5 ms·

Hacker Implants NFC Chip in His Hand to Bypass Security Scans and Exploit Android

87 points by cgtyoder 11y ago

_ikke_ 11y ago
NFC in Android is not active while the device is locked [0] > Android-powered devices are usually looking for NFC tags when the screen is unlocked, unless NFC is disabled in the device's Settings menu. So to use this, the hacker already needs an unlocked device, in which case it's just as easy to download the payload directly. Usually, the range for NFC to work is quite close, 4 cm or less [1], and I don't think these chips have the capability to increase the range. [0]: http://developer.android.com/guide/topics/connectivity/nfc/nfc.html http://developer.android.com/guide/topics/connectivity/nfc/n... [1]: https://developer.android.com/guide/topics/connectivity/nfc/index.html https://developer.android.com/guide/topics/connectivity/nfc/...
- flintchip 11y ago
  "Just as easily" is not the same as "surreptitiously".
  - _ikke_ 11y ago
    Not withstanding exploits, the user still has to accept the offered link, so it's not really stealthy in that case.
- ge0rg 11y ago
  You are right. The exploit is further complicated by the fact that Android will refuse to install apps outside of Google Play by default. The same effect could probably be reached with an NFC tag in a ring or hidden in your wear, without the pain.
  - jackweirdy 11y ago
    Or an actual NFC ring (probably disguised a bit) http://nfcring.com/ http://nfcring.com/
- sschueller 11y ago
  I am able to pay with NFC on my note 3 without waking up the phone or unlocking it. [0] [0] https://www.tapit.ch/en https://www.tapit.ch/en
  - mike-cardwell 11y ago
    I can unlock my OnePlus One using my NFC ring. The screen has to be turned on first though.
  - rstuder 11y ago
    In the case of Tapit NFC does not communicate with the OS or the apps of the phone. NFCcommunicates directly with the SIM card and the applets installed on there. You can actually have your phone turned off and Tapit will still work. (Source: I support the Tapit team)
hobarrera 11y ago
There's little research into these sort of implants, but lots of potential, IMHO. At one point, I though about a subdermal RFID to use with an RFID door-lock. Then I realized it can trivially be copied and spoofed, so no. I'm currently considering the utility of an NFC chip which shares a vcard (vcf) to quickly share contact details. Sound doable, trivial, and somewhat useful.
- crististm 11y ago
  I've heard that these implants also get you some piece of mind knowing that you are safe/secure. Dogs get these implants too and they look more intelligent then those who don't get to have them.
  - 13 11y ago
    Would be amusing to program the RFID in someone's dog to open the front door though, necessitating picking up a German Shepard to hold it up to a reader. Better still make the dog a spare key and nobody would ever notice.
    - thrownaway122 11y ago
      Cat flaps already do this...
      - pvaldes 11y ago
        Mhhh... I realise now that cats are the perfect NSA intrusion mecanism in fact. You can put some kitten of troy in front of the port of a hacker and your feline agent will couple and connect with the hacker laptop with a 100% of accuracy for many minutes each day. Is the perfect crime, if we think about it... they could call it, the PPP (Pretty Pink Panther) project.
        pavel_lishin 11y ago
        http://en.wikipedia.org/wiki/Acoustic_Kitty http://en.wikipedia.org/wiki/Acoustic_Kitty
neotek 11y ago
I've wanted to do this (implant an RFID chip, not exploit Android phones) for a while now but I can't figure out how to get it done here in Australia. Anyone have any suggestions?
- PhasmaFelis 11y ago
  It's not exactly an above-board medical procedure in the US, either. What are body modification laws like in Australia? I think most of the Americans with this sort of implant had them done by professional body piercers, which is legal in most US states (though possibly not Florida, going by the article). Of course, many piercers won't want to, and in any case they aren't licensed to use anesthesia, which you may consider a drawback. I would say your best bet is to Google for info on how it's done and on the legality of under-skin cosmetic implants in Australia, then take your findings to local body piercers and see if you can find any willing to do it.
  - neotek 11y ago
    Thank you, I'll do as you suggest.
- sgentle 11y ago
  I had a magnetic implant done by Joeltron in Sydney. If he can't do it for you he'd at least know whether there's anyone who can: http://www.joeltron.com/ http://www.joeltron.com/ (some parts of that website are pretty nsfw)
athoik 11y ago
Surgery: https://xkcd.com/644/ https://xkcd.com/644/
binarymax 11y ago
"Such an implant doesn’t get picked up at airports and so on, the amount of metal in it is far far less than wearing a watch or wedding ring." why not use a device embedded in a watch or wedding ring instead of injecting yourself with a piece of tech that can be obsoleted with a patch? Security personnel won't suspect such things.
- joeyspn 11y ago
  Or in a simple wristband (powerbalance, etc..)
  - throwitout 11y ago
    or put the NFC device in something like a barbell or ring, and pierce a part of the body where you'd normally find a piercing. You'd always have it on you, and be able to swap it out as upgrades are required.
amelius 11y ago
Can somebody explain how this could possibly work in a world where strong encryption is already commonplace?
jordigh 11y ago
This reminds me so much of cyberpunk fantasy and of the Panther Moderns sporting microsofts. Backstreet chip implants for enhancing hacking skills.
castell 11y ago
