6 ms·

Coercing a Magic MIFARE credential into being an iPhone-compatible NFC tag

92 points by ewpratten 2y ago

randomcatuser 2y ago
so cool! anyone have any recs for cheap cards (or hardware) that is scannable on iphones?
- walterbell 2y ago
  The cheapest RFID/NFC "card" tag is an expired tap-to-use transit ticket. It has a unique ID that can be used to trigger an iOS Shortcut to take any action, e.g. speak an audio description, open URL, open app, etc. For purchase, there are many form factors: https://store.gototags.com/nfc-tags https://store.gototags.com/nfc-tags On Amazon, search NTAG215.
  - immibis 2y ago
    If your city doesn't use NFC transit, you can also buy a box of blank cards. They have unique IDs like transit tickets, even without being programmed.
  - stavros 2y ago
    NTAG215 isn't "magic", right? I have a bunch of NTAG215 stickers and I'm not entirely sure what their difference is with magic cards.
    - ewpratten 2y ago
      Think of it like a subset of MIFARE. In a simple sense, NTAG cards can do NFC things, but MIFARE can do lots more (access control for example)..and also NFC things..somewhat. Magic mifare refers to special cards that let you bypass the write-lock of genuine mifare cards. These are mostly used for cloning keys (either for red-team pentesting or for people who want a copy of an office key for whatever reason)
      - stavros 2y ago
        Ah, thanks, so I guess to write tags like URLs and things I don't really need Mifare cards, the NTAG cards are fine. Thanks for the info!
      - lxgr 2y ago
        It's not really a subset: MIFARE Classic uses a proprietary and mandatory encryption/authentication algorithm and is therefore not ISO 14443-4 compliant. As a result, NFC-compliant readers don't need to support it, and in fact non-NXP ones (including many popular Android phones) usually don't. On the other hand, as you say, MIFARE Classic supports capabilities beyond NFC/NDEF, but there are fully NFC-compliant tags that do so as well (e.g. MIFARE DESfire, which properly stacks encryption in an ISO 14443-4 compliant way).
- ewpratten 2y ago
  Many of my cards are just repurposed from other things. Lots of hotel keycards can be rewritten to open URLs on phones for example. I actually have a hotel keycard taped to my washing machine to do some laundry-based automation with my phone. Maybe I should write about that sometime..
  - Eisenstein 2y ago
    Have you thought about getting one implanted?
    - ewpratten 2y ago
      (glances at chip on my desk) ..yes. Hopefully getting that installed later this week :)
    - lxgr 2y ago
      If you're getting an implant already, why not make it an actual smartcard that you can use for WebAuthN, GPG, SSH etc.? :) On the other hand, the fear of permanently bricking it or messing up the GlobalPlatform card management key has so far prevented me from doing it myself...
      - Eisenstein 2y ago
        Because those cost $350 as opposed to $89, and the install only costs $60, and there is no stopping you from implanting more than one in different locations. Many people get the small xEM or xM1 first to play with. * https://dangerousthings.com/product/apex-flex/ https://dangerousthings.com/product/apex-flex/ * https://dangerousthings.com/product/xm1/ https://dangerousthings.com/product/xm1/
        lxgr 2y ago
        > there is no stopping you from implanting more than one in different locations. Good point, although at some point you'll want to make sure your reader implements anticollision properly :)
- fragmede 2y ago
  https://www.amazon.com/dp/B0C49SVTCT https://www.amazon.com/dp/B0C49SVTCT are the tags I have, and https://apps.apple.com/us/app/nfc-tools/id1252962749 https://apps.apple.com/us/app/nfc-tools/id1252962749 is the app I used (which is the same as the one used in the post).
- lxgr 2y ago
  If you only care about static data that you can optionally freeze to a permanent read-only mode, NTAG21[3|5|6] tags are probably among the cheapest ones that reliably work with all iOS and most Android devices. MIFARE Classic supports (completely broken and for this use case) useless encryption and doesn't work with some Android devices, as they're not really a part of the standardized NFC stack. If you want to get really fancy, you can also get a Java Card based smartcard and install an NDEF application yourself. You could then also install a FIDO application and use the same card as a "homebrew Yubikey" :)
pm 2y ago
This is cool, but the most interesting part is the part that requires investigation, i.e., what do the compatibility tools write to the card to make it iOS-compatible? I've done some work with iOS NFC, but not enough to have experienced the undocumented quirks.
- ewpratten 2y ago
  Ya, I have no clue tbh. This is one of those cases where I know I really should investigate further, but I'm taking this one step at a time. Perhaps digging in to the "why" will become a follow-up post
  - stavros 2y ago
    But what happens if you dump the card with the Proxmark? Surely you should be able to see some differences. Actually, I have all the components, so I'll try this now and report back.
    - ewpratten 2y ago
      My quick eye-skim didn't see much, but I'll do a byte-for-byte diff. I imagine its a difference in the NDEF headers? (but even that doesn't make sense, since I wrote the headers again from the pm3)
