3 ms·

NFC in Android is not active while the device is locked [0] > Android-powered devices are usually looking for NFC tags when the screen is unlocked, unless NFC

by _ikke_ 11y ago

NFC in Android is not active while the device is locked [0] > Android-powered devices are usually looking for NFC tags when the screen is unlocked, unless NFC is disabled in the device's Settings menu. So to use this, the hacker already needs an unlocked device, in which case it's just as easy to download the payload directly. Usually, the range for NFC to work is quite close, 4 cm or less [1], and I don't think these chips have the capability to increase the range. [0]: http://developer.android.com/guide/topics/connectivity/nfc/nfc.html http://developer.android.com/guide/topics/connectivity/nfc/n... [1]: https://developer.android.com/guide/topics/connectivity/nfc/index.html https://developer.android.com/guide/topics/connectivity/nfc/...

flintchip 11y ago
"Just as easily" is not the same as "surreptitiously".
- _ikke_ 11y ago
  Not withstanding exploits, the user still has to accept the offered link, so it's not really stealthy in that case.
ge0rg 11y ago
You are right. The exploit is further complicated by the fact that Android will refuse to install apps outside of Google Play by default. The same effect could probably be reached with an NFC tag in a ring or hidden in your wear, without the pain.
- jackweirdy 11y ago
  Or an actual NFC ring (probably disguised a bit) http://nfcring.com/ http://nfcring.com/
sschueller 11y ago
I am able to pay with NFC on my note 3 without waking up the phone or unlocking it. [0] [0] https://www.tapit.ch/en https://www.tapit.ch/en
- mike-cardwell 11y ago
  I can unlock my OnePlus One using my NFC ring. The screen has to be turned on first though.
- rstuder 11y ago
  In the case of Tapit NFC does not communicate with the OS or the apps of the phone. NFCcommunicates directly with the SIM card and the applets installed on there. You can actually have your phone turned off and Tapit will still work. (Source: I support the Tapit team)

by _ikke_ 11y ago

flintchip 11y ago

"Just as easily" is not the same as "surreptitiously".

_ikke_ 11y ago
Not withstanding exploits, the user still has to accept the offered link, so it's not really stealthy in that case.

ge0rg 11y ago

You are right. The exploit is further complicated by the fact that Android will refuse to install apps outside of Google Play by default. The same effect could probably be reached with an NFC tag in a ring or hidden in your wear, without the pain.

jackweirdy 11y ago
Or an actual NFC ring (probably disguised a bit) http://nfcring.com/ http://nfcring.com/

sschueller 11y ago

I am able to pay with NFC on my note 3 without waking up the phone or unlocking it. [0] [0] https://www.tapit.ch/en https://www.tapit.ch/en

mike-cardwell 11y ago
I can unlock my OnePlus One using my NFC ring. The screen has to be turned on first though.
rstuder 11y ago
In the case of Tapit NFC does not communicate with the OS or the apps of the phone. NFCcommunicates directly with the SIM card and the applets installed on there. You can actually have your phone turned off and Tapit will still work. (Source: I support the Tapit team)