[PPT] - Smartcard protocol sniffing Introduction to the theoretical and PowerPoint Presentation

SLIDE 1

Introduction Logging the communication Re-engineering the protocol Creating a simulacrum

Smartcard protocol sniffing

Introduction to the theoretical and practical issues involved in cloning/simulating existing smartcards Bernd Fix, Marc-André Beck

Bernd Fix, Marc-André Beck Smartcard protocol sniffing

SLIDE 2

Introduction Logging the communication Re-engineering the protocol Creating a simulacrum

Outline

1

Introduction Recap of last years lecture about the swiss Postcard This talk is about What is a smartcard? Everyone can build its own

2

Logging the communication Hardware-based logging RFID Relay / Logging Agent Software-based logging Comparison between methods

3

Re-engineering the protocol Principle of communication logging Hands on example Data structure for a logging application

4

Creating a simulacrum

Bernd Fix, Marc-André Beck Smartcard protocol sniffing

SLIDE 3

Introduction Logging the communication Re-engineering the protocol Creating a simulacrum Recap of last years lecture about the swiss Postcard This talk is about What is a smartcard? Everyone can build its own

Outline

1

Introduction Recap of last years lecture about the swiss Postcard This talk is about What is a smartcard? Everyone can build its own

2

Logging the communication Hardware-based logging RFID Relay / Logging Agent Software-based logging Comparison between methods

3

Re-engineering the protocol Principle of communication logging Hands on example Data structure for a logging application

4

Creating a simulacrum

Bernd Fix, Marc-André Beck Smartcard protocol sniffing

SLIDE 4

Introduction Logging the communication Re-engineering the protocol Creating a simulacrum Recap of last years lecture about the swiss Postcard This talk is about What is a smartcard? Everyone can build its own

Recap of last years lecture about the swiss Postcard I

1979 Start design of PIN protected memory card (Bull CP8) 1983 French banking card with 320 bit RSA authentification 1989 Introduction of french banking card (Carte Bleue) 1998 Serge Humpich re-engineered the Carte Bleue

Bernd Fix, Marc-André Beck Smartcard protocol sniffing

SLIDE 5

Introduction Logging the communication Re-engineering the protocol Creating a simulacrum Recap of last years lecture about the swiss Postcard This talk is about What is a smartcard? Everyone can build its own

Recap of last years lecture about the swiss Postcard II

2002 Found that the security measures of the swiss Postcard were similar 2006 Re-checked the security measures 2006 Presentation of initial results at the 23C3: A not so smart card 2007 initiated academic response

eg. http://lis.fh-aargau.ch/ecsem/ECSeminar/SS07.html

low impact, small media coverage

Bernd Fix, Marc-André Beck Smartcard protocol sniffing

SLIDE 6

Introduction Logging the communication Re-engineering the protocol Creating a simulacrum Recap of last years lecture about the swiss Postcard This talk is about What is a smartcard? Everyone can build its own

This talk is about

PostFinance Flawed signatures not used in authentication scheme Goal Build a working Postcard clone based on known facts For an introduction into the design flaws take a look at postcard-sicherheit.ch

Bernd Fix, Marc-André Beck Smartcard protocol sniffing

SLIDE 7

Introduction Logging the communication Re-engineering the protocol Creating a simulacrum Recap of last years lecture about the swiss Postcard This talk is about What is a smartcard? Everyone can build its own

This talk is about

PostFinance Flawed signatures not used in authentication scheme Goal Build a working Postcard clone based on known facts For an introduction into the design flaws take a look at postcard-sicherheit.ch

Bernd Fix, Marc-André Beck Smartcard protocol sniffing

SLIDE 8

Introduction Logging the communication Re-engineering the protocol Creating a simulacrum Recap of last years lecture about the swiss Postcard This talk is about What is a smartcard? Everyone can build its own

What is a smartcard?

External clock, ground and energy source I/O (input - output), reset Microcontroller with an internal EEPROM External EEPROM

Bernd Fix, Marc-André Beck Smartcard protocol sniffing

SLIDE 9

Introduction Logging the communication Re-engineering the protocol Creating a simulacrum Recap of last years lecture about the swiss Postcard This talk is about What is a smartcard? Everyone can build its own

What is a smartcard?

