Hot answers tagged

216

Because the cards contain a chip which are powered by a coil. The coil is not really a antenna, but half of a transformer. Think your regular mobile charger. This contains a transformer, that will transform the voltage from 230V or 120V AC to 5V DC. This is done by having a coil magnetize some iron, and this iron magnetizes the "receiving coil". If you draw ...


57

Many NFC enabled smartphones can write to these cards with an app like MifareClassicTool. However I've found several phones seem to be able to do it when in reality trying to write to Sector-0 bricks the card. It may be worth testing one or two cards and if it doesn't work buy a dedicated USB writer. First of all a huge number of Mifare Classic Systems only ...


51

NFC (Near Field Communications) cards are not passive. NFC readers constantly transmit RF (radio frequency) energy; this is called a carrier signal. Very close to the reader (within about one wavelength, putting the "Near" in Near Field Communications,) the RF transmission is strong enough to induce enough energy into the receiving antenna to power the ...


50

Any Faraday cage will do the trick. So a shielding of just about anything conductive, be it aluminum foil, conductive paint, wire mesh, or any of a number of similar alternatives is going to be opaque to radiation. That means no radio waves in or out, which means the RFID signal is blocked. Note that the size of the mesh has to be significantly smaller than ...


24

I have recently cloned a Mifare Classic tag. The scan you have there indicates there is no information stored on your tags, apart from in the first sector. This isn't readable by that app because it does not use the default key. I suggest you first try it with Mifare Classic Tool first, using the extended keys file. There are some common keys there but your ...


21

How can RFID/NFC tags not be cloned when they are passive technology? Your question assumes 2 things: That RFID tags cannot be cloned And they are passive, not active. Both points are incorrect: RFID tags can be cloned. Tags which do not make use of password-protection or over-the-air (OTA) encryption can have their data banks copied into new tags. ...


18

Next time you go to the shop leave your card in your wallet and try as much as you can to pay for your purchase. Try with several different card readers to be sure. If you can't pay, then it's pretty well protected. If you can, well... I can't speak for that particular wallet but it is certainly possible to block RFID in that manner. It just depends if they ...


16

If it is Mifare Classic, that should really not be hard. The general attack on Mifare's broken cryptosystem has been around since 2007. Have a look at this if you want: BlackHat Talk Slides This is indeed most likely easily possible. There are plenty of tutorials about this. Just remember: if your ID/whatever is not stored in the data section but only in ...


13

Is RFID a superset of NFC? (or vice versa?) To quote from the the Wikipedia article "NFC standards cover communications protocols and data exchange formats, and are based on existing radio-frequency identification (RFID) standards..." So RFID is just a name for devices that use radio frequencies to communicate and NFC is one of these. Is all RFID / NFC ...


11

If it is a basic data providing tag, then it can be cloned. If it is a secure tag, it is far more difficult. For secure cards used for payments and authentication, a private key is loaded on to the card and the card never discloses it. The public key is kept by the bank or whoever needs to be able to verify that the card was used. If, for example, the ...


11

To be precise, an aluminum foil can do the trick. I hope your RFID Blocking wallet is actually blocking them. I am afraid that it is hard to test the practical way as it is happening unless you are a an IT expert in that field Or a RFID hacker ;) However there are good products available that promises against RFID theft. sample : http://www.idstronghold....


10

The principle has been used before, your wallet will act as a Faraday cage. This means that the inside of your wallet cannot be affected by electronic fields. This prevents the RFID from being read out. However normally a Faraday cage is closed, so as long as your wallet is closed with the card inside and the metal completely covering your card, you should ...


9

Short answer: No. Long answer: Nooooooo. Longer answer: RFIDs typical work via magnetic coupling to both power and to transmit data. By modulating the load on the secondary coil of the magnetic couple (aka transformer), the RFID card is able to effect a back EMF on the primary coil. RFID-proof wallets disrupt this by creating a Faraday cage (i.e. opaque ...


8

NFC devices which do not use either public key crypto, encrypted tokens or HMAC tokens or similar cryptographic mechanisms where there is a secret that never leaves the device, they can all be impersonated. Simple devices often just have a static string of data which they broadcast. Many newer NFC devices as well as most enterprise grade devices since ...


8

What can happen, and actually had happen, is that some card holder were badly designed and included a simple magnet for locking. This will do nothing to the RFID part of the chip, but it can damage the magnetic strip that is used in some terminal (The ones where you slide the card and don't have to enter your pin code). Note that this is not limited to "...


