Magic MIFARE in a Ring (and How To Enable Magic Wake-Up on a Gen4 Credential)

Рет қаралды 16,411

DeviantOllam

Күн бұрын

Пікірлер: 121

@mlies37 2 ай бұрын

NXP is Dutch I believe?

@DeviantOllam 2 ай бұрын

Really? My gosh, if I've been wrong about that this whole time, geez... I appreciate the correction! Holy cow, you're right! Thank you for this!! I have just been repeating what I was told long ago... and it was off by one country!

@autohmae 2 ай бұрын

Both NXP and ASML used to be part of Philips, you know Philips from the CD, DVD, etc. etc.

@DeviantOllam 2 ай бұрын

@@autohmaeyeah, just read that on Wikipedia 👍

@autohmae 2 ай бұрын

@@DeviantOllam for reference: the Netherlands is small, so Eindhoven (Philips, etc.) is about 1 hour drive from the German border. 🙂

@DeviantOllam 2 ай бұрын

@@autohmae indeed, I've been there many times... can't believe I never learned this about NXP though!

@OrginalDravas 2 ай бұрын

I been using a ring like this for my work badge back up for a couple years now. Its always fun to fist bump the gate reader and drive out.

@DeviantOllam 2 ай бұрын

that's cool... what type of credential tech is your system and what size of reader is on the gate?

@OrginalDravas 2 ай бұрын

@@DeviantOllam They are using old school HID - I want to say the reader is similar to the standard size we use on the doors, why i have to fist bump the reader. I will pay more attention when I drive out today. Looked back in my amazon history and the ring is called HECERE T5577.

@DeviantOllam 2 ай бұрын

@@OrginalDravas cool cool

@murunbuchstanzangur 2 ай бұрын

@@OrginalDravas shh. You are getting socially engineered!

@OrginalDravas 2 ай бұрын

@@murunbuchstanzangur lol I know but eh the company i work for sucks

@AuthenticUnicorn 2 ай бұрын

"Say hello to me in a tiny local spot in NC and a distillery in VA... say hello to me... anywhere!" -paraphrasing Dev He really will engage pretty much anywhere! It makes me smile. 😍

@DeviantOllam 2 ай бұрын

@@AuthenticUnicorn haha indeed!

@burstofsanity 2 ай бұрын

As a layman, the most obvious "fix" for hiding that an RFID device is a Magic device would be a physical change to the design requiring two contacts on the device to shorted to give access to the Magic interface. This would prevent any Magic commands from being accessible except when deliberately trying to access them.

@WeAreChecking 2 ай бұрын

Tough for people who have implants but definitely a worthy idea for rings/cards/etc

@matthewmiller6068 2 ай бұрын

Could probably do similar with passwords...have it ignore and give no reply with the wrong key but could enable the commands with the correct key.

@burstofsanity 2 ай бұрын

@@WeAreChecking Yeah definitely a no go for implants unfortunately.

@benbradstock183 2 ай бұрын

This explains everything I've been doing the last week and why I was struggling so much with it too. Thank you so much for this video, it's exactly what I was looking for! I watched that talk and had the same thought, why get the implant when I can get a ring. I looked for a ring, got one before knowing the type of mifare I needed wasn't 1k but 4k, destroyed the card I wanted to clone to the ring, now I have to go nicely ask the support desk to re-code my card. Thanks for including the commands too, that was making me loose hair.

@daRock1212 2 ай бұрын

Wow that's amazing, thanks DO for letting us know that a Gen4 ring exists! I have the 4xHF (2xGen1a, 2x21n) 2xT55 ring, and it's worked well. But I've wanted a Gen4 ring in case I came across a reader that tested for magic commands (taking a trip to Korea early next year, so we'll see if it's needed). One less Mifare card available, but that's the price you pay I guess. And on the Flipper, the app NFC Magic (it's on Momentum and others) handles Gen4 well. Can set and clear the backdoor password to prevent waking magic commands and do all the read / write stuff too

@Grappler130 2 ай бұрын

Getting some AVE/This Old Tony vibes in the intro, and I love it.

@imark7777777 2 ай бұрын

I was thinking Mr. Rogers.

@Phoen1x883 2 ай бұрын

Or Big Clive, but Dev's bench doesn't have nearly enough burn marks.

