Digital Forensics in Small Devices: RFID Tag Investigation

and confirmed the database was
obviously compromised.
Moreover, the acquisition results of
current table data of transaction log file
- RFID_test_log.ldf (see Figure 4.41)
showed the significant evidence of the
attack in which the malicious SQL
poisoning code was found and the SI
(Tag IDs starting with E004) were
updated to the values $600 at
06:39:48pm on the 12 October 2010.
A fake tag was found and preserved as
a proof of the theft of SI, in the
simulation experiment.
SUMMARY:
Likewise, the findings in SQL Server
error logs and system event logs such as
security, system and application logs
(see Figures 24A.2, 24A.3, 24A.4 in
Appendix 24) are not convincing
enough to prosecute the malicious
attacker.
Similarly, the fake tag could be
rewritten for another SI if the retailer
did not have proper policy of managing
and reusing the tag which was just
detached from SI sold.
In the simulation experiment, the RFID stock management system was able to be
compromised by using malicious RFID tag injected with SQL poisoning code to
steal the SI by paying $600 instead of $1500. The forensic image analysis was
performed on each artefact extracted from the three entities of the simulated RFID
BS and the sub-systems identified in Table 2.5 (Section 2.3). Even though the
significant evidence to prove the theft of SI is found in almost all the areas of the
RFID BS, there are some limitations in the finding results. However, the
arguments made for and against prove most of the proposed hypotheses (1, 2, 3, 4,
and 5) are to be accepted except hypothesis 6. As for hypothesis 7, the arguments
made for and against prove to be indeterminate.
Table 5.2: Secondary Research Question 2 and Tested Hypotheses
Secondary Question 2: What evidence can be extracted from a compromised
RFID based retail system?
Hypothesis 3: There will be transaction traces in the RFID reader’s memory after
132