[Q] Copy tag to phone - NFC Hacking

Hi
Here at the university we use a NFC card to check in. Is it possible to copy the tag to my phone so I don't have to carry my student card around?

Depends
Sent from my LS670 using XDA

Shark_On_Land said:
Depends
Sent from my LS670 using XDA
Click to expand...
Click to collapse
Wow, helpful much?
I'd like to know this too.

thx
arjun rajput

+1
I like to know this to.

(Here at the university we use a NFC card to check in. Is it possible to copy the tag to my phone so I don't have to carry my student card around?)
Hi Samuel
I believe this is not possible right now, as there are security measures in place to prevent fraudulent use, but give it a couple of months there will be apps you can download , to copy re-writeable NFC tags to your phone, making your phone work as an emulator of some sort.

virus007 said:
(Here at the university we use a NFC card to check in. Is it possible to copy the tag to my phone so I don't have to carry my student card around?)
Hi Samuel
I believe this is not possible right now, as there are security measures in place to prevent fraudulent use, but give it a couple of months there will be apps you can download , to copy re-writeable NFC tags to your phone, making your phone work as an emulator of some sort.
Click to expand...
Click to collapse
To emulate cards with your NFC phone, you have to have full control of the secure element. In the Nexus phones, access to the secure element is restricted to Google - only they have the codes to access it. In non-Nexus phones like the SGS2, they don't even have built-in secure elements and therefore have to rely on SIMs, which are in turn controlled by operators. Without access to the secure element, you won't be able to emulate another card. So, no, even in a few months you won't be able to copy a tag and emulate it from your phone. Unless Google opens up the secure element to, which is unlikely.
To OP: Even if you could actually copy the contents of the card and then emulate it, this might not be enough. Many schools use just the UID of the card to associate it with your account on their system. This means that there's a good chance that your card actually has no data on it. Furthermore, phones aren't currently able to emulate UIDs. You're out of luck.

LoveNFC said:
To emulate cards with your NFC phone, you have to have full control of the secure element. In the Nexus phones, access to the secure element is restricted to Google - only they have the codes to access it. In non-Nexus phones like the SGS2, they don't even have built-in secure elements and therefore have to rely on SIMs, which are in turn controlled by operators. Without access to the secure element, you won't be able to emulate another card. So, no, even in a few months you won't be able to copy a tag and emulate it from your phone. Unless Google opens up the secure element to, which is unlikely.
To OP: Even if you could actually copy the contents of the card and then emulate it, this might not be enough. Many schools use just the UID of the card to associate it with your account on their system. This means that there's a good chance that your card actually has no data on it. Furthermore, phones aren't currently able to emulate UIDs. You're out of luck.
Click to expand...
Click to collapse
Clearly, a direction NFC will follow. There's no way users will allow something like that to remain as neutered as it currently is. It just (seemingly) has not worked that way in the past.

thanks
thanks

Related

[Q] Galaxy Nexus and SIM Toolkit?

