Elvis Wiki - User contributions [en]

ChameleonMini RevE Rebooted

2024-12-14T13:26:36Z

LSchertler:

== Summary ==

Functionality and usage of Chameleon Mini RevE rebooted

== Requirements ==

* Chameleon Mini RevE Rebooted
* Operating systems are referred as:
** Linux: Ubuntu 18.04 bionic amd64
** Windows: Windows 10 (tested in a VM) (it is also possible to use a Android Phone)

== Introduction ==

The RFID Multitool ChameleonMini is a powerful and portable RFID emulation and manipulation tool that can emulate RFID tags, read tokens and sniff the radio communication. The credit card-shaped housing and integrated battery make it suitable for mobile use. In addition, transmissions can be read out and all data can be conveniently processed on the computer. Using a freely available open-source application, the ChameleonMini can be conveniently configured via a graphical user interface. Otherwise, it can be connected to a smartphone via USB cable or, in part, via Bluetooth and can thus also be configured on the move. This makes it possible, for example, to read an access card in passing and emulate it directly with the ChameleonMini and thus open a (actually protected) door. The ChameleonMini hardware is capable of emulating various ISO 14443, NFC and ISO 15693 cards, as well as other types of RFID transponders operating at 13.56 MHz. The ChameleonMini hardware consists of a PCB antenna driven by power transistors on the board to generate a 13.56 MHz RFID field. They thus function as an active RFID reader. An integrated Li-Ion battery can be charged via USB and enables stand-alone operation. The core of the hardware is an Atmel ATXMega128A4U microcontroller. The AES and DES hardware engines in the microcontroller enable very fast calculation of the cryptographic algorithms.

[[File:Chameleon-Mini-RevE-Rebooted.jpg|500px]]

=== Functionality of Chameleon Mini RevE rebooted ===

Chameleon Mini RevE rebooted has 8 card slots to simulate cards/UIDs, each slot can be set in an own configuration mode to
* simulate cards/UIDs to readers
* help getting a first auth key from a dialogue with a reader
* only first slot allows up to 4K dumps/uploads because of memory limitations
* the default firmware can only configure MIFARE cards
* RevE does not copy cards

Chameleon Mini RevE rebooted is a stand-alone device powered by CR2032 button battery

===Card configurations supported by default firmware===

* NONE: No functionality, ChameleonMini does nothing, the current setting is skipped when cycling through the settings
* MF_ULTRALIGHT: Emulates a MiFare Ultralight card
* MF_ULTRALIGHT_EV1_80B: Emulates a MiFare Ultralight EV1 80B card
* MF_ULTRALIGHT_EV1_164B: Emulates a MiFare Ultralight EV1 164B card
* MF_CLASSIC_1K: Emulates a MiFare Classic 1k card
* MF_CLASSIC_4K: Emulates a MiFare Classic 4k card
* MF_CLASSIC_1K_7B: Emulates a MiFare Classic 1k card with 7b UID
* MF_CLASSIC_4K_7B: Emulates a MiFare Classic 4k card with 7b UID
* MF_DETECTION: Emulates a MiFare Classic 1k card and saves nonces which can be used for mfkey32 attack in GUI

(Source: https://github.com/iceman1001/ChameleonMini-rebooted/wiki/Configurations, Feb 2,2020)

=== Hardware Description ===
[[File:Chameleon mini.png|200px|thumb|left|Chameleon Mini RevE rebooted]]

* Red Leds on left side:
: - 8 red LEDs which indicate the active slot
* Black Button - "KEY":
: - “short press” referred as BUTTON in commands and GUI and let you switch the active slot
: - “long press” - BUTTON_LONG
: - “long press while plugging USB cable” - BOOTLOADER Mode
* Red Buttern - "POWER":
: - used to power on the device when used stand-alone on battery

<br />

=== Device Recognition ===

==== Linux ====
The linux kernel recognizes a usb device from the idVendor 03eb with the product id 2fe4

dmesg | grep usb
[ 167.571731] usb 1-3: USB disconnect, device number 3
[ 180.768751] usb 1-3: new full-speed USB device number 11 using xhci_hcd
[ 180.917821] usb 1-3: New USB device found, idVendor=03eb, idProduct=2fe4, bcdDevice= 0.04
[ 180.917829] usb 1-3: New USB device strings: Mfr=0, Product=0, SerialNumber=0

The chameleon RevE is seen as a USB modem

lsusb
Bus 001 Device 011: ID 03eb:2fe4 Atmel Corp. ATxmega32A4U DFU bootloader

==== Windows ====

* in the Windows device manager should appear an Atmel USB Device: ATxmega32A4U
https://i.imgur.com/EJXyvdJ.png

== Usage ==
===GUI Usage with Chameleon Mini GUI v1.3.0.5 in Windows===
=== Step 1 ===
First you need to install the software in order to have a GUI to use the Chameleon Mini. The Version 1.3.0.6 can be downloaded here (http://www.icesql.se/download/ChameleonMiniGUI/publish.htm)
Afterwards connect the Chameleon Mini RevE Rebooted with an USB-Cable to your PC. The first LED with the label "TAG1" now lights up red.

==== Device Recognition ====
=== Step 2 ===
Now switch to the "Settings" tab, a photo is displayed there and there is a green message with the designation "CONNECTED! In the lower area with the messages, "Success, found Chameleon Mini device on 'COMX' with Firmware RevE rebooted installed" appears like in the screenshot below. The ChameleonMini RevE Rebooted is now ready for use.
On start of the Windows GUI the device should be recognized and following lines should appear in the output window

[=] Connecting to USB Serial Device (COMX) at COMX
[+] Success, found Chameleon Mini device on 'COMX' with Firmware RevE rebooted installed

[[File:ChameleonMiniSuccess.PNG|500px]]

If this is not the case and you are using Windows in a VM verify that the USB device is redirected to the VM and test to connect again in the submenu "Settings"

== ChameleonMini in Use ==
==== Use of the Chameleon Mini with the GUI in Window ====

In the first tab "Operation" of the Chameleon Mini GUI, up to eight different memory slots can be freely configured. In order to change an entry, the corresponding box of the entry must first be marked. Then one of four different variants can be selected in the "Mode" selection and any ID can be entered in the UID input field as shown below in the screenshot.

[[File:ChameleonOperation.PNG|500px]]

Below this, you can configure what happens when the button is pressed briefly or for a long time.
[[File:ChameleonButton.PNG|300px]]

To save the changes made, the "Apply" button must be clicked at the bottom. It is possible to edit several entries at the same time. To do this, simply select the corresponding checkboxes.

To emulate an RFID tag, first press the red button on the ChameleonMini RevE Rebooted. Now the memory slot that was marked as active in the software is active. Accordingly, the red LED lights up. Alternatively, ChameleonMini RevE Rebooted is activated when an RFID reader is detected. Then it activates automatically and the corresponding LED lights up. Depending on how the buttons have been configured, it is possible to switch through to RFID emulation through the corresponding memory loads.

==Command Line Interface==

==== Command return codes ====
Status numbers beginning with a '1' denote an informational item and those beginning with a '2' denote an error.
{|class="wikitable"
|-
! Response
! Description
|-
|100:OK
|The command has been successfully executed
|-
| 101:OK WITH TEXT
| The command has been successfully executed and this response is appended with an additional line of information, terminated with CR+LF
|-
| 110:WAITING FOR XMODEM
| The Chameleon is waiting for an XMODEM connection to be established
|-
| 120:FALSE
| The request is answered with false
|-
| 121:TRUE
| The request is answered with true
|-
| 200:UNKNOWN COMMAND
| This command is unknown to the Chameleon
|-
| 201:INVALID COMMAND USAGE
| This action is not supported by this command
|-
| 202:INVALID PARAMETER
| The format or value of the given parameter value is invalid
|-
| 203:TIMEOUT
| The timeout of the currently active command has expired
|+ Command response codes
|}

== Updating Firmware on Windows ==

First you should download the necessary drivers, firmware, and software.

You can the latests manufacturer firmware [https://lab401.com/products/chameleon-mini/firmware/latest.zip here].