External clock, ground and energy source I/O (input - output), reset Microcontroller with an internal EEPROM External EEPROM

Bernd Fix, Marc-André Beck Smartcard protocol sniffing

SLIDE 10

Introduction Logging the communication Re-engineering the protocol Creating a simulacrum Recap of last years lecture about the swiss Postcard This talk is about What is a smartcard? Everyone can build its own

What is a smartcard?

External clock, ground and energy source I/O (input - output), reset Microcontroller with an internal EEPROM External EEPROM

Bernd Fix, Marc-André Beck Smartcard protocol sniffing

SLIDE 11

Introduction Logging the communication Re-engineering the protocol Creating a simulacrum Recap of last years lecture about the swiss Postcard This talk is about What is a smartcard? Everyone can build its own

What is a smartcard?

External clock, ground and energy source I/O (input - output), reset Microcontroller with an internal EEPROM External EEPROM

Bernd Fix, Marc-André Beck Smartcard protocol sniffing

SLIDE 12

Introduction Logging the communication Re-engineering the protocol Creating a simulacrum Recap of last years lecture about the swiss Postcard This talk is about What is a smartcard? Everyone can build its own

Everyone can build its own

Comparable to an old 8bit PC (but with fewer passive elements).

Bernd Fix, Marc-André Beck Smartcard protocol sniffing

SLIDE 13

Introduction Logging the communication Re-engineering the protocol Creating a simulacrum Hardware-based logging RFID Relay / Logging Agent Software-based logging Comparison between methods

Outline

1

Introduction Recap of last years lecture about the swiss Postcard This talk is about What is a smartcard? Everyone can build its own

2

Logging the communication Hardware-based logging RFID Relay / Logging Agent Software-based logging Comparison between methods

3

Re-engineering the protocol Principle of communication logging Hands on example Data structure for a logging application

4

Creating a simulacrum

Bernd Fix, Marc-André Beck Smartcard protocol sniffing

SLIDE 14

Introduction Logging the communication Re-engineering the protocol Creating a simulacrum Hardware-based logging RFID Relay / Logging Agent Software-based logging Comparison between methods

Protocol is mostly known

Most cards use ISO-7816 protocol to communicate with terminal ISO-7816 defines all aspects (physical/logical specs) Compatibility leads to tolerance (timing less relevant if within range) Still necessary even if protocol is published (like EMV) ?

Bernd Fix, Marc-André Beck Smartcard protocol sniffing

SLIDE 15

Introduction Logging the communication Re-engineering the protocol Creating a simulacrum Hardware-based logging RFID Relay / Logging Agent Software-based logging Comparison between methods

Hardware-based logging

MEIER MUSTER 25132756 60-134597-1 03/12

Terminal Orginal PC

Pro Capture the communication on physical level (timing) Con Not feasable outdoors

Bernd Fix, Marc-André Beck Smartcard protocol sniffing

SLIDE 16

Introduction Logging the communication Re-engineering the protocol Creating a simulacrum Hardware-based logging RFID Relay / Logging Agent Software-based logging Comparison between methods

RFID Relay / Logging Agent

MEIER MUSTER 25132756 60-134597-1 03/12 MEIER MUSTER 25132756 60-134597-1 03/12

Original Terminal PC RFID

Pro Full processing power and comfort Con No known implementation yet Communicate with inserted card via RFID form notebook.

Bernd Fix, Marc-André Beck Smartcard protocol sniffing

SLIDE 17

Introduction Logging the communication Re-engineering the protocol Creating a simulacrum Hardware-based logging RFID Relay / Logging Agent Software-based logging Comparison between methods

Software-based logging

MEIER MUSTER 25132756 60-134597-1 03/12 MEIER MUSTER 25132756 60-134597-1 03/12

Clone

MEIER MUSTER 25132756 60-134597-1 03/12

Original Terminal Clone PC

Pro (Quite) easy to program and use (secrecy) Con Step-by-step approach (time consuming) Use programmable smartcards to capture communication.

