Questions tagged [nfc]

NFC (Near-Field Communication) is a short-range wireless technology, typically requiring a distance of 4cm or less to initiate a connection between two endpoints.

Filter by
Sorted by
Tagged with
0 votes
0 answers
119 views

Changing access conditions on a "magic" mifare classic 1k card

Is there a "magic" mifare classic card that enables you to change access conditions even if current access conditions are set to never change access conditions? (write ACS: never)
Atom's user avatar
  • 1
1 vote
1 answer
117 views

Are Bluetooth and/or NFC anonymous?

Suppose I have a smartphone and I have disabled all usual de-anonymizing things (e.g., wifi probe requests). My phone sends some data over Bluetooth (or NFC) to device A, and then at a different place ...
Sam Jaques's user avatar
0 votes
0 answers
1k views

Is using the CSN of a mifare desfire EV2 safe?

From what I know, Mifare Classic cards are easy to copy/clone using a device such as a flipperzero, and it has to do with authentication using the CSN (card serial number) However, let's say that a ...
Ismail's user avatar
  • 1
0 votes
0 answers
125 views

What kind of security protocols do current NFC or RFID based technologies use?

I have an information security class this semester, and I need to write a paper evaluating how secure NFC and RFID technology is. A lot of questions previously asked here are at least 3 years old, and ...
Eric M's user avatar
  • 1
0 votes
1 answer
286 views

If the terminal is malicious, is paying with NFC still safe?

Paying with credit card's NFC. I know about tokenization and all that, but does that actually protect my card against theft when the terminal is malicious?
iudhfgihdfigh's user avatar
0 votes
0 answers
115 views

Options for Integrating or developing a physical security solution (physical access control via in-house mobile apps [NFC/Bluetooh])

Our team is looking to either integrate or develop a physical security solution for a rather large campus. Requirements: Ability to either integrate (with reader/electronic lock hardware) from our ...
spencer741's user avatar
2 votes
0 answers
413 views

What are the security risks to NFC based YubiKeys?

What are the risks of using NFC on a YubiKey versus just a hard connector? I imagine it would be possible to sniff some data off of these security keys? How real is the risk of sniffing and what could ...
Adam Thompson's user avatar
3 votes
1 answer
937 views

Is it possible to emulate a full (mifare 1k) card with the ChameleonMini (Rev.G 2)?

I am testing a lock box I own, it uses a Mifare 1k lock with default key, and I use a keyfob to unlock it. I have both a Proxmark3 and a ChameleonMini. With the Proxmark3 I am able to both clone the ...
Dani's user avatar
  • 224
1 vote
0 answers
146 views

Any NFC readers (Android or iOS) able to access the ePassport raw (still encrypted) data e.g. without the Basic Access Control (BAC)?

Firstly, I assume it's possible to passively read the encrypted data from a ePassport NFC chip? All of the NFC scanning apps fail to load anything without the BAC. We are not interested in the ...
SuperJ's user avatar
  • 11
2 votes
1 answer
152 views

How is the timer implemented in mutual distance-bounding protocols?

I've come across several papers introducing the concept of mutual distance-bounding, where basically both sides can verify an upper bound of the distance in between, rather than having this unilateral ...
OrangeJusticeV's user avatar
1 vote
1 answer
1k views

Are there any contactless (RFID/NFC) card vulnerabilities that are still unsolved? even minor ones

The title is pretty self explanatory. The market is pretty secretive about these kinds of matter since companies won't give out vulnerabilities for attackers to abuse and will give out vulnerabilities ...
warpeace's user avatar
4 votes
1 answer
2k views

Guessing PIN code of smartcard using brute force and offline reader

I came across this question Offline brute-forcing of a bank card PIN, which was asked 7 years ago. I'm currently exploring vulnerabilities in EMV protocol, and I wanted to double check if an idea I ...
OrangeJusticeV's user avatar
2 votes
1 answer
368 views

RFID // Understanding security of Standard-UID

We are evaluating how to improve security on our RFID System. Our system was reviewed by someone finding the point that there are duplicate Tags we must get rid of. So the first idea was to read the ...
BesenWesen's user avatar
7 votes
1 answer
2k views

Hardening NFC tags for authentication

So I have a small electronics project where I am using common Mifare Classic 1K NFC tags as a means of authentication. (Mifare DesiFire is just too expensive) I know these aren't very secure so here ...
Inhinias's user avatar
0 votes
0 answers
394 views

Detect card type (RFID, NFC, Magnetic, ...) [duplicate]

I would like to know how the communication between my gym card and the checking point works. I bought an ACR122U reader, but it seems that I can't read my card with it, the card is not recognized as ...
ScTALE's user avatar
  • 103
0 votes
0 answers
509 views

Change NFC SAK Hard Coded to 08h

I am trying to copy some NFC card; however the SAK returned is always 08h using the command nfc-list. However looking through the actual content of the card, I can see that the byte associated to the ...
Ra'Jiska's user avatar
  • 229
2 votes
0 answers
337 views

Preventing DoS Attacks on NFC

There are some attack scenarios on NFC. These include e.g. Data modification, data insertion, relay attacks and DoS attacks. Just to name a few. While some of these attack scenarios are more likely ...
P_Gate's user avatar
  • 121
6 votes
1 answer
448 views

Is FeliCa DES encryption safe?

