RFID/NFC cloning: badges copied in seconds

July 18, 2024 · 1 min read · #hardware #rfid #nfc

RFID/NFC access control ranges from trivial tags to cryptographic smart cards. Security depends enormously on the technology used.

The gap

125 kHz (LF, e.g. EM4100/HID Prox): transmit a static ID with no authentication. Read and cloned in seconds (Proxmark, Flipper Zero). 13.56 MHz (HF): Mifare Classic has encryption (Crypto1) but it is broken — keys are recoverable. Only modern cards (DESFire EV2/3, with AES and mutual authentication) resist, if configured well.

proxmark3> lf hid read      # read a Prox badge
proxmark3> lf hid clone ... # write to a blank tag

Defence

Use modern smart cards (DESFire EV2/EV3) with AES and key diversification, not static LF or Mifare Classic. Multi-factor for sensitive areas (badge + PIN). Detect anomalies (same badge in two places). Keys must not be the defaults.

« back to home