      - stavros 2y ago
        Well it turns out I'm much worse at this than I thought, as I can't even figure out what kind of cards I have. I'm learning, though!
        ewpratten 2y ago
        HN formatting is going to do bad things here.. Here's the first 6 blocks of the card after I ran through the instructions of the post, then a ndefformat-only card (that never touched an iphone). [=] 0 | 0 | 00 56 78 BB 95 08 04 00 02 B2 1E 24 23 27 1E 1D | .Vx........$#'.. [=] | 1 | 14 01 03 E1 03 E1 03 E1 03 E1 03 E1 03 E1 03 E1 | ...�.�.�.�.�.�.� [=] | 2 | 03 E1 03 E1 03 E1 03 E1 03 E1 03 E1 03 E1 03 E1 | .�.�.�.�.�.�.�.� [=] | 3 | A0 A1 A2 A3 A4 A5 78 77 88 C1 89 EC A9 7F 8C 2A | ......xw.......* [=] 1 | 4 | 00 00 03 12 D1 01 0E 55 04 65 77 70 72 61 74 74 | ....�..U.ewpratt [=] | 5 | 65 6E 2E 63 6F 6D FE 00 00 00 00 00 00 00 00 00 | en.com�......... [=] 0 | 0 | 00 56 78 BB 95 08 04 00 02 B2 1E 24 23 27 1E 1D | .Vx........$#'.. [=] | 1 | 14 01 03 E1 03 E1 03 E1 03 E1 03 E1 03 E1 03 E1 | ...�.�.�.�.�.�.� [=] | 2 | 03 E1 03 E1 03 E1 03 E1 03 E1 03 E1 03 E1 03 E1 | .�.�.�.�.�.�.�.� [=] | 3 | A0 A1 A2 A3 A4 A5 78 77 88 C1 89 EC A9 7F 8C 2A | ......xw.......* [=] 1 | 4 | 03 00 FE 00 00 00 00 00 00 00 00 00 00 00 00 00 | ..�............. [=] | 5 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
akjak 2y ago
[flagged]
nippoo 2y ago
Has anyone managed the opposite feat, i.e. made a piece of hardware that can recognise an iPhone over NFC? I'm trying to design control system that relies on you touching your phone to various hardware readers (with some kind of unchanging key/identity), but off-the-shelf MFRC522 etc don't seem to work, and the 'official' Apple way requires an NDA...
- formerly_proven 2y ago
  NFC has been opened up more in iOS 16 and 17. Card emulation is a thing now: https://developer.apple.com/documentation/corenfc/cardsession https://developer.apple.com/documentation/corenfc/cardsessio... (edit: only in the EU) And iOS as well as iPadOS now also support USB smart card readers. iPads can actually use them to access NFC FIDO tokens. (Why iPads don't have native NFC is completely beyond me, there are so many obvious use cases for it)
  - lxgr 2y ago
    > And iOS as well as iPadOS now also support USB smart card readers. Oh, that's very cool! Apple seems to silently be implementing more and more features to make iOS/macOS a full-fledged smart card OS; I've also noticed that FIDO over CCID is now available natively on macOS, and by extension in Firefox and Safari via WebAuthN (which finally lets me use my smartcard form factor FIDO authenticator).
- auston 2y ago
  Here you go: https://github.com/kormax/apple-vas https://github.com/kormax/apple-vas If you can send/receive APDUs you're good to go.
  - lxgr 2y ago
    Wow, that's neat! Do you know if Apple requires any special permissions/entitlements to create VAT passes, or does a normal pass certificate suffice?
- numpad0 2y ago
xyst 2y ago
In my experience, the notification you see at the end of article was used to advertise your brand/site. The number of obnoxious people/guerilla ad companies that printed and programmed NFC tags and stuck them in random places was way too high. In some cases, they would replace the businesses QR code with the NFC tag. In some cases that NFC notification would pop up instead of the business’s menu. Quite annoying. Then there was a case where the person stuck the raw tags _under the table_, so putting your phone down in random places would spam this notification on your screen.
- ewpratten 2y ago
  Ah, we did the under-the-table thing with NFC stickers in school! Love rickrolling a well-placed phone on a classroom desk lol. I'm personally not a huge fan of needing to use NFC tags in the real world (parking meters use them for payment around here), but I do like creating tags.
deleted 2y ago
[deleted]
kweks 2y ago
We did extensive research on the subject, there is no mystery. iOS will only read MIFARE tags with NDEF formatted data. If you write NDEF data to a formatted MIFARE card, it will be 'compatible' with iOS. Otherwise, only the UID can be detected. The real mystery is why Apple refuses to open the low-level read commands. (To read NDEF, or determine that the data is _not_ NDEF, you need to read the card.)
- noprocrasted 2y ago
  It's not a mystery - it's anti-competitive behavior where they only want to give access to low-level NFC access (required to enable things like door locks, car keys, payment/loyalty card systems, transport, etc) to "partners" who sign an NDA and agree to a rev-share.
  - privacyking 2y ago
    Didn't apple announce earlier this year they were going to open NFC up more? What ever happened to that?
    - Daneel_ 2y ago
      It’s open to developers as of iOS 18.1: https://developer.apple.com/support/nfc-se-platform/ https://developer.apple.com/support/nfc-se-platform/
      - lxgr 2y ago
        That's for card emulation. This article is about using iOS devices as readers. ISO 14443 card reader functionality has been made available some iOS versions before, but it's still restricted (e.g. you can't select any "payment" ISO 7816 applications, you have to predefine the list of AIDs you want to be able to select, and you don't have lower layer access to ISO 14443). I'm not aware of any announcements to further open up "reader" mode.
        2y ago

