Proxmark3 developers community

Research, development and trades concerning the powerful Proxmark3 device.

Remember; sharing is caring. Bring something back to the community.


"Learn the tools of the trade the hard way." +Fravia

You are not logged in.

#1 2013-11-17 17:20:06

asper
Contributor
Registered: 2008-08-24
Posts: 1,409

About Hitag2 and NXP letter

Hi dears, expecially Roel,

I re-read with interest the "gone in 360 seconds" documents and I would like to ask a question about that sentence:

Following the principle of responsible disclosure, we
have contacted the manufacturer NXP and informed
them of our findings six months ahead of publication.
We have also provided our assistance in compiling a document
to inform their customers about these vulnerabilities.
The communication with NXP has been friendly
and constructive. NXP encourages the automotive industry
for years to migrate to more secure products that
incorporate strong and community-reviewed ciphers like
AES.

In particular is it possible to read the letter and the correspondant NXP answer/s and "encourages" to automotive industry ? Is a link available ?

Last edited by asper (2013-11-17 21:24:30)

Offline

#2 2013-11-17 21:05:19

rule
Administrator
Registered: 2008-05-21
Posts: 416

Re: About Hitag2 and NXP letter

To my knowledge, there is no public document about this particular notification. However, there is a public document from 2009, that notifies collaborating parties of preliminary weaknesses in Hitag products.

Offline

#3 2013-11-17 21:31:22

asper
Contributor
Registered: 2008-08-24
Posts: 1,409

Re: About Hitag2 and NXP letter

Thank you very much for your answer; looking at this NXP partner list there seems not to be any relation with car manufacturers... so who received that public document in automotive industries ? ECU producers ?

Last edited by asper (2013-11-17 21:34:40)

Offline

#4 2013-11-21 17:59:07

djrocket
Member
Registered: 2010-12-13
Posts: 3

Re: About Hitag2 and NXP letter

the document you read is
Gone in 360 Seconds: Hijacking with Hitag2
Roel Verdult Flavio D. Garcia Josep Balasch
?

it's a 16 pages?

Offline

#5 2013-11-21 21:31:40

asper
Contributor
Registered: 2008-08-24
Posts: 1,409

Re: About Hitag2 and NXP letter

Yes, it is.

Offline

#6 2014-01-18 13:53:43

asper
Contributor
Registered: 2008-08-24
Posts: 1,409

Re: About Hitag2 and NXP letter

Hi Roel, recently someone stole my brother's car (Renault Megane Scenic); it is written it has an Hitag2 security "device" so I thought it was stolen by expert car-thieves but opening the remote control/immo i found this:
mF4rCwp.jpg
It is a PCF7943 but there seems to be no info on this "device"... do you have something to read ?

Also is there anyone who know a way to "read" that pseudo-QRcode in the pcb ? Here it is a higher resolution verison.

Offline

#7 2014-01-18 18:43:38

midnitesnake
Contributor
Registered: 2012-05-11
Posts: 151

Re: About Hitag2 and NXP letter

PCF7943 https://avtotools.com/products_files/HiTag2/HiTag2_manual_eng.pdf

Offline

#8 2014-01-19 04:21:52

marshmellow
Moderator
From: US
Registered: 2013-06-10
Posts: 2,299

Re: About Hitag2 and NXP letter

btw, the barcode is a data matrix with a value of 10059750810611

Offline

#9 2014-01-19 08:09:52

asper
Contributor
Registered: 2008-08-24
Posts: 1,409

Re: About Hitag2 and NXP letter

@midnitesnake: thank you for the link ! I wasn't aware it belongs to hitag2 family ! I Updated the RFID tag list !

@marshmellow: thanks to you too ! Can you explain how you decoded it ?

Can someone also explain the whole circuitery on the PCB ?

Offline

#10 2014-01-19 22:56:37

marshmellow
Moderator
From: US
Registered: 2013-06-10
Posts: 2,299

Re: About Hitag2 and NXP letter

I recognized the type but I didn't have a proper reader so I made it black and white and read it with a barcode scanner app on my android phone.  (The app reads only black and white codes.)

Offline

#11 2014-01-19 22:58:24

asper
Contributor
Registered: 2008-08-24
Posts: 1,409

Re: About Hitag2 and NXP letter

Name of the app for those matrix code?

Offline

#12 2014-01-19 23:01:44

marshmellow
Moderator
From: US
Registered: 2013-06-10
Posts: 2,299

Re: About Hitag2 and NXP letter

Barcode Scanner by ZXing team

Offline

#13 2014-01-19 23:02:52

marshmellow
Moderator
From: US
Registered: 2013-06-10
Posts: 2,299

Re: About Hitag2 and NXP letter

That app reads most barcode types.

Offline

#14 2014-01-19 23:19:54

asper
Contributor
Registered: 2008-08-24
Posts: 1,409

Re: About Hitag2 and NXP letter

Thanx i was using qrdroid without success (also black and white).

Offline

#15 2014-01-19 23:43:36

marshmellow
Moderator
From: US
Registered: 2013-06-10
Posts: 2,299

Re: About Hitag2 and NXP letter

NP. A lot of apps only read QR codes which is a very different standard.

Offline

#16 2014-01-20 04:37:05

vivat
Contributor
Registered: 2010-10-26
Posts: 332

Re: About Hitag2 and NXP letter

On the left side of your photo is S100 circuit-probadly a voltage regulator. Nearby ripped battery holders contacts.
Next 13.56 D:4Z crystal 13.56 Mhz. Used to generate 433.92 Mhz signal. I think that PCF7943 have a x32 multiplier, so that 13.56*32=433.92.
On the right side I see damaged element with coil-maybe a 125 khz antenna? Then 3 yellow buttons, a buzzer and some IC from NXP/Philips 23967 that I couldn't identify.
The QR code can be an unique identifier.

Offline

#17 2015-03-31 18:07:36

r011
Member
Registered: 2014-08-17
Posts: 5

Re: About Hitag2 and NXP letter

I just start to work on renault card key rf and rfid and maybe someone will be intrested for chip info s100 from picture.
It is infineon tda 5100 ASK/FSK Transmitter 868/433 MHz.In renault card key rf modulation is 2fsk deviation 100khz,baud rate 10khz,
433.95 mhz

Offline

#18 2015-03-31 18:10:56

r011
Member
Registered: 2014-08-17
Posts: 5

Re: About Hitag2 and NXP letter

I am looking for pcf791,7943,7946 etc FULL datasneet if somebody have this please contact me

Offline

#19 2015-03-31 18:40:41

iceman
Administrator
Registered: 2013-04-25
Posts: 6,154
Website

Re: About Hitag2 and NXP letter

I think the pcf7931 datasheet is available if you google.


If you feel the love,  https://www.patreon.com/iceman1001

modhex(hkhehghthbhudcfcdchkigiehgduiehg)

Offline

#20 2015-04-01 14:01:28

r011
Member
Registered: 2014-08-17
Posts: 5

Re: About Hitag2 and NXP letter

iceman wrote:

I think the pcf7931 datasheet is available if you google

Yes pcf7931 is available but I am intrested in pcf7941,7943,7946,7947 FULL datasheet not only one page pdf
Thanks

Offline

Board footer

Powered by FluxBB