RF-Rock: An Intermodulation-based RFID Unauthorized Identification Attack without Tag Activation

Following the broad prospect of Radio Frequency Identification (RFID) technology is the security concern of unauthorized tag identification, which poses threats to the privacy of both objects and users. In this paper, we propose RF-Rock, the first RFID unauthorized identification attack that operates without tag activation, thereby evading almost all existing defenses. This attack exposes the vulnerabilities of current RFID networks in identification legitimacy and privacy. It is based on the intermodulation effect originating from intrinsic nonlinearity within tag circuits. To this end, we explore the distinctness and consistency of the intermodulation-based physical layer fingerprint of RFID tags with theoretical analysis and empirical validation, and optimize the attack accuracy and efficiency with delicate excitation plan. Real-world experiments show that RF-Rock achieves an attack success rate of 93.2% on average under various conditions. The entropy of our proposed fingerprint is 15.5 bits and implies sufficient capacity in practical attacks.