Man in the NFC

### Near Field Communication Architecture and Practical Use Cases At 00:00, Haoqi Shan and Jian Yuan open by surveying the widespread global adoption of Near Field Communication (NFC) technology. Operating at 13.56 MHz, NFC powers essential daily interactions, including contactless credit card payments (EMV), smartphone payment systems (Apple Pay, Android Pay), electronic transit ticketing, and physical building access control badges. Because NFC is designed for ultra-short communication ranges (typically under 4 centimeters), developers often mistakenly presume that physical proximity guarantees security.

### Classification of Contactless Card Protocols At 06:12 and 11:30, the speakers review the international standards governing contactless cards, focusing on ISO/IEC 14443 Type A, Type B, and Sony FeliCa. They explain that while underlying radio frequencies remain standardized across all categories, different application standards implement drastically divergent security architectures—ranging from unauthenticated plaintext memory reads in legacy transit cards to cryptographically secured dynamic tokenization in modern EMV banking applets.

### Constructing the "Man in the NFC" Hardware Proxy At 16:50, the authors reveal their custom hardware interception platform: the "Man in the NFC" proxy. Built using affordable microcontrollers, FPGA signal slicers, and active RF transceivers, the device operates as an active relay emulator. One module emulates a contactless smart card to trick legitimate POS payment terminals, while the companion module emulates an NFC reader to interrogate genuine victim cards, bridging transactions over extended physical distances via high-speed wireless or Bluetooth links.

### Exploiting Transit Protocols and Offline Transaction Limits At 24:10 and 28:45, Shan and Yuan showcase practical attack scenarios against transit systems and offline payment profiles. They demonstrate modifying data packets on the fly between reader and card, altering transaction value registers or spoofing terminal capabilities. Because many automated turnstiles and vending machines utilize offline transaction caching to maintain rapid commuter throughput, forged cryptograms and modified responses succeed without triggering instant bank rejection.

### Countermeasures and Hardware Verification Concluding around 33:35, the presenters outline defensive engineering recommendations for NFC hardware designers and software developers. They advocate enforcing strict transaction response timeout windows (distance bounding protocols) to prevent wireless relaying, utilizing mutual cryptographic authentication for all memory block queries, and securing point-of-sale firmware against malformed APDU buffer overflow attacks.

(AI summary — Gemini 3.8 Flash)