HCE/APDU-sniffing problem - NFC Hacking

Here's my problem: I want to be able to primitively emulate some function of a Desfire EV1 card by playing back the APDUs it receives/sends to a card reader. The problem is I don't know what kind of APDUs the reader is sending out.
I can't use KitKat because KK HCE requires the app to specify the SELECT AID APDU that the reader sends out, and I have no idea what that is or whether the reader is even sending a SELECT AID out.
I figured I could use Eddie Lee's NFCProxy on a modified build of CM9 to analyze the card/reader interactions, but every time I put my phone up to the reader, it says "invalid card."
My guess is that the reader is picking up some other NFC signal from the phone, possibly Android Beam-related. In fact, if I try to run a card emulation app on 1 phone and have another phone try to read it, both of the phones start buzzing. Even though I have Android Beam turned off, the OS's NFC scanning cycle is set to detect other Android peer-to-peer devices regardless.
Modifying the app's manifest for android.nfc.disable_beam_default doesn't disable it either.
Does anybody know what I have to modify in the CM source code to disable peer-to-peer NFC completely? Then I could build a version of CM with proper emulation. OR, does anybody have any other ideas?
I've been tearing my hair out with this one lol

Related

[Q] NFC for Access Control

Hello!
Currently I am writing my Master's thesis. For this I am supposed to use the NFC function of the Samsung Galaxy Nexus to turn on/off certain devices such as a flat iron or a stove.
My idea was to use an RFID access control as the ones used to open laboratory doors or the like and attach its relais to the devices' power switch. One could hold the phone next to the device to turn it on/off if permission is granted.
However, most of the access controls I've found are only for 125kHz. As far as I know NFC uses the ISO/IEC 14443 standard which communicates with 13.56MHz. What confuses me though is that some sources say it works with the NXP Mifare Ultralight C chipset but not with the Mifare Classic 1K. Can anyone explain why that is? But even more important to me is: has anyone a good suggestion on the access control I should use in my case?
I'd be happy about any reply!
Regards,
-knucKles
knucKles2 said:
Hello!
Currently I am writing my Master's thesis. For this I am supposed to use the NFC function of the Samsung Galaxy Nexus to turn on/off certain devices such as a flat iron or a stove.
My idea was to use an RFID access control as the ones used to open laboratory doors or the like and attach its relais to the devices' power switch. One could hold the phone next to the device to turn it on/off if permission is granted.
However, most of the access controls I've found are only for 125kHz. As far as I know NFC uses the ISO/IEC 14443 standard which communicates with 13.56MHz. What confuses me though is that some sources say it works with the NXP Mifare Ultralight C chipset but not with the Mifare Classic 1K. Can anyone explain why that is? But even more important to me is: has anyone a good suggestion on the access control I should use in my case?
I'd be happy about any reply!
Regards,
-knucKles
Click to expand...
Click to collapse
Just an Idea and hear me out...
As far as I remember most access control (Which I used to use about 7 years ago when I was working for a plant as a part time IT) is nothing but the right string of 101011010, a few bits of data stored on a magnetic strip on a card, or the older NFC chips that could changed, but only store 1 "Tag" at a time.
With most NFC chips in our newer smart phones we have the control to change the information that is broadcast by our NFC on the fly, and even better it is a two way transmission (Which is what makes Google wallet possible.)
If you were going to attempt to make a stove or other device turn off and on with an NFC chip, you would be better off not looking for an access control solution. I would try using another computer. Something that can be programmed with an NFC chip to receive a certain bit of code that says "Turn on front right burner at 50%" and then reply with a conformation saying when the action is complete.
A small Linux box, with an NFC and a single program, and Knowledge of external interfacing.
A smart phone with preset tags that can be chosen to do different actions, and wait for a confirmation.
I think that would be something new and applicable to the real world.
Hope this give you some ideas
After I get done with my current project I am going to make an android app that lets you create an NFC tag and write it to any tag, so people can program there router, stick an NFC Sticker to the side of your router any anyone with an NFC chip will have instant access to there network by touching the router.
Switching on a device using NFC
I have a similar requirement; i.e. to activate a device using NFC from a phone or smart tag. My question is whether the induction power of the NFC from the phone is sufficient to turn on a device that is an off state prior to this.
ilsol said:
I have a similar requirement; i.e. to activate a device using NFC from a phone or smart tag. My question is whether the induction power of the NFC from the phone is sufficient to turn on a device that is an off state prior to this.
Click to expand...
Click to collapse
Yes , but such tag isn’t available online, such tag can be only order from specialized manufacturer, we are making some stuff will turn on & off bluetooth device, and it work like a charm. Need soldering to bypass the existing on/off button.
hope that help
ilsol said:
I have a similar requirement; i.e. to activate a device using NFC from a phone or smart tag. My question is whether the induction power of the NFC from the phone is sufficient to turn on a device that is an off state prior to this.
Click to expand...
Click to collapse
Probably not, you will need something (small chip) that just listens for the right tag and handles it for you.
Thrown far across the web with the power of Hercules and Tapatalk 2
thankyou very jedan

