Abstract
We develop a new, custom-built hardware for emulating contactless smartcards compliant to ISO 14443. The device is based on a modern low-cost microcontroller and can support basically all relevant (cryptographic) protocols used by contactless smartcards today, e.g., those based on AES or Triple-DES. As a proof of concept, we present a full emulation of Mifare Classic cards on the basis of our highly optimized implementation of the stream cipher Crypto1. The implementation enables the creation of exact clones of such cards, including the UID. We furthermore reverse-engineered the protocol of DESFire EV1 and realize the first emulation of DESFire and DESFire EV1 cards in the literature. We practically demonstrate the capabilities of our emulator by spoofing several real-world systems, e.g., creating a contactless payment card which allows an attacker to set the stored credit balance as desired and hence make an infinite amount of payments.
The work described in this paper has been supported in part by the European Commission through the ICT programme under contract ICT-2007-216676 ECRYPT II.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Preview
Unable to display preview. Download preview PDF.
References
Atmel. ATmega32 Data Sheet, http://www.atmel.com/dyn/resources/prod_documents/doc2503.pdf
Atmel. ATxmega192A3 Data Sheet, http://www.atmel.com/dyn/resources/prod_documents/doc8068.pdf
Atmel. AVR XMEGA A Manual, http://www.atmel.com/dyn/resources/prod_documents/doc8077.pdf
Carluccio, D.: Electromagnetic Side Channel Analysis for Embedded Crypto Devices, Diplomarbeit, Ruhr-University Bochum (March 2005)
Courtois, N.: The Dark Side of Security by Obscurity and Cloning Mifare Classic Rail and Building Passes, Anywhere, Anytime. In: SECRYPT 2009, pp. 331–338. INSTICC Press (2009)
Crapto1. Open Implementation of Crypto1 (2008), http://code.google.com/p/crapto1
de Koning Gans, G., Hoepman, J., Garcia, F.: A Practical Attack on the MIFARE Classic. In: Grimaud, G., Standaert, F.-X. (eds.) CARDIS 2008. LNCS, vol. 5189, pp. 267–282. Springer, Heidelberg (2008)
Federal Office for Information Security, Germany. Advanced Security Mechanisms for Machine Readable Travel Documents – Extended Access Control, http://www.bsi.de/fachthem/epass/EACTR03110_v110.pdf
Future Technology Devices International Ltd. FT245R Datasheet, http://www.ftdichip.com/Support/Documents/DataSheets/ICs/DS_FT245R.pdf
Garcia, F., de Koning Gans, G., Muijrers, R., Van Rossum, P., Verdult, R., Schreur, R., Jacobs, B.: Dismantling MIFARE Classic. In: Jajodia, S., Lopez, J. (eds.) ESORICS 2008. LNCS, vol. 5283, pp. 97–114. Springer, Heidelberg (2008)
Garcia, F., van Rossum, P., Verdult, R., Schreur, R.: Wirelessly Pickpocketing a Mifare Classic Card. In: Symposium on Security and Privacy, pp. 3–15. IEEE, Los Alamitos (2009)
IAIK Graz. HF Demo Tag, http://www.iaik.tugraz.at/content/research/rfid/tag_emulators
ISO/IEC 14443-A. Identification Cards - Contactless Integrated Circuit(s) Cards - Proximity Cards - Part 1-4 (2001), http://www.iso.ch
Kasper, T., Carluccio, D., Paar, C.: An Embedded System for Practical Security Analysis of Contactless Smartcards. In: Sauveron, D., Markantonakis, K., Bilas, A., Quisquater, J.-J. (eds.) WISTP 2007. LNCS, vol. 4462, pp. 150–160. Springer, Heidelberg (2007)
Kasper, T., Oswald, D., Paar, C.: EM Side-Channel Attacks on Commercial Contactless Smartcards Using Low-Cost Equipment. In: Youm, H.Y., Yung, M. (eds.) WISA 2009. LNCS, vol. 5932, pp. 79–93. Springer, Heidelberg (2009)
Kasper, T., Silbermann, M., Paar, C.: All You Can Eat or Breaking a Real-World Contactless Payment System. In: Sion, R. (ed.) FC 2010. LNCS, vol. 6052, pp. 343–350. Springer, Heidelberg (2010)
Nohl, K., Evans, D.: Reverse-engineering a Cryptographic RFID Tag. In: USENIX Security Symposium, pp. 185–193 (2008)
NXP. About MIFARE (2001), http://mifare.net/about/
NXP. Mifare Classic 1K MF1 IC S50 Functional Specification (2008), http://www.nxp.com
OpenPICC. Programmable RFID-tag, http://www.openpcd.org/openpicc.0.html
Proxmark III. A Radio Frequency IDentification Tool, http://www.proxmark.org/
Silbermann, M.: Security Analysis of Contactless Payment Systems in Practice. Diplomarbeit, Ruhr-University Bochum (November 2009)
Touchatag. Touchatag RFID Reader, http://www.touchatag.com/
Verdult, R.: Proof of Concept, Cloning the OV-Chip Card, http://www.sos.cs.ru.nl/applications/rfid/2008-concept.pdf
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2011 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Kasper, T., von Maurich, I., Oswald, D., Paar, C. (2011). Chameleon: A Versatile Emulator for Contactless Smartcards. In: Rhee, KH., Nyang, D. (eds) Information Security and Cryptology - ICISC 2010. ICISC 2010. Lecture Notes in Computer Science, vol 6829. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-642-24209-0_13
Download citation
DOI: https://doi.org/10.1007/978-3-642-24209-0_13
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-642-24208-3
Online ISBN: 978-3-642-24209-0
eBook Packages: Computer ScienceComputer Science (R0)