Is your pet infected with a computer virus?

Digital vermin poses a real threat to RFID tags

Is your pet infected with a computer virus?

Has your dog or cat contracted a computer virus? It’s not impossible. These days, large numbers of pets and livestock have a small chip implanted under the skin so that they can be identified if they stray or turn out to be infected with a disease. As these chips only have a limited memory capacity, it was widely assumed that they could not become infected with a computer virus. However, researchers at VU Amsterdam have now discovered that this is a real possibility. Fortunately they have also come up with a number of adequate countermeasures.

The chips in question are called Radio Frequency Identification Tags, or RFID tags. These are small, relatively cheap microchips, which can be used to tag supermarket products, for example. They can also be implanted into pets or livestock. The same chips are used in public transport chip cards, ski passes or on baggage labels at airports.

Thanks to these tags, we will soon be able to do our shopping without having to queue at the tills. An RFID scanner placed at the exit will transmit a radio wave that will be received by all the RFID tags in your shopping trolley. The tags identify themselves, the scanner registers the products you have bought and the total bill can be debited directly from your bank account. Walmart, the largest supermarket chain in the world, expects to make a total switch to products with RFID chips within the next few years.

But these tags are apparently more vulnerable than was first thought. PhD candidate Melanie Rieback and her supervisor Prof. Andrew Tanenbaum have found a way of placing a computer virus onto a RFID tag. This was previously considered impossible on account of the limited memory capacity of the tags. Melanie Rieback will be giving a demonstration of her discovery on Wednesday 15 March at the annual IEEE Conference on Pervasive Computing and Communications in Pisa.

Digital plague

These chips may be small, but just one infected RFID tag is capable of disrupting an entire system with disastrous consequences. Take, for example, the airport at Las Vegas, which handles two million items of luggage per month. As from May 2006, RFID tags will be attached to cases to speed up the baggage handling process. If someone intentionally attaches an infected RFID tag to his case, the entire system will be thrown into disarray. As soon as the case is scanned, the infected tag will be able to invade the airport’s central baggage database and all cases subsequently checked in will also become infected. On arrival at other airports, these cases will be scanned again and within 24 hours, hundreds of airports throughout the world could be infected. The perfect solution for smugglers and terrorists wanting to send suspicious luggage across the world without being noticed.

Countermeasures

Fortunately, the threat of infection can be countered using standard measures. Rieback stresses that developers must check their RFID systems, and implement safety procedures and secure programme technology. Although these countermeasures will curb the threat posed by RFID viruses, extra time, money and effort will need to be spent on implementing them. It is therefore imperative that RFID system developers and users check the security of their systems now, before they are put to large-scale use.