cjunky

Loads, you can find details by googling for “RFID weapons management” and so on. Everything from small arms & long guns to rockets and even airplanes.

For additional context most manufacturers state the longest you can read passive EPC Gen 2 tags is about 30 feet. We were able to build a device that allowed reads at over 200 feet and could have easily done more.

EPC Gen 2 was designed to be an efficient, cheap Tag for inventory management and not used in secure applications. Anywhere you see it being used for something secure - it can almost certainly be broken.

I’ll be releasing the specs for the platform we built at a talk soon, so that everyone can start pentesting EPC Gen 2 tags for cheap.

Research by Kristin Paget and Marc Rogers shows that the RFID tagging used by branches of military to inventory weapons can be tracked at range.

That depends on who and why.

A skilled person or organization yes. Obtaining the latent prints probably isn't the hard part, I imagine stealing someones trash would be enough for that.

The tricky part is making a clone accurate and detailed enough that it works in less than 6 attempts.

completely agree!

+1

Actually CCC and I hacked the 5s at the same time using different techniques.

They won the prize in the end but honestly that wasn't the point to why I did it and the guys at CCC are friends of mine.

a four digit pin? not much. A strong passphrase? quite a lot actually. It means they cant get access to your data without your cooperation.

if someone has your phone and the ability to acquire/demand your fingerprints do you seriously think they arent?

I agree that its only likely as a targeted attack though. This isn't the sort of thing you will see street criminals doing.

You could always set up one pin/passcode for two factor auth and then use a separate passphrase as a fallback to unlock the device. It woould be much better security that way.

Also while we are on the subject using a short pincode to unlock the device is asking for trouble. While the device ID is tied to the decryption and there is no way to extract it yet I have no confidence that it will remain that way forever. At which point the ability to crack a short pin off the device means the pin will get cracked in seconds.

I completely agree.

While two factor auth is probably overkill for just unlocking a device to many people, I would like to at least have the option.

One of my concerns is that if your device is ever taken by an organization that has the ability to command your fingerprints then they can quite easily unlock your device negating any encryption.

Also while I think its unlikely right now for criminals to make fake fingerprints in order to steal financial transactions, its a flaw and ApplePay is going to financially motivate those criminals to look into ways to refine the process and make it easier to do.

Its interesting that since publishing this at least two other bits of smartphone based mining malware has appeared.

clearly these malware authors have too much time on their hands I mean unless you harness multiple thousands of smartphones together and make a bitcoin mining smartphone botnet theres no way you can make enough money to make this worthwhile.

It does speak to the entrepreneurial nature of malware authors though. Rather than create more wallet stealers, these guys are constantly striving to find a new "magic malware quadrant"