7

You would need to extract the key of the card, which is what these cards generally protect against. Authentication protocols in general depend on a challenge response. In case of Mifare EV1 this is done with AES or 3DES. Basically the nonce (incase of DESfire 2 nonces) are encrypted: Reader sends b1,b2 Card replies 3DES(b1) Card replies 3DES(b2) Reader ...


6

Conceptual view: there is authentication, and there is authorization; these are distinct activities. Authentication is about making sure of who you are talking to; authorization is about deciding what some individual is allowed to do. You actually want to keep them separate. RFID tags implement authentication: through the electronic conversation between the ...


6

I guess I am a bit late to the party on this question, however I'll add some quick information on wallets containing faraday cages. I have one myself, and they do in fact work very well. I have tested it pretty thoroughly, and not once has signals been able to leave the wallet, with the exception of when I have it open, then it works as intended. Here is ...


6

Are you wondering if such technology exist, or are you wondering if the speech of a company you know but for some reason do not mention is realistic from a technical point of view? No matter what, such company exist, an example would be Amourcard. I do not know if there are other, they claim to be the first to offer such service. This company targets more ...


6

The most-authoritative reference on EMV replay (i.e., transaction cloning) is Peter Fillmore's latest talk from Syscan 2015 https://github.com/peterfillmore/Talk-Stuff/blob/master/Syscan2015/PeterFillmore_Syscan2015.pdf Another great resource is Ricardo Rodriguez's talk from Rooted 2015 http://www.slideshare.net/cgvwzq/on-relaying-nfc-payment-transactions-...


6

I'll try to make it rather short and try to answer every question. How is this possible without power? There is power like usual. It works by the same electromagnetical principle as a transformer (which is contactless as well). Or like one of those modern(ish) contactless smartphone chargers where you just lay your phone on a plate instead of plugging it ...


5

It's possible that a jammer would work, but there are a couple of things to be concerned about. First, jammers that emit RF above a certain power output are illegal across the US and in most of the world. Next, there are many types of RFID technology in use, and they are all different. You would need to determine which kind of technology you are ...


5

TL;DR: Physical locks are simpler and therefore less prone to failure. Proximity cards (e.g. RFID) are superior in every other way. Picking a lock is a side-channel attack that grants access to an individual who does not need to have ever encountered a valid access token (in this case, a key). It's quick, highly effective, and leaves no audit logs (other ...


5

In favor of the mechanical locks is that they are cheap and simple (and so less likely to break down). (Even if you do deploy a fancy RFID system I bet you have a mechanical lock put in as well, because it costs next to nothing and gives you a fall-back in case the Access Control fails.) However, in most high security environment you are likely to want ...


5

The thought is probably that since it is inside you it can't be stolen, so obviously it would be more secure than a form of ID that could be stolen. I think it's pointless, and actually potentially hazardous to the user: It would only last a few hours. It's powered by stomach acid, once it's out of the stomach it would stop working. What are going to do, ...


5

ScanBlocker seems like overkill, and depending on how the transmitter works it may even be illegal in some places. RF blocking wallets are much cheaper, much smaller, and have fewer parts to go wrong. My paper passport has an RF blocking cover; it needs to be opened a bit in order to be read. My plastic passport card came in an RF-blocking Tyvek sleeve. ...


5

I've actually tried a similar thing at my old school, and after months of research, this is what I found: Write to sector 0 and hope for the best, maybe it's just the ID that's important. MFCUK, never got around to trying it myself, but if I recall correctly, it will use the security flaw of the classic and figure out the key. Brute force, the Mifare ...


4

To answer the question of copying/emulation yes it is possible but there are multiple standards for NFC transactions. There was research at blackhat that was presented that demonstrated credit card emulation but it required two devices, and one device had to be running a specific version of CyanogenMod that introduced the changes which allowed for skimming ...


4

At least 217 feet. Please keep in mind this is an Ultra High Frequency UHF Gen 2 RFID tag meant for use in item sales, tracking, and inventory. This is not the same RF technology in use by access cards. Those are generally Low Frequency (LF) and have a much longer wavelength, which results in a shorter demonstrated distance of 12-19 inches, although that ...


4

Primitive RFID keys can generally be copied easily. (CloneMyKey.com says it can clone 90% of RFID tags.) In most cases it's just a chip that emits an ID, which can't be changed. But sometimes it can be reprogrammed - and sometimes you can order tags programmed with specific requested IDs. (See YouTube videos for RFID Cloning.) The card itself doesn't have ...


Only top voted, non community-wiki answers of a minimum length are eligible