[Q] NFC smart cards like Mifare DESfire or SmartMX - NFC Hacking

Hi,
I'd like to create a App which I want to unlock with a NFC based smart card like a Mifare SmartMX or DESfire. So the user needs the card to do certain stuff within the application.
After the smart card is programmed with "java card" for example, is it possible to communicate with android? Is android even possible to deal with the cryptosystems?
Has anybody tried that before or knows something about it?
Thanks very much for ur help..
At the moment I'm using a galaxy nexus with android 4.0.4
cheers
-eiMer

I know NFC TagInfo ( play.google.com/store/apps/details?id=at.mroland.android.apps.nfctaginfo&hl=en ) is able to communicate with Desfire card (among with a lot of other kinds).
It can even read the secured data if it is given the correct keys.
The android SDK provides classes to handle Mifare Classic card but not Desfire AFAIK. I don't know if the used an external Desfire library or if they implemented the whole protocol by themselves (it seems to be a very big research group - founded by NXP - so they might have) but it is definitely possible to use Desfire cards with Android.

Thanks for your help.
Ill try to find out how they managed the communication.
If I get some results Ill post them here.

eiMer said:
After the smart card is programmed with "java card" for example, is it possible to communicate with android?
Click to expand...
Click to collapse
Smartcards and also DESFire communicate using the ISO14443-4 transmission protocol (also known as ISO-DEP). Android provides the class IsoDep to communicate with these cards. Depending on the card, you would then exchange either ISO7816-4 APDU commands (e.g. with your JavaCard applet or with the DESFire card in ISO 7816-4 framing mode) or proprietary commands (e.g. with DESFire native command set).
eiMer said:
Is android even possible to deal with the cryptosystems?
Click to expand...
Click to collapse
The Android API already provides support for a wide range of cipher suites, hash functions ... If that's not sufficient for your type of card, you could also implement your own algorithms.
Gildas35 said:
I know NFC TagInfo is able to communicate with Desfire card (among with a lot of other kinds).
Click to expand...
Click to collapse
Correct. I've implemented support for DESFire. For the moment, however, only authentication with the default key (DES, all zeros) is supported.
Gildas35 said:
The android SDK provides classes to handle Mifare Classic card but not Desfire AFAIK. I don't know if the used an external Desfire library or if they implemented the whole protocol by themselves (it seems to be a very big research group - founded by NXP - so they might have) but it is definitely possible to use Desfire cards with Android.
Click to expand...
Click to collapse
I've implemented the protocol myself (on top of the IsoDep class). The original DESFire protocol is pretty straight forward and there's lots of help on the web. When it comes to the EV1 extensions (improved cryptography) things get a bit more difficult.
br
Michael

Related

[Q] NFC card emulation

Hi
I am creating an NFC based solution and i need to send some information from a Nexus S to a desktop (windows 7 with ACR122 NFC Reader) via NFC. I have tried to do it using the P2P mode but i didn't find a way to read those information using the NFC reader.
And since it'is possible for the NFC to reader to reader MiFare NFC card , I need some help to know how is possible to emulate MiFare Card?
Which ROM enable NFC Card Emulation ? And how To Do it ?
Thanks
zouppa said:
Hi
I am creating an NFC based solution and i need to send some information from a Nexus S to a desktop (windows 7 with ACR122 NFC Reader) via NFC. I have tried to do it using the P2P mode but i didn't find a way to read those information using the NFC reader.
And since it'is possible for the NFC to reader to reader MiFare NFC card , I need some help to know how is possible to emulate MiFare Card?
Which ROM enable NFC Card Emulation ? And how To Do it ?
Thanks
Click to expand...
Click to collapse
I wanted to do the same thing some time ago, but found out that without access to the NFC secure element in the nexus s, this is not possible. Apparently, the 2.3.5 updated for the nexus s 4G has access to the NFC secure element... cant confirm this because I dont have one..
Any updates on this?
Sent from my Nexus S 4G using XDA App
i use an access card to get into the office at my workplace. would be cool if i could clone my card, however i dont think that is possible (security reasons). However if i had admin write the data to my nexus s NFC im sure it would be possible
Access to the SE is VERY limited. There is no public access to the SE currently.
AFAIK full Card Emulation is not in the SDK either (and may not be from an API perspective). Google in the past has cited issues with replication of all card technologies as well as lack of existing standards for emulation. They prefer to fall back on NDEF push at the API level. There is a bit of card emu stuff in the code base, but that may be related solely to payments / loyalty cards and it's not in the public API.
Thanks krohnjw - I was waiting for you to chime in. Keep us informed, if you don't mind.
Would be nice to get my transit pass on my phone...
I answered to this question on this thread:
http://forum.xda-developers.com/showthread.php?t=1443624