Bernd Fix, Marc-André Beck Smartcard protocol sniffing

SLIDE 18

Introduction Logging the communication Re-engineering the protocol Creating a simulacrum Hardware-based logging RFID Relay / Logging Agent Software-based logging Comparison between methods

Javacard / Processorcard

Javacard Pro No special programmer needed Con Can’t log direct convention

r T1

Processorcard Pro Can be customized to any sort of communication Con Needs special programmer (Money)

Bernd Fix, Marc-André Beck Smartcard protocol sniffing

SLIDE 19

Introduction Logging the communication Re-engineering the protocol Creating a simulacrum Hardware-based logging RFID Relay / Logging Agent Software-based logging Comparison between methods

Comparison between methods

Property HW JC PC Capture timing X T1 protocol X X Direct convention X X Indirect convention X X X Ease of use lo hi med* Secrecy lo hi hi Special hardware X X *Increase with ISO-7816/T0 library

Bernd Fix, Marc-André Beck Smartcard protocol sniffing

SLIDE 20

Introduction Logging the communication Re-engineering the protocol Creating a simulacrum Hardware-based logging RFID Relay / Logging Agent Software-based logging Comparison between methods

Comparison between methods

Property HW JC PC Capture timing X T1 protocol X X Direct convention X X Indirect convention X X X Ease of use lo hi med* Secrecy lo hi hi Special hardware X X *Increase with ISO-7816/T0 library

Bernd Fix, Marc-André Beck Smartcard protocol sniffing

SLIDE 21

Introduction Logging the communication Re-engineering the protocol Creating a simulacrum Hardware-based logging RFID Relay / Logging Agent Software-based logging Comparison between methods

Comparison between methods

Property HW JC PC Capture timing X T1 protocol X X Direct convention X X Indirect convention X X X Ease of use lo hi med* Secrecy lo hi hi Special hardware X X *Increase with ISO-7816/T0 library

Bernd Fix, Marc-André Beck Smartcard protocol sniffing

SLIDE 22

Introduction Logging the communication Re-engineering the protocol Creating a simulacrum Hardware-based logging RFID Relay / Logging Agent Software-based logging Comparison between methods

Comparison between methods

Property HW JC PC Capture timing X T1 protocol X X Direct convention X X Indirect convention X X X Ease of use lo hi med* Secrecy lo hi hi Special hardware X X *Increase with ISO-7816/T0 library

Bernd Fix, Marc-André Beck Smartcard protocol sniffing

SLIDE 23

Introduction Logging the communication Re-engineering the protocol Creating a simulacrum Hardware-based logging RFID Relay / Logging Agent Software-based logging Comparison between methods

Comparison between methods

Property HW JC PC Capture timing X T1 protocol X X Direct convention X X Indirect convention X X X Ease of use lo hi med* Secrecy lo hi hi Special hardware X X *Increase with ISO-7816/T0 library

Bernd Fix, Marc-André Beck Smartcard protocol sniffing

SLIDE 24

Introduction Logging the communication Re-engineering the protocol Creating a simulacrum Hardware-based logging RFID Relay / Logging Agent Software-based logging Comparison between methods

Comparison between methods

Property HW JC PC Capture timing X T1 protocol X X Direct convention X X Indirect convention X X X Ease of use lo hi med* Secrecy lo hi hi Special hardware X X *Increase with ISO-7816/T0 library

Bernd Fix, Marc-André Beck Smartcard protocol sniffing

SLIDE 25

Introduction Logging the communication Re-engineering the protocol Creating a simulacrum Hardware-based logging RFID Relay / Logging Agent Software-based logging Comparison between methods

Comparison between methods

Property HW JC PC Capture timing X T1 protocol X X Direct convention X X Indirect convention X X X Ease of use lo hi med* Secrecy lo hi hi Special hardware X X *Increase with ISO-7816/T0 library

Bernd Fix, Marc-André Beck Smartcard protocol sniffing

SLIDE 26

Introduction Logging the communication Re-engineering the protocol Creating a simulacrum Hardware-based logging RFID Relay / Logging Agent Software-based logging Comparison between methods

Comparison between methods

Property HW JC PC Capture timing X T1 protocol X X Direct convention X X Indirect convention X X X Ease of use lo hi med* Secrecy lo hi hi Special hardware X X *Increase with ISO-7816/T0 library

Bernd Fix, Marc-André Beck Smartcard protocol sniffing

SLIDE 27

Introduction Logging the communication Re-engineering the protocol Creating a simulacrum Principle of communication logging Hands on example Data structure for a logging application

Outline

1

Introduction Recap of last years lecture about the swiss Postcard This talk is about What is a smartcard? Everyone can build its own

2

Logging the communication Hardware-based logging RFID Relay / Logging Agent Software-based logging Comparison between methods

3

Re-engineering the protocol Principle of communication logging Hands on example Data structure for a logging application

