7 ms·

MIFARE Classic: exposing the static encrypted nonce variant [pdf]

jeffbee 2y ago
"Should we buy a Chinese knockoff of MIFARE Classic" strikes me as a self-answering question, but I guess that's why I still haven't been promoted to CISO.
- dave_universetf 2y ago
  The paper reports that the same backdoor seems to be present in some NXP and Infineon SKUs as well, including some manufactured in Europe.
  - janice1999 2y ago
    They could have licensed the IP from the same company.
    - dave_universetf 2y ago
      Possibly so. It just means that based on the report's findings, even if you'd decided to play it safe and buy exclusively from NXP directly (the creators of this ecosystem and owners of the MIFARE trademark), it looks like you could still end up with backdoored hardware.
      - jeffbee 2y ago
        Sorry if I was being unclear with my compound snark, but using a MIFARE Classic of any provenance would be a firing offense for the CISO of my daydream company.
        nine_k 2y ago
        What's a good alternative? How more expensive is it?
        Aiolo 2y ago
        MIFARE DESFire is an option. In a genral public reseller, I found 100 DESFire cards sold for 146€ (tax excluded), while 100 of the equivalent versions as MIFARE Classic are sold for 109€ (tax excluded). This is a differnce of 37 cents by card, MIFARE Classic are about 25% less expensive than MIFARE DESFire. I guess the difference increase with the quantity you buy at once.
        dave_universetf 2y ago
        Indeed. Alas (or fortunately depending which colour team you work on), fully broken Mifare Classic is still all over the place, and likewise the "hardened" variant broken in this paper :(
      - RockRobotRock 2y ago
        NXP would probably want to steer you away from mifare classic in the first place, wouldn't they?
        baby_souffle 2y ago
        Maybe for greenfield deployment… but there’s all the existing infrastructure to support. I still see classic being installed for door/gate systems in American apartments that are under active construction in 2024. Presumably that’s because resellers either don’t know better or they just have a massive inventory.
        jeffbee 2y ago
        I still see new apartment buildings with Sentex or Linear call boxes with the factory master passwords. I don't think these guys are crack security experts.
    - mzs 2y ago
      I think it's more likely those NXP/Infineon parts are counterfeits. Look at A.12, there are early cards that don't NACK $F000 but claim to be NXP or Infineon, behavior counter to legit parts. It looks like the Chinese copies started to chameleon that behavior later as well.
    - Haemm0r 2y ago
      ... or used the IP without licensing.
    - aragonite 2y ago
      They found the exact same backdoor key present on old NXP and Infineon cards produced as early as 1996. See p.11: > But, quite surprisingly, some other cards, aside from the Fudan ones, accept the same backdoor authentication commands using the same key as for the FM11RF08! > ... > - Infineon SLE66R35 possibly produced at least during a period 1996-20136 ; > - NXP MF1ICS5003 produced at least between 1998 and 2000 ; > - NXP MF1ICS5004 produced at least in 2001. > ... > Additionally, what are we to make of the fact that old NXP and Infineon cards share the very same backdoor key?
  - deleted 2y ago
    [deleted]
- turtle_heck 2y ago
  The end users of such cards are often not aware of the source, there's usually resellers that supply them who are always trying to save a buck here or there. We have customers who use smartcards and we often need to read or write to them, during on-boarding they often have no clue what version or spec they are using and it often results in trial-and-error after they send us a few cards with little-to-no markings on them.
- evanjrowley 2y ago
  You might get promoted to CISO if you can come up with a creative way to quantify the risk. Risk management frameworks can communicate how the impact, likelihood, and possible responses would play out in dollar amounts. With a few proposed ideas for how different risk mitigations would affect the resulting residual risk, non-technical people may be able to adopt your vision for securing the enterprise. Yes, it also means doing basic things like saying "security is important", "vulnerabilities are bad", and "supply chain risk should be addressed", etc. The more informed you are, the more of a pain this is, at least in my experience (disclaimer: I'm not a CISO).
  - TeMPOraL 2y ago
    1) Frame as much of the risk in terms of reputation damage; 2) Present a huge dollar number to make it sound important; 3) Get promoted as everyone high-up implicitly understands that reputational damage is a fiction that never materializes in practice.
