7 ms·

Building an RFID Proximity Card Cloner for $30

86 points by trotsky 16y ago

achille 16y ago
Great, but where can I buy one now? My apartment compex issues only one single bulky RFID+garage opener that I hate carrying in my keychain.
- Zev 16y ago
  You have the schematic, what more could you want?! (I kid, I kid. But, I think it would be fun to put together.)
- simonsarris 16y ago
  I think dealextreme.com had a few a while back. Yeah: http://www.dealextreme.com/details.dx/sku.17230 http://www.dealextreme.com/details.dx/sku.17230 $66
- tocomment 16y ago
  I was wondering the same thing. He should sell a kit. By the way I had the exact same problem last time I lived in an apartment. Stupid management refused to give me a second card.
bmalicoat 16y ago
Do RFID tags have anything to prevent a replay attack or is owning a bit for bit copy of an RFID tag the same as owning the original?
- almost 16y ago
  RFID tags are not smart cards, they basically just have a small amount of data on them which can be read off. So yes, having a bit for bit copy is exactly the same as having the original tag.
  - tocomment 16y ago
    That doesn't seem like a smart design. It seems less secure than an old fashioned metal key.
    - lisper 16y ago
      These chips aren't supposed to be used for secure applications (though no doubt some people do use them that way). They are intended to be used more like a UPC code.
      - tocomment 16y ago
        I thought that's how keycards generally work?
        lisper 16y ago
        Some work that way, others do PKI-ish things and so are more secure.
    - almost 16y ago
      Not for a key, no. But it's a great design when what you want is low cost ID tags which don't require their own power source and which essentially work like barcodes that you can scan without line of sight.
- deutronium 16y ago
  Regarding 'contactless smart cards' which use a similar radio protocol to RFID: One example being MIFARE used in the London underground, where they found a vulnerability in the encryption algorithm being used on the card (the cards are 'intelligent' in that they have a processor on board to perform the cryptography etc.). Once you can break the encryption, you can then set about making a clone. With contactless bank cards, (which in the UK you can use to pay for the M6 toll), you could imagine people electronically picking your pocket, by relaying the signal from a transceiver near a cash point over RF to another transceiver which communicates with the card in your pocket. (hopefully they use distance bounding protocols to prevent this!) Karsten Nohl (http://www.cs.virginia.edu/~kn5f/ http://www.cs.virginia.edu/~kn5f/) has some fascinating papers on how they broke Crypto1 (the algorithm used by MIFARE). They took photos of the chip in the card using an optical microscope, after dissolving the card in acetone (They had to sand off each layer of the chip to get to the next) They then applied image recognition to identify logic gates from their constituent transistors. And then looked for XOR gates, as they mention they're rarely used for anything other than crypto on this type of chip. Once they had found the area of the chip involved in cryptography, they converted the logic gates into the actual algorithm used, and then picked apart weaknesses with it.
  - mikedmiked 16y ago
    Remarkable! Thank you for sharing this.
    - flawawa2 16y ago
      http://media.ccc.de/browse/congress/2007/24c3-2378-en-mifare_security.html http://media.ccc.de/browse/congress/2007/24c3-2378-en-mifare... http://media.ccc.de/browse/congress/2008/25c3-3032-en-analyzing_rfid_security.html http://media.ccc.de/browse/congress/2008/25c3-3032-en-analyz... Nowadays he is busy cracking and hacking GSM. Remarkable person.
heyrhett 16y ago
This is why Richard Stallman recommends that you wrap your RFID card in aluminum foil. http://slashdot.org/articles/05/11/19/149242.shtml?tid=133&tid=117 http://slashdot.org/articles/05/11/19/149242.shtml?tid=133&#...
- ben1040 16y ago
  Not just RMS -- the RFID trusted traveler pass I used to use (a NEXUS card to be specific) came with a foil storage envelope that DHS/customs recommended you use whenever the card wasn't in use.
- gvb 16y ago
  Hmmm, how effective is aluminum foil in blocking the RFID? Despite having "RF" in the name, the signal is primarily magnetic induction. One google hit says "helps a lot, but doesn't prevent": http://www.omniscienceisbliss.org/rfid.html http://www.omniscienceisbliss.org/rfid.html Note that the picture of the reader and the unshielded read distance (18") indications it is the long distance version. I'll have to experiment at work tomorrow. ;-)
  - tgflynn 16y ago
    Electromagnetic signals are attenuated exponentially in metals with a frequency dependent decay constant called the skin depth. The formula is given in this wikipedia page : http://en.wikipedia.org/wiki/Skin_depth http://en.wikipedia.org/wiki/Skin_depth If you know what frequency RFID uses and the thickness of the foil you can easily calculate how much attenuation you'd get.
    - gvb 16y ago
      125KHz => 0.024mm skin depth Looks like typical aluminum foil is thicker than that. The box in our kitchen doesn't say how thick it is, but the Wikipedia page indicates it is likely thicker than 0.025mm since it needs to be thicker than that to be impermeable to oxygen and water. Ref: http://en.wikipedia.org/wiki/Aluminium_foil#Properties http://en.wikipedia.org/wiki/Aluminium_foil#Properties

86 points by trotsky 16y ago

Great, but where can I buy one now? My apartment compex issues only one single bulky RFID+garage opener that I hate carrying in my keychain.

