Half an hour of #mifare #nfc #encryption and #security. How weaknesses were found, and how they were dealt with.
Not the worst thing to watch on a slow Saturday morning! 🤓
https://youtu.be/4tIKj5QQE_0?is=jzJOM2T3NPxAlkQq
#Norsktut #infosec #allheimen
Not the worst thing to watch on a slow Saturday morning! 🤓
https://youtu.be/4tIKj5QQE_0?is=jzJOM2T3NPxAlkQq
#Norsktut #infosec #allheimen
October 31, 2026 at 11:23 AM
Half an hour of #mifare #nfc #encryption and #security. How weaknesses were found, and how they were dealt with.
Not the worst thing to watch on a slow Saturday morning! 🤓
https://youtu.be/4tIKj5QQE_0?is=jzJOM2T3NPxAlkQq
#Norsktut #infosec #allheimen
Not the worst thing to watch on a slow Saturday morning! 🤓
https://youtu.be/4tIKj5QQE_0?is=jzJOM2T3NPxAlkQq
#Norsktut #infosec #allheimen
Good news; this hotel is fully supportive of the BYOK approach :neocat_approve:
The key does seem to have been generated with a seed that's more random than 4 and which isn't in the dictionary, unfortunately :neocat_sad:
The key does seem to have been generated with a seed that's more random than 4 and which isn't in the dictionary, unfortunately :neocat_sad:
November 1, 2026 at 5:54 PM
Good news; this hotel is fully supportive of the BYOK approach :neocat_approve:
The key does seem to have been generated with a seed that's more random than 4 and which isn't in the dictionary, unfortunately :neocat_sad:
The key does seem to have been generated with a seed that's more random than 4 and which isn't in the dictionary, unfortunately :neocat_sad:
yeah mew agreed, i quite like the mifare/nfc solutions for mass transit, can add to google/apple wallet or subdurmal implant or w/e hehe
October 25, 2026 at 2:52 PM
yeah mew agreed, i quite like the mifare/nfc solutions for mass transit, can add to google/apple wallet or subdurmal implant or w/e hehe
TIL there's some relatively new attacks against Ultralight: https://breakmeifyoucan.com/
Which is good, as hotels are starting to use Ultralight C with 3DES; that's difficult to exploit (unlike other Ultralights)
Suppose I should be happy MiFare Classic is finally dying in the hotel industry....
Which is good, as hotels are starting to use Ultralight C with 3DES; that's difficult to exploit (unlike other Ultralights)
Suppose I should be happy MiFare Classic is finally dying in the hotel industry....
BREAKMEIFYOUCAN! - Exploiting Keyspace Reduction and Relay Attacks in 3DES and AES-protected NFC Technologies
Exploiting Keyspace Reduction and Relay Attacks in 3DES and AES-protected NFC Technologies. Reducing 2TDEA keyspace from 2¹¹² to 2²⁸ through partial key overwrites and relay attacks.
breakmeifyoucan.com
October 31, 2026 at 12:57 AM
TIL there's some relatively new attacks against Ultralight: https://breakmeifyoucan.com/
Which is good, as hotels are starting to use Ultralight C with 3DES; that's difficult to exploit (unlike other Ultralights)
Suppose I should be happy MiFare Classic is finally dying in the hotel industry....
Which is good, as hotels are starting to use Ultralight C with 3DES; that's difficult to exploit (unlike other Ultralights)
Suppose I should be happy MiFare Classic is finally dying in the hotel industry....
moving to? i feel like its been this way for quite a while in the UK and Australia moved to miFare cards in most major cities iirc a long time ago
but yeah thread.. yep yep whole thing
but yeah thread.. yep yep whole thing
October 25, 2026 at 2:37 PM
moving to? i feel like its been this way for quite a while in the UK and Australia moved to miFare cards in most major cities iirc a long time ago
but yeah thread.. yep yep whole thing
but yeah thread.. yep yep whole thing
Switch App Update: Emulanders by joaoHypo (v1.0.0)
Emulanders by joaoHypo - Skylanders NFC Emulation, Joy-Con scanner, dump manager & Tesla overlay (GPLv3)
v1.0.0
- Initial release for Nintendo Switch Homebrew App Store!
- Full nfc:mf:u Mifare Classic 1K emulation sysmodule with passive RAM architecture.
