Proxmark3 community

Research, development and trades concerning the powerful Proxmark3 device.

Remember; sharing is caring. Bring something back to the community.


"Learn the tools of the trade the hard way." +Fravia

You are not logged in.

Announcement

Time changes and with it the technology
Proxmark3 @ discord

Users of this forum, please be aware that information stored on this site is not private.

#1 2018-11-04 00:53:54

pclever
Contributor
Registered: 2018-07-15
Posts: 9

Mystery Mifare Fob

Hello, I am trying to see if it is possible to clone or emulate this new type of RFID fob. From my research even though the fob itself has no brand on it I believe it is manufactured by Kaba / Dormakaba. The fact sheet (see below) for these products claims the tags run on 13.56Mhz Mifare Classic 14443A with a 4 byte NUID.

I had initial success being able to read the tag in standalone mode however when I tested the emulation the door lit up red and refused to authenticate.

fmylSlg.png

On my PM3 I tried "lf search" and "hf search" and it failed to recognize the tag:
dupcNDJ.png



I found this other forum post about Kaba tags and the community had reason to believe that the tag could be a hitag. But unfortunately hitags are only 125Khz and the PM3 does not get any data from those commands (even when using Iceman's software).
zw2QTOc.png

Does anyone have any advice for anything else I can try?
Thanks!


References:
Dormakaba RFID fact sheet
Saflok M3573 fact sheet
Kaba forum post

Offline

#2 2018-11-04 16:00:08

iceman
Administrator
Registered: 2013-04-25
Posts: 9,495
Website

Re: Mystery Mifare Fob

try sniffing...   to see if you can capture some 14a traffic..

Offline

#3 2018-11-04 16:39:31

pclever
Contributor
Registered: 2018-07-15
Posts: 9

Re: Mystery Mifare Fob

iceman wrote:

try sniffing...   to see if you can capture some 14a traffic..

Hey thanks for the reply. I tried using "hf 14a reader" and like "hf search" it recognizes all my other cards but not this Kaba fob.

Unfortunately the command "hf 14a sniff" is not working at all on my device. I tried reflashing the fullimage and bootrom but I am still having issues with it. When I run it the A LED turns on and I need to press the button to end continue using the device. Do you know what could be wrong with my system?

Offline

#4 2018-11-07 13:36:54

Mackwa
Contributor
Registered: 2016-06-10
Posts: 51

Re: Mystery Mifare Fob

pclever wrote:

Unfortunately the command "hf 14a sniff" is not working at all on my device. I tried reflashing the fullimage and bootrom but I am still having issues with it. When I run it the A LED turns on and I need to press the button to end continue using the device. Do you know what could be wrong with my system?

that's normal.
what is your output of "hf 14a list" after hf 14a sniff?
does "hf 14a sniff" works on your pm3 with another hf reader/terminal?

Offline

Board footer

Powered by FluxBB