RFID in Credit Cards

I believe that we are hearing and seeing enough about hacking and information theft from so many sources that I cannot succeed in conveying anything useful unless I limit my posts to small bits of the whole that are most likely to have an effect on the average person. Today that topic will be the addition of the "convenience" of having a RFID microchip embedded in their credit card.

When one of my credit card companies sent me a shiny new card out of sequence (that is, my old one was two years away from expiring) I did what I usually do in such situations. I became suspicious. Why did they do this? I doubted that it was for my benefit or totally in my best interest. OK, what was different? There was a new word printed on the back and the note that I could now just wave my card near a store's card reader rather than sliding it through the reader itself. How does this help me, I asked myself? As far as I could tell, it didn't help at all. Who did it help, then? Must be "them". Credit card companies use many safeguards including predictive analytics, identity theft countermeasures, data mining, encryption, and others to protect themselves (as well as the consumer) from theft or loss of data. I looked at the card extremely closely and discovered a very slightly thicker square located above and between the word blink and the radio wave icon. The photo is of the upper right quadrant of the card, below the magnetic strip. If you can't see it in the picture below, try looking at your monitor screen at an angle so that the shadows make it clearer.

This is not a great macro photo of the chip, but if you see it, it serves its purpose.

So why is he at it again about this privacy craziness? Because the the magnetic strip on a presently "normal" credit card is coded and cannot be read at a distance. The information can be stolen in a number of other ways, but not read at a distance.

Now I want to scare you. RFID hacking is not new (See this 2003 article from Wired) and is rather simple as this procedure, the Mifare Hack, as demonstrated by Engadget, left many cities' public transportation systems and other RFID users in peril. Here is a Creative Commons interview via Boing Boing showing the basics of remote RFID hacking (be sure to read the comments.) An excellent but easily read article RFID Credit Cards and Theft: Tech Clinic was published in 2007 by Popular Mechanics. Presently, RFID experimentation kits are being sold as toys at Think Geek for just under $100 (USD) while companies such as DIFRwear offer radio shielded wallets and passport cases for sale. If you read only one of these links, I would suggest this one as being the most general and inclusive of the good and bad uses of RFID.

If you will excuse me now, I think I'm done for a while. I must go line my wallet with copper screening to function as a Faraday Cage and make little tinfoil hats for my credit cards.

Peace, Doc

Copyright © 2009, Thomas A. Blood, Ph.D.

"The world of RFID is like the Internet in its early stages. Nobody thought about building security features into the Internet in advance, and now we're paying for it in viruses and other attacks. We're likely to see the same thing with RFIDs." - Ari Juels, research manager at the high tech security firm RSA Labs.

Technorati Tags: RFID,credit cards,fraud,hacking,encryption,phylactology,Danger Will Robinson

Storage and Backup of Clinical Records

Clinicians should all be aware of the necessity of keeping secure and private clinical records. A major problem is where to store them. I have been engaged in a seemingly endless quest to find places to put my "stuff" following the sale of a large house in a rural-suburban area and the subsequent move into a much smaller apartment. This compacting process has included such trivial efforts as discarding standard sized Jewel Cases and using either the slim-line type or paper or vinyl sleeves to store CDs and DVDs. I have purchased a very large capacity but small sized Maxtor outboard hard drive. Along with efforts in the computer area, I have given away, donated, discarded, or sold items such as a breadmaker, fine, unused cooking equipment, antique furniture, and half my "wardrobe." The latter was comprised primarily of jeans with holes in the knees and flannel shirts with gaping rents at the elbow, so not much loss there. I have shredded many records and plan to store client records in .PDF file form soon. I had tried the free CutePDF Writer and free Converter and found them to be the best for my needs among the various types of .PDF programs. I liked them so much, really, that I purchased the CutePDF Pro version which included the CutePDF Form Filler for $49.95. Among the many other features provided in the Pro version are the ability to scan to PDF (scan your session notes directly into a PDF document,) the ability to FTP upload the document (for file sharing or for online storage,) and most important to compliance with HIPAA requirements, the ability to encrypt the document at a 40-bit or 128-bit level. With the Form Fill portion, one could easily produce a standard intake or interview form, save to PDF, encrypt it, and be compliant in storing it online, burned to disk, or saved on a hard drive. I'm sure by this point I must seem like I am doing a paid advertisement. I am not. Certainly there are other similar programs available, but I have used this one and am thoroughly satisfied with it.

Another aspect to consider when using any computer to produce important documents is the absolute certainty that it will crash or die, taking all your records with it, at the most inconvenient possible time. The answer to this is backup, backup, backup! I have had enough computers quit without giving the required two weeks notice that I have learned this lesson several times over. Again, I have tried and accepted a method to insure against this disaster. I use a Maxtor OneTouch 4 Plus 750 GB external drive which can be used with either a USB.2 or a FireWire 400 connection to the computer. A review of this drive by PC Magazine staff rated it very good and states that the bottom line is; "The Maxtor OneTouch 4 Plus exists as extra storage, but it's really there to save your butt. The next time your system crashes, this drive will get you on your feet again." The drive comes in 250, 500, and 750 GB models, with a very recent release of a 1000 GB (1TB) model, made by pairing two 500 GB drives in one case. One can store the usual documents, pictures, music, and the like on any of them. This series of drives also backs up everything on your computer, including the Operating System, to restore to a new drive in case of a catastrophe. Again, I know that there are similar drives and programs that allow the same types of backup, but after obsessively studying the specifications and abilities of everything I could find with these capabilities, this was my choice and it has worked well.

Backing up only files of whatever type can be accomplished by burning them, in encrypted form, to CD or DVD. There are many programs that will do this efficiently and effectively. I use Roxio's Easy Media Creator 8 (it has advanced to Easy Media Creator Suite 10 recently) and find it more than adequate to do what I want it to do.

Finally, there is online storage for files. I trust it enough for blogs, songs, pictures, and relatively unimportant documents. However, having had my EIN and SS numbers with all other personal and business information "lost" by a government agency, I am less than enthusiastic about the security of information stored anywhere not directly under my control. If you have a Google account and use the Firefox browser, there is an add-on available called G-Drive that allows one to store up to about 5 GB of information online free. A number of other companies offer free and paid storage with varying sizes, charges, and layers of security. I will simply mention MediaMax which offers 25 GB of free storage and increasingly larger amounts for increasing fees.

Until I write next, I'll be trying to force myself to part with my dissertation data (collected over 30 years ago) and deciding what to do with the toy airplanes with 16 foot wingspans. Even the cats seem a bit anxious.

Peace, Doc

Copyright © 2007, Thomas A. Blood, Ph.D.