Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [nfc]

NFC (Near-Field Communication) is a short-range wireless technology, typically requiring a distance of 4cm or less to initiate a connection between two endpoints.

1
vote
0answers
97 views

Is there any NFC message injection?

Are there any NDEF message smuggling attacks (like http smuggling attack)? When I say it, I mean that I have a full control on the NFC packet. Is it possible to inject another packet into a NFC ...
0
votes
1answer
91 views

PCI-DSS scope: Using P2PE Compliant devices

We use EMV card readers to automate the payments at the entry and exit to our services. These card readers and the unattended payment terminals are fully PTS complaint and use P2PE encryption. Also, ...
0
votes
0answers
145 views

Cloning NFC card failed - dump looks identical

I've been trying to experiment with cloning NFC cards as part of an experiment. I've successfully got to the point where I've got a dump of both cards (done with Mifare Classic Tool). After the '...
3
votes
0answers
218 views

What is the most secure NFC Encryption system? [closed]

What are the best ways for NFC (Near-field communication) encryption with high level of security? Basically, I am interested in having an NFC which can only be read/authenticated with a mobile app/...
1
vote
0answers
38 views

Security of RFID/NFC card Payment [closed]

You are standing in front of a building with 3 rooms and have a NXP Mifare Classic 1k card. In the first room is a device (device1) that can do the following things: Shows how much money is on the ...
2
votes
1answer
103 views

Burp not intercepting the intended traffic

I'm trying to test an authentication process using NFC reader as a medium. The scenario is like this, I need to go to a certain website but in order to get there, I need to verify myself using my ID ...
1
vote
0answers
532 views

NFC Android (Ntag213 vs Ultralight C)

I have an (university) project where I basically write and read text out of NFC Tags with Android devices in order to store one's balance in the card (wich can be used on the cafeteria, for example). ...
0
votes
1answer
72 views

Do 2 Chip based cards effect each other's data if they are in the same wallet all the time?

So I got 2 new ATM cards from two different banks, both cards are Chip and NFC enabled. Card A arrived one week earlier than Card B. Both of them remain in my wallet in close proximity to each other, ...
1
vote
1answer
3k views

Is there a way to clone Mifare DESfire EV1 key sent by a NFC reader?

If I understood well its functioning, the card send an ID (NFC tag) if it has received a correct encryption key. Probably by the reader? So it must be possible to attack the reader instead of the ...
5
votes
1answer
368 views

Is transaction history stored on credit card a security risk?

I installed an NFC reader on my android and scanned each of my bank cards to see what they would reveal through their contactless feature (NFC). Unsurprisingly they reveal the card number and the ...
83
votes
4answers
38k views

Can a student ID containing an NFC chip be cloned?

The head of our IT department and Networking class in my college has given me and another student a challenge; he told us that if we could clone the NFC tags in our student ID's used to sign in on ...
4
votes
0answers
118 views

Location fixing through NFC Tag

I'm new to NFC technologies and I want to develop a smartphone app that reads a NFC tag and sends the location securely to web service. This NFC tag is in a special place and we MUST be sure that the ...
0
votes
2answers
666 views

What should I know to prevent relay attack on NFC?

I am doing thesis on "NFC relay attack" in my BSc last year. I have studied 10-15 papers and learned the basics of NFC and relay attack. Still I am no where near to understand how relay attack is ...
1
vote
1answer
148 views

How secure is a mobile e-banking authentication app that requires an NFC card plus a pin to authenticate the user?

Many banks these days offer online banking (in a web browser). To increase security, most banks require a standard login with a username (account number) and password, plus a code that is sent to your ...
2
votes
0answers
78 views

Security implications of owning a German electronic ID card

I am German and about to renew my ID card. Since around 2010, the new ID cards contain an electronic chip that can be used for e.g. online authentication. If I understood the documentation correctly,...
1
vote
0answers
568 views

NFC Forum Type 4 Tag and NXP MIFARE DESFire EV2?

I have some comprehension problems regarding the NFC Forum Type 4 Tag capabilities of NXP MIFARE DESFire EV2. I found the NXP Application Note AN1104 regarding NFC Forum Type 4 Tag and NXP MIFARE ...
2
votes
0answers
223 views

How is a NFC session key created?

