Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

MIFARE Classic: exposing the static encrypted nonce variant [pdf]

eprint.iacr.org

Post reply on HN
Print view View original

11–20 of 103 posts

Re: MIFARE Classic: exposing the static encrypted nonce variant [pdf]

#11

Post by nine_k »

jeffbee wrote: post #7
dave_universetf wrote: post #5

Earlier quoted context omitted.

Possibly so. It just means that based on the report's findings, even if you'd decided to play it safe and buy exclusively from NXP directly (the creators of this ecosystem and owners of the MIFARE trademark), it looks like you could still end up with backdoored hardware.

Sorry if I was being unclear with my compound snark, but using a MIFARE Classic of any provenance would be a firing offense for the CISO of my daydream company.

What's a good alternative? How more expensive is it?

Re: MIFARE Classic: exposing the static encrypted nonce variant [pdf]

#12

Post by dave_universetf »

jeffbee wrote: post #7
dave_universetf wrote: post #5

Earlier quoted context omitted.

Possibly so. It just means that based on the report's findings, even if you'd decided to play it safe and buy exclusively from NXP directly (the creators of this ecosystem and owners of the MIFARE trademark), it looks like you could still end up with backdoored hardware.

Sorry if I was being unclear with my compound snark, but using a MIFARE Classic of any provenance would be a firing offense for the CISO of my daydream company.

Indeed. Alas (or fortunately depending which colour team you work on), fully broken Mifare Classic is still all over the place, and likewise the "hardened" variant broken in this paper :(

Re: MIFARE Classic: exposing the static encrypted nonce variant [pdf]

#13

Post by TeMPOraL »

evanjrowley wrote: post #8
jeffbee wrote: post #2

"Should we buy a Chinese knockoff of MIFARE Classic" strikes me as a self-answering question, but I guess that's why I still haven't been promoted to CISO.

You might get promoted to CISO if you can come up with a creative way to quantify the risk. Risk management frameworks can communicate how the impact, likelihood, and possible responses would play out in dollar amounts. With a few proposed ideas for how different risk mitigations would affect the resulting residual risk, non-technical people may be able to adopt your vision for securing the enterprise. Yes, it also m…

1) Frame as much of the risk in terms of reputation damage;

2) Present a huge dollar number to make it sound important;

3) Get promoted as everyone high-up implicitly understands that reputational damage is a fiction that never materializes in practice.

Re: MIFARE Classic: exposing the static encrypted nonce variant [pdf]

#14

Post by borski »

fsckboy wrote: post #10

could somebody ELI5 the threat vector here? I'm not skeptical, I just don't know what to imagine. backdoor implies somebody can "get in" to my rfid, but rfid's spend most of their time "off the grid". So when my rfid powers up, does the "host" who powered it up also need to be insecure or on an insecure/compromised net? then... what capabilities would suddenly become possible; unlocking the door is already unlocked,…

The idea is that by spending a few minutes with your card, someone can now clone it and impersonate you. Yes, they could already steal your card, but you might notice that. But if you leave it on your desk for a few minutes in your wallet, or IT “borrows” it to re-encode it, or any thousand of other ways to get a hold of your RFID card… it can be dumped, cloned, and you can be impersonated.

That’s the threat vector.

Re: MIFARE Classic: exposing the static encrypted nonce variant [pdf]

#15

Post by borski »

TeMPOraL wrote: post #13
evanjrowley wrote: post #8

Earlier quoted context omitted.

You might get promoted to CISO if you can come up with a creative way to quantify the risk. Risk management frameworks can communicate how the impact, likelihood, and possible responses would play out in dollar amounts. With a few proposed ideas for how different risk mitigations would affect the resulting residual risk, non-technical people may be able to adopt your vision for securing the enterprise. Yes, it also m…

1) Frame as much of the risk in terms of reputation damage; 2) Present a huge dollar number to make it sound important; 3) Get promoted as everyone high-up implicitly understands that reputational damage is a fiction that never materializes in practice.

That’s not how CISOs get promoted. If a CISO presented it this way, the very obvious next question is “and how much will it cost us to fix” followed by “and how much will insurance cover,” which are both going to blow the reputational damage argument out of the water.

CISOs get promoted by being willing to focus on compliance over security, so that they can cover the company if and when it inevitably gets breached by saying they “followed best practices” (if that’s true).

All of this is because resolving a breach and giving everyone a year of identity theft protection is a lot less expensive, short-term, than actually investing in a real security practice, and companies in the US think in quarters, not years.

Europe is better about this because they tend to think many years ahead rather than focusing on short-term results.

Re: MIFARE Classic: exposing the static encrypted nonce variant [pdf]

#16

Post by ethbr1 »

borski wrote: post #14
fsckboy wrote: post #10

could somebody ELI5 the threat vector here? I'm not skeptical, I just don't know what to imagine. backdoor implies somebody can "get in" to my rfid, but rfid's spend most of their time "off the grid". So when my rfid powers up, does the "host" who powered it up also need to be insecure or on an insecure/compromised net? then... what capabilities would suddenly become possible; unlocking the door is already unlocked,…

The idea is that by spending a few minutes with your card, someone can now clone it and impersonate you. Yes, they could already steal your card, but you might notice that. But if you leave it on your desk for a few minutes in your wallet, or IT “borrows” it to re-encode it, or any thousand of other ways to get a hold of your RFID card… it can be dumped, cloned, and you can be impersonated. That’s the threat vector.

