Syscan Act like a spy. High/Low frequency attack & defense tools. Haoqi

Size: px

Start display at page:

Download "Syscan Act like a spy. High/Low frequency attack & defense tools. Haoqi"

Anabel Shavonne Oliver
6 years ago
Views:

1 Syscan Act like a spy High/Low frequency attack & defense tools Haoqi Shan@360UnicornTeam 1

2 Agenda About us Quick Review of Attacks HackID Pro EMV Issues Card defender Tools Used Key takeaways from this talk 2

3 About us 360 UnicornTeam GPS/Wireless Hacking Embedded device hacking IoT System hacking Hardware development Wireless security of Qihoo 360 3

4 Quick Review Low frequency(125khz 134KHz) Key Card High frequency(13.56mhz) Smart Card Mifare Classic 1K/4K Side channel analysis 4

5 Review of ID card attack Sniff Clone Brute Force 5

6 Old school What I used to do Big laptop Card Reader And a bag 6

7 New fashion Now what you can do HackID Pro App+Hardware+Nexus 7

8 Transformation of HackID Pro Badge -> HackID -> HackID Pro 8

9 Details of HackID Pro Mode Controlledby App Work alone 9

10 Details of HackID Pro CPU: 32bit ARM 16Kb flash 4KB SRAM Interface MicroUSB Audio connector(ctia) Power Lithium Battery 10

11 Applicable scene Read & Simulate EM4305 EM4100 TK4100 EM4001 T55X7 Record & Replay All 125KHz card Manchester Code Biphase code PSK Code 11

12 Audio connector Idea Hijack from Universityof Michigan Use power and bandwidth of your phone Communication between phone and hardware 12

13 Audio connector Left channel Transfer data from phone to HackID Pro MIC channel Transfer data from HackID Pro to phone 13

14 MCU & StorageCircuit ARM Cortex Brain of HackID Pro Processall software protocol Control hardware interface Storage Circuit 521KB EEPROM AT24C512B 14

15 Power supplycircuit MicroUSB 5V Lithium battery 3.7V Chip LTC V & 5V Buck -> 3.3V Boost -> 5V 15

16 Simulate & Reader Circuit NPN Transistor f = 1 2π LC f = 125KHz EM4095 Demodulation 5V 16

17 Summary of Hardware Design Not complicated intheory Notices Digital & simulation separate in layout Adjustment on antenna Electromagnetic isolation Accuracy of C All hardware designersknow 17

18 Software design of HackID Pro Cortex-M Low power consumption Sub-routines Button control copy card Simulate copied ID card Controlledby Phone APP 18

19 Sub routines Read Card Simulate Card Clone Card Communicate with phone 19

20 Read Card Main ID card protocol internal Hitag TI256/2048 T5577/E5551 EM41xx TK4100(commonly used in China) 20

21 Example(TK4100) 64 bits data 9 start bits(all be 1) 40 data bits 14 check bits 1 stop bit 21

22 Example(TK4100) When card closed by HackID Pro Transponder: ID Card Transceiver: HackID Pro After demodulation Toc about 8us 22

23 Example(TK4100) Manchester Code Rising edge - 1 Falling edge - 0 Decode by Manchester format Data parity check P0-P9 Line PC0- PC3 Row 23

24 Parity Check Algorithm buffer number 24

25 Simulate Card Opposite principle from reading Transfer ID into data Output in Manchester format Brute force Increase ID Output again 25

26 Clone Card Multiple format Biphase Code PSK Code Etc It s ID card! Keep it simple Just record it Store it in our ROM 26

27 Communication App -> HackID Pro Manchester Line Comparators Decode bit flow Data in pic(ch-2) 3 idle-bits(1) 1 start-bit(0) 8 data-bits 1 parity-bit 1 stop-bit 3 idle-bits(1) 0x72 27

28 Communication HackID Pro -> App Similar to previous one Bit flow RC filter Remove DC bias APP check MIC 28 Edge detection

29 HackID Demo(standalone) 29

30 30 HackID Demo(app)

31 The future of HackID Pro Not onlylowfrequency Chameleon-mini? Laptop/tablet again? Or just on your phone 31

32 EMV issues High frequency Chip and pin Apple Pay Chineseversion EMV PBOC 32

33 Quick review of EMV attack Clone Replay Pre-play In China? Much easier Read all your information And use your card online 33

34 How to read Tools Nexus ACR122U Omnikey5321 Homemade reader Routine Send command Parse response TLV format 34

35 Why remake a reader The power of phone Carder reader with laptop I don t want to hold my big laptop anymore 35

36 Hardware Details Reader NFC Reader chip CLRC663 Zigbee chip CC

37 Hardware Details Receiver Zigbee chip CC2530 Transfer data to laptop through serial port 37

38 Principle Quite simple CC2530controlthis device Connect to CLRC663 by SPI Send read command Parse the response Transfer response to your laptop 38

39 What you can get? My credit card Card number Cardholder s name Valid date Cardholder s IDnumber Buy whatyou want CVV2? Don t need in some Chinese online store! Which store? 39

40 40 Use it!

41 Defense Tool RFID Wallet Armourcard What s the shortcoming? 41

42 Our solution Card Defender Jammer Chargeable 125KHz/13.56Mhz 42

43 Simple principle Detect if there is a reader Jam it! 43

44 Major problem Battery How sensitive Chargeable Thickness Low power consumption 44

45 Solution Thin battery Level up trigger voltage Soft PCB 45

46 Card Defender Demo 46

47 The future of Card Defender Targeted jamming Bus card Long time standby Little trick 47

48 Wanna home-made? Quite simple Large battery I don t care if it s ugly L Our Gift! Source code explains everything 48

49 Takeaways All Source Code All PCB Instruction paperwill be uploaded ASAP 49

50 Thanks Our hardware designers HackID Pro Hack Reader CardDefender Card Defender Any questions? 50

Prepaid Energy System

Prepaid Energy System Group 21 Youssef Ojeil (EE) Michael Cuervo (EE) MD.S. Rahaman (EE) Sahin Okur (EE) Sponsored by: Supervised by Dr. Chung-Yong Chan Goals and Objectives Alternative pre-paid solution