Can Disney's Magic Bands be Hacked? - MouseChat.net - Orlando News & Reviews | Disney W... - 0 views
-
While it is still certainly possible to potentially clone a MagicBand (and thereby gain access to protected resources by impersonating the original band holder), the fact that the band operates on the 2.4 GHZ frequency inherently presents some challenges to any would-be malicious users. Admission to the parks is fairly expensive (Fig. 5) and the cost of the hardware required to conduct such a cloning attack far exceeds the cost of a legitimate day pass. For the attack to even be considered economical, the malicious user must clone many passes over time.
-
glope143 on 11 Jun 18This paragraph brings up an interesting point when it comes to the security of Disney's RFID MagicBands. The primary information on the Band itself that could be most "easily" accessed if cloned is a ticketed theme park entrance. The author believes the chances of this happening are slim to none given the amount of theme park entrances that would needed to be stolen in order to justify the cost of expensive RFID cloning hardware. For arguments sake, should a hacker clone a MagicBands individual RFID code there are still a variety of hurdles to cross before being able to walk away unnoticed. Since every RFID code is individualized, should the Band that was hacked enter the the theme park prior to the duplicate, the duplicate will be stopped and questioned by security. There are also bio-metric scanners in the front of each entrance that require the scanned fingerprint to match that on file. Should the fingerprint scanner fail, a cast member with access to the original MagicBand owner's photograph will deem the duplicate band a fraud.
-
-
Part of the MagicBand system allows guests to make purchases with the band at specific registers provided they have tied a credit/debit card to their account via an external process. This can be seen as a very big convenience to guests who do not wish to continually use their cards to make purchases while in the parks, or for those who find themselves wishing to buy merchandise when they had not initially anticipated in doing so and do not have their wallet/purse/money clip in their possession. Yet in order to make purchases, a user must first swipe their band against a specially designed reader (Fig. 6) and subsequently enter a matching PIN number. Even if our malicious user had an RFID token that was a working clone of a legitimate one, it is somewhat unlikely he would be able to successfully guess the matching PIN number within a reasonable number of tries in one sitting before the cashier would begin to get suspicious.
-
One of Disney's star features for their MagicBands is the ability to go hands-free throughout their vacation by having everything necessary stored on one device, including credit card information. This gives guests the ability to make purchases across the Resort without the additional moral barrier of having to remove their wallet from their purse or pocket. Should a MagicBand be misplaced, or duplicated as in the context of this article, a four digit code is still required to make purchases with the credit card on file. This code is not available for viewing on the band and cannot be changed though any means besides visiting the front desk with property identification.
-
-
While multifactor authentication certainly adds to the security of the system in a significant way, biometric hardware is not flawlessly reliable. Florida is a rather humid place [5] which inevitably affects the performance of sensitive electronic hardware like fingerprint readers. To address this issue and counteract the likelihood of the system presenting users with false negatives, it would be fair to assume that the fingerprint readers themselves are configured to fail open (ie, when in doubt, allow entry). This gives malicious users the potential benefit of knowing that they merely need to intentionally cause the reader to malfunction to be granted access. Social engineering could also potentially play a factor in the exploitation of the MagicBand system by using Disney’s own customer-service policy against itself. Suppose our malicious user is successfully stopped dead in his tracks at the gate. He has been beaten to the entry gate by his victims and has lost the calibration race; there is no hope the machine will accept his cloned band. Yet he scans it anyway, and is denied access immediately. He knows he will not gain entry, but he continues to scan it. The employees at the gate attempt to help him, scanning his band for him, fiddling with the machine, etc, all to no avail. Yet a large line is beginning to form behind him.
-
This article does a great job at playing devil's advocate in the situation of MagicBand cloning and creates a sound argument at what could happen should a hacker attempt to enter a Disney park with a previously used RFID code. As someone to frequently visit's the Disney theme parks, I would not be surprised if a cast member simply waved a guest through in order to avoid a line back up, especially during peak season times.
-
- ...1 more annotation...