I was reading MIFARE DESFire EV1 document and noticed this: MIFARE DESFire EV1 and the reader device show in an encrypted way that they possess the same secret which especially means the same key;...
0
votes
3answers
4k views

Is it possible to disable NFC on credit card?

I have credit card with wireless payment. For low prices it does not require to enter pin code. An attacker with 100$ device can take these money whithout my knowledge. Of course, I can configure ...
1
vote
2answers
1k views

Are NFC tags with cryptographic features “write-only”?

I was wondering how exactly cryptographic NFC tags/cards retain their security. I read that there are certain types of cards that are able to perform symmetric or asymmetric cryptography. These cards ...
2
votes
0answers
83 views

Prevent NFC token from being easily copied?

From my knowledge on NFC, which isn't a lot, it seems like it would be very easy to copy an NFC token. What methods can be used to prevent people from making unauthorised copies of the NFC tokens? ...
0
votes
1answer
95 views

Why are card associations launching RFID enabled payment cards despite of their being unsecure?

You can use applications to get data from these cards. I got tracks data of my cards as well as card number and expiry from my debit card just by single tap of phone. A criminal can use that data and ...
4
votes
2answers
16k views

Mifare DESfire EV1 cloning?

How can I clone an encrypted Mifare DESfire EV1 Card? Tried a 13.56Mhz Reader/writer from eBay but didn't work properly... I need to find any possible way of doing this.
2
votes
2answers
147 views

Protecting QR Code, Eddystone and NFC against spoofing

Let's say I have the following scenario. I have QR Code, Eddystone and/or NFC which contains IP address, with which, my client side application communicates. Let's say this IP address can vary from ...
1
vote
1answer
319 views

NFC and ISO 14443 : security?

I'm trying to understand if the ISO 14443 guarantees any degree of security for an NFC transaction. I can't access the documentation because it is not free, but I see devices (like MIFARE DESFire or ...
-1
votes
1answer
2k views

Where can I use BLE/NFC U2F device?

Can BLE U2F security keys be used on Chrome for macOS/Windows for any site supporting U2F USB keys as a second factor? What sites/apps can I use NFC/BLE U2F keys for on NFC-(and BLE-)supporting ...
2
votes
1answer
6k views

Is there a reason why Android blocks emulating a RFID tag?

So, I have this public transportation card, as well as a card that grants access to my school and lastly one that grants access to my work's office building. My android device doesn't allow me to ...
4
votes
1answer
1k views

How secure is Google’s/Android’s Smart Lock functionality?

Newer Android phones (since Android 5, “Lollipop”) have the Smart Lock functionality that allows one to unlock the phone, among other ways, with a trusted device (Bluetooth or NFC) instead of entering ...
2
votes
1answer
947 views

Mifare Desfire symmetric authentication with master key on android

I wanted to use the Mifare Desfire chip for product authentication purposes, where the chip would be embedded into products. As such, I am looking for a NFC solution that makes it virtually impossible(...
3
votes
2answers
244 views

How are payment cards secured?

Since the era of contactless payments, it's easy to make payment via card without entering PIN code, but how is the card actually secured? There is limit of 20€ of course, but even committing 20€ ...
3
votes
3answers
796 views

mifare classic 1k for micropayments

Can Mifare Classic 1k be used for micro payments in a secure way? I have a system in mind for use in a arcade game saloon. You are getting a card from cashier and can top it up for example with 100 ...
7
votes
3answers
954 views

Contactless credit cards security

In the UK there has been a large increase recently in the use of contactless card payments (you pay by waving your card over a reader). Prior to this the primary way to pay with a card was to use "...
3
votes
0answers
351 views

Can we capture security key used in an NFC connection for Mifare Classic?

Millions of NFC Mifare Classic cards are used for public transport, access control and other purposes. These NFC tags use encryption so that the data on NFC tag cannot be read or changed by someone ...
2
votes
0answers
4k views

Is it possible to clone an NFC/RFID chip that uses IsoDep, NfcA and NdefFormatable

I have an NFC/RFID keychain that looks pretty much like this one: When I read it with an Android app called "Nfc Reader", it shows me a specific ID (always the same) and it says that these ...
2
votes
1answer
1k views

Mifare Plus X vulnerabilities [closed]

I have just purchased a Mifare Plus X (MF1PLUSx0) for a security project. I know that there are exploits against Mifare Classic cards (using tools such as Mfoc and Mfcuk), but are there similar ...
5
votes
3answers
3k views

What is the difference between secure element and smart card?

