25 ms·
Please scan my towel
- marvel_boy 11y agoInteresting. Where I can find more information about reading RFID chips?
- Rafert 11y agohttps://en.wikipedia.org/wiki/MIFARE#Security_of_MIFARE_Classic.2C_MIFARE_DESFire_and_MIFARE_Ultralight https://en.wikipedia.org/wiki/MIFARE#Security_of_MIFARE_Clas... seems to be a good start.
- glastra 11y agoThis reminds me of the ubiquity of insecure MIFARE Classic chips. My previous workplace (an international organization that shall remain anonymous) had vending machines where you could "buy" an RFID key that acted sort of like a "wallet". You could refill it by putting it inside the vending machine and then inserting coins, or you could use it to buy goods from the machines. It used MIFARE Classic and was trivial to break, and the cash amount was stored as cents in a short integer. Fun stuff, you could even buy deodorant and panties. Then, several towns in my country use RFID cards for public transportation payment. Guess what? Even systems implanted AFTER these cards were deemed highly insecure are using them.
- lucaspiller 11y agoOne place I worked at while in college had a similar thing with smart cards. The vending of the product and debiting of the card wasn't an atomic operation, so if you removed the card at the right time you'd still get the product but not be charged.
- throw91283 11y agoThey must have changed that. At a cafeteria that uses MIFARE cards the operation is still not atomic, but the customer loses: If you remove the card at the wrong time, the card is debited but the transaction does not show up on the cashier's terminal, leading to heated arguments. The transaction does show up in the central database, so after spending 20 min writing a complaint you get your money back after a few days. I guess this is called progress.
- mitoyarzun 11y agoIn Santiago, Chile, the public transportation system uses Mifare Classic cards, and few apps that (ilegally) refilled the cards appeared a while ago. The solution given by the government was to block the cards that were used with fraudulent refills on a weekly basis, but there is always the possibility of changing the ID or purchasing blank cards. Of course the system was chosen years after the vulnerabilities were discovered, too. My guess is that the only way to stop this is to replace all the scanners, which will be far more expensive than losing a few thousand paying customers per day.
- creshal 11y agoNXP has SDKs and mobile apps for it: https://www.mifare.net/en/products/tools/ https://www.mifare.net/en/products/tools/ There's also different kinds, for environments with high security demands you're not supposed to use DESfire cards, not Ultralight: https://www.mifare.net/en/products/chip-card-ics/ https://www.mifare.net/en/products/chip-card-ics/
- jgrahamc 11y agoI posted this in part because I love the idea and because today is the anniversary of the birth of Douglas Adams. Edit: said death meant birth.
- oneeyedpigeon 11y agoIt's actually his birthday. He died on 11 May 2001.
- bpchaps 11y agoIt's March :)
- DominikD 11y agoDiscussed thrice already. Kinda, never caught up. https://news.ycombinator.com/item?id=11212357 https://news.ycombinator.com/item?id=11212357 https://news.ycombinator.com/item?id=11207155 https://news.ycombinator.com/item?id=11207155 https://news.ycombinator.com/item?id=11217681 https://news.ycombinator.com/item?id=11217681
- deleted 11y ago[deleted]
- lucb1e 11y agoWait, towels have RFID tags?! Never heard of that before.
- aylons 11y agoHotel towels, to prevent theft.
- krzrak 11y agoHow do they prevent theft, exactly?
- rc55 11y agoA customer checks in and is given a towel with a customer specific RFID attached. If at the point the customer checks out and the towel is not in the room, it is assumed to be missing or stolen.
- uptown 11y agoWhich is the same as if a non RFID'd towel is missing from the room.
- jameshart 11y agoEr, no. Have you been to a hotel? They don't normally give you a single towel for your entire stay. The hotel changes the towels every day. Bulk RFID scanning during laundry lets them keep track of how many towels have gone wandering and individually track how many times specific towels have been laundered, which is probably useful information for managing towel quantities in bulk. I don't think tracking down and identifying individual towel thiefs is generally the idea, though I guess you can detect towels in places they are not meant to be (such as in their suitcases on the way out of the lobby).
- cballard 11y agoThis doesn't prevent someone from just taking a pool towel to their room and then putting it in their suitcase.
- rtpg 11y agoRFID is definitely one of the cooler things that exist on the practical/futuristic feeling matrix. Really wish I had some need for one
- deleted 11y ago[deleted]
- roel_v 11y agoRFID is one of those things that seem cool until you start playing with it and then it turns out that the only uses for it are really boring. Like, you can't use it to locate stuff because the range is too short; you can't rely on stuff to have chips (food, or clothes or whatever) and it's a major time sink if you'd have to start tagging stuff yourself; it's cumbersome to install readers everywhere and not being able to rely on half lives measured in decades instead of months, etc. I used to have an rfid chip implanted in my hand. I had all these ideas of what I was going to do with it - log on to my computer by putting an rfid reader in my keyboard, build a magic 'touch the wall and music starts playing' thing etc. All of them turned out to be very boring and useless in practice. Logging into my machine - meh, turns out that it takes longer for monitors to come back on than to type the password. Building (useful) user interfaces based on rfid is very hard and doesn't add anything over a regular proximity sensor. The only idea I have left is that in my current house, I have a place where I could put an rfid reader so that if I'd get a chip implanted in my gluteus maximus (my butt, essentially) I could activate an automatic door opener by bumping into it when I have my hands full. I just can't motivate myself to set this up and discovering again that it's a dud in real life.