    - borski 2y ago
      That’s not how CISOs get promoted. If a CISO presented it this way, the very obvious next question is “and how much will it cost us to fix” followed by “and how much will insurance cover,” which are both going to blow the reputational damage argument out of the water. CISOs get promoted by being willing to focus on compliance over security, so that they can cover the company if and when it inevitably gets breached by saying they “followed best practices” (if that’s true). All of this is because resolving a breach and giving everyone a year of identity theft protection is a lot less expensive, short-term, than actually investing in a real security practice, and companies in the US think in quarters, not years. Europe is better about this because they tend to think many years ahead rather than focusing on short-term results.
- closeparen 2y ago
  Does a CISO even make this decision? Probably like a contractor hired by the building manager of an anonymous commercial real estate holding company.
- lxgr 2y ago
  The question is usually a bit more complex, such as "should we rip out thousands of readers and gates in our buildings, or can we maybe get away with switching to hardened cards using the same protocol for a few more years". Not that I'd recommend it, but in most companies, physical security doesn't have a limitless budget just like everything else.
nine_k 2y ago
The problem is pretty serious, not an esoteric theoretically exploitable vulnerability, but a gaping hole. From the abstract: > Through empirical research, we discovered a hardware backdoor and successfully cracked its key. This backdoor enables any entity with knowledge of it to compromise all user-defined keys on these cards without prior knowledge, simply by accessing the card for a few minutes. Additionally, our investigation into older cards uncovered another hardware backdoor key that was common to several manufacturers.
- deleted 2y ago
  [deleted]
- deleted 2y ago
  [deleted]
fsckboy 2y ago
could somebody ELI5 the threat vector here? I'm not skeptical, I just don't know what to imagine. backdoor implies somebody can "get in" to my rfid, but rfid's spend most of their time "off the grid". So when my rfid powers up, does the "host" who powered it up also need to be insecure or on an insecure/compromised net? then... what capabilities would suddenly become possible; unlocking the door is already unlocked, my credit card is already all ready to spend... or does it simply allow people passing me on the sidewalk to make a copy of my card?
- borski 2y ago
  The idea is that by spending a few minutes with your card, someone can now clone it and impersonate you. Yes, they could already steal your card, but you might notice that. But if you leave it on your desk for a few minutes in your wallet, or IT “borrows” it to re-encode it, or any thousand of other ways to get a hold of your RFID card… it can be dumped, cloned, and you can be impersonated. That’s the threat vector.
  - ethbr1 2y ago
    Super curious to know how many common access control solutions flag unbalanced entries/exits. E.g. if "John" badges in... and then 10 minutes later "John" badges in again... Will most systems complain?
    - emag 2y ago
      From experience, more places than you'd expect only have you badging in one direction and not both.
      - padthai 2y ago
        Probably fire safety laws
        dingnuts 2y ago
        Yes, locking people into buildings (which is what you are doing if you need a key to get out, whether it's an RFID badge or a skeleton key) has been illegal since the Triangle Shirtwaist Factory Fire
deleted 2y ago
[deleted]
deleted 2y ago
[deleted]
noddingham 2y ago
I've been involved with carding for 10+ years and issues with MIFARE Classic cards have been around and known for at least that long. Anyone in the carding industry will (should at the very least) tell you not to use them and move on to DESFire or some other newer safer chips. The introduction even says as much "By 2024, we all know MIFARE Classic is badly broken." If you're still deploying MIFARE Classic cards you reap what you sow.
- jtriangle 2y ago
  "carding" is also colloquially used to refer to people involved in credit card fraud online. Just FYI in case you get weird looks when you say that.
  - pajeets 2y ago
    also attracts 3 letters when they see "carding" on clearnet
    - corn13read2 2y ago
      3 letters and clearnet in conjunction I’m sure won’t garner attention
  - deleted 2y ago
    [deleted]
  - inopinatus 2y ago
    To an Australian, the only allowable response is "that'll buff out".
- astrobe_ 2y ago
