MIFARE Classic Key Recovery Improvements #3822

noproto · 2024-08-04T02:00:20Z

What's new

MIFARE Classic Accelerated dictionary attack: dictionary attacks reduced to several seconds - checks ~3500 keys per second
MIFARE Classic Nested attack support: collects nested nonces to be cracked by MFKey, no longer requiring users to downgrade to FW 0.93.0
MIFARE Classic Static encrypted backdoor support: collects static encrypted nonces to be cracked by MFKey using NXP/Fudan backdoor, allowing key recovery of all non-hardened MIFARE Classic tags on-device

Verification

This PR currently contains the minimum necessary code to achieve the intended functionality. It will be superseded with performance improvements and UI improvements.

Accelerated dictionary attack: Benchmark against standard dictionary attack
- Note: This PR adds nonce collection methods which trade some of the time reclaimed by this improvement
Nested (weak PRNG): Using any weak PRNG tag and MFKey [WIP]
Hardnested (hard PRNG): Verify nonces are stored at /ext/nfc/.nested.log
Static encrypted (backdoor): Using static encrypted tag and MFKey [WIP]

Checklist (For Reviewer)

PR has description of feature/bug or link to Confluence/Jira task
Description contains actions to verify feature/bugfix
I've built this code, uploaded it to the device and verified feature/bugfix

noproto · 2024-08-10T00:40:39Z

This PR also resolves bit_buffer_copy_bytes_with_parity improperly storing parity bits: 8dd3daf#diff-1d0dbb15ed26364f785d68ba753267b5326c95629d29641ef53276ac32336f7e

noproto · 2024-08-21T14:38:34Z

The accelerated dictionary attack is mostly working. I'm tracking down a minor bug in it and making sure the UI reflects the state of the attack.

The fork takes an average of 10 seconds to run dictionary attacks in my tests (1 second of the average is backdoor detection - separate from the dictionary attack). OFW 0.105.0 takes an average of 3 minutes 10 seconds. On real tags the number of unknown keys and the offset in the dictionary are all different, here are five benchmarks on random MIFARE Classic tags:

OFW 0.105.0: 4 min 44 seconds (found 19/32 keys, 16 sectors read)
nestednonces 26845cb: 10 seconds (found 19/32 keys, 16 sectors read)
---
OFW 0.105.0: 5 min 8 seconds (found 18/32 keys, 2 sectors read) 
nestednonces 26845cb: 25 seconds (found 18/32 keys, 2 sectors read)
---
OFW 0.105.0: 22 seconds (found 32/32 keys, 16 sectors read) 
nestednonces 26845cb: 3 seconds (found 32/32 keys, 16 sectors read)
---
OFW 0.105.0: 35 seconds (found 32/32 keys, 16 sectors read) 
nestednonces 26845cb: 10 seconds (found 32/32 keys, 16 sectors read)
---
OFW 0.105.0: 5 min 3 seconds (found 18/32 keys, 16 sectors read) 
nestednonces 26845cb: 10 seconds (found 18/32 keys, 16 sectors read)

noproto · 2024-09-04T01:26:18Z

I’d consider this PR to be beta quality now. A review would be helpful in guiding the next steps and prioritizing fixes.

Some FAQ:

How do I crack the nonces?: I am working on MFKey 3.0 and a fork of FlipperNestedRecovery. These will be the primary methods of key recovery when I am finished.

It gets stuck on collecting nonces.: This is a calibration issue and will be fixed. The process isn't actually stuck — it's taking longer than expected due to difficulties finding a candidate range.

It crashes after a few reads.: There may be a memory leak. Any help in identifying this issue would be appreciated. Solved: 13411da

There's no progress bar.: This is a UI issue and will be fixed. In the meantime, you can track progress using the header, which shows the current phase and how many keys have been recovered. Solved: c1cdd49 You can also interrupt nonce collection, if you want to only run the accelerated dictionary attack/backdoor read. I'd like to add a preference to toggle nonce collection on/off (default: on).

