Eavesdropping Near Field Contactless Payments: A Quantitative - - PowerPoint PPT Presentation

▶

Dec 05, 2023 150 likes •621 views

Introduction Eavesdropping Antennas Experimental Work Results Conclusions Eavesdropping Near Field Contactless Payments: A Quantitative Analysis Thomas P. Diakos 1 Johann A. Bri ff a 1 Tim W. C. Brown 2 Stephan Wesemeyer 1 1 Department of

SLIDE 1

Introduction Eavesdropping Antennas Experimental Work Results Conclusions

Eavesdropping Near Field Contactless Payments: A Quantitative Analysis

Thomas P. Diakos1 Johann A. Briffa1 Tim W. C. Brown2 Stephan Wesemeyer1

1Department of Computing, University of Surrey, Guildford 2Centre for Communication Systems Research, University of Surrey, Guildford

Computer Laboratory, University of Cambridge, January 21, 2014

Thomas P. Diakos (t.diakos@surrey.ac.uk) University of Surrey Eavesdropping Near Field Contactless Payments: A Quantitative Analysis

SLIDE 2

Introduction Eavesdropping Antennas Experimental Work Results Conclusions

Outline Introduction: Near Field Communications Eavesdropping Antennas Experimental Work Results Conclusions and Future Work

Thomas P. Diakos (t.diakos@surrey.ac.uk) University of Surrey Eavesdropping Near Field Contactless Payments: A Quantitative Analysis

SLIDE 3

Introduction Eavesdropping Antennas Experimental Work Results Conclusions Near Field Contactless Payments

Near Field Communications

Near Field

I Distance π Wavelength (¥ 22m) I HF 13.56 MHz radio inductive coupling I H-fields I Reader and tag (passive) I Short (‘from a touch to a few cm’) range of operation

NFC devices

I Reader and tag on the same device I Power on-board

Thomas P. Diakos (t.diakos@surrey.ac.uk) University of Surrey Eavesdropping Near Field Contactless Payments: A Quantitative Analysis

SLIDE 4

Introduction Eavesdropping Antennas Experimental Work Results Conclusions Near Field Contactless Payments

Near Field Communications

Near Field Contactless Payments

I Marketed as ideal for quick, convenient transactions I Contactless Cards and NFC devices I 23 million cards in the UK alone I 13.32% of smartphones equipped with NFC

Thomas P. Diakos (t.diakos@surrey.ac.uk) University of Surrey Eavesdropping Near Field Contactless Payments: A Quantitative Analysis

SLIDE 5

Introduction Eavesdropping Antennas Experimental Work Results Conclusions Near Field Contactless Payments

Near Field Communications

Near Field Contactless Payments

I Marketed as ideal for quick, convenient transactions I Contactless Cards and NFC devices I 23 million cards in the UK alone I 13.32% of smartphones equipped with NFC

What’s the catch?

‘Because the transmission range is so short, NFC-enabled transactions are inherently secure.’ http://nfc-forum.org/what-is-nfc/nfc-in-action/

Thomas P. Diakos (t.diakos@surrey.ac.uk) University of Surrey Eavesdropping Near Field Contactless Payments: A Quantitative Analysis

SLIDE 6

Introduction Eavesdropping Antennas Experimental Work Results Conclusions Near Field Contactless Payments

Motivation

Eavesdropping - Chosen attack

I Why eavesdropping?

Thomas P. Diakos (t.diakos@surrey.ac.uk) University of Surrey Eavesdropping Near Field Contactless Payments: A Quantitative Analysis

SLIDE 7

Introduction Eavesdropping Antennas Experimental Work Results Conclusions Near Field Contactless Payments

Motivation

Eavesdropping - Chosen attack

I Why eavesdropping? I ‘Inherently’ secure? I Difficult to defend against I ‘Contact world’ heritage

Thomas P. Diakos (t.diakos@surrey.ac.uk) University of Surrey Eavesdropping Near Field Contactless Payments: A Quantitative Analysis

SLIDE 8

Introduction Eavesdropping Antennas Experimental Work Results Conclusions Near Field Contactless Payments

Motivation

Eavesdropping - Past work

I Expensive, cumbersome equipment I No control over transmit power I Traces on a scope?

