Ilan Kirschenbaum and Avishai Wool have demonstrated the feasibility of designing and building an extended range RFID skimmer on a very limited budget (US$100). Although the paper focuses on ISO-14443 RFID tags, these have the same operating frequency as the Octopus cards used on Hong Kong transportation networks (13.56 MHz). The Octopus system was designed before the publication of the ISO standard.
They used an antenna constructed from antenna from 5/16 inch cooking gas copper tube to read RFID tags at a range of up to 25cm, and believed that they could reach a range of 35cm with some more effort. They concluded that,
- ISO-14443 RFID tags can be skimmed from a distance that does not require the attacker to touch the victim;
- Simple RFID tags, that respond to any reader, are immediately vulnerable to skimming; and
- They are about half–way toward a full-blown implementation of the relay-attack predicted by Ziv Kfir and Avishai Wool.