Does the One X have NFC card emulation enabled?

Does the One X have NFC card emulation enabled?
Well, does it?
No. In the future it might be possible that a custom kernel and rom might be able to crack it. However at present card emulation does not work on any android phone. It has something to do with google restricting access to the secure element.
ozaghloul said:
No. In the future it might be possible that a custom kernel and rom might be able to crack it. However at present card emulation does not work on any android phone. It has something to do with google restricting access to the secure element.
Click to expand...
Click to collapse
Access to the SE and card emulation are two different things entirely. The SE in only used for payment info. Given proper API support the SE is not needed to emulate a standard NFC card (like access cards).
What that being said, card emulation is not exposed in the API itself. Based on some comments made by Google I wouldn't expect it to be exposed any time soon either. They have moved forward leveraging NDEF push for transmitting data from a device to another device via NFC.

Reading/Writing MiFare Ultralight on Nexus S (ICS)

Hi,
I'm looking for a way to read & write on a Mifare Ultralight. I know a couple of applications available on the Play Store allow the possibility to read them, but I didn't find any application allowing me to write back (for example, change the data and save it back).
Is there a way to do so?
Also, is it possible to plug in the Android to my computer to use the NFC capabilities and to code in another language than Java? (some kind of bridge)
Thanks a lot for your support!
jpmonette said:
Hi,
I'm looking for a way to read & write on a Mifare Ultralight. I know a couple of applications available on the Play Store allow the possibility to read them, but I didn't find any application allowing me to write back (for example, change the data and save it back).
Is there a way to do so?
Also, is it possible to plug in the Android to my computer to use the NFC capabilities and to code in another language than Java? (some kind of bridge)
Thanks a lot for your support!
Click to expand...
Click to collapse
Have you tried NXP NFC Writer app? As of now there is no way to use your phone as a USB NFC reader.
Well I have both TagWriter and TagInfo. I can read the content of my NFC chip with TagInfo, but I can't with TagWriter. That's why I'm looking for something else to do the job, but can't find much on the Play Store.
jpmonette said:
Well I have both TagWriter and TagInfo. I can read the content of my NFC chip with TagInfo, but I can't with TagWriter. That's why I'm looking for something else to do the job, but can't find much on the Play Store.
Click to expand...
Click to collapse
Is the tag write locked? Formatting Classic 1K tags to NDEF is part of the standard NFC/NDEF libraries on Android. This allows full write access.
If you're trying to do it without NDEF then you have a different set of issues you'll need to deal with.
Nfc task launcher
Sent from my Nocturnal HOX
krohnjw said:
Is the tag write locked? Formatting Classic 1K tags to NDEF is part of the standard NFC/NDEF libraries on Android. This allows full write access.
If you're trying to do it without NDEF then you have a different set of issues you'll need to deal with.
Click to expand...
Click to collapse
Well, some pages are writable, some others aren't. Still, I can't get it to work with any apps I found (also the one people suggested in here).

