The Implications of RFID Technology in University ID Cards

Missouri S&T’s Peer to Peer Volume 1 | Issue 1 Article 3 February 2016 The Implications of RFID Technology in University ID Cards Michael Beaver Follow this and additional works at: https://scholarsmine.mst.edu/peer2peer Part of the Information Security Commons Recommended Citation Beaver, Michael. 2016. "The Implications of RFID Technology in University ID Cards." Missouri S&T’s Peer to Peer 1, (1). https://scholarsmine.mst.edu/peer2peer/vol1/iss1/3 This Article - Journal is brought to you for free and open access by Scholars' Mine. It has been accepted for inclusion in Missouri S&T’s Peer to Peer by an authorized administrator of Scholars' Mine. This work is protected by U. S. Copyright Law. Unauthorized use including reproduction for redistribution requires the permission of the copyright holder. For more information, please contact . Beaver: RFID Technology in University ID Cards The Implications of RFID Technology in University ID Cards S&T’s Peer to Peer: An Undergraduate Research Journal (Vol 1; Issue 1 – 2016) Beaver 1 The Implications of RFID Technology in University ID Cards Michael Beaver Missouri University of Science and Technology Radio frequency identification (RFID) chips have been rising in popularity because of their usefulness and convenience, and have now made their way into the ID cards of universities. An RFID chip is an identification device that, when powered by some nearby source, sends out a signal with information that was stored in the chip. RFID physical security systems work just like a lock and key, with the RFID chip acting as the key. Instead of having a unique pattern, RFID chips have an identification code that is read by the lock. Some RFID chips also hide this code behind a series of encryptions. While this can be very convenient when used for door locks and quick pay systems, there are still many RFID chips that have insufficient securities protecting the information they hold. Based on the increasing trend of RFID usage (RFID forecasts, 2014), it is safe to assume that many more universities will follow. However, this convenience could come at the cost of security. The implementation of RFID technology in ID cards on college campuses could be a serious security risk if universities do not commit to ongoing investments in security and research. RFID Insecurities Northern Arizona University (NAU) is one example of an innovative university that is utilizing RFID chips in their student ID cards. This system has allowed professors to record student attendance automatically, which became relevant once “student attendance (and attendance collection by Published by Scholars' Mine, 2016 1 Missouri S&T’s Peer to Peer, Vol. 1, Iss. 1 [2016], Art. 3 The Implications of RFID Technology in University ID Cards S&T’s Peer to Peer: An Undergraduate Research Journal (Vol 1; Issue 1 – 2016) Beaver 2 instructors) became mandatory”(NAU, 2013) in 2012. NAU made this policy because “Numerous studies show a strong correlation between attendance and student success” (NAU, 2013) and they have seen great results. Even though there are considerable benefits to using RFID chips in student ID cards, some argue that they shouldn’t be used for students at all. They believe that the RFID chips provide an unacceptable form of tracking on the students that amounts to a breach of student privacy. There are even “three Texas bills [that] seek to either curtail or outright ban the use of RFID student trackers” (Barnes, 2013). The issue here is whether or not RFID technology is too much of a loose cannon for use in student ID cards because while there are very significant benefits, there certainly are risks involved that need to addressed. In 2013, Francis Brown spoke at a hacking conference about how he successfully accessed an RFID physical security system. He accomplished this by discreetly stealing access information from the RFID chips in employee entry devices. He then took this information and created a card clone, which he used to grant himself access to restricted areas protected by the RFID security systems (Brown, 2013). Brown has made all of the information that he used and created for this project available online. These resources provide all the tools necessary for anyone to discreetly steal information from RFID chips. Chris Paget’s research was completely devoted to reading RFID chips from as far away as possible. This involved the use of EPC Gen 2 RFID chips which are significantly different from most chips. EPC Gen 2 “supports operation at long distances (e.g., 25-30 feet), and has minimal support for security” (Smart Card Alliance, 2006). These chips can be found in various applications such as U.S. passports, enhanced drivers licenses, and even “leading organizations, such as the U.S. Department of Defense and Wal-Mart, have set goals for their suppliers to begin using RFID on shipments to their organizations” (Saygin & Sarangapani, 2007). Paget was capable of reading these chips from over 200 feet away, and he believes that longer ranges are possible (Paget, 2010). There are a number of possible consequences to malicious persons being capable of collecting https://scholarsmine.mst.edu/peer2peer/vol1/iss1/3 2 Beaver: RFID Technology in University ID Cards The Implications of RFID Technology in University ID Cards S&T’s Peer to Peer: An Undergraduate Research Journal (Vol 1; Issue 1 – 2016) Beaver 3 information from RFID systems discreetly and illicitly. Someone could grant themselves access to restricted areas, leading to anything from stealing information to obtaining restricted chemicals, the ramifications of which could be severe. At the same time, someone could also steal financial and personal information and use it to make purchases with the victim’s money. Beyond theft, there are a number of other issues that could arise. If using EPC Gen 2 chips someone could stalk an individual from over 200 feet away, and thereby determine a student’s daily schedule, and even identify when there are no other students nearby. These are just a few examples though, crimes are always changing and becoming more complex, and the versatility of RFID chips will only aid that development. University Security Although not every university has implemented RFID technology, it has been continuously increasing, and this trend is expected to continue. In 2014 the market worth of RFID technology was “$9.2 billion” and “IDTechEx forecast that to rise to $30.24 billion in 2024” (RFID forecasts, 2014). Based on this, it should be safe to assume that most universities will eventually implement some form of RFID system. When this happens, it is important that universities continually invest in the security of their RFID systems. When a university is implementing RFID technology, an investment into both security and research needs to be made to ensure the safety of its students. A large initial investment into determining what technology is secure (...truncated)