Lesson Title: Media Interface Threats, Risks, and Mitigation Dale R. Thompson Computer Science and Computer Engineering Dept. University of Arkansas 1 This material is based upon work supported by the National Science Foundation under Grant No. DUE Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect the views of the National Science Foundation (NSF). Copyright © 2008, 2009 by Dale R. Thompson

Apply STRIDE* How can you spoof the system? How can you tamper with data? How can you repudiate your actions? How can you cause the system to disclose information (information disclosure) that should be confidential? How can you deny service to authorized users? How can you elevate your privilege? 2 *M. Howard and D. LeBlanc, Writing Secure Code 2nd ed., Redmond, Washington: Microsoft Press, 2003.

Media Interface Layer Threats 3 STRIDE* Category Threat Spoofing Identity - Replay tag responses - Replay reader responses - Relay attack Tampering with data Intercept and modify signal (difficult) Repudiation None Information disclosure Eavesdropping on reader and tag signals Denial of service - Jamming - Shielding - Coupling - Blocker tag Elevation of privilege None *M. Howard and D. LeBlanc, Writing Secure Code 2nd ed., Redmond, Washington: Microsoft Press, 2003.

Which threat seems the most important? 4

Media Interface Layer Mitigation 5 STRIDE* Category ThreatMitigation Spoofing Identity - Replay tag responses - Replay reader responses - Relay attack - Authentication - Authentication - Authentication Tampering with data Intercept and modify signal (difficult) Repudiation None Information disclosure Eavesdropping on reader and tag signals - Cryptography Denial of service - Jamming - Shielding - Coupling - Blocker tag Easy to detect Elevation of privilege None *M. Howard and D. LeBlanc, Writing Secure Code 2nd ed., Redmond, Washington: Microsoft Press, 2003.

Gen2 Passwords Access Password: 32-bit password to prevent changing of EPC either temporarily or permanently Kill Password: 32-bit password to prevent killing of the tag Locking – Lock – Unlock – Permanently Lock – Permanently Unlock 6

Gen2 Locking Options Read unlocked Read locked – password required to read Write locked – password required to write Read permanently unlocked – Memory can be read and never locked Write permanently unlocked – Password required to write – Memory cannot be locked 7

Gen2 Memory sections that can be locked Kill password memory Access password memory EPC memory TID memory User memory Options: Locked, Unlocked, Permanently Locked, or Permanently Unlocked 8

Gen2 Cover-Coding Write, Kill, and Access commands use one- time pad to obscure transmitted word from the reader – Reader asks tag for new RN16 – Tag whispers the RN16 to the reader – Reader does a bit-wise exclusive-OR (XOR) of RN16 and 16-bit word to be transmitted – Tag decrypts by doing bit-wise XOR of the received word with the RN16 it sent 9

Apply DREAD* What is the damage potential? How easy is the threat to reproduce? How easy is the threat to exploit? Rank the number of affected users that the threat affects. How easy is it for the threat to be discovered? 10 *M. Howard and D. LeBlanc, Writing Secure Code 2nd ed., Redmond, Washington: Microsoft Press, 2003.

Contact Information Dale R. Thompson, Ph.D., P.E. Associate Professor Computer Science and Computer Engineering Dept. JBHT – CSCE University of Arkansas Fayetteville, Arkansas Phone: +1 (479) FAX: +1 (479) WWW:

Copyright Notice, Acknowledgment, and Liability Release Copyright Notice – This material is Copyright © 2008, 2009 by Dale R. Thompson. It may be freely redistributed in its entirety provided that this copyright notice is not removed. It may not be sold for profit or incorporated in commercial documents without the written permission of the copyright holder. Acknowledgment – These materials were developed through a grant from the National Science Foundation at the University of Arkansas. Any opinions, findings, and recommendations or conclusions expressed in these materials are those of the author(s) and do not necessarily reflect those of the National Science Foundation or the University of Arkansas. Liability Release – The curriculum activities and lessons have been designed to be safe and engaging learning experiences and have been field-tested with university students. However, due to the numerous variables that exist, the author(s) does not assume any liability for the use of this product. These curriculum activities and lessons are provided as is without any express or implied warranty. The user is responsible and liable for following all stated and generally accepted safety guidelines and practices. 12