Card emulation on Galaxy S3 olympics - NFC Hacking

Just read this article
http://global.samsungtomorrow.com/?p=16659
The interesting thing is that they must have been using the hidden API to be able to use card emulation.
From my experience with hotel nfc cards they often are Mifare UltraLight cards.
Maybe they are giving out special phones using a custom ROM made by samsung that has this enabled.
I'm currently checking the 4.1 sources to see if anything can be done with that.
So what do you guys think about this? If someone with access to this phone could dump the rom it could be easily checked with the current S3 and see the diff.

This is interesting but I think we will have to wait. The article says only 40 VIPs will get it to start, the odds of any of them dumping the the ROM is slim to none.

Fredro said:
Just read this article
http://global.samsungtomorrow.com/?p=16659
The interesting thing is that they must have been using the hidden API to be able to use card emulation.
From my experience with hotel nfc cards they often are Mifare UltraLight cards.
Maybe they are giving out special phones using a custom ROM made by samsung that has this enabled.
I'm currently checking the 4.1 sources to see if anything can be done with that.
So what do you guys think about this? If someone with access to this phone could dump the rom it could be easily checked with the current S3 and see the diff.
Click to expand...
Click to collapse
They have the Holiday Inn app on their phone, as shown on Engadget. I think there are already apps that let you copy NFC card data to your phone.

Product F(RED) said:
They have the Holiday Inn app on their phone, as shown on Engadget. I think there are already apps that let you copy NFC card data to your phone.
Click to expand...
Click to collapse
Indeed copying the card is no problem, though it's the ability to use the phone to emulate the card that is interesting

Fredro said:
Indeed copying the card is no problem, though it's the ability to use the phone to emulate the card that is interesting
Click to expand...
Click to collapse
All it does is transmit what was copied on the card via NFC. But in my experience most hotels don't use NFC yet; they still use magnetic strip cards, which by the way can still be easily copied. Just because they're encrypted doesn't mean you can't just copy the raw encrypted data to another card. Check this out:

Product F(RED) said:
All it does is transmit what was copied on the card via NFC. But in my experience most hotels don't use NFC yet; they still use magnetic strip cards, which by the way can still be easily copied. Just because they're encrypted doesn't mean you can't just copy the raw encrypted data to another card. Check this out:
Click to expand...
Click to collapse
I've been to several new hotels which indeed use NFC Ultralight cards.
I'm saying that, to be able to use this data you've copied from a card onto your phone, you need to be able to make the phone emulate the same card as the one you copied from. And that is the interesting part.
I'm working on a patch for 4.1.1 (galaxy nexus) that will enable this option, same as the phones used at this olympic hotel.

Google Wallet works in the same way, doesn't it? Card emulation is built into Android, but for an application (like Google Wallet) to use it, it must hold the access keys to the secure element.
Samsung controls the secure element in the S3; writing an application that can access the secure element is no problem for them.
Also, someone above said something about just copying the 'raw data' from an 'encrypted' card. You'll need access keys to access the data stored in each sector, so I doubt that would work.

LoveNFC said:
Google Wallet works in the same way, doesn't it? Card emulation is built into Android, but for an application (like Google Wallet) to use it, it must hold the access keys to the secure element.
Samsung controls the secure element in the S3; writing an application that can access the secure element is no problem for them.
Also, someone above said something about just copying the 'raw data' from an 'encrypted' card. You'll need access keys to access the data stored in each sector, so I doubt that would work.
Click to expand...
Click to collapse
yes, it's correct that samsung has control over who has access to it, but it's easy to "add yourself" if you patch the software.
About the keys for each sector, this is no problem because the ultralight cards dont use any encryption, even for the classic cards the protection is broken. So this doesn't really matter, the point is that people should be able to create their own cards inside the phone for their own usage for example.

