Retrieving keys using MFOC : distance varies significantly

jgarnham · 2015-10-25 17:15:20

I've been trying to use MFOC along with my ACR122U reader to retrieve the keys from my MIFARE Classic 4K card. When using MFOCi it indicates that the card uses some of the default keys, two of them twice. And then starts to try to crack the others using one of these (initially the default fffffffffff… key). Unfortunately even with the number of probes set to a very high number like 20000 it never succeeds.

Noticeably the distance returned for each probe varies significantly, going from up in the 40000s down to the high 10000s — I assume this is problematic given screenshots from others whose distance is in a very small range.

Initially this was occurring in Ubuntu in VMWare on my MBP, which given others issues with virtualisation and MFOC thought may have been the issue so I switched to using a Ubuntu Live USB on my MBP and the issue persisted.

What is likely the cause of the issues here? MFOC? The reader? The card or the laptop itself?

iceman · 2015-10-25 19:51:09

If you want answers about MFOC and ACR122U readers, I would suggest you raise them in their forums instead of here.

jgarnham · 2015-10-25 23:07:17

iceman wrote:

If you want answers about MFOC and ACR122U readers, I would suggest you raise them in their forums instead of here.

I will do but any help from those who have done similar here would be of use also.

jgarnham · 2015-10-26 13:29:53

iceman wrote:

If you want answers about MFOC and ACR122U readers, I would suggest you raise them in their forums instead of here.

Is there any way to check if my Mifare Classic card is a new one with a fixed Random Number Generator? I'm thinking that may be the cause of my issues.

iceman · 2015-10-26 13:41:59

If you have a PM3, then you can run the "hf mf mifare" command to get some feedback about whether the tag is vuln or not.

jgarnham · 2015-10-26 15:19:10

iceman wrote:

If you have a PM3, then you can run the "hf mf mifare" command to get some feedback about whether the tag is vuln or not.

Thanks. If it is using a fixed RNG are they still possible to crack using another method?

iceman · 2015-10-26 17:11:29

if you read some threads on this forum, you find your answer.

jgarnham · 2015-10-26 22:32:52

iceman wrote:

if you read some threads on this forum, you find your answer.

Will do. One other query, do Mifare Classics' with fixed RNG only have 7 byte UIDs or can they have 8 byte UIDs too?

meter · 2015-10-26 22:43:49

I never seen a mifare with 8 bytes UID but only 4 or 7. I have a Mifare with PRNG fixed and 4 byte UID, so UID is not a difference.

jgarnham · 2015-10-26 22:49:05

meter wrote:

I never seen a mifare with 8 bytes UID but only 4 or 7. I have a Mifare with PRNG fixed and 4 byte UID, so UID is not a difference.

nfc-list reports the following:

UID (NFCID1): ab  0c  e1  38

jgarnham · 2015-10-26 22:50:05

Sorry, meant to say 4 in that original post.

jgarnham · 2015-10-26 22:51:05

meter wrote:

I never seen a mifare with 8 bytes UID but only 4 or 7. I have a Mifare with PRNG fixed and 4 byte UID, so UID is not a difference.

Was using PM3 the only way you could tell if the PRNG was fixed?

Proxmark3 community

Announcement

#1 2015-10-25 17:15:20

Retrieving keys using MFOC : distance varies significantly

#2 2015-10-25 19:51:09

Re: Retrieving keys using MFOC : distance varies significantly

#3 2015-10-25 23:07:17

Re: Retrieving keys using MFOC : distance varies significantly

#4 2015-10-26 13:29:53

Re: Retrieving keys using MFOC : distance varies significantly

#5 2015-10-26 13:41:59

Re: Retrieving keys using MFOC : distance varies significantly

#6 2015-10-26 15:19:10

Re: Retrieving keys using MFOC : distance varies significantly

#7 2015-10-26 17:11:29

Re: Retrieving keys using MFOC : distance varies significantly

#8 2015-10-26 22:32:52

Re: Retrieving keys using MFOC : distance varies significantly

#9 2015-10-26 22:43:49

Re: Retrieving keys using MFOC : distance varies significantly

#10 2015-10-26 22:49:05

Re: Retrieving keys using MFOC : distance varies significantly

#11 2015-10-26 22:50:05

Re: Retrieving keys using MFOC : distance varies significantly

#12 2015-10-26 22:51:05

Re: Retrieving keys using MFOC : distance varies significantly

Board footer