Can a student ID containing an NFC chip be cloned?

Question

The head of our IT department and Networking class in my college has given me and another student a challenge; he told us that if we could clone the NFC tags in our student ID's used to sign in on time, he would give one of us unlimited access to the colour printers for a year. His main motto that he always talks about though is encouraging students to learn through experimentation regardless of whether the students ideas will work or not. He wants us to experience failure as well as success through our own attempts.

I'm a bit skeptical as to whether it will work because I've read forums online that say this a futile attempt because no reputable academic institution or business would leave their NFC tags unprotected and completely vulnerable to complete cloning.

From scanning the card with my Android phone, I see that it uses a Mifare Classic 1k tag.

Does anyone have an idea how to replicate it? There are some cheap tags on eBay but I wonder if I should bother if it's not even possible to clone it.

Answer 1

Many NFC enabled smartphones can write to these cards with an app like MifareClassicTool. However I've found several phones seem to be able to do it when in reality trying to write to Sector-0 bricks the card. It may be worth testing one or two cards and if it doesn't work buy a dedicated USB writer.

First of all a huge number of Mifare Classic Systems only use the ID on the card. This is stored in Sector-0 which is theoretically read only. Of course plenty of online sources will happily sell you cards where this is writable. Writing to the cards themselves is trivial.

The encryption on the cards has also been broken and again can be trivially cracked on a smartphone, as seen on Wikipedia: Security of MIFARE Classic, MIFARE DESFire and MIFARE Ultralight. My university used the same cards. As did an Oracle facility I used to work at…

Answer 2

I have recently cloned a Mifare Classic tag. The scan you have there indicates there is no information stored on your tags, apart from in the first sector. This isn't readable by that app because it does not use the default key.

I suggest you first try it with Mifare Classic Tool first, using the extended keys file. There are some common keys there but your tag may use a different one.

If that doesn't work, you will need MFOC or MFCUK with a dedicated reader, or a modified version of Mifare Classic Tool (google it) with your phone to attack the card. It can take upwards of 8 hours with a dedicated (USB / UART / SPI etc. I use a Raspberry Pi with a reader connected by SPI) reader, and even longer with Mifare Classic Tool.

You can then use the above tools to make a dump of the tag, providing you obtain the key.

If there is only data stored in the top row of sector 0 (not including the bottom row), this means the readers only look at the ID of the card. If your phone is rooted, you can then use this app to emulate a card (the ID is the first 4 bytes of sector 0). I have not tested this personally as my phone is not rooted.

Almost all Mifare Classic tags do not allow you to write to sector 0 (where the unique ID is stored), so that the ID can be used for security purposes. However, you can buy some tags (on eBay for example) that do allow you to write to sector 0.

Some of them will let you write them with Mifare Classic Tool, but others won't. This is because they require a special unlock command that is blocked on phones. You will need a dedicated reader (PN532 chipset works well) to write to them and nfc-tools, which you will probably have to compile yourself, but there are guides on how to do this.

Answer 3

If it is Mifare Classic, that should really not be hard.

The general attack on Mifare's broken cryptosystem has been around since 2007. Have a look at this if you want: BlackHat Talk Slides

This is indeed most likely easily possible. There are plenty of tutorials about this. Just remember: if your ID/whatever is not stored in the data section but only in Block 0 (the card's ID), this is not writable on most of the cards. There are Chinese models (as far as I know) that allow writing to Block 0. If your college just uses the card's ID and does everything else internally (like on a DB basis), you will need such a card.

See also: "How To Crack Mifare Classic Cards"

Answer 4

I've actually tried a similar thing at my old school, and after months of research, this is what I found:

1. Write to sector 0 and hope for the best, maybe it's just the ID that's important.
2. MFCUK, never got around to trying it myself, but if I recall correctly, it will use the security flaw of the classic and figure out the key.
3. Brute force, the Mifare Classic Tool, have a extended version of the app, that you'll have to download over github, but let's face it, you're probably not going to have much luck with this option...