Download [https://github.com/iceman1001/ChameleonMini-rebooted iceman1001's GitHub repo] and unzip it. It contains the necessary drivers and software to update the firmware.

Download and install Windows C++ Redistributable for Visual Studio 2013 (VC 12.0) x64 and x86 versions. You can [https://support.microsoft.com/en-us/topic/update-for-visual-c-2013-and-visual-c-redistributable-package-5b2ac5ab-4139-8acc-08e2-9578ec9b2cf1 download them from Microsoft] directly.

After downloading and installing all necessary software navigate to the settings page in the Chameleon Rebooted GUI and press the Upgrade button.

[[File:ChameleonMiniSuccess.PNG|500px]]

This will set the Chameleon Mini RevE rebooted into bootloader mode.

The device will no longer be recognized by Windows.

The next step is to open the Windows Device Manager and look for an unkown USB device. Once you have found the unknown device right-click and select "Update driver".

Then navigate the assistant to the unziped GitHub repo downloaded earlier and go to Drivers/DFU Driver and select .inf-file in the folder.

After this step the Chameleon Mini RevE rebooted should be listed as a Amtel USB Device.

Now move the files Myfile.bin and Myfilee.bin from the downladed firmware to the directory where BOOT_LOADER_EXE.exe is. This should be in the directory Software/Flashing-Windows within the GitHub repo directory.

After Moving the files execute the BOOT_LOADER_EXE.exe.

To finish and verify the installation disconnect and reconnect the Chameleon Mini RevE rebooted and restart the GUI.

== Used Hardware ==

[[Chameleon Mini: RevE Rebooted]]

== References ==

* https://scheible.it/chameleon-mini/
* Wiki: https://github.com/iceman1001/ChameleonMini-rebooted/wiki
* Linux GUI: https://github.com/WolfgangMau/chamgo-qt/releases
* Windows GUI: https://github.com/iceman1001/ChameleonMini-rebootedGUI
* Product description: https://lab401.com/products/chameleon-mini-reve-rebooted
* Updating Firmware: https://github.com/iceman1001/ChameleonMini-rebooted/wiki/Getting-started

[[Category:Documentation]]

KeySy: Copying and Replaying RFID Tags

2024-12-14T13:17:24Z

LSchertler: Added some supported and unsupported Models.

== Summary ==

The KeySy is an low-frequency RFID duplicator by Tiny Labs, which can be used to store, replay and duplicate 125kHz RFID Tags. It comes with the KeySy remote and an additional rewriteable keyfob, onto which stored data can be duplicated.

[[File: Keysy.jpg | 300 px]]

== Hardware Used ==

* KeySy RFID Duplicator (includes CR2032 battery)
* programmed 125 kHz RFID Tag
* empty 125 kHz RFID Tag

== Copying RFID Tags ==

==== Step 1 ====

On the KeySy remote, press the button you wish to program until the light starts blinking red (approx. 8 seconds)

==== Step 2 ====
Place the remote on the keycard to be copied until the light stops blinking.
If the copying process was successful, the light will now be green otherwise it will turn amber and you should proceed to Step 3.

==== Step 3 ====
If the light turned amber, the copying process failed. Turn over the tag and repeat Steps 1 & 2 while slowly moving the KeySy remote over the tag.

''' If the copying process keeps failing: '''
* Change the battery: <br />Copying a tag uses a lot more energy than just replaying one. This means, even if the LED lights up, the battery could be too weak to complete the copying process.
* Check KeySy compatibility: <br /> The Tag you want to copy is simply not readable by the remote. Refer to Section [[#Hardware Limitations| Hardware Limitations]] or Tiny Labs website under KeySy compatibility for further information.

''Note:'' Any buttons that have already been programmed can be rewritten using the same steps. It is not necessary to explicitly delete information from the remote beforehand.

== Replaying and Duplicating Tags ==

When you press one of the buttons on the KeySy remote, the LED will either flash red (there is nothing programmed on the button) or green (there is currently something programmed on this button).

=== Replaying ===
To replay a stored RFID tag from the remote, simply press and release the corresponding button in front of the RFID reader. Replay distance of the KeySy is about 5cm. The reader should blink or beep when the tags has been read successfully.

=== Duplicating Tags ===
The KeySy remote can also be used to program empty RFIDs tags with the information stored on one of the buttons.

==== Step 1 ====
Position the remote on top of the empty RFID tag.

==== Step 2 ====
Press the button you wish to copy 5 times, after which the LED will start blinking.

==== Step 3 ====
When programming is finished the LED will blink 3 times green or red, if programming the keyfob failed. In this case please refer to Section [[#Copying RFID Tags| Copying RFID Tags]] Step 3.

=== Hardware Limitations ===

The KeySy is specifically designed to operate only with RFID tags that function on the 125kHz low-frequency band. This means that NFC tags operating on 13.56MHz cannot be read or copied. While many perimeter access control systems rely on low-frequency RFID (e.g., gym cards, garage doors, and building key cards), modern building key cards provided by employers often use NFC due to its advanced functionality, such as authentication, which is incompatible with the KeySy. Additionally, high-frequency RFID, commonly used in smartphones, also falls outside KeySy’s capabilities.

A simple rule of thumb is: Any tag your phone can read, the KeySy cannot, and vice versa.

This limitation is intentional and was implemented to enhance security by preventing the duplication of sensitive data, such as credit or debit cards.

The compatibility list below reflects the current state as of 14.12.2024, but it may change over time. For the most up-to-date information, please refer to the official website. (Source: https://tinylabs.io/keysy/keysy-compatibility)

====RFID Key Fobs and Cards Supported====

* HID Prox (Proxcard, ISOProx, ProxKey)
* HID Indala (Motorola) (95% Success rate for Clamshell card and key fob versions. Thin card is not compatible)Kantech ioProx
* Rosslare Square fob (Triangle shaped fob not compatible)
* AWID (Low frequency only – CS-AWID, GR-AWID, KT-AWID, PW-AWID)(Emulation (playback) not supported, can still clone to rewritable oval key fob)
* Keri Key Fobs (95% Success rate KC-10X, MT-10X, PKT-10X)
* Radio Key (SecuraKey RKKT-01, RKKT-02)
*DKS DoorKing 1508
* Schlage IBF iButton (RFID portion only)
* PDK Prodatakey
* EM400x, EM410x, EM420x
* Nortek Linear Blue Key Fob
*Noralsy (KCP3000)
* Farpointe Pyramid
* Open Key Fobs (5 digits only- 8 digit incompatible)
* Viking
* Visa2000
* XceedID (labeled 7610 only)
* Schlage key fob (labeled 7610 only)
* Schlage Proximity key card (labeled 7410 – 7510 only)
* ACTprox Fob-B, Vanderbilt (Mifare version not compatible)
* Paradox C704, C705, PTDE16, PTAP14, PTAP17, PTFE19, PTOC16, PTJA19)
* CDVI BTAG, PPCB
* CDVI Black Metal1 (Not blue)
* T55x7 compatible keycard/keyfob

====Unsupported Models====

* Automotive Fobs & Windshield Tags/Transponders
* HID iCLASS, Seos IY
* DKProx Long Range
* XceedID key fob 9651
* Schlage key fob (9651, 9691T)
* Schlage key card (8420, 8520, 8920, 9451, 9551, 9951)
* Miwa Red Green Mifare
* Mifare Classic 1k/4k (all colors)
* Kantech ioSMART SSF Key Fobs and Key Cards
* Salto key fobs (PFM01K, PFM04K, PFD04K)
* Keri key cards
* Keri NXT fobs, serial #’s starting with *N, K-SF-1k MAX fobs
* Mass transit cards
* Stored value cards
* Mifare Plus EV1
* Mifare DESFire EV1/2
* Mifare Ultralight
* Farpointe Delta, Farpointe Ranger
* DKProx Long Range (AVI)
* AWID (all HF and UHF tags)
* Any other RFID cards/fobs not operating at 125kHz

== References ==

* https://tinylabs.io/keysy/
* https://www.iso.org/standard/56692.html
* https://tinylabs.io/keysy/keysy-compatibility