Zev 16y ago
You have the schematic, what more could you want?! (I kid, I kid. But, I think it would be fun to put together.)
simonsarris 16y ago
I think dealextreme.com had a few a while back. Yeah: http://www.dealextreme.com/details.dx/sku.17230 http://www.dealextreme.com/details.dx/sku.17230 $66
tocomment 16y ago
I was wondering the same thing. He should sell a kit. By the way I had the exact same problem last time I lived in an apartment. Stupid management refused to give me a second card.

bmalicoat 16y ago

Do RFID tags have anything to prevent a replay attack or is owning a bit for bit copy of an RFID tag the same as owning the original?

almost 16y ago
RFID tags are not smart cards, they basically just have a small amount of data on them which can be read off. So yes, having a bit for bit copy is exactly the same as having the original tag.
- tocomment 16y ago
  That doesn't seem like a smart design. It seems less secure than an old fashioned metal key.
  - lisper 16y ago
    These chips aren't supposed to be used for secure applications (though no doubt some people do use them that way). They are intended to be used more like a UPC code.
    - tocomment 16y ago
      I thought that's how keycards generally work?
      - lisper 16y ago
        Some work that way, others do PKI-ish things and so are more secure.
  - almost 16y ago
    Not for a key, no. But it's a great design when what you want is low cost ID tags which don't require their own power source and which essentially work like barcodes that you can scan without line of sight.
deutronium 16y ago
Regarding 'contactless smart cards' which use a similar radio protocol to RFID: One example being MIFARE used in the London underground, where they found a vulnerability in the encryption algorithm being used on the card (the cards are 'intelligent' in that they have a processor on board to perform the cryptography etc.). Once you can break the encryption, you can then set about making a clone. With contactless bank cards, (which in the UK you can use to pay for the M6 toll), you could imagine people electronically picking your pocket, by relaying the signal from a transceiver near a cash point over RF to another transceiver which communicates with the card in your pocket. (hopefully they use distance bounding protocols to prevent this!) Karsten Nohl (http://www.cs.virginia.edu/~kn5f/ http://www.cs.virginia.edu/~kn5f/) has some fascinating papers on how they broke Crypto1 (the algorithm used by MIFARE). They took photos of the chip in the card using an optical microscope, after dissolving the card in acetone (They had to sand off each layer of the chip to get to the next) They then applied image recognition to identify logic gates from their constituent transistors. And then looked for XOR gates, as they mention they're rarely used for anything other than crypto on this type of chip. Once they had found the area of the chip involved in cryptography, they converted the logic gates into the actual algorithm used, and then picked apart weaknesses with it.
- mikedmiked 16y ago
  Remarkable! Thank you for sharing this.
  - flawawa2 16y ago
    http://media.ccc.de/browse/congress/2007/24c3-2378-en-mifare_security.html http://media.ccc.de/browse/congress/2007/24c3-2378-en-mifare... http://media.ccc.de/browse/congress/2008/25c3-3032-en-analyzing_rfid_security.html http://media.ccc.de/browse/congress/2008/25c3-3032-en-analyz... Nowadays he is busy cracking and hacking GSM. Remarkable person.

heyrhett 16y ago

This is why Richard Stallman recommends that you wrap your RFID card in aluminum foil. http://slashdot.org/articles/05/11/19/149242.shtml?tid=133&tid=117 http://slashdot.org/articles/05/11/19/149242.shtml?tid=133&#...

ben1040 16y ago
Not just RMS -- the RFID trusted traveler pass I used to use (a NEXUS card to be specific) came with a foil storage envelope that DHS/customs recommended you use whenever the card wasn't in use.
gvb 16y ago
Hmmm, how effective is aluminum foil in blocking the RFID? Despite having "RF" in the name, the signal is primarily magnetic induction. One google hit says "helps a lot, but doesn't prevent": http://www.omniscienceisbliss.org/rfid.html http://www.omniscienceisbliss.org/rfid.html Note that the picture of the reader and the unshielded read distance (18") indications it is the long distance version. I'll have to experiment at work tomorrow. ;-)
- tgflynn 16y ago
  Electromagnetic signals are attenuated exponentially in metals with a frequency dependent decay constant called the skin depth. The formula is given in this wikipedia page : http://en.wikipedia.org/wiki/Skin_depth http://en.wikipedia.org/wiki/Skin_depth If you know what frequency RFID uses and the thickness of the foil you can easily calculate how much attenuation you'd get.
  - gvb 16y ago
    125KHz => 0.024mm skin depth Looks like typical aluminum foil is thicker than that. The box in our kitchen doesn't say how thick it is, but the Wikipedia page indicates it is likely thicker than 0.025mm since it needs to be thicker than that to be impermeable to oxygen and water. Ref: http://en.wikipedia.org/wiki/Aluminium_foil#Properties http://en.wikipedia.org/wiki/Aluminium_foil#Properties