Digital Forensics in Small Devices: RFID Tag Investigation

Figure A6.10: Screenshot of writing the SQL injection code to the fake tag
5. An Attack in Action
The testing BIS is a simple system as it has a reader connected to a POS terminal
and the backend database is running on the host computer. When the customer is
checking out the item he/she bought, the tag attachment is detached from the
product and scanned at the POS terminal.
Figure A6.11: Genuine tag is read at the POS terminal
However, the fake tag is replaced by the attacker with the help of a malicious
employee in store and scanned at the POS terminal (as shown in Figure A6.12);
the value attached to the item will be changed in the backend database as the
65