Imagine when you line up in a store, the person in front of you can make you pay her bill by using a passive wearable device that forces a scan of your credit card or mobile phones without your awareness. An important assumption of today's near-field communication (NFC)-enabled cards is the limited communication range between the commercial reader and the NFC cards. Previous approaches effectively used mobile phones and active relays to break the range limit of NFC propagation for the NFC attack. However, these approaches require a power supply and protocol modification when mobile phones or active relays transmit NFC signals. We propose ReCoil, a system that uses passive relays to attack NFC-enabled mobile phones or cards by expanding the communication range of NFC to 49.6 cm, an obvious improvement over its intended commercial distance. ReCoil is a magnetically coupled resonant wireless power transfer system, which optimizes the energy transfer by searching the optimal geometry parameters. Specifically, we first narrow down the feasible area reasonably and design the ReCoil-greedy algorithm such that the relays absorb the maximum energy from the reader. In order to reroute the signal to pass over the surface of the human body, we then design a half waistband by carefully analyzing the impact of the distance and orientation between two coils on the mutual inductance. Then, three more coils are added to the system to keep enlarging the communication range. Finally, extensive experiment results validate our analysis, showing that our passive relays consisting of common copper wires and tunable capacitors can expand the range of NFC to 49.6 centimeters.

中文翻译：

---

你买单！使用无源继电器攻击 NFC


想象一下，当您在商店排队时，您前面的人可以使用无源可穿戴设备让您支付账单，该设备会在您不知情的情况下强制扫描您的信用卡或手机。当今支持近场通信 (NFC) 的卡的一个重要假设是商业读卡器与 NFC 卡之间的通信范围有限。以前的方法有效地使用移动电话和有源中继来突破 NFC 传播的范围限制以进行 NFC 攻击。然而，当手机或有源继电器传输 NFC 信号时，这些方法需要电源和协议修改。我们提出了ReCoil，这是一种使用无源继电器攻击支持NFC的手机或卡的系统，通过将NFC的通信范围扩大到49.6厘米，比其预期的商业距离有了明显的改进。 ReCoil 是一种磁耦合谐振无线功率传输系统，它通过搜索最佳几何参数来优化能量传输。具体来说，我们首先合理缩小可行区域，设计ReCoil-greedy算法，使继电器吸收来自读写器的最大能量。为了重新路由信号以通过人体表面，我们通过仔细分析两个线圈之间的距离和方向对互感的影响，设计了半腰带。然后，系统中又添加了三个线圈，以不断扩大通信范围。最后，大量的实验结果验证了我们的分析，表明我们的由普通铜线和可调电容器组成的无源继电器可以将 NFC 的范围扩大到 49.6 厘米。