Minutes 2025-02-13 - Revision history

D2wn: Added images

2025-02-15T01:49:07Z

Added images

D2wn at 23:25, 14 February 2025

2025-02-14T23:25:30Z

← Older revision		Revision as of 23:25, 14 February 2025
Line 2:		Line 2:
	## Brief primer of NFC and RFID		## Brief primer of NFC and RFID
	### HID and NXP duopoly		### HID and NXP duopoly
	### ~~many~~ organizations ~~usually~~ use ~~encrypted~~ credentials with broken encryption		### Many organizations use credentials with broken or nonexistent encryption
	## MIFARE		## MIFARE
	### MIFARE Classic		### MIFARE Classic

D2wn: Created page with "# Presentation from Noah on creating MIFARE Classic polyglot cards! ## Brief primer of NFC and RFID ### HID and NXP duopoly ### many organizations usually use encrypted credentials with broken encryption ## MIFARE ### MIFARE Classic ### MIFARE DESFire ### HID iClass ## MIFARE Classic ### Crypto1 #### Security through obscurity ### MIT hackers break it overnight #### NXP attempts to sue, fails ### Used in lots of hotels and organizations that don't know any better ## Vis..."

2025-02-14T23:23:03Z

Created page with "# Presentation from Noah on creating MIFARE Classic polyglot cards! ## Brief primer of NFC and RFID ### HID and NXP duopoly ### many organizations usually use encrypted credentials with broken encryption ## MIFARE ### MIFARE Classic ### MIFARE DESFire ### HID iClass ## MIFARE Classic ### Crypto1 #### Security through obscurity ### MIT hackers break it overnight #### NXP attempts to sue, fails ### Used in lots of hotels and organizations that don't know any better ## Vis..."

New page

# Presentation from Noah on creating MIFARE Classic polyglot cards!
## Brief primer of NFC and RFID
### HID and NXP duopoly
### many organizations usually use encrypted credentials with broken encryption
## MIFARE
### MIFARE Classic
### MIFARE DESFire
### HID iClass
## MIFARE Classic
### Crypto1
#### Security through obscurity
### MIT hackers break it overnight
#### NXP attempts to sue, fails
### Used in lots of hotels and organizations that don't know any better
## Visual representation of data on a MIFARE Classic card
### The '1K' in "MIFARE Classic 1K" is the total space
### There's only 720 bytes of usable space
### Block 0 is for manufacturer data
#### First 4 bytes are the UID (serial number) of the card
### Blocks 2/3 are for the MAD (more on this later)
### the rest of the sectors are for data
## MIFARE Classic 1K is the cheapest version of these cards
### There exist 2K and 4K variants
### Not very useful since most orgs just store an ID number on them anyway, which takes like 10 bytes, and leave the rest blank
## Is this allowed @ Tech?
### In all of IT's and the Universities policies, nothing says you can't put your own data on a different medium
### But they do explicitly disallow unauthorized distribution, so don't hand out your card or share a copy of the data dump
### "not an issue until it becomes one"
#### Don't otherwise abuse services or technology and it won't pose an issue
## How it works
### Key Diversification Function (KDF)
### Take the (in this case) four-byte UID
### Plug into 'black-box' algorithm
### get keys for that sector
### We don't have the KDF for Schlage, but we can get a 1:1 copy of the data anyway
### The first sector is the one that we care about
## Orange bytes are access bits
### These define read/write permissions
### If the access bits are configured to never allow writing the access bits, they're 'bricked'; IE permanently locked and can never be changed
### For this reason, we use the access bits of <code>787788</code> instead of the OEM access bits of <code>F0FF00</code> to keep the same KeyA/KeyB R/W permissions, but also allow re-writing the access bits again in the future
#### Can be useful if anyone wants their LUG ID to be a different card in the future, like a hotel key or convention pass
## General purpose byte - not super important
## Weigand value is the one that were looking for
### Card numbers are printed on the card
### Wiegand values are all sequential in most systems
### These are both stupid
## The MIFARE Application Directory (MAD)
### Allows formatting the data in the card in special ways
### Designed to allow multi-tenant functionality
### The purpose was to use different sectors to store different 'types' of applications (vending credits, bus passes, dorm access, etc)
#### No one uses it like this
### But it also allows encoding data as NDEF (what we care about)
### NDEF
#### Special type of standard by NXP, the company with a borderline monopoly on NFC
#### Can store files, contacts, pictures and more
#### Commonly used on NTAG chips (ex. NTAG215/216)
### MAD normally is in sector one, which on our cards, is where our ID numbers are
### Mobile devices look for mad in sector 0, then reads in sector 1 even when the MAD specifies otherwise
### Don't implement spec properly
### IOS is really strict with some aspects, but still doesn't implement it correctly
## What do we do?
### Allegion has our backs
### Schlage readers support a zillion card formats
### One of these formats is a card with the data in sector 15 (the last sector)
### we can just copy+paste our sector 1 data down to sector 15, and it works all the same
### This frees up sector 1 to be used to our MAD data
### This trick let's us make other kinds of Polyglot Cards
#### Noah's Tech+Elements NFC (gen4) / RFID (t5577) Ring
## Dining halls and printers only use UID (really insecure)
### This means you can't write your data to an RFID tag, as they only work with a 13.56mHz NFC tag
## Onto the fun stuff!
### Josh literally just finished the script as presentation ended
### Not tested yet
# Handed out materials to create IDs for people who haven't made them yet
## For people who already created theirs last meeting, started on the polyglot creation
## They work!
### They even work on iPhones!
# Borrowed Ethan's Flipper Zero to check if the unlabeled stock of cards were gen1 or gen2
## We ran out of pre-confirmed gen2 tags
## Didn't want to use gen1 tags so members could rewrite cards with their phones at a later date
# USG Budget Hearing @ 8:20 PM
## Took some quick pictures before leaving at 8:15 (the ones embedded in these minutes)
## Noah, Dane, Lucas, and Logan went
## Was only 10 minutes, meetings are very short
## Seems to have gone well
# Returned to the meeting
## Helped finish up remaining cards
## Discussions about integrating LUG into RedTeam and some future plans for RedTeam's leadership as people slowly dispersed