Hardnested is slow.: I'll be optimizing this over the next few days. The slowdown is related to how Hardnested nonces are collected, but I've identified several ways to possibly improve it. I will run some tests to find the fastest/most reliable approach. Solved: 18f8cfb

skotopes · 2024-09-07T12:48:36Z

targets/f7/api_symbols.csv

@@ -2040,6 +2041,7 @@ Function,-,initstate,char*,"unsigned, char*, size_t"
 Function,+,input_get_key_name,const char*,InputKey
 Function,+,input_get_type_name,const char*,InputType
 Function,-,iprintf,int,"const char*, ..."
+Function,+,is_weak_prng_nonce,_Bool,uint32_t


We need to prefix all symbols in crypto1 package if symbols are exported to api symbol table

skotopes · 2024-09-07T12:50:36Z

applications/main/nfc/scenes/nfc_scene_mf_classic_dict_attack.c

@@ -5,6 +5,8 @@

 #define TAG "NfcMfClassicDictAttack"

+// TODO: Update progress bar with nested attacks


TODOs will fail CI/CD lint stage, normally we don't leave them without appropriate issue in task tracker.

skotopes · 2024-09-07T12:52:06Z

lib/nfc/protocols/mf_classic/mf_classic_poller.c

+                command = instance->callback(instance->general_event, instance->context);
+                // Nested entrypoint
+                // TODO: Ensure nested attack isn't run if tag is fully read
+                if(dict_attack_ctx->nested_phase == MfClassicNestedPhaseNone ||


skotopes · 2024-09-07T12:55:52Z

lib/nfc/protocols/mf_classic/mf_classic_poller_i.h

@@ -3,13 +3,39 @@
 #include "mf_classic_poller.h"
 #include <lib/nfc/protocols/iso14443_3a/iso14443_3a_poller_i.h>
 #include <bit_lib/bit_lib.h>
+#include "nfc/helpers/iso14443_crc.h"


<> - for global includes(outside of this file folder)
"" - for local includes(in this file folder)

skotopes · 2024-09-07T12:57:47Z

lib/toolbox/bit_buffer.c

@@ -113,7 +113,7 @@ void bit_buffer_copy_bytes_with_parity(BitBuffer* buf, const uint8_t* data, size
            uint8_t bit =
                FURI_BIT(data[bits_processed / BITS_IN_BYTE + 1], bits_processed % BITS_IN_BYTE);

-            if(bits_processed % BITS_IN_BYTE) {
+            if((bits_processed % BITS_IN_BYTE) == 0) {


unit tests maybe?

skotopes · 2024-09-07T12:59:59Z

@noproto that is some very cool thing that you've made )

skotopes · 2024-09-07T13:01:36Z

We'll include this one in next release after @gornekich review and QA testing.
Also we may need to free some RAM to make it more stable, I'll think about it.

…s read

gornekich

Hi @noproto
Thank you for working on that! I started reviewing the code, I will come back with the review soon

gornekich · 2024-09-11T14:41:32Z

lib/nfc/protocols/mf_classic/mf_classic_poller.c

+    size_t current_key_index =
+        mf_classic_backdoor_keys_count - 1; // Default to the last valid index
+
+    // Find the current key in the backdoor_keys array
+    for(size_t i = 0; i < mf_classic_backdoor_keys_count; i++) {
+        if(memcmp(
+               dict_attack_ctx->current_key.data,
+               mf_classic_backdoor_keys[i].key.data,
+               sizeof(MfClassicKey)) == 0) {
+            current_key_index = i;
+            break;
+        }
+    }
+
+    // Choose the next key to try
+    size_t next_key_index = (current_key_index + 1) % mf_classic_backdoor_keys_count;
+    uint8_t backdoor_version = mf_classic_backdoor_keys[next_key_index].type - 1;
+
+    FURI_LOG_E(TAG, "Trying backdoor v%d", backdoor_version);
+    dict_attack_ctx->current_key = mf_classic_backdoor_keys[next_key_index].key;
+
+    // Attempt backdoor authentication
+    MfClassicError error = mf_classic_poller_auth(
+        instance, 0, &dict_attack_ctx->current_key, MfClassicKeyTypeA, NULL, true);
+    if((next_key_index == 0) &&
+       (error == MfClassicErrorProtocol || error == MfClassicErrorTimeout)) {
+        FURI_LOG_E(TAG, "No backdoor identified");
+        dict_attack_ctx->backdoor = MfClassicBackdoorNone;
+        instance->state = MfClassicPollerStateRequestKey;


@noproto Could you check this part?

