flipper zero: an introduction long overdue
For a while I have been trying to get myself into not only using, but understanding wireless communication protocols - save for WiFi, which I am quite fond of - a bit better. So when the opportunity arose, I've dusted off my Flipper Zero, which I bought years ago, and committed to having a fun and mildly informative afternoon.
RFID: a slightly technical overview
RFID (Radio Frequency Identification) devices are contactless identification or communication devices. They usually contain two essential components:
- microchip, which stores data.
- antenna, which enables wireless communication. There are three primary types of RFID devices: Low Frequency (LF), High Frequency (HF), and Ultra-High Frequency (UHF).
| name | abbreviation | typical frequency |
|---|---|---|
| Low Frequency | LF | 125 kHz to 134 kHz |
| High Frequency | HF | 13.56 MHz |
| Ultra-High Frequency | UHF | 860 MHz to 960 MHz |
The devices are either passive or active. Semi-active (or semi-passive) ones are not so frequent and I will not be covering them here.
RFID: a slightly more technical overview
Data format
The data format of an RFID tag is either Hex or ASCII, and while Hex is a widely-adopted industry standard, ASCII is easily human-readable. Nonetheless, the tags usually consist of the following memory banks:
- EPC, Electronic Product Code, which is a unique identifier for the item.
- TID, Tag Identifier assigned by the manufacturer, which is also unique.
- User Memory, the flexible space that allows for the storage of additional user-defined data.
- Reserved, an area where strong authorization and security information are stored, so it's the section that retains passwords for secure read/write access to other memory banks.
Exhibit A: EM4100
Introduction
According to some sources, the EM4100 is one of the most widely deployed low-frequency RFID chips in the world. According to my experience, this statement is probably true - this small, blue chip is nearly ubiquitous. Their Unique Identification Number is permanently programmed during manufacturing and cannot be modified, but that will not stop us in the slightest.
| Parameter | Specification |
|---|---|
| Frequency | 125 kHz (LF) |
| Memory Type | Mask ROM (Read-Only) |
| Data Length | 64 bits (UID + parity) |
| Power Source | Passive (inductive coupling) |
| Communication | ASK modulation |
| Anti-collision | Not supported |
| Security | None (plain UID) |
| Typical Read Range | 5–10 cm |
| Standards | EM4100 / EM4102 protocol |
Using an RFID reader embedded in Flipper Zero (FZ), we can read the EM4100. I will use the one I am in possession of, and which I've obtained legally. In FZ, we will find the STM32WB55 microcontroller with a dual-band RFID antenna.
The reading
Reading the EM4100 with Flipper Zero is trivial. You select the preinstalled app, touch the device's back with the blue chip and that's it - you got it. Flipper extracts the RFID key automatically and stores it in Hex along with some metadata for later reading. The key turns out to be 23 00 3D 2F AD. You can try to clone it and open... well, whatever it opens; I won't make it that easy for you! One cool trick you can do with Flipper Zero is to add a custom tag manually. Either way, you can emulate the key in question or write it to a blank device (i.e. a T5577 card).
NFC: hey, I've seen it before
Near-field communication (NFC) is a short-range wireless technology closely related to RFID. Its operation is based on standards such as ISO/IEC 14443 and FeliCa, and its specifications are maintained by the NFC Forum. NFC operates at 13.56 MHz, which places it in the high-frequency RFID band, and it supports communication in both tag/reader and peer-to-peer-style modes.
Data format
For NFC, data formats can vary significantly between manufacturers, even though the communication protocol itself is standardized. Let's take a look at a sample MIFARE Classic 1K card.
Exhibit B: MIFARE Classic 1K
Introduction
MIFARE Classic is, once again, a widely used solution. It comes in several variants - 1K, 2K, and 4K - which refer to the card’s memory capacity in kilobytes (where 1 KB equals 1024 bytes). According to the manufacturer’s documentation, the memory is organized into 16 sectors of 4 blocks each, and each block contains 16 bytes, though this is not a universal industry standard.
The reading^2
As before, we will read the card with Flipper Zero. The procedure is roughly the same. After dumping the card, we can find there:
- a common UID.
- an ATQA (Answer To reQuest code A).
- a SAK (Select Acknowledge), value identifying card's type and its capabilities.
The first block in a sector contains UID and manufacturing data. In the fourth block of the sector we find Key A, Key B and access control bits. In our example, it turns out that both keys are set to a default value (FF FF). Using an online calculator based on the documentation, we can read the configuration - and it turns out to be the default one, so emulating the card is trivial.
Summary
It surely was a fun afternoon exercise. I didn't delve too deep into the whole subject of RFID hacking, but to be fair, I always feel that no insight is deep enough, save for those dealing with 1s and 0s. And now I can have some fun with my Flipper Zero without thinking about it as some sort of a black-box magical device. It's always better to know just a bit about the stuff you try to break, right?
The next thing I'll like to look into is GPIO hacking. That might be fun.