92 points by ewpratten 2y ago

randomcatuser 2y ago

so cool! anyone have any recs for cheap cards (or hardware) that is scannable on iphones?

walterbell 2y ago
The cheapest RFID/NFC "card" tag is an expired tap-to-use transit ticket. It has a unique ID that can be used to trigger an iOS Shortcut to take any action, e.g. speak an audio description, open URL, open app, etc. For purchase, there are many form factors: https://store.gototags.com/nfc-tags https://store.gototags.com/nfc-tags On Amazon, search NTAG215.
- immibis 2y ago
  If your city doesn't use NFC transit, you can also buy a box of blank cards. They have unique IDs like transit tickets, even without being programmed.
- stavros 2y ago
  NTAG215 isn't "magic", right? I have a bunch of NTAG215 stickers and I'm not entirely sure what their difference is with magic cards.
  - ewpratten 2y ago
    Think of it like a subset of MIFARE. In a simple sense, NTAG cards can do NFC things, but MIFARE can do lots more (access control for example)..and also NFC things..somewhat. Magic mifare refers to special cards that let you bypass the write-lock of genuine mifare cards. These are mostly used for cloning keys (either for red-team pentesting or for people who want a copy of an office key for whatever reason)
    - stavros 2y ago
      Ah, thanks, so I guess to write tags like URLs and things I don't really need Mifare cards, the NTAG cards are fine. Thanks for the info!
    - lxgr 2y ago
      It's not really a subset: MIFARE Classic uses a proprietary and mandatory encryption/authentication algorithm and is therefore not ISO 14443-4 compliant. As a result, NFC-compliant readers don't need to support it, and in fact non-NXP ones (including many popular Android phones) usually don't. On the other hand, as you say, MIFARE Classic supports capabilities beyond NFC/NDEF, but there are fully NFC-compliant tags that do so as well (e.g. MIFARE DESfire, which properly stacks encryption in an ISO 14443-4 compliant way).
ewpratten 2y ago
Many of my cards are just repurposed from other things. Lots of hotel keycards can be rewritten to open URLs on phones for example. I actually have a hotel keycard taped to my washing machine to do some laundry-based automation with my phone. Maybe I should write about that sometime..
- Eisenstein 2y ago
  Have you thought about getting one implanted?
  - ewpratten 2y ago
    (glances at chip on my desk) ..yes. Hopefully getting that installed later this week :)
  - lxgr 2y ago
    If you're getting an implant already, why not make it an actual smartcard that you can use for WebAuthN, GPG, SSH etc.? :) On the other hand, the fear of permanently bricking it or messing up the GlobalPlatform card management key has so far prevented me from doing it myself...
    - Eisenstein 2y ago
      Because those cost $350 as opposed to $89, and the install only costs $60, and there is no stopping you from implanting more than one in different locations. Many people get the small xEM or xM1 first to play with. * https://dangerousthings.com/product/apex-flex/ https://dangerousthings.com/product/apex-flex/ * https://dangerousthings.com/product/xm1/ https://dangerousthings.com/product/xm1/
      - lxgr 2y ago