@HenryKlausEsq. 2 ай бұрын

The red velvet chair, book shelf and indoor plant needs to be your ongoing format. The can of dehydrated water and Duff beer also added to the mystique.

@Chirael 2 ай бұрын

Great video. One of the best parts of open source work is documenting obfuscated or previously undocumented/poorly documented things, leaving breadcrumbs and guide books for those who come after. Thanks for explaining all this 🙏

@Crftbt 2 ай бұрын

This is so cool! Appreciate you sharing the functional technical information and demo. :)

@canoepick1140 2 ай бұрын

Nice! I haven’t bought one yet! Fingers crossed they’ll be a prize and I win finally!

@SubTerraAlly 2 ай бұрын

I've found hundreds of rings while metal detecting. Now I'll have to start checking them!

@AuthenticUnicorn 2 ай бұрын

Oooh this is cool. Anything particularly interesting?

@zaprodk 2 ай бұрын

Do the RFID rings contain enough ferrous metals to stick to a magnet?

@SubTerraAlly 2 ай бұрын

I'm in Hawaii so just gold, diamond, platinum and silver. Mostly wedding rings.

@seanr2109 2 ай бұрын

Iv not watched this yet, but was googling for this a few weeks ago and didn’t come across anything so really looking forward to watching this later today when I get a bit of spare time!! I thought about looking at an implant but in the UK getting a magic Mifare seems almost impossible at the moment

@rallias1 2 ай бұрын

I love how your CPU sticker on your laptop is at almost the exact same angle as the one on my work laptop.

@JessicaFEREM 2 ай бұрын

the rings seem like a good compromise for people who want an implant but don't or can't get it done

@BeeWhere 2 ай бұрын

Super cool tech, not quite ready for a jab but would be fun to try a ring 💍

@Artood4R2 2 ай бұрын

Fantastic, amazing video again dev!

@AlonAltman 2 ай бұрын

Seems like this will be an endless cat and mouse game where the readers could start attempting to detect the gen4 chips, except that the readers only need a firmware update while the magic credentials need new hardware. A better solution may be to require a cryptographic key in order to gain access to the "magic" interface, but that means that if that key is lost or corrupted you may end up with a bricked device. A physical reset button might be a way to handle that but obviously that is not easily doable with implants.

@DeviantOllam 2 ай бұрын

I believe that something like this is now possible... folk in Iceman's Discord (as well as the ever-emerging documentation in the RRG GitHub repo) can likely speak more to this

@MarshallLevin 2 ай бұрын

Radar detector detector. It's detectors all the way down.

@eltrick__ 2 ай бұрын

That is actually how it works in a gen4 magic chip when you get first get it. If you noticed in the video, "Magic auth enabled" is exactly that, you authenticate to the chip using a different command and authentication key, and it acts as one of the possible ways to "magic wakeup" the chip. It is, however, currently not possible to change the magic authentication key.

@LakeVermilionDreams 2 ай бұрын

I need to spend a lot of time learning about this stuff! Thanks for the inspiration!

@0therun1t21 2 ай бұрын

Hell yeah that was fun and yes I did learn something, I remembered the gen 4 disables the gen 1 magic wake up from the implant talk. I wonder if anyone made a ring with a flat surface so they can give an easier read.

@asailijhijr 2 ай бұрын

Never stop never stopping.

@handcoding 2 ай бұрын

1:01 - Oh, hey-I think that I might be the person who you’re alluding to here? Awesome!

@HaileySchmailey 2 ай бұрын

I absolutely learned something and I’m absolutely going to exploit it (lawfully, of course).

@matthewmiller6068 2 ай бұрын

YOU HAVE MY FULL ATTENTION! I'm terrified of "stuff in my body" even needles for normal shots or blood-draw so I LOVE the idea of a ring or wristband credential! I'd like to know more about how it actually performs - I got a Gen2 (I think) Dangerous Things NFC ring and a China one off Amazon and could never get either to register on a door (tho worked great on a Proxmark and intermittently on a smartphone if I took it off and put flat on the phone) And yes, I think I did learn a few things here...and maybe a wristband is more what I'd want. Pipe dream would be smacking hand/wrist on the reader as I reach for the handle, with arms full carrying stuff so I don't have to dig in my wallet or pockets (or if I don't have pockets).