4

Creating a simulacrum

Bernd Fix, Marc-André Beck Smartcard protocol sniffing

SLIDE 28

Introduction Logging the communication Re-engineering the protocol Creating a simulacrum Principle of communication logging Hands on example Data structure for a logging application

Principle of communication logging

Terminal Logger Smartcard request − → Lookup in request list ← − Found: Send associated response ← − Unknown: Send ok Start logging repeat Replay − → Save ← − response restart

Bernd Fix, Marc-André Beck Smartcard protocol sniffing

SLIDE 29

Introduction Logging the communication Re-engineering the protocol Creating a simulacrum Principle of communication logging Hands on example Data structure for a logging application

Principle of communication logging

Terminal Logger Smartcard request − → Lookup in request list ← − Found: Send associated response ← − Unknown: Send ok Start logging repeat Replay − → Save ← − response restart

Bernd Fix, Marc-André Beck Smartcard protocol sniffing

SLIDE 30

Introduction Logging the communication Re-engineering the protocol Creating a simulacrum Principle of communication logging Hands on example Data structure for a logging application

Principle of communication logging

Terminal Logger Smartcard request − → Lookup in request list ← − Found: Send associated response ← − Unknown: Send ok Start logging repeat Replay − → Save ← − response restart

Bernd Fix, Marc-André Beck Smartcard protocol sniffing

SLIDE 31

Introduction Logging the communication Re-engineering the protocol Creating a simulacrum Principle of communication logging Hands on example Data structure for a logging application

Principle of communication logging

Terminal Logger Smartcard request − → Lookup in request list ← − Found: Send associated response ← − Unknown: Send ok Start logging repeat Replay − → Save ← − response restart

Bernd Fix, Marc-André Beck Smartcard protocol sniffing

SLIDE 32

Introduction Logging the communication Re-engineering the protocol Creating a simulacrum Principle of communication logging Hands on example Data structure for a logging application

Principle of communication logging

Terminal Logger Smartcard request − → Lookup in request list ← − Found: Send associated response ← − Unknown: Send ok Start logging repeat Replay − → Save ← − response restart

Bernd Fix, Marc-André Beck Smartcard protocol sniffing

SLIDE 33

Introduction Logging the communication Re-engineering the protocol Creating a simulacrum Principle of communication logging Hands on example Data structure for a logging application

Principle of communication logging

Terminal Logger Smartcard request − → Lookup in request list ← − Found: Send associated response ← − Unknown: Send ok Start logging repeat Replay − → Save ← − response restart

Bernd Fix, Marc-André Beck Smartcard protocol sniffing

SLIDE 34

Introduction Logging the communication Re-engineering the protocol Creating a simulacrum Principle of communication logging Hands on example Data structure for a logging application

Principle of communication logging

Terminal Logger Smartcard request − → Lookup in request list ← − Found: Send associated response ← − Unknown: Send ok Start logging repeat Replay − → Save ← − response restart

Bernd Fix, Marc-André Beck Smartcard protocol sniffing

SLIDE 35

Introduction Logging the communication Re-engineering the protocol Creating a simulacrum Principle of communication logging Hands on example Data structure for a logging application

Communication

Terminal Smartcard (Power on) 3B:65:00:00:02:04:6C:90:00 BC:B0:09:C0:1C 08:4D:FF:FF:23:9F:0B:EB:... [9000] BC:B0:09:F8:04 3E:AC:9F:CC [9000] BC:B0:08:E0:1C 2E:03:30:33:3X:XX:XX:XX:... [9000] BC:B0:09:18:1C 3X:XX:XX:XX:3X:XX:XX:XX:... [9000] BC:B0:08:B0:04 [6A81] BC:20:00:00:04:XX:XX:XX:XX[9000] BC:40:00:00:00 [9000] BC:B0:08:B0:04 75:XX:XX:XX [9000]

Bernd Fix, Marc-André Beck Smartcard protocol sniffing

SLIDE 36

Introduction Logging the communication Re-engineering the protocol Creating a simulacrum Principle of communication logging Hands on example Data structure for a logging application

Sending the ATR

Terminal Smartcard (Power on) ATR - Answer To Reset 3F:65:35:10:02:04:6C:90:00 TS Initial Character 3F: indirect convention T0 Format Character 65: TB1, TC1 and 5 historicals TB1 35 Programming voltage 5.3 V TC1 10 Extra guardtime 10 * 104 µs HS Historicals

