A Better Way To Hack IClass RFID Readers

November 20, 2012 by Mike Szczys 18 Comments

iClass is an RFID standard that is aimed at better security through encryption and authentication. While it is more secure than some other RFID implementations, it is still possible to hack the system. But initial iClass exploits were quite invasive. [Brad Antoniewicz] published a post which talks about early attacks on the system, and then demonstrates a better way to exploit iClass readers.

We remember seeing the talk on iClass from 27C3 about a year and a half ago. While the technique was interesting, it was incredibly invasive. An attacker needed multiple iClass readers at his disposal as the method involved overwriting part of the firmware in order to get a partial dump, then patching those image pieces back together. [Brad] makes the point that this is fine with an off-the-shelf system, but high-security installations will be using custom images. This means you would need to get multiple readers off the wall of the building you’re trying to sneak into.

But his method is different. He managed to get a dump of the EEPROM from a reader using an FTDI cable and external power source. If you wan to see how he’s circumventing the PIC read protection you’ll have to dig into the source code linked in his article.

Wristband RFID Unlocks Car Door And Starts Engine

November 14, 2012 by Mike Szczys 19 Comments

[João Ribeiro] is an electronics engineer by day, but in his free time he likes to ply his trade on everyday items. Recently he’s been integrating his own microcontroller network to unlock and start his car via RFID. In addition to the joy of pulling apart the car’s interior, he spent time designing his own uC breakout board and developing an RFID reader from a single chip.

He’s working with a 1988 Mercedes that has very little in the way of electronics. It sounds like the stock vehicle didn’t even include a CAN bus so the prelude to the RFID hack had him installing a CAN bus network made up of two microcontrollers. One reads the velocity and RPM while the other displays it on the tachometer. When he began the tag-based entry system he used an RFID reader module for prototyping, but eventually built his own reader around the TRF7960 chip. This included etching his own receiver coil which was mounted in the side-view mirror bracket. To unlock the doors he holds the bracelet up to the mirror and the vehicle lets him in. The video after the break starts with a demonstration of the completed project and moves on to some build videos.

We certainly like the idea of using a bracelet rather than implanting the tag in the meaty part of your hand.

Continue reading “Wristband RFID Unlocks Car Door And Starts Engine” →

Configurable RFID Tag From 7400 Logic Chips

October 12, 2012 by Mike Szczys 16 Comments

This soldering nightmare is a configurable RFID tag which has been built from 7400-series logic chips. The beast of a project results in an iPhone-sized module which can be used as your new access card for security systems that uses the 125 kHz tags. The best part is that a series of switches makes the tag hand programmable, albeit in binary.

Of course this is an entry in this year’s 7400 Logic Competition. It’s from last year’s winner, and he’s spent a lot of time documenting the project; which we love. We were surprised that this many chips can be powered simply by what is induced in the coil from the reader. This is just one of the reasons the 7400-series have been so popular over the years. After working out the numbers, a 64-bit shift register was built to feed the tag ID to the encoding portion of the design. There were many kinks to work out along the way, but once it was functional a surface-mount design was put together resulting in the final product shown off in the video after the break.

Continue reading “Configurable RFID Tag From 7400 Logic Chips” →

Scratch-built RFID Reader

September 7, 2012 by Mike Szczys 11 Comments

We never bought an RFID reader because it seems too simple to be all that much fun. But [Abdullah] really caught our eye with his latest project. It’s an RFID reader built from discrete parts, and that’s an adventure we can get behind!

His write-up dives right into the theory of the device. He wrapped his own coil, which measure about one microhenry, then shares an equation used to calculate the appropriate capacitor pair for it. This is fed by a 125 kHz oscillator and works as the most basic reader. In practice this needs more components for rock-solid operation and he quickly moves to a marginally more complicated circuit which still does exactly the same thing.

He is now able to detect RFID tag data by reading this circuit with an oscilloscope. But the signal is very very weak. The rest of the post focuses on how to best utilize an OpAmp to increase signal quality and on/off time.

If you’re looking to recreate his reader [Abdullah] included a Kicad schematic and board layout.

No Secret Knocks Required At [Steve’s] House – Your Subway Pass Will Do

August 22, 2012 by Mike Nathan 26 Comments

rfid-door-lock

[Steve] is often host to all sorts of guests, and he was looking for an easy way to let his friends come and go as they please. After discovering that his front door came equipped with an electronic strike, he decided that an RFID reader would be a great means of controlling who was let in, and when.

Giving all your friends RFID cards and actually expecting that they carry them is a bit of a stretch, but lucky for [Steve] he lives near Boston, so the MBTA has him covered. Just about everyone in town has an RFID subway pass, which pretty much guarantees that [Steve’s] cohorts will be carrying one when they swing by.

He crafted a stylish set of wooden boxes to contain both the RFID reader and the Arduino that controls the system, matching them to the Victorian styling of his home. A single button can control the setup, allowing him to add and remove cards from access lists without much fuss. For more granular control however, [Steve] can always tweak settings from the Arduino serial console.

The card system is both stylish and useful – a combination that’s hard to beat.

Learn A New Language With The Babel Fish

August 6, 2012 by Brian Benchoff 8 Comments

The Babel fish from Hitchhiker’s Guide to the Galaxy is one of the strangest things in the universe. After inserting a Babel fish into your ear, it feeds off brain wave energy and excretes a matrix from the conscious frequencies into the speech areas of the brain. It’s invaluable as a universal translator, but until Earth is targeted for demolition we’ll have to make do with [Becky] from Adafruit’s Babel fish language toy.

[Becky]’s Babel fish is still able to feed off the energy given off by language, but in this case the energy comes from a set of RFID cards on which Chinese characters are written. After waving these RFID flash cards in front of the Babel fish, a wave shield connected to the Arduino plays a recording of how the logogram on the flash card should sound when pronounced.

While it’s not a biologically engineered fish that simultaneously proves and disproves the existence of god, every human endeavor – learning a language included – needs more [Douglas Adams] references. You can check out [Becky]’s Babel fish demo video after the break.

Continue reading “Learn A New Language With The Babel Fish” →

Store Your RFID Transit Card Inside Your Cellphone

July 17, 2012 by Mike Szczys 54 Comments

Check it out, this is a Boston transit pass — or at least the parts of it that matters. [Becky Stern] got rid of the rest in a bid to embed the RFID tag inside her cellphone.

The transit pass, called a CharlieCard, started out as a normal credit card shaped tag which you might use for access in the workplace. She unsheathed the chip and its antennae by giving it a generous soak in acetone. In about thirty minutes the plastic card looks more like paper pulp, and you can gently fish out the electronics. These are now small enough to fit in the back cover of a cellphone much like those inductive charging hacks.

[Becky] put hers in an iPhone. But the idea comes from [Dhani Sutanto] who used the same technique to extract the coil from a London transit pass. He then embedded the hardware in a resin cast ring.

Continue reading “Store Your RFID Transit Card Inside Your Cellphone” →