CastleCops® - Near Field Communication Technology - Will it Allow Identity Theft via Cell?

katiec writes "By katiec, CastleCops Staff.

Bluetooth. You’ve seen them - those trendy little earpieces that are worn as much for fashion as functionality. (In fact, a kid came to my mother-in-law’s funeral wearing his this summer. No kidding! But that’s another story for another time.)

Utilizing Near Field Communication technology (NFC) Bluetooth and other like products will offer consumers options like the ability to pay your restaurant bill with your cell phone complete with receipt. But just exactly how secure can this be?

NFC was jointly developed by Sony and Philips and was approved as an ISO/IEC standard on December 8, 2003. It was approved as an ECMA standard prior to that. On March 18, 2004 Nokia, Sony and Philips formed NFC-forum to advance NFC development. Although NFC technology holds the promise of bringing true mobility to consumer electronics in an intuitive and psychologically comfortable way, it definitely poses some security risks that need addressing.

NFC, unlike Radio Frequency Identification (RFID), uses 2-way communication.

According to Scott McGregor, president and CEO of Philips Semiconductors, “The NFC, standardized into ISO 18092, operates at 13.56 MHz frequency. Its radio-frequency interface technology exchanges data between consumer electronics devices at a distance of 10 cm. Beyond using a contactless card on a contactless smart card reader, two NFC devices can communicate with each other for data transfer.”

That’s fine as long as it is secured communication but as McGregor points out, “The technology can be also used to trigger Bluetooth connections. With two Bluetooth-enabled devices in close proximity, NFC can automatically initialize Bluetooth connectivity.”

Although an interesting concept, it may also allow for theft of credit card info or the ability to spread Symbian based malware.

Say you are talking on your Bluetooth while sipping lattes at Starbuck’s and the person beside you taps into your frequency and sends you some nasty little bug. When you go home and hot-sync your Blackberry et al with your computer and “voila!” you have now transferred that virus to your computer.

In 2004, the first purported virus using Bluetooth to spread itself among mobile phones appeared for the Symbian OS. Although the installation of unknown software requires confirmation before it can propagate, this is still a concern. So far, this is regarded as just a potential security threat of Bluetooth or Symbian OS as the virus has not yet spread in the wild. But is it just a matter of time?
Police in Cambridgeshire, England, issued warnings about thieves using Bluetooth-enabled phones to track other devices left in cars in August 2005. Users need to be sure any mobile networking connections are deactivated if laptops and other devices are left in this way.
In April 2006, researchers from Secure Network and F-Secure published a report that warned of the huge number of devices left in a visible state, and issued statistics on the spread of various Bluetooth services and the ease of spread of an eventual Bluetooth worm.

Although it may not be as cool or convenient, corded earpieces are still probably a safer alternative to NFCs. However, I managed to pull my last cell phone into a sink full of dishwater when I was wearing one recently. The result, I could only speed dial five and call my sister. But, that’s yet another story for another time. "


	2002-2008 © Computer Cops LLC dba CastleCops®. All rights reserved. Acceptable Use Policy. Use signifies your agreement. 109ppm 0.284s (0.027s) Making cybercriminals unhappy since 2002*