N-Guard: a Solution to Secure Access to NFC tags

Abstract

In this paper we propose N-Guard: a portable, effective, and efficient solution to thwart contactless skimming of NFC cards. Our solution enables an NFC-compliant smartphone to protect the user's cards, preventing the adversary from harvesting the cards' data. Moreover, we also introduce a fine grained access control mechanism, allowing the user to discriminate between NFC cards that can be opportunistically queried and sensitive ones that can be read only under the strict permission of the owner. We implemented a proof-of-concept of N-Guard for Android OS and tested it under several digital skimming scenarios showing its effectiveness in thwarting unauthorized access attempts. Moreover, we also measured the consumption of N-Guard and proved that its energy consumption is negligible. Further, it is worth noting that N-Guard requires neither any specific modification to the NFC standard, nor any change on users behavior. Finally, through some empirical evidence, we show N-Guard to be effective even when the interaction between the NFC tags and the reader is driven by proprietary protocols (e.g. Mastercard). All the reported results, having being developed over an NFC-enabled credit-card use case, are general and applicable to all NFC tags.

Security of NFC Banking Transactions: Overview on Attacks and Solutions

“…4) Skimming Attack: an attacker can capture the data of an NFC bank card for later use [10]. Payment skimming is therefore the unauthorized capture and transfer of payment data to another source in order to perform an attack later on.…”

“…2) Eavesdropping Attack: an attacker can eavesdrop on all communications exchanged between an NFC reader (PoS or ATM) and an NFC bank card or an NFC smartphone [10]. To do this, he can use a standard receiver, a listening antenna, and an oscilloscope to observe the recovered signal [23].…”

“…An attacker can pass the communication between a dummy bank card (proxy) that is used to perform certain transactions at a given time with an NFC reader (ATM or PoS). The proxy receives signals from a device called a mole that has physical access to the real bank card [10].…”