[[Category:Documentation]]

Chameleon Mini RevE rebooted Usage

2024-12-14T12:42:03Z

LSchertler: Updatet to the newest Verision 1.3.0.6

== Summary ==
Already exists: https://wiki.elvis.science/index.php?title=ChameleonMini_RevE_Rebooted

Functionality and usage of Chameleon Mini RevE rebooted

== Requirements ==

* Chameleon Mini RevE Rebooted
* Operating systems are referred as:
** Linux: Ubuntu 18.04 bionic amd64
** Windows: Windows 10 (tested in a VM)

== Description ==

The RFID Multitool ChameleonMini is a powerful and portable RFID emulation and manipulation tool that can emulate RFID tags, read tokens and sniff the radio communication. The credit card-shaped housing and integrated battery make it suitable for mobile use. In addition, transmissions can be read out and all data can be conveniently processed on the computer. Using a freely available open-source application, the ChameleonMini can be conveniently configured via a graphical user interface. Otherwise, it can be connected to a smartphone via USB cable or, in part, via Bluetooth and can thus also be configured on the move. This makes it possible, for example, to read an access card in passing and emulate it directly with the ChameleonMini and thus open a (actually protected) door. The ChameleonMini hardware is capable of emulating various ISO 14443, NFC and ISO 15693 cards, as well as other types of RFID transponders operating at 13.56 MHz. The ChameleonMini hardware consists of a PCB antenna driven by power transistors on the board to generate a 13.56 MHz RFID field. They thus function as an active RFID reader. An integrated Li-Ion battery can be charged via USB and enables stand-alone operation. The core of the hardware is an Atmel ATXMega128A4U microcontroller. The AES and DES hardware engines in the microcontroller enable very fast calculation of the cryptographic algorithms.

[[File:Chameleon-Mini-RevE-Rebooted.jpg|500px]]

=== Functionality of Chameleon Mini RevE rebooted ===

Chameleon Mini RevE rebooted has 8 card slots to simulate cards/UIDs, each slot can be set in an own configuration mode to
* simulate cards/UIDs to readers
* help getting a first auth key from a dialogue with a reader
* only first slot allows up to 4K dumps/uploads because of memory limitations
* the default firmware can only configure MIFARE cards
* RevE does not copy cards

Chameleon Mini RevE rebooted is a stand-alone device powered by CR2032 button battery

===Card configurations supported by default firmware===

* NONE: No functionality, ChameleonMini does nothing, the current setting is skipped when cycling through the settings
* MF_ULTRALIGHT: Emulates a MiFare Ultralight card
* MF_ULTRALIGHT_EV1_80B: Emulates a MiFare Ultralight EV1 80B card
* MF_ULTRALIGHT_EV1_164B: Emulates a MiFare Ultralight EV1 164B card
* MF_CLASSIC_1K: Emulates a MiFare Classic 1k card
* MF_CLASSIC_4K: Emulates a MiFare Classic 4k card
* MF_CLASSIC_1K_7B: Emulates a MiFare Classic 1k card with 7b UID
* MF_CLASSIC_4K_7B: Emulates a MiFare Classic 4k card with 7b UID
* MF_DETECTION: Emulates a MiFare Classic 1k card and saves nonces which can be used for mfkey32 attack in GUI

(Source: https://github.com/iceman1001/ChameleonMini-rebooted/wiki/Configurations, Feb 2,2020)

=== Hardware Description ===
[[File:Chameleon mini.png|200px|thumb|left|Chameleon Mini RevE rebooted]]

* Red Leds on left side:
: - 8 red LEDs which indicate the active slot
* Black Button - "KEY":
: - “short press” referred as BUTTON in commands and GUI and let you switch the active slot
: - “long press” - BUTTON_LONG
: - “long press while plugging USB cable” - BOOTLOADER Mode
* Red Buttern - "POWER":
: - used to power on the device when used stand-alone on battery

<br />
=== Device Recognition ===

==== Linux ====
The linux kernel recognizes a usb device from the idVendor 03eb with the product id 2fe4

dmesg | grep usb
[ 167.571731] usb 1-3: USB disconnect, device number 3
[ 180.768751] usb 1-3: new full-speed USB device number 11 using xhci_hcd
[ 180.917821] usb 1-3: New USB device found, idVendor=03eb, idProduct=2fe4, bcdDevice= 0.04
[ 180.917829] usb 1-3: New USB device strings: Mfr=0, Product=0, SerialNumber=0

The chameleon RevE is seen as a USB modem

lsusb
Bus 001 Device 011: ID 03eb:2fe4 Atmel Corp. ATxmega32A4U DFU bootloader

==== Windows ====

* in the Windows device manager should appear an Atmel USB Device: ATxmega32A4U
https://i.imgur.com/EJXyvdJ.png

== Usage ==
===GUI Usage with Chameleon Mini GUI v1.3.0.5 in Windows===
First you need to install the software in order to have a GUI to use the Chameleon Mini. The Version 1.3.0.6 can be downloaded here (http://www.icesql.se/download/ChameleonMiniGUI/publish.htm)
Afterwards connect the Chameleon Mini RevE Rebooted with an USB-Cable to your PC. The first LED with the label "TAG1" now lights up red.

==== Device Recognition ====
On start of the Windows GUI the device should be recognized and following lines should appear in the output window

[=] Connecting to USB Serial Device (COMX) at COMX
[+] Success, found Chameleon Mini device on 'COMX' with Firmware RevE rebooted installed

[[File:ChameleonMiniSuccess.PNG|500px]]

If this is not the case and you are using Windows in a VM verify that the USB device is redirected to the VM and test to connect again in the submenu "Settings"

==== Use of the Chameleon Mini with the GUI in Window ====

In the first tab "Operation" of the Chameleon Mini GUI, up to eight different memory slots can be freely configured. In order to change an entry, the corresponding box of the entry must first be marked. Then one of four different variants can be selected in the "Mode" selection and any ID can be entered in the UID input field as shown below in the screenshot.

[[File:ChameleonOperation.PNG|500px]]

Below this, you can configure what happens when the button is pressed briefly or for a long time.
[[File:ChameleonButton.PNG|300px]]

To save the changes made, the "Apply" button must be clicked at the bottom. It is possible to edit several entries at the same time. To do this, simply select the corresponding checkboxes.

To emulate an RFID tag, first press the red button on the ChameleonMini RevE Rebooted. Now the memory slot that was marked as active in the software is active. Accordingly, the red LED lights up. Alternatively, ChameleonMini RevE Rebooted is activated when an RFID reader is detected. Then it activates automatically and the corresponding LED lights up. Depending on how the buttons have been configured, it is possible to switch through to RFID emulation through the corresponding memory loads.

==Command Line Interface==

==== Command return codes ====
Status numbers beginning with a '1' denote an informational item and those beginning with a '2' denote an error.
{|class="wikitable"
|-
! Response
! Description
|-
|100:OK
|The command has been successfully executed
|-
| 101:OK WITH TEXT
| The command has been successfully executed and this response is appended with an additional line of information, terminated with CR+LF
|-
| 110:WAITING FOR XMODEM
| The Chameleon is waiting for an XMODEM connection to be established
|-
| 120:FALSE
| The request is answered with false
|-
| 121:TRUE
| The request is answered with true
|-
| 200:UNKNOWN COMMAND
| This command is unknown to the Chameleon
|-
| 201:INVALID COMMAND USAGE
| This action is not supported by this command
|-
| 202:INVALID PARAMETER
| The format or value of the given parameter value is invalid
|-
| 203:TIMEOUT
| The timeout of the currently active command has expired
|+ Command response codes
|}

== Updating Firmware on Windows ==

First you should download the necessary drivers, firmware, and software.

You can the latests manufacturer firmware [https://lab401.com/products/chameleon-mini/firmware/latest.zip here].

Download [https://github.com/iceman1001/ChameleonMini-rebooted iceman1001's GitHub repo] and unzip it. It contains the necessary drivers and software to update the firmware.