Now I can see that you check only first backdoor key (MfClassicBackdoorAuth3), and if backdoor auth is failed we don't check other 2 known backdoor keys. Also the instance->mode_ctx.dict_attack_ctx is always 0-initialized at this point, so I think the current_key_index will be always mf_classic_backdoor_keys_count - 1

It depends on how backdoor authentication fails. If the tag does not respond with a nonce to the backdoor authentication command, we skip detection (as it is an unrecognized command by the tag) and save time. If it does, we continue unless we've failed to authenticate with all known backdoor keys. current_keys_index is initialized to 2 initially, so that the "next" key is 0 (since current_key is initially not a backdoor key) and starts the loop through the backdoor key array.

Verified with v1, v3, and a tag with no backdoor present:

v1:

59810309 [E][MfClassicPoller] Trying backdoor v3 59810423 [E][MfClassicPoller] Trying backdoor v1 59810428 [E][MfClassicPoller] Backdoor identified: v1

v3:

20070 [E][MfClassicPoller] Trying backdoor v3 20075 [E][MfClassicPoller] Backdoor identified: v3

No backdoor:

15543 [E][MfClassicPoller] Trying backdoor v3 15547 [E][MfClassicPoller] No backdoor identified

MfClassicErrorProtocol is the error code when a nonce is not sent by the tag. Let me know if I can test anything else for this.

noproto · 2024-09-11T16:13:20Z

Here is what I'll resolve before moving this PR back out of draft, will keep this list updated:

~~Fix crash when skipping tag, then re-reading it~~
~~Make Hardnested nonce collection faster~~ (Faster now but we can still buffer log writes for another 20%-30% speedup)
Resolve all TODOs in code (12 remaining)
Fix calibration issue, and eliminate outliers
~~Add UI progress bar~~
Resolve all reviews (5 remaining)

noproto and others added 6 commits August 1, 2024 09:10

Initial structure for nonce collection

cf6d6bb

Nonce logging

b154603

Dictionary attack structure

ef16770

Merge branch 'flipperdevices:dev' into nestednonces

d3bf372

Fix compilation

213ec1d

Identified method to reduce candidate states

9ba78bf

noproto mentioned this pull request Aug 4, 2024

Any chance to update it to support NFC refactor? AloneLiberty/FlipperNested#21

Open

noproto and others added 6 commits August 4, 2024 08:30

Use EXT_PATH instead of ANY_PATH

6d66638

Merge branch 'flipperdevices:dev' into nestednonces

e61b543

Use median calibrated distance, collect parity bits

09f8a73

Modify parity collection

7d2cab5

Fixed parity bit collection

8dd3daf

Add note to fix nonce logging

4b44288

noproto added 3 commits August 9, 2024 22:01

Fix nonce logging

5feeae8

Clean redundant code

3acba77

Fix valid_nonce

6332ec7

hedger added the NFC NFC-related label Aug 12, 2024

noproto added 11 commits August 14, 2024 02:25

First attempt disambiguous nonce implementation

01b1948

Merge remote-tracking branch 'origin/dev' into nestednonces

8d1a220

FM11RF08S backdoor detection

cc8cae7

Initial accelerated dictionary attack for weak PRNGs

79bc887

Refactor to nested dictionary attack

0af28fb

Renaming some variables

08ca794

Hard PRNG support for accelerated dictionary attack

b7e63bf

Update found keys, initial attempt

bbc10cd

Update found keys, second attempt

75a0e4b

Code cleanup

c1f01ce

Misc bugfixes

26845cb

noproto requested a review from Skorpionm as a code owner September 3, 2024 19:32

Willy-JL mentioned this pull request Sep 3, 2024

OFW PR 3822 (MIFARE Classic Key Recovery Improvements) Next-Flip/Momentum-Firmware#207