- Tesla Overlay with lazy thumbnail rendering and ...
hb-app.store
October 16, 2026 at 5:29 PM
Switch App Update: Emulanders by joaoHypo (v1.0.0)
NFC Toolsで手持ちのみたら全部NXP Mifareと出るが1つだけclassic 1kとまで表示されたのでちゃんとチップ名拾ってるって事でいいんかな？
October 14, 2026 at 3:04 PM
NFC Toolsで手持ちのみたら全部NXP Mifareと出るが1つだけclassic 1kとまで表示されたのでちゃんとチップ名拾ってるって事でいいんかな？
October 9, 2026 at 10:37 PM
Der Verschlüsselungsalgorithmus #crypto1, den die #mifare Classic nutzt, wurde im Jahr 2008 gebrochen. Im Gegensatz zum aktuellen Screenshot oben schrieb #heise vor fast dreißig Jahren:
»Die Sicherheit des Algorithmus, so das Fazit der Forscher, sei "nahe Null".«
https://heise.de/-201011
»Die Sicherheit des Algorithmus, so das Fazit der Forscher, sei "nahe Null".«
https://heise.de/-201011
Aus für RFID-System Mifare Classic? [Update]
Waren zum Knacken der Zugriffsschlüssels bislang große Rainbow-Tabellen nötig, gelingt der neue Angriff nun auch ohne diese und auf normaler PC-Hardware innerhalb weniger Sekunden.
www.heise.de
October 10, 2026 at 7:23 AM
Der Verschlüsselungsalgorithmus #crypto1, den die #mifare Classic nutzt, wurde im Jahr 2008 gebrochen. Im Gegensatz zum aktuellen Screenshot oben schrieb #heise vor fast dreißig Jahren:
»Die Sicherheit des Algorithmus, so das Fazit der Forscher, sei "nahe Null".«
https://heise.de/-201011
»Die Sicherheit des Algorithmus, so das Fazit der Forscher, sei "nahe Null".«
https://heise.de/-201011
So if you're implementing a MIFARE Classic system (why?), verify what cards are going to be used with it and implement accordingly.
September 30, 2026 at 8:16 PM
So if you're implementing a MIFARE Classic system (why?), verify what cards are going to be used with it and implement accordingly.
This makes sense since you can configure key B as user data if you don't need it as a second key, and user data should not be authenticatable. However, for FM11RF08/S chips (why are people still using those), they missed the memo during implementation. stackoverflow.com/questions/73...
Why is Mifare Classic data readable with KeyB in transport configuration?
The Mifare Classic specification from NXP explicitly states, that data should not be readable using KeyB when using transport configuration (factory default), because KeyB is readable (having KeyA)...
stackoverflow.com
September 30, 2026 at 8:16 PM
This makes sense since you can configure key B as user data if you don't need it as a second key, and user data should not be authenticatable. However, for FM11RF08/S chips (why are people still using those), they missed the memo during implementation. stackoverflow.com/questions/73...
Something I just learned while poking around at a MIFARE Classic hotel key card from my most recent trip (why are people still using those) is that you're not supposed to be able to read a sector if its key B is readable and you authenticate with key B.
September 30, 2026 at 8:16 PM
Something I just learned while poking around at a MIFARE Classic hotel key card from my most recent trip (why are people still using those) is that you're not supposed to be able to read a sector if its key B is readable and you authenticate with key B.
This is getting a lot of attention lately.
HiLetgo RFID Kit - Mifare RC522 RF IC Card Sensor
🔭 https://www.amazon.com/dp/B01CSTW0IA?tag=jwebb004-20&linkCode=osi&th=1&psc=1 #ad #paidlink #AmazonAffiliate #Tech #Gadgets
HiLetgo RFID Kit - Mifare RC522 RF IC Card Sensor
🔭 https://www.amazon.com/dp/B01CSTW0IA?tag=jwebb004-20&linkCode=osi&th=1&psc=1 #ad #paidlink #AmazonAffiliate #Tech #Gadgets
HiLetgo RFID Kit - Mifare RC522 RF IC Card Sensor
Explore on Amazon
www.amazon.com
September 26, 2026 at 9:06 AM
This is getting a lot of attention lately.
