5 ms·

I love my little Flipper Zero. Comes in handy for all kinds of things. Recently copied my hotel keycard with it just in case I lost it.

nickthegreek 3y ago
Did the same at cedar point this weekend. The flipper zero is just a fun little gadget.
- grubbs 3y ago
  Yea I'd like to grab one literally to copy my garage keycard at work. I always forget and have to pay ridiculous rates in the city...
lxgr 3y ago
That's really neat, but on another level it's a shame that this is possible with so many keycards still. At least for magnetic stripe keycards, you'd need actual physical access to the card for a second; with many contactless ones, a tap on somebody's wallet/pocket is enough. Actually secure keycards only cost fractionally more; even classic Mifare (which has been thoroughly hacked) would offer better security than this.
- hnav 3y ago
  most keycards/fobs are pretty secure and near impossible to copy (e.g. NXP Desfire based systems), others are easy to copy but copies can be detected (e.g. NXP Mifare Classic), it's mostly legacy RFID stuff that's trivial.
  - lxgr 3y ago
    Yeah, but so many hotels seem to use the legacy stuff. Most keycards I've tested don't even register on my phone, meaning that they're using something pre-ISO-14443 (which very likely does not support any real cryptographic authentication).
  - tonyarkles 3y ago
    > it's mostly legacy RFID stuff that's trivial I don't know what it's like globally, but around these parts it is way more common to encounter one of these "legacy" systems than any of the modern stuff. Many large campuses were early adopters of fob-based access and upgrades are prohibitively expensive. One of my favourite attacks against the existing HID-card based systems is... once you scan a card, the 24-bit identifier is split between an 8-bit facility ID and a 16-bit card ID. If you encounter a door that won't open with the card you have, start decrementing the card ID; many of these places assigned card IDs sequentially and by trying smaller IDs you're trying cards for employees who have had longer tenure at the company.
- xeromal 3y ago
  It wasn't a very easy process. I had to scan my card for about 30 minutes and then I had to scan the card reader for a bit. It was impractical.
  - lxgr 3y ago
    Interesting, do you happen to know what system that was? Sounds like an active attack of some sorts.
    - hnav 3y ago
      Sounds like something based on NXP Mifare Classic. You first try a dictionary attack against the fob (most readers use whatever default keys the vendor set), if that fails, you collect nonces by touching the flipper to a reader, calculate keys in the companion app on your phone, then add keys to the flipper's dictionary. The attacks are called darkside and nested.

nickthegreek 3y ago

Did the same at cedar point this weekend. The flipper zero is just a fun little gadget.

grubbs 3y ago
Yea I'd like to grab one literally to copy my garage keycard at work. I always forget and have to pay ridiculous rates in the city...

lxgr 3y ago

That's really neat, but on another level it's a shame that this is possible with so many keycards still. At least for magnetic stripe keycards, you'd need actual physical access to the card for a second; with many contactless ones, a tap on somebody's wallet/pocket is enough. Actually secure keycards only cost fractionally more; even classic Mifare (which has been thoroughly hacked) would offer better security than this.

hnav 3y ago
most keycards/fobs are pretty secure and near impossible to copy (e.g. NXP Desfire based systems), others are easy to copy but copies can be detected (e.g. NXP Mifare Classic), it's mostly legacy RFID stuff that's trivial.
- lxgr 3y ago
  Yeah, but so many hotels seem to use the legacy stuff. Most keycards I've tested don't even register on my phone, meaning that they're using something pre-ISO-14443 (which very likely does not support any real cryptographic authentication).
- tonyarkles 3y ago
  > it's mostly legacy RFID stuff that's trivial I don't know what it's like globally, but around these parts it is way more common to encounter one of these "legacy" systems than any of the modern stuff. Many large campuses were early adopters of fob-based access and upgrades are prohibitively expensive. One of my favourite attacks against the existing HID-card based systems is... once you scan a card, the 24-bit identifier is split between an 8-bit facility ID and a 16-bit card ID. If you encounter a door that won't open with the card you have, start decrementing the card ID; many of these places assigned card IDs sequentially and by trying smaller IDs you're trying cards for employees who have had longer tenure at the company.
xeromal 3y ago
It wasn't a very easy process. I had to scan my card for about 30 minutes and then I had to scan the card reader for a bit. It was impractical.
- lxgr 3y ago
  Interesting, do you happen to know what system that was? Sounds like an active attack of some sorts.
  - hnav 3y ago
    Sounds like something based on NXP Mifare Classic. You first try a dictionary attack against the fob (most readers use whatever default keys the vendor set), if that fails, you collect nonces by touching the flipper to a reader, calculate keys in the companion app on your phone, then add keys to the flipper's dictionary. The attacks are called darkside and nested.