NFC Mifare card emulation

NFC
#6

I gave this a try tonight and had no luck. Current release firmware (0.59.1)

I have an NFC lock that uses a Mifare Classic 1K, all default keys, just UID authentication. Using my Proxmark, I am able to clone that card and emulate it.

The Flipper reads the card and correctly identifies it, but the emulation fails. The lock doesn’t even recognize it as a Mifare Classic; it will buzz when an invalid card is presented, but it doesn’t even do that. It acts like there is no card there.

While the Flipper is emulating, the Proxmark reads the UID, ATQA, and SAK properly, but cannot actually read all of the sectors, and thus I cannot even get a dump to save and compare to the card dump.

#7

As I said above, this is a known issue and we can’t do anything about it at the moment. You can patch your proxmark3 to ignore read timings and it’ll work, but if your reader has a correctly implemented mifare classic protocol and respects proper timeouts - our emulation will not work.

1 Like
#8

I was able to scan and run the app to look for keys on my Mifare Classic 1k card.

When emulating the reader does not beep or turn green.

The LED on my flipper stops blinking when I put it up to the reader.

Is this still due to the WIP?

Video: https://photos.app.goo.gl/LgJPPWbhQ7nG2ffW8

#9

You are emulating the UID only, not the whole card. It means that the dump might be incomplete or you’re using the wrong file (output of the initial read instead of the long one)

#10

I actually have both keycards stored. I just realized you are correct and I only emulated the UID, however the 2nd where I had it find the keys; it only found 1 key in sector A. And has same behavior

PXL_20220609_205847840
PXL_20220609_2058478403024×4032 1.5 MB

#11

This means that this card’s keys are not in the dictionary we use. You’ll need something like a proxmark3 to perform a more computationally-intensive attack like nested/hardnested to recover other keys, and then you can dump the card and convert it to FFF (Flipper File Format) using this script

1 Like
#12

I have an abundance of HID RP40 readers and arduinos. Can I make my own proxmark with this HID reader and an arduino mega or uno? Can i use the gpio on the flipper? i only need 4 wires for these readers to interface serial.

PXL_20220613_184925260
PXL_20220613_1849252604032×3024 2.9 MB

PXL_20220613_190453142
PXL_20220613_1904531423024×4032 3.07 MB

#13

No, a proxmark uses an FPGA and not a microcontroller. DIY-ing it is basically not an option, sadly.

#14

@Astra : Nice, i wrote something simular for converting Proxmark json to flipper
see prox2flip.py in https://github.com/evilpete/flipper_toolbox

1 Like
#15

@Astra does the new mifare classic emulation emulate the contents of the card or just the UID at the moment?

#16

The whole content of the tag.

2 Likes
#17

Sorry, but I have to ask:

Mifare tags are supposed to encrypt their data sectors, right? From what I see, the keys stored on the tag are not readable. So unless the tag uses a simple default key, how are you going to emulate the whole content of the tag?

#18

Dictionary brute-force attack on keys. On the future we’ll add nested and herdnestwd attacks to recover all keys on any card where at least one key is known (it’s based on the mathematic vulnerability of the protocol)

3 Likes
#19

Hi, I just ordered my Flipper (second production batch expected to be shipped from August 2022 onwards).
When I read that you’re not sure that the Flipper might ever be able to emulate Mifare Classic Cards because of CPU constraints, that scares me because it is, for me, the most useful feature.
Is there a plan to correct that for the next Production batch to make sure it will be able to emulate such cards ? (if it ends up not being able to do it with software updates?).
Thanks,

#20

I think the flipper team has already done a phenomenal job in figuring out a workaround for that issues. The current state of the mifare 1k full dump emulation has worked for multiple lock systems that I have tested on so far.

#21

Thanks, great news.
I don’t see any successful emulation announced on Mifare cards on the forum and Discord.

#22

That’s “survivorship bias”, people who successfully use the feature have no need to wrote about it, but the ones for who it doesn’t work do. The emulation is actually already working on about 80% of readers we have tested it on.

2 Likes
#23

You’re right.
So you confirm you were able to solve the fact that the Flipper Zero NFC chip doesn’t natively support Mf classic emulation.
Great news, as I have many badges to emulate :wink:

#24

I did test with 2 Mifare Classic 1K on “Nayax” reader/food dispenser and emulation fully works on both.

1 Like
#25

Hi guys,
I just want to know if someone did succeed tu emule a VIGIK.
My copy is ok (all keys, all sectors) its a mifare 1.
But it’s doesn’t work when I want to emule it,
I try two different VIGIK from two différent door.
Thanks.

3 Likes