Iclass Rfid Hacking
Hacking iClass Elite with proxmark3RFID-based physical access control systems (“physical” as in systems for opening doors to grant physical access to a site) are very interesting. Typically, a modern access control system is heavily integrated with IT-systems, susceptible to the same type of vulnerabilities found in any IT system. LF entry systemsHistorically, RFID-based access control systems utilized low-frequency RFID badges. These type of badges operate within 125 KHz or 134 KHz range.
Hack Your Access Control With This $30 HID 125kHz Card Copier By: Brian Rhodes, Published on May 01, 2017 You might have heard the stories or seen the YouTube videos of random people hacking electronic access control systems.
They are typically not very sophisticated; upon being powered by a reader, they shout their identifier (UID) continuously. Naturally, a drawback with this system is that they are easily cloneable; anyone who is close enough to both power the tag and read the tags modulations can read the id, thus later simulate the tag or program the identifier into a similar tag.Low-frequency tags has the advantage that they can operate on a larger distance from a reader. This happens to be an advantage for attackers aswell; as an example, a commercial long-range reader with a read-range of up to 24 inches (61cm) was modified by to perform stealth attacks, e.g. By carrying the reader in briefcase close to the victim.HF systemsThe blatant insecurity of LF-based access controls led to the development of more ‘intelligent’ tags; HF-tags. These tags operate on the 13.56 MHz band and are capable of actually communicating (as in, a two-part dialogue, not just shouting an id.) and performing cryptography to protect the communications.There are a lot of different systems, based on different ISO-standard but also with proprietary protocol extensions. Examples are Mifare Classic (based on iso 14443a) and HID iClass (based on iso 15693).The most common such system is Mifare Classic. The ‘classic’ comes in several forms, from 1K storage to 4K storage.
This system has been cracked since several years (check the whitepapers for a more thorough reading about that). #./loclassIClass Cipher version 1.2, Copyright (C) 2014 Martin Holst SwendeComes with ABSOLUTELY NO WARRANTYThis is free software, and you are welcome to use, abuse and repackage, please keep the creditsUsage: iclazz optionsOptions:-t Perform self-test-h Show this help-f Bruteforce iclass dumpfileAn iclass dumpfile is assumed to consist of an arbitrary number of malicious CSNs, and their protocol responsesThe the binary format of the file is expected to be as follows. Totalling N.24 bytesCheck iclassdump.bin for an exampleAnd testing with the example dumpfile. #./loclass -f iclassdump.binIClass Cipher version 1.2, Copyright (C) 2014 Martin Holst SwendeComes with ABSOLUTELY NO WARRANTYThis is free software, and you are welcome to use, abuse and repackage, please keep the creditsBruteforcing byte 1Bruteforcing byte 0Bruteforcing byte 123= 1: 0x35= 0: 0xf1= 69: 0x7b= 2: 0x59. Removed for brevity. = 5: 0x5a= 125: 0x70= 21: 0x85Performed full crack in 107.098549 secondsHigh security custom key (Kcus):Std format = 8fa250c3cb61f41cIclass format = 5b7c62c491c11b39Key verified ok!The example file above uses the CSN-values from proxclone’s, which uses 126 authentication attempts. Loclass is agnostic regarding what CSNs have been used during the authentication attempts.There is more work to be done, in order to dump an elite card using proxmark.
Forum users midnitesnake and penturaprox wrote functionality to dump standard iclass tags, but I’ve not succeeded in dumping elite cards as of yet - unfortunately I don’t have access to an elite card right now, but I hope to be able to finish that part later.2014-08-10.
RFID projects have been pretty prominent recently, ranging from projects here in Instructables, to our local Silicon Chip magazine in Australia publishing a RFID door lock project in their November issue. Even I recently purchased a RFID door lock on eBay for $15 to lock my garage (so my front neighbor could get tools if he wanted to).We have known that the cheaper RFID technologies were pretty insecure for a number of years. Researchers have demonstrated cloners of all varieties, but simple RFID tags are still being used for access control. Even my current employer uses them.A while ago, I was looking at Hack A Day, and I saw an amazing project that somebody had made.
