Reading RFID tags - Adam Laurie's RFIDIOt and the CardMan 5321 USB reader

As I noted in my last post, Improvised RFID Blocking Wallets: Preventing PayPass Skimming, I have recently been working with an OmniKey Cardman 5321 USB RFID reader in Windows. The reader is compatible with a broad range of RFID cards (From Omnikey's website):

• Philips/NXP: MIFARE®, DESFire®, MIFARE ProX®, and i.code
• HID: iCLASS®
• Texas Instruments: TagIT®
• ST Micro: x-ident, SR 176, SR 1X 4K
• Infineon: My-d (in secure mode UID only)
• Atmel: AT088RF020
• KSW MicroTech: KSW TempSens
• JavaCard: JCOP / SMART-MX in RSA mode with 2048 bit keys

Omnikey provides drivers, as well as a simple diagnostic tool which can read tag IDs and can provide basic information about the contents of the tag. If you want to do more with RFID, you need a more full featured software package, and Adam Laurie's RFIDIOt handily answers that call. RFIDIOt reads ICAO 9303 encoded Machine Readable Travel Documents, and both Data Group 61 (MRZ) and DataGroup 75 (Encoded Information Features - FACE), as well as many other data types.

To make RFIDIOt work, I installed Python 2.5.2, as some of the packages it relies on work with 2.5, but not with 2.6. You'll need the following software packages to make it all work:

• pySerial (2.4 Win32)
• pyscard (1.6.7 Win32-py2.5)
• pycrypto (pycrypto-2.0.1.win32-py.25)
• the Python Imaging Library (PIL-1.1.6.win32.py2.5)
• pywin32-212 (pywin32-212.win32-py2.5)

You can ignore the need for PCSCLite for the purposes of this install.

You will also need to modify RFIDIOtconfig.py to use the USB device. Simply modify the section that reads:

# serial port (can be overridden with -l for Windows)
line= "SERIAL”

With the following:

# serial port (can be overridden with -l for Windows)
line= "USB”

A simple re-compile of RFIDIOtconfig.py results in an updated RFIDIOtconfig.pyc, and you're ready to go.
Once you have done this, you should be able to test your reader by executing multiselect.pyc, which is a simple looping tag ID reader. If you see the tag IDs when the green LED on your CardMan turns red, you've succeeded.

RFIDIOt presumes that you will have a directory in your system root called /tmp - if you want to capture any data for testing, you'll need to manually create the directory on Windows systems.

Improvised RFID Blocking Wallets: Preventing PayPass Skimming

Many credit card users do not realize that they have PayPass enabled RFID credit cards in addition to the new RFID enabled US Passports. These RFID enabled devices are easily read at distances compatible with casual contact in a crowded environment such as a subway or an airport, and various data can be gathered from them (US passports require key data to decrypt the data stream). More and more people carry fob based RFID PayPass tokens, or have PayPass cards, making the wireless exposure of their card data far more likely.

How can we combat this? The good news is that commercial RFID blocking wallets are available, and various people have created their own versions such as the duct tape and tin foil wallet. The resourceful traveler can easily replicate their functionality on an ad-hoc basis too. We have tested with a number of common objects, such as the cookie bag and tinfoil above, which worked quite nicely for our 13.56 Mhz test tags.


As you would expect, common food packaging is a very easy to obtain improvised RFID blocking material. We have not tested 125 kHz tags, so your mileage may vary if you are attempting to block RFID tags using that frequency.

Our testing was conducted using a commercially available Omnikey Cardman 5321, a USB connected RFID reader, and using Adam Laurie's RFIDIOt package. Longer ranges are possible using custom antennas and readers, with some testing on these passive tags being done at up to 30 feet by NIST - a result that worries the ACLU.

Check your wallet - you may have a PayPass enabled card without realizing that you do. To check, simply check the back of your wallet for the PayPass logo. In addition, many cards have a chip logo on the front, making them easily identifiable.