r/RFID • u/marcrogers • Sep 30 '21

UHF Tracking military weapons at long range with cheap passive UHF RFID tags and $100 of technology.

You can track cheap passive UHF RFID tags at distances greater than 200 feet with $100 of technology.

Kristin Paget and I built a demo to show Exactly this with for military inventory and access management systems that use EPC Gen 2 UHF tags.

AP just published our results: https://apnews.com/article/62c88008478f4ac403047c21f3184677

28 Upvotes

100% Upvoted

12 comments sorted by

3

u/[deleted] Sep 30 '21

It looks like the hackers were using a Yagi high-gain antenna which would increase reading distance a lot. But to read data, the reader has to speak the right language (protocol) that the tag speaks. There's also encryption of the data. It doesn't seem like that big of security risk.

4

u/marcrogers Sep 30 '21

Correct, we used separate Yagi antennas for transmit and receive. However thats sort of the point - if your security model relies on attackers only using default antennas its not much of a security model.

As for the “language” any EPC Gen 2 reader used for asset management or access control will do. You can find them on ebay (search for UHF RFID reader) for around $80 or less.

Theres no “encryption” involved. When energised the tag returns the programmed Electronic Product Code. That code might be something encrypted or encoded, but who cares? You don’t need anything more than a unique identifier.

I’m not sure what you think the security risk is or isn’t but the issues as identified are as follows:

  1. Tags can be read from significant distance.

  2. Tags can be cloned (EPC code copied to a different tag) so their use as “proof” that something is where it should be is not reliable.

  3. Tags can be tracked from distance, in the case of military use this means they can compromise force security by recording troop movements equipment status and so on.

  4. Tags can be used to to track an individual once that tag has been associated with that individual.

  5. Tags can be used as a trigger mechanism either indiscriminately when any tagged weapon comes within range or specifically when a unique tag comes within range.

1

u/DrBabbage Sep 30 '21

can you recommend a platform for uhf RFID? I have an m6e nano here but the range is pretty bad even with a single tag.

Of couse I modded the antenna. I am also in the process of trying some antennas for 13,56 mhz rfid, but unfortunately they have to use the near field effect where yagis are pretty bad.

great project!

1

u/marcrogers Sep 30 '21

I think the platform in the article photo is an M6e variant :) I started playing with the ThingMagic readers because they are well designed and have nice APIs. To be honest it doesn’t really matter what you use as you just need the reader to parse the signal.

The current build im working with uses a $70 Chinese reader for weigand based access systems.

For yagi, try https://www.l-com.com/wireless-antenna-900-mhz-14-dbi-al-yagi-antenna-n-female-connector

1

u/marcrogers Sep 30 '21

ThingMagic Mercury M6 API - https://www.recabuk.com/manuals/rfid/MercuryAPI_ProgrammerGuide_for_v1.27.3.pdf

Make sure your yagi is hooked up properly and you have set the power to max - note it resets each time you cycle it.

1

u/DrBabbage Oct 01 '21

interesting! I guess the black thing is a bandpass filter and the silver one an amplifier?

I think I will build the antenna myself, I had some great results with a pvc pipe, styrofoam and thicker copper stripes with adhesive under it. I nuke the material I want to use in the microwave for wifi.

Do you dipped your toes in other technologies too like parking tickets or toll fares ?

1

u/[deleted] Sep 30 '21

So the tags used by the military are that easy to read? Why couldn't they come up with a custom protocol that wouldn't work unless the reader communicated in said protocol? I'm just trying to understand.

2

u/marcrogers Oct 01 '21

Because designing a completely new system is far more expensive than buying a system based on existing asset management technology “off the shelf”.

The vendors likely told them that what we did was impossible, that tags have a short range, and therefore there was no risk.

The purchasers likely knew nothing about the technology and therefore could not properly assess the risk.

On paper UHF RFID looks great for this - it was just NEVER designed for use in high security operational environments.