Security of Near Field Communication Transactions with Mobile Phones
- When?
- Monday 6 December 2010, 10:30 to 11:30
- Where?
- 39BB02
- Open to:
- Staff, Students
- Speaker:
- Mr Thomas Diakos
Google CEO, Eric Schmidt, announced on the 15th of November 2010 the plan for their next generation of Android based mobile phones to become electronic wallets by making use of Near Field Technology (NFC). NFC is contactless technology based on high frequency RF tags already found in contactless cards like the Oyster. Little research has been carried out on how secure the services offered by NFC are, one of the reasons being its reliance on proximity (~10cm). Attacks that have been carried out used expensive antennas and other equipment. They have also been targeted at contactless cards and not mobile phones where other side channels exist like Bluetooth and Wi-Fi, making crosstalk and information leakage a security concern.
The aim of our research is to investigate the vulnerabilities of NFC phones as an alternative to credit cards at the various layers of communication, exploit any security holes currently present and suggest possible countermeasures. Ensuring that NFC is a secure platform could possibly make credit and access cards obsolete. Such devices could be used for access control, for example getting on trains and buses without needing to purchase a ticket in advance. They could also be used to transfer money to each other and also offer a quick way of checking out account balances quickly and easily and also replace the current chip and pin system.
Our work begins by examining the PHY layer. We investigate whether the proximity feature of NFC is a good countermeasure to attacks from distance. We are using a shopping trolley as a rogue antenna to carry out an eavesdropping attack from distance and demodulate the captured transmission in hardware. We would then use MATLAB and Python for signal decoding. We like to demonstrate that it does not take expensive hardware or software to carry out a successful eavesdropping attack on the PHY layer.