It was an on it. For the next couple of days, I couldn't get the image of the card out of my mind; the project reminded me of how much I wanted to build a RFID spoofer myself. RFID, or Radio Frequency IDentification is the term used to describe a wide variety of standards that allow data stored within electronic 'tags' to be read by a reader without using wires. There are a number of standards, encoding formats, and frequencies in common use. I will describe the 125 kHz standard that is common for access control mechanisms.125 kHz RFID tags are commonly encased in a business card sized piece of plastic, or a round disk.
The tag consists of a coil of wire, connected to a microchip. When the tag is brought into close proximity to a reader, energy is coupled inductively from the reader to the microchip within the tag.The energy from the reader has dual use; firstly, it provides power to run the card, and secondly, it provides a communication medium for data to be transmitted. Once powered up, the tag modulates the bit pattern that is programmed into the tag using a signal that the reader can detect. The reader then reads this bit pattern, and passes it onto the door controller. If the bit pattern matches one that is authorised, the door will be unlocked. If the bit pattern does not match an authorised one, then the door won't unlock.In the RFID system I was playing with, the bit pattern looked like this;0000I will describe what this pattern actually means in the next page.One interesting feature of the data transfer between the card and the reader, is that data is encoded using Manchester Encoding, which is a way of encoding data so that it can be transmitted over a single wire ensuring that the clock information is able to be recovered easily.
With Manchester encoding, there is always a transition in the middle of a bit. If you want to transmit a 1, the transition would be from low to high, and if you want to transmit a 0, the transition would from from high to low. Because the transitions are in the middle of each bit, you can ensure that you have locked onto valid data.
For a detailed description, have a look a this.The actual data is transmitted by the card effectively shorting the coil out - this applies an additional load to the transmitter in the reader, which can be detected. I started by building a RFID card reader (more details in a future article). That showed me the data that was being sent when the card transmitted its information.The RFID cards that I brought have numbers printed on the back of them. So the next step was to identify how to pretend to be a card - I wanted a card that I could type a card number into, so it had to have a microprocessor on it, was well as a keypad to allow the data to be keyed in.The ATMega manipulates the 125kHz RF field by using a bridge rectifier. When the output of the micro is low, the diodes in the bridge are allowed to be turned on by the current induced in the coil, this effectively short it out.
Rfid Cloner
The reader detects the additional load, and a bit transition is detected.The job of the micro is simply to turn the output on and off in a way that makes sense to our reader. So I created a board that had the micro, a power supply, keypad, and some status LEDs on it.The attached PDF is the full schematic of the project.You may notice that c6 is 0pF - That is intentional c6 is a placeholder component allowing me to either use a 1000pF surface mount cap, or a 1000pF through hole cap.The coil is 100 turns of fine wire would on an open former that is just smaller than the card border. The software was next. Using the Arduino IDE, I implemented a simple menu system that allowed me to enter the relevant facility and CardID data directly from the keypad. I also provided a way of displaying the data using the LEDs that I mounted on the board.One problem I came across, was when I was calculating the card data (parity and checksum) on the fly - To be read successfully, the card has to output data in real time (most readers need a number of sequential valid reads), and adding subroutine and calculation delays caused the card to output invalid data as far as the reader was concerned. I worked around this problem by populating an array of bits that gets sent when the card is in transmit more.
That way, the calculations are done only once.When the card is powered up, it waits for the 'mode' button to be pressed. The current mode number is displayed using a set of 4 LEDs. Each press on the 'mode' button increments the current mode. Once the correct mode is displayed, then the 'enter' key starts that function executing. MODE 1 - Enter low power (sleep) modeThe card enters a low power mode, waiting for the reset button to be pressed to re-awaken it MODE 2 - Enter a Hex Facility IDThe card waits for 2 digits to be entered signifying the facility code for this system (In this case, it is 2C) - The software defaults to 2C - so this does not need to be entered. MODE 3 - Decimal Card IDThe card waits for 8 digits to be entered signifying the CardID for the card to be spoofed (In this case, it is 07820706) - This is the long number printed on the back of the card, not the 119,21922 number. MODE 4 - Dump the facility and Card IDThe Facility and Card ID are Dumped as Hex numbers using the 4 Leds at the top of the card.
