Chameleon Mini: Mifare Cracking via the Reader Attack
by Lab401 Lee August 27, 2017
LAB401 ACADEMY: Mifare Cracking: Reader Attack with Chameleon Mini RevE Rebooted
INTRODUCTION:
Lab401's Chameleon Tiny is a compact, highly capable tool typically used for 13.56MHz emulation (Mifare, Ultralight, etc).
When a reader begins communication with a Mifare Tag, it will send a series of keys to attempt card decryption. The first of these keys can be sniffed by the Chameleon Mini and easily decoded.
Armed with this key, we are able to use LibNFC's mfoc tool with the DL-533N, or the Proxmark 3 to perform a nested / hardnested attack to successfully crack all keys and dump the card.
This attack is especially useful when we have:
A new generation MIFARE tag that resists classic attacks
Access to the card's reader
Check out the step by step video below.
Interested in getting started with these tools? We've made the Pentester Pack that contains all the tools from this tutorial - and some extra Magic Mifare cards.
Buying in a pack gives a massive saving of 66 Euros - check out the pack here.
Is your iCopy-XS showing a "Boot Timeout" error? This is caused by a faulty or corrupted internal microSD card. Fortunately, it's an easy fix - no soldering or special tools required. Follow this guide to open the device, replace the microSD card, and flash a fresh image.
Bought a refurbished IoT device on Amazon? It might still be paired to the previous owner. Using a WHIDBoard Pro, we exploited a smart cooker's UART debug port to gain root access in minutes. From Android vulnerabilities to remote ADB shells, we weaponized this kitchen gadget - then installed DOOM for good measure. Refurbished doesn't mean factory reset.
Seduce sensors into spilling secrets, with the DigiLab by Lab401 and the FlipperZero. Within minutes, you can peek and poke directly into the memory of millions of modules. In this hands on tutorial, we pull temperature data directly from a LM75A temperature sensor - without anything but the DigiLab and Flipper. No Arduinos, no code, no fuss!
With Lab401's DigiLab and the FlipperZero you can interact directly with millions of modules that use I2C. What took hours now takes minutes! In this in-depth tutorial, we target a BMP280 barometric sensor: detection, identification, communication and data interpretation!