HiLetgo RFID Kit - Mifare RC522 RF IC Card Sensor
🔭 https://www.amazon.com/dp/B01CSTW0IA?tag=jwebb004-20&linkCode=osi&th=1&psc=1 #ad #paidlink #AmazonAffiliate #Tech #Gadgets
HiLetgo RFID Kit - Mifare RC522 RF IC Card Sensor
🔭 https://www.amazon.com/dp/B01CSTW0IA?tag=jwebb004-20&linkCode=osi&th=1&psc=1 #ad #paidlink #AmazonAffiliate #Tech #Gadgets
proxmark3 v4.23346 — Hardware tool for RFID/NFC analysis, emulation, sniffing, and cloning. Supports multiple protocols (MIFARE, iClass, ISO14443, ISO15693) with extensive LUA scripting for automated security testing and tag interaction. https://ktp.sh/10gmt4jZz3
September 22, 2026 at 4:57 PM
proxmark3 v4.23346 — Hardware tool for RFID/NFC analysis, emulation, sniffing, and cloning. Supports multiple protocols (MIFARE, iClass, ISO14443, ISO15693) with extensive LUA scripting for automated security testing and tag interaction. https://ktp.sh/10gmt4jZz3
proxmark3 v4.23346 https://kitploit.com/en/posts/github-rfidresearchgroup-proxmark3-v423346
proxmark3 v4.23346 — Hardware tool for RFID analysis, emulation, and penetration testing. Supports 125kHz, 13.56MHz protocols (MIFARE, iClass, ISO14443/15693) with key recovery, sniffing, and scripting for security research. | Kitploit
Hardware tool for RFID/NFC analysis, emulation, sniffing, and cloning. Supports multiple protocols (MIFARE, iClass, ISO14443, ISO15693) with extensive LUA scripting for automated security testing and tag interaction.
kitploit.com
September 19, 2026 at 4:58 AM
proxmark3 v4.23346 https://kitploit.com/en/posts/github-rfidresearchgroup-proxmark3-v423346
Worth checking before it's gone.
HiLetgo RFID Kit - Mifare RC522 RF IC Card Sensor
🔭 https://www.amazon.com/dp/B01CSTW0IA?tag=jwebb004-20&linkCode=osi&th=1&psc=1 #ad #paidlink #AmazonAffiliate #Tech #Gadgets
HiLetgo RFID Kit - Mifare RC522 RF IC Card Sensor
🔭 https://www.amazon.com/dp/B01CSTW0IA?tag=jwebb004-20&linkCode=osi&th=1&psc=1 #ad #paidlink #AmazonAffiliate #Tech #Gadgets
HiLetgo RFID Kit - Mifare RC522 RF IC Card Sensor
Explore on Amazon
www.amazon.com
September 13, 2026 at 4:52 AM
Worth checking before it's gone.
HiLetgo RFID Kit - Mifare RC522 RF IC Card Sensor
🔭 https://www.amazon.com/dp/B01CSTW0IA?tag=jwebb004-20&linkCode=osi&th=1&psc=1 #ad #paidlink #AmazonAffiliate #Tech #Gadgets
HiLetgo RFID Kit - Mifare RC522 RF IC Card Sensor
🔭 https://www.amazon.com/dp/B01CSTW0IA?tag=jwebb004-20&linkCode=osi&th=1&psc=1 #ad #paidlink #AmazonAffiliate #Tech #Gadgets
the official flipper zero account hinting you can toggle other peoples sex toys with it _was_ weird but you have to remember theyre desperately looking for a second feature beyond "replay mifare cards"
September 12, 2026 at 7:00 PM
the official flipper zero account hinting you can toggle other peoples sex toys with it _was_ weird but you have to remember theyre desperately looking for a second feature beyond "replay mifare cards"
Asking mastodon: is it really not possible to unlock a locked MIFARE Ultralight NFC tag? Seems to me there should be some way to do it. Or is it actually physically altering the chip?
September 8, 2026 at 9:40 PM
Asking mastodon: is it really not possible to unlock a locked MIFARE Ultralight NFC tag? Seems to me there should be some way to do it. Or is it actually physically altering the chip?
