{"id":837,"date":"2020-10-16T16:20:54","date_gmt":"2020-10-16T20:20:54","guid":{"rendered":"https:\/\/dc540.org\/xxx\/?p=837"},"modified":"2020-10-16T16:20:54","modified_gmt":"2020-10-16T20:20:54","slug":"another-rfid-reader-on-the-way","status":"publish","type":"post","link":"https:\/\/dc540.org\/xxx\/2020\/10\/another-rfid-reader-on-the-way\/","title":{"rendered":"Another RFID reader on the way"},"content":{"rendered":"\n<p>Since I had success with both commercial and maker-level LF RFID readers, i decided to move forward in time another decade, and picked up a HID RP40 multiclass reader.<\/p>\n\n\n\n<p>I&#8217;m still in the learning process with HF RFID, so bear with me in this little logic exercise, if you please&#8230;<\/p>\n\n\n\n<ol class=\"wp-block-list\"><li>LF RFID is terrible because it&#8217;s just a tag ID and is easily cloned.<\/li><li>HF RFID (MIFARE etc) offer enhanced security because it adds the capability of generating a nonce, and I won&#8217;t go into further detail here because math&#8230; In short, you can write the UID of a tag to a UID-writable tag and the UID will present, but it won&#8217;t generate that nonce, so depending on the security application, it may or may not be more secure.<\/li><li>I have found at least one person providing a DIY HF RFID reading app for Arduino that simply validates the UID against a database. This defeats the entire purpose of the enhanced security of MIFARE-type tag protocols, and renders. It&#8217;s the equivalent of me being able to withdraw money from your checking account just by knowing your name.<\/li><li>That said, the pm3 with Iceman&#8217;s firmware can quickly crack the passwords and dump tag data. The pm3 can also copy that dumped data to a &#8220;magic Chinese backdoor&#8221; tag and then set the tag to the same UID. At that point, the copied tag seems to read the same as the original. I&#8217;d love to test that, but until my next hotel stay, I don&#8217;t have access to test that copied tag against an HF reader <em>in situ<\/em>.  <\/li><li>If #4 is correct, given ~15 seconds of proximity to a users badge or fob, I can have a working cloned copy of it, rendering the HF tag literally no more secure than the UID-only LF tag.<\/li><\/ol>\n\n\n\n<p>I have pretty strong confidence that this will work after reading the following article, and I find the conclusion rather titillating. &#8220;While card cloning is a serious security risk, the main problem is not reading or copying the card itself, but being able to reverse engineer the card contents, which could lead to us making a \u201cmaster key\u201d that opens all the doors in a building.&#8221; By the way, I apologize for linking to a medium.com article. I hate everyone that implements paywalls in any form, even though theirs doesn&#8217;t kick in until after you&#8217;ve read a few articles.<\/p>\n\n\n\n<p><a href=\"https:\/\/medium.com\/exc3l\/cracking-mifare-classic-cards-with-proxmark3-e42121cd968b\">https:\/\/medium.com\/exc3l\/cracking-mifare-classic-cards-with-proxmark3-e42121cd968b<\/a><\/p>\n\n\n\n<p><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Since I had success with both commercial and maker-level LF RFID readers, i decided to move forward in time another decade, and picked up a HID RP40 multiclass reader. I&#8217;m &hellip; <\/p>\n<p class=\"link-more\"><a href=\"https:\/\/dc540.org\/xxx\/2020\/10\/another-rfid-reader-on-the-way\/\" class=\"more-link\">Continue reading<span class=\"screen-reader-text\"> &#8220;Another RFID reader on the way&#8221;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":838,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[5,73],"tags":[],"class_list":["post-837","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-hardware","category-rfid"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"https:\/\/dc540.org\/xxx\/wp-content\/uploads\/2020\/10\/rp40.jpg","jetpack_likes_enabled":true,"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/dc540.org\/xxx\/wp-json\/wp\/v2\/posts\/837","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dc540.org\/xxx\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dc540.org\/xxx\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dc540.org\/xxx\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/dc540.org\/xxx\/wp-json\/wp\/v2\/comments?post=837"}],"version-history":[{"count":1,"href":"https:\/\/dc540.org\/xxx\/wp-json\/wp\/v2\/posts\/837\/revisions"}],"predecessor-version":[{"id":839,"href":"https:\/\/dc540.org\/xxx\/wp-json\/wp\/v2\/posts\/837\/revisions\/839"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/dc540.org\/xxx\/wp-json\/wp\/v2\/media\/838"}],"wp:attachment":[{"href":"https:\/\/dc540.org\/xxx\/wp-json\/wp\/v2\/media?parent=837"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dc540.org\/xxx\/wp-json\/wp\/v2\/categories?post=837"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dc540.org\/xxx\/wp-json\/wp\/v2\/tags?post=837"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}