Fredro said:
I've been to several new hotels which indeed use NFC Ultralight cards.
I'm saying that, to be able to use this data you've copied from a card onto your phone, you need to be able to make the phone emulate the same card as the one you copied from. And that is the interesting part.
I'm working on a patch for 4.1.1 (galaxy nexus) that will enable this option, same as the phones used at this olympic hotel.
Click to expand...
Click to collapse
Please kindly let me know if you succeed in patching the galaxy nexus, as I really want to use my phone as a nfc to open my building entrance door!

any. outhosur
Fredro said:
yes, it's correct that samsung has control over who has access to it, but it's easy to "add yourself" if you patch the software.
About the keys for each sector, this is no problem because the ultralight cards dont use any encryption, even for the classic cards the protection is broken. So this doesn't really matter, the point is that people should be able to create their own cards inside the phone for their own usage for example.
Click to expand...
Click to collapse
Sometimes I totally no idea why RFID card or NFC tag emulation so complicated.

fordiy said:
Sometimes I totally no idea why RFID card or NFC tag emulation so complicated.
Click to expand...
Click to collapse
cuz of the thousands of geezers who wanna abuse cards or nfs tags

LoveNFC said:
Also, someone above said something about just copying the 'raw data' from an 'encrypted' card. You'll need access keys to access the data stored in each sector, so I doubt that would work.
Click to expand...
Click to collapse
I've succesfully copied and cracked a Mifare classic card, thus accessing all the data in the sectors. It took me just over 10 minutes for a single card. But my interest is also, how can I put this card dump file on my phone and let the NFC chip push/emulate this card dump as a Mifare card?
See also http://forum.xda-developers.com/showthread.php?t=1706057

Is there any reason it has to be your phone? Could you write the info to a mifare tag, and get the same effect? This would allow you to clone the card to a paper sticker.

sysadmn said:
Is there any reason it has to be your phone? Could you write the info to a mifare tag, and get the same effect? This would allow you to clone the card to a paper sticker.
Click to expand...
Click to collapse
The Problem is that you can't change the ID of the card. Most applications check (only) for the ID as it is (falsely) seen by many as unique and unspoofable. So an card emulator able to let you change the ID as handy as a smartphone would be really really nice

nookieman said:
The Problem is that you can't change the ID of the card. Most applications check (only) for the ID as it is (falsely) seen by many as unique and unspoofable. So an card emulator able to let you change the ID as handy as a smartphone would be really really nice
Click to expand...
Click to collapse
But this feature is normally not accessible in the phones - partly also because of these reasons.
You would have to obtain keys to the ecure element from the operator or the handset manufacturer and will surely not give it to you if you are not a bank or someone of a similar size
---------- Post added at 02:38 PM ---------- Previous post was at 02:32 PM ----------
Perhaps you could also try to use an unofficial ROM, but I am not sure if that solves the problem

In order to emulate MIFARE Ultralight, you need the first UID byte = 0x04. NXP Semiconductors have introduced a restriction in their interface chips such that UID0 is hardwired to 0x08, meaning "random UID" according to their specifications. So even if hidden Android API get released, it will still not be possible to use the phone itself for MIFARE Ultralight tag emulation. However, EMUTAG emulator on emutag.com totally solves the problem by being portable, and can emulate any UID with almost no restrictions* (see Manual).

yeah its right.. i agree with you

Related

Does the One X have NFC card emulation enabled?

Does the One X have NFC card emulation enabled?
Well, does it?
No. In the future it might be possible that a custom kernel and rom might be able to crack it. However at present card emulation does not work on any android phone. It has something to do with google restricting access to the secure element.
ozaghloul said:
No. In the future it might be possible that a custom kernel and rom might be able to crack it. However at present card emulation does not work on any android phone. It has something to do with google restricting access to the secure element.
Click to expand...
Click to collapse
Access to the SE and card emulation are two different things entirely. The SE in only used for payment info. Given proper API support the SE is not needed to emulate a standard NFC card (like access cards).
What that being said, card emulation is not exposed in the API itself. Based on some comments made by Google I wouldn't expect it to be exposed any time soon either. They have moved forward leveraging NDEF push for transmitting data from a device to another device via NFC.