[[Category:Meeting Minutes]]

← Older revision		Revision as of 01:49, 15 February 2025
Line 1:		Line 1:
	# Presentation from Noah on creating MIFARE Classic polyglot cards!		# Presentation from Noah on creating MIFARE Classic polyglot cards!
	## Brief primer of NFC and RFID		## Brief primer of NFC and RFID[[File:LUG Card Programming Meeting (Whole Table).jpg\|thumb\|468x468px\|Members hanging out around the round table]]
	### HID and NXP duopoly		### HID and NXP duopoly
	### Many organizations use credentials with broken or nonexistent encryption		### Many organizations use credentials with broken or nonexistent encryption
Line 13:		Line 13:
	#### NXP attempts to sue, fails		#### NXP attempts to sue, fails
	### Used in lots of hotels and organizations that don't know any better		### Used in lots of hotels and organizations that don't know any better
	## Visual representation of data on a MIFARE Classic card		## Visual representation of data on a MIFARE Classic card[[File:LUG Card Programming Meeting (Half Table).jpg\|thumb\|462x462px\|Response to being photographed]]
	### The '1K' in "MIFARE Classic 1K" is the total space		### The '1K' in "MIFARE Classic 1K" is the total space
	### There's only 720 bytes of usable space		### There's only 720 bytes of usable space
Line 31:		Line 31:
	### Key Diversification Function (KDF)		### Key Diversification Function (KDF)
	### Take the (in this case) four-byte UID		### Take the (in this case) four-byte UID
	### Plug into 'black-box' algorithm		### [[File:Logan cutting his card.jpg\|thumb\|460x460px\|Logan cutting his card]]Plug into 'black-box' algorithm
	### get keys for that sector		### get keys for that sector
	### We don't have the KDF for Schlage, but we can get a 1:1 copy of the data anyway		### We don't have the KDF for Schlage, but we can get a 1:1 copy of the data anyway
Line 45:		Line 45:
	### Wiegand values are all sequential in most systems		### Wiegand values are all sequential in most systems
	### These are both stupid		### These are both stupid
	## The MIFARE Application Directory (MAD)		## The MIFARE Application Directory (MAD)[[File:Josh programming a card.jpg\|thumb\|460x460px\|Josh programming an ID]]
	### Allows formatting the data in the card in special ways		### Allows formatting the data in the card in special ways
	### Designed to allow multi-tenant functionality		### Designed to allow multi-tenant functionality
Line 59:		Line 59:
	### Don't implement spec properly		### Don't implement spec properly
	### IOS is really strict with some aspects, but still doesn't implement it correctly		### IOS is really strict with some aspects, but still doesn't implement it correctly
			## What do we do?[[File:Closeup of Josh programming an ID.jpg\|thumb\|457x457px\|Closeup of the ID being programmed]]
	## What do we do?
	### Allegion has our backs		### Allegion has our backs
	### Schlage readers support a zillion card formats		### Schlage readers support a zillion card formats
Line 76:		Line 76:
	## They work!		## They work!
	### They even work on iPhones!		### They even work on iPhones!
	# Borrowed Ethan's Flipper Zero to check if the unlabeled stock of cards were gen1 or gen2		# Borrowed Ethan's Flipper Zero to check if the unlabeled stock of cards were gen1 or gen2[[File:Anika's LUG IDs.jpg\|thumb\|455x455px\|Anika showing off the front and back of her two LUG IDs]]
	## We ran out of pre-confirmed gen2 tags		## We ran out of pre-confirmed gen2 tags
	## Didn't want to use gen1 tags so members could rewrite cards with their phones at a later date		## Didn't want to use gen1 tags, so members could rewrite cards with their phones at a later date
	# USG Budget Hearing @ 8:20 PM		# USG Budget Hearing @ 8:20 PM
	## Took some quick pictures before leaving at 8:15 (the ones embedded in these minutes)		## Took some quick pictures before leaving at 8:15 (the ones embedded in these minutes)