Questions tagged [nfc]
NFC (Near-Field Communication) is a short-range wireless technology, typically requiring a distance of 4cm or less to initiate a connection between two endpoints.
89
questions
0
votes
0
answers
119
views
Changing access conditions on a "magic" mifare classic 1k card
Is there a "magic" mifare classic card that enables you to change access conditions even if current access conditions are set to never change access conditions? (write ACS: never)
1
vote
1
answer
117
views
Are Bluetooth and/or NFC anonymous?
Suppose I have a smartphone and I have disabled all usual de-anonymizing things (e.g., wifi probe requests). My phone sends some data over Bluetooth (or NFC) to device A, and then at a different place ...
0
votes
0
answers
1k
views
Is using the CSN of a mifare desfire EV2 safe?
From what I know, Mifare Classic cards are easy to copy/clone using a device such as a flipperzero, and it has to do with authentication using the CSN (card serial number)
However, let's say that a ...
0
votes
0
answers
125
views
What kind of security protocols do current NFC or RFID based technologies use?
I have an information security class this semester, and I need to write a paper evaluating how secure NFC and RFID technology is.
A lot of questions previously asked here are at least 3 years old, and ...
0
votes
1
answer
286
views
If the terminal is malicious, is paying with NFC still safe?
Paying with credit card's NFC. I know about tokenization and all that, but does that actually protect my card against theft when the terminal is malicious?
0
votes
0
answers
115
views
Options for Integrating or developing a physical security solution (physical access control via in-house mobile apps [NFC/Bluetooh])
Our team is looking to either integrate or develop a physical security solution for a rather large campus.
Requirements:
Ability to either integrate (with reader/electronic lock hardware) from our ...
2
votes
0
answers
413
views
What are the security risks to NFC based YubiKeys?
What are the risks of using NFC on a YubiKey versus just a hard connector?
I imagine it would be possible to sniff some data off of these security keys? How real is the risk of sniffing and what could ...
3
votes
1
answer
937
views
Is it possible to emulate a full (mifare 1k) card with the ChameleonMini (Rev.G 2)?
I am testing a lock box I own, it uses a Mifare 1k lock with default key, and I use a keyfob to unlock it.
I have both a Proxmark3 and a ChameleonMini.
With the Proxmark3 I am able to both clone the ...
1
vote
0
answers
146
views
Any NFC readers (Android or iOS) able to access the ePassport raw (still encrypted) data e.g. without the Basic Access Control (BAC)?
Firstly, I assume it's possible to passively read the encrypted data from a ePassport NFC chip?
All of the NFC scanning apps fail to load anything without the BAC. We are not interested in the ...
2
votes
1
answer
152
views
How is the timer implemented in mutual distance-bounding protocols?
I've come across several papers introducing the concept of mutual distance-bounding, where basically both sides can verify an upper bound of the distance in between, rather than having this unilateral ...
1
vote
1
answer
1k
views
Are there any contactless (RFID/NFC) card vulnerabilities that are still unsolved? even minor ones
The title is pretty self explanatory. The market is pretty secretive about these kinds of matter since companies won't give out vulnerabilities for attackers to abuse and will give out vulnerabilities ...
4
votes
1
answer
2k
views
Guessing PIN code of smartcard using brute force and offline reader
I came across this question Offline brute-forcing of a bank card PIN, which was asked 7 years ago. I'm currently exploring vulnerabilities in EMV protocol, and I wanted to double check if an idea I ...
2
votes
1
answer
368
views
RFID // Understanding security of Standard-UID
We are evaluating how to improve security on our RFID System. Our system was reviewed by someone finding the point that there are duplicate Tags we must get rid of.
So the first idea was to read the ...
7
votes
1
answer
2k
views
Hardening NFC tags for authentication
So I have a small electronics project where I am using common Mifare Classic 1K NFC tags as a means of authentication. (Mifare DesiFire is just too expensive)
I know these aren't very secure so here ...
0
votes
0
answers
394
views
Detect card type (RFID, NFC, Magnetic, ...) [duplicate]
I would like to know how the communication between my gym card and the checking point works.
I bought an ACR122U reader, but it seems that I can't read my card with it, the card is not recognized as ...
0
votes
0
answers
509
views
Change NFC SAK Hard Coded to 08h
I am trying to copy some NFC card; however the SAK returned is always 08h using the command nfc-list. However looking through the actual content of the card, I can see that the byte associated to the ...
