Black Hat: RFID weakness demo nixed

ARLINGTON, VA — Show organizers of the Black Hat Federal security conference on Wednesday said they have agreed to cancel a demonstration scheduled for today that would show attendees how to build RFID cloners.

Updated story: Black Hat: Much ado about RFID

Founder and director of Black Hat Jeff Moss said that the scheduled presentation by Chris Paget, director of R&D with security consulting firm IOActive, has been cancelled. Paget made the decision on Tuesday to pull his demo based on the potential for legal action by HID Global, which makes RFID cards, readers and related technologies.

“This is flashing me back to CiscoGate days,” Moss said, referring to a similar incident two years ago at a Black Hat conference when then ISS research analyst Michael Lynn gave a technical talk explaining how Cisco routers could be remotely compromised, resulting in legal action and his dismissal from ISS.

“The core mission of Black Hat is to expose security vulnerabilities in a very vendor-neutral way. When someone tries to stifle security information, like HID is, we get really frustrated … but we stand behind our speakers,” Moss said.

In his talk titled “RFID for Beginners,” Paget planned to discuss security flaws found in RFID cards sold by HID and others, usually used for office-building access. As part of his discussion Paget planned to feature his RFID cloner that could duplicate access cards, which IOActive displayed at the RSA Conference `07 in San Francisco earlier this month.

“I’ll explain everything you need to know in order to build a working cloner, understand how it works, and see exactly why RFID is so insecure and untrustworthy,” wrote Paget in his description of the talk in conference materials.

HID sent a letter to IOActive telling the company to cancel the talk or risk patent infringement, although Moss said he doubts HID had proof that Paget’s talk would infringe because HID didn’t have access to IOActive’s source code or technology.

Black Hat organizers quickly slotted officials from the American Civil Liberties Union to take Paget’s spot on the schedule with a panel discussion on RFID. After the panel, scheduled for this afternoon, Paget will address the audience.

“Chris will be talking sort of about what he wanted to talk about; he’ll still talk about RFID stuff, just not in the format he wanted,” Moss said.