We can connect (and use) external NFC readers to our phones through USB OTG

You can find pictures and a description of my set up here:
http://www.nfcbrief.com/2012/07/acr122-and-galaxy-nexus-connected-via.html
Basically, ACS released an application called Smart Biz Card that allows you to read and write contact NFC tags with the popular ACR122 connected via USB host. The application is only for tablets, so it will look strange on phone screens, but this can be fixed by entering tablet mode.
I'm sure many of you viewing this sub-forum also have a ACR122, so maybe this application will provide some clues as to unlocking more advanced features through external readers?
NFC Guy said:
You can find pictures and a description of my set up here:
http://www.nfcbrief.com/2012/07/acr122-and-galaxy-nexus-connected-via.html
Basically, ACS released an application called Smart Biz Card that allows you to read and write contact NFC tags with the popular ACR122 connected via USB host. The application is only for tablets, so it will look strange on phone screens, but this can be fixed by entering tablet mode.
I'm sure many of you viewing this sub-forum also have a ACR122, so maybe this application will provide some clues as to unlocking more advanced features through external readers?
Click to expand...
Click to collapse
hi good job but i don't see the point ?? Nexus for example already have NFC so why connect ACR 122 ??
Bardamuz said:
hi good job but i don't see the point ?? Nexus for example already have NFC so why connect ACR 122 ??
Click to expand...
Click to collapse
My thinking was that this sort of thing would be ideal for NFC hacking. The documentation for the ACR122 states that it can do card emulation (but everyone seems to be having trouble with it). If we could somehow get the drivers for the ACR122 working fully with Android, it would provide a good alternative to trying to access our phones' secure elements for card emulation.
This could also have some more practical uses, e.g. for event ticketing on a small scale?
NFC Guy said:
My thinking was that this sort of thing would be ideal for NFC hacking. The documentation for the ACR122 states that it can do card emulation (but everyone seems to be having trouble with it). If we could somehow get the drivers for the ACR122 working fully with Android, it would provide a good alternative to trying to access our phones' secure elements for card emulation.
This could also have some more practical uses, e.g. for event ticketing on a small scale?
Click to expand...
Click to collapse
i some point i agree with you, but i think will be (maybe) simpler to use the ACR122 in pc (mac/winbooze) and transfer it in some Android apps
but at least you are right card emulation it's a problem currently
ACS USB NFC reader
Hi
Have you actually had this working on a tablet? I have tried with a Samsung Galaxy tab 10.1 (2) and the reader is not recognised. Some other readers which have chipsets Samsung support are recognised and show up as an HID. But the ACR122U doesnt appear.
Ted
Basically, ACS released an application called Smart Biz Card that allows you to read and write contact NFC tags with the popular ACR122 connected via USB host. The application is only for tablets, so it will look strange on phone screens, but this can be fixed by entering tablet mode.
I'm sure many of you viewing this sub-forum also have a ACR122, so maybe this application will provide some clues as to unlocking more advanced features through external readers?[/QUOTE]
tedhurlock said:
Have you actually had this working on a tablet? I have tried with a Samsung Galaxy tab 10.1 (2) and the reader is not recognised. Some other readers which have chipsets Samsung support are recognised and show up as an HID. But the ACR122U doesnt appear.
Click to expand...
Click to collapse
I would guess they are missing the mandatory drivers to use them. Btw, are you sure they are recognized as HID? They actually should be recognized as CCID, if I remember correctly. Can you confirm they actually work?
ACR122 on Galaxy
I have no idea where I would get drivers. ACD who produce the device have only given a lava library for access which seems to use direct USB calls. And it seems to have been broken with ICS.
Tjis Android world looks quite muddy from my first experiences
Damastus said:
I would guess they are missing the mandatory drivers to use them. Btw, are you sure they are recognized as HID? They actually should be recognized as CCID, if I remember correctly. Can you confirm they actually work?
Click to expand...
Click to collapse