Will Galaxy Nexus come with SIM Toolkit? On Galaxy S it was a huge problem that even Gingerbread update did not have SIM Toolkit. This however is a must-have application when using certain pre-paid cards, bank authentications or identification.
Does anyone know if it has it?
So no one knows? Don't people use SIM cards with added functionality?
SIM Toolkit is just another way of the carrier pushing pointless services my way e.g. horoscopes, weather etc all at a cost and not as good as apps you can get in the market. This is my experience in the UK anyway, perhaps its different elsewhere.
In The Netherlands Sim toolkit is obsolete. The services it was used for, are now offered by Google and others. Sim toolkit uses a lot of (internet)data however and that is one of the reasons why many SGS-owners rooted their device, so they could use Titanium Backup to get rid of the Sim toolkit.
chandlerweb said:
SIM Toolkit is just another way of the carrier pushing pointless services my way e.g. horoscopes, weather etc all at a cost and not as good as apps you can get in the market. This is my experience in the UK anyway, perhaps its different elsewhere.
Click to expand...
Click to collapse
Perhaps I should enlighten what SIM Toolkit is used for in certain parts of Europe, especially Finland and Estonia. In Finland your pre-paid cards have SIM Toolkit related services, such as checking for balance and data usage without additional costs.
But in Estonia SIM cards can be used effectively as an identification device. That is, your mobile phone can double as your identification that is usable country-wide. You can authorize bank transfers, even do all bank-related activities right through your phone without having to fiddle with websites. It can be used to sign digital documents and authorize yourself for e-voting (Estonia was the first country in the world to effectively introduce internet-based voting for local government). All this uses a special SIM-card for that exact purpose.
SIM Toolkit is very important for those reasons. Just because some carriers blatantly misuse it does not mean it isn't important.
kristovaher said:
Perhaps I should enlighten what SIM Toolkit is used for in certain parts of Europe, especially Finland and Estonia. In Finland your pre-paid cards have SIM Toolkit related services, such as checking for balance and data usage without additional costs.
But in Estonia SIM cards can be used effectively as an identification device. That is, your mobile phone can double as your identification that is usable country-wide. You can authorize bank transfers, even do all bank-related activities right through your phone without having to fiddle with websites. It can be used to sign digital documents and authorize yourself for e-voting (Estonia was the first country in the world to effectively introduce internet-based voting for local government). All this uses a special SIM-card for that exact purpose.
SIM Toolkit is very important for those reasons. Just because some carriers blatantly misuse it does not mean it isn't important.
Click to expand...
Click to collapse
I'd rather get rid of the SIM completely, unfortunately it only seems Apple is interested in it at the moment, in their own patent pending insanely closed method, and even that is just a hack.
Don't really see the SIM as an important component in the features you're talking about, and especially something like checking your datausage could easily be done using web API's, like Three has done here in Denmark.
It doesn't even have to cost data, though i'm not sure whether or not it does, they simply have to allow traffic to and from that server freely.
Sure I would love a SIM-free future, but I would also love ID card and password-free future and so on. In fact, I would love username-password free future.
But reality today is that SIM Toolkit is useful part of infrastructure in many countries, there were a lot of complaints about it being missing from Nexus S, as many use SIM Toolkit for bank services.
This is why I'm wondering if Galaxy Nexus still has SIM Toolkit. I simply would be unable to use these services otherwise. It's 2011, I should not have to use a desktop computer or mobile browser to do bank transfers and so on.
no there will not and there will never be a sim toolkit on a nexus device.
i actually dont know any country's that do use a simtoolkit.
cheking your data usage?
App
bank services.?
App
App
App
App.
no need for a sim toolkit.
and seeing as NFC might be the future.
there even is more reason why sim toolkit is useless.
its indeed 2011.
we shouldn't even be using a sim toolkit.
its a technology thats been laid to rest in allot of country's.