Our contribution

Thomas P. Diakos (t.diakos@surrey.ac.uk) University of Surrey Eavesdropping Near Field Contactless Payments: A Quantitative Analysis

SLIDE 9

Introduction Eavesdropping Antennas Experimental Work Results Conclusions Near Field Contactless Payments

Motivation

Eavesdropping - Past work

I Expensive, cumbersome equipment I No control over transmit power I Traces on a scope?

Our contribution

I Relatively inexpensive, inconspicuous equipment I Varying Magnetic field strength I Quantitative analysis

Thomas P. Diakos (t.diakos@surrey.ac.uk) University of Surrey Eavesdropping Near Field Contactless Payments: A Quantitative Analysis

SLIDE 10

Introduction Eavesdropping Antennas Experimental Work Results Conclusions Eavesdropping Antennas

Design Factors

The ideal eavesdropping antenna

I Maximise SNR I Resonance I Suitable Q factor I Impedance matched

Thomas P. Diakos (t.diakos@surrey.ac.uk) University of Surrey Eavesdropping Near Field Contactless Payments: A Quantitative Analysis

SLIDE 11

Introduction Eavesdropping Antennas Experimental Work Results Conclusions Eavesdropping Antennas

NFC antenna design principles

Ideal H-antenna

L(f0) RL Load Resistance Antenna Coil

I H-field antenna I L constant I R (DC) negligible

Thomas P. Diakos (t.diakos@surrey.ac.uk) University of Surrey Eavesdropping Near Field Contactless Payments: A Quantitative Analysis

SLIDE 12

Introduction Eavesdropping Antennas Experimental Work Results Conclusions Eavesdropping Antennas

NFC Antenna Design Principles

H-Antenna Receiver Mode

I In RX mode:

VL Vin = 1 1 + jωL(ω)

RL

≠ ω2LC (1)

I At resonance:

VL Vin = RL Ô C j



L(ωo) (2)

H-Antenna Conclusions

I Low Inductance, high load Resistance I Magnitude of 2 is equal to the Q-factor

Thomas P. Diakos (t.diakos@surrey.ac.uk) University of Surrey Eavesdropping Near Field Contactless Payments: A Quantitative Analysis

SLIDE 13

Introduction Eavesdropping Antennas Experimental Work Results Conclusions Eavesdropping Antennas

Large Metallic structures

The shopping trolley

I Various distances

I Fixed Ground I Network Analyser

Thomas P. Diakos (t.diakos@surrey.ac.uk) University of Surrey Eavesdropping Near Field Contactless Payments: A Quantitative Analysis

SLIDE 14

Introduction Eavesdropping Antennas Experimental Work Results Conclusions Eavesdropping Antennas

The shopping trolley

Findings at 13.5 MHz

Scenario Inductance at Resistance at 13.5 MHz / µH 13.5 MHz / Ω Near End 0.42 1.31 Middle End 1.42 18.48 Leg End 3.73 70.66 Far End 2.59 7.67

I Connection point dependence

Thomas P. Diakos (t.diakos@surrey.ac.uk) University of Surrey Eavesdropping Near Field Contactless Payments: A Quantitative Analysis

SLIDE 15

Introduction Eavesdropping Antennas Experimental Work Results Conclusions Eavesdropping Antennas

Shopping Trolley antenna

Pros

I Ease of execution (variable C) I High load resistance desirable I Short connection points

cons

I Trolley resistance I Loop size

Thomas P. Diakos (t.diakos@surrey.ac.uk) University of Surrey Eavesdropping Near Field Contactless Payments: A Quantitative Analysis

SLIDE 16

Introduction Eavesdropping Antennas Experimental Work Results Conclusions Eavesdropping Antennas

Eavesdropping Antenna Benchmarks

Eavesdropping H-fields

I H-loop antenna used as a transmitter I Controlled H-field through current I Signal generator and power amplifier I Three types of eavesdropping antennas I Path Loss measurements

Thomas P. Diakos (t.diakos@surrey.ac.uk) University of Surrey Eavesdropping Near Field Contactless Payments: A Quantitative Analysis

