Hacking the RFID-based Authentication System of a University Campus on a Budget

Abstract

Radio-Frequency IDentification (RFID) technologies have been widely used in physical ID cards in educational institutions due to its low-cost, simple integration and convenience. In a university campus, the RFID technology can be used for proximity-based authentication for services such as access control, student/employee attendance record, or in-campus payments. These RFID-based technologies present vulnerabilities that, if exploited, can compromise the university campus authentications systems. RFID skimming and tag killing are examples of attacks that are simple to execute and have a high impact on their victims. This paper exploits a tag-related vulnerability of an ID Card based on RFID technology for proximity-based authentication inside a university campus. The proof of concept presented shows that, by using low-cost commercial-off-the-shelf hardware and open-source software, it is simple to clone an ID card and perform RFID skimming, harming the real ID card users. Possible countermeasures are later introduced and discussed.