All registered dogs already need a NFC implant. Hopefully this requirement will never ever carry on to human beings - it's like 1984. [edit: Technically the dog implants use RFID. NFC standards cover communications protocols and data exchange formats, and are based on existing radio-frequency identification (RFID) standards including ISO/IEC 14443 and FeliCa. There are several RFID frequency bands like 13.56 MHz: http://en.wikipedia.org/wiki/Radio-frequency_identification#Frequencies http://en.wikipedia.org/wiki/Radio-frequency_identification#... ]
- narrowrail 11y ago
  This depends on how widely you define NFC. In the US, dogs are implanted with transponders that use ~134kHz, while NFC is technically 13.56MHz.
- cgtyoder 11y ago
  What country? Certainly not the US.
  - eli 11y ago
    England by 2016. Probably others.
  - chiph 11y ago
    The EU Pet Passport, that lets Fido skip Rabies quarantine, require that he have an implanted chip. http://ec.europa.eu/food/animal/liveanimals/pets/qanda_en.htm http://ec.europa.eu/food/animal/liveanimals/pets/qanda_en.ht...
  - castell 11y ago
    Several countries in the EU have it already, they other have to follow soon.
lucb1e 11y ago
A friend of mine did this as well. Didn't know this was cool enough to get on Forbes.
before 11y ago
> Exploit android > It has an NFC antenna that pings Android phones, asking them to open a link.
davidgerard 11y ago
> A combination of pallid skin, hoody and laptop is the biggest giveaway. Bah (waves) everyone knows that hackers wear business suits and balaclavas. https://www.google.co.uk/search?q=stock+photo+hacker&tbm=isch https://www.google.co.uk/search?q=stock+photo+hacker&tbm=isc...
mpclark 11y ago
Think of all the ways you could tempt a phone user to visit a specific URL. An email, Twitter, a QR code, graffiti etc. This is just another one of those -- and not particularly easy to execute, at that. And if I wanted to carry a URL across borders or into a secure facility I would memorise a bitly link.
- DEinspanjer 11y ago
  Yeah. Even a QR code could be much easier to deal with. Maybe as a follow-up they'll demonstrate using a tattoo of a QR code. ;)
FLUX-YOU 11y ago
>A combination of pallid skin, hoody and laptop is the biggest giveaway. Such hackneyed images of hackers are, of course, evidently wrong, bordering on offensive Damn straight it's offensive. I spent a lot of money on a suit, skimask and laptop.
- patcheudor 11y ago
  >Going by hacker stereotypes, it’d be pretty easy to physically identify anyone committing an act of digital crime. A combination of pallid skin, hoody and laptop is the biggest giveaway. Our pen-testing group has members who fit that exact stereotype. We've found that people don't care, even when acting suspicious. In fact, it gets more interesting. Awhile back we all picked up blue prison work jumpsuits from a local surplus store that say "Work Crew" on the back in faded lettering. When combined with a small red toolbox it seems prison jumpsuits are as good as a firefighters uniform for gaining access to places. I've become bold enough while wearing mine that I've openly picked locks on doors in busy offices. I haven't been caught yet & the assessment photos really hit home far more in the end-of-review report. It's pretty easy for a manager to dismiss a compromise by someone dressed as a fire fighter but not so much when its some dude in a prison jumpsuit.
  - spacemanmatt 11y ago
    I love this. You have taken pen-testing to a level of security-shaming.
    - jacquesm 11y ago
      Standard trick to enter a building you have no business being in: carry a large cardboard box while walking up to the door just behind someone else. Better than even money they'll hold the door open for you.
fmela 11y ago
> He first had to acquire the chip, designed to be injected into cattle for agricultural uses, from Chinese company Freevision (see images below for their animal products and the sizeable syringe used by Wahle). But the chip, which has just 888 bytes of memory Something tells me that the 888 byte memory limit is intentional.
- ptaipale 11y ago
  What you won't find is a chip with 444 bytes of memory. That would be a killer (not in a positive sense).
- discardorama 11y ago
  According to the vendor, it has max 256B of memory: http://www.alibaba.com/product-detail/Bio-glass-Schott-8625-ISO11784-785_1312956746.html http://www.alibaba.com/product-detail/Bio-glass-Schott-8625-...
rlonstein 11y ago
A friend implanted an RFID in 2005... http://screwdecaf.cx/chipped.html http://screwdecaf.cx/chipped.html I suppose the bloviating about security and Android is a twist on the story.
DEinspanjer 11y ago
I recorded a video that shows my hand a week or so after my installation: https://www.youtube.com/watch?v=WeIqDlaatp0 https://www.youtube.com/watch?v=WeIqDlaatp0 This was an xNT NFC tag: https://dangerousthings.com/shop/xnt-ntag216-2x12mm-glass-tag/ https://dangerousthings.com/shop/xnt-ntag216-2x12mm-glass-ta... Turns out it wasn't installed too shallow, I just have thin and pale skin which makes it very visible. :) The scar did disappear completely. Still use it on my door locks and with a couple of apps on my phone. Not sure if the antenna coil on this person's NFC chip is larger or better orientated than mine, but one thing I'll say is that it isn't that easy to get a random phone to pick it up. It took me several tries to figure out where I had to put my hand, and a few weeks before I could quickly and reliably get it to scan on the first try. If I scan it with someone else's phone, it still takes several tries. The antenna on most phones isn't very large, and the antenna on the NFC chips are miniscule, so getting the right orientation and position isn't as easy as swiping an RFID or NFC badge.
frozenport 11y ago
Is it socially acceptable to walk around exploiting other people's devices :-)
- juliangregorian 11y ago
  The whole premise of social engineering is subverting what is considered socially acceptable.
deleted 11y ago
[deleted]

