MIFARE Classic: exposing the static encrypted nonce variant [pdf]

https://eprint.iacr.org/2024/1275.pdf

250 95 2 years ago

eprint.iacr.org

jeffbee3• 2 years ago

"Should we buy a Chinese knockoff of MIFARE Classic" strikes me as a self-answering question, but I guess that's why I still haven't been promoted to CISO.

dave_universetf4• 2 years ago

The paper reports that the same backdoor seems to be present in some NXP and Infineon SKUs as well, including some manufactured in Europe.

janice1999• 2 years ago

They could have licensed the IP from the same company.

turtle_heck• 2 years ago

The end users of such cards are often not aware of the source, there's usually resellers that supply them who are always trying to save a buck here or there.

We have customers who use smartcards and we often need to read or write to them, during on-boarding they often have no clue what version or spec they are using and it often results in trial-and-error after they send us a few cards with little-to-no markings on them.

evanjrowley• 2 years ago

You might get promoted to CISO if you can come up with a creative way to quantify the risk. Risk management frameworks can communicate how the impact, likelihood, and possible responses would play out in dollar amounts. With a few proposed ideas for how different risk mitigations would affect the resulting residual risk, non-technical people may be able to adopt your vision for securing the enterprise.

Yes, it also means doing basic things like saying "security is important", "vulnerabilities are bad", and "supply chain risk should be addressed", etc. The more informed you are, the more of a pain this is, at least in my experience (disclaimer: I'm not a CISO).

TeMPOraL• 2 years ago

1) Frame as much of the risk in terms of reputation damage;

2) Present a huge dollar number to make it sound important;

3) Get promoted as everyone high-up implicitly understands that reputational damage is a fiction that never materializes in practice.

closeparen2• 2 years ago

Does a CISO even make this decision? Probably like a contractor hired by the building manager of an anonymous commercial real estate holding company.

lxgr6• 2 years ago

The question is usually a bit more complex, such as "should we rip out thousands of readers and gates in our buildings, or can we maybe get away with switching to hardened cards using the same protocol for a few more years".

Not that I'd recommend it, but in most companies, physical security doesn't have a limitless budget just like everything else.

nine_k2• 2 years ago

The problem is pretty serious, not an esoteric theoretically exploitable vulnerability, but a gaping hole. From the abstract:

Through empirical research, we discovered a hardware backdoor and successfully cracked its key. This backdoor enables any entity with knowledge of it to compromise all user-defined keys on these cards without prior knowledge, simply by accessing the card for a few minutes. Additionally, our investigation into older cards uncovered another hardware backdoor key that was common to several manufacturers.

fsckboy• 2 years ago

could somebody ELI5 the threat vector here? I'm not skeptical, I just don't know what to imagine.

backdoor implies somebody can "get in" to my rfid, but rfid's spend most of their time "off the grid". So when my rfid powers up, does the "host" who powered it up also need to be insecure or on an insecure/compromised net?

then... what capabilities would suddenly become possible; unlocking the door is already unlocked, my credit card is already all ready to spend...

or does it simply allow people passing me on the sidewalk to make a copy of my card?

borski7• 2 years ago

The idea is that by spending a few minutes with your card, someone can now clone it and impersonate you. Yes, they could already steal your card, but you might notice that. But if you leave it on your desk for a few minutes in your wallet, or IT “borrows” it to re-encode it, or any thousand of other ways to get a hold of your RFID card… it can be dumped, cloned, and you can be impersonated.

That’s the threat vector.

ethbr13• 2 years ago

Super curious to know how many common access control solutions flag unbalanced entries/exits.

E.g. if "John" badges in... and then 10 minutes later "John" badges in again...

Will most systems complain?

dave_universetf4• 2 years ago

In the case of this attack, somewhere between 40s and 30min of physical access, depending on how the card was set up. In the case of a hotel, the spicy card to clone would be the cleaning staff's, which conveniently also admits a reasonable explanation for the card going temporarily missing (e.g. abandon it one corridor over, oops must have dropped it while doing the rounds).

Depending on the specifics of a deployment, I'm guessing you could also use the card secrets to mint new cards that authenticate correctly to facility readers, but contain different information? But I don't know nearly enough about how these cards get used to know how much flexibility you get there.

guardiangod• 2 years ago

Most RFID card systems in the world uses MIFARE Classic due to its cost and long history.