Use Android Phone as NFC Tag?

Hello there,
is it possible to use my HTC One X as an NFC Tag?
My goal is to scan a normal NFC Tag (1k) with my phone and store the informations. And then I'll provide this informations with my phone, so an other NFC Reader can read the informations stored on my phone.
Greetz
It is possible as the NXP chip most likely used by the HTC (and known to be in Nexus S/galaxy) can be put into card emulation mode but the current kernel does not support it. There has been at least one user that has gotten it to work on the Nexus S.
Nightskill said:
Hello there,
is it possible to use my HTC One X as an NFC Tag?
My goal is to scan a normal NFC Tag (1k) with my phone and store the informations. And then I'll provide this informations with my phone, so an other NFC Reader can read the informations stored on my phone.
Greetz
Click to expand...
Click to collapse
Hi i believe NFC ReTag will do the trick , or at Least NFC TagReader , can also be use as ask … but that will depend on what you will store in … as you didn’t say it ican’r help you more at this stage.
hope that help
Nightskill said:
Hello there,
is it possible to use my HTC One X as an NFC Tag?
My goal is to scan a normal NFC Tag (1k) with my phone and store the informations. And then I'll provide this informations with my phone, so an other NFC Reader can read the informations stored on my phone.
Greetz
Click to expand...
Click to collapse
I'd really like to do the same thing.. but haven't had any success in finding a way to do that. I would personally love to scan my work badge and use my phone instead of my badge which I commonly leave at home. It would also be great for hotels where I commonly lose my hotel key and could instead use my phone.
Any advice on these being a possibility. Any additional information I need to provide. I personally have the HTC EVO 4G LTE and my wife has the Nexus S 4G that I could use.
card emulation
try NFClassic.apk its in the android market, i cannot confirm it works but it appears to and i will test it tomorrow, it recognises my work card it picks up 2 tags, one will be door access and the other is canteen credit, (the app doesnt tell you this, but i know there 2 parts to the card, as i recently cancelled a card then found it, and can no longer access doors with it, but can still use it in the canteen) anyway the app reads the card and asks if you want to save the info, save it, the you will see it under saved tags click the tag, and click share tag, it then appears to emulate the tag as a card so it can be read by a nfc card reader, but i dont have a reader to confirm this, but i will try it tomorrow night at work to see if the doors accept it, ill let you know my results
and if anyone else know of any apps that can definatley emulate cards on galaxy s 3 let me know ! the more software i can try at work the more likely ill find one that works, i only got my s3 yesterday and have been of work so havnt tested any app, but NFClassic is the only one that appears to emulate my card.
note the app cannot write cards, only has options to write contact to card but when tried it force closes. i would definatly like to be able to write to card if at all possible ( free lunch copy card when it has credit , when run out of credit, re-write info = credit again its gotta be possible somehow ! )
okz19 said:
try NFClassic.apk its in the android market, i cannot confirm it works but it appears to and i will test it tomorrow, it recognises my work card it picks up 2 tags, one will be door access and the other is canteen credit, (the app doesnt tell you this, but i know there 2 parts to the card, as i recently cancelled a card then found it, and can no longer access doors with it, but can still use it in the canteen) anyway the app reads the card and asks if you want to save the info, save it, the you will see it under saved tags click the tag, and click share tag, it then appears to emulate the tag as a card so it can be read by a nfc card reader, but i dont have a reader to confirm this, but i will try it tomorrow night at work to see if the doors accept it, ill let you know my results
and if anyone else know of any apps that can definatley emulate cards on galaxy s 3 let me know ! the more software i can try at work the more likely ill find one that works, i only got my s3 yesterday and have been of work so havnt tested any app, but NFClassic is the only one that appears to emulate my card.
note the app cannot write cards, only has options to write contact to card but when tried it force closes. i would definatly like to be able to write to card if at all possible ( free lunch copy card when it has credit , when run out of credit, re-write info = credit again its gotta be possible somehow ! )
Click to expand...
Click to collapse
You can try, but it's probably not going to work.
Bardamuz said:
Hi i believe NFC ReTag will do the trick , or at Least NFC TagReader , can also be use as ask … but that will depend on what you will store in … as you didn’t say it ican’r help you more at this stage.
hope that help
Click to expand...
Click to collapse
NFC ReTag can´t do that ... but a lot of other cool stuff
I tried nfclassic and that didn't work I'm also looking for NFC card emulation
I'm not sure about other phones but Evo4GLTE's have Android beam that should do what is wanted
This didn't even occur to me til I saw this thread. I will be trying with my work badge since I occasionally forget mine as well...
I am still deciding between getting the S3 and the EVO 4G LTE. Leaning towards evo... but haven't played with the s3 yet.
I don't have your HTC, although there's documented info for the nexus s where devs were successful in emulating mifare most of the code is still on dev android. Its not full reigns of emulation but depending on your level of tech you can do some pretty cool stuff. I don't know how far this has gone but I remember people getting some functionality on new galaxy. Check out the link.
http://techshek4u.blogspot.com/2012/01/applying-card-emulation-patch-to_03.html
How does google wallet do it? Doesn't that emulate a secure card?
Sent from my GT-I9300 using xda premium
Zanith said:
How does google wallet do it? Doesn't that emulate a secure card?
Click to expand...
Click to collapse
I was thinking the same thing!
The most "advanced" operations that i was able to do with the Galaxy Nexus were saving actions with differents cards. But that's all.
By the way, i use NFC ReTag to achieve it.
What I was just referring to was emulation how I perceived the op was looking for. Example you use a card at work to open a door and wanted to emulate that so you could use your phone instead. However with gwallet or say paywave then you'd need to have the secure key which obviously wouldn't just be given out otherwise you would be able to emulate anyone's card. Hence the secure element. Then it would be ridiculously insecure. Ex. If I took a friends paywave and was able to emulate it then now I in theory just stole their credit card . It's also why gwallet won't work without a secure element like on my sgs2.
Sent from my SGH-I777 using xda premium
WOW interesting topic
Nizda1 said:
I don't have your HTC, although there's documented info for the nexus s where devs were successful in emulating mifare most of the code is still on dev android. Its not full reigns of emulation but depending on your level of tech you can do some pretty cool stuff. I don't know how far this has gone but I remember people getting some functionality on new galaxy. Check out the link.
http://techshek4u.blogspot.com/2012/01/applying-card-emulation-patch-to_03.html
Click to expand...
Click to collapse
anyone trythis
ive seen the video after flashing and kinda dissapointed
bcos they cannot prove that nexus s can be the nfc tag anyway they donk have the reader too to test it
Hmmm...
Hey guys.. i went searching in the marketplace for an app that does just that (emulate a RFID)...
And... I FOUND ONE!It's called NFC Classic Tag Reader
It was able to read my cards and apparently emulate it but i have no idea if it works cause my door does not detect it... and i have no other NFC devices...
I'm using a SHS-5120 door lock... and that only registers the serial no of the tags programmed and allows only those to enter...
Read on the comments that ICS users are not getting it to work but previous 2.3.3 user reviewed that it was working like a charm...
Oh and i'm using a S3... which of course is ICS...
I reckoned Google Wallet will store something into the mobile NFC chip. Make the phone like a RFID card or tag.
I also noticed some Korean telecom operators has their apps integrated on the Android phones which have the Membership card, Voucher, Credit card etc. functionality. That means the NFC enabled phone can be acted as RFID card or tag.
Is there anyone know where we can find the source code sample from Google development website we could look into this kind of project?
We have HID sensors on doors at work as well as a clocking in system and both use different cards so I'm going to have a go with them on Monday with my SGS3.
SimonCraddock said:
We have HID sensors on doors at work as well as a clocking in system and both use different cards so I'm going to have a go with them on Monday with my SGS3.
Click to expand...
Click to collapse
any luck with doors?
Anyone any luck with being able to push/publish his phone as a card? Like for instance with doors?
We have Mifare Classic cards which open doors, reading the card isn't a problem, but being able to emulate your phone as a card has proven to be more difficult..
How does one turn his phone into 'beacon mode' (being able to receive the door's power boost and return card info) ?

