#mifareclassic — Public Fediverse posts

The democratisation of Mifare attacks is almost here.

https://github.com/flipperdevices/flipperzero-firmware/pull/3822

#Mifare #MifareClassic #FlipperZero #security

Researchers Uncover Backdoor in Millions of Chinese RFID Smart Cards https://thecyberexpress.com/backdoor-fm11rf08s-chinese-rfid-smart-cards/ #ShanghaiFudanMicroelectronics #TheCyberExpressNews #CybersecurityNews #TheCyberExpress #RFIDSmartCards #FirewallDaily #MIFAREClassic #FM11RF08S

Classic example of #securitybyobscurity ending badly: "To clone the cards, they had to crack #dormakaba's key derivation function. ... Forged keycards can be created using any #MIFAREClassic card."
https://www.bleepingcomputer.com/news/security/unsaflok-flaw-can-let-hackers-unlock-millions-of-hotel-doors/ #Unsaflok #vulnerability #infosec #cybersecurity #Saflok

😭 this moment where I analyze yet another card and I have no keys of this other card.

Two hypothesis:
1. They have a pool of random keys
2. They have change keys randomly per card, to avoid having master keys in the wild ("No master key, no problem :blobthinksmart:"). In this case, I'll try to guess keys (e.g. a bad random number generator)

I'll try to collect a bunch of card near me (friends and colleagues), attack the cards, and try to get evidence of the first hypothesis. Meanwhile, I'll try to see if their random key generator is really random... 🤷‍♀️

Any other idea?

#Mifare #MifareClassic #MiFail #ovchipkaart

I got the keys of the NL OV-chipkaart, the national transport card. I'm studying if this is a real vulnerability 👀
If it is, I'll try to responsibly disclose it. Do you know who is responsible for this? NCSC NL?

Evidence:
```
$ md5sum *
ba02cb86e460806c9b72dc0813956c39 anonymous_ov_keys.dic
3a8aff313a14feba3fde78f15d98eee8 personal_ov_keys.dic
7e88b55d40e612bafb44276ce3e73507 pro_ov_keys.dic
```

#NFC #transportcard #Mifare #MifareClassic

@AndreasSebayang ah ok, #MifareClassic

Cracking the MiFare Classic Could Get You Free Snacks - [Guillermo] started a new job a while back. That job came with an NFC access card,... - https://hackaday.com/2022/07/13/cracking-the-mifare-classic-could-get-you-free-snacks/ #vendingmachine #mifareclassic #mischacks #mifare #nfctag #nfc