Digital Forensics in Small Devices: RFID Tag Investigation

Hypothesis 7: The malicious tag can be found at the crime scene.
ARGUMENT FOR:
The backend database server was able
to be successfully compromised by
using a fake RFID R/W tag injected
with malicious code (Section 3.3.2).
The traces of evidence after the attack
were able to be identified, acquired,
preserved and analysed according to the
digital forensic principles and
guidelines for handling the digital
evidence.
Hence, the evidence of changes to the
original values of the stock items
tagged with R/W RFID tags was found
in the backend database during the
investigation (see Figure 4.37 in
Section 4.2.3.4.4).
Likewise, the evidence of malicious
transaction traces including the tag ID,
date and timestamp was found in logs
of RFID reader’s memory (Section
4.3.1) and POS RAM (Section 4.3.2).
As stated above, the significant
evidence was found in the acquired
current table data of the stock
management database (Figure 4.37)
from the backend SQL Server. It
showed that all the SI values were $600
ARGUMENT AGAINST:
The implemented RFID stock
management system was a simple
system design as it did not deploy the
intrusion detection/prevention system,
CCTV system and web server in the
research experiment. Furthermore,
other modules for Credit Card payment
processing, purchasing, receiving,
customers, reporting, and the like were
not integrated in the system.
Hence, additional research are still
needed as more evidence traces could
be found if some of these modules or
software was even integrated in the
system design. For instance, the
attacker could be identified if he/she
paid for the stolen item by using
Electronic Funds Transfer at Point of
Sale (EFPOTS) or Credit Card instead
of cash. Likewise, the evidence such as
IP address of the unauthorized user
could also be found in the Web Server
log if the attack was coming from the
Internet (Section 3.1.4). Moreover, the
evidence could be found in the records
of CCTV if implemented. In the real
world, the percentage of prosecuting
the perpetrator would be lesser without
showing such evidence.
131