## 3 Electromagnetic Security of Selected HF-Band RFID Card Readers and Access Control Systems
### Reader Systems
#### 3.1.3 Galaxy A34 as an HF-Band RFID Reader  
The last of the analyzed cases was the use of a mobile phone equipped with an NFC module to read identifiers. A SAMSUNG phone marked as GALAXY A32 was used for the research. The measuring system in which the tests were carried out is shown in Figure 32.  
The measurements for this case were carried out in the frequency range from 1 MHz to 100 MHz (the measurement range is limited due to the lack of visible disturbances of the revealing emission nature). They were aimed (as in the previous example) to detect possible frequencies at which it would be possible to receive a signal from the identifier. Potentially dangerous frequencies may be the basic frequency of the reader's operation (13.56 MHz) and its harmonics. A graph showing the signal level at individual frequencies is shown in Figure 33.  
Figure 33: Level of electromagnetic disturbances from the tested mobile phone. Figure 32: Measuring system for testing the revealing emissions from the tested mobile phone. Figure 34 shows waveforms recorded with an oscilloscope connected to the \"VIDEO\" output of the measurement receiver after tuning to selected frequencies. As can be seen in the presented measurement results (Figures 30 and 31 and Table 9) the least secure of the tested RFID HF systems is, in our opinion, the NFC card reader/programmer NS-106 because of the following reasons:  
* Very clear revealing emission signals were observed up to the frequency of 691.56 MHz (Figure 30);
* These signals were characterized by a high level of field strength of up to 60 dB\(\mu\)V/m (Figure 30);
* The level of waveforms observed on the oscilloscope corresponding to the data sent from the identifier is comparable to the level of the signal corresponding to the queries;
* The range of the occurrence of revealing emissions was estimated at about 10-20 m (depending on the frequency);
* The possibility of identifying the reader's signal at about 50 m;
* It is, in our opinion, a great threat in relation to both the possibility of intercepting the transmission and tracking the card reader. As can be seen in the presented measurement results (Figures 23-25, Figures 27 and 28 and Table 11) the second tested RFID HF system that is not fully secure is, in our opinion, the ACS-Access Control system, because of the following reasons:  
* For this system, it was possible to recreate information for the frequencies of 13.56 and 40.68 MHz. * The estimated range of information penetration (i.e., the distance from which it is possible to read the data transmitted by the identifier) is about 2-3 m.  
Figure 34: Examples of obtained waveforms for a frequency of 13.56 MHz: (**a**–**c**). -reception methods described in the article do not significantly affect it. The maximum distances from which it is possible to read the data do not exceed a dozen or so cm. Therefore, the communication between the card and the reader can be considered safe. Unauthorized persons cannot restore the data stored on the card and possibly copy such a card without direct access to it. The weakest links in the entire access control system are the card readers. In this case, with the appropriate equipment, it is possible to restore the data stored on RFID cards. Identification of such data is possible from a distance not exceeding 2 m.  
In the case of HF-band RFID (NFC) communication, it is possible to receive a signal from the identifier from a distance of approx. 30 cm using simple and inexpensive solutions. This can be a potential danger with regard to the possibility of copying or transferring data from the identifier. Information and Communication Technologies (ICT) security measures such as encryption of sent data were not taken into account. As in the case of LF-band RFID solutions, for HF-band RFID the weakest link seems to be the systems used to read information.