        > there is no stopping you from implanting more than one in different locations. Good point, although at some point you'll want to make sure your reader implements anticollision properly :)
fragmede 2y ago
https://www.amazon.com/dp/B0C49SVTCT https://www.amazon.com/dp/B0C49SVTCT are the tags I have, and https://apps.apple.com/us/app/nfc-tools/id1252962749 https://apps.apple.com/us/app/nfc-tools/id1252962749 is the app I used (which is the same as the one used in the post).
lxgr 2y ago
If you only care about static data that you can optionally freeze to a permanent read-only mode, NTAG21[3|5|6] tags are probably among the cheapest ones that reliably work with all iOS and most Android devices. MIFARE Classic supports (completely broken and for this use case) useless encryption and doesn't work with some Android devices, as they're not really a part of the standardized NFC stack. If you want to get really fancy, you can also get a Java Card based smartcard and install an NDEF application yourself. You could then also install a FIDO application and use the same card as a "homebrew Yubikey" :)

pm 2y ago

This is cool, but the most interesting part is the part that requires investigation, i.e., what do the compatibility tools write to the card to make it iOS-compatible? I've done some work with iOS NFC, but not enough to have experienced the undocumented quirks.

ewpratten 2y ago
Ya, I have no clue tbh. This is one of those cases where I know I really should investigate further, but I'm taking this one step at a time. Perhaps digging in to the "why" will become a follow-up post
- stavros 2y ago
  But what happens if you dump the card with the Proxmark? Surely you should be able to see some differences. Actually, I have all the components, so I'll try this now and report back.
  - ewpratten 2y ago
    My quick eye-skim didn't see much, but I'll do a byte-for-byte diff. I imagine its a difference in the NDEF headers? (but even that doesn't make sense, since I wrote the headers again from the pm3)
    - stavros 2y ago
      Well it turns out I'm much worse at this than I thought, as I can't even figure out what kind of cards I have. I'm learning, though!
      - ewpratten 2y ago
        HN formatting is going to do bad things here.. Here's the first 6 blocks of the card after I ran through the instructions of the post, then a ndefformat-only card (that never touched an iphone). [=] 0 | 0 | 00 56 78 BB 95 08 04 00 02 B2 1E 24 23 27 1E 1D | .Vx........$#'.. [=] | 1 | 14 01 03 E1 03 E1 03 E1 03 E1 03 E1 03 E1 03 E1 | ...�.�.�.�.�.�.� [=] | 2 | 03 E1 03 E1 03 E1 03 E1 03 E1 03 E1 03 E1 03 E1 | .�.�.�.�.�.�.�.� [=] | 3 | A0 A1 A2 A3 A4 A5 78 77 88 C1 89 EC A9 7F 8C 2A | ......xw.......* [=] 1 | 4 | 00 00 03 12 D1 01 0E 55 04 65 77 70 72 61 74 74 | ....�..U.ewpratt [=] | 5 | 65 6E 2E 63 6F 6D FE 00 00 00 00 00 00 00 00 00 | en.com�......... [=] 0 | 0 | 00 56 78 BB 95 08 04 00 02 B2 1E 24 23 27 1E 1D | .Vx........$#'.. [=] | 1 | 14 01 03 E1 03 E1 03 E1 03 E1 03 E1 03 E1 03 E1 | ...�.�.�.�.�.�.� [=] | 2 | 03 E1 03 E1 03 E1 03 E1 03 E1 03 E1 03 E1 03 E1 | .�.�.�.�.�.�.�.� [=] | 3 | A0 A1 A2 A3 A4 A5 78 77 88 C1 89 EC A9 7F 8C 2A | ......xw.......* [=] 1 | 4 | 03 00 FE 00 00 00 00 00 00 00 00 00 00 00 00 00 | ..�............. [=] | 5 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

