Radio chip barcodes can carry a virus

Lucas van Grinsven

AMSTERDAM: Cheap radio chips that are replacing the ubiquitous barcode are a threat to privacy and susceptible to computer viruses, scientists at a Dutch university said on Wednesday.

Researchers at the Amsterdam's Free University created a radio frequency identity (RFID) chip infected with a virus to prove that RFID systems are vulnerable despite the extremely low memory capacity on the cheap chips.

The problem is that an infected RFID tag, which is read wirelessly when it passes through a scanning gate, can upset the database that processes the information on the chip, says the study by Melanie Rieback, Bruno Crispo and Andrew Tanenbaum.

"Everyone working on RFID technology has tacitly assumed that the mere act of scanning an RFID tag cannot modify back-end software and certainly not in a malicious way. Unfortunately, they are wrong," the scientists said in a paper.

"An RFID tag can be infected with a virus and this virus can infect the back-end database used by the RFID software. From there it can be easily spread to other RFID tags," they said.

As a result, it is possible that criminals or militants could use an infected RFID tag to upset airline baggage handling systems with potentially devastating consequences, they said.

The same technology could also be used to wreak havoc with the databases used by supermarkets.

"This is intended as a wake-up call. We ask the RFID industry to design systems that are secure," Tanenbaum said in a telephone interview.

Internet of things

RFID has been touted as "The Internet of Things", in which anything from shampoo bottles to marathon runners can be tracked using radio tags.

Civil liberty groups say RFID could lead to an unacceptable invasion of privacy and argue that law enforcement agencies and divorce lawyers could use airline ticket information.

Metro, Germany's biggest retailer, said at the CeBIT technology trade show it plans to save €8.5 million ($10.1 million) annually by using RFID to track stock from suppliers and at its flagship Future Store in Rheinberg town.

Industries in which tracking goods is crucial such as pharmaceuticals, governments, logistics, airlines and manufacturing already use RFID technology.

A recent study by ABI Research found that 10 drug products are expected to have RFID tags on a large scale this year.

The cost of making an RFID tag is about 14 euro cents today and needs to fall, Metro's head of technology Gerd Wolfram said.

But Ian Furlong, manager of Intel's Solution Services division for Central Europe, said at CeBIT that the price of RFID tags was "rapidly falling toward the 5 euro cent mark".

Andrea Huber, managing director of Informationsforum RFID, a German group raising public awareness about the technology, said most companies were waiting for the price of tags to fall to 1 euro cent before they start widespread use.