  Yes, and more generally I've been baffled by the fact that manufacturers - including ARM-based SoCs with SecureBoot (or similar); you know, those PDF spec docuements that disable copy-paste and a nice "confidential" watermark - put their cyber-security stuff under NDA. As if it security-by-obscurity was still a thing.
- 2y ago
madjam002 2y ago
How does this relate to PKCS or cards using PKI? Are there access control systems out there that use this and is it more secure? Or maybe there’s door access control systems out there that use FIDO2 :D
- g_p 2y ago
  There absolutely are access control systems out there using PKI. For example, the PIV specification (a la DOD CAC) slot 9e is intended for "card authentication" without a PIN typically being required. PKCS based cards get all the benefits of smart cards (hard in theory to extract keys, side channel resistance, etc), with the usual risks (trust in vendors and issuers to not add backdoor APDUs to applets etc.) Doubt anyone would want to use FIDO2 for a door access control system, but in theory there's nothing really to stop you, if you come up with a clever URI schema for your doors and know what public key to expect for each identity on each URI. That's where FIDO2 wouldn't be ideal, as you'd get a different identity on each URI, so it would only really work with a single URI (zone?) for the whole site, and implementing zone access checks at each individual verifier. Realistically, doing a PIV style PKI verification would give you all the benefits of FIDO2, but also with the ability to handle card revocation etc via a CRL that's distributed through the system.
arjvik 2y ago
Can I use a flipper zero to perform these attacks?
- hoherd 2y ago
  My guess is NFC -> Extra Actions -> MIFARE Classic Keys -> Add, but I don't have any Classic keys to test on right now.
  - arjvik 2y ago
    Oh, the existing MIFARE app already supports this new attack? That's awesome! I was expecting to have to write some code for it! I do have a flipper and a classic key, will test it out soon!
    - 0fr 2y ago
      It should not work (yet), at least not the official firmware or the RogueMaster. It requires special auth command(s) instead of the usual. Hopefully soon tho!
- netsec_burn 2y ago
  Not yet, I'm writing it. Will be available by the end of the month, feel free to follow the PR: https://github.com/flipperdevices/flipperzero-firmware/pull/3822 https://github.com/flipperdevices/flipperzero-firmware/pull/...
bobnarizes 2y ago
This news about RFID vulnerabilities really highlights the importance of rethinking how we secure access to critical systems, especially in industrial environments. At Siemens, we’ve been working on a solution that addresses these exact concerns. I’ve developed Unified Air, a new technology that allows factory workers to authenticate to production machines using the biometric sensors on their mobile devices—eliminating the need for insecure RFID cards altogether. Not only does this method enhance security by leveraging unique biometric data, but it also streamlines the authentication process, making it both faster and more reliable for operators. If you’re interested in a more secure and user-friendly alternative to RFID, you can check out more details about Unified Air here: https://support.industry.siemens.com/cs/document/109827772/delivery-release-simatic-unified-air?dti=0&lc=en-WW https://support.industry.siemens.com/cs/document/109827772/d...
- hansoolo 2y ago
  That's a pretty clever idea! How does the whole authentication process work exactly? What protocol is used, once the engineer used its biometrics?
- lxgr 2y ago
  > [...] authenticate to production machines using the biometric sensors on their mobile devices How does adding a mobile phone with a significantly larger code and hardware base improve security? > eliminating the need for insecure RFID cards altogether. Why not use a secure card system instead? I can see the convenience factor, and that might well make for a more effective system all in all, but in terms of security, I don't see this as a step forward.
Thoreandan 2y ago
Non-PDF link w/ abstract: https://eprint.iacr.org/2024/1275 https://eprint.iacr.org/2024/1275 MIFARE Classic: exposing the static encrypted nonce variant Cryptology ePrint Archive, Paper 2024/1275 author: Philippe Teuwen
deleted 2y ago
[deleted]
Rant423 2y ago
Something like 8 years ago I used this tutorial to get unlimited food at the uni vending machine. Good times. https://firefart.at/post/how-to-crack-mifare-classic-cards/ https://firefart.at/post/how-to-crack-mifare-classic-cards/
arnavpraneet 2y ago
Baader Meinhof effect but I spent the last two days trying to clone my uni's Mifare Classic 1K's because they refuse to reactivate my ID because it is faded.

