Exploiting Keyspace Reduction And Relay Attacks In 3Des And Aes Protected NFC Tags
Presenters detail vulnerability discovery and exploitation in Exploiting Keyspace Reduction And Relay Attacks In 3Des And Aes Protected NFC Tags.
Summary
Overview: Nathan Nye (True Anomaly) and Philip Toan (Ledger) present at Hardwear.io on exploiting keyspace reduction and relay attacks against 3DES and AES-protected NFC tags.
Key Topics: NFC authentication weaknesses in access control; relay attacks over sub-gigahertz links; keyspace reduction techniques; prior MIFARE Classic vulnerability research; and live card unlocking demonstration.
Technical Details: Researchers demonstrate authenticating with a locked NFC card via relay, then updating configuration to unlock memory pages from 10 of 48 to 44 of 48 accessible. The attack chains relay communication with an unlock-mode configuration write.
Takeaways: AES and 3DES-protected NFC implementations remain vulnerable to relay attacks. Physical access control deployments should not assume cryptographic protection alone prevents cloning.
Related talks
hardwear.io·46 min
Security researchers examine technical aspects of Bluetooth LE Link Layer Relay Attacks by Sultan Qasim Khan | hardwear.io NL 2022.
DragonJAR - Hacking y Seguridad Informática·31 min
Demonstrates pagos NFC: Creando Sniffers, Relays y Detección de Tarjetas and evaluates key implications for security practitioners.
Hack In The Box Security Conference·32 min
Salvador Mendoza
Salvador Mendoza explores #HITBGSEC 2018 D2: NFC Payments: The Art Of Relay And Replay Attacks.