2

I was surprised to find out today that condominium, garage etc. access cards can be duplicated and used without being registered with the reader system. Are these RFID cards? Does it mean that store-value cards for transportation can also be duplicated?!

My understanding was that each RFID card has a GUID that is "burned" into the card. When the card reader reads the card, it will match the unique GUID with the system records to make sure it is registered with the system before granting access. Is this not the case?

Jake
  • 477
  • 2
  • 6
  • 12
  • 5
    If a reader can read the GUID, why can't it be duplicated? Have you done any research? This is a very popular and well-written topic. – schroeder Mar 04 '15 at 09:16
  • My thoughts: It can read, but it cannot be "burned" into the card, since the duplicated card would have its own GUID already. But if it can be duplicated, then why can't we duplicate store-value cards and even like the VISA Pay Wave? – Jake Mar 04 '15 at 09:18
  • 5
    There are multiple RFID technologies out there. It can be simply an id providing, but also "smartcard" operations that includes computations. – M'vy Mar 04 '15 at 09:33

1 Answers1

4

Primitive RFID keys can generally be copied easily. (CloneMyKey.com says it can clone 90% of RFID tags.) In most cases it's just a chip that emits an ID, which can't be changed. But sometimes it can be reprogrammed - and sometimes you can order tags programmed with specific requested IDs. (See YouTube videos for RFID Cloning.)

The card itself doesn't have to be a card, it can be a device, which obviously won't have a burned-in ID, which can be used to replay RF transmissions to mimic the signals normally emitted by a legitimate card. They are just radio waves after all.

Some systems will use a simple ID check from the card to determine if the card has the right ID to allow access. Some systems (like NFC) do have protection from these replay attacks, with varying degrees of fallibility. The same technology is used in Oyster cards, on the London transport network for example, and there are numerous cases of this technology being hacked, with card skimming and replay attacks taking place and uploaded to YouTube - How to Clone an Oyster Card.

Credit/Debit card NFC payments involves two parts of information being sent from the card to the reader, one request from the reader is to identify the type of card, next the reader makes a request to the card that is specific to the type of card, this effectively unlocks the card, which then transmits the next piece of data, used to confirm the card is legitimate. The second request the card makes involves using a secret key that is proprietary information, known only those associated with the card industry. The card itself has built in defences to prevent brute force attacks to discover this key.

So yes, it is possible to clone some RFID cards (or tags), and it is possible to impersonate them with devices, but it depends how a specific system is using these devices as to how vulnerable each system is to this style if attack.

Is NFC still a vulnerable technology

StampyCode
  • 435
  • 4
  • 8