Card emulation on Galaxy S3 olympics

Just read this article
http://global.samsungtomorrow.com/?p=16659
The interesting thing is that they must have been using the hidden API to be able to use card emulation.
From my experience with hotel nfc cards they often are Mifare UltraLight cards.
Maybe they are giving out special phones using a custom ROM made by samsung that has this enabled.
I'm currently checking the 4.1 sources to see if anything can be done with that.
So what do you guys think about this? If someone with access to this phone could dump the rom it could be easily checked with the current S3 and see the diff.
This is interesting but I think we will have to wait. The article says only 40 VIPs will get it to start, the odds of any of them dumping the the ROM is slim to none.
Fredro said:
Just read this article
http://global.samsungtomorrow.com/?p=16659
The interesting thing is that they must have been using the hidden API to be able to use card emulation.
From my experience with hotel nfc cards they often are Mifare UltraLight cards.
Maybe they are giving out special phones using a custom ROM made by samsung that has this enabled.
I'm currently checking the 4.1 sources to see if anything can be done with that.
So what do you guys think about this? If someone with access to this phone could dump the rom it could be easily checked with the current S3 and see the diff.
Click to expand...
Click to collapse
They have the Holiday Inn app on their phone, as shown on Engadget. I think there are already apps that let you copy NFC card data to your phone.
Product F(RED) said:
They have the Holiday Inn app on their phone, as shown on Engadget. I think there are already apps that let you copy NFC card data to your phone.
Click to expand...
Click to collapse
Indeed copying the card is no problem, though it's the ability to use the phone to emulate the card that is interesting
Fredro said:
Indeed copying the card is no problem, though it's the ability to use the phone to emulate the card that is interesting
Click to expand...
Click to collapse
All it does is transmit what was copied on the card via NFC. But in my experience most hotels don't use NFC yet; they still use magnetic strip cards, which by the way can still be easily copied. Just because they're encrypted doesn't mean you can't just copy the raw encrypted data to another card. Check this out:
Product F(RED) said:
All it does is transmit what was copied on the card via NFC. But in my experience most hotels don't use NFC yet; they still use magnetic strip cards, which by the way can still be easily copied. Just because they're encrypted doesn't mean you can't just copy the raw encrypted data to another card. Check this out:
Click to expand...
Click to collapse
I've been to several new hotels which indeed use NFC Ultralight cards.
I'm saying that, to be able to use this data you've copied from a card onto your phone, you need to be able to make the phone emulate the same card as the one you copied from. And that is the interesting part.
I'm working on a patch for 4.1.1 (galaxy nexus) that will enable this option, same as the phones used at this olympic hotel.
Google Wallet works in the same way, doesn't it? Card emulation is built into Android, but for an application (like Google Wallet) to use it, it must hold the access keys to the secure element.
Samsung controls the secure element in the S3; writing an application that can access the secure element is no problem for them.
Also, someone above said something about just copying the 'raw data' from an 'encrypted' card. You'll need access keys to access the data stored in each sector, so I doubt that would work.
LoveNFC said:
Google Wallet works in the same way, doesn't it? Card emulation is built into Android, but for an application (like Google Wallet) to use it, it must hold the access keys to the secure element.
Samsung controls the secure element in the S3; writing an application that can access the secure element is no problem for them.
Also, someone above said something about just copying the 'raw data' from an 'encrypted' card. You'll need access keys to access the data stored in each sector, so I doubt that would work.
Click to expand...
Click to collapse
yes, it's correct that samsung has control over who has access to it, but it's easy to "add yourself" if you patch the software.
About the keys for each sector, this is no problem because the ultralight cards dont use any encryption, even for the classic cards the protection is broken. So this doesn't really matter, the point is that people should be able to create their own cards inside the phone for their own usage for example.
Fredro said:
I've been to several new hotels which indeed use NFC Ultralight cards.
I'm saying that, to be able to use this data you've copied from a card onto your phone, you need to be able to make the phone emulate the same card as the one you copied from. And that is the interesting part.