- Sidnicious 11y agoOne interesting use: https://vimeo.com/157990864 https://vimeo.com/157990864 This library lets visitors rearrange the books organically (if you pull out multiple books on a topic, you're encouraged to put them back on the shelf together instead of finding their old homes). The books are tracked with RFID so that they remain easy to find individually.
- Sir_Cmpwn 11y agoThat's very cool! I thought it deserved its own post: https://news.ycombinator.com/item?id=11266334 https://news.ycombinator.com/item?id=11266334
- spectaclepiece 11y agoyes indeed, 1 up
- spants 11y agoThe Proxmark is a great tool... there is a nice forum here: http://proxmark.org/forum http://proxmark.org/forum
- poppingtonic 11y agoOh, what a hoopy frood.
- anarchitect 11y agoReminds me of how someone embedded the chip from their Oyster card (London travel card) in a magic wand :)
- mino 11y agoI also immediately thought about this! :) https://41.media.tumblr.com/tumblr_m3i9ic6qKJ1qg9f5xo1_400.jpg https://41.media.tumblr.com/tumblr_m3i9ic6qKJ1qg9f5xo1_400.j...
- helper 11y agoThis story doesn't quite make sense. I believe that his RSA pass was clonable and that his towel also had an RFID chip embedded in it. What I find hard to believe is that the towel had a writable RFID tag. My main experience with RFID is cloning tags onto T5557 chips, and I don't think I've ever come across a writable tag in the wild. It doesn't seem to make economic sense to spend an extra penny or two on every towel to put in a tag you are never going to change.
- pjc50 11y agoThe tags have to be writable at the factory to set the serial number. Presumably it's supposed to be write-once but is actually a small EEPROM, and he has an exploit that lets him overwrite it (see the "details withheld").
- kens 11y agoMifare Ultralight C cards have 3DES-based security, cloning protection and read-only locking [1]. So I don't see how copying the RSA card to the towel would work unless the RSA conference totally messed up their use of RFID or the author has some super-hacker key extraction technique. Am I missing something? [1] http://www.nxp.com/documents/data_sheet/MF0ICU2.pdf http://www.nxp.com/documents/data_sheet/MF0ICU2.pdf
- tekklloneer 11y agoI recently was at a Panera Bread, and when I put my Android phone (with NFC) onto the table, it immediately helpfully popped open tagwriter. Turns out they didnt lock the tables' tags, so you could write urls and when people placed their phones down, had those urls open. (they used the tags for their food pager system)
- chipperyman573 11y agoThe ones at the Panera I used to work at weren't writable (I know this because I saw people trying more than once). How long ago was this?
- 11y ago
- gargravarr 11y agoThere's a frood who really knows where his towel is.
- HillaryBriss 11y agoThis article succeeds with just a few words and well chosen pictures.
- bpicolo 11y agoI'm kind of wondering what sort of towel hacks can be done now to truly create a hitchhiker's kind of towel
- bsenftner 11y agoI was a CTO strategy consultant for an RFID MIST startup back in 2008 - that is RFID chips on documents, id badges, and any item of value within an organization. The MIST is a series of wireless sensors & network placed throughout the organization, enabling 3D location of any RFID marked object within range of the MIST network. The system could track who, when, and where of any person or item of interest simply by following the RFID through the series of sensors. However, there was zero plan for security of the RFID signals nor the MIST network itself, they were planning on security by obscurity. As I made more and more noise that security was their entire mission, and by not having any themselves they were setting themselves up for massive hacking. Thankfully, their main inventor was more interested in surfing than working, and their investor got deported for tax fraud.
- apaz 11y agoIs proxmark3 still the device to get?
- collyw 11y agoCould this be done using a phone with NFC? Thats pretty much RFID tech isn't it?
- tjohns 11y agoYes, it was a Mifare Ultralight C, which most Android phones can talk to.
- Animats 11y agoOK, the RSA conference failed here. They're supposed to be a security conference, yet they didn't use an RFID tag that's challenge/encrypt/response, so you can't clone it by passive listening. RSA itself used to make such things. That tag is about the right level of security for towel inventory. The big win in this is managing outsourced laundry costs. Knowing how many items went to the laundry, and how many came back, rather than just counting linen carts, matters a lot. ABS Laundry Solutions overview (with ominous music) [1] [1] http://www.abslbs.com/ http://www.abslbs.com/
- tjohns 11y agoThat might not have been an oversight. Having designed the RFID tag system for a conference before, there's a real cost difference between crypto-capable NFC tags and ordinary ones, once you factor in the number of badges you need to print. Then consider that (a) the conference probably has very little budget for an RFID implementation, and (b) the NFC tag isn't used for anything that's security-sensitive -- mostly checking in at vendor booths, attendance tracking, etc. Given that, I can totally understand why RSA didn't use something more secure. The BIG fail here is that the towel manufacturers didn't toggle the read-only fuse in the tags, which allows them to be overwritten by anyone with an Android smartphone.
- RoseO 11y agoDisney has a pretty neat use for RFID that was featured in a previous HN post. https://news.ycombinator.com/item?id=9177105 https://news.ycombinator.com/item?id=9177105