Zigfrid – A Passive RFID Fuzzer

https://z4ziggy.wordpress.com/2017/07/21/zigfrid-a-passive-rfid-fuzzer/

by wolframio • 9 years ago

128 29 9 years ago

z4ziggy.wordpress.com

IshKebab• 9 years ago

Somehow this post skips an explanation of what it actually does. It's a passive RFID tag that sends 40 bits of data (5 bytes). The bits are changed in sequence. More of a brute force attack than a fuzzer.

geekuillaume• 9 years ago

From the comments in the source, the code needs 20 clock cycles to send a new tag, it's running at 125kHz and each tag is 40 bits long. How can this device bruteforce the tag at this rate? Won't it be extremely slow compared to the number of possible tags?

revelation• 9 years ago

It will be and most software on the other end likely isn't prepared to even read tags at that speed. Fun hack though.

moron4hire• 9 years ago

125kHz is the transmission frequency. It's one of the unregulated frequencies for RFID tags, but sort of an industry standard value commonly used in retail products and goats. Most other cattle use tags at 134kHz. NFC is mostly just RFID at 13.56mHz.

TheSoftwareGuy3• 9 years ago

Well let's do the math

125 kHz 2 bits/cycle = 250 bits /sec

A 2^40 bit string has 1099511627776 combinations, and would require 1099511627776 40 = 43980465111040 bits to besent to try all of them. That would take 43980465111040/250 seconds or about 5575 years

And that's under ideal "spherical object in a vacuum" conditions.

So yeah your right, unless they get lucky.

ckdarby• 9 years ago

Wouldn't the readers be designed against this sort of attack?

EvanAnderson• 9 years ago

One would hope.

The small amount of IT security work I've done has taught me that such hopes are quickly and frequently dashed. Even products specifically designed for security applications have silly glaring vulnerabilities.

Rjevski2• 9 years ago

The high-end MIFARE-based systems would be - there's actual crypto happening between the reader and card, no way to bruteforce that.

However most keycard systems in the real world use a dumb unencrypted card that broadcasts an ID. This is vulnerable to sniffing, cloning as well as bruteforce (as this project demonstrates).

londons_explore• 9 years ago

Seems it would be better to use a pseudorandom number generator to just test a random selection of tags

ivanbakel• 9 years ago

Wonder if there's some sort of low-power hardware-easy problem you could use to reduce the request rate for individuals, instead of just shutting the device down when it detects a brute-force attempt. Seems to me that having hardware that breaks inconspicuously means you can't leave it as unmanned as you'd want to.

joshvm• 9 years ago

With these kind of systems (like a parking meter) you could add a 2-3 second delay between each attempt. Most people wouldn't notice the slowdown, but it would make brute forcing so slow that it would be useless in the field. This also works for things like logins on websites where the time taken to authenticate can be a second or two without annoying the user (vs loading a page which should be instant).

There is absolutely no reason why anything RFID controlled, like a door mechanism, should allow key entries at full speed (3k keys/sec someone posted).

ynezz2• 9 years ago

It's usually easier and faster to get the sniff of the communication between MCU and the reader(UART,I2C,SPI,USB) in some cases you've to dump MCU's flash or EEPROM to get an idea about the keying scheme used in particular product range.

keyme• 9 years ago

Why bruteforce when you can just passively listen for a working code (once someone else uses their card)?

40 bits of bruteforce at 125khz, with every code being 40 bits long, results in 3125 codes/sec at best, thus it will take roughly 11 years.

Goopplesoft2• 9 years ago

They include a video of a parking garage being opened after just a few iterations. The code used in commercial applications could often be lower bits given criminal prosecution is a larger deterrent than code security. Although, OP may have set a specific range for that demo.

Goopplesoft2• 9 years ago

This made me wonder if iOS 11's CoreNFC API can be used in similar ways. It would be cool to consolidate my tags (building and office) if they speak NFC.

ynezz2• 9 years ago

You can do this with some cards/tags with rooted Android phone(some tweaks are needed in the NFC subsystem) with certain NFC chipsets. It needs to be card with broken crypto (Mifare) so you can obtain the password and then copy complete card's content. The door reader shouldn't rely on the card's UID (unique serial number) as this can't be spoofed, the chipsets doesn't allow this.

I don't waste time with closed systems, so I can't comment directly on iOS capabilities, but I would guess, that it's going to be almost impossible to make it working in such locked down iOS world.

aspenmayer2• 9 years ago

What Android versions/handsets/tweaks/etc do you recommend for NFC work?

eridius• 9 years ago

CoreNFC only allows for reading, not writing.

aspenmayer2• 9 years ago

I haven't seen any word on that yet, but it would likely require iOS 11 to be jailbroken. I only know of one jailbreak project that supports NFC on iOS, and only on iOS 10.

http://cydia.saurik.com/package/net.limneos.nfcwriter/

Description Supports iOS 10.0 to 10.2

NFCWriter for iOS!

$3.99

Use your iPhone's NFC Chip to its maximum!

As pre-seen in 9to5mac

Features:

-Read most common tag types

-Write tags

-Host Emulation Mode with limitations for now

-Manage and save your tags in one place.

-Perform actions based on your tag's contents.

-Read/Write NDEF messages

-Display information about your tags like Manufacturer, Tag Type, Serial Number, ATQA, SAK, Memory Size etc.

-Supported tag types are ISO 14443, Mifare , ISO 15693 , iCode SLIX, all of the NTAG series.

-Supported protocols are ISO 14443 and Mifare.

-Host Emulation Mode currently only allows you to set a custom Serial Number to your device and emulate a tag's serial number, no tag content emulation yet.

This new achievement enables you to use the NFC chip beyond iOS's limitations.

A professional must-have tool for IoT experts, NFC researchers, hobbyists and all of you that make good use of NFC technology.

Research for more Tag types and protocols is constant.

This is the first time that NFC chip on iPhone is used to this extent.

Check the screenshots and... Enjoy!

Limitations: - Supported devices are iPhone 6S, iPhone 6S Plus, iPhone SE, iPhone 7, iPhone 7 Plus. - iPhone 6 is under testing and not yet supported. - iOS 10 only for now, still working on iOS 9 compatibility.

contingencies• 9 years ago

I found the following interesting.

Using a curtain capacitors combo might initiate a DoS attack on the reader which will prevent legitimate tags from being read correctly after placing it against a reader only once. A hard reset to the reader will be required to resume work. Just FYI.

Seems like a cute way to create a diversionary scene or frustrate physical security personnel in physical pen testing.

Zigfrid – A Passive RFID Fuzzer

Related Stories