MAN IMPLANTS NFC CHIP IN HIS HAND TO HACK ANDROID PHONES

When you hold an Android phone, you just hold it. When Seth Wahle holds the same phone, an NFC chip in his hand can load a malicious web page that exploits the phone. So, should you stop letting people touch your phone from here on out? Well, you don’t have to freak out just yet.
The first phase in transforming himself into a walking, talking Android hack was for Wahle to find an NFC chip suitable for implantation. That’s not the sort of thing you can order on Amazon, after all. He was eventually able to purchase some Schott 8625 Bio-glass capsules with embedded NFC tags from a company in China. These tags are usually used to identify livestock in an agricultural setting, but the bio-neutral tubes work equally well in humans.
As with many types of body modification, Wahle couldn’t have a doctor implant the chip. Instead he had an “unlicensed amateur” inject it with a special syringe. Wahle lives in Florida, which has stringent body modification restrictions, though in most places you can find a professional piercer who will do implants of various types. The chip in Wahle’s hand allows him to send a web page to any Android phone with an NFC chip, and this page is the key to his exploit.

The hack requires that the person using the phone manually installs the file downloaded via the web page, which usually means a trip to the system settings to disable a security setting. Once installed, the app connects to a remote server and allows the attacker to control the device. In this case, he caused the phone to take a picture. It’s far from a silent app install, but it’s an interesting proof of concept. If you can get some kind of data onto a phone simply by touching it, that expands your options for exploiting it. Some future vulnerability might allow an attack without installing an app.
Wahle will demo his process at the Hack Miami conference in May. Let’s be honest, though. You can do pretty much the same thing by hiding a regular NFC chip in the palm of your hand, so why the injection? Seth Wahle clearly has a flair for the dramatic.