Hot answers tagged

212

Because the cards contain a chip which are powered by a coil. The coil is not really a antenna, but half of a transformer. Think your regular mobile charger. This contains a transformer, that will transform the voltage from 230V or 120V AC to 5V DC. This is done by having a coil magnetize some iron, and this iron magnetizes the "receiving coil". If you draw ...


57

Many NFC enabled smartphones can write to these cards with an app like MifareClassicTool. However I've found several phones seem to be able to do it when in reality trying to write to Sector-0 bricks the card. It may be worth testing one or two cards and if it doesn't work buy a dedicated USB writer. First of all a huge number of Mifare Classic Systems only ...


50

Any Faraday cage will do the trick. So a shielding of just about anything conductive, be it aluminum foil, conductive paint, wire mesh, or any of a number of similar alternatives is going to be opaque to radiation. That means no radio waves in or out, which means the RFID signal is blocked. Note that the size of the mesh has to be significantly smaller than ...


50

NFC (Near Field Communications) cards are not passive. NFC readers constantly transmit RF (radio frequency) energy; this is called a carrier signal. Very close to the reader (within about one wavelength, putting the "Near" in Near Field Communications,) the RF transmission is strong enough to induce enough energy into the receiving antenna to power the ...


24

I have recently cloned a Mifare Classic tag. The scan you have there indicates there is no information stored on your tags, apart from in the first sector. This isn't readable by that app because it does not use the default key. I suggest you first try it with Mifare Classic Tool first, using the extended keys file. There are some common keys there but your ...


20

How can RFID/NFC tags not be cloned when they are passive technology? Your question assumes 2 things: That RFID tags cannot be cloned And they are passive, not active. Both points are incorrect: RFID tags can be cloned. Tags which do not make use of password-protection or over-the-air (OTA) encryption can have their data banks copied into new tags. ...


19

The SIM card must be plugged into a device for it to be functional in any way. It does not contain a power supply or an antenna. As such, it'd be impossible to track a SIM card on its own. However, once you plug it into a phone and power it on, the IMEI number of the phone and the SIM's serial number will be transmitted to the nearest cell tower(s).


18

Next time you go to the shop leave your card in your wallet and try as much as you can to pay for your purchase. Try with several different card readers to be sure. If you can't pay, then it's pretty well protected. If you can, well... I can't speak for that particular wallet but it is certainly possible to block RFID in that manner. It just depends if they ...


16

If it is Mifare Classic, that should really not be hard. The general attack on Mifare's broken cryptosystem has been around since 2007. Have a look at this if you want: BlackHat Talk Slides This is indeed most likely easily possible. There are plenty of tutorials about this. Just remember: if your ID/whatever is not stored in the data section but only in ...


13

Is RFID a superset of NFC? (or vice versa?) To quote from the the Wikipedia article "NFC standards cover communications protocols and data exchange formats, and are based on existing radio-frequency identification (RFID) standards..." So RFID is just a name for devices that use radio frequencies to communicate and NFC is one of these. Is all RFID / NFC ...


11

To be precise, an aluminum foil can do the trick. I hope your RFID Blocking wallet is actually blocking them. I am afraid that it is hard to test the practical way as it is happening unless you are a an IT expert in that field Or a RFID hacker ;) However there are good products available that promises against RFID theft. sample : http://www.idstronghold....


11

The secret of credit card transaction security is that by law (in many jurisdictions) the card issuer is responsible for fraudulent transactions after a certain limit, not the card holder. Since they already assume the bulk of the liability, most (all?) simply make the jump to say that the card holder is not responsible under any circumstances for fraud. ...


11

If it is a basic data providing tag, then it can be cloned. If it is a secure tag, it is far more difficult. For secure cards used for payments and authentication, a private key is loaded on to the card and the card never discloses it. The public key is kept by the bank or whoever needs to be able to verify that the card was used. If, for example, the ...


10

The principle has been used before, your wallet will act as a Faraday cage. This means that the inside of your wallet cannot be affected by electronic fields. This prevents the RFID from being read out. However normally a Faraday cage is closed, so as long as your wallet is closed with the card inside and the metal completely covering your card, you should ...


10

Visa and other credit card manufacturers use the EMV standard to authenticate credit/debit card transactions. The Wiki article explains it better than I can, but this is a highly technical topic - it will take time to read and understand. You should also see the answers to similar questions about NFC/RFID/EMV. Essentially though, the demonstrated cloning ...


