Analysis of NFC Attack Surface¶
Date: | 2012-07-25 |
---|---|
Speakers: | Charlie Miller |
Slides: | http://media.blackhat.com/bh-us-12/Briefings/C_Miller/BH_US_12_Miller_NFC_attack_surface_Slides.pdf |
The Gist¶
- Fuzzing NFC stacks
- Potential attacks and demos
- Many Android phones have NFC. Not iPhone yet.
- He broke into a Google Nexus S and Nokia N9 using NFC!
Motivation¶
- NFC coming to a phone near you!
- “Server-side” attack vector
- Very hard to test NFC implementations
NFC Attack Surface¶
- New way to test NFC stacks
- Examples
- Google wallt PIN brute force
- parking meters
- bus passes, gym memberships
- URL spoofing, vending machines
NFC Basics¶
- Based on RFID (ISO 14443)
- 13.56 MHz (+/- 7kHz)
- Range: < 4cm
- Data rates: 106, 212, 424 kbps
- Typically on when phone screen is on (not when “asleep”)
- Modes: Passive, Active (P2P)