Christopher Wade - Tag Side Attacks Against NFC
Demonstrates NFC tag-side attacks that manipulate reader-side applications via malformed tag responses and relay injection.
Summary
NFC Tag-Side Security
Christopher Wade presents research on the underexplored attack surface of NFC from the tag's perspective — malicious or manipulated tags that attack the reader-side software stack.
Malformed Tag Responses
NFC reader software (on smartphones, POS terminals, access control readers) must parse complex tag response PDUs. Wade demonstrates buffer overflows, integer overflows, and use-after-free vulnerabilities in reader software triggered by carefully crafted malformed NDEF records.
Relay Attacks via Proxy Tags
Using a custom NFC relay tool, Wade shows how a malicious tag can transparently proxy reader queries to a remote legitimate tag, enabling long-range NFC relay attacks against transport payment cards and building access badges.
Android and iOS Parsing Vulnerabilities
The talk includes specific CVEs in Android's NFC stack and iOS's Core NFC framework triggered by specially crafted NFC tag data, demonstrating impact on mainstream mobile devices.
Related talks
Main Stage·38 min
Trevor Stevado · Sam Haskins
Demonstrates long-distance relay attacks against ISO 14443A and HID SEOS contactless credentials, unlocking a physical door in Ottawa from a stage in Las Vegas.
Main Stage·32 min
Christopher Wade
Christopher Wade examines this talk covers tag-side attacks against NFC communication protocols, including cracking of Mifare encryption keys and performing targeted attacks against NFC readers.
Main Stage·20 min
Bughardy · Eagle1753
Bughardy and Eagle1753 reveal how to exploit the lockbyte sector on unencrypted MIFARE Ultralight RFID transit cards to bypass one-time programmable (OTP) decrement counters.