"Hack-proof" RFID could change contactless & tracking industries

MIT researchers and Texas Instruments have developed a new "hack-proof" radio frequency identification chip (RFID) designed to prevent so-called "side-channel" attacks, which extract cryptographic key data by analysing patterns of memory access and power fluctuations, when a device is performing a cryptographic operation such as a digital banking transaction. If the new high security RFID chip becomes commercially available this could help prevent contactless payment fraud and tracking due to two key design innovations: its on-chip power supply that would be virtually impossible to cut and its set of "non-volatile" memory cells that are able to store any data the chip is working on when it begins to lose power, so that power-glitch attacks are resisted.

MIT researchers and Texas Instruments have developed a new radio-frequency (RFID) chip that it calls "hack-proof."

The high-security chip, if it hits mainstream adoption, could well be a game-changer that could help prevent credit card fraud (through contactless payments), for instance. That's because it sets itself apart from other RFID-chips. The chip is able to resist power-glitch attacks, which can be used to bypass limits on incorrect password entries in password-protected devices, because it comes with on-board power that is "virtually impossible to cut," according to the press release.

Surprise: MIT just painted a giant target on this chip's back. It almost begs the community to rip it to pieces.

Nothing is unhackable. Ask anyone in security circles what the most overblown term is, they'll say it's "hack-proof" or "virtually impossible to hack."

Even devices that are designed to be at the top of their security game like Silent Circle's Blackphone 2 -- an Android smartphone that's designed to protect privacy and be secure to the core -- aren't immune to hacks and attacks. Silent Circle's chief scientist Javier Aguera told me at a meeting in London last year that the phone isn't hack-proof and "doesn't pretend to be."

Security is a cat-and-mouse game. Devices have to be patched, and technologies can be altered.

The notion of "perfect security" is a nice idea and something the security community consistently strives for. But calling something "hack-proof" is a red flag to anyone with an ounce of common sense.