search

burja8x / relay

A tool for performing relay attacks on RFID/NFC systems (ISO 14443-4A)
GNU General Public License v3.0
10 stars 2 forks source link

MFClassic #2

Open Dan-Rdd opened 1 year ago

Dan-Rdd commented 1 year ago

so I have acheived a low latency and have been playing with MF Classic hoping it would just work but I seem to be getting a Seg fault as shown below. Any Idea? in the logs it comes up new command from reader but no reply from mole and well the seg fault kills them pm instance

[=] ISO14A_CONNECT [=] Sending CARD_INFO to proxy. status:2 [=] downloading tracelog data from device [=] DOWNLOADING TRACE [#] Buffer cleared (42100 bytes) [!] m 60 [=] Sending to TAG: 60 00 F5 7B /home/dark/relay/proxmark3-relay/pm3: line 246: 939 Segmentation fault $CLIENT "$@"

looking at a sniff of the test card I can see this is the Auth cmd 458550272 | 458554976 | Rdr |60 00 f5 7b | ok | AUTH-A(0) 458556612 | 458561348 | Tag |ae 37 0d b5 | | AUTH: nt 458722160 | 458731472 | Rdr |70 0f! 5d! 62! fc! a5! 3e 41 | | AUTH: nr ar (enc) 458732724 | 458737396 | Tag |50 53 fa! e6! | | AUTH: at (enc) 458863648 | 458868416 | Rdr |56 e6 99 d9 | | | | * | key A0A1A2A3A4A5 prng WEAK

My understanding of the code must be wrong I thought the mole server just relayed the cmds back and forth

burja8x commented 1 year ago

In the README, I wrote that this relay will not work with MIFARE Classic. I tested it, and the issue is related to timing; I think the relay delay must be less than 1 ms. The code for the 'Mole' on the Raspberry Pi is designed to retry if there is a problem receiving a message from the tag.

MIFARE Classic's security is weak. The most effective way to compromise a MIFARE Classic system would be to crack a tag and then either emulate or clone it.

Dan-Rdd commented 1 year ago

In the README, I wrote that this relay will not work with MIFARE Classic. I tested it, and the issue is related to timing; I think the relay delay must be less than 1 ms. The code for the 'Mole' on the Raspberry Pi is designed to retry if there is a problem receiving a message from the tag.

MIFARE Classic's security is weak. The most effective way to compromise a MIFARE Classic system would be to crack a tag and then either emulate or clone it.

yeah I did read the readme but i didn't think the timing would have to be so low I was getting about 15ms and thought it would be fast enough :(. I understand that MF Classic is easy to crack but was just looking at a passive relay. All good I love your projects and am going to look at the Relay Desfire you have aswell. Thanks for the response.