87 points by cgtyoder 11y ago

NFC in Android is not active while the device is locked [0] > Android-powered devices are usually looking for NFC tags when the screen is unlocked, unless NFC is disabled in the device's Settings menu. So to use this, the hacker already needs an unlocked device, in which case it's just as easy to download the payload directly. Usually, the range for NFC to work is quite close, 4 cm or less [1], and I don't think these chips have the capability to increase the range. [0]: http://developer.android.com/guide/topics/connectivity/nfc/nfc.html http://developer.android.com/guide/topics/connectivity/nfc/n... [1]: https://developer.android.com/guide/topics/connectivity/nfc/index.html https://developer.android.com/guide/topics/connectivity/nfc/...

flintchip 11y ago
"Just as easily" is not the same as "surreptitiously".
- _ikke_ 11y ago
  Not withstanding exploits, the user still has to accept the offered link, so it's not really stealthy in that case.
ge0rg 11y ago
You are right. The exploit is further complicated by the fact that Android will refuse to install apps outside of Google Play by default. The same effect could probably be reached with an NFC tag in a ring or hidden in your wear, without the pain.
- jackweirdy 11y ago
  Or an actual NFC ring (probably disguised a bit) http://nfcring.com/ http://nfcring.com/
sschueller 11y ago
I am able to pay with NFC on my note 3 without waking up the phone or unlocking it. [0] [0] https://www.tapit.ch/en https://www.tapit.ch/en
- mike-cardwell 11y ago
  I can unlock my OnePlus One using my NFC ring. The screen has to be turned on first though.
- rstuder 11y ago
  In the case of Tapit NFC does not communicate with the OS or the apps of the phone. NFCcommunicates directly with the SIM card and the applets installed on there. You can actually have your phone turned off and Tapit will still work. (Source: I support the Tapit team)

hobarrera 11y ago

There's little research into these sort of implants, but lots of potential, IMHO. At one point, I though about a subdermal RFID to use with an RFID door-lock. Then I realized it can trivially be copied and spoofed, so no. I'm currently considering the utility of an NFC chip which shares a vcard (vcf) to quickly share contact details. Sound doable, trivial, and somewhat useful.

