RFID readers, writers, and spoofers

posted Sep 25th 2010 12:00pm by Mike Szczys
filed under: security hacks

[Carl] has done a lot of work developing a collection of RFID hardware. The two cards you see above are spoofers that can be programmed in the field using the keypad on the left, or the rather intimidating banks of DIP switches on the right. We also enjoyed his look at the Atmel T5557 and ATA5567 on-card chips used for the tags themselves. He shared the schematics for his designs but unfortunately he’s not distributing the firmware. None-the-less, if you’re interested in learning more about RFID this is a wonderful resource as it covers readers, writers, spoofer, and tags.

Comments [10]

tagged: ata5567, reader, rfid, spoofer, t5557, tag, writer

10 Responses to RFID readers, writers, and spoofers

Chris says:

September 25, 2010 at 12:32 pm

What an interesting design and hack. I now want to have a go, primarily to work out which RFID tags actually use this chip. Congrats!

Reply Report comment

F. says:

September 25, 2010 at 1:50 pm

“Rather intimidating banks of DIP switches”? You’ve never configured an old dot matrix printer…

Reply Report comment

Dave says:

September 25, 2010 at 4:39 pm

That large number of switches seems intimidating unless you have a conversion chart. An earlier thread on the RFID Proxmark forum had a link to the following chart which shows an example of how the 44-bits in a HID access card will map into the T5567 read/write card registers. The information is also applicable to setting up the DIP switches on a spoofer like the one shown.
http://www.proxclone.com/pdfs/HID_format_example.pdf

Reply Report comment

terribledamage says:

September 25, 2010 at 7:54 pm

Still not an RFID sniffer. Build a device which able to copy RFID cards in seconds.

Eg.: you put near to a hotelroom rfid card then it downloads it to its memory and then after u set a switch and put another card near to it, it writes it out.

Since RFID has no security by designs it should be an easy task. Kinda stupid that hotels started using it.

Reply Report comment

Addidis says:

September 25, 2010 at 8:17 pm

It makes me sad when firmware isnt posted. I would make a section for stingy bastards who dont post code :) And then the normal HAD for people who are cool and post code.

Perhaps im being harsh?

Reply Report comment

Ken says:

September 25, 2010 at 10:38 pm

Ah, the venerable SX-28.

Don’t see many of those around nowadays, especially since Parallax pulled the plug.

Reply Report comment

abc says:

September 26, 2010 at 6:23 am

Yayyyy. Fun hax. Why no Firmware? ;__;

Reply Report comment

Thibow says: