Relay Attacks Research Articles

Fortune cookies and smartphones: Weakly unrelayable channels to counter relay attacks

Smartphones are being increasingly used to perform financial transactions (through m-banking, virtual wallet or as a smartcard). The latter applications involve contactless technology (e.g., NFC) that is known to be vulnerable to mafia fraud attacks. In this work we show that a secret message inside an appropriately folded piece of paper (fortune cookie) can be used to effectively mitigate the mafia fraud attack. Fortune cookies implement a weakly unrelayable channel that, in combination with smartphones, provides a provable protection against those attacks. Our solution requires minimal or no hardware changes to the existing equipment (especially on the user’s side) and is suitable for different communication technologies (e.g., intra-body communication, NFC, WiFi, Bluetooth, sound, infrared).

Captcha as Graphical Passwords—A New Security Primitive Based on Hard AI Problems

Many security primitives are based on hard mathematical problems. Using hard AI problems for security is emerging as an exciting new paradigm, but has been under-explored. In this paper, we present a new security primitive based on hard AI problems, namely, a novel family of graphical password systems built on top of Captcha technology, which we call Captcha as graphical passwords (CaRP). CaRP is both a Captcha and a graphical password scheme. CaRP addresses a number of security problems altogether, such as online guessing attacks, relay attacks, and, if combined with dual-view technologies, shoulder-surfing attacks. Notably, a CaRP password can be found only probabilistically by automatic online guessing attacks even if the password is in the search set. CaRP also offers a novel approach to address the well-known image hotspot problem in popular graphical password systems, such as PassPoints, that often leads to weak password choices. CaRP is not a panacea, but it offers reasonable security and usability and appears to fit well with some practical applications for improving online security.

Real Time Authentication System for RFID Applications

Currently, the RFID (Radio\\Frequency Identification) applications, such as banking (card payment), toll cards, access cards and package delivery do not use location information for authentication. These applications depend only on the information available in the RFID card to authenticate. This results in various security issues, such as unauthorized reading and relay attacks on RFID systems. Using the location information, a new level of security layer can be introduced into the authentication mechanism. The location information can be used by a back end server, such as a bank server to analysee the current location and compare it with predefined authorized locations for that particular card. In case of positive match, authorization is granted to the payment gateway to proceed with the transaction. This approach protects the tag owners from unauthorized transactions or misusage of RFID card. The location information can also be used by payment gateway to authenticate the card payment machines to be legal and in the registered premises. In case the machine is not in the registered premises, then the machine can be blocked. This makes the machine steal proof, as the machine would be useless in any other location. Keywords: Access Card, GPS, Location Based Authentication, RFID

Button‐based method for the prevention of near field communication relay attacks

SummaryIn this study, we developed a novel method for preventing relay attacks over near field communication (NFC) using a simple interface. NFC provides standardized short‐range contactless communication using one of the radio frequency identification communication channels. NFC‐enabled mobile devices can exchange information in close proximity (within 4 cm). In particular, modern mobile phones have adopted NFC technology because of its promising functionalities, for example, mobile payments, Bluetooth pairing, and electronic keys. The distance limitation of NFC communication offers security advantages against passive or active attackers, but it is still vulnerable to relay attacks. During a relay attack, adversaries relay messages between two legitimate participants without any attempt at message modification. There is no requirement for knowledge of a cryptographic key or to share secrets with victims, therefore encrypting messages is not a solution that prevents relay attacks. We propose a new method for relay attack prevention, which uses a simple interface with only one button. In our scheme, the elapsed time of button pressing is used for verification. Our experimental results obtained using the proposed scheme demonstrated the accuracy of our method for verifying human users and the difficulties experienced by human attackers. Copyright © 2014 John Wiley & Sons, Ltd.

Context-Aware Defenses to RFID Unauthorized Reading and Relay Attacks

Many RFID tags store valuable information privy to their users that can easily be subject to unauthorized reading, leading to owner tracking, or impersonation. RFID tags are also susceptible to different forms of relay attacks. This paper presents novel sensing-enabled defenses to unauthorized reading and relay attacks against RFID systems without necessitating any changes to the traditional RFID usage model. Specifically, this paper proposes the use of cyber-physical interfaces, on-board tag sensors, to (automatically) acquire useful contextual information about the tag's environment (or its owner, or the tag itself). First, such context recognition is leveraged for the purpose of selective tag unlocking-the tag will respond selectively to reader interrogations. In particular, novel mechanisms based on an owner's posture recognition are presented. Second, context recognition is used as a basis for transaction verification in order to provide protection against a severe form of relay attacks involving malicious RFID readers. A new mechanism is developed that can determine the proximity between a valid tag and a valid reader by correlating certain (specifically audio) sensor data extracted from the two devices. Our evaluation of the proposed mechanisms demonstrate their feasibility in significantly raising the bar against RFID attacks.

A Practical Generic Relay Attack on Contactless Transactions by Using NFC Mobile Phones

A Practical Generic Relay Attack on Contactless Transactions by Using NFC Mobile Phones

Mutual Distance Bounding Protocol with Its Implementability Over a Noisy Channel and Its Utilization for Key Agreement in Peer-to-Peer Wireless Networks

In order to protect a wireless sensor network and an RFID system against wormhole and relay attacks respectively, distance bounding protocols are suggested for the past decade. In these protocols, a verifier authenticates a user as well as estimating an upper bound for the physical distance between the user and itself. Recently, distance bounding protocols, each with a mutual authentication, are proposed to increase the security level for such systems. They are also suggested to be deployed for key agreement protocols in a short-range wireless communication system to prevent Man-in-the-Middle attack. In this paper, a new mutual distance bounding protocol called NMDB is proposed with two security parameters ( $$n$$ n and $$t$$ t ). The parameter $$n$$ n denotes the number of iterations in an execution of the protocol and the parameter $$t$$ t presents the number of errors acceptable by the verifier during $$n$$ n iterations. This novel protocol is implementable in a noisy wireless environment without requiring final confirmation message. Moreover, it is shown that, how this protocol can be employed for the key agreement procedures to resist against Man-in-the-Middle attack. NMDB is also analyzed in a noisy environment to compute the success probability of attackers and the rejection probability of a valid user due to channel errors. The analytically obtained results show that, with the proper selection of the security parameters ( $$n$$ n and $$t$$ t ) in a known noisy environment, NMDB provides an appropriate security level with a reliable performance.

Elliptic curve-based RFID/NFC authentication with temperature sensor input for relay attacks

Unless specifically designed for its prevention, none of the existing RFID authentication protocols are immune to relay attacks. Relay attacks generally involve the presence of one or more adversaries who transfer unmodified messages between a prover and a verifier. Given that the message content is not modified, it is rather difficult to address relay attacks through cryptographic means. Extant attempts to prevent relay attacks involve measuring signal strength, round-trip distance, and ambient conditions in the vicinity of prover and verifier. While a majority of related authentication protocols are based on measuring the round-trip distance between prover and verifier using several single-bit challenge–response pairs, recent discussions include physical proximity verification using ambient conditions to address relay attacks. We provide an overview of existing literature on addressing relay attacks through ambient condition measurements. We then propose an elliptic curve-based mutual authentication protocol that addresses relay attacks based on (a) the surface temperature of the prover as measured by prover and verifier and (b) measured single-bit round-trip times between prover and verifier. We also evaluate the security properties of the proposed authentication protocol.

소리를 이용한 릴레이 공격 공격의 탐지

NFC, RFID 등의 무선 기술이 발전하면서 기기간의 데이터 전달이 용이해지고 있다. 사용자는 여러 개의 복잡한 비밀번호를 외우고 입력하는 대신 항상 소지하고 있는 카드나 휴대폰을 이용하여 간편하게 자신을 인증함으로써 건물에 출입하거나, 보안 자료에 접근하고, 결제를 할 수 있게 되었다. 그러나 최근 릴레이 공격(relay attack)의 출현으로 편리한 토큰 기반(something you have) 인증의 안전성이 위협받고 있다. 릴레이 공격은 안전한 통신 채널을 가진 두 기기 사이에서도 효과적으로 공격을 성공시킬 수 있고, 공격의 원리가 복잡하지 않아 쉽게 구현이 가능하다. 본 논문에서는 거리 제한 방식(distance bounding)이나 위치 측정 후 비교와 같은 기존 방어 기법과 다른 청각 채널을 통한 릴레이 공격 탐지에 대해 제안한다. Wireless communication technology such as NFC and RFID makes the data transfer between devices much easier. Instead of the irksome typing of passwords, users are able to simply authenticate themselves with their smart cards or smartphones. Relay attack, however, threatens the security of token-based, something-you-have authentication recently. It efficiently attacks the authentication system even if the system has secure channels, and moreover it is easy to deploy. Distance bounding or localization of two devices has been proposed to detect relay attacks. We describe the disadvantages and weakness of existing methods and propose a new way to detect relay attacks by recording a background noise.

On Selecting the Nonce Length in Distance-Bounding Protocols

Distance-bounding protocols form a family of challenge–response authentication protocols that have been introduced to thwart relay attacks. They enable a verifier to authenticate and to establish an upper bound on the physical distance to an untrusted prover. We provide a detailed security analysis of a family of such protocols. More precisely, we show that the secret key shared between the verifier and the prover can be leaked after a number of nonce repetitions. The leakage probability, while exponentially decreasing with the nonce length, is only weakly dependent on the key length. Our main contribution is a high probability bound on the number of sessions required for the attacker to discover the secret, and an experimental analysis of the attack under noisy conditions. Both of these show that the attack's success probability mainly depends on the length of the used nonces rather than the length of the shared secret key. The theoretical bound could be used by practitioners to appropriately select their security parameters. While longer nonces can guard against this type of attack, we provide a possible countermeasure which successfully combats these attacks even when short nonces are used.

Location-Aware and Safer Cards: Enhancing RFID Security and Privacy via Location Sensing

In this paper, we report on a new approach for enhancing security and privacy in certain RFID applications whereby location or location-related information (such as speed) can serve as a legitimate access context. Examples of these applications include access cards, toll cards, credit cards, and other payment tokens. We show that location awareness can be used by both tags and back-end servers for defending against unauthorized reading and relay attacks on RFID systems. On the tag side, we design a location-aware selective unlocking mechanism using which tags can selectively respond to reader interrogations rather than doing so promiscuously. On the server side, we design a location-aware secure transaction verification scheme that allows a bank server to decide whether to approve or deny a payment transaction and detect a specific type of relay attack involving malicious readers. The premise of our work is a current technological advancement that can enable RFID tags with low-cost location (GPS) sensing capabilities. Unlike prior research on this subject, our defenses do not rely on auxiliary devices or require any explicit user involvement.

Vehicle Relay Attack Avoidance Methods Using RF Signal Strength

The number of passenger cars equipped with a smart key system continues to increase due to the convenience of the system. A smart key system allows the driver to enter and start a car without using a mechanical key through a wireless authentication process between the car and the key fob. Even though a smart key system has its own security scheme, it is vulnerable to the so-called relay attacks. In a relay attack, attackers with signal relaying devices enter and start a car by relaying signals from the car to the owner’s fob. In this study, a method to detect a relay attack is proposed. The signal strength is used to determine whether the signal received is from the fob or the attacker’s relaying devices. Our results show that relay attacks can be avoided by using the proposed method.

Attacks and improvements on the RFID authentication protocols based on matrix

Most of the Radio Frequency IDentification (RFID) authentication protocols, proposed to preserve security and privacy, are analysed to show that they can not provide security against some passive or active attacks. In this paper, the security of two matrix-based protocols, proposed by Karthikeyan and Nesterenko (KN protocol) and Ramachandra et al. (RRS protocol) that conform to Electronic Product Code Class-1 Generation-2 (EPC Class-1 Gen-2) standard, are investigated. Using the linear relationship of multiplication of matrix and vector, we point out that both protocols can not provide scalability, and they are vulnerable to passive impersonation attack. In addition, both protocols are totally insecure if the adversary can compromise one tag to extract the secrets. A modified lightweight matrix-based authentication protocol is presented, which can resist mainly common attacks on an RFID authentication system including eavesdropping, relay attack, desynchronization attack, impersonation attack and tag tracking attack. The new protocol also has the desirable scalability property and can keep secure under compromising attack.

Cryptanalysis of Pasargad, A Distance Bounding Protocol Based on RFID System

In this paper we analyze an authentication protocol so-called Pasargad which proposed by Arjemand et al. [1]. The Pasargad protocol is a distance bounding protocol which has been designed for RFID-based electronic voting systems. The designers have claimed that this protocol is more secure than Preneel and Single protocol [2], against relay attacks. However, in this paper, we present some efficient attacks against it. Our attacks include conditional impersonation attack and recovery key attack. Moreover, we show that this protocol has some structural flaw which may prevent to execution the protocol.

다중 비트 시도와 응답을 이용한 RFID 거리 한정 프로토콜

RFID 시스템에서 중계 공격에 저항하기 위해 리더와 태그 간의 시도와 응답에 소요된 1비트의 왕복 여행시간 측정을 이용한 거리 한정 프로토콜이 주로 사용된다. 이러한 프로토콜에서 1비트 시도와 응답에 대한 중계 공격의 성공확률을 줄일 수 있으면 효율적인 거리 한정 프로토콜을 만들 수 있다. 본 논문에서는 Hancke와 Khun이 제안한 1비트 시도와 응답 기반의 RFID 거리 한정 프로토콜을 2비트 시도와 응답 기반으로 수정한 효율적인 RFID 거리 한정 프로토콜을 제안한다. n번의 시도와 응답에 대한 중계 공격의 성공확률이 제안된 프로토콜에서는 (7/16)n으로 (3/4)n인 Hancke와 Khun의 프로토콜보다 훨씬 낮다. To resist the relay attacks in RFID system, it is commonly used RFID distance bounding protocols using the round trip time measurement for 1 bit challenge and response between a reader and a tag. If the success probability of relay attacks for the 1 bit challenge and response can be reduced in these protocols, it is possible to make an efficient distance bounding protocol. In this paper, we propose an efficient RFID distance bounding protocol based on 2 bit challenge and response which is modified the RFID distance bounding protocol proposed by Hancke and Khun based on 1 bit challenge and response. The success probability of relay attack for the proposed protocol is (7/16)n for the n times of challenge and response, which is much lower than (3/4)n given by Hancke and Khun's protocol.

Chaotic masking for securing RFID systems against relay attacks

ABSTRACTThe relay attack is a simple yet effective attack against most radio‐frequency identification (RFID) authentication systems. Because of the minimalist design of an RFID system, a lightweight authentication scheme must be designed to provide a strong level of security for low‐cost RFID tags. In this work, we propose a simple but secure masking scheme that counters the relay attack in RFID systems. Our scheme is the first solution based on the chaos suppression theory. We have exploited the chaotic characteristics of a dynamic Lorenz controller to distinguish a legitimate RFID reader from a proxy reader in the relay attack. We also show that the proposed approach is practical using simulation results. Copyright © 2012 John Wiley & Sons, Ltd.

Secure neighbor discovery and wormhole localization in mobile ad hoc networks

Neighbor discovery is an important part of many protocols for wireless adhoc networks, including localization and routing. When neighbor discovery fails, communications and protocols performance deteriorate. In networks affected by relay attacks, also known as wormholes, the failure may be more subtle. The wormhole may selectively deny or degrade communications. In this article we present Mobile Secure Neighbor Discovery (MSND), which offers a measure of protection against wormholes by allowing participating mobile nodes to securely determine if they are neighbors, and a wormhole localization protocol, which allows nodes that detected the presence of a wormhole to determine wormhole’s location. To the best of our knowledge, this work is the first to secure neighbor discovery in mobile adhoc networks and to localize a wormhole. MSND leverages concepts of graph rigidity for wormhole detection. We prove security properties of our protocols, and demonstrate their effectiveness through extensive simulations and a real system evaluation employing Epic motes and iRobot robots.

Non‐linearity cannot help RFID resist full‐disclosure attacks and terrorist fraud attacks

ABSTRACTAs the concept of radio‐frequency identification (RFID) relay attack has been successfully implemented and demonstrated, the research of RFID distance‐bounding protocols to deter RFID relay attacks has drawn much attention from both the industry and academia. Conventionally, researchers adopted linear composition of secrets to resist terrorist fraud attacks. Recently, Peris‐Lopez et al. studied the weaknesses of previous RFID distance‐bounding protocols and proposed that non‐linear composition of secrets and inclusion of more random nonce could help RFID resist key disclosure attack and terrorist fraud attack. In this paper, we will show that non‐linear composition of secrets cannot help enhance the security actually. Copyright © 2012 John Wiley & Sons, Ltd.

Lightweight Distance Bounding Protocol against Relay Attacks

Traditional authentication protocols are based on cryptographic techniques to achieve identity verification. Distance bounding protocols are an enhanced type of authentication protocol built upon both signal traversal time measurement and cryptographic techniques to accomplish distance verification as well as identity verification. A distance bounding protocol is usually designed to defend against the relay attack and the distance fraud attack. As there are applications to which the distance fraud attack is not a serious threat, we propose a streamlined distance bounding protocol that focuses on the relay attack. The proposed protocol is more efficient than previous protocols and has a low false acceptance rate under the relay attack.

Analysis of Relay Attacks on RFiD Systems

Today Radio Frequency identification RFiD systems are widely used in a variety of security sensitive applications such as access control, the payment industry and many others. An important class of attacks on these types of systems is that of relay attacks, due to the orthogonality of such attacks to the existing security and cryptographic solutions. In this paper we address the open question of the maximum distance between the rogue Reader and the victim TAG under which a relay attack can be successful. We determine that interference is the largest confounding factor, but that with proper interference cancelation, a distance of up to 10m is possible. This paper provides an analysis of the maximum distance for successful communication between the rogue Reader and the legitimate TAG,herein called the victim distance. We also propose several countermeasures to the relay attack.