crististm 11y ago
I've heard that these implants also get you some piece of mind knowing that you are safe/secure. Dogs get these implants too and they look more intelligent then those who don't get to have them.
- 13 11y ago
  Would be amusing to program the RFID in someone's dog to open the front door though, necessitating picking up a German Shepard to hold it up to a reader. Better still make the dog a spare key and nobody would ever notice.
  - thrownaway122 11y ago
    Cat flaps already do this...
    - pvaldes 11y ago
      Mhhh... I realise now that cats are the perfect NSA intrusion mecanism in fact. You can put some kitten of troy in front of the port of a hacker and your feline agent will couple and connect with the hacker laptop with a 100% of accuracy for many minutes each day. Is the perfect crime, if we think about it... they could call it, the PPP (Pretty Pink Panther) project.
      - pavel_lishin 11y ago
        http://en.wikipedia.org/wiki/Acoustic_Kitty http://en.wikipedia.org/wiki/Acoustic_Kitty

neotek 11y ago

I've wanted to do this (implant an RFID chip, not exploit Android phones) for a while now but I can't figure out how to get it done here in Australia. Anyone have any suggestions?

PhasmaFelis 11y ago
It's not exactly an above-board medical procedure in the US, either. What are body modification laws like in Australia? I think most of the Americans with this sort of implant had them done by professional body piercers, which is legal in most US states (though possibly not Florida, going by the article). Of course, many piercers won't want to, and in any case they aren't licensed to use anesthesia, which you may consider a drawback. I would say your best bet is to Google for info on how it's done and on the legality of under-skin cosmetic implants in Australia, then take your findings to local body piercers and see if you can find any willing to do it.
- neotek 11y ago
  Thank you, I'll do as you suggest.
sgentle 11y ago
I had a magnetic implant done by Joeltron in Sydney. If he can't do it for you he'd at least know whether there's anyone who can: http://www.joeltron.com/ http://www.joeltron.com/ (some parts of that website are pretty nsfw)

athoik 11y ago

Surgery: https://xkcd.com/644/ https://xkcd.com/644/

binarymax 11y ago

"Such an implant doesn’t get picked up at airports and so on, the amount of metal in it is far far less than wearing a watch or wedding ring." why not use a device embedded in a watch or wedding ring instead of injecting yourself with a piece of tech that can be obsoleted with a patch? Security personnel won't suspect such things.

joeyspn 11y ago
Or in a simple wristband (powerbalance, etc..)
- throwitout 11y ago
  or put the NFC device in something like a barbell or ring, and pierce a part of the body where you'd normally find a piercing. You'd always have it on you, and be able to swap it out as upgrades are required.

amelius 11y ago

Can somebody explain how this could possibly work in a world where strong encryption is already commonplace?

jordigh 11y ago

This reminds me so much of cyberpunk fantasy and of the Panther Moderns sporting microsofts. Backstreet chip implants for enhancing hacking skills.

castell 11y ago

All registered dogs already need a NFC implant. Hopefully this requirement will never ever carry on to human beings - it's like 1984. [edit: Technically the dog implants use RFID. NFC standards cover communications protocols and data exchange formats, and are based on existing radio-frequency identification (RFID) standards including ISO/IEC 14443 and FeliCa. There are several RFID frequency bands like 13.56 MHz: http://en.wikipedia.org/wiki/Radio-frequency_identification#Frequencies http://en.wikipedia.org/wiki/Radio-frequency_identification#... ]

narrowrail 11y ago
This depends on how widely you define NFC. In the US, dogs are implanted with transponders that use ~134kHz, while NFC is technically 13.56MHz.
cgtyoder 11y ago
What country? Certainly not the US.
- eli 11y ago
  England by 2016. Probably others.
- chiph 11y ago
  The EU Pet Passport, that lets Fido skip Rabies quarantine, require that he have an implanted chip. http://ec.europa.eu/food/animal/liveanimals/pets/qanda_en.htm http://ec.europa.eu/food/animal/liveanimals/pets/qanda_en.ht...
- castell 11y ago
  Several countries in the EU have it already, they other have to follow soon.

lucb1e 11y ago

A friend of mine did this as well. Didn't know this was cool enough to get on Forbes.

before 11y ago

> Exploit android > It has an NFC antenna that pings Android phones, asking them to open a link.

davidgerard 11y ago

> A combination of pallid skin, hoody and laptop is the biggest giveaway. Bah (waves) everyone knows that hackers wear business suits and balaclavas. https://www.google.co.uk/search?q=stock+photo+hacker&tbm=isch https://www.google.co.uk/search?q=stock+photo+hacker&tbm=isc...

mpclark 11y ago

Think of all the ways you could tempt a phone user to visit a specific URL. An email, Twitter, a QR code, graffiti etc. This is just another one of those -- and not particularly easy to execute, at that. And if I wanted to carry a URL across borders or into a secure facility I would memorise a bitly link.

