abusing rfid for fun & profit. · 2017-10-15 · it may only be used for payment at the budai...
TRANSCRIPT
![Page 1: Abusing RFID for fun & profit. · 2017-10-15 · It may only be used for payment at the Budai Gourmet, the Volt Festival, the Heineken Balaton Sound and Sziget events durin the event](https://reader036.vdocument.in/reader036/viewer/2022081613/5fb5788909ed3e456d616b2d/html5/thumbnails/1.jpg)
Abusing RFID for fun & profit.
Youri ”iTdeal” van der ZwartJurre ”DrWhax” van Bergen
![Page 2: Abusing RFID for fun & profit. · 2017-10-15 · It may only be used for payment at the Budai Gourmet, the Volt Festival, the Heineken Balaton Sound and Sziget events durin the event](https://reader036.vdocument.in/reader036/viewer/2022081613/5fb5788909ed3e456d616b2d/html5/thumbnails/2.jpg)
Introduction
$whoarewe
![Page 3: Abusing RFID for fun & profit. · 2017-10-15 · It may only be used for payment at the Budai Gourmet, the Volt Festival, the Heineken Balaton Sound and Sziget events durin the event](https://reader036.vdocument.in/reader036/viewer/2022081613/5fb5788909ed3e456d616b2d/html5/thumbnails/3.jpg)
Outline
What is RFID? Failed implementations.
Ov-Chipcard Metapay University cards
MijnID
![Page 4: Abusing RFID for fun & profit. · 2017-10-15 · It may only be used for payment at the Budai Gourmet, the Volt Festival, the Heineken Balaton Sound and Sziget events durin the event](https://reader036.vdocument.in/reader036/viewer/2022081613/5fb5788909ed3e456d616b2d/html5/thumbnails/4.jpg)
What is RFID
Radio-Frequency-Identification Works on various frequencies Broad usages Used around the world
![Page 5: Abusing RFID for fun & profit. · 2017-10-15 · It may only be used for payment at the Budai Gourmet, the Volt Festival, the Heineken Balaton Sound and Sziget events durin the event](https://reader036.vdocument.in/reader036/viewer/2022081613/5fb5788909ed3e456d616b2d/html5/thumbnails/5.jpg)
Usages
Hotels (13,56mhz, NL) Public transport (13,56mhz, NL) Passport (900mhz .NL) Credit cards (900mhz?)
![Page 6: Abusing RFID for fun & profit. · 2017-10-15 · It may only be used for payment at the Budai Gourmet, the Volt Festival, the Heineken Balaton Sound and Sziget events durin the event](https://reader036.vdocument.in/reader036/viewer/2022081613/5fb5788909ed3e456d616b2d/html5/thumbnails/6.jpg)
Failed implementations
![Page 7: Abusing RFID for fun & profit. · 2017-10-15 · It may only be used for payment at the Budai Gourmet, the Volt Festival, the Heineken Balaton Sound and Sziget events durin the event](https://reader036.vdocument.in/reader036/viewer/2022081613/5fb5788909ed3e456d616b2d/html5/thumbnails/7.jpg)
Ov-chipkaart
Mifare cards Mifare Classic proven to be insecure '08 Backoffice system mapped.
![Page 8: Abusing RFID for fun & profit. · 2017-10-15 · It may only be used for payment at the Budai Gourmet, the Volt Festival, the Heineken Balaton Sound and Sziget events durin the event](https://reader036.vdocument.in/reader036/viewer/2022081613/5fb5788909ed3e456d616b2d/html5/thumbnails/8.jpg)
Hardware
![Page 9: Abusing RFID for fun & profit. · 2017-10-15 · It may only be used for payment at the Budai Gourmet, the Volt Festival, the Heineken Balaton Sound and Sziget events durin the event](https://reader036.vdocument.in/reader036/viewer/2022081613/5fb5788909ed3e456d616b2d/html5/thumbnails/9.jpg)
Ov-chipkaart metro system
No encryption at all \o/ One write only. Being used for one way/round trip. Hardware created to bruteforce UID's.
![Page 10: Abusing RFID for fun & profit. · 2017-10-15 · It may only be used for payment at the Budai Gourmet, the Volt Festival, the Heineken Balaton Sound and Sziget events durin the event](https://reader036.vdocument.in/reader036/viewer/2022081613/5fb5788909ed3e456d616b2d/html5/thumbnails/10.jpg)
Magnetic swipe side
![Page 11: Abusing RFID for fun & profit. · 2017-10-15 · It may only be used for payment at the Budai Gourmet, the Volt Festival, the Heineken Balaton Sound and Sziget events durin the event](https://reader036.vdocument.in/reader036/viewer/2022081613/5fb5788909ed3e456d616b2d/html5/thumbnails/11.jpg)
Adam University card
![Page 12: Abusing RFID for fun & profit. · 2017-10-15 · It may only be used for payment at the Budai Gourmet, the Volt Festival, the Heineken Balaton Sound and Sziget events durin the event](https://reader036.vdocument.in/reader036/viewer/2022081613/5fb5788909ed3e456d616b2d/html5/thumbnails/12.jpg)
Metapay
![Page 13: Abusing RFID for fun & profit. · 2017-10-15 · It may only be used for payment at the Budai Gourmet, the Volt Festival, the Heineken Balaton Sound and Sziget events durin the event](https://reader036.vdocument.in/reader036/viewer/2022081613/5fb5788909ed3e456d616b2d/html5/thumbnails/13.jpg)
0day time!
AH mijnid Mifare ultralight UID coupled to your back account Self service Bruteforcing for free 0xf00d.
![Page 14: Abusing RFID for fun & profit. · 2017-10-15 · It may only be used for payment at the Budai Gourmet, the Volt Festival, the Heineken Balaton Sound and Sziget events durin the event](https://reader036.vdocument.in/reader036/viewer/2022081613/5fb5788909ed3e456d616b2d/html5/thumbnails/14.jpg)
DIY
Come tonight to the hackerspaces village!
RFIDIOT, mfoc, touchatag
![Page 15: Abusing RFID for fun & profit. · 2017-10-15 · It may only be used for payment at the Budai Gourmet, the Volt Festival, the Heineken Balaton Sound and Sziget events durin the event](https://reader036.vdocument.in/reader036/viewer/2022081613/5fb5788909ed3e456d616b2d/html5/thumbnails/15.jpg)
Thanks for listening!
DrWhax
iTdeal