RFID Malware: Truth vs. Myth

On 15 March 2006, our research team at Vrije Universiteit published a paper about RFID malwareentitled "Is Your Cat Infected with a Computer Virus?" as well as a companion Web site(wwww.rfidvirus.org). Our paper introduced the concept of RFID malware and presented an accompanyingproof-of-concept RFID virus. It ultimately resulted in a huge amount of media attention; within 24 hours ofpresenting it at the Fourth Annual IEEE International Conference on Pervasive Computing and Communications(IEEE PerCom), we received more than 200 email messages. Amid this chaos, our research paper received theBest Paper Award for High Impact at the IEEE PerCom conference. In the months that followed, reports ofRFID malware prompted reactions from the RFID industry, the antivirus industry, and the US and Dutchgovernments. In this installment of Crypto Corner, we give our general impression of the paper's aftermath,addressing some important unanswered questions and distinguishing the truths from the myths about the workwe did.