SLIDE 17

Introduction Eavesdropping Antennas Experimental Work Results Conclusions Eavesdropping Antennas

NFC Antenna Design Principles

H-Loop Antenna

I Matched to 50 with a resistor (10 Ω) in series

Thomas P. Diakos (t.diakos@surrey.ac.uk) University of Surrey Eavesdropping Near Field Contactless Payments: A Quantitative Analysis

SLIDE 18

Introduction Eavesdropping Antennas Experimental Work Results Conclusions Eavesdropping Antennas

Path Loss Measurements

Various H-fields for H-loop and trolley only

Thomas P. Diakos (t.diakos@surrey.ac.uk) University of Surrey Eavesdropping Near Field Contactless Payments: A Quantitative Analysis

SLIDE 19

Introduction Eavesdropping Antennas Experimental Work Results Conclusions Eavesdropping Antennas

Quarter Wavelength Antenna

S11 Reflection Coefficients

Thomas P. Diakos (t.diakos@surrey.ac.uk) University of Surrey Eavesdropping Near Field Contactless Payments: A Quantitative Analysis

SLIDE 20

Introduction Eavesdropping Antennas Experimental Work Results Conclusions Eavesdropping Antennas

Quarter Wavelength Antenna

Worn over body

I Water content of body reduces efficiency

Thomas P. Diakos (t.diakos@surrey.ac.uk) University of Surrey Eavesdropping Near Field Contactless Payments: A Quantitative Analysis

SLIDE 21

Introduction Eavesdropping Antennas Experimental Work Results Conclusions Eavesdropping Antennas

Path Loss Measurements

Trolley

Thomas P. Diakos (t.diakos@surrey.ac.uk) University of Surrey Eavesdropping Near Field Contactless Payments: A Quantitative Analysis

SLIDE 22

Introduction Eavesdropping Antennas Experimental Work Results Conclusions Eavesdropping Antennas

Path Loss Measurements

Summary

I H-loop and trolley are most efficient I Antenna orientation I H-field strength I Proceed with FER measurements

Thomas P. Diakos (t.diakos@surrey.ac.uk) University of Surrey Eavesdropping Near Field Contactless Payments: A Quantitative Analysis

SLIDE 23

Introduction Eavesdropping Antennas Experimental Work Results Conclusions Experimental Work

Eavesdropping Near Field Contactless Payments

Near Field Contactless Payments

I PHY layer based on ISO 14443 standard I Half-duplex communication I Type A and Type B

Thomas P. Diakos (t.diakos@surrey.ac.uk) University of Surrey Eavesdropping Near Field Contactless Payments: A Quantitative Analysis

SLIDE 24

Introduction Eavesdropping Antennas Experimental Work Results Conclusions Experimental Work

Near Field Contactless Payments

ISO 14443 type A communication

I 106kbps or 9.4 µs bit duration I Manchester encoded baseband I 847 kHz Subcarrier modulation (OOK) I Standard / short frames I SOF and EOF markers

Thomas P. Diakos (t.diakos@surrey.ac.uk) University of Surrey Eavesdropping Near Field Contactless Payments: A Quantitative Analysis

SLIDE 25

Introduction Eavesdropping Antennas Experimental Work Results Conclusions Experimental Work

Eavesdropping Near Field Contactless Payments

Computing Frame Error Rates

I A known (random), long sequence I Transmitter / Receiver I Processing and computation

Thomas P. Diakos (t.diakos@surrey.ac.uk) University of Surrey Eavesdropping Near Field Contactless Payments: A Quantitative Analysis

SLIDE 26

Introduction Eavesdropping Antennas Experimental Work Results Conclusions Experimental Work

Eavesdropping Near Field Contactless Payments

Transmitter arrangement

PC Data Card Pad Attenuator Signal Generator IQ Modulator Step Attenuator RF Amp Coil Antenna

I Synthetic data, 60 bytes per frame I Subcarrier generated in software I External trigger signal at 1.7 MHz

Thomas P. Diakos (t.diakos@surrey.ac.uk) University of Surrey Eavesdropping Near Field Contactless Payments: A Quantitative Analysis

SLIDE 27

Introduction Eavesdropping Antennas Experimental Work Results Conclusions Experimental Work