2
votes
0
answers
337
views
Preventing DoS Attacks on NFC
There are some attack scenarios on NFC. These include e.g. Data modification, data insertion, relay attacks and DoS attacks. Just to name a few.
While some of these attack scenarios are more likely ...
6
votes
1
answer
448
views
Is FeliCa DES encryption safe?
Sony FeliCa does not provide any official docs on which cryptographic functions are used for their NFC cards. They got some docs explaining that they do mutual authentication, but there is no official ...
1
vote
1
answer
1k
views
Is there a secure way to disable NFC and RFID on credit cards and personal IDs?
If you're wondering why would I want that - it's for my own security: against identity and data theft.
3
votes
1
answer
1k
views
Why don't online banks use WebAuthn? [closed]
My ideal bank would offer online banking from a browser with user/pwd and WebAuthn, for example with a NFC or USB key. No OTP or SMS or apps on the smartphone or physical devices required. (It goes ...
0
votes
1
answer
4k
views
Identifying and cloning NFC Card double size UID - type mifare plus 7 byte 2k or classic 7 byte 1k
I am trying to clone/write copies of an NFC card. I am using an ACR122U-A9 receiver and running nfc-tools on a kali linux VM.
The card I am trying to clone is identified as a Mifare Classic 1k tag
...
1
vote
0
answers
187
views
Is there any NFC message injection?
Are there any NDEF message smuggling attacks (like http smuggling attack)?
When I say it, I mean that I have a full control on the NFC packet. Is it possible to inject another packet into a NFC ...
0
votes
1
answer
225
views
PCI-DSS scope: Using P2PE Compliant devices
We use EMV card readers to automate the payments at the entry and exit to our services. These card readers and the unattended payment terminals are fully PTS complaint and use P2PE encryption. Also, ...
3
votes
0
answers
767
views
What is the most secure NFC Encryption system? [closed]
What are the best ways for NFC (Near-field communication) encryption with high level of security?
Basically, I am interested in having an NFC which can only be read/authenticated with a mobile app/...
1
vote
0
answers
105
views
Security of RFID/NFC card Payment [closed]
You are standing in front of a building with 3 rooms and have a NXP Mifare Classic 1k card.
In the first room is a device (device1) that can do the following things:
Shows how much money is on the ...
2
votes
1
answer
333
views
Burp not intercepting the intended traffic
I'm trying to test an authentication process using NFC reader as a medium. The scenario is like this, I need to go to a certain website but in order to get there, I need to verify myself using my ID ...
2
votes
1
answer
2k
views
NFC Android (Ntag213 vs Ultralight C)
I have an (university) project where I basically write and read text out of NFC Tags with Android devices in order to store one's balance in the card (wich can be used on the cafeteria, for example).
...
0
votes
1
answer
1k
views
Do 2 Chip based cards effect each other's data if they are in the same wallet all the time?
So I got 2 new ATM cards from two different banks, both cards are Chip and NFC enabled. Card A arrived one week earlier than Card B.
Both of them remain in my wallet in close proximity to each other, ...
1
vote
1
answer
7k
views
Is there a way to clone Mifare DESfire EV1 key sent by a NFC reader?
If I understood well its functioning, the card send an ID (NFC tag) if it has received a correct encryption key.
Probably by the reader?
So it must be possible to attack the reader instead of the ...
5
votes
1
answer
817
views
Is transaction history stored on credit card a security risk?
I installed an NFC reader on my android and scanned each of my bank cards to see what they would reveal through their contactless feature (NFC).
Unsurprisingly they reveal the card number and the ...
92
votes
4
answers
74k
views
Can a student ID containing an NFC chip be cloned?
The head of our IT department and Networking class in my college has given me and another student a challenge; he told us that if we could clone the NFC tags in our student ID's used to sign in on ...
4
votes
0
answers
318
views
Location fixing through NFC Tag
I'm new to NFC technologies and I want to develop a smartphone app that reads a NFC tag and sends the location securely to web service. This NFC tag is in a special place and we MUST be sure that the ...
0
votes
2
answers
1k
views
What should I know to prevent relay attack on NFC?
I am doing thesis on "NFC relay attack" in my BSc last year. I have studied 10-15 papers and learned the basics of NFC and relay attack. Still I am no where near to understand how relay attack is ...
