Reports that the military has started outfitting firearms with RFID tags for tracking have raised security alarms.
The concern: What if the enemy uses the tags to track soldiers on the battlefield?
The Department of Defense, the Marines and the Navy have already rejected the RFID tagging tech for that specific reason, according to the AP. However, five Air Force bases are operating at least one RFID armory, along with a Florida-based Green Beret unit that uses RFID in what officials said were a “few” armories.
When the AP questioned the Navy about its use of RFID tags to track weapons, spokesman Lt. Lewis Aldridge said the tech “didn’t meet operational requirements” and would not be rolled out further throughout the service branch, according to the report.
Tagging the guns keeps them from being stolen or sold to civilians, according to the AP, which added that the tags also make labor-intensive tasks like counting and checking weapons in and out practically instantaneous.
But the security downside to that convenience is potentially enormous.
RFID Security Risks
Capt. Andrew Wood succinctly framed the concerns when he told the AP that the RFID tags “[increase] the digital signature of Marines on a battlefield, increasing the security/force protection risks.”
Security experts who talked to the AP said the tags would be detectable up to a much farther distance than advertised, meaning adversaries could track troop movements, make fake RFID tags and more.
Tod Beardsley, director of research at Rapid7, told Threatpost that the danger depends on the specific technology deployed. He pointed out the distinction between RFID tags that require a reader to activate, vs. tags that are outfitted with their own power source.
“The kinds of RFID tags that are used in retail settings and warehouses are nearly always activated by the reader because they’re cheap and they don’t have their own power source,” Beardsley explained. “Imagine an access badge – you have to hold the badge within a couple of centimeters of a door lock for the reader to power and read the badge, but it doesn’t work when the badge is in your pocket.”
On the other hand, Beardsley said, if tags are equipped to send out their own signals, the security concerns are real.
“Self-powered RFID tags [that] have a battery and beacon out with their own signals can be read much further away since it all comes down to the reader’s sensitivity and directionality,” Beardsley added. “With the right equipment. you could read an active RFID tag from a couple of hundred meters away without much problem.”
Frequency could also be a big factor, he said.
“In other words, some RFID tags can be read from much longer distances than the manufacturer intends, while other RFID tags cannot be read from distances over a few meters, tops, no matter how much power you’re putting behind the reader,” Beardsley explained. “RFID tags aren’t magical; they have physical limitations based on their design.”
Convenience Over Warfighter Security
Maor Franco, senior director at Pentera, told Threatpost that he views this as a classic case of convenience being put before security. He also warned that tracking isn’t the only security concern with RFID technology. Attacks including sniffing and RFID spoofing should also be considered threats.
“Operational Technology (OT) controls, such as medical devices, and Industrial Controls Systems (ICS) are more connected and open than ever before, and increasingly targeted by nation-state and criminal groups,” Franco said. “In this case of RFID, with proximity obstacles removed, different attacks such as RFID sniffing and spoofing are enabled. The most dangerous in the case of weapons is tracking, where the location and movement of an object/person can be recorded relatively easily – even in the case of encrypted messages.”
William Malik, VP of infrastructure strategies with Trend Micro, told Threatpost that the military routinely blocks location trackers around sensitive installations, and this should be no different.
“RFID tracking devices make life easier for the logistics management function and the quartermaster but make life a lot more dangerous for the warfighter,” Malik said. “As with wearing a FitBit while jogging outside a covert military base or carrying an active cell phone into a secure installation, location identification and tracking technologies give away far too much information to be safely used in combat.”
Check out our free upcoming live and on-demand webinar events – unique, dynamic discussions with cybersecurity experts and the Threatpost community.