RFID Security Threats and Countermeasures
Attack Vectors and Mitigation
Overview of RFID attack vectors including cloning, eavesdropping, relay attacks, and denial-of-service with mitigation strategies.
RFID Security Threats and Countermeasures
Every RFID deployment is a radio system — and radio systems broadcast to anyone within range. Understanding the realistic threat model for your deployment helps you apply the right countermeasures without over-engineering a solution for a risk that does not exist in your environment.
Threat Model Overview
Threats against RFID systems fall into three categories: confidentiality attacks (reading data you should not see), integrity attacks (modifying or forging data), and availability attacks (disrupting the system). The severity of each depends heavily on the tag type, deployment environment, and the value of the data being protected.
| Threat Category | Example Attack | Affected Tag Types | Impact |
|---|---|---|---|
| Confidentiality | Eavesdropping on reader-tag exchange | All passive UHF | Data exposure |
| Integrity | Cloning a tag and replaying its EPC | Gen 2 without crypto | Counterfeit goods |
| Integrity | Writing malicious data to user memory | Writable tags | System corruption |
| Availability | RF jamming / blocker tags | All | Loss of reads |
| Availability | Denial-of-service via inventory flooding | UHF Gen 2 | Reader saturation |
Cloning and Tag Forgery
Tag cloning is the most frequently cited threat in retail and pharmaceutical contexts. An attacker reads a genuine tag's EPC and programs an identical EPC onto a blank tag. Because standard EPC Gen 2 tags do not authenticate themselves, a cloned tag is indistinguishable at the RF level.
Countermeasures include:
- Crypto-enabled tags — NXP UCODE DNA, Impinj M800, and similar chips perform AES-128 challenge-response authentication. Even if the EPC is copied, the cryptographic response cannot be replicated without the secret key.
- TID-based verification — The TID memory bank contains a factory-programmed, read-only identifier unique to each chip die. Backend systems can cross-check EPC against TID to detect clones.
- Kill command — Tags retired at point-of-sale can be permanently disabled, eliminating a source of clonable tags in the wild.
- EAS bit — The Electronic Article Surveillance bit can serve as an additional in-store integrity signal.
Eavesdropping
Eavesdropping means passively recording the RF conversation between a reader and tag using a software-defined radio or purpose-built sniffer. Forward-link eavesdropping (reader to tag) is easier — readers transmit at up to 2 W EIRP. Reverse-link eavesdropping (tag to reader) is harder but demonstrated at up to 10 m with directional antennas.
Mitigations:
- Physical shielding of sensitive zones (Faraday enclosures for storage)
- Minimise reader power to the minimum needed for reliable reads
- Encrypt EPC payload or use pseudonymous identifiers that map to real SKUs only in a secured backend
Relay and Replay Attacks
A replay attack captures a valid tag response and retransmits it later to impersonate the tag. Crypto-enabled tags defeat replay by incorporating a reader-supplied random challenge (nonce) in every cryptographic response — the response changes each session and cannot be reused.
Relay attacks extend the effective read range by forwarding RF signals over a wired or wireless link. They are relevant to access-control deployments rather than supply-chain RFID. Solutions include distance-bounding protocols and time-of-flight measurement.
Denial-of-Service
A rogue reader transmitting continuously on UHF RFID frequencies can prevent legitimate readers from communicating with tags. Dense reader mode (DRM) mitigates inter-reader interference in high-density deployments but does not protect against deliberate jamming. Physical-security controls — restricting RF access to the facility — are the primary defence.
Countermeasures Summary
| Countermeasure | Threat Addressed | Deployment Cost |
|---|---|---|
| Crypto tags (AES-128) | Cloning, replay | Medium (tag premium) |
| TID verification backend | Cloning | Low (software) |
| Kill command at POS | Post-sale cloning | Low |
| Faraday shielding | Eavesdropping | Medium–High |
| Minimum reader power | Eavesdropping | Low |
| Physical access control | Jamming, relay | Variable |
| Pseudonymous EPCs | Tracking / privacy | Low–Medium |
Use the RFID Tag Selector to filter tags by security feature — filter for "AES authentication" to see crypto-capable options.
See also: Crypto-Enabled RFID Tags, RFID Privacy Guide.
Pertanyaan yang Sering Diajukan
The primary RFID security threats are eavesdropping (intercepting tag-reader communication), relay attacks (extending effective read range to clone access credentials), cloning (duplicating a tag's EPC to counterfeit products or bypass access control), and denial-of-service jamming using a high-power RF transmitter. In supply chains, tag spoofing — writing a legitimate EPC to a counterfeit tag — is the most commercially damaging.
Tags with cryptographic authentication, such as NXP UCODE DNA or Impinj M775, implement a challenge-response protocol where the reader sends a random nonce and the tag responds with an AES-encrypted value derived from a secret key stored in protected memory. Because the secret key never leaves the tag, an attacker capturing the exchange cannot replay or clone it.
The EPC Gen2 kill command permanently deactivates a UHF tag, rendering it unresponsive to all future reader queries. It is protected by a 32-bit kill password. Retailers may kill tags at point-of-sale to prevent post-purchase tracking of consumer items. Once killed, a tag cannot be reactivated, so the command should only be issued after confirming the item has left the retail supply chain.
EPC Gen2 tags support a 32-bit access password that locks memory banks against unauthorized reads or writes. However, 32-bit passwords provide only 4 billion combinations and are transmitted in the clear in basic Gen2. For genuinely sensitive data, use tags with AES-128 mutual authentication (UCODE DNA, M775) or store only a non-sensitive reference ID on the tag, keeping sensitive data in a secured backend system.
Our guides cover a range of experience levels. Getting Started guides introduce RFID fundamentals. Implementation guides help engineers design RFID solutions for specific industries. Advanced guides cover topics like dense reader mode, anti-collision algorithms, and EPC encoding schemes.
Most getting-started guides require only a basic UHF RFID reader (such as the Impinj Speedway or ThingMagic M6e) and a few sample tags. Some guides reference desktop USB readers for development. All hardware requirements are listed at the beginning of each guide.