49 ms·
From the comments in the source, the code needs 20 clock cycles to send a new tag, it's running at 125kHz and each tag is 40 bits long. How can this device brut
by geekuillaume 9y ago
From the comments in the source, the code needs 20 clock cycles to send a new tag, it's running at 125kHz and each tag is 40 bits long.
How can this device bruteforce the tag at this rate? Won't it be extremely slow compared to the number of possible tags?
- revelation 9y agoIt will be and most software on the other end likely isn't prepared to even read tags at that speed. Fun hack though.
- moron4hire 9y ago125kHz is the transmission frequency. It's one of the unregulated frequencies for RFID tags, but sort of an industry standard value commonly used in retail products and goats. Most other cattle use tags at 134kHz. NFC is mostly just RFID at 13.56mHz.
- cobookman 9y agoRAIN rfid uses 900mhz and can be read from 30+ feet away
- TheSoftwareGuy 9y agoWell let's do the math 125 kHz 2 bits/cycle = 250 bits /sec A 2^40 bit string has 1099511627776 combinations, and would require 1099511627776 40 = 43980465111040 bits to besent to try all of them. That would take 43980465111040/250 seconds or about 5575 years And that's under ideal "spherical object in a vacuum" conditions. So yeah your right, unless they get lucky.
- thatsso1999 9y agoI believe your math is off by a factor of 1000. 125kHz = 125,000 cycles/sec * 2 bits/cycle = 250,000 bits/sec 250,000 bits/sec / 40 bits/code = 6250 codes/sec 2^40 = 1,099,511,627,776 possible codes / 6250 codes/sec ~= 175,921,860 sec ~= 5.578 years While this is still an extremely long time for the worst case, by the looks of other comments, as well as the author's video, it appears extremely doubtful that most RFID readers have anywhere near 40 bits of security - and it takes about 10 seconds (65536/6250) for the fuzzer to brute force all codes 16 bits or less.
- TheSoftwareGuy 9y agoShoot you're right, it's kHz not Hz haha I'll update my comment.
- TheSoftwareGuy 9y agoDarn I don't think HN is letting me update my comment.
- mrb 9y agoBruteforcing is totally doable because in practice the unique identifiers broadcasted by these tags are allocated sequentially. I built an AVRFID a few years ago to bruteforce the HID ProxCard II RFIDs at work (45 bits of data: 20-bit mfg ID, 8-bit facility ID, 16-bit tag ID, 1 odd parity bit). Starting from my ID, and incrementing it one by one, it only took seconds to find many other valid IDs that were unlocking doors of various restricted areas. Imagine a disgruntled employee who has his legit RFID and is looking to access other restricted areas to which he normally doesn't have access... bruteforcing works perfectly fine for him.
- TheSoftwareGuy 9y agoWell let's do the math 125 kHz 2 bits/cycle = 250 bits /sec A 2^40 bit string has 1099511627776 combinations, and would require 1099511627776 40 = 43980465111040 bits to besent to try all of them. That would take 43980465111040/250 seconds or about 5575 years So yeah your right, unless they get lucky.