Telematique, water and fire.

You need to feed the critics.

Friend Tom sent a message over the holiday weekend which referenced the text of a speech given by Bruce Sterling earlier this year. I went back to read it again, since I remembered enjoying it so much the first time. The post is a multi-front assault on the problem of "the Internet of Things", the importance of language (or, rather, the vocabulary used, what what it invokes and what it evokes), and Bruce's take on the timeline that moves us from ThingLinks, through blogjects, to spimes. (No... you go read it for yourself. I can't possibly do it justice.)

It was a better read this time! But what caught me is a sentiment / statement of principle / credo that really resonates as I consider my next endeavors.

...
It's morally wrong to avoid controversies just because you don't want anybody confronting you over what you are doing. There's something snotty about an author who expects only good reviews for his books. The author of an emergent technology is in the same boat. If nobody is dismissing you as hype, then you are not being loud enough. If nobody thinks what you are doing is dangerous, you are doing something that has no power to change the world. You'd better fight it out with words before you fight with laws. You're gonna be in no position to think straight when you suddenly get hauled in front of Congress and confronted for being "evil." You need to feed the critics. Don't feed the crazy ones, but a loyal opposition is hugely valuable.
...

Technorati Tags: blogjects, blogjects, RFID, spimes

More on the RFID virus assertion

More response to the study of RFID and security issues about which I posted earlier. In particular, I found the response from the EPC community very interesting. It's worth the read, and I have to agree with most of the arguments posited by the RFID "defenders". That said, I find the important point is made by one of the authors, Melanie Rieback: "A lot of these attacks are common knowledge to IT security professionals, but what is different is that no one expects these attacks to come from an RFID tag."

RFID Journal - Can Tag Viruses Infect RFID Systems?

... However, the group's claims were immediately rejected by some members of the RFID industry, including Kevin Ashton, cofounder and former executive director of MIT's Auto-ID Center and now vice president of marketing for RFID interrogator manufacturer ThingMagic.

"A typical EPC tag has 96 bits of memory with an ID number," Ashton notes. "For any such threat to be credible, there would have to be more memory, a read-write tag and variable-length tag reads. It would also need a reader and a system stupid enough and vulnerable enough to allow executable malicious code."

Sue Hutchinson is the director of product management for EPCglobal US, the U.S. arm of EPCglobal, a GS1-sponsored organization working to commercialize EPC technology and RFID standards. She says the security features built into the latest EPC tag and reader standard, Class 1 Gen 2, make the air interface protocol very different than the tags and readers used in the Dutch study.

Studies such as the one done at Vrije University are important because "they keep us thinking about these things, and it's of critical importance," says Hutchinson, "but it's a grand leap to say that [what was shown in the study] could happen to EPC tags and readers. ...

Update:

More reaction to the RFID Virus paper, including a reasonably accurate (as I read it) description of how the whole study is jury-rigged. I think that the point raised above is still the important one: Don't take for granted that the data in a tag is "clean" and "valid."

... Really, what they're doing is the equivalent of:

1. Designing a barcode system to automatically self-destruct if it ever reads a barcode of 1337 1337, for no reason other than to prove it's dangerous.

2. Broadcasting to the world that the barcode system will self-destruct if it ever reads a barcode of 1337 1337.

3. Intentionally reading a barcode of 1337 1337.

4. Claiming that barcodes are dangerous.

RFID Tags, just like barcodes are just data. Nothing more than data. If you intentionally design a system to be vulnerable to certain data, then intentionally expose the system to that data, then yup, you'll have a problem.

Technorati Tags: RFID, Security

How does an RFID tag perpetuate a computer virus?

InformationWeek's carrying a Reuter's article that mystifies me. I can understand that if an RFID tag is used to retain volatile information that, later, might be used in other calculations, transforms, etc. AND the villain of the piece has intimate knowledge of that application, it would be possible to throw data into the volatile storage that might gum up the works.