Of course bank services through an app. But app alone is not secure enough. Our bank services run through Android app, but authenticate as an extra layer of security through SIM toolkit so that even if your data is stolen, they cannot access your bank, unless they also clone your SIM.
kristovaher said:
Of course bank services through an app. But app alone is not secure enough. Our bank services run through Android app, but authenticate as an extra layer of security through SIM toolkit so that even if your data is stolen, they cannot access your bank, unless they also clone your SIM.
Click to expand...
Click to collapse
The SIM just stores your private key. The same effect can be achieved if the phone itself stores your private key. It makes no difference whether it's the SIM or the phone that's used to store the private key, as long as the private key is used in the key exchange to derive a shared key to encrypt the communications between your device and the bank, the same effect is achieved.
kristovaher said:
Of course bank services through an app. But app alone is not secure enough. Our bank services run through Android app, but authenticate as an extra layer of security through SIM toolkit so that even if your data is stolen, they cannot access your bank, unless they also clone your SIM.
Click to expand...
Click to collapse
i dont know about your bank,but i have to certify my card and pin trug some sort of special card reader.and than note that code onto my phone.and make a pin code to access my bank account.
there is no way anywhere in that process that anyone can steal that data. unless i give the pin away.
ghost010 said:
i dont know about your bank,but i have to certify my card and pin trug some sort of special card reader.and than note that code onto my phone.and make a pin code to access my bank account.
there is no way anywhere in that process that anyone can steal that data. unless i give the pin away.
Click to expand...
Click to collapse
Well, in Estonia we have implemented country wide ID Cards. That is, something what UK tried and failed to implement, it works here and is a great success. Our ID cards double as passports and in fact we do not need to carry passports when traveling within EU.
These same ID cards are part of a wider infrastructure. We can sign documents with these ID cards digitally (just as valid as a written signature, for example). These ID cards carry chips that are specially encrypted for that purpose and carry public and private keys for communicating with various online services. Other than digital document signatures (for any kind of document), we also use our ID card to vote on the internet without having to go to voting offices or log into various government services and view/edit private data related to our citizen status.
We can also use these ID cards to log-in to all banks in Estonia. It is more secure than private password codes that are on a separate sheet of paper and is more convenient to the end user. When authenticating it always asks for a separate PIN code, just like with any other card of that type. These ID card chips are nearly impossible to clone, just like SIM cards.
As a result there's an option for Estonians to also make their SIM card in their phone double as identification device. Our bank applications require this on phones, when logging in it sends encrypted information to the phone that can only be unencrypted with information from the SIM card. If successful, it allows you to log in and do bank transfers. This is far more secure than any regular password-sheet methods. It works through your network and has methods to protect from middle-man attacks as well.
However, that relies on SIM Toolkit and would not be possible without it. Also note that regular SIM cards cannot be upgraded to work like that. Government issues new type of SIM cards for that purpose.
kristovaher said:
Well, in Estonia we have implemented country wide ID Cards. That is, something what UK tried and failed to implement, it works here and is a great success. Our ID cards double as passports and in fact we do not need to carry passports when traveling within EU.
These same ID cards are part of a wider infrastructure. We can sign documents with these ID cards digitally (just as valid as a written signature, for example). These ID cards carry chips that are specially encrypted for that purpose and carry public and private keys for communicating with various online services. Other than digital document signatures (for any kind of document), we also use our ID card to vote on the internet without having to go to voting offices or log into various government services and view/edit private data related to our citizen status.
