Brendon J. Wilson

 by Brendon J. Wilson

The Killer RFID App

RFID has been in the news on and off again, with industry and privacy advocates lining up to do battle over whether this technology is the greatest thing since the UPC code, or the worst thing since Echelon. What’s really interesting is the central focus of the discussion is over something so mind-numbingly boring to a casual observer, it hardly seems to warrant all the attention: inventory control.

Much of the furor has been prompted by Wal-Mart’s decision to finally proceed with pilots of the technology with the goal of having all of suppliers using the technology by January. This is seen by many as the green light for the technology, which uses chips equipped with radio antennas to provide additional product meta-date information, allowing vendors to locate items and provide real-time tracking of inventory levels. Real-time tracking would eliminate traditional inventory tracking costs, while providing much better stocking planning capabilities for vendors.

However, retailers’ silver lining is unfortunately attached to the looming dark cloud of privacy advocates concerned that the technology could spur further privacy invasions. If every item eventually contains RFID tags, what’s to prevent massive tracking of individuals based on the tags embedded in the clothes they wear or the shoes they wear. These tags would become a real-world equivalent of the browser cookies used to track web site visitors, thereby allowing people to be tracked and targeted (perhaps fatally, as pointed out by John Gilmore) endlessly.

Though it has been suggested that this would be one way to allow a homeowner to find lost items within their house, my idea is slightly different: I want a comprehensive inventory of everything I own for both moving and insurance purposes. This idea occurred to me during my recent move, during which the movers had to guestimate weights and sizes to provide an estimate, and then tag everything manually. If everything I owned had an RFID tag, they could simply look up the item and get exact details on weight size, thereby providing an instant and accurate estimate of moving costs. Similarly, my insurer could ensure that I had enough insurance coverage for all of my items (after all, who can accurately guess how much all their stuff is worth?).

Taking the idea a step further, I could perform a scan of everything I own and upload the info to e-tailers like Amazon in order to obtain better personalized recommendations. Though Amazon already tracks past purchases, it is limited to purchases made from Amazon.com, and requires a manual process to upload additional information on items you own. This would streamline the process, and eliminate Amazon from suggesting items I already own. If all retailers did this, maybe they’d stop advertising crap I would never buy in a million years (nice dream, but probably unlikely).

On the other hand, maybe having everything tagged with RFID is not such a good idea – a burglar could easily wardrive for RFID tags, enabling a thief to target homes containing the high-value items. Then again, if I have the proper amount of insurance, what do I care?

in Technology 0 comments
 by Brendon J. Wilson

Spying With GMail

If you haven’t noticed, there’s lately been an overabundance of news about Google, including a deluge of product announcements, GMail privacy histrionics, and IPO speculations. Though I’m reluctant to contribute to the insanity, there is one element of the GMail privacy flap that I haven’t yet seen discussed, and so I feel the need to discuss the topic.

The GMail privacy discussions have taken one of two predictable forms. In one camp, privacy advocates tug their tinfoil hats further down their heads, and mutter to themselves that GMail will inevitably be bad because allowing someone to read all your email is never a good thing. In the other camp, seemingly level-headed, though somewhat indifferent, pseudo-champions of GMail point out that no one is holding a gun to anyone’s head – if you don’t want Google or advertisers getting access to your email, they say, simply don’t use the service.

Into this arena, I would like to present a third possibility: GMail might be a threat to your privacy, even if you don’t use the service. To illustrate how this is possible, it’s necessary to understand a little about signaling.

If you want to know whether or not a major operation is underway at the local FBI office, there’s a simple way to find out: watch the office over a long period of time and record the number of pizzas deliveries. Those nights that differ significantly from the average represent nights on which an operation is underway. Though this example is known to be an urban legend, it does provide a simple example to use to explain signaling – as you can probably guess, signaling reveals information to an outside party through an indirect channel. In the case of the FBI example, someone monitoring the deliveries knows that something is up; however, they don’t know exactly what operation is taking place. Nevertheless, the signal that the FBI is working harder/later than usual may be enough to convince a criminal to change their plans, and hence foil the FBI’s operation.

So how does this relate to GMail?

Well, you have to consider how Google’s advertising system, AdWords, works. Anyone can get an AdWords account with Google, allowing them to create a campaign that will display a specific advertisement to users when they search for the keywords associated with the campaign. For example, I created an AdWords campaign for my book, associating a simple text ad with the keywords “java”, “p2p”, and “jxta” – whenever someone entered those words into Google, they saw my ad.

Google’s AdWords system provides an advertiser with reports on the ad campaign detailing the number of times an advertisement has been displayed and the number of times a user has clicked on the ad. Though the AdWords administrative interface doesn’t report who saw my advertisement, throwing GMail into the mix makes this irrelevant. In order for me to be able to spy on a GMail user, I only need to carefully craft an AdWords campaign with a very specific set of keywords, and monitor if anyone ever triggers the display of my advertisement. This technique allows any user, not just Google, to effectively monitor GMail-based email communications, and only requires one of the parties (preferably the recipient) to be a GMail user.

Is this attack practical for general-purpose spying? Probably not. It’s unclear at this point whether GMail uses email headers that would permit this attack to be specific to an email address. It’s also unclear whether Google will filter out proper names to limit the ability of an attacker to target a particular person. However, an attacker could conceivably use knowledge of their victim to tailor the AdWords campaigns’ keywords to be arbitrarily precise.

That said, this flaw isn’t as bad as it seems – I doubt we’ll see companies blocking access to GMail, or filtering email destined for GMail accounts. After all, companies a hemorrhaging intellectual property via unencrypted email every day. Though this attack may allow GMail to be used to spy on a user from afar, the limited scope of any attack puts its risk below most of the other virus or spyware-based threats.

in Technology 2 comments