MODE 5 - Emulate a cardThe card enters emulation mode - all LEDs are turned off. Emulation mode can only be exited by pressing the reset button.The software relies on Mark Stanley's and Alexander Brevig's Keypad Library Attachments. To keep the project the same size as a normal prox card, I decided to make it on a small PCB that was the same size as a business card.I decided to use surface mount push buttons that I brought from eBay, so that meant that all of the components must be soldered onto the copper side of the PCB to allow the buttons to be mounted and labeled.I started by soldering the push buttons, then I mounted the LEDs, resistors and capacitors. I had to install the 16MHz crystal on the bottom of the PCB, as I did not have a surface mount crystal. I also installed 12 jumpers on the back of the card to connect the key columns together.The ATMega168 was mounted next.
I did not use a socket, as I wanted to reduce the board thickness.Next, I wound the coil - I used a piece of scrap timber, with 4 screws mounted on it, and counted 100 turns of 0.25mm diameter coil winding wire. Before I removed the coil from the mounts, I wound a small amount of clear tape around each edge to make sure that the coil didn't unwind.Then, I mounted the coil on the back of the PCB, along with a small battery holder.I was pretty happy with the result of my handiwork. I used a standard 6 pin header mounted on the PCB to allow a FTDI 5V USB-232 cable to be used to program the chip in-situ - this was especially important, as the ATMega chip is soldered directly to the PCB, so it couldn't be removed for insertion into a normal Arduino PCB- This is a small price to pay to have a nice compact project.The chip was programmed using the.pde Arduino sketch that was supplied in Step 4 - using the normal Arduino IDE.The.PDE file that I have provided is tailored to the standard cheap eBay RFID systems. It is not the version for the other IFID readers I have access too. (I just thought I would mention that:-) ). This was a 'to prove I could do it' project - I have completed it, so it now sits on my shelf at work to remind others that simple RFID systems are simply not secure.You are welcome to adapt the project however you would like to, and while you may have the skeleton keys to the kingdom, you still need the little numbers on the back of the access card before you can use the key yourself.I have considered modifying my card so that it works as all of the compatible RFID tags that I hold. In my job, I need have access to multiple work sites, and it would be great to use the one card, but I don't think that would be a great idea.
Will this work on all RFID sytems?No it won't. This is a good thing.The first RFID systems deployed years ago used very simple protocols, based on the intelligence of the chip in the card - They also used a low frequency (125kHz) carrier.More modern systems use a number of techniques to ensure security, such as one time codes; cryptography; use bi-directional communication; use internal passwords, and use much higher frequencies. So spoofing these systems is a lot more work.But there are a large number of low tech systems in place now. The only way that it is similar is that they both use RFID but, most credit cards do not use RFID because it is so insecure. Credit/debit cards use Pin and Chip technology which requires the card to be inserted much like the magnetic swipe, as the information is read from the chip.
Iclass Rfid Hacking Video
However, if the card reader is compromised, you are out of luck. This tech is more similar to the RFID implants you have on your pets or it is exactly like those cards you see at low security doctors offices and what not. Basically, it's a reader for id chips which includes but is not limited to credit/debit cards. Simply owning or using such a device on a stranger is most likely illegal in all states, but is a useful tool in discovering someone's identity, for example. This nation (U.S.) was founded on the principle of overthrowing any government which condemned the people from the freedoms of the constitution. We are thereby granted the right by founding fathers to hold equal technology and protection against any government. Anyone who otherwise affects these freedoms should be imprisoned and or deported for treason against the American people.
I have NEVER heard of a dentist or ENT doctor putting an RFID chip in a patient. And I'm hearing impaired. However, I know some doctors do and a lot of wetware body hackers do.I havent ever heard of anyone using those chips to torture anyone either though.
I mean you would have to know the person has the chip for one.Not saying it isnt a possibility, just that ive never heard of it. I do know the chips are becoming more popular though. But I dont think you can actually block an object from inducing a current in a chip with anything short of a faraday cage around the chip you want to protect. But then that would make it unreadable period.