Download and install Windows C++ Redistributable for Visual Studio 2013 (VC 12.0) x64 and x86 versions. You can [https://support.microsoft.com/en-us/topic/update-for-visual-c-2013-and-visual-c-redistributable-package-5b2ac5ab-4139-8acc-08e2-9578ec9b2cf1 download them from Microsoft] directly.

After downloading and installing all necessary software navigate to the settings page in the Chameleon Rebooted GUI and press the Upgrade button.

[[File:ChameleonMiniSuccess.PNG|500px]]

This will set the Chameleon Mini RevE rebooted into bootloader mode.

The device will no longer be recognized by Windows.

The next step is to open the Windows Device Manager and look for an unkown USB device. Once you have found the unknown device right-click and select "Update driver".

Then navigate the assistant to the unziped GitHub repo downloaded earlier and go to Drivers/DFU Driver and select .inf-file in the folder.

After this step the Chameleon Mini RevE rebooted should be listed as a Amtel USB Device.

Now move the files Myfile.bin and Myfilee.bin from the downladed firmware to the directory where BOOT_LOADER_EXE.exe is. This should be in the directory Software/Flashing-Windows within the GitHub repo directory.

After Moving the files execute the BOOT_LOADER_EXE.exe.

To finish and verify the installation disconnect and reconnect the Chameleon Mini RevE rebooted and restart the GUI.

== Used Hardware ==

[[Chameleon Mini: RevE Rebooted]]

== References ==

* Wiki: https://github.com/iceman1001/ChameleonMini-rebooted/wiki
* Linux GUI: https://github.com/WolfgangMau/chamgo-qt/releases
* Windows GUI: https://github.com/iceman1001/ChameleonMini-rebootedGUI
* Product description: https://lab401.com/products/chameleon-mini-reve-rebooted
* https://scheible.it/chameleon-mini/
* Updating Firmware: https://github.com/iceman1001/ChameleonMini-rebooted/wiki/Getting-started

Radio-Frequency Identification

2024-12-14T12:40:00Z

LSchertler: Added some Examples for every attack so the reader get a better understanding.

==Introduction==
Radio-Frequency Identification (RFID) is a communication technology, that uses electromagnetic waves to identify and track tags.
A RFID system consists out of a tag, which is attached to an object, an reader, which extracts the information of the tag and an application, that uses the gathered information.

==RFID-System==
It consists out of three parts <ref>Xiaolin Jia, Quanyuan Feng, Taihua Fan, and Quanshui Lei, "RFID Technology and Its Applications in Internet of Things (IoT)," in Proceedings of the 2012 2nd International Conference on Consumer Electronics, Communications and Networks (CECNet), 2012, pp. 1282-1285, doi: 10.1109/CECNet.2012.6201508.
</ref>:
<ol style="list-style-type:disc">
<li>Tag</li>
<li>Reader</li>
<li>Application</li>
</ol>
The focus will be set on the tag and the reader, not on the application.

===Reader===
A reader is responsible for initiating the communication with a tag, in case of a passive tag the reader also supplies the energy needed to operate the tag.

[[File:Tag reader schema.png]]

A reader consists out of to components:
<ol style="list-style-type:lower-decimal">
<li>A control unit</li>
<li>A high-frequency interface</li>
</ol>

====Control Unit====
The control unit is responsible for
<ol style="list-style-type:disc">
<li>Communication with the application</li>
<li>Communication with the tag</li>
<li>Coding and decoding of the signal</li>
<li>Anti-collision algorithm</li>
<li>Encryption and decryption of data sent between reader and tag</li>
<li>Authentication between reader and tag</li>
</ol>

====High-frequency interface====
The high-frequency interface is responsible for
<ol style="list-style-type:disc">
<li>Generation of strong high-frequency signals to activate the tag and supply it with energy</li>
<li>Modulating the transmission signal to send data to the tag</li>
<li>Receiving the radio frequency signals transmitted by a tag and converting them back into original data</li>
</ol>

====Communication Principles====

Communication between the reader and the tag is achieved through electromagnetic fields at specific radio frequencies. The reader’s high-frequency interface continuously emits radio waves, and tags tuned to these frequencies respond by reflecting and modulating the received signal. This interaction not only facilitates data exchange but also, in the case of passive tags, provides the energy needed to power their internal circuits. Different frequency bands offer varying read distances, making them suitable for diverse application scenarios <ref>J. P. O’Sullivan, K. Wang, J. Dooley, O. Buckley and T. Newe, "Exploring how to speed up the read time of passive RFID tags," 2021 IEEE International Conference on RFID Technology and Applications (RFID-TA), 2021, pp. 75-80, doi: 10.1109/RFID-TA53372.2021.9675754. [Online]. Available: https://ieeexplore.ieee.org/document/9675754</ref>.

{| class="wikitable"
! Frequency Band !! Frequency Range !! Typical Read Distance
|-
| Low Frequency (LF) || 9–135 kHz || Up to 10 cm
|-
| High Frequency (HF) || 13.553–15.567 MHz || Up to 1 m
|-
| Ultra-High Frequency (UHF) || 860–930 MHz || Approximately 10–15 m
|}

===Tag===
RFID tags are divided into six categories by EPC Global<ref>EPC-RFID, "RFID Tags," Accessed: 2023. [Online]. Available: https://www.epc-rfid.info/rfid_tags. Note: RFID tags are classified as Class 0 through Class 5, depending on their functionality.</ref>. A tag in one category has all the capabilities of the subordinate categories. This means that tags are backward compatible

Passive tags, which have no built-in energy source and draw their energy from the reader's radio waves, are assigned to classes 0 to 3.
Active tags, with their own energy source, are assigned to class 4.
Class 5 is reserved for tag readers and active tags that can read other tags.
<ol style="list-style-type:disc">
<li>'''Class 0:''' These tags are passive and work with UHF. These tags are pre-programmed in the manufacturer's factory and can no longer be reprogrammed, the information can no longer be changed.</li>
<li>'''Class 1:''' Class 1 tags use HF radio waves. In contrast to class 0 tags, class 1 tags and higher can be programmed by the user. However, in class 1, tags can only be described once.</li>
<li>'''Class 2:''' Unlike class 1, class 2 tags can be written to multiple times.</li>
<li>'''Class 3:''' Read-write with integrated sensors that are able to detect parameters such as temperature, pressure and movement; can be semi-passive or active. Semi-passive means that they occupy an energy source but cannot initiate communication with other tags or readers.</li>
<li>'''Class 4:''' Class 4 tags have their own energy source and can initiate communication with other tags or readers, so they are active tags.</li>
<li>'''Class 5:''' Class 5 tags are the most advanced, they can transfer energy to passive tags and communicate with readers and tags of any class, so they can also be classified as readers.</li>
</ol>

===Tag information===
Four types of information can be stored on a transponder:
<ol style="list-style-type:disc">
<li>'''Information to identify the tagged item:''' This category includes the identification data used to uniquely identify the tagged item. This includes user-defined fields such as bank accounts, product barcodes and prices, as well as predefined registers such as the Application Family Identifier (AFI) and the Data Storage Format Identifier (DSFID)</li>
<li>'''Supplementary information on the object:''' Supplementary data includes further standard information such as Application Identifiers (AIs) and ANSI MH-10 Data Identifiers (DIs), which enable further differentiation and specific information on the tagged item</li>
<li>'''Control data:''' Control data could include information about the configuration of the tag, such as the settings for the security controls, including mechanisms that restrict reads or writes to user memory blocks and special registers that contain the AFI and DSFID values</li>
<li>'''Manufacturer data''': The unique identifier (UID), transponder type, manufacturer and manufacturing data can be stored in this category. This information can be specific to each manufacturer and transponder type. </li>
</ol>
The first two categories, identification and supplementary information, are present on all tags as they provide essential information for identifying and supplementing the tagged item. Categories three and four, control data and manufacturer data, can vary depending on the manufacturer and contain specific information for configuring the tag and identifying the manufacturer.<ref>Fotios Chantzis, Ioannis Stais, Paulino Calderon, Evangelos Deirmentzoglou, and Beau Woods, "Practical IoT Hacking: The Definitive Guide to Attacking the Internet of Things," No Starch Press, 2021, ISBN 978-1-7185-0091-4.</ref>

Hier ist der überarbeitete und korrekt formatierte Text, bei dem die Examples fett markiert und in einem neuen Absatz dargestellt werden:

===Attack methods===
'''Cloning'''

There are two different types of cloning used to attack.<ref>Kolin Nielson and Sayeed Sajal, "The Art of RFID Hacking," in Proceedings of the 2023 Intermountain Engineering, Technology and Computing (IETC), 2023, pp. 328-333, doi: 10.1109/IETC57902.2023.10152251.</ref>
<ol style="list-style-type:disc"> <li>'''Simple RFID cloning:''' If an attacker gains physical access to an RFID tag, they can clone it. The advantage of cloning is that, unlike theft, the original tag does not have to be kept by the attacker. Since the owner can easily become aware that the original tag is missing in the event of theft, no changes are made to the tag during cloning. The cloned tag has the same access options as the original. This makes it much less likely that the victim will know that they have been victimized. Disadvantage, needs physical access to the card/tag, must copy it and then return it. There are various devices for copying the card.