Eavesdropping Near Field Contactless Payments

Sequence of 5 bits

Thomas P. Diakos (t.diakos@surrey.ac.uk) University of Surrey Eavesdropping Near Field Contactless Payments: A Quantitative Analysis

SLIDE 28

Introduction Eavesdropping Antennas Experimental Work Results Conclusions Experimental Work

Eavesdropping Near Field Contactless Payments

Transition between two PICC frames

Thomas P. Diakos (t.diakos@surrey.ac.uk) University of Surrey Eavesdropping Near Field Contactless Payments: A Quantitative Analysis

SLIDE 29

Introduction Eavesdropping Antennas Experimental Work Results Conclusions Experimental Work

Eavesdropping Near Field Contactless Payments

Receiver arrangement

Covert Antenna LNA RF Amp 13.56 MHz Notch Filter BPF Peak Detector Data Card PC

I LNA maximises SNR I Band Pass Filter 12.7-14.4MHz I Logarithmic detector

Thomas P. Diakos (t.diakos@surrey.ac.uk) University of Surrey Eavesdropping Near Field Contactless Payments: A Quantitative Analysis

SLIDE 30

Introduction Eavesdropping Antennas Experimental Work Results Conclusions Experimental Work

Eavesdropping Near Field Contactless Payments

Receiver arrangement

Thomas P. Diakos (t.diakos@surrey.ac.uk) University of Surrey Eavesdropping Near Field Contactless Payments: A Quantitative Analysis

SLIDE 31

Introduction Eavesdropping Antennas Experimental Work Results Conclusions Experimental Work

Eavesdropping Near Field Contactless Payments

Receiver arrangement

Covert Antenna LNA RF Amp 13.56 MHz Notch Filter BPF Peak Detector Data Card PC

I LNA maximises SNR I Band Pass Filter 12.7-14.4MHz I Logarithmic detector I Capture card sampling at 1.7MS/s

Thomas P. Diakos (t.diakos@surrey.ac.uk) University of Surrey Eavesdropping Near Field Contactless Payments: A Quantitative Analysis

SLIDE 32

Introduction Eavesdropping Antennas Experimental Work Results Conclusions Experimental Work

Eavesdropping Near Field Contactless Payments

Noise corruption

I Frame synchronisation becomes challenging

Thomas P. Diakos (t.diakos@surrey.ac.uk) University of Surrey Eavesdropping Near Field Contactless Payments: A Quantitative Analysis

SLIDE 33

Introduction Eavesdropping Antennas Experimental Work Results Conclusions Experimental Work

Eavesdropping Near Field Contactless Payments

Noise corruption

I Frame synchronisation becomes challenging I Variance computing sliding window I Threshold crossing

Thomas P. Diakos (t.diakos@surrey.ac.uk) University of Surrey Eavesdropping Near Field Contactless Payments: A Quantitative Analysis

SLIDE 34

Introduction Eavesdropping Antennas Experimental Work Results Conclusions Experimental Work

Eavesdropping Near Field Contactless Payments

Variance sliding window

Thomas P. Diakos (t.diakos@surrey.ac.uk) University of Surrey Eavesdropping Near Field Contactless Payments: A Quantitative Analysis

SLIDE 35

Introduction Eavesdropping Antennas Experimental Work Results Conclusions Experimental Work

Eavesdropping Near Field Contactless Payments

Variance smoothing and threshold

I Gaussian smoothing

Thomas P. Diakos (t.diakos@surrey.ac.uk) University of Surrey Eavesdropping Near Field Contactless Payments: A Quantitative Analysis

SLIDE 36

Introduction Eavesdropping Antennas Experimental Work Results Conclusions Experimental Work

Eavesdropping Near Field Contactless Payments

Robust Frame Synchronisation

I Frame length I Rough estimate based on ρ crossing I (EOF ≠ SOF ≠ 32) ± Y ∆ multiple of 144 I Cross correlation for bit decoding

Thomas P. Diakos (t.diakos@surrey.ac.uk) University of Surrey Eavesdropping Near Field Contactless Payments: A Quantitative Analysis

SLIDE 37

Introduction Eavesdropping Antennas Experimental Work Results Conclusions Results