1
vote
1
answer
307
views
How secure is a mobile e-banking authentication app that requires an NFC card plus a pin to authenticate the user?
Many banks these days offer online banking (in a web browser). To increase security, most banks require a standard login with a username (account number) and password, plus a code that is sent to your ...
2
votes
0
answers
142
views
Security implications of owning a German electronic ID card
I am German and about to renew my ID card.
Since around 2010, the new ID cards contain an electronic chip that can be used for e.g. online authentication. If I understood the documentation correctly,...
1
vote
0
answers
1k
views
NFC Forum Type 4 Tag and NXP MIFARE DESFire EV2?
I have some comprehension problems regarding the NFC Forum Type 4 Tag capabilities of NXP MIFARE DESFire EV2.
I found the NXP Application Note AN1104 regarding NFC Forum Type 4 Tag and NXP MIFARE ...
2
votes
0
answers
431
views
How is a NFC session key created?
I was reading MIFARE DESFire EV1 document and noticed this:
MIFARE DESFire EV1 and the reader device show in an encrypted way
that they possess the same secret which especially means the same key;...
0
votes
3
answers
10k
views
Is it possible to disable NFC on credit card?
I have credit card with wireless payment.
For low prices it does not require to enter pin code.
An attacker with 100$ device can take these money whithout my knowledge.
Of course, I can configure ...
1
vote
2
answers
3k
views
Are NFC tags with cryptographic features "write-only"?
I was wondering how exactly cryptographic NFC tags/cards retain their security. I read that there are certain types of cards that are able to perform symmetric or asymmetric cryptography. These cards ...
2
votes
0
answers
210
views
Prevent NFC token from being easily copied?
From my knowledge on NFC, which isn't a lot, it seems like it would be very easy to copy an NFC token.
What methods can be used to prevent people from making unauthorised copies of the NFC tokens?
...
0
votes
1
answer
185
views
Why are card associations launching RFID enabled payment cards despite of their being unsecure?
You can use applications to get data from these cards. I got tracks data of my cards as well as card number and expiry from my debit card just by single tap of phone. A criminal can use that data and ...
10
votes
2
answers
44k
views
Mifare DESfire EV1 cloning?
How can I clone an encrypted Mifare DESfire EV1 Card?
Tried a 13.56Mhz Reader/writer from eBay but didn't work properly... I need to find any possible way of doing this.
2
votes
2
answers
268
views
Protecting QR Code, Eddystone and NFC against spoofing
Let's say I have the following scenario. I have QR Code, Eddystone and/or NFC which contains IP address, with which, my client side application communicates. Let's say this IP address can vary from ...
3
votes
1
answer
769
views
NFC and ISO 14443 : security?
I'm trying to understand if the ISO 14443 guarantees any degree of security for an NFC transaction. I can't access the documentation because it is not free, but I see devices (like MIFARE DESFire or ...
0
votes
1
answer
2k
views
Where can I use BLE/NFC U2F device?
Can BLE U2F security keys be used on Chrome for macOS/Windows for any site supporting U2F USB keys as a second factor?
What sites/apps can I use NFC/BLE U2F keys for on NFC-(and BLE-)supporting ...
2
votes
1
answer
12k
views
Is there a reason why Android blocks emulating a RFID tag?
So, I have this public transportation card, as well as a card that grants access to my school and lastly one that grants access to my work's office building.
My android device doesn't allow me to ...
4
votes
1
answer
2k
views
How secure is Google’s/Android’s Smart Lock functionality?
Newer Android phones (since Android 5, “Lollipop”) have the Smart Lock functionality that allows one to unlock the phone, among other ways, with a trusted device (Bluetooth or NFC) instead of entering ...
2
votes
1
answer
2k
views
Mifare Desfire symmetric authentication with master key on android
I wanted to use the Mifare Desfire chip for product authentication purposes, where the chip would be embedded into products. As such, I am looking for a NFC solution that makes it virtually impossible(...
3
votes
2
answers
625
views
How are payment cards secured?
Since the era of contactless payments, it's easy to make payment via card without entering PIN code, but how is the card actually secured?
There is limit of 20€ of course, but even committing 20€ ...
3
votes
3
answers
2k
views
mifare classic 1k for micropayments
Can Mifare Classic 1k be used for micro payments in a secure way?
I have a system in mind for use in a arcade game saloon. You are getting a card from cashier and can top it up for example with 100 ...