Help Cloning a Chicago Transit Card

Hello, I tried watching all the proxmark3 tutorial videos on YouTube but I could not figure out how to dump the Mifare Desfire card into a Mifare Classic 1k Card.

Here is the result from hf mfdesfire info

So I have read some forum posts stating that although an Mifare Desfire card cannot be dumped, but the UID can still be put on a Mifare Classic 1k card.

Either way, I want to try it out but I am very new to this and any help will be greatly appreciated, thank you very much!

Unfortunately it can’t be done. Mifare DESFire uses strong encryption that cannot be broken with current computing. Also, Mifare Classic and Mifare DESFire use completely different technology and simply copying a UID from one to another would not be sufficient.

4 Likes

It’s MIFARE DESFire with a EMV based system. Nope, can’t be cloned unfortunately. And no, cloning the UID to a Magic MIFARE tag will not work as there is the encrypted portion of DESFire.

The system allows enrolling any valid credit/debit card to use as a Ventra card and you can even use cash to reload fare instead of charging the card. When some kind of EMV payment implant is available, that could be an option for Chicago transit.

I tried experimenting with the Ventra system. Unsurprisingly you cannot enroll a blank MIFARE DESFire tag. You also cannot enroll a no longer valid card, I tried an expired debit card and an empty AMEX gift card and it didn’t work. I haven’t tried a canceled debit card though, but I’m pretty certain that will not work.

4 Likes

Also

Mifare Classic 1k card only has a 4 byte UID and DESFire has 7 byte.

So even if the system you were using the DESFire on was only utilising UID, It’s unlikely that only 4 bytes of the MF1k would work for you.

As this is a transit card, it’s highly unlikey they are only using a UID anyway.

What’s the purpose of making a copy? A spare? To share?

If you were eventually looking to get an implant, you could have your original converted via the conversion service Dangerous Things offers

3 Likes

Technically, 7-byte MF Classic 1k cards do exist, however they are less common than 4-byte. There are even magic 7-byte MF Classic cards. However, that still likely wouldn’t change the outcome of the UID swap not working.

3 Likes

Right you are, I was thinking implants when I first replied.

Good catch :emoji_thumbsup:

Here’s one

https://labs.ksec.co.uk/product/mifare-compatible-1k-magic-uid-7-byte-changeable-uid-gen-3-apdu/

Also, again I was initially thinking implant, But this is probably your best bet (thoughstill highly unlikely)

https://labs.ksec.co.uk/product/mifare-desfire-compatible-uid-modifiable-emulator-card/

4 Likes