From smartcardalliance.org: The secure element [...] resides in highly secure crypto chips (usually a smart card chip). My questions are: Aside from smart card chip, are there any other types of ...
3
votes
1answer
87 views

NFC Security for Payment

During an offline transaction, the Point-of-Sale has no internet connection, and so the payment terminal cannot verify if the client’s payment device has been revoked. A malicious person can use a ...
2
votes
1answer
281 views

How does TLS over NFC works?

I'm reading about NFC and how its security can be enhanced. I read somewhere that it is possible to use TLS over NFC. Unfortunately, I can't find any more information on that topic. How does TLS over ...
98
votes
4answers
44k views

How can RFID/NFC tags not be cloned when they are passive technology?

Everywhere a question like this is asked, I see people responding that (in a scenario where a card is used) the card does some processing with the data it receives/generates some data when it receives ...
2
votes
4answers
803 views

Best practices for loyalty cards (barcode & NFC)

I am currently trying to determine the best way to go about designing a system that integrates both barcodes and NFC passes. The barcodes will be displayed on a phone screen. The barcode (2D, Aztec, ...
6
votes
2answers
6k views

Is it possible to clone my contactless debit card while it's in my pocket?

I have a bank account that I never use, someone cloned my debit card and used it to buy something in Brazil in order to make sure the cloning was successful then they started making transactions of £...
1
vote
0answers
440 views

Mifare cards authentication

I have few questions about Mifare authentication: 1) Can you confirm me that the authentication between the reader and the tag is as follow: the reader send the correct key to the tag for the sector ...
14
votes
1answer
2k views

How safe is my contactless bank card?

In the past few years Contactless Payment cards have been introduced and I have been reading some articles surrounding security of these cards. The following article "Stealing data from contactless ...
1
vote
1answer
238 views

What data is sent between an NFC/BTLE FIDO U2F device and Chrome (or other agent)?

I need to explain what "conversation" occurs between a FIDO U2F device (YubiKey NEO) and the agent (Chrome). I want to know if it's a challenge response, and ultimately figure out how much ...
-1
votes
1answer
332 views

How does NFC card and reader transfer data? [closed]

Just out of curiosity. In our town we use NFC cards for the public transportation, so when you use the train you have to touch on and then touch off when getting off. I've recently found out that ...
6
votes
1answer
363 views

What is the current state of RFID / NFC security?

I'm attempting to do some RFID and NFC cloning and replaying research, as I'm hoping to be able to demo physical security as an attack vector to a few of out clients and prospects. The downside (...
-3
votes
2answers
325 views

NTAG216 lock bytes security [closed]

I want to ask about the "lock bytes" implemented on the NTAG216 by NXP. What exactly are these and how do they work? Are they a standard or is it some proprietary technology by NXP? Are there any ...
3
votes
0answers
2k views

What are the differences between the Proxmark3 and the Chameleon Mini? [closed]

I want to play with RFID/NFC cards and I need a tool to read, write and emulate tags. I know the Proxmark 3 (http://www.proxmark.org/), but I also heard about the new Chameleon Mini (https://www....
7
votes
1answer
1k views

RFID blocker with a card

There is a company out there that developed a product which looks like a simple card ( format of a credit card or so ) and claims to block rfid-signals in a distance of 10mm. It is not a case to ...
2
votes
0answers
125 views

What's the standard protocol for secure contactless communication

A contactless smartcard has to communicate with a reader in a secure way. The ICAO standard, for example, defines an encryption key (check BAC, EAC and PACE), so that the communication is not ...
19
votes
3answers
13k views

Do readers for the “Mifare DESFire EV1” smartcard really need to know the card's secret key in order to authenticate the card?

I'm trying to understand the security of a contactless smartcard system, used for access control and payment. The card is a Mifare DESFire EV1 implementing ISO 14443 (see the this documentation ...