Bernd Fix, Marc-André Beck Smartcard protocol sniffing

SLIDE 37

Introduction Logging the communication Re-engineering the protocol Creating a simulacrum Principle of communication logging Hands on example Data structure for a logging application

Sending the ATR

Terminal Smartcard (Power on) ATR - Answer To Reset 3F:65:35:10:02:04:6C:90:00 TS Initial Character 3F: indirect convention T0 Format Character 65: TB1, TC1 and 5 historicals TB1 35 Programming voltage 5.3 V TC1 10 Extra guardtime 10 * 104 µs HS Historicals

Bernd Fix, Marc-André Beck Smartcard protocol sniffing

SLIDE 38

Introduction Logging the communication Re-engineering the protocol Creating a simulacrum Principle of communication logging Hands on example Data structure for a logging application

Sending the ATR

Terminal Smartcard (Power on) ATR - Answer To Reset 3F:65:35:10:02:04:6C:90:00 TS Initial Character 3F: indirect convention T0 Format Character 65: TB1, TC1 and 5 historicals TB1 35 Programming voltage 5.3 V TC1 10 Extra guardtime 10 * 104 µs HS Historicals

Bernd Fix, Marc-André Beck Smartcard protocol sniffing

SLIDE 39

Introduction Logging the communication Re-engineering the protocol Creating a simulacrum Principle of communication logging Hands on example Data structure for a logging application

Sending the ATR

Terminal Smartcard (Power on) ATR - Answer To Reset 3F:65:35:10:02:04:6C:90:00 TS Initial Character 3F: indirect convention T0 Format Character 65: TB1, TC1 and 5 historicals TB1 35 Programming voltage 5.3 V TC1 10 Extra guardtime 10 * 104 µs HS Historicals

Bernd Fix, Marc-André Beck Smartcard protocol sniffing

SLIDE 40

Introduction Logging the communication Re-engineering the protocol Creating a simulacrum Principle of communication logging Hands on example Data structure for a logging application

Sending the ATR

Terminal Smartcard (Power on) ATR - Answer To Reset 3F:65:35:10:02:04:6C:90:00 TS Initial Character 3F: indirect convention T0 Format Character 65: TB1, TC1 and 5 historicals TB1 35 Programming voltage 5.3 V TC1 10 Extra guardtime 10 * 104 µs HS Historicals

Bernd Fix, Marc-André Beck Smartcard protocol sniffing

SLIDE 41

Introduction Logging the communication Re-engineering the protocol Creating a simulacrum Principle of communication logging Hands on example Data structure for a logging application

Sending the APDU

Terminal Smartcard (Power on) 3B:65:00:00:02:04:6C:90:00 BC:B0:09:C0:1C CLA BC Banking cards. INS B0 Read data ADDR at address 09:C0 LC and return 1C bytes. * APDU - Application Protocol Data Unit.

Bernd Fix, Marc-André Beck Smartcard protocol sniffing

SLIDE 42

Introduction Logging the communication Re-engineering the protocol Creating a simulacrum Principle of communication logging Hands on example Data structure for a logging application

Sending the APDU

Terminal Smartcard (Power on) 3B:65:00:00:02:04:6C:90:00 BC:B0:09:C0:1C CLA BC Banking cards. INS B0 Read data ADDR at address 09:C0 LC and return 1C bytes. * APDU - Application Protocol Data Unit.

Bernd Fix, Marc-André Beck Smartcard protocol sniffing

SLIDE 43

Introduction Logging the communication Re-engineering the protocol Creating a simulacrum Principle of communication logging Hands on example Data structure for a logging application

Sending the APDU

Terminal Smartcard (Power on) 3B:65:00:00:02:04:6C:90:00 BC:B0:09:C0:1C CLA BC Banking cards. INS B0 Read data ADDR at address 09:C0 LC and return 1C bytes. * APDU - Application Protocol Data Unit.

Bernd Fix, Marc-André Beck Smartcard protocol sniffing

SLIDE 44

Introduction Logging the communication Re-engineering the protocol Creating a simulacrum Principle of communication logging Hands on example Data structure for a logging application

Sending the APDU

Terminal Smartcard (Power on) 3B:65:00:00:02:04:6C:90:00 BC:B0:09:C0:1C CLA BC Banking cards. INS B0 Read data ADDR at address 09:C0 LC and return 1C bytes. * APDU - Application Protocol Data Unit.

