HOWTO build an RFID skimmer

Two electrical engineering students from Tel Aviv University have written a paper to be presented at Usenix called "How to Build a Low-Cost, Extended-Range RFID Skimmer." It does pretty much what it says on the tin: shows you how shockingly insecure the RFIDs in your office key-fob, subway-card, car-key, etc all are -- easy to "skim," clone, and walk away with. The two achieve skims at more than 25cm, and note that they are "halfway to a full-blown relay attack."

Our reference system was the RX-MFR-RLNK-00 Texas Instrument Multi-Function Reader evaluation kit. The evaluation kit embeds the TI module we used, and comes with small 8.5 cm diameter round antenna directly connected to the module's output [TI05]. The basic read-range of the evaluation kit was 6.5 cm.

We first connected our 10x15 cm PCB antenna to the evaluation kit, without the power amplifier. This alone gave a range increase of 30%, to around 8.5 cm. Attaching the big loop antenna to the evaluation kit gave no results since the kit generates only 200 mW output power that is insufficient to drive the antenna.

Using the power amplifier we reached much larger ranges (see Figure 13). With the linear power supply providing 14.58 volts, we were able to read the tag at a range of 17.3 cm using the PCB antenna, and at a range of 25.2 cm using the copper tube antenna. With a 12-volt battery we reached a reading range of 23.2 cm using the copper tube antenna and 16.9 cm using the PCB antenna. Note that this type of battery, upon recharging, can supply more than its nominal voltage: we measured that it supplied 13.8 volts during the above experiments.

Link (via Schneier)