2 months ago
- The post explains how to clone MIFARE Classic cards using a Proxmark3 device, motivated by high replacement costs from apartment access control.
- MIFARE Classic uses the broken CRYPTO-1 cipher and is widespread despite being insecure; modern alternatives like DESFire use AES.
- Proxmark3 is a full RFID research platform that supports dictionary, darkside, nested, and hardnested attacks, unlike limited phone apps or Chameleon Ultra.
- The Proxmark3 RDV4 is the official version (~$300), but cheaper clones on AliExpress (£20–60) work similarly with proper firmware flashing.
- Flashing the open-source Iceman firmware is essential; on macOS, use Homebrew with the `--with-generic` flag for clones.
- The `hf mf autopwn` command automates detection and cracking: dictionary, darkside, nested, then hardnested for hard PRNG cards.
- Example 1: Standard MIFARE Classic 1K with hard PRNG: default keys found via dictionary, custom Key B cracked via hardnested in ~23 seconds.
- Example 2: Fudan FM11RF08 clone with weak PRNG: dictionary failed, darkside cracked Key A, nested cracked Key B, total ~22 seconds.
- Keys are 6 bytes; common formats include default `FFFFFFFFFFFF`, random hex, and ASCII-encoded keys like `MYFACE`.
- Cloning requires 'magic' cards with writable Block 0 (UID); Gen1a cards are detectable via backdoor command (0x40), CUID cards via write tests.
- FUID cards write Block 0 once and lock permanently, making clones undetectable after writing; workflow: verify blank, dump target, write, verify clone.
- Detection methods: readers send 7-bit 0x40 to probe Gen1a backdoor, or attempt write to Block 0; rolling counters defeat static clones entirely.