Example:
An attacker clones an employee's access card using a portable RFID copier while the card is unattended and then returns it unnoticed. The cloned card is used to enter the secure facility.
</li> <li>'''Distance RFID cloning:''' There are a large number of devices that can read and clone RFID tags at a distance. The range is limited to less than 1 meter, and the greater the range, the more expensive the devices become. There are devices that can store the read data on an SD card.

Example:
In a crowded subway, an attacker uses a concealed RFID reader to scan and clone a commuter's contactless payment card from their pocket.
</li> </ol>

'''Man-in-the-middle attacks'''

For this attacks, the hacker positions himself between the RFID tag and the reader in order to influence or eavesdrop on the communication. We distinguish between the following attacks.
<ol style="list-style-type:disc"> <li>'''Eavesdropping:''' An attacker can use devices or apps to intercept the communication between the RFID tag and the reader in order to capture the transmitted data.

Example:
An attacker intercepts the communication between a contactless payment card and a reader at a busy checkout counter.
</li> <li>'''Replay attacks:''' In this attack, the attacker is in the vicinity of a communication between the RFID/NFC tag and a reader. The communication is recorded and can be replayed at a later time to the reader.

Example:
An attacker records the signal between a keyless entry tag and a car's locking system and later replays it to unlock the car.
</li> <li>'''Relay attack:''' In a relay attack, the communication between the RFID tag and reader is recorded and sent to a third device.

Example:
An attacker uses a relay device to extend the range of a keyless car system, allowing them to start the car while the owner’s key remains inside their house.
</li> </ol>

'''Data manipulation'''

An attacker who has access to an RFID/NFC device manipulates it so that false data or requests are sent.

Example:
An attacker changes the stored value on an RFID-enabled transport card to gain unlimited free rides.

'''Skimming'''

Skimming is the use of unauthorized readers to retrieve data from RFID tags or to start a transaction, for example with a mobile wallet.

Example:
In a crowded shopping center, an attacker with a concealed RFID reader skims payment card data from nearby shoppers.

'''Spoofing'''

The attacker creates fake RFID tags or readers to fool the system and gain unauthorized access.

Example:
An attacker programs a fake RFID tag to mimic a legitimate employee badge and uses it to access restricted areas.

'''Denial of Service (DoS)'''

These attacks aim to overload RFID systems and disrupt their function in order to prevent authorized access.

Example:
An attacker uses a signal jammer to disrupt RFID-based access systems, preventing employees from entering a secure building.

'''Side channel attacks'''

This involves analyzing the physical properties of the RFID system, such as power consumption or electromagnetic emissions, in order to derive confidential information.

Example:
An attacker observes the electromagnetic emissions from an RFID reader to extract cryptographic keys used in secure communications.

'''Cryptanalytical attacks'''

These attacks aim to break the cryptographic mechanisms used to protect the data in RFID systems.

Example:
An attacker uses brute force to break the encryption of an RFID tag used for secure payments, allowing them to clone the tag.

'''Physical attacks'''

These include methods such as physically destroying RFID tags or changing their internal structures in order to disrupt their function or obtain information.

Example:
An attacker removes an RFID tag from a shipping container, modifies its data to redirect the shipment, and reattaches the tag.

'''Phone malware'''

A vulnerability was found in Android devices in 2019. Using NFC, it was possible to download software that is not offered in the Google Play Store. Normally, the smartphone warns in such a case. The download triggered by this vulnerability did not trigger these warnings, but the user still had to confirm the download. This vulnerability has now been closed.<ref>https://nvd.nist.gov/vuln/detail/CVE-2019-2114</ref>

Example:
An attacker places malicious NFC tags on posters, tricking users into unknowingly downloading malware onto their devices.

'''Physical shielding of the tag'''

To circumvent Electronic Article Surveillance (EAS), thieves use multi-layered aluminium pockets, creating a Faraday cage, to shield the tag from the reader.

Example:
A shoplifter uses a bag lined with aluminum foil to block RFID sensors and steal items without triggering security alarms.

'''Social Engineering'''

Social engineering is not a direct attack, but social engineering can be used to gain access to NFC or RFID devices, which makes it possible to clone them or steal information.

Example:
An attacker impersonates an IT technician and convinces an employee to hand over their access badge for “maintenance,” cloning the badge before returning it.

===Tools===
There are a lot of different tools to attack RFID-Systems. Well known tools are:

<ol style="list-style-type:disc">
<li>
[[Flipper Zero]] is a powerful and multi-functional tool specifically created for pentesting and device hacking purposes. This is a little gadget that has the ability to communicate with many wireless systems, such as RFID, NFC, and radio frequencies. Flipper Zero is very proficient in analysing and evaluating the security of RFID systems. It may be used for various activities like as duplicating RFID tags, intercepting communications, and investigating weaknesses in wireless protocols.<ref>https://flipperzero.one/</ref>
</li>
<li>
[[ChameleonMini]] is a specialised device designed to emulate and clone RFID tags, with a particular focus on contactless card technology. It is often used in security research to assess the resilience of RFID systems against cloning and spoofing attacks. The ChameleonMini is a versatile tool that can imitate several kinds of RFID tags and store different RFID identities. This makes it an effective device for researchers and security experts to evaluate and showcase the security risks associated with RFID technology.<ref>https://github.com/emsec/ChameleonMini</ref>
</li>
<li>
The [[Keysy RFID Duplicator]] is a small and easy-to-use hardware device designed to replicate Mifare cards, which are widely used for access control, public transit, and payment systems. Users are able to replicate and retain numerous sets of RFID tag data, so gaining the ability to reproduce the same functionality as these cards. This tool is very valuable for assessing and showcasing weaknesses in access control systems that are based on Mifare technology, hence emphasising possible security hazards in RFID implementations of such systems.<ref>https://tinylabs.io/keysy/</ref>
</li>
<li>
The [[Proxmark3 RDV4]] is a refined and condensed iteration of the [[Proxmark3]]. It was created specifically for the community of professionals that do penetration tests. The frequencies 125kHz and 13.56MHz are the defining characteristics. The device is equipped with several antennas and may be expanded using diverse modules.<ref>https://proxmark.com/proxmark-3-hardware/proxmark-3-rdv4</ref>
</li>
</ol>

Security experts and researchers often use these tools to assess and scrutinise the security of RFID systems.

= Security controls for RFID=

This section addresses security measures that are relevant to the majority of implementations. It fails to consider the security aspects of RFID-enabled smart cards and payment systems. Furthermore, it omits any mention of security measures pertaining to conventional IT systems, such as network infrastructure, databases, and web servers, since they are already addressed by existing security prerequisites and standards. To ensure the security of the data collected by the RFID system, it is important to protect EPCIS servers that can be accessed over the Internet by trading partners. This can be done by implementing similar controls that are used for any other system accessible over the Internet, such as encrypting sensitive communications and implementing access control measures to prevent unauthorised access to data and systems. Various sources, including NIST's Computer Security Resource Centre (CSRC), provide guidelines on areas such as IT server, application, database, and network security.

