Hacker tries to read a radio identification tag from 29 floors up (video)

Radio frequency identification (RFID) tags are becoming pervasive as the barcodes of the 21st century. They are being used in everything from Wal-Mart merchandise to U.S. passport cards.

But the problem, as demonstrated by hacker Chris Paget at the Defcon security conference today, is that they have no security and can be read from a great distance. Paget has already shown he can read a tag from 217 feet. (See our roundup of all Black Hat and Defcon stories).

[aditude-amp id="flyingcarpet" targeting='{"env":"staging","page_type":"article","post_id":202381,"post_type":"story","post_chan":"none","tags":null,"ai":false,"category":"none","all_categories":"business,media,security,","session":"D"}']

Paget tried to break the world record for long-distance reading of an RFID tag today on the 29th floor of the Riviera Hotel in Las Vegas, or more than 1,000 feet from a tag. He showed that his reading system and two large antennae could detect tags belonging to someone on the ground parking lot of the hotel (the little guy in black on the right), but his equipment couldn’t read the serial numbers on the tags because he didn’t quite have a powerful enough amplifier. The Las Vegas heat may have brought his experiment down, he said. He’s going to work on it and try again. But his point was a good one.

“These are pervasive technologies, but they absolutely should not be used in identification cards,” Paget (right and top) said during the live demonstration.

He used a Ham radio license to establish a legal wireless connection for his experiment. He used his contraption to read an EPCglobal generation 2 tag, which has been widely adopted by industry. Paget calls himself an “ethical hacker” and said he simply wanted to demonstrate that RFID tags are not safe for storing private information.

It took Paget several tries to be able to detect the RFID tags (pictured), as he had to increase the power of the antennae in each attempt.

Both industry and government officials say the RFID tags are more efficient and useful than barcodes. But since they carry serial numbers that (unless used in high-cost tags) have no encryption, they can be read by anybody. If, for instance, you bought a bunch of RFID-tagged groceries at the store, somebody with a reader could find out what you bought, from a distance. Most tags can be read from a few inches to a few feet away. But Paget says the new EPCglobal generation 2 tags are radar-like and can be read with radar technology, which has a longer range.