Hey Rosco, youāre my goto for long range reader shenanigans
Iām thinking of running a contest at CircleCityCon, an open challenge to steal the uid Iām going to use to open the pistol safe I just built as a example
Whatās the range actually like with the long range reader and a x series? I know the ISO cards can get like 2-3 feetā¦ but glassies tend to be picky and petulant
Good idea? Bad idea? Terrible but failure is fun?
I figure best case, itās incredibly hard to sniff the uid, which can be seen as a benefit
Worst case itās not hard, and then thereās clarity about realistic vulnerability
My most powerful HF readers are the DL533-XL (ISO14443 - about 1W) and the FEIG MR102 with the 240mm x 340mm pad antenna (ISO15693 - about 1.2W). Both have a range of about 4 cm with glassies.
But most importantly, you only get that range when the glassie is orthogonal to the antennaās coil wire. It wonāt work if the glassie is positioned alongside the wire, it wonāt work if itās in the middle of the antennaā¦ Itās quite specific, and much MUCH less forgiving than LF.
The FEIG reader for instance is something I got to make a quality control machine for production: the glassies to test actually come in a chute and stop at precise locations along the perimeter of the pad antenna. You canāt just throw a bucket of them on the antenna any which way and hope to get good reads, despite its power. Itās that finicky.
Iām not sure how you intend to run your contest thing, but bear that in mind because it might end up not being a terribly practical thing to use in the field.
Mostly Im sick of hearing people go on about how easy it would be to steal a uid from an implant
Because they can do so easily ish with an iso card and think they would get the same range
So this is aā¦ āwell letās see you do it thenā
I think the rough idea isā¦ you have 3 days at the conference to get it from meā¦ without being super obvious
I am looking to use LF ( system uses that, and I can rewrite it if I loose the challenge)
It is easy with LF: typical parking garage readers have ridiculous power and range, and most importantly, the LF tags offer exactly zero protection and are completely trivial to clone to a T55xx. My LF readers get a clear foot of range with the flexEM, and a good few inches with the xEM:
But thatās LF. HF is much more bitchy to use. Even flex HF implants are completely impractlcal to read and clone for nefarious purposes. They only pose a risk if youāre passed out or asleep and your attacker is reasonably technically savvy, which isnāt terribly likely since youāre most likely to be passed out in a bar and asleep at home.
Ah sorry I was under the impression your system used HF.
Then yes, LF is a very real sniffing risk. Someone with the know-how will defeat your system in no time at all.
Hell, the high-power reader in my office chair that reads the flexEM in my back even prevents a Halo reader from reading the xBT in my chest.
But I should say this: if all your LF tags are EM, thereās a chance a high-power reader will get the ID of one of them. Which one is a toss-up, but collisions arenāt always a guarantee that stuff is totally unreadable.
Alternatively, you could get yourself one of them Chinese parking garage readers to try it yourself. Theyāre dirt cheap, and when youāre done testing, you can use it for another fun project. Iāve had tons of fun putting together implant-related projects with those things. You would too.
Bought an older Dell laptop with an integrated RFID reader. After issuing one command to change the proprietary nonsense Dell security mode it was in, it is now acting like a normal PC/SC reader. Too bad the laptop is so old and slow itās basically only useful for the lab.
My nicer laptop (Asus scar 15 G533QS-DS76 came with a Rfid reader built inā¦ mostly for proprietary sillynessā¦ but I hoped I could maybe do something with it
Near as I can tell it only works with iso15693 and it can only detect it when itās inserted into the slot
You will enjoy hacking with RFID/NFC cards and devices by means of open source.
You will have plenty of time to get familiar with the Proxmark3 RDV4 and operate it by yourself in various conditions and challenges.
I used to have a Precision with that same feature back in the day. Chances are that yours also has a normal smartcard reader under the PCMCIA slot just like mine did.
it occurs to me, there arenāt specific instructions for removing users from a XACv2
I understand the
scan āadd masterā, scan new chip, scan āadd masterā
and
scan āremove masterā, scan unwanted chip, scan āremove masterā
but this implies that I HAVE the old tagā¦
any secret scan order to remove all active tags?
or would you have to put the jumper back into master mode?
or scaryā¦ are they always in memory unless you scan them to be removed?
. Thatās smart
