3 ms·

I doubt it -- the range of NFC seems to be very bad. Unless the malware can turn up the gain, you have to hold the phones back-to-back within about a centimeter

by gwillen 14y ago

I doubt it -- the range of NFC seems to be very bad. Unless the malware can turn up the gain, you have to hold the phones back-to-back within about a centimeter of each other.

ryanhuff 14y ago
Is this true? My understanding is that the range issue of NFC has more to do with the non-powered nature of NFC chip, thus having very limited broadcasting range. If I had a powered device that broadcasted NFC responses over a much greater range, wouldn't the phone happily accepting this as an NFC chip response?
jerf 14y ago
It's just a feature of this particular hack that it was two phones. The real-world manifestation would probably be an NFC skimmer, like ATM skimmers [1]. Slam the virus in, then proxy the original request (or vice versa, depends on the timing), use the network on the phone to connect to the malware hub control, owned phone. Note you only have to slam a shim in; the shim can then download an arbitrary payload. [1]: http://krebsonsecurity.com/2012/07/atm-skimmers-get-wafer-thin/ http://krebsonsecurity.com/2012/07/atm-skimmers-get-wafer-th...
- Unoeufisenough 14y ago
  The vector is the same as for QR codes, paste a different tag overtop of a legitimate tag that takes the user to a URI with a browser or other application exploit. Or physical world version of phishing. Again it is the application that is the root of the vulnerability. NFC would be no worse than a QR code or even a malicious URL printed in plain english on a poster. The only unique theoretical option would be to hack a very highpowered antenna and transmitter to try and pick up blast out RFID-compatible signals to/from the very weak NFC radios of handsets from further away.
  - gcb 14y ago
    No, a qr tag can't replicate itself on infected devices. A nfc phone can. Even if the range is small, it can send it's payload everyone you were trying to use it intentionally.
noselasd 14y ago
People have been hacking ATMs for years by installing gear on those ATMs. With NFC, such skimming might be much easier, as the gear you need to install can be _tiny_, and you only need to be in the vicinity of the target, making it easier to camouflage. And attacks doesn't need to come from cots phones, with your own higher gain NFC device, you can interact with with ordinary NFC devices from greater distances.
headShrinker 14y ago
or maybe you could embed your hack in on of these ads. http://nfctimes.com/sites/default/files/imagecache/poster/nfc_vh1_bbwives_nyc-proxama-crop-2.jpg http://nfctimes.com/sites/default/files/imagecache/poster/nf...

by gwillen 14y ago

I doubt it -- the range of NFC seems to be very bad. Unless the malware can turn up the gain, you have to hold the phones back-to-back within about a centimeter of each other.

ryanhuff 14y ago

Is this true? My understanding is that the range issue of NFC has more to do with the non-powered nature of NFC chip, thus having very limited broadcasting range. If I had a powered device that broadcasted NFC responses over a much greater range, wouldn't the phone happily accepting this as an NFC chip response?

jerf 14y ago

It's just a feature of this particular hack that it was two phones. The real-world manifestation would probably be an NFC skimmer, like ATM skimmers [1]. Slam the virus in, then proxy the original request (or vice versa, depends on the timing), use the network on the phone to connect to the malware hub control, owned phone. Note you only have to slam a shim in; the shim can then download an arbitrary payload. [1]: http://krebsonsecurity.com/2012/07/atm-skimmers-get-wafer-thin/ http://krebsonsecurity.com/2012/07/atm-skimmers-get-wafer-th...

Unoeufisenough 14y ago
The vector is the same as for QR codes, paste a different tag overtop of a legitimate tag that takes the user to a URI with a browser or other application exploit. Or physical world version of phishing. Again it is the application that is the root of the vulnerability. NFC would be no worse than a QR code or even a malicious URL printed in plain english on a poster. The only unique theoretical option would be to hack a very highpowered antenna and transmitter to try and pick up blast out RFID-compatible signals to/from the very weak NFC radios of handsets from further away.
- gcb 14y ago
  No, a qr tag can't replicate itself on infected devices. A nfc phone can. Even if the range is small, it can send it's payload everyone you were trying to use it intentionally.

noselasd 14y ago

People have been hacking ATMs for years by installing gear on those ATMs. With NFC, such skimming might be much easier, as the gear you need to install can be _tiny_, and you only need to be in the vicinity of the target, making it easier to camouflage. And attacks doesn't need to come from cots phones, with your own higher gain NFC device, you can interact with with ordinary NFC devices from greater distances.

headShrinker 14y ago

or maybe you could embed your hack in on of these ads. http://nfctimes.com/sites/default/files/imagecache/poster/nfc_vh1_bbwives_nyc-proxama-crop-2.jpg http://nfctimes.com/sites/default/files/imagecache/poster/nf...