We can also use these ID cards to log-in to all banks in Estonia. It is more secure than private password codes that are on a separate sheet of paper and is more convenient to the end user. When authenticating it always asks for a separate PIN code, just like with any other card of that type. These ID card chips are nearly impossible to clone, just like SIM cards.
As a result there's an option for Estonians to also make their SIM card in their phone double as identification device. Our bank applications require this on phones, when logging in it sends encrypted information to the phone that can only be unencrypted with information from the SIM card. If successful, it allows you to log in and do bank transfers. This is far more secure than any regular password-sheet methods. It works through your network and has methods to protect from middle-man attacks as well.
However, that relies on SIM Toolkit and would not be possible without it. Also note that regular SIM cards cannot be upgraded to work like that. Government issues new type of SIM cards for that purpose.
Click to expand...
Click to collapse
I know what you mean. At least one bank over here implemented login using something called BankID on SIM which required new sim cards and SIM Toolkit. It used service SMS in the background though and was recently deprecated for a BankID app that starts up in the background and handles the encrypting and decrypting personally issued certs.
I agree that SIM Toolkit should be included regardless because it's very small and doesn't show up at all in the app drawer unless your SIM includes something that needs it. The layout and icon is very outdated though but you usually never have to interact directly with it like that. The messages it pops up look fine.
blunden said:
I know what you mean. At least one bank over here implemented login using something called BankID on SIM which required new sim cards and SIM Toolkit. It used service SMS in the background though and was recently deprecated for a BankID app that starts up in the background and handles the encrypting and decrypting personally issued certs.
I agree that SIM Toolkit should be included regardless because it's very small and doesn't show up at all in the app drawer unless your SIM includes something that needs it. The layout and icon is very outdated though but you usually never have to interact directly with it like that. The messages it pops up look fine.
Click to expand...
Click to collapse
Yeah, exactly.
My main point is that it's used in many countries and is especially relevant here in Estonia. Just because some mobile service companies misuse it is no grounds for removing it. It's like removing e-mail notifications just because you're unable to use spam lists.
I just wonder if Galaxy Nexus has it or not.
Take a look at *THIS* thread. I dont know if its of any value as I havent read through the thread but it seems to be something on how to put it on your phone and I very much doubt the Galaxy Nedxus will come with it preinstalled.
Mark.
we also have ID cards here. with an NFC chip(i can scan my ID card to my phone)
but we dont use that system. only for criminal identifying.
though there might be the solution.
instead of sim toolkit.
youd have to scan your ID card to log in(NFC)
and seeing as you do need your ID card everywhere(by law)
According to this it does have it, but that phone seems to have some other abnormalities from the thread here http://91.151.218.11/showthread.php?t=18331065&page=51
Picture:
https://lh3.googleusercontent.com/-...AAAAAAcI/WEg1ScqOFLo/s800/20111117_103746.jpg
kristovaher said:
According to this it does have it, but that phone seems to have some other abnormalities from the thread here http://91.151.218.11/showthread.php?t=18331065&page=51
Picture:
https://lh3.googleusercontent.com/-...AAAAAAcI/WEg1ScqOFLo/s800/20111117_103746.jpg
Click to expand...
Click to collapse
Seems to be a dev-build. Those usually include it.
Alright, Galaxy Nexus DOES have SIM Toolkit, I have the phone and it is listed under all Apps, but not in app drawer. Some of its functionality also seems to be working.
But does anyone know how to make it visible in app drawer? Not sure I need it for all things, but still.
Anyways, glad it is there!
I have a UK sim-free Galaxy Nexus and the SIM Tool Kit does appear in the app drawer for me with a Telstra SIM. It works from what I can see but I never really use it and all it provides is a mobile news service (pocket news from BigPond)
From my experience with my S2 also, the app only shows in the drawer when a SIM card is in the phone that actually has something to be used with the Tool Kit. When I used another SIM card once it didn't show up.

