Cloning iCLASS DL (iCLASS SE)

Support
21

Let see,

Sniff/jam as the original nr-mac replay attack is called in the Proxmark world was implemented by Piwi. Based on the HoD papers.

NVX’s CVE is an modified nr/mac replay attack where the interesting part is based on a bug in some firmware versions which has been patched.

I know of three different approaches.

A) Sniff/jam

  1. While sniffing a card presented to a reader also jam the readers update cmd.
  2. Re-use the nc/mac pair to dump the card as long as the ePurse stays the same (ie don’t present card to reader)
  3. Simulate it and never update the dump file, ie nr/mac stays the same

B) Simplified Simulation

  1. Get CSN and epurse from card (iCLASS SE)
  2. Collect a nr/mac pair by simulate your data against a reader.
  3. Re-use the nc/mac pair to dump the card as long as the ePurse stays the same (ie don’t present card to reader)
  4. Simulate it and never update the dump file, ie nr/mac stays the same

C) NR-MAC attack

  1. Get CSN and epurse from card (iCLASS SE)
  2. Collect a nr/mac pair by simulate your data against a reader.
  3. Re-use the nc/mac pair to dump the card as long as the ePurse stays the same (ie don’t present card to reader)
    4a. Simulate it and never update the dump file, ie nr/mac stays the same
    4b. Simulate it using F0 and over exploiting the authentication skip bug in reader
    The reader doesn’t verify the card return mac.

Using a SAM

  • The flipper route is NARD/SEADER
  • The Proxmark3 route is using a RDV4 with sim module.

This path allows you to get the PACS data out and perform potential downgrade attacks hoping that the reader allows for multi-technology and has a lesser secure technology enabled. Where you either simulate or copy the PACS data to it.

Weaponised reader
Or you go down the weaponized reader route, which is take (steal) a reader from the installed site and read out the PACS data over the wiegand wires, and then simulate or clone to a lesser enabled security technology if system has it enabled. A nicer version of this is th door sim projects. For OSDP you do the same but hope its not using secure version 2 mode. (I know know too little of OSDP)

All of which gives you some fair chance to “clone” your card

Fun thing is that all of these methods above is used in the field. Its no made up academic scenarios.

You search the old proxmark3 forum to find the history and how it came to fruition over the years. You watch old def con and black hat talks to see when and where things was public announced. You read the academic papers and get lost in hard math. Then you go to the flipper forum and you can see things a bit clearer to what people are saying.

5 Likes
22

That’s very informative and Proxmark Easy with Iceman Fork has great contribution to the world of RFID at least in what I am trying to achieve at hobby level. I love the support by @Iceman and @Aoxhwjfoavdlhsvfpzha , you guys have been awesome, thank you.

I am going to get the flipper and see what I can do further.

3 Likes