  The Internet of Things (IoT) is a distributed system of physical objects that
requires the seamless integration of hardware (e.g., sensors, actuators,
electronics) and network communications in order to collect and exchange data.
IoT smart objects need to be somehow identified to determine the origin of the
data and to automatically detect the elements around us. One of the best
positioned technologies to perform identification is RFID (Radio Frequency
Identification), which in the last years has gained a lot of popularity in
applications like access control, payment cards or logistics. Despite its
popularity, RFID security has not been properly handled in numerous
applications. To foster security in such applications, this article includes
three main contributions. First, in order to establish the basics, a detailed
review of the most common flaws found in RFID-based IoT systems is provided,
including the latest attacks described in the literature. Second, a novel
methodology that eases the detection and mitigation of such flaws is presented.
Third, the latest RFID security tools are analyzed and the methodology proposed
is applied through one of them (Proxmark 3) to validate it. Thus, the
methodology is tested in different scenarios where tags are commonly used for
identification. In such systems it was possible to clone transponders, extract
information, and even emulate both tags and readers. Therefore, it is shown
that the methodology proposed is useful for auditing security and reverse
engineering RFID communications in IoT applications. It must be noted that,
although this paper is aimed at fostering RFID communications security in IoT
applications, the methodology can be applied to any RFID communications
protocol.