"Should we buy a Chinese knockoff of MIFARE Classic" strikes me as a self-answering question, but I guess that's why I still haven't been promoted to CISO.

dave_universetf 2y ago
The paper reports that the same backdoor seems to be present in some NXP and Infineon SKUs as well, including some manufactured in Europe.
- janice1999 2y ago
  They could have licensed the IP from the same company.
  - dave_universetf 2y ago
    Possibly so. It just means that based on the report's findings, even if you'd decided to play it safe and buy exclusively from NXP directly (the creators of this ecosystem and owners of the MIFARE trademark), it looks like you could still end up with backdoored hardware.
    - jeffbee 2y ago
      Sorry if I was being unclear with my compound snark, but using a MIFARE Classic of any provenance would be a firing offense for the CISO of my daydream company.
      - nine_k 2y ago
        What's a good alternative? How more expensive is it?
        Aiolo 2y ago
        MIFARE DESFire is an option. In a genral public reseller, I found 100 DESFire cards sold for 146€ (tax excluded), while 100 of the equivalent versions as MIFARE Classic are sold for 109€ (tax excluded). This is a differnce of 37 cents by card, MIFARE Classic are about 25% less expensive than MIFARE DESFire. I guess the difference increase with the quantity you buy at once.
      - dave_universetf 2y ago
        Indeed. Alas (or fortunately depending which colour team you work on), fully broken Mifare Classic is still all over the place, and likewise the "hardened" variant broken in this paper :(
    - RockRobotRock 2y ago
      NXP would probably want to steer you away from mifare classic in the first place, wouldn't they?
      - baby_souffle 2y ago
        Maybe for greenfield deployment… but there’s all the existing infrastructure to support. I still see classic being installed for door/gate systems in American apartments that are under active construction in 2024. Presumably that’s because resellers either don’t know better or they just have a massive inventory.
        jeffbee 2y ago
        I still see new apartment buildings with Sentex or Linear call boxes with the factory master passwords. I don't think these guys are crack security experts.
  - mzs 2y ago
    I think it's more likely those NXP/Infineon parts are counterfeits. Look at A.12, there are early cards that don't NACK $F000 but claim to be NXP or Infineon, behavior counter to legit parts. It looks like the Chinese copies started to chameleon that behavior later as well.
  - Haemm0r 2y ago
    ... or used the IP without licensing.
  - aragonite 2y ago
    They found the exact same backdoor key present on old NXP and Infineon cards produced as early as 1996. See p.11: > But, quite surprisingly, some other cards, aside from the Fudan ones, accept the same backdoor authentication commands using the same key as for the FM11RF08! > ... > - Infineon SLE66R35 possibly produced at least during a period 1996-20136 ; > - NXP MF1ICS5003 produced at least between 1998 and 2000 ; > - NXP MF1ICS5004 produced at least in 2001. > ... > Additionally, what are we to make of the fact that old NXP and Infineon cards share the very same backdoor key?
- deleted 2y ago
  [deleted]
turtle_heck 2y ago
The end users of such cards are often not aware of the source, there's usually resellers that supply them who are always trying to save a buck here or there. We have customers who use smartcards and we often need to read or write to them, during on-boarding they often have no clue what version or spec they are using and it often results in trial-and-error after they send us a few cards with little-to-no markings on them.
evanjrowley 2y ago
You might get promoted to CISO if you can come up with a creative way to quantify the risk. Risk management frameworks can communicate how the impact, likelihood, and possible responses would play out in dollar amounts. With a few proposed ideas for how different risk mitigations would affect the resulting residual risk, non-technical people may be able to adopt your vision for securing the enterprise. Yes, it also means doing basic things like saying "security is important", "vulnerabilities are bad", and "supply chain risk should be addressed", etc. The more informed you are, the more of a pain this is, at least in my experience (disclaimer: I'm not a CISO).
- TeMPOraL 2y ago
  1) Frame as much of the risk in terms of reputation damage; 2) Present a huge dollar number to make it sound important; 3) Get promoted as everyone high-up implicitly understands that reputational damage is a fiction that never materializes in practice.
  - borski 2y ago
    That’s not how CISOs get promoted. If a CISO presented it this way, the very obvious next question is “and how much will it cost us to fix” followed by “and how much will insurance cover,” which are both going to blow the reputational damage argument out of the water. CISOs get promoted by being willing to focus on compliance over security, so that they can cover the company if and when it inevitably gets breached by saying they “followed best practices” (if that’s true). All of this is because resolving a breach and giving everyone a year of identity theft protection is a lot less expensive, short-term, than actually investing in a real security practice, and companies in the US think in quarters, not years. Europe is better about this because they tend to think many years ahead rather than focusing on short-term results.
closeparen 2y ago
Does a CISO even make this decision? Probably like a contractor hired by the building manager of an anonymous commercial real estate holding company.
lxgr 2y ago
The question is usually a bit more complex, such as "should we rip out thousands of readers and gates in our buildings, or can we maybe get away with switching to hardened cards using the same protocol for a few more years". Not that I'd recommend it, but in most companies, physical security doesn't have a limitless budget just like everything else.