Sony FeliCa does not provide any official docs on which cryptographic functions are used for their NFC cards. They got some docs explaining that they do mutual authentication, but there is no official ...
Me7e0r's user avatar
  • 83
1 vote
1 answer
1k views

Is there a secure way to disable NFC and RFID on credit cards and personal IDs?

If you're wondering why would I want that - it's for my own security: against identity and data theft.
Sir Muffington's user avatar
3 votes
1 answer
1k views

Why don't online banks use WebAuthn? [closed]

My ideal bank would offer online banking from a browser with user/pwd and WebAuthn, for example with a NFC or USB key. No OTP or SMS or apps on the smartphone or physical devices required. (It goes ...
jj_p's user avatar
  • 379
0 votes
1 answer
4k views

Identifying and cloning NFC Card double size UID - type mifare plus 7 byte 2k or classic 7 byte 1k

I am trying to clone/write copies of an NFC card. I am using an ACR122U-A9 receiver and running nfc-tools on a kali linux VM. The card I am trying to clone is identified as a Mifare Classic 1k tag ...
Gustav Hartz's user avatar
1 vote
0 answers
187 views

Is there any NFC message injection?

Are there any NDEF message smuggling attacks (like http smuggling attack)? When I say it, I mean that I have a full control on the NFC packet. Is it possible to inject another packet into a NFC ...
adi's user avatar
  • 111
0 votes
1 answer
225 views

PCI-DSS scope: Using P2PE Compliant devices

We use EMV card readers to automate the payments at the entry and exit to our services. These card readers and the unattended payment terminals are fully PTS complaint and use P2PE encryption. Also, ...
Kane's user avatar
  • 61
3 votes
0 answers
767 views

What is the most secure NFC Encryption system? [closed]

What are the best ways for NFC (Near-field communication) encryption with high level of security? Basically, I am interested in having an NFC which can only be read/authenticated with a mobile app/...
Hadi's user avatar
  • 31
1 vote
0 answers
105 views

Security of RFID/NFC card Payment [closed]

You are standing in front of a building with 3 rooms and have a NXP Mifare Classic 1k card. In the first room is a device (device1) that can do the following things: Shows how much money is on the ...
Paski7's user avatar
  • 111
2 votes
1 answer
333 views

Burp not intercepting the intended traffic

I'm trying to test an authentication process using NFC reader as a medium. The scenario is like this, I need to go to a certain website but in order to get there, I need to verify myself using my ID ...
rockStar's user avatar
  • 143
2 votes
1 answer
2k views

NFC Android (Ntag213 vs Ultralight C)

I have an (university) project where I basically write and read text out of NFC Tags with Android devices in order to store one's balance in the card (wich can be used on the cafeteria, for example). ...
pedrofialho's user avatar
0 votes
1 answer
1k views

Do 2 Chip based cards effect each other's data if they are in the same wallet all the time?

So I got 2 new ATM cards from two different banks, both cards are Chip and NFC enabled. Card A arrived one week earlier than Card B. Both of them remain in my wallet in close proximity to each other, ...
Hanky Panky's user avatar
1 vote
1 answer
7k views

Is there a way to clone Mifare DESfire EV1 key sent by a NFC reader?

If I understood well its functioning, the card send an ID (NFC tag) if it has received a correct encryption key. Probably by the reader? So it must be possible to attack the reader instead of the ...
Maxim's user avatar
  • 15
5 votes
1 answer
817 views

Is transaction history stored on credit card a security risk?

I installed an NFC reader on my android and scanned each of my bank cards to see what they would reveal through their contactless feature (NFC). Unsurprisingly they reveal the card number and the ...
iainpb's user avatar
  • 4,172
92 votes
4 answers
74k views

Can a student ID containing an NFC chip be cloned?

The head of our IT department and Networking class in my college has given me and another student a challenge; he told us that if we could clone the NFC tags in our student ID's used to sign in on ...
myopicflight's user avatar
4 votes
0 answers
318 views

Location fixing through NFC Tag

I'm new to NFC technologies and I want to develop a smartphone app that reads a NFC tag and sends the location securely to web service. This NFC tag is in a special place and we MUST be sure that the ...
Mohamed Hamzaoui's user avatar
0 votes
2 answers
1k views

What should I know to prevent relay attack on NFC?

