83

The head of our IT department and Networking class in my college has given me and another student a challenge; he told us that if we could clone the NFC tags in our student ID's used to sign in on time, he would give one of us unlimited access to the colour printers for a year. His main motto that he always talks about though is encouraging students to learn through experimentation regardless of whether the students ideas will work or not. He wants us to experience failure as well as success through our own attempts.

I'm a bit skeptical as to whether it will work because I've read forums online that say this a futile attempt because no reputable academic institution or business would leave their NFC tags unprotected and completely vulnerable to complete cloning.

From scanning the card with my Android phone, I see that it uses a Mifare Classic 1k tag.

Does anyone have an idea how to replicate it? There are some cheap tags on eBay but I wonder if I should bother if it's not even possible to clone it.

  • 9
    If you read @Hector answer and source reference, you will notice NXP is officially recommending to migrate away from MIFARE Classic based systems – mootmoot Oct 6 '17 at 8:51
  • 18
    Totally unrelated: I'm surprised the ability to make hard copy (ick) is seen as a reward in this day and age, but I'm out of touch with modern campus realities. – Todd Wilcox Oct 6 '17 at 12:09
  • 87
    "...no reputable academic institution or business would leave their NFC tags unprotected and completely vulnerable to complete cloning." Anybody who writes something like that needs to go poke around the real world for a few hours. – Blrfl Oct 6 '17 at 14:49
  • 4
    @ToddWilcox we're talking about unlimited color posters for beer bashes and keg parties. – barbecue Oct 7 '17 at 17:03
  • 4
    If I was you, I'd make sure to get some indication in writing that the head of IT has authorized you to try this. If you don't already, I would email them with something like: "We have made some progress researching your challenge <Summarize something from here> If you are still happy we are ready to trying a physical copy. If so do you have a blank card we can use?" If you don't get an email back (e.g., only gets back to you in person) then tread very carefully... Other wise have fun being authorized to break some things! Document everything carefully for when the sh*t hits the fan – DarcyThomas Oct 8 '17 at 9:26
57

Many NFC enabled smartphones can write to these cards with an app like MifareClassicTool. However I've found several phones seem to be able to do it when in reality trying to write to Sector-0 bricks the card. It may be worth testing one or two cards and if it doesn't work buy a dedicated USB writer.

First of all a huge number of Mifare Classic Systems only use the ID on the card. This is stored in Sector-0 which is theoretically read only. Of course plenty of online sources will happily sell you cards where this is writable. Writing to the cards themselves is trivial.

The encryption on the cards has also been broken and again can be trivially cracked on a smartphone, as seen on Wikipedia: Security of MIFARE Classic, MIFARE DESFire and MIFARE Ultralight. My university used the same cards. As did an Oracle facility I used to work at…

  • 12
    "when in reality trying to write to Sector-0 bricks the card" That sounds like a great denial of service attack on someone's wallet. – Luc Oct 6 '17 at 13:31
  • 7
    @Luc - Only works on cards with a writable Sector-0. I imagine there is a bug in the driver which hasn't been identified/fixed because its not a legal action. How it ends up bricking the card altogether is beyond me. Might just leave it in a dodgy state that led my reading software to barf. – Hector Oct 6 '17 at 13:43
  • 2
    Ah, Oracle... stuck in the 20th century as always. – jpmc26 Oct 6 '17 at 23:04
  • 5
    @jpmc26: Securing Oracle access has been an issue since the 6th century BC ;) – MSalters Oct 9 '17 at 12:54
22

I have recently cloned a Mifare Classic tag. The scan you have there indicates there is no information stored on your tags, apart from in the first sector. This isn't readable by that app because it does not use the default key.

I suggest you first try it with Mifare Classic Tool first, using the extended keys file. There are some common keys there but your tag may use a different one.

If that doesn't work, you will need MFOC or MFCUK with a dedicated reader, or a modified version of Mifare Classic Tool (google it) with your phone to attack the card. It can take upwards of 8 hours with a dedicated (USB / UART / SPI etc. I use a Raspberry Pi with a reader connected by SPI) reader, and even longer with Mifare Classic Tool.

You can then use the above tools to make a dump of the tag, providing you obtain the key.

If there is only data stored in the top row of sector 0 (not including the bottom row), this means the readers only look at the ID of the card. If your phone is rooted, you can then use this app to emulate a card (the ID is the first 4 bytes of sector 0). I have not tested this personally as my phone is not rooted.

Almost all Mifare Classic tags do not allow you to write to sector 0 (where the unique ID is stored), so that the ID can be used for security purposes. However, you can buy some tags (on eBay for example) that do allow you to write to sector 0.

Some of them will let you write them with Mifare Classic Tool, but others won't. This is because they require a special unlock command that is blocked on phones. You will need a dedicated reader (PN532 chipset works well) to write to them and nfc-tools, which you will probably have to compile yourself, but there are guides on how to do this.

15

If it is Mifare Classic, that should really not be hard.

The general attack on Mifare's broken cryptosystem has been around since 2007. Have a look at this if you want: BlackHat Talk Slides

This is indeed most likely easily possible. There are plenty of tutorials about this. Just remember: if your ID/whatever is not stored in the data section but only in Block 0 (the card's ID), this is not writable on most of the cards. There are Chinese models (as far as I know) that allow writing to Block 0. If your college just uses the card's ID and does everything else internally (like on a DB basis), you will need such a card.

See also: "How To Crack Mifare Classic Cards"

4

I've actually tried a similar thing at my old school, and after months of research, this is what I found:

  1. Write to sector 0 and hope for the best, maybe it's just the ID that's important.
  2. MFCUK, never got around to trying it myself, but if I recall correctly, it will use the security flaw of the classic and figure out the key.
  3. Brute force, the Mifare Classic Tool, have a extended version of the app, that you'll have to download over github, but let's face it, you're probably not going to have much luck with this option...

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.