MIFARE (not just the Classic family) have a UID (32 bits) and x blocks of encrypted data (12 for Classic). Each block is protected by a A key and a B key.

The earliest card system only uses UID for authentication ie. if the card says the right UID the card passes authentication.

Obviously, anyone can forge a card with said UID, so the latter system start to use the 12 encrypted fields for authentication. The card reader would challenge the card to encrypt the nonce plus stored identification. Only cards with the correct key can respond with the correct encrypted data + nonce.

The authentication uses symmetric encryption. Depending on how the system is setup, A key is used for Read only, Read Write, or A is used for read and B is used for write, or both A/B is need for read write.

The original Mifare Classic uses a proprietary crypto crypto-1. Due to various reasons (eg. weak PRNG, collisions, etc.) , it can be trivial to crack a traditional Mifare Classic key. However there are harden keys that still could not be cracked due to various countermeasures.

The paper seems to found a hardcoded A/B key A396EFA4E24F for a particular brand of RFID cards (I just skimped the paper and its been years since I worked on RFID. I might be wrong on the detail).

ale42• 2 years ago

The paper seems to found a hardcoded A/B key A396EFA4E24F for a particular brand of RFID cards (I just skimped the paper and its been years since I worked on RFID. I might be wrong on the detail).

Actually, if I understood the paper well, the same key worked also on older, non-Chinese cards like those produced by NXP. Why, that's a big question.

gillesjacobs• 2 years ago

This is also why chip implants from eg Dangerous Things with MIFARE were desirable: you could clone old MIFARE chips this way using some tools.

Sadly, neither my gym or work access card were cloneable even though they are MIFARE Classic. So I did not end up getting an implant.

stavros• 2 years ago

Would you happen to know of a good reference for this? I have a Proxmark and I'd like to learn how the encryption works so I can play around with (and maybe clone) some of my cards.

altairprime• 2 years ago

Backdoor root access to instantaneously clone any affected RFID card with one of the chipsets listed on the second to last page.

noddingham• 2 years ago

I've been involved with carding for 10+ years and issues with MIFARE Classic cards have been around and known for at least that long. Anyone in the carding industry will (should at the very least) tell you not to use them and move on to DESFire or some other newer safer chips. The introduction even says as much "By 2024, we all know MIFARE Classic is badly broken." If you're still deploying MIFARE Classic cards you reap what you sow.

jtriangle• 2 years ago

"carding" is also colloquially used to refer to people involved in credit card fraud online. Just FYI in case you get weird looks when you say that.

pajeets• 2 years ago

also attracts 3 letters when they see "carding" on clearnet

inopinatus• 2 years ago

To an Australian, the only allowable response is "that'll buff out".

astrobe_• 2 years ago

Yes, and more generally I've been baffled by the fact that manufacturers - including ARM-based SoCs with SecureBoot (or similar); you know, those PDF spec docuements that disable copy-paste and a nice "confidential" watermark - put their cyber-security stuff under NDA. As if it security-by-obscurity was still a thing.

minkles• 2 years ago

Yeah TFL killed them off starting 2010 in London due to this. I'm surprised this is even a thing now.

lxgr6• 2 years ago

Oyster has been using MIFARE DESfire, and stopped using MIFARE Classic, for over a decade now.

They're stopping it for completely unrelated reasons (primarily convenience – people don't like having to buy and top up a card – and not having to maintain a vending machine and top-up infrastructure).

znpy• 2 years ago

Yup… the vending machines at my university used to use mifare classic tokens with credit on such tokens… in like 2014 i was a student and ran out of money in the middle of july and barely had the money to buy a train ticket to go home for vacation… but thanks to mommy mifare i managed to survive on sandwiches from said vending machines for like two weeks.

Oh, to be young again.

dfox3• 2 years ago

The main point from that is that you should never do a system with stored value on a smart card. The vendors will show you various methods for that, but well it is 2024, just do that online (and the card is just an ID, which optionally can produce ECC signature of some challenge).

DaSHacka2• 2 years ago

My university had something similar, but with ID numbers correlated to each person in a database that recorded how many credits they had left.

Tapping the vending machine with your card sends the ID in plaintext over the wire to the upstream server, which responds in plaintext for the machine to either accept or reject the transaction.