Draft

2 tasks

Bump f18 API version (all functions are NFC related)

b09d5a0

Merge remote-tracking branch 'origin/dev' into nestednonces

9ea7a46

skotopes requested changes Sep 7, 2024

View reviewed changes

skotopes marked this pull request as draft September 7, 2024 12:58

gornekich and others added 7 commits September 9, 2024 13:34

Merge branch 'dev' into nestednonces

9558a5f

Add new backdoor key, fix UI status update carrying over from previou…

cba58ed

…s read

Clear TODO line

ab8bc3e

Fix v1/v2 backdoor nonce collection

d7484ee

Speed up backdoor detection, alert on new backdoor

c43806b

Add additional condition to backdoor check

ab0debb

Merge branch 'flipperdevices:dev' into nestednonces

8d26636

gornekich reviewed Sep 11, 2024

View reviewed changes

noproto added 2 commits September 11, 2024 16:22

I'll try freeing memory, that's a good trick!

13411da

Do not enter nested attack if card is already finished

8edafa3

noproto mentioned this pull request Sep 12, 2024

Please get app working with most recent Official Flipper firmware version AloneLiberty/FlipperNested#36

Open

noproto and others added 7 commits September 16, 2024 05:28

Do not reset the poller between collected nonces

18f8cfb

Merge branch 'flipperdevices:dev' into nestednonces

4836a54

Clean up various issues

3ab752b

Fix Hardnested sector/key type logging

8eae5c0

Add nested_target_key 64 to TODO

d8864a4

Implement progress bar for upgraded attacks in NFC app

c1cdd49

Typo

96606dc

This was referenced Sep 18, 2024

Update MFKey to v3.0 flipperdevices/flipperzero-good-faps#243

Draft

MIFARE Classic guide Flipper-Community/flipper-community-wiki#5

Draft

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

MIFARE Classic Key Recovery Improvements #3822

MIFARE Classic Key Recovery Improvements #3822

noproto commented Aug 4, 2024 •

edited

Loading

noproto commented Aug 10, 2024

noproto commented Aug 21, 2024 •

edited

Loading

noproto commented Sep 4, 2024 •

edited

Loading

skotopes Sep 7, 2024

skotopes Sep 7, 2024

skotopes Sep 7, 2024

skotopes Sep 7, 2024

skotopes Sep 7, 2024

skotopes commented Sep 7, 2024

skotopes commented Sep 7, 2024

gornekich left a comment

gornekich Sep 11, 2024

noproto Sep 11, 2024 •

edited

Loading

noproto Sep 11, 2024

noproto commented Sep 11, 2024 •

edited

Loading

		@@ -5,6 +5,8 @@

		#define TAG "NfcMfClassicDictAttack"

		// TODO: Update progress bar with nested attacks

MIFARE Classic Key Recovery Improvements #3822

Are you sure you want to change the base?

MIFARE Classic Key Recovery Improvements #3822

Conversation

noproto commented Aug 4, 2024 • edited Loading

What's new

Verification

Checklist (For Reviewer)

noproto commented Aug 10, 2024

noproto commented Aug 21, 2024 • edited Loading

noproto commented Sep 4, 2024 • edited Loading

skotopes Sep 7, 2024

Choose a reason for hiding this comment

skotopes Sep 7, 2024

Choose a reason for hiding this comment

skotopes Sep 7, 2024

Choose a reason for hiding this comment

skotopes Sep 7, 2024

Choose a reason for hiding this comment

skotopes Sep 7, 2024

Choose a reason for hiding this comment

skotopes commented Sep 7, 2024

skotopes commented Sep 7, 2024

gornekich left a comment

Choose a reason for hiding this comment

gornekich Sep 11, 2024

Choose a reason for hiding this comment

noproto Sep 11, 2024 • edited Loading

Choose a reason for hiding this comment

noproto Sep 11, 2024

Choose a reason for hiding this comment

noproto commented Sep 11, 2024 • edited Loading

noproto commented Aug 4, 2024 •

edited

Loading

noproto commented Aug 21, 2024 •

edited

Loading

noproto commented Sep 4, 2024 •

edited

Loading

noproto Sep 11, 2024 •

edited

Loading

noproto commented Sep 11, 2024 •

edited

Loading