I'm working on a patch for 4.1.1 (galaxy nexus) that will enable this option, same as the phones used at this olympic hotel.
Click to expand...
Click to collapse
Please kindly let me know if you succeed in patching the galaxy nexus, as I really want to use my phone as a nfc to open my building entrance door!
any. outhosur
Fredro said:
yes, it's correct that samsung has control over who has access to it, but it's easy to "add yourself" if you patch the software.
About the keys for each sector, this is no problem because the ultralight cards dont use any encryption, even for the classic cards the protection is broken. So this doesn't really matter, the point is that people should be able to create their own cards inside the phone for their own usage for example.
Click to expand...
Click to collapse
Sometimes I totally no idea why RFID card or NFC tag emulation so complicated.
fordiy said:
Sometimes I totally no idea why RFID card or NFC tag emulation so complicated.
Click to expand...
Click to collapse
cuz of the thousands of geezers who wanna abuse cards or nfs tags
LoveNFC said:
Also, someone above said something about just copying the 'raw data' from an 'encrypted' card. You'll need access keys to access the data stored in each sector, so I doubt that would work.
Click to expand...
Click to collapse
I've succesfully copied and cracked a Mifare classic card, thus accessing all the data in the sectors. It took me just over 10 minutes for a single card. But my interest is also, how can I put this card dump file on my phone and let the NFC chip push/emulate this card dump as a Mifare card?
See also http://forum.xda-developers.com/showthread.php?t=1706057
Is there any reason it has to be your phone? Could you write the info to a mifare tag, and get the same effect? This would allow you to clone the card to a paper sticker.
sysadmn said:
Is there any reason it has to be your phone? Could you write the info to a mifare tag, and get the same effect? This would allow you to clone the card to a paper sticker.
Click to expand...
Click to collapse
The Problem is that you can't change the ID of the card. Most applications check (only) for the ID as it is (falsely) seen by many as unique and unspoofable. So an card emulator able to let you change the ID as handy as a smartphone would be really really nice
nookieman said:
The Problem is that you can't change the ID of the card. Most applications check (only) for the ID as it is (falsely) seen by many as unique and unspoofable. So an card emulator able to let you change the ID as handy as a smartphone would be really really nice
Click to expand...
Click to collapse
But this feature is normally not accessible in the phones - partly also because of these reasons.
You would have to obtain keys to the ecure element from the operator or the handset manufacturer and will surely not give it to you if you are not a bank or someone of a similar size
---------- Post added at 02:38 PM ---------- Previous post was at 02:32 PM ----------
Perhaps you could also try to use an unofficial ROM, but I am not sure if that solves the problem
In order to emulate MIFARE Ultralight, you need the first UID byte = 0x04. NXP Semiconductors have introduced a restriction in their interface chips such that UID0 is hardwired to 0x08, meaning "random UID" according to their specifications. So even if hidden Android API get released, it will still not be possible to use the phone itself for MIFARE Ultralight tag emulation. However, EMUTAG emulator on emutag.com totally solves the problem by being portable, and can emulate any UID with almost no restrictions* (see Manual).
yeah its right.. i agree with you

NFC - Use HCE as ID card

Hi everybody,
With KitKat (Android 4.4.2 on Samsung S4) can I emulate a specific and fixed ID number using HCE?
I have an USB Multi Card Reader that is used as Identification Device with some proximity cards.
I'd like to replace that cards with S4 smartphones
For me it is not important to emulate the old card numbers (their tag are not supported by S4 reader and I can't read them with the smartphone but only with the USB Multi Card Reader) but is important to emulate a fix number.
For example if I read a credit card (Tag Type ISO 14443-4) using the USB Multi Card Reader it gets the serial number (es. xx.xx:xx:xx) and that number is also readable by the smartphone.
Can I emulate that number?
Thank in davance
i dont think so
So what this is this made for?
https://play.google.com/store/apps/details?id=com.jmarroyo.nfcloyaltywallet&hl=it
dylan6662 said:
So what this is this made for?
https://play.google.com/store/apps/details?id=com.jmarroyo.nfcloyaltywallet&hl=it
Click to expand...
Click to collapse
well try it and let us know if it works for you
No it doesn't work and I dont't know if I misunderstand hce technology or there is a problem with the reader

Categories

Resources