Reading/Writing MiFare Ultralight on Nexus S (ICS)

Hi,
I'm looking for a way to read & write on a Mifare Ultralight. I know a couple of applications available on the Play Store allow the possibility to read them, but I didn't find any application allowing me to write back (for example, change the data and save it back).
Is there a way to do so?
Also, is it possible to plug in the Android to my computer to use the NFC capabilities and to code in another language than Java? (some kind of bridge)
Thanks a lot for your support!
jpmonette said:
Hi,
I'm looking for a way to read & write on a Mifare Ultralight. I know a couple of applications available on the Play Store allow the possibility to read them, but I didn't find any application allowing me to write back (for example, change the data and save it back).
Is there a way to do so?
Also, is it possible to plug in the Android to my computer to use the NFC capabilities and to code in another language than Java? (some kind of bridge)
Thanks a lot for your support!
Click to expand...
Click to collapse
Have you tried NXP NFC Writer app? As of now there is no way to use your phone as a USB NFC reader.
Well I have both TagWriter and TagInfo. I can read the content of my NFC chip with TagInfo, but I can't with TagWriter. That's why I'm looking for something else to do the job, but can't find much on the Play Store.
jpmonette said:
Well I have both TagWriter and TagInfo. I can read the content of my NFC chip with TagInfo, but I can't with TagWriter. That's why I'm looking for something else to do the job, but can't find much on the Play Store.
Click to expand...
Click to collapse
Is the tag write locked? Formatting Classic 1K tags to NDEF is part of the standard NFC/NDEF libraries on Android. This allows full write access.
If you're trying to do it without NDEF then you have a different set of issues you'll need to deal with.
Nfc task launcher
Sent from my Nocturnal HOX
krohnjw said:
Is the tag write locked? Formatting Classic 1K tags to NDEF is part of the standard NFC/NDEF libraries on Android. This allows full write access.
If you're trying to do it without NDEF then you have a different set of issues you'll need to deal with.
Click to expand...
Click to collapse
Well, some pages are writable, some others aren't. Still, I can't get it to work with any apps I found (also the one people suggested in here).

Copying NFC tags?

Is there some way to copy one RFID NFC tag to another blank NFC tag with the SGS3?. I have 2 active NFC tags that I would like to mess around with and see if I can actually copy them and get the same access as my authentic ones offers.
So down to the question. Is it possible to copy the entire contents of an NFC chip and write it to another one with an app, and in that case which one?
bump* I'd like to know as well
copy a tag
"NFC Smart Q supports reading or copying a tag"
I just read this, didn't use this app.
There must be more nfc apps in Google's android shop, doing this trick.
I cannot post links, i'm sure you will find it.
MeX_DK said:
Is there some way to copy one RFID NFC tag to another blank NFC tag with the SGS3?. I have 2 active NFC tags that I would like to mess around with and see if I can actually copy them and get the same access as my authentic ones offers.
So down to the question. Is it possible to copy the entire contents of an NFC chip and write it to another one with an app, and in that case which one?
Click to expand...
Click to collapse
Depends. If it's a tag without any protection, yes.
If it's a tag with crypto, such as most RFID door entry systems, contactless credit cards, subway cards - no, they're intentionally designed to prevent such things. (Specific systems may have been hacked, but in general, these are not copyable.)
"Not protected" means I can edit them as I want right??
So if I can solve the encryption manually than I can change my info on my NFC card with the help of my cellphone.
Is that right??
https://play.google.com/store/apps/details?id=com.skjolberg.nfc.clone2. Try this..... Works for me
Sent from my Nexus 4
carhustler said:
https://play.google.com/store/apps/details?id=com.skjolberg.nfc.clone2. Try this..... Works for me
Sent from my Nexus 4
Click to expand...
Click to collapse
Agreed - may not work for everything, but definitely one of the better tag cloning apps.
Hello,
I am new at nfc so please do not judge me
I have one question:
It is possible to write dokumrent path in nfc tags for example:URL.
but on the path will be security level as:
login
pasword
And after you type your login and password it is automatically opened your dokument.
I was tried to write this way, but after I type login and password the link is not active longer and I have to search manually the document in my data base.
Waiiting fot you answers
For any information I would be thankfull.
P.S. It is possible to do this with my samsung galaxy s3?