akjak 2y ago

[flagged]

nippoo 2y ago

Has anyone managed the opposite feat, i.e. made a piece of hardware that can recognise an iPhone over NFC? I'm trying to design control system that relies on you touching your phone to various hardware readers (with some kind of unchanging key/identity), but off-the-shelf MFRC522 etc don't seem to work, and the 'official' Apple way requires an NDA...

formerly_proven 2y ago
NFC has been opened up more in iOS 16 and 17. Card emulation is a thing now: https://developer.apple.com/documentation/corenfc/cardsession https://developer.apple.com/documentation/corenfc/cardsessio... (edit: only in the EU) And iOS as well as iPadOS now also support USB smart card readers. iPads can actually use them to access NFC FIDO tokens. (Why iPads don't have native NFC is completely beyond me, there are so many obvious use cases for it)
- lxgr 2y ago
  > And iOS as well as iPadOS now also support USB smart card readers. Oh, that's very cool! Apple seems to silently be implementing more and more features to make iOS/macOS a full-fledged smart card OS; I've also noticed that FIDO over CCID is now available natively on macOS, and by extension in Firefox and Safari via WebAuthN (which finally lets me use my smartcard form factor FIDO authenticator).
auston 2y ago
Here you go: https://github.com/kormax/apple-vas https://github.com/kormax/apple-vas If you can send/receive APDUs you're good to go.
- lxgr 2y ago
  Wow, that's neat! Do you know if Apple requires any special permissions/entitlements to create VAT passes, or does a normal pass certificate suffice?
numpad0 2y ago

xyst 2y ago

In my experience, the notification you see at the end of article was used to advertise your brand/site. The number of obnoxious people/guerilla ad companies that printed and programmed NFC tags and stuck them in random places was way too high. In some cases, they would replace the businesses QR code with the NFC tag. In some cases that NFC notification would pop up instead of the business’s menu. Quite annoying. Then there was a case where the person stuck the raw tags _under the table_, so putting your phone down in random places would spam this notification on your screen.

ewpratten 2y ago
Ah, we did the under-the-table thing with NFC stickers in school! Love rickrolling a well-placed phone on a classroom desk lol. I'm personally not a huge fan of needing to use NFC tags in the real world (parking meters use them for payment around here), but I do like creating tags.

deleted 2y ago

[deleted]

kweks 2y ago

We did extensive research on the subject, there is no mystery. iOS will only read MIFARE tags with NDEF formatted data. If you write NDEF data to a formatted MIFARE card, it will be 'compatible' with iOS. Otherwise, only the UID can be detected. The real mystery is why Apple refuses to open the low-level read commands. (To read NDEF, or determine that the data is _not_ NDEF, you need to read the card.)

noprocrasted 2y ago
It's not a mystery - it's anti-competitive behavior where they only want to give access to low-level NFC access (required to enable things like door locks, car keys, payment/loyalty card systems, transport, etc) to "partners" who sign an NDA and agree to a rev-share.
- privacyking 2y ago
  Didn't apple announce earlier this year they were going to open NFC up more? What ever happened to that?
  - Daneel_ 2y ago
    It’s open to developers as of iOS 18.1: https://developer.apple.com/support/nfc-se-platform/ https://developer.apple.com/support/nfc-se-platform/
    - lxgr 2y ago
      That's for card emulation. This article is about using iOS devices as readers. ISO 14443 card reader functionality has been made available some iOS versions before, but it's still restricted (e.g. you can't select any "payment" ISO 7816 applications, you have to predefine the list of AIDs you want to be able to select, and you don't have lower layer access to ISO 14443). I'm not aware of any announcements to further open up "reader" mode.
      - 2y ago