DEinspanjer 11y ago
Yeah. Even a QR code could be much easier to deal with. Maybe as a follow-up they'll demonstrate using a tattoo of a QR code. ;)

FLUX-YOU 11y ago

>A combination of pallid skin, hoody and laptop is the biggest giveaway. Such hackneyed images of hackers are, of course, evidently wrong, bordering on offensive Damn straight it's offensive. I spent a lot of money on a suit, skimask and laptop.

patcheudor 11y ago
>Going by hacker stereotypes, it’d be pretty easy to physically identify anyone committing an act of digital crime. A combination of pallid skin, hoody and laptop is the biggest giveaway. Our pen-testing group has members who fit that exact stereotype. We've found that people don't care, even when acting suspicious. In fact, it gets more interesting. Awhile back we all picked up blue prison work jumpsuits from a local surplus store that say "Work Crew" on the back in faded lettering. When combined with a small red toolbox it seems prison jumpsuits are as good as a firefighters uniform for gaining access to places. I've become bold enough while wearing mine that I've openly picked locks on doors in busy offices. I haven't been caught yet & the assessment photos really hit home far more in the end-of-review report. It's pretty easy for a manager to dismiss a compromise by someone dressed as a fire fighter but not so much when its some dude in a prison jumpsuit.
- spacemanmatt 11y ago
  I love this. You have taken pen-testing to a level of security-shaming.
  - jacquesm 11y ago
    Standard trick to enter a building you have no business being in: carry a large cardboard box while walking up to the door just behind someone else. Better than even money they'll hold the door open for you.

fmela 11y ago

> He first had to acquire the chip, designed to be injected into cattle for agricultural uses, from Chinese company Freevision (see images below for their animal products and the sizeable syringe used by Wahle). But the chip, which has just 888 bytes of memory Something tells me that the 888 byte memory limit is intentional.

ptaipale 11y ago
What you won't find is a chip with 444 bytes of memory. That would be a killer (not in a positive sense).
discardorama 11y ago
According to the vendor, it has max 256B of memory: http://www.alibaba.com/product-detail/Bio-glass-Schott-8625-ISO11784-785_1312956746.html http://www.alibaba.com/product-detail/Bio-glass-Schott-8625-...

rlonstein 11y ago

A friend implanted an RFID in 2005... http://screwdecaf.cx/chipped.html http://screwdecaf.cx/chipped.html I suppose the bloviating about security and Android is a twist on the story.

DEinspanjer 11y ago

I recorded a video that shows my hand a week or so after my installation: https://www.youtube.com/watch?v=WeIqDlaatp0 https://www.youtube.com/watch?v=WeIqDlaatp0 This was an xNT NFC tag: https://dangerousthings.com/shop/xnt-ntag216-2x12mm-glass-tag/ https://dangerousthings.com/shop/xnt-ntag216-2x12mm-glass-ta... Turns out it wasn't installed too shallow, I just have thin and pale skin which makes it very visible. :) The scar did disappear completely. Still use it on my door locks and with a couple of apps on my phone. Not sure if the antenna coil on this person's NFC chip is larger or better orientated than mine, but one thing I'll say is that it isn't that easy to get a random phone to pick it up. It took me several tries to figure out where I had to put my hand, and a few weeks before I could quickly and reliably get it to scan on the first try. If I scan it with someone else's phone, it still takes several tries. The antenna on most phones isn't very large, and the antenna on the NFC chips are miniscule, so getting the right orientation and position isn't as easy as swiping an RFID or NFC badge.

frozenport 11y ago

Is it socially acceptable to walk around exploiting other people's devices :-)

juliangregorian 11y ago
The whole premise of social engineering is subverting what is considered socially acceptable.

deleted 11y ago

[deleted]