NFC read write & protection.

Now a days the most talked topic of the world is wireless. And one of the most recent and widely used wireless technology is NFC (Near Field Communication). Today most of our credit cards and security cards are NFC enabled. When our cellphone comes with a NFC reader we must be interested to finding that how this tech work or what is really going on when we punch our credit card, is it possible to hack our subway pass?? So I tried to find-out something about NFC here is some info about it that you might be interested on:
Please use this information only for fun and testing field. Respect your country law. I'm not responsible if you break any law using this information.
** NFC tags can be protected.
** Non protected tags can be edited(mostly rewrite) with any NFC enabled devices using some apps.
** There are several "Sectors" and "Blocks" in a tag just like a RAM(Random Access Memory), most probably to address the memory efficiently.
** I found two types of protection #Soft protect(read able from any system) & #Hard protect (Not readable from other systems or apps).
** You can copy the data of a protected NFC tag depending how it's protected.
** I was able to read and erase the data of my University ID card which is of "Type A(ISO/IEC 14443 Type A).
** However I was not able to read any kind of data from my "Smart Cash Payment Card" which is of Type F(JUS-X 6319-4 / FeliCa).
** Android has built-in protection against NFC hacking or something like that so you may not be able to read or write any credit card with your stock android.
** Though some custom rom like CynogeMod may allow you to do so.
## There is an app that can really copy your standard credit card and simulate it from your phone. That is you can use your phone as a credit card. If it can't copy the card or read it's info, the app is also capable of sending the signal form a credit-card reader through another phone to your credit card. which means you can hold one phone over your NFC credit card and hold another phone(connected to each other over WiFi) and use the card without taking it near the card reader.
I'm not sure if I should post the APK or the the link here as it is not available in the android market and it's not mine. I just found it on the web.
Please let me know if I found out anything wrong or explained anything wrong.
_______________________________________________
Please press the thanks button if you find this helpful.
What are you using as a reader?
Sent from my SPH-D710 using Tapatalk 2
I'm using NFC retag pro and NFC tag writer.
Please continue to update this thread with more findings as I am sure many would benefit from it. :good:
arvin2212 said:
Please continue to update this thread with more findings as I am sure many would benefit from it. :good:
Click to expand...
Click to collapse
I'll try my best to find out more bout this. Any kind of help is welcome.
apk
@op
where that apk can be found if u dont wanna post link here?
Thanks
shubri said:
@op
where that apk can be found if u dont wanna post link here?
Thanks
Click to expand...
Click to collapse
I'd love to but I'm afraid if it's gonna be legal...
PM me I'll see what can be done...
Isn't what you described NFCProxy?
Beamed from my Maguro
Mach3.2 said:
Isn't what you described NFCProxy?
Beamed from my Maguro
Click to expand...
Click to collapse
Yah it is. But I was afraid of my country rules. Some people stole some Credit card ID using NFC device. That's the reason I was not posting the name in public.
That is interesting. If someone managed to steal your card using a phone, you are extremely not careful..
Beamed from my Maguro

Categories

Resources