nine_k 2y ago

The problem is pretty serious, not an esoteric theoretically exploitable vulnerability, but a gaping hole. From the abstract: > Through empirical research, we discovered a hardware backdoor and successfully cracked its key. This backdoor enables any entity with knowledge of it to compromise all user-defined keys on these cards without prior knowledge, simply by accessing the card for a few minutes. Additionally, our investigation into older cards uncovered another hardware backdoor key that was common to several manufacturers.

deleted 2y ago
[deleted]
deleted 2y ago
[deleted]

fsckboy 2y ago

could somebody ELI5 the threat vector here? I'm not skeptical, I just don't know what to imagine. backdoor implies somebody can "get in" to my rfid, but rfid's spend most of their time "off the grid". So when my rfid powers up, does the "host" who powered it up also need to be insecure or on an insecure/compromised net? then... what capabilities would suddenly become possible; unlocking the door is already unlocked, my credit card is already all ready to spend... or does it simply allow people passing me on the sidewalk to make a copy of my card?

borski 2y ago
The idea is that by spending a few minutes with your card, someone can now clone it and impersonate you. Yes, they could already steal your card, but you might notice that. But if you leave it on your desk for a few minutes in your wallet, or IT “borrows” it to re-encode it, or any thousand of other ways to get a hold of your RFID card… it can be dumped, cloned, and you can be impersonated. That’s the threat vector.
- ethbr1 2y ago
  Super curious to know how many common access control solutions flag unbalanced entries/exits. E.g. if "John" badges in... and then 10 minutes later "John" badges in again... Will most systems complain?
  - emag 2y ago
    From experience, more places than you'd expect only have you badging in one direction and not both.
    - padthai 2y ago
      Probably fire safety laws
      - dingnuts 2y ago
        Yes, locking people into buildings (which is what you are doing if you need a key to get out, whether it's an RFID badge or a skeleton key) has been illegal since the Triangle Shirtwaist Factory Fire

deleted 2y ago

[deleted]

deleted 2y ago

[deleted]

noddingham 2y ago

I've been involved with carding for 10+ years and issues with MIFARE Classic cards have been around and known for at least that long. Anyone in the carding industry will (should at the very least) tell you not to use them and move on to DESFire or some other newer safer chips. The introduction even says as much "By 2024, we all know MIFARE Classic is badly broken." If you're still deploying MIFARE Classic cards you reap what you sow.

jtriangle 2y ago
"carding" is also colloquially used to refer to people involved in credit card fraud online. Just FYI in case you get weird looks when you say that.
- pajeets 2y ago
  also attracts 3 letters when they see "carding" on clearnet
  - corn13read2 2y ago
    3 letters and clearnet in conjunction I’m sure won’t garner attention
- deleted 2y ago
  [deleted]
- inopinatus 2y ago
  To an Australian, the only allowable response is "that'll buff out".
astrobe_ 2y ago
Yes, and more generally I've been baffled by the fact that manufacturers - including ARM-based SoCs with SecureBoot (or similar); you know, those PDF spec docuements that disable copy-paste and a nice "confidential" watermark - put their cyber-security stuff under NDA. As if it security-by-obscurity was still a thing.
2y ago