日本インフラ企業独自仕様の失敗事例
・NTTドコモ（iモード・PDC）
国内で儲かりすぎて調子に乗り海外キャリアの株を買収して自滅。
・JR東日本（Suica）
”東京だけ”の超過密ダイヤで確率した技術を過信し、世界標準（MIFARE）を舐めて孤立。
・東京電力（CHAdeMO）
「世界初のEV充電規格」という夢に酔ったが、既にCCSで決まった海外では全く相手にされず壊滅。
これら全てに共通するのは
「まず日本国内で最高のものを完成させ、実績を作ってから海外に持っていけば、優れているんだからみんな飛びつくはずだッ！」
という致命的な勘違い。
・NTTドコモ（iモード・PDC）
国内で儲かりすぎて調子に乗り海外キャリアの株を買収して自滅。
・JR東日本（Suica）
”東京だけ”の超過密ダイヤで確率した技術を過信し、世界標準（MIFARE）を舐めて孤立。
・東京電力（CHAdeMO）
「世界初のEV充電規格」という夢に酔ったが、既にCCSで決まった海外では全く相手にされず壊滅。
これら全てに共通するのは
「まず日本国内で最高のものを完成させ、実績を作ってから海外に持っていけば、優れているんだからみんな飛びつくはずだッ！」
という致命的な勘違い。
September 6, 2026 at 1:08 AM
日本インフラ企業独自仕様の失敗事例
・NTTドコモ（iモード・PDC）
国内で儲かりすぎて調子に乗り海外キャリアの株を買収して自滅。
・JR東日本（Suica）
”東京だけ”の超過密ダイヤで確率した技術を過信し、世界標準（MIFARE）を舐めて孤立。
・東京電力（CHAdeMO）
「世界初のEV充電規格」という夢に酔ったが、既にCCSで決まった海外では全く相手にされず壊滅。
これら全てに共通するのは
「まず日本国内で最高のものを完成させ、実績を作ってから海外に持っていけば、優れているんだからみんな飛びつくはずだッ！」
という致命的な勘違い。
・NTTドコモ（iモード・PDC）
国内で儲かりすぎて調子に乗り海外キャリアの株を買収して自滅。
・JR東日本（Suica）
”東京だけ”の超過密ダイヤで確率した技術を過信し、世界標準（MIFARE）を舐めて孤立。
・東京電力（CHAdeMO）
「世界初のEV充電規格」という夢に酔ったが、既にCCSで決まった海外では全く相手にされず壊滅。
これら全てに共通するのは
「まず日本国内で最高のものを完成させ、実績を作ってから海外に持っていけば、優れているんだからみんな飛びつくはずだッ！」
という致命的な勘違い。
It looks like they use the same technology. But not sure if it's the same model/manufacturer.
en.wikipedia.org/wiki/MIFARE#...
en.wikipedia.org/wiki/MIFARE#...
MIFARE - Wikipedia
en.wikipedia.org
September 3, 2026 at 8:37 PM
It looks like they use the same technology. But not sure if it's the same model/manufacturer.
en.wikipedia.org/wiki/MIFARE#...
en.wikipedia.org/wiki/MIFARE#...
🔐 Guía definitiva: MIFARE, DESFire, iCLASS y NFC
¿Qué tarjeta usas para entrar al edificio? ¿Es segura?
Comparativa clara de tecnologías de control de acceso.
ita.tech/mifare-desfi...
¿Qué tarjeta usas para entrar al edificio? ¿Es segura?
Comparativa clara de tecnologías de control de acceso.
ita.tech/mifare-desfi...
🔐 Control de Acceso: La guía definitiva de tecnologías como MIFARE, DESFire, iCLASS, NFC - ITA TECH
Explora los principales estándares de control de acceso como MIFARE, DESFire, NFC e iCLASS. Conoce sus diferencias y aplicaciones en proyectos reales.
ita.tech
August 31, 2026 at 1:10 PM
🔐 Guía definitiva: MIFARE, DESFire, iCLASS y NFC
¿Qué tarjeta usas para entrar al edificio? ¿Es segura?
Comparativa clara de tecnologías de control de acceso.
ita.tech/mifare-desfi...
¿Qué tarjeta usas para entrar al edificio? ¿Es segura?
Comparativa clara de tecnologías de control de acceso.
ita.tech/mifare-desfi...
Hikvision DS-KV8213-WME1(B) Postazione esterna videocitofonica per 2 appartamenti con 2 pulsanti fisici retroilluminato, collegabile in wifi o via cavo ethernet (RJ45), antivandalo IK08 ed impermeabile (IP65), illuminazione fino a 3 mt. Lettore Tag mifare incorporato per lapertura cancelli. Pu esser
August 27, 2026 at 7:56 PM
Hikvision DS-KV8213-WME1(B) Postazione esterna videocitofonica per 2 appartamenti con 2 pulsanti fisici retroilluminato, collegabile in wifi o via cavo ethernet (RJ45), antivandalo IK08 ed impermeabile (IP65), illuminazione fino a 3 mt. Lettore Tag mifare incorporato per lapertura cancelli. Pu esser
C'est dommage que Google ait supprimé la fonctionnalité pour cloner des Mifare Classic dans Android. Ca aurait été le zonz complet au Lycée avec des lycéens qui peuvent se cloner les badges les un des autres.
August 26, 2026 at 3:03 PM
C'est dommage que Google ait supprimé la fonctionnalité pour cloner des Mifare Classic dans Android. Ca aurait été le zonz complet au Lycée avec des lycéens qui peuvent se cloner les badges les un des autres.
Je pars du principe qu'on ne met plus de mifare classic, évidemment, hein.
August 26, 2026 at 3:00 PM
Je pars du principe qu'on ne met plus de mifare classic, évidemment, hein.