== Management controls==
Management control is crucial for assessing risks, designing and acquiring systems, as well as certifying and evaluating security. Further eplaination of the management controls for RFID systems is provided below.

<ol style="list-style-type:disc">
<li>
RFID usage guideline:
<ol style="list-style-type:square">
<li> Description of authorized and unauthorized use of RFID technology</li>
<li> Should be consistent with the organization's privacy policy</li>
<li> Required for all organizations using RFID technology</li>
<li> Provides the framework for further security controls</li>
<li> Challenge is to ensure compliance with the policy</li>
</ol>
</li>
<li>
IT security guidelines:
<ol style="list-style-type:square">
<li>Define measures to achieve high-level security objectives</li>
<li>Cover RFID subsystems such as network, database and application security</li>
<li>Necessary for all RFID implementations, especially enterprise subsystems</li>
<li>Provide guidance for the design and management of RFID systems</li>
<li>Require consistent implementation and enforcement</li>
</ol>
<li>
Minimization of sensitive data on tags:
<ol style="list-style-type:square">
<li> Prefers to store sensitive data in secure enterprise systems.
<li> Suitable for applications with tags that process sensitive or interpretable data.
<li> Prevents adversaries from obtaining information through scanning or eavesdropping.
<li> Challenge is the dependency on network availability.
</ol>
</li>
</ol>

== Operational controls ==
Operational controls include various measures that are used in RFID systems. They range from access restrictions to operator training. The following points provide a detailed overview of these controls.

<ol style="list-style-type:disc">
<li>
Physical access control:
<ol style="list-style-type:square">
<li> Enclosing critical areas with fences, doors and surveillance cameras.
<li> The aim is to prevent unauthorized access to RFID components.
<li> Limits the possibility for adversaries to compromise RFID data.
<li> Not applicable in publicly accessible areas.
</ol>
</li>
<li>
Appropriate placement of tags and readers:
<ol style="list-style-type:square">
<li> Avoidance of unnecessary electromagnetic radiation </li>
<li> Placement away from sources of interference and sensitive products </li>
<li> Reduces the risk of interference and data breaches</li>
</ol>
</li>
<li>
Safe disposal of tags:
<ol style="list-style-type:square">
<li> Physical or electronic destruction of tags after use.
<li> Prevents adversaries from gaining access to data.
<li> Important for applications with data protection risks.
</ol>
</li>
<li>
Training of operators and administrators:
<ol style="list-style-type:square">
<li>Providing skills and knowledge for compliance</li>
<li>Important for all RFID implementations</li>
<li>Training supports the correct use and maintenance of the system</li>
</ol>
</li>
<li>
Information label and notes:
<ol style="list-style-type:square">
<li>Provides basic information about the RFID system</li>
<li>Important for applications where privacy is a concern</li>
<li>Communicates risks and risk mitigation measures</li>
</ol>
</li>
<li>
Separation of duties:
<ol style="list-style-type:square">
<li>Distribution of system tasks to different roles</li>
<li>Reduces the risk of fraud and malicious damage</li>
<li>Important for applications with high value or internal security risks</li>
</ol>
</li>
<li>
Non-revealing identifier formats:
<ol style="list-style-type:square">
<li> Use of identifier formats that do not reveal any information</li>
<li> Prevents opponents from obtaining information from the identifier format alone</li>
<li> Important for applications where tag identification is a business risk</li>
</ol>
</li>
<li>
Fallback identification system:
<ol style="list-style-type:square">
<li>Provision of alternative identification methods in the event of system failure</li>
<li>Applicable to all RFID applications</li>
<li>Provides redundancy and security in case of emergency or system failure</li>
</ol>
</li>
</ol>

==Technical controls==
Technical controls are essential for the security of RFID systems. These include measures for authentication and data integrity, for protecting the RF interface and for securing the data stored on the tags. \cite{NISTSP800-98}

<ol style="list-style-type:disc">
<li> Authentication and data integrity
<ol style="list-style-type:square">
<li> Password authentication: Use of passwords to control access to tags. Complex password management and risks associated with wireless transmission are challenges.</li>
<li> HMAC (Keyed-Hash Message Authentication Code): Use of HMAC for stronger authentication and data integrity. However, requires efficient key management and computing power on the tag.</li>
<li> Digital signatures: Use of digital signatures to authenticate transactions. Requires a public key infrastructure (PKI) and is more memory-intensive than other methods.</li>
</ol>
</li>

<li> RF interface protection
<ol style="list-style-type:square">
<li> cover coding:Encryption of communication between reader and tag to prevent eavesdropping.</li>
<li> encryption of transmitted data: Protection of data during transmission through encryption. </li>
<li> Electromagnetic shielding: Use of shielding to control the propagation of RF signals and prevent unauthorized reading. </li>
<li> Frequency selection: Selection of the appropriate frequency to avoid interference and provide optimum radio coverage.</li>
<li> Adjustment of transmission characteristics: Control over transmission power and antenna alignment to minimize interference and radiation risks.v
<li> Temporary deactivation of tags: Option to temporarily disable tags to prevent unauthorized access.</li>
<li> Tag activation switch:User control over the activation of tags to prevent unauthorized communication.</li>
<li> tag query (polling):Periodic polling of tags to check their presence and state.</li>
</ol>
</li>

<li> Privacy on tags
<ol style="list-style-type:square">
<li> Tag memory access control: Password-protected locking functions to control read and write access.</li>
<li> encryption of data at rest: Protection of the data stored on the tag by encryption. </li>
<li> Kill function: Ability to permanently disable tags to protect them from unauthorized use.</li>
<li> Tamper protection: Properties of tags that make tampering more difficult or visible.</li>
</ol>
</li>
</ol>

= References =

[[Category:Basic]]

Radio-Frequency Identification

2024-12-11T12:07:26Z

LSchertler: Added Communication Principles

==Introduction==
Radio-Frequency Identification (RFID) is a communication technology, that uses electromagnetic waves to identify and track tags.
A RFID system consists out of a tag, which is attached to an object, an reader, which extracts the information of the tag and an application, that uses the gathered information.

==RFID-System==
It consists out of three parts <ref>Xiaolin Jia, Quanyuan Feng, Taihua Fan, and Quanshui Lei, "RFID Technology and Its Applications in Internet of Things (IoT)," in Proceedings of the 2012 2nd International Conference on Consumer Electronics, Communications and Networks (CECNet), 2012, pp. 1282-1285, doi: 10.1109/CECNet.2012.6201508.
</ref>:
<ol style="list-style-type:disc">
<li>Tag</li>
<li>Reader</li>
<li>Application</li>
</ol>
The focus will be set on the tag and the reader, not on the application.

===Reader===
A reader is responsible for initiating the communication with a tag, in case of a passive tag the reader also supplies the energy needed to operate the tag.

[[File:Tag reader schema.png]]

A reader consists out of to components:
<ol style="list-style-type:lower-decimal">
<li>A control unit</li>
<li>A high-frequency interface</li>
</ol>

====Control Unit====
The control unit is responsible for
<ol style="list-style-type:disc">
<li>Communication with the application</li>
<li>Communication with the tag</li>
<li>Coding and decoding of the signal</li>
<li>Anti-collision algorithm</li>
<li>Encryption and decryption of data sent between reader and tag</li>
<li>Authentication between reader and tag</li>
</ol>

====High-frequency interface====
The high-frequency interface is responsible for
<ol style="list-style-type:disc">
<li>Generation of strong high-frequency signals to activate the tag and supply it with energy</li>
<li>Modulating the transmission signal to send data to the tag</li>
<li>Receiving the radio frequency signals transmitted by a tag and converting them back into original data</li>
</ol>

====Communication Principles====

Communication between the reader and the tag is achieved through electromagnetic fields at specific radio frequencies. The reader’s high-frequency interface continuously emits radio waves, and tags tuned to these frequencies respond by reflecting and modulating the received signal. This interaction not only facilitates data exchange but also, in the case of passive tags, provides the energy needed to power their internal circuits. Different frequency bands offer varying read distances, making them suitable for diverse application scenarios <ref>J. P. O’Sullivan, K. Wang, J. Dooley, O. Buckley and T. Newe, "Exploring how to speed up the read time of passive RFID tags," 2021 IEEE International Conference on RFID Technology and Applications (RFID-TA), 2021, pp. 75-80, doi: 10.1109/RFID-TA53372.2021.9675754. [Online]. Available: https://ieeexplore.ieee.org/document/9675754</ref>.