I am doing thesis on "NFC relay attack" in my BSc last year. I have studied 10-15 papers and learned the basics of NFC and relay attack. Still I am no where near to understand how relay attack is ...
user avatar
1 vote
1 answer
307 views

How secure is a mobile e-banking authentication app that requires an NFC card plus a pin to authenticate the user?

Many banks these days offer online banking (in a web browser). To increase security, most banks require a standard login with a username (account number) and password, plus a code that is sent to your ...
Mark Anderson's user avatar
2 votes
0 answers
142 views

Security implications of owning a German electronic ID card

I am German and about to renew my ID card. Since around 2010, the new ID cards contain an electronic chip that can be used for e.g. online authentication. If I understood the documentation correctly,...
Byte Commander's user avatar
1 vote
0 answers
1k views

NFC Forum Type 4 Tag and NXP MIFARE DESFire EV2?

I have some comprehension problems regarding the NFC Forum Type 4 Tag capabilities of NXP MIFARE DESFire EV2. I found the NXP Application Note AN1104 regarding NFC Forum Type 4 Tag and NXP MIFARE ...
burnersk's user avatar
  • 111
2 votes
0 answers
431 views

How is a NFC session key created?

I was reading MIFARE DESFire EV1 document and noticed this: MIFARE DESFire EV1 and the reader device show in an encrypted way that they possess the same secret which especially means the same key;...
Tankman六四's user avatar
0 votes
3 answers
10k views

Is it possible to disable NFC on credit card?

I have credit card with wireless payment. For low prices it does not require to enter pin code. An attacker with 100$ device can take these money whithout my knowledge. Of course, I can configure ...
changer's user avatar
  • 31
1 vote
2 answers
3k views

Are NFC tags with cryptographic features "write-only"?

I was wondering how exactly cryptographic NFC tags/cards retain their security. I read that there are certain types of cards that are able to perform symmetric or asymmetric cryptography. These cards ...
paolo's user avatar
  • 113
2 votes
0 answers
210 views

Prevent NFC token from being easily copied?

From my knowledge on NFC, which isn't a lot, it seems like it would be very easy to copy an NFC token. What methods can be used to prevent people from making unauthorised copies of the NFC tokens? ...
Terry's user avatar
  • 1,115
0 votes
1 answer
185 views

Why are card associations launching RFID enabled payment cards despite of their being unsecure?

You can use applications to get data from these cards. I got tracks data of my cards as well as card number and expiry from my debit card just by single tap of phone. A criminal can use that data and ...
user avatar
10 votes
2 answers
44k views

Mifare DESfire EV1 cloning?

How can I clone an encrypted Mifare DESfire EV1 Card? Tried a 13.56Mhz Reader/writer from eBay but didn't work properly... I need to find any possible way of doing this.
user146719's user avatar
2 votes
2 answers
268 views

Protecting QR Code, Eddystone and NFC against spoofing

Let's say I have the following scenario. I have QR Code, Eddystone and/or NFC which contains IP address, with which, my client side application communicates. Let's say this IP address can vary from ...
Dávid Kaya's user avatar
3 votes
1 answer
769 views

NFC and ISO 14443 : security?

I'm trying to understand if the ISO 14443 guarantees any degree of security for an NFC transaction. I can't access the documentation because it is not free, but I see devices (like MIFARE DESFire or ...
Arabella Brayer's user avatar
0 votes
1 answer
2k views

Where can I use BLE/NFC U2F device?

Can BLE U2F security keys be used on Chrome for macOS/Windows for any site supporting U2F USB keys as a second factor? What sites/apps can I use NFC/BLE U2F keys for on NFC-(and BLE-)supporting ...
yurkennis's user avatar
  • 151
2 votes
1 answer
12k views

Is there a reason why Android blocks emulating a RFID tag?

So, I have this public transportation card, as well as a card that grants access to my school and lastly one that grants access to my work's office building. My android device doesn't allow me to ...
Florian Humblot's user avatar
4 votes
1 answer
2k views

How secure is Google’s/Android’s Smart Lock functionality?

Newer Android phones (since Android 5, “Lollipop”) have the Smart Lock functionality that allows one to unlock the phone, among other ways, with a trusted device (Bluetooth or NFC) instead of entering ...
Socob's user avatar
  • 225
2 votes
1 answer
2k views

Mifare Desfire symmetric authentication with master key on android

I wanted to use the Mifare Desfire chip for product authentication purposes, where the chip would be embedded into products. As such, I am looking for a NFC solution that makes it virtually impossible(...
LongJeongS's user avatar
3 votes
2 answers
625 views

How are payment cards secured?

Since the era of contactless payments, it's easy to make payment via card without entering PIN code, but how is the card actually secured? There is limit of 20€ of course, but even committing 20€ ...
user avatar
3 votes
3 answers
2k views

mifare classic 1k for micropayments

Can Mifare Classic 1k be used for micro payments in a secure way? I have a system in mind for use in a arcade game saloon. You are getting a card from cashier and can top it up for example with 100 ...
user avatar