Super curious to know how many common access control solutions flag unbalanced entries/exits.

E.g. if "John" badges in... and then 10 minutes later "John" badges in again...

Will most systems complain?

Re: MIFARE Classic: exposing the static encrypted nonce variant [pdf]

#17

Post by 0cf8612b2e1e »

ethbr1 wrote: post #16
borski wrote: post #14

Earlier quoted context omitted.

The idea is that by spending a few minutes with your card, someone can now clone it and impersonate you. Yes, they could already steal your card, but you might notice that. But if you leave it on your desk for a few minutes in your wallet, or IT “borrows” it to re-encode it, or any thousand of other ways to get a hold of your RFID card… it can be dumped, cloned, and you can be impersonated. That’s the threat vector.

Super curious to know how many common access control solutions flag unbalanced entries/exits. E.g. if "John" badges in... and then 10 minutes later "John" badges in again... Will most systems complain?

That would be a terrible user experience. Most places are not diligent about ensuring each employee separately badges past a barrier. Common to hold the door for Bob while he is juggling a coffee. Boom, missed badge swipe and now things are forever imbalanced.

Re: MIFARE Classic: exposing the static encrypted nonce variant [pdf]

#18

Post by dave_universetf »

borski wrote: post #14
fsckboy wrote: post #10

could somebody ELI5 the threat vector here? I'm not skeptical, I just don't know what to imagine. backdoor implies somebody can "get in" to my rfid, but rfid's spend most of their time "off the grid". So when my rfid powers up, does the "host" who powered it up also need to be insecure or on an insecure/compromised net? then... what capabilities would suddenly become possible; unlocking the door is already unlocked,…

The idea is that by spending a few minutes with your card, someone can now clone it and impersonate you. Yes, they could already steal your card, but you might notice that. But if you leave it on your desk for a few minutes in your wallet, or IT “borrows” it to re-encode it, or any thousand of other ways to get a hold of your RFID card… it can be dumped, cloned, and you can be impersonated. That’s the threat vector.

In the case of this attack, somewhere between 40s and 30min of physical access, depending on how the card was set up. In the case of a hotel, the spicy card to clone would be the cleaning staff's, which conveniently also admits a reasonable explanation for the card going temporarily missing (e.g. abandon it one corridor over, oops must have dropped it while doing the rounds).

Depending on the specifics of a deployment, I'm guessing you could also use the card secrets to mint new cards that authenticate correctly to facility readers, but contain different information? But I don't know nearly enough about how these cards get used to know how much flexibility you get there.

Re: MIFARE Classic: exposing the static encrypted nonce variant [pdf]

#19

Post by guardiangod »

fsckboy wrote: post #10

could somebody ELI5 the threat vector here? I'm not skeptical, I just don't know what to imagine. backdoor implies somebody can "get in" to my rfid, but rfid's spend most of their time "off the grid". So when my rfid powers up, does the "host" who powered it up also need to be insecure or on an insecure/compromised net? then... what capabilities would suddenly become possible; unlocking the door is already unlocked,…

Most RFID card systems in the world uses MIFARE Classic due to its cost and long history.

MIFARE (not just the Classic family) have a UID (32 bits) and x blocks of encrypted data (12 for Classic). Each block is protected by a A key and a B key.

The earliest card system only uses UID for authentication ie. if the card says the right UID the card passes authentication.

Obviously, anyone can forge a card with said UID, so the latter system start to use the 12 encrypted fields for authentication. The card reader would challenge the card to encrypt the nonce plus stored identification. Only cards with the correct key can respond with the correct encrypted data + nonce.

The authentication uses symmetric encryption. Depending on how the system is setup, A key is used for Read only, Read Write, or A is used for read and B is used for write, or both A/B is need for read write.

The original Mifare Classic uses a proprietary crypto crypto-1. Due to various reasons (eg. weak PRNG, collisions, etc.) , it can be trivial to crack a traditional Mifare Classic key. However there are harden keys that still could not be cracked due to various countermeasures.

The paper seems to found a hardcoded A/B key A396EFA4E24F for a particular brand of RFID cards (I just skimped the paper and its been years since I worked on RFID. I might be wrong on the detail).

Re: MIFARE Classic: exposing the static encrypted nonce variant [pdf]

#20

Post by borski »

ethbr1 wrote: post #16
borski wrote: post #14

Earlier quoted context omitted.

The idea is that by spending a few minutes with your card, someone can now clone it and impersonate you. Yes, they could already steal your card, but you might notice that. But if you leave it on your desk for a few minutes in your wallet, or IT “borrows” it to re-encode it, or any thousand of other ways to get a hold of your RFID card… it can be dumped, cloned, and you can be impersonated. That’s the threat vector.

Super curious to know how many common access control solutions flag unbalanced entries/exits. E.g. if "John" badges in... and then 10 minutes later "John" badges in again... Will most systems complain?

Great question; not to my knowledge. There would be many false positives, especially as people bring in guests. Sometimes guests get a temp badge; at many companies, they get a sticker to put on their shirt and get tapped in by their host, who is responsible for them.

Rather than building a SOC to look at logs and flag unbalanced entries or similar (which would be very expensive), companies tend to rely on their employees’ vigilance.

Post reply on HN