{| class="wikitable"
! Frequency Band !! Frequency Range !! Typical Read Distance
|-
| Low Frequency (LF) || 9–135 kHz || Up to 10 cm
|-
| High Frequency (HF) || 13.553–15.567 MHz || Up to 1 m
|-
| Ultra-High Frequency (UHF) || 860–930 MHz || Approximately 10–15 m
|}

===Tag===
RFID tags are divided into six categories by EPC Global<ref>EPC-RFID, "RFID Tags," Accessed: 2023. [Online]. Available: https://www.epc-rfid.info/rfid_tags. Note: RFID tags are classified as Class 0 through Class 5, depending on their functionality.</ref>. A tag in one category has all the capabilities of the subordinate categories. This means that tags are backward compatible

Passive tags, which have no built-in energy source and draw their energy from the reader's radio waves, are assigned to classes 0 to 3.
Active tags, with their own energy source, are assigned to class 4.
Class 5 is reserved for tag readers and active tags that can read other tags.
<ol style="list-style-type:disc">
<li>'''Class 0:''' These tags are passive and work with UHF. These tags are pre-programmed in the manufacturer's factory and can no longer be reprogrammed, the information can no longer be changed.</li>
<li>'''Class 1:''' Class 1 tags use HF radio waves. In contrast to class 0 tags, class 1 tags and higher can be programmed by the user. However, in class 1, tags can only be described once.</li>
<li>'''Class 2:''' Unlike class 1, class 2 tags can be written to multiple times.</li>
<li>'''Class 3:''' Read-write with integrated sensors that are able to detect parameters such as temperature, pressure and movement; can be semi-passive or active. Semi-passive means that they occupy an energy source but cannot initiate communication with other tags or readers.</li>
<li>'''Class 4:''' Class 4 tags have their own energy source and can initiate communication with other tags or readers, so they are active tags.</li>
<li>'''Class 5:''' Class 5 tags are the most advanced, they can transfer energy to passive tags and communicate with readers and tags of any class, so they can also be classified as readers.</li>
</ol>

===Tag information===
Four types of information can be stored on a transponder:
<ol style="list-style-type:disc">
<li>'''Information to identify the tagged item:''' This category includes the identification data used to uniquely identify the tagged item. This includes user-defined fields such as bank accounts, product barcodes and prices, as well as predefined registers such as the Application Family Identifier (AFI) and the Data Storage Format Identifier (DSFID)</li>
<li>'''Supplementary information on the object:''' Supplementary data includes further standard information such as Application Identifiers (AIs) and ANSI MH-10 Data Identifiers (DIs), which enable further differentiation and specific information on the tagged item</li>
<li>'''Control data:''' Control data could include information about the configuration of the tag, such as the settings for the security controls, including mechanisms that restrict reads or writes to user memory blocks and special registers that contain the AFI and DSFID values</li>
<li>'''Manufacturer data''': The unique identifier (UID), transponder type, manufacturer and manufacturing data can be stored in this category. This information can be specific to each manufacturer and transponder type. </li>
</ol>
The first two categories, identification and supplementary information, are present on all tags as they provide essential information for identifying and supplementing the tagged item. Categories three and four, control data and manufacturer data, can vary depending on the manufacturer and contain specific information for configuring the tag and identifying the manufacturer.<ref>Fotios Chantzis, Ioannis Stais, Paulino Calderon, Evangelos Deirmentzoglou, and Beau Woods, "Practical IoT Hacking: The Definitive Guide to Attacking the Internet of Things," No Starch Press, 2021, ISBN 978-1-7185-0091-4.</ref>

==RFID Attacks==
In contrast to attackers on the Internet, who can always attack a machine on the Internet, a server is always online and responds to requests from all over the world, an attacker of an RFID system does not have constant access. They must be physically close to the tag that is to be read. Or must be present during a transaction.
Security models must be adapted to these facts. Further more, cheap RFID tags cannot perform standard encryption.

The challenge is therefore to create a realistic security model that reflects the threats and capabilities of reality as accurately as possible.

===Attack methods===
'''Cloning'''

There are two different types of cloning used to attack.<ref>Kolin Nielson and Sayeed Sajal, "The Art of RFID Hacking," in Proceedings of the 2023 Intermountain Engineering, Technology and Computing (IETC), 2023, pp. 328-333, doi: 10.1109/IETC57902.2023.10152251.</ref>
<ol style="list-style-type:disc">
<li>'''Simple RFID cloning:''' If an attacker gains physical access to an RFID tag, they can clone it. The advantage of cloning is that, unlike theft, the original tag does not have to be kept by the attacker. Since the owner can easily become aware that the original tag is missing in the event of theft, no changes are made to the tag during cloning. The cloned tag has the same access options as the original. This makes it much less likely that the victim will know that they have been victimized. Disadvantage, needs physical access to the card/tag, must copy it and then return it. There are various devices for copying the card.</li>
<li>'''Distance RFID cloning:''' There are a large number of devices that can read and clone RFID tags at a distance. The range is limited to less than 1 meter, and the greater the range, the more expensive the devices become. There are devices that can store the read data on an SD card.</li>
</ol>

'''Man-in-the-middle attacks'''

For this attacks, the hacker positions himself between the RFID tag and the reader in order to influence or eavesdrop on the communication. We distinguish between the following attacks.
<ol style="list-style-type:disc">
<li>'''Eavesdropping:''' An attacker can use devices or apps to intercept the communication between the RFID tag and the reader in order to capture the transmitted data.</li>
<li>'''Replay attacks:''' In this attack, the attacker is in the vicinity of a communication between the RFID/NFC tag and a reader. The communication is recorded and can be replayed at a later time to the reader.</li>
<li>'''Relay attack:''' In a relay attack, the communication between the RFID tag and reader is recorded and sent to a third device.</li>
</ol>

'''Data manipulation'''

An attacker who has access to an RFID/NFC device manipulates it so that false data or requests are sent.

'''Skimming'''

Skimming is the use of unauthorized readers to retrieve data from RFID tags or to start a transaction, for example with a mobile wallet.

'''Spoofing'''

The attacker creates fake RFID tags or readers to fool the system and gain unauthorized access.

'''Denial of Service (DoS)'''

These attacks aim to overload RFID systems and disrupt their function in order to prevent authorized access.

'''Side channel attacks'''

This involves analyzing the physical properties of the RFID system, such as power consumption or electromagnetic emissions, in order to derive confidential information.

'''Cryptanalytical attacks'''

These attacks aim to break the cryptographic mechanisms used to protect the data in RFID systems.

'''Physical attacks'''

These include methods such as physically destroying RFID tags or changing their internal structures in order to disrupt their function or obtain information.

'''Phone malware'''

A vulnerability was found in Android devices in 2019. Using NFC, it was possible to download software that is not offered in the Google Play Store. Normally, the smartphone warns in such a case. The download triggered by this vulnerability did not trigger these warnings, but the user still had to confirm the download. This vulnerability has now been closed.<ref>https://nvd.nist.gov/vuln/detail/CVE-2019-2114</ref>

'''Physical shielding of the tag'''

To circumvent Electronic Article Surveillance (EAS), thieves use multi-layered aluminium pockets, creating a Faraday cage, to shield the tag from the reader.

'''Social Engineering'''

Social engineering is not a direct attack, but social engineering can be used to gain access to NFC or RFID devices, which makes it possible to clone them or steal information.