Eavesdropping Near Field Contactless Payments

Experimental Set-up

PC IQ Modulator Data Card 13.56 MHz carrier Step Attenuator Pre Amp RF Amp Tx Antenna Rx Antenna Receiver & Peak detector

Outside Chamber Inside Chamber Thomas P. Diakos (t.diakos@surrey.ac.uk) University of Surrey Eavesdropping Near Field Contactless Payments: A Quantitative Analysis

SLIDE 38

Introduction Eavesdropping Antennas Experimental Work Results Conclusions Results

Eavesdropping Near Field Contactless Payments

Receiver circuit and antenna

Thomas P. Diakos (t.diakos@surrey.ac.uk) University of Surrey Eavesdropping Near Field Contactless Payments: A Quantitative Analysis

SLIDE 39

Introduction Eavesdropping Antennas Experimental Work Results Conclusions Results

Eavesdropping Near Field Contactless Payments

Preliminary testing

I Anechoic chamber I Controlled environment I 500 frame tests I Establish σ and ρ values

Thomas P. Diakos (t.diakos@surrey.ac.uk) University of Surrey Eavesdropping Near Field Contactless Payments: A Quantitative Analysis

SLIDE 40

Introduction Eavesdropping Antennas Experimental Work Results Conclusions Results

Eavesdropping Near Field Contactless Payments

σ and ρ selection at 7.45 A/m

Thomas P. Diakos (t.diakos@surrey.ac.uk) University of Surrey Eavesdropping Near Field Contactless Payments: A Quantitative Analysis

SLIDE 41

Introduction Eavesdropping Antennas Experimental Work Results Conclusions Results

Eavesdropping Near Field Contactless Payments

Experimental procedure

I 5000 frames (20 minutes per run) I 20–170 cm, increments of 5 cm (2–30 cm for trolley) I 1.5, 3.45, 7.45 A/m I Experiments ran over 2 days

Thomas P. Diakos (t.diakos@surrey.ac.uk) University of Surrey Eavesdropping Near Field Contactless Payments: A Quantitative Analysis

SLIDE 42

Introduction Eavesdropping Antennas Experimental Work Results Conclusions Results

Results

H-Loop Antenna FER

I Normal approximation, 95% confidence interval levels

Thomas P. Diakos (t.diakos@surrey.ac.uk) University of Surrey Eavesdropping Near Field Contactless Payments: A Quantitative Analysis

SLIDE 43

Introduction Eavesdropping Antennas Experimental Work Results Conclusions Results

Eavesdropping Near Field Contactless Payments

Shopping trolley eavesdropping arrangement

Thomas P. Diakos (t.diakos@surrey.ac.uk) University of Surrey Eavesdropping Near Field Contactless Payments: A Quantitative Analysis

SLIDE 44

Introduction Eavesdropping Antennas Experimental Work Results Conclusions Results

Eavesdropping Near Field Contactless Payments

Shopping trolley FER (σ = 10, ρ = 50)

I Trolley generates its own noise, lossy antenna

Thomas P. Diakos (t.diakos@surrey.ac.uk) University of Surrey Eavesdropping Near Field Contactless Payments: A Quantitative Analysis

SLIDE 45

Introduction Eavesdropping Antennas Experimental Work Results Conclusions Conclusions

Conclusions and Future work

Conclusions

I Eavesdropping distance 45-90 cm in shielded environment I Similar conditions to those found in underground stations I Relatively inexpensive equipment, inconspicuous antennas I Gaussian filtering and variance computation are reliable

Future work

I Real data with real devices I Improve portability (FPGA), integrate a skimmer I What does this mean for the user?

Thomas P. Diakos (t.diakos@surrey.ac.uk) University of Surrey Eavesdropping Near Field Contactless Payments: A Quantitative Analysis

SLIDE 46

Introduction Eavesdropping Antennas Experimental Work Results Conclusions Conclusions

Eavesdropping Near Field Contactless Payments

Thank you for listening

Please forward any questions

Thomas P. Diakos (t.diakos@surrey.ac.uk) University of Surrey Eavesdropping Near Field Contactless Payments: A Quantitative Analysis