Near Field Contactless Transactions Variance Smoothing and Threshold Crossing Voltage / V Variance Value σ=0 σ=10 σ=40 Eavesdropped samples Impact of σ and ρ on variance curve ρ =60% data start Gaussian smoothing

30 Experimental Work Eavesdropping Near Field Contactless Transactions Robust Frame Synchronisation Frame length Rough estimate based on ρ crossing (EOF SOF 32) ± Y multiple of 144 Cross correlation for bit decoding

31 Results Eavesdropping Near Field Contactless Transactions Experimental set-up Outside Chamber PC Data Card IQ Modulator MHz carrier Pre Amp Step Attenuator RF Amp Tx Antenna Rx Antenna Receiver & Peak detector Inside Chamber

32 Introduction Eavesdropping Antennas Experimental Work Results Conclusions Results Eavesdropping Near Field Contactless Transactions Receiver circuit and Antenna

33 Results Eavesdropping Near Field Contact-less Transactions Preliminary testing Anechoic chamber 500 frame tests Establish σ and ρ values

34 Results Eavesdropping Near Field Contactless Transactions σ and ρ selection at 7.45 A m 1 ρ 80cm , cm 10, σ 90cm 10,

35 Results Eavesdropping Near Field Contactless Transactions Experimental Procedure 5000 frames (20 minutes per run) cm Increments of 5 cm (2 30 cm for trolley) 1.5, 3.45, 7.45 A m 1 Experiments ran over 2 days

36 Results Results H-Loop Antenna Frame Error Rates 10 0 FER with confidence intervals FER (a) 7.45 (b) 3.45 (a) 3.45 (b) 3.45 (c) 1.45 (a) 1.45 (b) distance / cm Normal approximation, 95% confidence interval levels

37 Introduction Eavesdropping Antennas Experimental Work Results Conclusions Results Eavesdropping Near Field Contactless Transactions Shopping Trolley Eavesdropping Arrangement

38 Results Eavesdropping Near Field Contactless Transactions Shopping Trolley FER (σ = 10, ρ = 50) 1.0 Shopping Trolley FER Error Rate A/m 3.45 A/m 1.45 A/m Distance / cm Trolley generates its own noise, lossy antenna

39 Conclusions Conclusions and Future work Conclusions Eavesdropping distance cm No interference from other HF sources Relatively inexpensive equipment, inconspicuous antennas Reliable data recovery Future work Commercial devices Improve portability Remote interrogation Security and privacy implications

40 Conclusions Eavesdropping Near Field Contactless Transactions Thank you for listening Please forward any questions