madjam002 2y ago

How does this relate to PKCS or cards using PKI? Are there access control systems out there that use this and is it more secure? Or maybe there’s door access control systems out there that use FIDO2 :D

g_p 2y ago
There absolutely are access control systems out there using PKI. For example, the PIV specification (a la DOD CAC) slot 9e is intended for "card authentication" without a PIN typically being required. PKCS based cards get all the benefits of smart cards (hard in theory to extract keys, side channel resistance, etc), with the usual risks (trust in vendors and issuers to not add backdoor APDUs to applets etc.) Doubt anyone would want to use FIDO2 for a door access control system, but in theory there's nothing really to stop you, if you come up with a clever URI schema for your doors and know what public key to expect for each identity on each URI. That's where FIDO2 wouldn't be ideal, as you'd get a different identity on each URI, so it would only really work with a single URI (zone?) for the whole site, and implementing zone access checks at each individual verifier. Realistically, doing a PIV style PKI verification would give you all the benefits of FIDO2, but also with the ability to handle card revocation etc via a CRL that's distributed through the system.

arjvik 2y ago

Can I use a flipper zero to perform these attacks?

hoherd 2y ago
My guess is NFC -> Extra Actions -> MIFARE Classic Keys -> Add, but I don't have any Classic keys to test on right now.
- arjvik 2y ago
  Oh, the existing MIFARE app already supports this new attack? That's awesome! I was expecting to have to write some code for it! I do have a flipper and a classic key, will test it out soon!
  - 0fr 2y ago
    It should not work (yet), at least not the official firmware or the RogueMaster. It requires special auth command(s) instead of the usual. Hopefully soon tho!
netsec_burn 2y ago
Not yet, I'm writing it. Will be available by the end of the month, feel free to follow the PR: https://github.com/flipperdevices/flipperzero-firmware/pull/3822 https://github.com/flipperdevices/flipperzero-firmware/pull/...

bobnarizes 2y ago

This news about RFID vulnerabilities really highlights the importance of rethinking how we secure access to critical systems, especially in industrial environments. At Siemens, we’ve been working on a solution that addresses these exact concerns. I’ve developed Unified Air, a new technology that allows factory workers to authenticate to production machines using the biometric sensors on their mobile devices—eliminating the need for insecure RFID cards altogether. Not only does this method enhance security by leveraging unique biometric data, but it also streamlines the authentication process, making it both faster and more reliable for operators. If you’re interested in a more secure and user-friendly alternative to RFID, you can check out more details about Unified Air here: https://support.industry.siemens.com/cs/document/109827772/delivery-release-simatic-unified-air?dti=0&lc=en-WW https://support.industry.siemens.com/cs/document/109827772/d...

hansoolo 2y ago
That's a pretty clever idea! How does the whole authentication process work exactly? What protocol is used, once the engineer used its biometrics?
lxgr 2y ago
> [...] authenticate to production machines using the biometric sensors on their mobile devices How does adding a mobile phone with a significantly larger code and hardware base improve security? > eliminating the need for insecure RFID cards altogether. Why not use a secure card system instead? I can see the convenience factor, and that might well make for a more effective system all in all, but in terms of security, I don't see this as a step forward.

Thoreandan 2y ago

Non-PDF link w/ abstract: https://eprint.iacr.org/2024/1275 https://eprint.iacr.org/2024/1275 MIFARE Classic: exposing the static encrypted nonce variant Cryptology ePrint Archive, Paper 2024/1275 author: Philippe Teuwen

deleted 2y ago

[deleted]

Rant423 2y ago

Something like 8 years ago I used this tutorial to get unlimited food at the uni vending machine. Good times. https://firefart.at/post/how-to-crack-mifare-classic-cards/ https://firefart.at/post/how-to-crack-mifare-classic-cards/

arnavpraneet 2y ago

Baader Meinhof effect but I spent the last two days trying to clone my uni's Mifare Classic 1K's because they refuse to reactivate my ID because it is faded.