Basically, it is, at that point, no more secure than a memory stick. This means you can read the card, and make a copy, and change it in any way including changing any 'value' settings it has. It will work through all of the unknown keys, and get you a dump of the card and all the keys. It took nearly 10 minutes to get the key, and after several tests I found that was about the longest it takes, with it often finding in under 3 minutes. I loaded a card where I had put a key it could not read. It was a tad harder to run as the iMac grabs the NFC reader and I had to edit the ist file in recovery mode to remove the ACR122U reader I am using, and compile libnfc with. This meant a few brew commands instead of apt commands, but getting the hardnested mfoc compiled was simple. So I tried my very old linux box I normally use, not bad. I set up on a Pi, and realised that did not have much oomph. I found a site covering how to set up a hardnested attack, here.

This really shows why you don't make your own crypto, ever!Īs I am doing some work with MIFARE Classic for a client (yes, I said it was insecure), I thought it worth seeing what that means in practice, in 2020. Now, it seems, that modern cards are not quite as vulnerable, but can be cracked with a brute force attack in some way. By standard command I mean literally apt install mfoc, seriously. These apparently allow access very quickly, and there is even a standard command mfoc to crack such cases. Something to do with the random number generator being poor, and a nested attack. Reading up on it a little, it sounds like several issues.

What was not clear to me is quite how insecure. This is old news to most people, but do not use MIFARE Classic cards, they are not secure.

Mifare crack