0
\$\begingroup\$

I have an RFID keyfob which is used to access my building. The access is not otherwise authenticated (everybody just touches the door with the keyfob and enters) so I was wondering whether I could use generic RFID cards to enter.

The assumption is that each keyfob has one common code which is presented to the reader. (that code would be written to the keyfob when adding it).

There can be other solutions (the ID of the keyfob is added to the building system upon the addition of a keyfob) in which case my approach will not work but it is worth a try taken into account the prehistoric computerization of the set of buildings.

Based on Miguel Balboa's RFID library and a RFID-RC522 reader I wanted to read the data on the card.

All the generic cards I tried dump information such as

Card UID: 94 5D 85 1E
Card SAK: 08
PICC type: MIFARE 1KB
Sector Block   0  1  2  3   4  5  6  7   8  9 10 11  12 13 14 15  AccessBits
  15     63   00 00 00 00  00 00 FF 07  80 69 FF FF  FF FF FF FF  [ 0 0 1 ] 
         62   00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  [ 0 0 0 ] 
         61   00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  [ 0 0 0 ] 
         60   00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  [ 0 0 0 ] 
  14     59  PCD_Authenticate() failed: Error in communication.
  13     55  PCD_Authenticate() failed: Timeout in communication.
  12     51  PCD_Authenticate() failed: Timeout in communication.
  11     47  PCD_Authenticate() failed: Timeout in communication.
  10     43  PCD_Authenticate() failed: Timeout in communication.

I do not know how to make sense of the data yet but at least it is there.

When trying my building entrance keyfob, I get

Card UID: 25 C7 EB 48
Card SAK: 88
PICC type: MIFARE 1KB
Sector Block   0  1  2  3   4  5  6  7   8  9 10 11  12 13 14 15  AccessBits
  15     63  PCD_Authenticate() failed: Timeout in communication.
  14     59  PCD_Authenticate() failed: Timeout in communication.
  13     55  PCD_Authenticate() failed: Timeout in communication.
  12     51  PCD_Authenticate() failed: Timeout in communication.

So the card is read, its UID and other information are recognized but there us no further data read. This is the same case with another keyfob.

One thing is clear: both the building keyfobs and my generic ones are Mifare ones.

My question: does this failure to read the keyfob contents (beside the metadata ones) mean that noting is encoded? Or that for some reasons the way this Mifare card needs to be accessed is different?

If this the former, I am done - the access is based on the ID of the card and there is nothing I can do (as the ID of the card cannot be changed (?)). (there are cards with changeable UIDs, I happen to have found and tried one but the access was refused - see edit and Lior Bilia's answer)

EDIT: Lior Bilia's answer gave a third possibility: the fact that the access to the data is behind a challenge and therefore not available (and then used to authenticate the card).

\$\endgroup\$
0
\$\begingroup\$

From the data you posted, it seems there is an authentication protocol, so not any MiFare tag can open the door. Those tags contain a small MCU, that has to authenticate with the reader's MCU. Somewhere in the system there is a white list of all the allowed tags.

\$\endgroup\$
0
\$\begingroup\$

Depending on the exact implementation used for your companies readers, it could be using either the lazy approach where it only reads the UID, or may have stored records on the card to authenticate the card,

I would suggest test the lazy approach first, as some Chinese mifare cards do have re-programmable UID's,

As for the unreadable sectors on your company card, you likely just have to work out the sector access keys to read from it, there are many common ones published online, and its rare that they would not be in this normal range, my own card readers in the past would just try from a list of about 15 I had collected, and had no issue on about 5 different companies with different tag suppliers during that time period

\$\endgroup\$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.