225
votes
Accepted
How can RFID/NFC tags not be cloned when they are passive technology?
Because the cards contain a chip which are powered by a coil.
The coil is not really a antenna, but half of a transformer.
Think your regular mobile charger. This contains a transformer, that will ...
- 8,914
58
votes
Can a student ID containing an NFC chip be cloned?
Many NFC enabled smartphones can write to these cards with an app like MifareClassicTool. However I've found several phones seem to be able to do it when in reality trying to write to Sector-0 bricks ...
- 10.9k
52
votes
How can RFID/NFC tags not be cloned when they are passive technology?
NFC (Near Field Communications) cards are not passive. NFC readers constantly transmit RF (radio frequency) energy; this is called a carrier signal. Very close to the reader (within about one ...
- 34.1k
24
votes
Can a student ID containing an NFC chip be cloned?
I have recently cloned a Mifare Classic tag. The scan you have there indicates there is no information stored on your tags, apart from in the first sector. This isn't readable by that app because it ...
- 341
22
votes
How can RFID/NFC tags not be cloned when they are passive technology?
How can RFID/NFC tags not be cloned when they are passive technology?
Your question assumes 2 things:
That RFID tags cannot be cloned
And they are passive, not active.
Both points are incorrect:...
- 1,736
16
votes
Can a student ID containing an NFC chip be cloned?
If it is Mifare Classic, that should really not be hard.
The general attack on Mifare's broken cryptosystem has been around since 2007. Have a look at this if you want: BlackHat Talk Slides
This is ...
- 2,054
11
votes
Accepted
Hardening NFC tags for authentication
First and foremost: if you want security, don't use MIFARE cards. They aren't the best at security. Even if a card isn't vulnerable to something like a hardnested attack or a brute-force attack, the ...
- 382
10
votes
Accepted
Is it possible to clone my contactless debit card while it's in my pocket?
If your debit card has an NFC chip on it (the "tap to pay"), it's possible. This presentation discusses two methods. One is skimming an NFC card and using the recovered data for making Card Not ...
- 34.1k
10
votes
Accepted
How safe is my contactless bank card?
Can an attacker get information off the card?
Yes, at least some can, and the UK consumer group Which? mentioned in the question did it:
Our researchers tested 10 cards (six debit and four credit, ...
- 65.4k
9
votes
Mifare DESfire EV1 cloning?
You would need to extract the key of the card, which is what these cards generally protect against. Authentication protocols in general depend on a challenge response. In case of Mifare EV1 this is ...
- 54.4k
7
votes
Accepted
Contactless credit cards security
No, contactless transactions are not more secure than contact transactions. The whole contactless business has a lot more to do with making payments easier on the point of sale (and possibly enable ...
- 513
6
votes
How can RFID/NFC tags not be cloned when they are passive technology?
I'll try to make it rather short and try to answer every question.
How is this possible without power?
There is power like usual. It works by the same electromagnetical principle as a transformer (...
- 2,389
6
votes
Do readers for the "Mifare DESFire EV1" smartcard really need to know the card's secret key in order to authenticate the card?
Edited:
OK. As there is request for "short answer" here is "executive summary" here it is:
Question: “So all the reading devices must know the secret key, too. But there can be many readers from many ...
- 61
6
votes
Accepted
RFID blocker with a card
Are you wondering if such technology exist, or are you wondering if the speech of a company you know but for some reason do not mention is realistic from a technical point of view?
No matter what, ...
- 19.2k
5
votes
Is the newly adopted NFC technology going to be safe?
NFC is just another medium like wires, wifi, microwave, light-comms, etc. It will be incumbent on the security professionals to create and guide their safe use whether it is for payments, data sharing ...
- 1,844
5
votes
Can a student ID containing an NFC chip be cloned?
I've actually tried a similar thing at my old school, and after months of research, this is what I found:
Write to sector 0 and hope for the best, maybe it's just the ID that's important.
MFCUK, ...
- 151
5
votes
Why don't online banks use WebAuthn?
Username and password alone or together with WebAuthn1 only offer an authentication of the user.
Modern authentication methods used by the banks like PhotoTAN instead authenticate each transaction ...
- 198k
4
votes
Accepted
Do readers for the "Mifare DESFire EV1" smartcard really need to know the card's secret key in order to authenticate the card?
MIFARE DESFire EV1 can have multiple applications (28), and each application can have multiple files (32) of different types (4). The card itself has a PICC master key plus between 1 and 14 keys per ...
- 667
4
votes
Do readers for the "Mifare DESFire EV1" smartcard really need to know the card's secret key in order to authenticate the card?
Most of the systems I know indeed use a network connection to authenticate the cards via challenge-response.
I have seen some offline devices that only compare the UID of the card with stored values. ...
- 2,339
4
votes
Accepted
Approach to hack RFID Cards
To identify a card, you power it using a carrier wave on its frequency and wait for answers. If there is no answer, you switch to a different frequency and protocol and so on until you get ...
- 12.8k
4
votes
Accepted
Guessing PIN code of smartcard using brute force and offline reader
EMV has PIN Try Counter. Failed offline PIN attempt decrements the counter and remains persistent across sessions. So even if you cancel the transaction after 2 failed attempts, it won't reset the ...
- 6,761
3
votes
What is the difference between secure element and smart card?
According to globalplatform.org, there are three SE technologies:
Universal Integrated Circuit Card (UICC)
embedded SE
microSD.
From the same website, a secure element is a physical object, not ...
- 101
3
votes
Best practices for loyalty cards (barcode & NFC)
NFC cards can authenticate the reader. Mifare Plus (and Classic as well, but they're broken) can implement ACLs on sectors so that a key must be presented in order to read/write a sector. You can have ...
- 12.8k
3
votes
Accepted
Is the newly adopted NFC technology going to be safe?
NFC is a standard for a packet transmission.
The packet can have a payload.
The payload can be harmful, but would require a program listening for that payload to do harm.
So no, this can't happen ...
- 7,006
3
votes
mifare classic 1k for micropayments
Mifare classic can be completely cloned. You can buy cards with changeable UID as well - I just ordered a bunch. The blocks of the card which require non-default keys can be cracked on a PC using ...
- 873
3
votes
How are payment cards secured?
There are different types of authentications for cards. Years ago the old mag stripe cards (still in use in the USA) had only "Static Data Authentication" (SDA), which was a fixed, unchanging number ...
- 34.1k
3
votes
Accepted
Mifare Desfire symmetric authentication with master key on android
The key does not need to reside on the app.
When you ask for authentication, you will get a random number, encrypted with the key, back.
This random number, you can send back to the server with the ...
- 8,914
3
votes
Mifare DESfire EV1 cloning?
I'm doing a security feasibility study at the moment.
Short answer: No, you can not (at this point)
MIFARE Classic has been hacked some years ago, so NXP upgraded their security.
At the moment there ...
3
votes
Is it possible to disable NFC on credit card?
To answer the question briefly, and if we're only talking about wireless payment, yes it is possible. You can ask your bank for a non-NFC card, or simply to not allow NFC payments, which would be the ...
3
votes
Burp not intercepting the intended traffic
I'm assuming you're NFC reader is a peripheral device?
Burp can be set up as a MITM but you'll need to direct any traffic from that peripheral to be aware of the Burp HTTP proxy if you want to ...
- 746
Only top scored, non community-wiki answers of a minimum length are eligible