===Tools===
There are a lot of different tools to attack RFID-Systems. Well known tools are:

<ol style="list-style-type:disc">
<li>
[[Flipper Zero]] is a powerful and multi-functional tool specifically created for pentesting and device hacking purposes. This is a little gadget that has the ability to communicate with many wireless systems, such as RFID, NFC, and radio frequencies. Flipper Zero is very proficient in analysing and evaluating the security of RFID systems. It may be used for various activities like as duplicating RFID tags, intercepting communications, and investigating weaknesses in wireless protocols.<ref>https://flipperzero.one/</ref>
</li>
<li>
[[ChameleonMini]] is a specialised device designed to emulate and clone RFID tags, with a particular focus on contactless card technology. It is often used in security research to assess the resilience of RFID systems against cloning and spoofing attacks. The ChameleonMini is a versatile tool that can imitate several kinds of RFID tags and store different RFID identities. This makes it an effective device for researchers and security experts to evaluate and showcase the security risks associated with RFID technology.<ref>https://github.com/emsec/ChameleonMini</ref>
</li>
<li>
The [[Keysy RFID Duplicator]] is a small and easy-to-use hardware device designed to replicate Mifare cards, which are widely used for access control, public transit, and payment systems. Users are able to replicate and retain numerous sets of RFID tag data, so gaining the ability to reproduce the same functionality as these cards. This tool is very valuable for assessing and showcasing weaknesses in access control systems that are based on Mifare technology, hence emphasising possible security hazards in RFID implementations of such systems.<ref>https://tinylabs.io/keysy/</ref>
</li>
<li>
The [[Proxmark3 RDV4]] is a refined and condensed iteration of the [[Proxmark3]]. It was created specifically for the community of professionals that do penetration tests. The frequencies 125kHz and 13.56MHz are the defining characteristics. The device is equipped with several antennas and may be expanded using diverse modules.<ref>https://proxmark.com/proxmark-3-hardware/proxmark-3-rdv4</ref>
</li>
</ol>

Security experts and researchers often use these tools to assess and scrutinise the security of RFID systems.

= Security controls for RFID=

This section addresses security measures that are relevant to the majority of implementations. It fails to consider the security aspects of RFID-enabled smart cards and payment systems. Furthermore, it omits any mention of security measures pertaining to conventional IT systems, such as network infrastructure, databases, and web servers, since they are already addressed by existing security prerequisites and standards. To ensure the security of the data collected by the RFID system, it is important to protect EPCIS servers that can be accessed over the Internet by trading partners. This can be done by implementing similar controls that are used for any other system accessible over the Internet, such as encrypting sensitive communications and implementing access control measures to prevent unauthorised access to data and systems. Various sources, including NIST's Computer Security Resource Centre (CSRC), provide guidelines on areas such as IT server, application, database, and network security.

== Management controls==
Management control is crucial for assessing risks, designing and acquiring systems, as well as certifying and evaluating security. Further eplaination of the management controls for RFID systems is provided below.

<ol style="list-style-type:disc">
<li>
RFID usage guideline:
<ol style="list-style-type:square">
<li> Description of authorized and unauthorized use of RFID technology</li>
<li> Should be consistent with the organization's privacy policy</li>
<li> Required for all organizations using RFID technology</li>
<li> Provides the framework for further security controls</li>
<li> Challenge is to ensure compliance with the policy</li>
</ol>
</li>
<li>
IT security guidelines:
<ol style="list-style-type:square">
<li>Define measures to achieve high-level security objectives</li>
<li>Cover RFID subsystems such as network, database and application security</li>
<li>Necessary for all RFID implementations, especially enterprise subsystems</li>
<li>Provide guidance for the design and management of RFID systems</li>
<li>Require consistent implementation and enforcement</li>
</ol>
<li>
Minimization of sensitive data on tags:
<ol style="list-style-type:square">
<li> Prefers to store sensitive data in secure enterprise systems.
<li> Suitable for applications with tags that process sensitive or interpretable data.
<li> Prevents adversaries from obtaining information through scanning or eavesdropping.
<li> Challenge is the dependency on network availability.
</ol>
</li>
</ol>

== Operational controls ==
Operational controls include various measures that are used in RFID systems. They range from access restrictions to operator training. The following points provide a detailed overview of these controls.

<ol style="list-style-type:disc">
<li>
Physical access control:
<ol style="list-style-type:square">
<li> Enclosing critical areas with fences, doors and surveillance cameras.
<li> The aim is to prevent unauthorized access to RFID components.
<li> Limits the possibility for adversaries to compromise RFID data.
<li> Not applicable in publicly accessible areas.
</ol>
</li>
<li>
Appropriate placement of tags and readers:
<ol style="list-style-type:square">
<li> Avoidance of unnecessary electromagnetic radiation </li>
<li> Placement away from sources of interference and sensitive products </li>
<li> Reduces the risk of interference and data breaches</li>
</ol>
</li>
<li>
Safe disposal of tags:
<ol style="list-style-type:square">
<li> Physical or electronic destruction of tags after use.
<li> Prevents adversaries from gaining access to data.
<li> Important for applications with data protection risks.
</ol>
</li>
<li>
Training of operators and administrators:
<ol style="list-style-type:square">
<li>Providing skills and knowledge for compliance</li>
<li>Important for all RFID implementations</li>
<li>Training supports the correct use and maintenance of the system</li>
</ol>
</li>
<li>
Information label and notes:
<ol style="list-style-type:square">
<li>Provides basic information about the RFID system</li>
<li>Important for applications where privacy is a concern</li>
<li>Communicates risks and risk mitigation measures</li>
</ol>
</li>
<li>
Separation of duties:
<ol style="list-style-type:square">
<li>Distribution of system tasks to different roles</li>
<li>Reduces the risk of fraud and malicious damage</li>
<li>Important for applications with high value or internal security risks</li>
</ol>
</li>
<li>
Non-revealing identifier formats:
<ol style="list-style-type:square">
<li> Use of identifier formats that do not reveal any information</li>
<li> Prevents opponents from obtaining information from the identifier format alone</li>
<li> Important for applications where tag identification is a business risk</li>
</ol>
</li>
<li>
Fallback identification system:
<ol style="list-style-type:square">
<li>Provision of alternative identification methods in the event of system failure</li>
<li>Applicable to all RFID applications</li>
<li>Provides redundancy and security in case of emergency or system failure</li>
</ol>
</li>
</ol>

==Technical controls==
Technical controls are essential for the security of RFID systems. These include measures for authentication and data integrity, for protecting the RF interface and for securing the data stored on the tags. \cite{NISTSP800-98}

<ol style="list-style-type:disc">
<li> Authentication and data integrity
<ol style="list-style-type:square">
<li> Password authentication: Use of passwords to control access to tags. Complex password management and risks associated with wireless transmission are challenges.</li>
<li> HMAC (Keyed-Hash Message Authentication Code): Use of HMAC for stronger authentication and data integrity. However, requires efficient key management and computing power on the tag.</li>
<li> Digital signatures: Use of digital signatures to authenticate transactions. Requires a public key infrastructure (PKI) and is more memory-intensive than other methods.</li>
</ol>
</li>

<li> RF interface protection
<ol style="list-style-type:square">
<li> cover coding:Encryption of communication between reader and tag to prevent eavesdropping.</li>
<li> encryption of transmitted data: Protection of data during transmission through encryption. </li>
<li> Electromagnetic shielding: Use of shielding to control the propagation of RF signals and prevent unauthorized reading. </li>
<li> Frequency selection: Selection of the appropriate frequency to avoid interference and provide optimum radio coverage.</li>
<li> Adjustment of transmission characteristics: Control over transmission power and antenna alignment to minimize interference and radiation risks.v
<li> Temporary deactivation of tags: Option to temporarily disable tags to prevent unauthorized access.</li>
<li> Tag activation switch:User control over the activation of tags to prevent unauthorized communication.</li>
<li> tag query (polling):Periodic polling of tags to check their presence and state.</li>
</ol>
</li>

<li> Privacy on tags
<ol style="list-style-type:square">
<li> Tag memory access control: Password-protected locking functions to control read and write access.</li>
<li> encryption of data at rest: Protection of the data stored on the tag by encryption. </li>
<li> Kill function: Ability to permanently disable tags to protect them from unauthorized use.</li>
<li> Tamper protection: Properties of tags that make tampering more difficult or visible.</li>
</ol>
</li>
</ol>

= References =

[[Category:Basic]]