RFID attacks and proxmark hands-on @ KirilsSolovjovs +4fd9 About - PowerPoint PPT Presentation

RFID attacks and proxmark hands-on @ KirilsSolovjovs +4fd9

About me ● Programming → sysad → networking ● IT security for the past 10+ y ● Owner and Lead Researcher at Possible Security ● Hacking and breaking things http://kirils.org/ – http://possiblesecurity.com/news/ – +4fd9

Contents ● RFID basics ● RFID standarts ● Hacking tools ● Proxmark + Lots of demos +4fd9

Let’s get this out of the way: RFID vs NFC? ● NFC is a subset of RFID – 13.56MHz – ISO/IEC 14443 – NFC device can be both a reader and a tag +4fd9

RFID tag ● Microchip ● Antenna ● No power source +4fd9

RFID ● Radio Frequency Identification +4fd9

Typical RFID frequencies ● HF ● LF ● 13.56 MHz ● 125 kHz ● ... ● 134.2 kHz ● ... +4fd9

RFID standards ● em4xxx ● ISO/IEC 14443A ● HID Global – Mifare iClass ● ISO/IEC 14443B – Hitag2 – ● ISO/IEC 15693 Indala – ● TI +4fd9

Tools ● RFID readers ● RFID duplication “gun” ● Frequency scanner ● BLEkey ● hackRF… ? ● Proxmark III ! +4fd9

Proxmark III +4fd9

Proxmark III RDV 2 / 4 +4fd9

Wiegand interface Problematic for UID-based protocols ● BLEKey ● – Bluetooth connected UID sniffer / storage +4fd9

Card cloning Duplicating contents of one card into another ● Often involves breaking some cryptography or defeating some other protection ● +4fd9

Mifare Ultralight +4fd9

Mifare Classic +4fd9

+4fd9

Proxmark III setup ● https://github.com/Proxmark/proxmark3/wiki/Kali-Linux +4fd9

Proxmark III magic ● reading cards... ● attacks… + mfkey – +4fd9

Proxmark III snooping +4fd9