Using NFC between Android and Arduino

Can anyone point me in a good direction for getting started working with NFC between an android phone an an arduino? I'm thinking of starting a project using a phone and google authenticator (or similar OTP system) to send the one-time password to an arduino based system via NFC. I only recently bought a NFC capable phone and I've just started playing with NFC tags very recently. I'm very interested in more data I/O applications of NFC, not just having tags perform actions.
drumz0rz said:
Can anyone point me in a good direction for getting started working with NFC between an android phone an an arduino? I'm thinking of starting a project using a phone and google authenticator (or similar OTP system) to send the one-time password to an arduino based system via NFC. I only recently bought a NFC capable phone and I've just started playing with NFC tags very recently. I'm very interested in more data I/O applications of NFC, not just having tags perform actions.
Click to expand...
Click to collapse
You'll want to read up on LLCP (to negotiate the connection) and SNEP (to transfer data). Beam will work for this without an issue. You'll likely have to implement your own firmware for the arduino nfc shield (negotiating the connection via LLCP and sending / receiving data).

[Q] Using NFC to acces control

Hi guys,
There is a question to Smartwatch owners.
Does anyone tried to use NFC tag in the watch to open a door or gain access on other RFID device?
I'm considering to buy a watch and the main reason to do it is abillity to use it at work, where I have to go through many doors where I use my Nexus 5 or just simple keyfob with Mifare chip.
I don't really understand, why companys like Sony, LG or Samsung cannot see this, that is a game changing feature .... There is until now, just one company which thinking about that.. but theirs watch isn't smart : http://www.winwatchtrade.com/the-key-nfc-mifare/
Be something that would be very cool, would have to see if NFC Tagwrier can be sideloaded..
Even if it worked on the watch, it may not create workable NFC tags,
Hope somebody tries this. I did try but was not able to read any NFC tags
AstroDigital said:
Be something that would be very cool, would have to see if NFC Tagwrier can be sideloaded..
Even if it worked on the watch, it may not create workable NFC tags,
Hope somebody tries this. I did try but was not able to read any NFC tags
Click to expand...
Click to collapse
Tried and worked with an HID iClass R10 Card Reader. Problem is that the watch's nfc sends the same info from all Sony SW3's, so not secure.

Copy a NFC card to my Android phone and use my Android phone as that NFC card?

I have a few NFC cards for different access and I would like to copy the auth information on that NFC card to my Android phone so I can use ONE Android phone (which also is more difficult to lose) for all NFC reader access points.
Is this possible?
riahc3 said:
I have a few NFC cards for different access and I would like to copy the auth information on that NFC card to my Android phone so I can use ONE Android phone (which also is more difficult to lose) for all NFC reader access points.
Is this possible?
Click to expand...
Click to collapse
"NFC Card Emulator" should be able to do that. you need root of course. look it up in the Play Store
however credit cards or in the Netherlands "OV chipkaart" (OV = Public Transport, chipkaart = chip (?) card ) won't work. just basic cards without verification or whatever will work.
It only works if the ID of the card is used for authentication. If there is any token involved, it won't work.
However, I don't understand why root is necessary. The NFC standard should allow the phone to set any ID by will. However, it only SHOULD present a random ID every time, but not MUST. However, Samsung decided to not allow people to change this, even with root. Therefor, no way this works with S7.
Emulating the NFC card is to modify the system's NFC chip's memory space which is root required.
aeroxy said:
Emulating the NFC card is to modify the system's NFC chip's memory space which is root required.
Click to expand...
Click to collapse
Hello,
I need this information for research ! Would you happen to know what particular (specific) file most be modify and with what? Thank you so much in advance.

Categories

Resources