When Theory and Reality Collide: Demystifying the Effectiveness of Ambient Sensing for NFC-based Proximity Detection by Applying Relay Attack Data

TL;DR

This study empirically evaluates whether ambient sensors can effectively detect proximity in NFC transactions and prevent relay attacks, providing insights into their suitability for securing contactless smartphone-based services.

Contribution

The paper provides a comprehensive empirical analysis of 17 sensors, selecting 7 for in-depth testing against relay attacks in contactless NFC transactions.

Findings

Ambient sensors show limited effectiveness in preventing relay attacks.

Certain sensors can distinguish legitimate from illegitimate transactions with moderate accuracy.

The study highlights challenges in using ambient sensors as reliable proximity detection mechanisms.

Abstract

Over the past decade, smartphones have become the point of convergence for many applications and services. There is a growing trend in which traditional smart-card based services like banking, transport and access control are being provisioned through smartphones. Smartphones with Near Field Communication (NFC) capability can emulate a contactless smart card; popular examples of such services include Google Pay and Apple Pay. Similar to contactless smart cards, NFC-based smartphone transactions are susceptible to relay attacks. For contactless smart cards, distance-bounding protocols are proposed to counter such attacks; for NFC-based smartphone transactions, ambient sensors have been proposed as potential countermeasures. In this study, we have empirically evaluated the suitability of ambient sensors as a proximity detection mechanism for contactless transactions. To provide a comprehensive analysis, we also collected relay attack data to ascertain whether ambient sensors are able to thwart such attacks effectively. We initially evaluated 17 sensors before selecting 7 sensors for in-depth analysis based on their effectiveness as potential proximity detection mechanisms within the constraints of a contactless transaction scenario. Each sensor was used to record 1000 legitimate and relay (illegitimate) contactless transactions at four different physical locations. The analysis of these transactions provides an empirical foundation on which to determine whether ambient sensors provide a strong proximity detection mechanism for security-sensitive applications like banking, transport and high-security access control.