Bernd Fix, Marc-André Beck Smartcard protocol sniffing

SLIDE 45

Introduction Logging the communication Re-engineering the protocol Creating a simulacrum Principle of communication logging Hands on example Data structure for a logging application

Sending the APDU

Terminal Smartcard (Power on) 3B:65:00:00:02:04:6C:90:00 BC:B0:09:C0:1C CLA BC Banking cards. INS B0 Read data ADDR at address 09:C0 LC and return 1C bytes. * APDU - Application Protocol Data Unit.

Bernd Fix, Marc-André Beck Smartcard protocol sniffing

SLIDE 46

Introduction Logging the communication Re-engineering the protocol Creating a simulacrum Principle of communication logging Hands on example Data structure for a logging application

Stateful lookup

Terminal Smartcard (Power on) (ATR) 3B:65:00:00:02:04:6C:90:00 BC:B0:09:C0:1C 08:4D:FF:FF:23:9F:0B:EB:... [9000] BC:B0:09:F8:04 3E:AC:9F:CC [9000] BC:B0:08:E0:1C 2E:03:30:33:3X:XX:XX:XX:... [9000] BC:B0:09:18:1C 3X:XX:XX:XX:3X:XX:XX:XX:... [9000] BC:B0:08:B0:04 [6A81] BC:20:00:00:04:XX:XX:XX:XX[9000] BC:40:00:00:00 [9000] BC:B0:08:B0:04 75:XX:XX:XX [9000]

Bernd Fix, Marc-André Beck Smartcard protocol sniffing

SLIDE 47

Introduction Logging the communication Re-engineering the protocol Creating a simulacrum Principle of communication logging Hands on example Data structure for a logging application

Stateful lookup

Terminal Smartcard (Power on) (ATR) 3B:65:00:00:02:04:6C:90:00 BC:B0:09:C0:1C 08:4D:FF:FF:23:9F:0B:EB:... [9000] BC:B0:09:F8:04 3E:AC:9F:CC [9000] BC:B0:08:E0:1C 2E:03:30:33:3X:XX:XX:XX:... [9000] BC:B0:09:18:1C 3X:XX:XX:XX:3X:XX:XX:XX:... [9000] BC:B0:08:B0:04 [6A81] BC:20:00:00:04:XX:XX:XX:XX[9000] BC:40:00:00:00 [9000] BC:B0:08:B0:04 75:XX:XX:XX [9000]

Bernd Fix, Marc-André Beck Smartcard protocol sniffing

SLIDE 48

Introduction Logging the communication Re-engineering the protocol Creating a simulacrum Principle of communication logging Hands on example Data structure for a logging application

Stateful lookup

Terminal Smartcard (Power on) (ATR) 3B:65:00:00:02:04:6C:90:00 BC:B0:09:C0:1C 08:4D:FF:FF:23:9F:0B:EB:... [9000] BC:B0:09:F8:04 3E:AC:9F:CC [9000] BC:B0:08:E0:1C 2E:03:30:33:3X:XX:XX:XX:... [9000] BC:B0:09:18:1C 3X:XX:XX:XX:3X:XX:XX:XX:... [9000] BC:B0:08:B0:04 [6A81] BC:20:00:00:04:XX:XX:XX:XX[9000] BC:40:00:00:00 [9000] BC:B0:08:B0:04 75:XX:XX:XX [9000]

Bernd Fix, Marc-André Beck Smartcard protocol sniffing

SLIDE 49

Introduction Logging the communication Re-engineering the protocol Creating a simulacrum Principle of communication logging Hands on example Data structure for a logging application

Stateful lookup

Terminal Smartcard (Power on) (ATR) 3B:65:00:00:02:04:6C:90:00 BC:B0:09:C0:1C 08:4D:FF:FF:23:9F:0B:EB:... [9000] BC:B0:09:F8:04 3E:AC:9F:CC [9000] BC:B0:08:E0:1C 2E:03:30:33:3X:XX:XX:XX:... [9000] BC:B0:09:18:1C 3X:XX:XX:XX:3X:XX:XX:XX:... [9000] BC:B0:08:B0:04 [6A81] BC:20:00:00:04:XX:XX:XX:XX[9000] BC:40:00:00:00 [9000] BC:B0:08:B0:04 75:XX:XX:XX [9000]

Bernd Fix, Marc-André Beck Smartcard protocol sniffing

SLIDE 50

Introduction Logging the communication Re-engineering the protocol Creating a simulacrum Principle of communication logging Hands on example Data structure for a logging application