Tomfoolery may or may not have been performed by a bunch of bored, hungry college students at 1AM one night...

stefan_• 2 years ago

These cards have hardware backdoors. Their generation or type doesn't matter.

adontz2• 2 years ago

MIFARE Classic are cheap and reliable, only their encryption is broken. One can use them as simple storage and encrypt/authenticate data by different means. Nothing wrong with that. I did that, ECC signatures are small enough to fit in 2K/4K cards.

nullc• 2 years ago

A signature fits but what good does it do you? The cards can't sign a challenge, and so someone with access to a valid card can just clone it. (or access to a card and reader, in the case encryption is used)

madjam002• 2 years ago

How does this relate to PKCS or cards using PKI? Are there access control systems out there that use this and is it more secure?

Or maybe there’s door access control systems out there that use FIDO2 :D

g_p• 2 years ago

There absolutely are access control systems out there using PKI. For example, the PIV specification (a la DOD CAC) slot 9e is intended for "card authentication" without a PIN typically being required.

PKCS based cards get all the benefits of smart cards (hard in theory to extract keys, side channel resistance, etc), with the usual risks (trust in vendors and issuers to not add backdoor APDUs to applets etc.)

Doubt anyone would want to use FIDO2 for a door access control system, but in theory there's nothing really to stop you, if you come up with a clever URI schema for your doors and know what public key to expect for each identity on each URI. That's where FIDO2 wouldn't be ideal, as you'd get a different identity on each URI, so it would only really work with a single URI (zone?) for the whole site, and implementing zone access checks at each individual verifier.

Realistically, doing a PIV style PKI verification would give you all the benefits of FIDO2, but also with the ability to handle card revocation etc via a CRL that's distributed through the system.

arjvik2• 2 years ago

Can I use a flipper zero to perform these attacks?

hoherd• 2 years ago

My guess is NFC -> Extra Actions -> MIFARE Classic Keys -> Add, but I don't have any Classic keys to test on right now.

arjvik2• 2 years ago

Oh, the existing MIFARE app already supports this new attack? That's awesome!

I was expecting to have to write some code for it!

I do have a flipper and a classic key, will test it out soon!

netsec_burn• 2 years ago

Not yet, I'm writing it. Will be available by the end of the month, feel free to follow the PR: https://github.com/flipperdevices/flipperzero-firmware/pull/...

bobnarizes• 2 years ago

This news about RFID vulnerabilities really highlights the importance of rethinking how we secure access to critical systems, especially in industrial environments. At Siemens, we’ve been working on a solution that addresses these exact concerns.

I’ve developed Unified Air, a new technology that allows factory workers to authenticate to production machines using the biometric sensors on their mobile devices—eliminating the need for insecure RFID cards altogether. Not only does this method enhance security by leveraging unique biometric data, but it also streamlines the authentication process, making it both faster and more reliable for operators.

If you’re interested in a more secure and user-friendly alternative to RFID, you can check out more details about Unified Air here: https://support.industry.siemens.com/cs/document/109827772/d...

hansoolo• 2 years ago

That's a pretty clever idea! How does the whole authentication process work exactly? What protocol is used, once the engineer used its biometrics?

lxgr6• 2 years ago

[...] authenticate to production machines using the biometric sensors on their mobile devices

How does adding a mobile phone with a significantly larger code and hardware base improve security?

eliminating the need for insecure RFID cards altogether.

Why not use a secure card system instead?

I can see the convenience factor, and that might well make for a more effective system all in all, but in terms of security, I don't see this as a step forward.

Thoreandan• 2 years ago

Non-PDF link w/ abstract: https://eprint.iacr.org/2024/1275

MIFARE Classic: exposing the static encrypted nonce variant

Cryptology ePrint Archive, Paper 2024/1275

author: Philippe Teuwen

Rant423• 2 years ago

Something like 8 years ago I used this tutorial to get unlimited food at the uni vending machine. Good times.

https://firefart.at/post/how-to-crack-mifare-classic-cards/

arnavpraneet• 2 years ago

Baader Meinhof effect but I spent the last two days trying to clone my uni's Mifare Classic 1K's because they refuse to reactivate my ID because it is faded.

MIFARE Classic: exposing the static encrypted nonce variant [pdf]

Related Stories