I was excited to pick up the new Proxmark 3 RDV4 from its Kickstarter, before the official, far more expensive release at Defcon 26. I’d been playing with it since I got it, cloned my office entry HID card, and tried out a couple of the Android apps to run it.
There are two Android apps that I’m aware of. Walrus is the one that seems promising to me. It leverages the ability to read, write and simulate (playback) RFID cards native to the Proxmark, and supposedly a feature under development is to brute force readers using bulk-collected tags. Sounds like a fun tool for physical pentesters. Collect cards in a crowded elevator, then try to get into offices using the cards you’ve collected. I haven’t checked for an update since downloading the software, so I have no idea whether it’s been implemented yet. The other one, AndProx, is a standard Proxmark CLI, and I’m not much for typing on phones. It’ll work in a pinch, but I prefer my trusty Macbook for that. Also, it didn’t seem to recognize the Proxmark from my phone. Maybe I need an OTG cable.
I picked up some keyfob tags on Amazon, because I have this annoying habit of forgetting my work card every once in a while and having to borrow a temporary card from the receptionist, and I figure if I have one on the same ring as my car keys it’ll be far less likely that I’ll leave it at home (or in the car). However, my RFID tag knowledge isn’t super deep, and apparently just looking for T5577 cards isn’t good enough. They read as “Indala” in the Proxmark, and I’m unable to clone my HID card to them as I could with the included Proxgrind card, or other random cards in my collection.
So I looked a little closer this time, and ordered another set of fobs that one reviewer claims he was able to clone HID with. Science is all trial and error, right?
If you’re considering getting a Proxmark, I’ll share a couple of experiences. Trying to update the bootloader and firmware from a Linux VM was problematic. The update hung and bricked the Proxmark. This was easily fixed by holding down the button on the unit while powering it up, and while re-uploading the bootloader and firmware directly from MacOS. If you get weird command errors, it’s because your client and firmware versions are out of sync. Once everything’s in sync, it’s like clockwork.
Side note: I’m getting to be known as “that guy” at work. A coworker asked me if I could pick tubular locks today. Gotta dig out my tubular pick set to bring in tomorrow. He wants to replace a drive in a locked drive array and doesn’t know where the key is.
Indala Update 2018-09-09: I somehow managed to get the “Indala” card to work. Hints from iceman gave me confidence that the reader may have just been misreading the tags, so I played around with t55xx commands until I managed to get it right. I will try to duplicate the process in my spare time so that I have a documented solution. The good news is that it does work. Now what to do with these 19 extra fobs. 🙂