[Q] NFC uses in transit cards

I recently downloaded an app called FareBot.
It basically reads the amount of money left and the trips taken in my transit card. It uses the NFC capabilities to read them.
Is there a way to make my phone act as my transit card? Can the transit card be cloned and added to the phone's NFC capabilities?
ahse0w said:
I recently downloaded an app called FareBot.
It basically reads the amount of money left and the trips taken in my transit card. It uses the NFC capabilities to read them.
Is there a way to make my phone act as my transit card? Can the transit card be cloned and added to the phone's NFC capabilities?
Click to expand...
Click to collapse
Funny, I was looking today on my way into work on how to do the same thing...
No.
To emulate a card, you need access to the Secure Element of your NFC chip.
It's called Secure Element for a reason, Google ain't going to let any Tom, **** and Harry have access to the Secure Element.

[Q] Copy NFC tag to another NFC tag

Hi everyone, this has probably been asked before but I didn't want to i guess bump a necro thread.
Basically I was wondering is it possible for me to copy an nfc tag to another nfc tag. From a post I saw here, it said it is possible as long as the tag isn't encrypted.
So basically what i was hoping to know is one how would be the best way I would know if its encrypted and two what would be the easiest way to do this.
If it helps my mindset is basically I want to copy the NFC tag from my bus card onto a wristband so that I don't need to use the card anymore. What I'm guessing is that everything is set electronically in terms of card cost and stuff like that as I read that I can recharge and view my balance online so I'm assuming the card just acts like a connecter to your specific account and doesn't actually contain any money information on it.
I tried an app to read from the card and it did show me what I think is numerous files, in which the one I saw said that I was allowed to read from the device but no write access which I'm guessing is fine since all I want to do is read and copy from that NFC tag and then write it to another one I can buy.
The other thing I could do is just cut up my bus card and get the nfc part and place it under a watch or something, the bus company said I can get a new card for free whenever I like if I lose my current one so that's another way but seems a bit crude to me.
eitherrideordie said:
Basically I was wondering is it possible for me to copy an nfc tag to another nfc tag. From a post I saw here, it said it is possible as long as the tag isn't encrypted.
Click to expand...
Click to collapse
You can copy any information you can actually read. BUT the following is not working:
If it helps my mindset is basically I want to copy the NFC tag from my bus card onto a wristband so that I don't need to use the card anymore. What I'm guessing is that everything is set electronically in terms of card cost and stuff like that as I read that I can recharge and view my balance online so I'm assuming the card just acts like a connecter to your specific account and doesn't actually contain any money information on it.
Click to expand...
Click to collapse
Wrong assumption. A card used for banking etc has a private key on it that the bank will use to authenticate you. In order to do this they let the card sign some data and verifies the signature. If everyone could read that key, that would be horrible unsafe. Everybody that would be able to read the key could sign the data on your behalf. That is why the key is on the card and never leaves it.
I tried an app to read from the card and it did show me what I think is numerous files, in which the one I saw said that I was allowed to read from the device but no write access which I'm guessing is fine since all I want to do is read and copy from that NFC tag and then write it to another one I can buy.
Click to expand...
Click to collapse
As I said above, this works for cards that contain only data. You can copy any data that is readable, but cards that give you the functionality you want are not copyable via nfc.
The other thing I could do is just cut up my bus card and get the nfc part and place it under a watch or something, the bus company said I can get a new card for free whenever I like if I lose my current one so that's another way but seems a bit crude to me.
Click to expand...
Click to collapse
Same as above. Id guess your buscard is some sort of mifare card. You can only read/write those if you have the keys. And I don't think you will have them. Well it depends on the exact card but still.
Damastus said:
You can copy any information you can actually read. BUT the following is not working:
Wrong assumption. A card used for banking etc has a private key on it that the bank will use to authenticate you. In order to do this they let the card sign some data and verifies the signature. If everyone could read that key, that would be horrible unsafe. Everybody that would be able to read the key could sign the data on your behalf. That is why the key is on the card and never leaves it.
As I said above, this works for cards that contain only data. You can copy any data that is readable, but cards that give you the functionality you want are not copyable via nfc.
Same as above. Id guess your buscard is some sort of mifare card. You can only read/write those if you have the keys. And I don't think you will have them. Well it depends on the exact card but still.
Click to expand...
Click to collapse
I guess I had too much I was hoping would work, but from reading what you said it doesn't sound like it will . I do get that it has a private key, I was just kind of hoping that in this case it wouldn't since the card doesn't really seem like its worth much, such as compared to something like a visa card or something like that.
Each card has a unique number on them written on the back, so I guess I just kind of assumed each number was assigned for each account type thing and if you lost a card they would just change the account with another different number since you can own multiple bus cards, and that would be all I need, but it seems like you are most likely correct. Our buscard only came into affect about a month or two a go, but I'm assuming they probably paid a company of some sort to do it, and if thats the case they probably would have it encrypted either way
Is there still a way I could check? Just in case theres like some sort of miracle and it is only just a basic card type thing? Even though thats most likely wrong?
You can copy any data that is readable, but cards that give you the functionality you want are not copyable via nfc.
Click to expand...
Click to collapse
If this is the case though I guess its impossible
Cheers though
eitherrideordie said:
Is there still a way I could check? Just in case theres like some sort of miracle and it is only just a basic card type thing? Even though thats most likely wrong?
Click to expand...
Click to collapse
You could try to identify the card. Maybe use sth. like NFC TagInfo or ReTAG to see what type of card it is. These TagInfo will also show you whats in the card when its readable. But dont get your hopes too high.
Damastus said:
You could try to identify the card. Maybe use sth. like NFC TagInfo or ReTAG to see what type of card it is. These TagInfo will also show you whats in the card when its readable. But dont get your hopes too high.
Click to expand...
Click to collapse
Hi, thanks heaps, had a go at using NFC TagInfo and this is what I get
Tag information says the tag type is ISO/IEC 14443-4 smart card
mifare desfire evi(mf3ICD2I)
Under the ISO/IEC 14443-4 Smart card part
it talks about the mifare desfire
Within there it says
Key configuration changeable YES
Master Key required for application creation/deletion YES
Master Key required for application directory list NO
Master Key changeable YES
Available Keys KEY 0: Key version 1
Another key configuration says the exact same thing but also says
Key change permissions AUTHENTICATE WITH KEY 0 application master key
And there's a whole heap of files in there, most of which are readable but some say read fail.
From the sound of all this, its starting to not look that good , I'm assuming if there's keys and things that the only way would be to break them and I don't want to do anything against the rules to be honest .