Stateful lookup

Terminal Smartcard (Power on) (ATR) 3B:65:00:00:02:04:6C:90:00 BC:B0:09:C0:1C 08:4D:FF:FF:23:9F:0B:EB:... [9000] BC:B0:09:F8:04 3E:AC:9F:CC [9000] BC:B0:08:E0:1C 2E:03:30:33:3X:XX:XX:XX:... [9000] BC:B0:09:18:1C 3X:XX:XX:XX:3X:XX:XX:XX:... [9000] BC:B0:08:B0:04 [6A81] BC:20:00:00:04:XX:XX:XX:XX[9000] BC:40:00:00:00 [9000] BC:B0:08:B0:04 75:XX:XX:XX [9000]

Bernd Fix, Marc-André Beck Smartcard protocol sniffing

SLIDE 51

Introduction Logging the communication Re-engineering the protocol Creating a simulacrum Principle of communication logging Hands on example Data structure for a logging application

A data structure for a logging application - requests

Requests

ffset

length field 00 01 Index (0 = End) 01 01 Active State (0 = Any) 02 01 Next State (FF = no change) 03 01 Length of additional data (n) 04 05 APDU 09 n <Additional data>

Bernd Fix, Marc-André Beck Smartcard protocol sniffing

SLIDE 52

Introduction Logging the communication Re-engineering the protocol Creating a simulacrum Principle of communication logging Hands on example Data structure for a logging application

A data structure for a logging application - responses

Responses

ffset

length field 00 01 Index (0 = End) 01 01 Type (1 = SW, 2 = Data) 02 02 SW / Length (n) 04 n <Data>

Bernd Fix, Marc-André Beck Smartcard protocol sniffing

SLIDE 53

Introduction Logging the communication Re-engineering the protocol Creating a simulacrum Principle of communication logging Hands on example Data structure for a logging application

Treating the same card differently

Swisscom publicphone SBB ticket machine BC:B0:09:C0:1C BC:B0:09:C0:18 BC:B0:09:F8:04 BC:B0:08:E0:1C BC:B0:09:18:1C BC:B0:09:50:1C BC:B0:09:48:1C BC:B0:09:88:1C

Bernd Fix, Marc-André Beck Smartcard protocol sniffing

SLIDE 54

Introduction Logging the communication Re-engineering the protocol Creating a simulacrum Principle of communication logging Hands on example Data structure for a logging application

Treating the same card differently

Swisscom publicphone SBB ticket machine BC:B0:09:C0:1C BC:B0:09:C0:18 BC:B0:09:F8:04 BC:B0:08:E0:1C BC:B0:09:18:1C BC:B0:09:50:1C BC:B0:09:48:1C BC:B0:09:88:1C

Bernd Fix, Marc-André Beck Smartcard protocol sniffing

SLIDE 55

Introduction Logging the communication Re-engineering the protocol Creating a simulacrum

Outline

1

Introduction Recap of last years lecture about the swiss Postcard This talk is about What is a smartcard? Everyone can build its own

2

Logging the communication Hardware-based logging RFID Relay / Logging Agent Software-based logging Comparison between methods

3

Re-engineering the protocol Principle of communication logging Hands on example Data structure for a logging application

4

Creating a simulacrum

Bernd Fix, Marc-André Beck Smartcard protocol sniffing

SLIDE 56

Introduction Logging the communication Re-engineering the protocol Creating a simulacrum

Material you need

special reader http://www.infinityusb.com Ask for better Linux, BSD, Plan9, Solaris, OS/2 support! avr-gcc http://www.nongnu.org/avr-libc ISO-7816/T0 library http://postcard-sicherheit.ch/de/clone.html

Bernd Fix, Marc-André Beck Smartcard protocol sniffing

SLIDE 57

Appendix Further information Further reading Questions?

Further information

postcard-sicherheit.ch The ultimate source for postcard security. parodie.com/monetique Reference of the Carte Bleue. mbsks.franken.de/sosse Simple Operating System for Smartcard Education. en.wikipedia.org/wiki/ISO_7816

Bernd Fix, Marc-André Beck Smartcard protocol sniffing

SLIDE 58

Appendix Further information Further reading Questions?

Questions?

Bernd Fix, Marc-André Beck Smartcard protocol sniffing

SLIDE 60

Appendix Further information Further reading Questions? Bernd Fix, Marc-André Beck Smartcard protocol sniffing