Confidence 2009.02 – Mifare Classic anaysis – Pavol Luptak
Pavol started by showing the cards he cracked that same day at the conference. Two Polish public transport cards, one Slovacian public transport card and, by coincidence, a Dutch Public Transport Card.
He also released, into open source, an offline MiFare cracking utility that can be used to crack any MiFare card for 30 euros and with just a few hours of work.
In the past MiFare’s encryption technology, Crypto1, was only available in hardware and thus survived for a surprisingly long time.
Pavol explained how his program can computer derived keys from the main key by using the time distance between the keys.
For those people that dodn’t know. MiFare Classic can be cloned in 99.6% (Except for sector 0 that cannot be written) a ProxMark3 card emulator can emulate all cards 100% perfect.
There are currently three countermeasures:
1) User safe cards (Mifare Plus/Mifare Desfire or other)
2) Use decrement counter protection (workaround)
3) Use online checking
Slovak public transport card allows anybody to read the name of the passenger and has no protection against cloning or modification.
The tool can be downloaded from https://www.nethemba.com/research/ .
Coming up:
• Cracking hitag rfid
• Cracking GSM encryption
