1. miLazyCracker
Kevin Larson

2. Me Software Engineer at Honeywell
This presentation in no way represents my employer or what I do there, this work was done completely on my time and my dime
Masters Student at University Of Minnesota, USA

3. Research Note Mifare Plus Cracking
This presentation does not disclose any new vulnerabilities, simply builds on existing tools to make them easy to use

4. Mifare Classic simple storage device
read/write access permissions per block via keys
e-wallet, access control, transportation, hotels
Not all systems rely on networked/server side checks
Custom crypto library – CRYPTO1
Source:

5. Mifare Memory Layout
Source: NXP

6. Mifare Classic Attacks – Card Only
Open source NFC tools for Mifare Classic
MFOC (Nested Attack)
Relies on the fact that one key is known
MFCUK (Darkside Attack)
No keys are known for the card at all
MFCUK: MFOC:

7. IMG URL: https://www.pinterest.com/pin/440297301040955293/
Response to Attacks
Released Mifare Plus card - AES option
Backwards compatible with Mifare Classic (uses CRYPTO1 as well)
Fixed PRNG, no longer vulnerable to existing card-only attacks (MFOC/MFCUK)
IMG URL:

8. Researchers Response Carlo Meijer and Roel Verdult
Found new card-only attacks (Mifare Plus SL1)
Important because many installations likely did not update infrastructure

9. My Goals Reproduce the attack Get the proper hardware and software
Improve attack / easier to use
Can I make it faster? Real-time even?

10. Hardware and Tools SCL3711 (~$30) Proxmark3 ($212)
Mifare Plus Cards (~$75)
Mifare Reader (~$50)
Config Software (FREE!)
Crappy eBay lock *
Not all Classic readers accept MF+ (timing)

11. The Hardnested Attack Nested attacked on hardened cards = “hardnested”
Requires at least one known key
Many attempts at nested authentication
Collect unique encrypted nonces
Leaked bits can reduce keyspace to ~2^20
Brute-force

12. What did I actually do? Improving the attack was difficult
People a lot smarter than me don’t sleep
Speed of the attack is heavily dependent on the physical time constraints
Make this REALLY easy to use

13. Are you lazy? Everyone is lazy Lets make this easy: Try miLazyCracker!
Don’t know if you have a Mifare Classic or Plus?
Don’t have time to wait for older attacks (MFOC)
Don’t have over $200 to buy a Proxmark?
Have $30 for a usb reader?
Try miLazyCracker!

14. miLazyCracker modified LibNFC version of MFOC to ID the PRNG
Modified LibNFC version of hardnested attack to save additional data for tool automation
Created wrapper script to figure out all parameters necessary, no input parameters needed

15. Demo
./miLazyCracker …
Fingerprinting based on MIFARE type Identification Procedure:
* MIFARE Classic 1K
* MIFARE Plus (4 Byte UID or 4 Byte RID) 2K, Security level 1
Try to authenticate to all sectors with default keys...
Sector 00 - Found Key A: ffffffffffff Found Key B:
Sector 01 - Unknown Key A Found Key B:
Sector 11 - Found Key A: ffffffffffff Found Key B:
Sector 12 - Unknown Key A Unknown Key B
Sector 13 - Found Key A: ffffffffffff Found Key B:
Sector 14 - Found Key A: ffffffffffff Found Key B:
Sector 15 - Found Key A: ffffffffffff Found Key B:

16. Demo (cont.) PRNG is not vulnerable to nested attack
MFOC not possible, detected hardened Mifare Classic
Trying HardNested Attack...
libnfc_crypto1_crack B 48 B …
Collected 1540 nonces... leftover complexity (~2^37.54) - initializing brute-force phase...
Found key:
The custom key 0x has been added to the default keys
 … recursively calling attacks in wrapper script...
libnfc_crypto1_crack B 48 A
Found key: aabb
The custom key 0x aabb has been added to the default keys
Try to authenticate to all sectors with default keys...
Symbols: '.' no key found, '/' A key found, '\' B key found, 'x' both keys found
[Key: ] -> [ \...]
[Key: aabb] -> [ x...]
[Key: ffffffffffff] -> [x.xxxxxxxxxxxxxx]
[Key: a0a1a2a3a4a5] -> [x.xxxxxxxxxxxxxx]
[Key: d3f7d3f7d3f7] -> [x.xxxxxxxxxxxxxx]

17. Demo (cont.)
Sector 00 - Found Key A: ffffffffffff Found Key B:
Sector 01 - Unknown Key A Found Key B:
Sector 02 - Found Key A: ffffffffffff Found Key B: …
Sector 12 - Found Key A: aabb Found Key B:
Sector 13 - Found Key A: ffffffffffff Found Key B:
Sector 14 - Found Key A: ffffffffffff Found Key B:
Sector 15 - Found Key A: ffffffffffff Found Key B:
Using sector 00 as an exploit sector
PRNG is not vulnerable to nested attack
MFOC not possible, detected hardened Mifare Classic
Trying HardNested Attack...
libnfc_crypto1_crack B 4 A
Found tag with uid a007a2a0, collecting nonces for key A of block 4 using known key B for block 60
Collected 4003 nonces... leftover complexity (~2^35.03) - initializing brute-force phase...
Starting 8 threads to test states using 256-way bitslicing
Cracking %
No solution found :(
…. Keep Trying! We’ll get different nonces next time around….

18. Demo (cont.) MFOC not possible, detected hardened Mifare Classic
Trying HardNested Attack...
libnfc_crypto1_crack B 4 A
Collected nonces... leftover complexity (~2^33.32) - initializing brute-force phase...
Found key:  
Auth with all sectors succeeded, dumping keys to a file!

19. https://github.com/iAmNotSuperman/miLazyCracker/
Source Code Released

20. Remediation CUSTOM CRYPTO DO NOT USE Mifare Classic should be avoided
** Mifare Plus SL2 and SL3 are secure **

21. Questions?