In this lesson,
we're going to explore attacks
against devices using RFID and NFC.
First let's look at RFID.
Now, RFID or radio frequency identification
is a form of radio frequency transmission
that has commonly been modified for use
in authentication and tracking systems.
In an RFID-based system,
two components known as the tags
and the readers are going to be used.
This is heavily used in inventory tracking systems
where an RFID tag can be placed on an object,
like a shipping container or pallet,
and then we have readers that can be used
to identify the container or pallet
as it's placed into the warehouse,
loaded onto a truck,
or moved along its designated logistical route.
Another common place to find RFID technology
is inside of enterprises
where they use it for their employee badges.
An RFID tag can be embedded
into an employee's identification badge
and used as a possession factor
inside of that authentication.
Because it uses radio frequency,
there is a danger that that signal
could be captured by an attacker
or penetration tester and then retransmitted.
For this reason,
when using RFID as an authentication system,
we usually should use a second authentication factor,
like a PIN or a password.
Now, if you want to clone an RFID tag
as a penetration tester,
you're going to need to have a specialized hardware device
that can read the existing tag
and then write its data to a new tag.
Since these badges are considered contactless,
you only really need to be within the range of that badge
in order to read its authentication information.
For example,
if an employee has their badge
on a lanyard around their neck,
you could then accidentally bump into them,
and that reader inside your backpack
could pick up the RFID's tag,
and that way you could gather that detail
and store it for later.
Most RFID readers can actually read the badge
from up to a few feet away.
Now, this was actually a very common technique
for older RFID badges
that relied on the system called EM4100,
which uses 125 kilohertz technologies,
because those badges did not support encryption,
and they would transmit any time there was a reader nearby.
Unfortunately for us as penetration testers though,
the newer RFID badges that are used today
in modern authentication systems
actually use higher frequencies
that provide higher data rates,
and those do support encryption.
Many of these systems
also don't send the entire authentication data
from the badge during the transmission,
and instead they only transmit
some key identifying attributes to identify the user.
All of these security features combined do make it harder
to effectively conduct badge cloning
on newer RFID-based badges,
but there's still lots of old badges out there
and in use in most organizations.
To conduct RFID cloning,
you need to either build your own reader/writer,
or you can purchase a prebuilt one
that was specially made for this purpose.
Remember, regular business people also need a way
to read these tags and write new tags,
so there's lots of tools that are widely available.
For example, if you go onto Amazon,
you're going to find many of these RFID readers and writers
for under $100 that come with two-day delivery,
and most of these even come with some RFID key fobs
and cards that you can use as well.
So if you're interested in playing around
with RFID hacking and clothing,
you can easily get the supplies you need
and practice with those.
Now, for NFC-based badges,
these work much the same way as an RFID-based badge,
but they do use different frequencies
and they have a much shorter range.
Now, the nice thing about NFC
is that most of our phones these days
have NFC readers built into them
because they come standard with most Android and iPhones.
This makes it easier for us
to read and clone these NFC badges,
because we can use tools
like the Android-based MIFARE Classic Tool
that can be used to read and write tags,
as well as edit and add key files
directly to your Android device
and then use that as your key.
Another common NFC attack is known
as an amplification attack.
Now, one of the big problems with NFC
is that it has a very short distance.
Remember, near-field communication is a set of standards
for mobile devices that was designed
to establish radio communication with each other
by being touched together
or brought within a short distance.
This standard regulates a radio technology
that allows these two devices to communicate
when they're in that close proximity,
and normally we define that as a few centimeters,
and this allows the secure exchange of information.
Now, to try and overcome this short-range limitation though,
we can then try to create a NFC amplified antenna
to extend the range of those NFC devices,
so we can read those signals from longer distances.
Still though,
the distance is going to be fairly limited
even with amplification.
Due to the frequencies and antennas used in those NFC tags,
you shouldn't expect to pick up an NFC signal
if you're more than about eight to 10 inches away
or about 20 to 30 centimeters away,
even with a strong amplification antenna being used.