I can also understand that if RFID tags are "programmable" in the field, an erroneous EPC number could be inserted into the tag, inadvertantly or intentionally, with the result that the data base (once again) contains invalid information (and potentially, you're charged the going rate for toothpaste when buying a bottle of wine, since it has the same effect as a mis-tagged item).

But, a virus? That infects other RFID tags? I gotta see this paper.

Radio Chip Barcodes Can Carry A Virus: Scientists

March 15, 2006

AMSTERDAM (Reuters) - Cheap radio chips that are replacing the ubiquitous barcode are a threat to privacy and susceptible to computer viruses, scientists at a Dutch university said on Wednesday.

Researchers at the Amsterdam's Free University created a radio frequency identity (RFID) chip infected with a virus to prove that RFID systems are vulnerable despite the extremely low memory capacity on the cheap chips.

The problem is that an infected RFID tag, which is read wirelessly when it passes through a scanning gate, can upset the database that processes the information on the chip, says the study by Melanie Rieback, Bruno Crispo and Andrew Tanenbaum.

"Everyone working on RFID technology has tacitly assumed that the mere act of scanning an RFID tag cannot modify back-end software and certainly not in a malicious way. Unfortunately, they are wrong," the scientists said in a paper.

"An RFID tag can be infected with a virus and this virus can infect the back-end database used by the RFID software. From there it can be easily spread to other RFID tags," they said.

As a result, it is possible that criminals or militants could use an infected RFID tag to upset airline baggage handling systems with potentially devastating consequences, they said.

The same technology could also be used to wreak havoc with the databases used by supermarkets.

"This is intended as a wake-up call. We ask the RFID industry to design systems that are secure," Tanenbaum said in a telephone interview." ...

Update:

OK, I've downloaded their paper and read through the website. Their point, and it's a good one, though overblown, is that RFID, like any system that elicits input that goes to a database system, must be considered as containing attempted "exploits." If I were to do a "global replace" on their discussion of threats and exploits, replacing RFID with elicitation of data from users of the public internet using web browsers, the argument would be just as valid.

There are ways of pointing out that Best Practice in coding back-office software should always do a validation check on the input data before "committing" it to the system. This is an application software issue... not an issue specific to RFID.

If the point of this website and article is to point out that the data embodied in an RFID chip must NOT be considered already validated, they should have said so. If it was a fair study, by pointing up the potential threat, they should also point out that it is best practice to examine RFID-resident data for either inadvertent or intentional threats to the back-office software systems. They should have and could have said that without the sky-is-falling-and-RFID-is-inherently-unsafe hoopla.

Technorati Tags: RFID, Security

Microsoft Develops Own RFID Framework

Link: InformationWeek > Microsoft RFID Framework Due In '06 > Microsoft Develops Own RFID Framework > July 8, 2005.

...Microsoft's RFID framework will be encapsulated within enterprise applications, such as Microsoft's Axapta 4.0, due next year. The company also will offer its RFID object model and APIs to device manufacturers and ISVs—allowing them to plug into Microsoft's RFID framework and enabling out-of-the-box inventory tracking on the Windows platform, he said.
...
A number of partners in particular vertical industries stand to benefit from Microsoft's RFID solution, one service executive said. "This is something that end users are becoming very interested in, and it could be a good service offering for partners who service manufacturer and retail markets," said Paul Freeman, president of Coast Solutions Group, Irvine, Calif. Ken Winell, CEO of Econium, a Totowa, N.J., subsidiary of Visalign, agreed: "Lots of clients are interested in RFID, especially around the point-of-sale stuff," he said. "We are doing some really cool things with distribution and delivery solutions, so the Microsoft RFID [offering] will complement and extend that."

New Spec Could Put RFID Into Action

I know that I'm less tuned in to RFID these days, but I can't help but think that efforts like the one just announced by EPCglobal will make a big difference in the short-term uptake and viability of RFID.

EPCglobal hopes to finally propel radio-frequency identification from pilot status to wide-scale deployment with a new interoperability specification.

[eWEEK Technology News]