Comments on: Are there any RFID triggering devices?

Question: Are there any RFID triggering devices?

TwelveTwo — Sun, 02 Oct 2005 12:28:20 -0800

Are there any devices able to trigger/trick RFID detectors?

I've had mild amusement with stick-on RFID chips, so the recent question here piqued my curiosity. Are there any devices in existance that go across all frequencies used by RFIDs as to trigger them. Thus allowing for push button activation of the beeping theft obelisks at the enterance of stores.

By: cillit bang

cillit bang — Sun, 02 Oct 2005 12:42:23 -0800

No anti-theft devices use RFIDs, since they don't have enough range. Instead they use passive reflectors that echo the signal sent by the posts. The antennas have a very focused area of reception, so I don't think you'd have much luck trying to trigger them remotely. Why no just steal something?

By: cyphill

cyphill — Sun, 02 Oct 2005 12:47:19 -0800

Better yet, just steal the triggering device

By: TwelveTwo

TwelveTwo — Sun, 02 Oct 2005 13:22:28 -0800

Oh well.

By: Mwongozi

Mwongozi — Sun, 02 Oct 2005 15:01:47 -0800

Anti-theft devices in the UK commonly use RFIDs, with large antennas attached to increase the range, the antenna typically looks like a spiral of wire printed onto paper or card.

The tags are neutralised by the checkout staff when you buy something, so that the tags don't have to be removed. They stay on the product, but no longer set off the alarm.

A common theft trick is a bag lined with tin foil. Tags placed in such a bag don't trigger the alarm.

By: cillit bang

cillit bang — Sun, 02 Oct 2005 15:20:44 -0800

Those aren't RFIDs.

By: Godbert

Godbert — Sun, 02 Oct 2005 16:01:22 -0800

I don't know if there's actually something "on the market" that does this, but one of my professors once explained the concept of an "RFID jammer" that effectively identifies itself as every possible ID #. Apparently RFID readers don't simply "pick up" the code number, but instead repeatedly query bit positions for the code (as it was explained to me; this doesn't sound quite right to me, but I don't really have any basis not to trust the prof, who does a lot of research into wireless security and such).

By: Pinback

Pinback — Sun, 02 Oct 2005 16:14:52 -0800

Not RFID, but it's quite often possible to trigger the passive-tag detectors using car keys. Take 2 keys side-by-side on your key ring, then slide them apart into a V-shape such that the notches are facing each other. Walk repeatedly through a detector, moving the keys slightly each time, until it goes off. Memorise this position for much future fun, hilarity, and bag-searching...

(Put simply, the tags work by resonance stimulated by a field from the gates in the doorway, and if you get it right the gap between the teeth of the 2 keys matches the resonant frequency of a tag.)

By: TwelveTwo

TwelveTwo — Sun, 02 Oct 2005 20:21:17 -0800

Ooh, Godbert, if you have any links about such a thing, or terms for me to search, I'd be most interested! Then a best answer is you!

After I try that, Pinback, a best answer will also be yours!

By: IndigoRain

IndigoRain — Sun, 02 Oct 2005 22:48:45 -0800

Slightly related: TagZapper, a handheld device for deactivating RFID tags, for the paranoid. Not yet available.

By: hattifattener

hattifattener — Mon, 03 Oct 2005 00:37:30 -0800

There are a ton of different things that fall under the term "RFID tag" and there are a ton of other technologies that look the same on the surface.

First, the theft tags. Most of these don't do any identifying, so I wouldn't call them RFID. They're just RF-detectable in some way. Some are just resonant circuits that "ring" at a particular frequency. Those usually have a small amount of nonlinearity added so that they emit harmonics as well, which makes it easier for the reader/gate (which is constantly sending out that particular frequency and listening for answering notes) to distinguish the tag from its own emissions. These are the tags that usually look like a square patch with a spirally trace, which is the antenna and the inductive part of the resonant circuit. (See.) (There's a "magnetostriction" resonant tag technology out there too which i know nothing about.) Another kind I know of has a magnetic material with a very low saturation, and the reader produces a varying magnetic field which drives the metal strip into and out of saturation. Again that produces a detectable nonlinearity and accompanying harmonics. (Most everyday materials have a fairly linear magnetic response.)

Okay, after that are RFID tags. There are assloads of different tags out there. Lots of different standards, and lots of proprietary, non-standardized protocols as well. The really simple kind, often used for building keyless entry cards, just have a serial number and will mindlessly broadcast it as soon as they're energized by the reader. (They power themselves from the field emitted by the reader.) Problem is, if more than one tag is within the reader's range, they talk over each other and nobody gets heard. More sophisticated tags have anticollision algorithms, which is what Godbert's prof was probably talking about: the reader has ways to query only some tags ("any tags out there starting with 00001? .. no ? ... okay, 00010? ...") and eventually discover all tags in the area. Some tags have nonvolatile storge on board: the ones used by my local library, for example, can be told whether the book they're in is checked-out or not, and the library exit gate presumably interrogates this bit. Even more sophisticated tags, once they've been discovered by the reader, have the CPU power to set up a cryptographically-secured channel à la SSL and have a nice private dialogue with the reader.

Back to the OP's question: false-triggering of anti-theft gates. It seems to me that that should be easy because, as I said, they're usually not ID tags, so you don't have to give the theft gate a specific 80-bit magic number or something. Presumably you could manufacture your own tag with a coil of wire, an appropriately-sized capacitor, and a diode. Disconnect the wire to keep it from triggering. Depending on how the gate works, you could maybe just broadcast the harmonic it's looking for, which would work at a longer range. (The gates might be too smart to be fooled by that though.) A prank-minded EE undergrad could probably whip something up in a few weeks.

By: phearlez

phearlez — Mon, 03 Oct 2005 10:39:54 -0800

No anti-theft devices use RFIDs, since they don't have enough range. Instead they use passive reflectors that echo the signal sent by the posts.

The ones the college I used to work at used echoed and rectified; if you pulled on open it was a copper loop antenna with a resistor. My understanding was that it clipped the peaks and valleys on the transmitted waveform in a distinctive way. It was complete crap, so perhaps ones that actually work are made differently.

By: Godbert

Godbert — Mon, 03 Oct 2005 11:59:26 -0800

TwelveTwo, I can't really help you out with search terms or more info, but hattifattener bit about the "anticollision algorithms" is exactly what was explained to me, so you may want to look to that for some more direction.