Samsung Ezon NFC Unlock

I have the door lock and have some NFC stickers which work great
I have the Note and am trying to figure out how to use it with the door lock, but i cant get it to work i have NFC on and downloaded some apps
I put the Ezon in setup mode and the stickers register fine but not the phone, so im sure something is not right, but have no idea which
Won't work..
xboxhaxorz said:
I have the door lock and have some NFC stickers which work great
I have the Note and am trying to figure out how to use it with the door lock, but i cant get it to work i have NFC on and downloaded some apps
I put the Ezon in setup mode and the stickers register fine but not the phone, so im sure something is not right, but have no idea which
Click to expand...
Click to collapse
As I understand it, the only way to get your phone to unlock the Samsung Ezon is to be using Google Wallet and use the Loyalty Cards feature. I don't think the Note has Google Wallet so you might be out of luck. I have been trying to do the same thing for months now with a One X, One, S4 and Nexus to no avail.
from a google search I found this quote
your mobile phone to be your access key. This would then allow you to control when your card is active and when it is not. If you have an Android device that supports Google Wallet, you’re all set. The trick is to have Google Wallet installed with at least one “Loyalty Card” setup in the wallet, then make sure the card is enabled. Doing this enables NFC card emulation on your device which will present a UID to the EZon when it is within range. This type of card emulation is different from your payment information (so you don’t have to worry about the lock charging your bank account each time you unlock it). You can then enroll your phone just like a physical access card to the EZon and use your phone to unlock the device. The added benefit is that when your phone’s screen is turned off, card emulation is off as well which makes things a lot harder to tap and then clone.
Click to expand...
Click to collapse
..
I just installed my Ezon 6020 on saturday, and I havent been able to get it to detect me phone using the Commonwealth bank contactless app D:
it doesnt detect my usual credit cards either which surprised me...
did you find anything OP ?
any updates on this?

if a nfc/rfid card is disactivated?

lets say a nfc/rfid card for a job or apt is disactivated. Is there a way you can reprogram the card in anyway for it to be able to gain access again to those places?
bump
q-live said:
lets say a nfc/rfid card for a job or apt is disactivated. Is there a way you can reprogram the card in anyway for it to be able to gain access again to those places?
Click to expand...
Click to collapse
Afaik, there is no 'activation' or 'deactivation' on nfc.
Afaik, again, the readers interpret what the card has written on it. Let's take opening a door. On the card you have an unique ID, the reader goes through a list of authorized IDs, and if yours is in there, it opens the door.
Via an NFC reader app you should be able to replicate any card you like, and I also think reprogramming is possible. If your ID is not allowed to cross a gate anymore, you would have to scan a tag which can and emulate it. This goes without saying, don't do anything illegal.
Also, there could (should) be some more layers of protection, like encryption of the data on the tag, which could prevent advanced editing.
Of course, these are my two cents, I may be ridiculously wrong.
Sent from my XT1068 using XDA Free mobile app
Wow

Categories

Resources