9

Short answer: No. Long answer: Nooooooo. Longer answer: RFIDs typical work via magnetic coupling to both power and to transmit data. By modulating the load on the secondary coil of the magnetic couple (aka transformer), the RFID card is able to effect a back EMF on the primary coil. RFID-proof wallets disrupt this by creating a Faraday cage (i.e. opaque ...


8

NFC devices which do not use either public key crypto, encrypted tokens or HMAC tokens or similar cryptographic mechanisms where there is a secret that never leaves the device, they can all be impersonated. Simple devices often just have a static string of data which they broadcast. Many newer NFC devices as well as most enterprise grade devices since ...


8

What can happen, and actually had happen, is that some card holder were badly designed and included a simple magnet for locking. This will do nothing to the RFID part of the chip, but it can damage the magnetic strip that is used in some terminal (The ones where you slide the card and don't have to enter your pin code). Note that this is not limited to "...


7

You can check this paper : http://media.blackhat.com/bh-us-12/Briefings/C_Miller/BH_US_12_Miller_NFC_attack_surface_WP.pdf It's from a talk given by Charlie Miller at BlackHat 2012 : Near Field Communication (NFC) has been used in mobile devices in some countries for a while and is now emerging on devices in use in the United States. This technology ...


6

I guess I am a bit late to the party on this question, however I'll add some quick information on wallets containing faraday cages. I have one myself, and they do in fact work very well. I have tested it pretty thoroughly, and not once has signals been able to leave the wallet, with the exception of when I have it open, then it works as intended. Here is ...


6

Conceptual view: there is authentication, and there is authorization; these are distinct activities. Authentication is about making sure of who you are talking to; authorization is about deciding what some individual is allowed to do. You actually want to keep them separate. RFID tags implement authentication: through the electronic conversation between the ...


6

Are you wondering if such technology exist, or are you wondering if the speech of a company you know but for some reason do not mention is realistic from a technical point of view? No matter what, such company exist, an example would be Amourcard. I do not know if there are other, they claim to be the first to offer such service. This company targets more ...


6

The most-authoritative reference on EMV replay (i.e., transaction cloning) is Peter Fillmore's latest talk from Syscan 2015 https://github.com/peterfillmore/Talk-Stuff/blob/master/Syscan2015/PeterFillmore_Syscan2015.pdf Another great resource is Ricardo Rodriguez's talk from Rooted 2015 http://www.slideshare.net/cgvwzq/on-relaying-nfc-payment-transactions-...


6

I'll try to make it rather short and try to answer every question. How is this possible without power? There is power like usual. It works by the same electromagnetical principle as a transformer (which is contactless as well). Or like one of those modern(ish) contactless smartphone chargers where you just lay your phone on a plate instead of plugging it ...


5

TL;DR: Physical locks are simpler and therefore less prone to failure. Proximity cards (e.g. RFID) are superior in every other way. Picking a lock is a side-channel attack that grants access to an individual who does not need to have ever encountered a valid access token (in this case, a key). It's quick, highly effective, and leaves no audit logs (other ...


5

In favor of the mechanical locks is that they are cheap and simple (and so less likely to break down). (Even if you do deploy a fancy RFID system I bet you have a mechanical lock put in as well, because it costs next to nothing and gives you a fall-back in case the Access Control fails.) However, in most high security environment you are likely to want ...


5

The thought is probably that since it is inside you it can't be stolen, so obviously it would be more secure than a form of ID that could be stolen. I think it's pointless, and actually potentially hazardous to the user: It would only last a few hours. It's powered by stomach acid, once it's out of the stomach it would stop working. What are going to do, ...


5

It's possible that a jammer would work, but there are a couple of things to be concerned about. First, jammers that emit RF above a certain power output are illegal across the US and in most of the world. Next, there are many types of RFID technology in use, and they are all different. You would need to determine which kind of technology you are ...


5

ScanBlocker seems like overkill, and depending on how the transmitter works it may even be illegal in some places. RF blocking wallets are much cheaper, much smaller, and have fewer parts to go wrong. My paper passport has an RF blocking cover; it needs to be opened a bit in order to be read. My plastic passport card came in an RF-blocking Tyvek sleeve. ...


5

You would need to extract the key of the card, which is what these cards generally protect against. Authentication protocols in general depend on a challenge response. In case of Mifare EV1 this is done with AES or 3DES. Basically the nonce (incase of DESfire 2 nonces) are encrypted: Reader sends b1,b2 Card replies 3DES(b1) Card replies 3DES(b2) Reader ...


Only top voted, non community-wiki answers of a minimum length are eligible