Schneier on Security

Roger • September 10, 2012 8:09 AM

@Clive:

I doubt if any one person even a self admited “serious slaker” “goofing off on his employers dime” could look through them all.

It’s not one person searching them: it’s thousands. Kip has become the bête noire of the distance running community, and websites have been set up to co-ordinate the Kip hunting.

It’s not that runners are usually that obsessive *. While 99.9% put in an honest effort, you usually spot one or two cheats at every race — and no-one cares. Unless they are way up the front passing the Kenyans, they quite literally are only cheating themselves.

Cheating is far worse than failure. They will spend the same hours of pain under the burning sun, but while we’re reliving the emotional roller-coaster at the pub, they slink off home knowing that they didn’t do it, that when they had to reach deep down inside all they found was tawdry.

The difference with Kip is the charity fraud. I emphasise that it has not been proven, but there is a widespread suspicion that he has been using this ruse to steal money from a charity.

• That’s a joke, I say, that’s a joke, son.

Roger • September 11, 2012 7:14 AM

@boog:

… but GPS records would show the two runners ran together most of the race, easily disputed with eyewitness testimony and photographic evidence.

A certain celebrity recently completed her debut marathon to much fanfare … and the regular timing chips revealed that she crossed every mat at exactly the same time as her personal trainer. It didn’t help suspicions that very soon after the race she was walking around in high-heels without difficulty. Race organisers do not accept such circumstantial evidence.

I only offered it as an idea to mitigate the issue of shortcuts.

As I mentioned above, most of the time it isn’t worth the trouble. Kip is a special case because he may also be stealing money.

@Toby Speight:

… I speculate that you could forward the protocol over a wireless link to avoid having to to take the tag to all the checkpoints. If you can secrete the forwarding devices near enough to the checkpoints in advance, you can even avoid the need for accomplices.

I think that is technically quite challenging. It is readily possible to receive the signal from the reader at much greater than the design range. It is more difficult, but possible, to receive the signal from the chip at a longer range — say reading a 50 cm chip from 5 – 10 metres away, not from miles off. This requires a quite large antenna, big enough that you will need to be inventive with camouflage.

However I suspect it is extremely difficult, perhaps impossible, to inject a signal from any significant distance. The reason is that the chip doesn’t actually emit any radio waves; rather, the reader “hears” the chip’s signal by the amount of power the chip sucks out of the reader’s near field. Once you’re more than a few metres away you physically can’t intercept enough of the field to absorb detectable amounts of power. (But I’d be fascinated to be proved wrong!)

@Bruce Clement:

Why attack the timing mats? This just increases the chance of being noticed. Why not just attack the central server and feed it false reports that his rfid has passed over the mat?

Two reasons come to mind: deniability, and consequences. Several times he was caught with his technique but weasled out of it. Whereas if someone noticed that central server logs didn’t match logs at the actual mats, there would be no doubt that some serious malfeasance has occurred.

Which brings us to consequences. The penalty for cheating in a marathon is public ridicule. The penalty for hacking a computer is at least a substantial fine, and possibly prison time.

@bob:

There was an episode of “Monk” the TV show where they put the electronic tracking device on a dog that ran with the runners.

It’s an interesting plot device. In reality, while fit dogs are much faster than a man over middle distances, it’s a very rare dog that can keep up with a human athlete over distances of more than about 10 miles. They overheat faster.

Roger • September 12, 2012 9:27 AM

@Wael:

That is not correct. The chip does emmit radio waves through it’s antenna. It is a passively powered device; it gets the power necessary for operation from the reader.

Ahem. That is not correct for near field communication devices, which includes most passive RFID chips. I suggest you read Resonant inductive coupling or NFC Antennas for an explanation of how these devices work. Notably, the chip is not a radio transmitter and does not transmit energy [1], it only varies how much it absorbs.

Having said that: I see that there are now some models of passive RFID chip on the market that do not use near field coupling for communication, and are transmitters. However they are not common in this application. There is also one model of RFID chip used for sports timing that is actually a disposable active chip, with a very small embedded battery. It is also less common. Most sports timing chips are passive, inductively coupled chips which do not contain radio transmitters.

You’ve gotta be kidding me!!! I saw a lot of RFID readers, and NONE of them had freakin’ “ears”, man! How could they hear? 🙂

I take it that you haven’t read much of the literature on this? Terms like “listen”, “mute”, and “reply” are in common use, because “transmit” and “receive” are misleading and confusing.

One way is to “extend the signal range” by adding a repeater.

I understand how a repeater works. It is unnecessary to use one here. These chips have no computational power; they simply reply to queries with a fixed string of bits. Hence they are trivial to clone. The challenge is not the data, but emulating the signal of chip without placing a device on the mat. (If you can leave a remote-controlled fake chip emulator on the mat without getting caught, then your problems are solved.)

My point was that in this case, such tag emulation will be extremely difficult if the emulator cannot be placed extremely close to the mat. Eavesdropping on the protocol can be done at a range considerably greater than the design range (which is a couple of feet); injecting a signal from a distance seems much more challenging.

Simply tuning a radio transmitter to the same frequency and aiming a directional antenna at the reader, is just not going to work as that’s not the kind of signal the reader “hears”. You might as well say that you will inject data into a computer by beaming a microwave signal at it. It’s not impossible, in the “against the laws of physics” sense, but it is a difficult engineering challenge.

To the best of my knowledge, current records are:

1. Eavesdropping on a passive chip: 21 m, unreliably; quite reliably at 10 m
2. Eavesdropping on a reader: I forget the exact distance, but it was around a km. (It was a pretty powerful reader, intended to operate at about 3 – 4 m from tags.)
3. Injecting a spurious signal: has been done, but no-one has done it from further than the normal read range.

I would still be fascinated to be proven wrong about point 3. (Proven, as in actual counter-examples, rather than sarcasm.)

1. Technically, any device which contains varying electric currents must always transmit radio waves. In that sense, even an AC light bulb is a “radio transmitter.” However in most cases — including this — the transmitted power is completely negligible and not relevant to operation.