Digital Forensics in Small Devices: RFID Tag Investigation

2.0 INTRODUCTION
Chapter 2 -
Literature Review
The focus of this research is on the criminal risk of the Read/Write radio
frequency identification (RFID) chip in the retail environment. These chips are
used to tag stock with an identification (ID) that provides two utility values for
the retailer; namely theft protection (ie. The tag is removed at the point of sale
so the exit sensors do not alarm). Similarly, these chips are mapping into the
retail database for price and stock control – this includes the point of sale
process and inventory control process (Chalasani et al., 2005). RFID chips are
divided into passive and active and each type has particular risks. Passive chips
are open to “kill” hits and hence the retail exit security can be negated (Chawla
& Ha, 2007; El-Said & Woodring, 2009). Active chips with the read/write
feature can be hacked in order to change the ID and in practice swap an ID
linked to a higher price with an ID linked to a lower price (Haines, 2006a,
2006b; Jeng, Chang, & Wei, 2009).
One of the concerns for retail is that as RFID chips are made more user
friendly then the risk of attack grows. Jones et al., (2006a) describes the
evolution of RFID chip design and process time costs. In the manufacture of
chips the access to writing has become easier in the interest of letting retailers
code their own chips. The benefit has however brought with it easier access for
criminals to write and rewrite over chips and hence change the values (including
the null value) in a RFID system. System solutions are provided by Solanas et
al., (2007) and others. Digital forensic research into small devices is a current
growth area of knowledge (Harrill & Mislan, 2007). In the Digital Forensic
Research Workshop (DFRWS) road map for Digital Forensic research, small
devices were again prioritised as key areas for research and growth of
investigator knowledge (Palmer, 2001). Xiao et al., (2007) raises a number of
research issues associated with RFID investigations and suggests that
application research has to be evaluated. Rieback et al., (2006a) explicitly
9