@NutchapolSal Ай бұрын

i feel like wearables are much more practical than implants anyways

@ConnorVisser 2 ай бұрын

Dev did I notice the Modernist Cuisine cookbooks behind you? If so I'm impressed those are like $1000 bucks for some very nerdy high level detailed cooking info!

@DeviantOllam 2 ай бұрын

yes i believe that our friends Adam and Terri gave us those. they're amazing.

@lyfandeth 2 ай бұрын

Even the abriged single volume edition is stunning.

@JoeTomasone 2 ай бұрын

Great info; thanks Dev!

@OneNvrKnoz 2 ай бұрын

So basically a feature not a bug. Cool!

@Scully1800 2 ай бұрын

Added one of these to my list the other day.

@christianp1788 2 ай бұрын

Putting this on my to watch list. But I've been saying I wanted this in a ring even since you first talk about your implants. Course now the issue will be remembering to take it off in the machine shop. I wonder if you could put it in one of those breakaway/stretchy rings....

@mjmeans7983 2 ай бұрын

So, let's say I have a small box of 100 or so RFID or NFC tags and I want to be able to use a scanner to read and log the serial numbers of all the tags in the box without opening the box. What RFID or NFC frequency or type would make this possible?

@NamesGolden 2 ай бұрын

Id like to know if it's working with the small round saflok readers and the new merry-yacht keys with mifare ultralight I was gonna get a implant til unsaflok hit, really liking the idea of a ring if the readers I use on a daily can easily read them.

@Codex_of_Wisdom 2 ай бұрын

The continued miniaturisation of tech is astounding. Too bad physics keeps messing us up, like with the coil directions.

@Aaron48219 Ай бұрын

Neat. I never got into RFID stuff, but this really intrigues me. Specifically because I've noticed certain bank debit cards won't allow tap payment, even if the correct PIN is used, depending on the card reader even if the same POS system is used. Allow me to elaborate. A small local store near me has two registers. The POS system is the same for both. However, one register will allow bank debit card payment with Comerica and Huntington bank cards. The second register will always decline these cards (even if the correct PIN is used) and require the customer to insert the card for debit payment. The second register *will allow* tap if the transaction is run as credit. These are in fact bank debit cards and not prepaid or CC's. The card readers are the same manufacturer, but do look slightly different, so they appear to be different models or revisions. Could it be the card readers firmware and protocols causing this?

@MorningDusk7734 2 ай бұрын

You have to be careful with your ring material, if you need to go to the hospital and your finger’s swollen the doctors will have to cut it off and they’ll struggle to cut tungsten.

@DeviantOllam 2 ай бұрын

i've heard that risk expressed before but then other folk state that the actual risk of this is super low

@peema10 2 ай бұрын

Something I kind of wondered about the rings is whether the antenna is in a specific side or runs right around. I had variable results with the reader dance whilst wearing.

@christopherlenahan3906 2 ай бұрын

Found out about serial number access control at the flipper demo in the village this year. There was no data on my Hilton room key.

@DeviantOllam 2 ай бұрын

that's absolutely crazy, wow. are you SURE that this info is correct? i'm not aware of any modern hotels anywhere that fail to use the protected memory segments when using MIFARE for their room keys

@nezu_cc 2 ай бұрын

So gen 4 is the best of both sorlds? I've heard you can brick gen2 chips, I'm assuming thats impossible in gen 4, right? What would you recommend for an implant, 1a or 2, I'm assuming we will have to still wait a while for gen4 implants to show up.

@daRock1212 2 ай бұрын

You can certainly brick magic Gen2 and Gen4 chips with improper direct write of blocks, but you can usually recover Gen4 that's soft-bricked with a backdoor reset. Commands are in the RfidResearchGroup/proxmark3 group

@sjoer 2 ай бұрын

Can you get a Gen4 implant anywhere?

@nameless9560 2 ай бұрын

i saw your talk and i thought the rfid nails were really cool but i dont know where you would find them or find thin enough chips to use to make them

@changandy 2 ай бұрын

I think I have the same dual frequency ring but I think mine is gen 2 not gen 4 magic. I don’t have a pm3 to verify but I have a flipper and can’t perform any gen 4 actions with NFC Magic. Does anyone know if the flipper has a wakeup function or some other way I can test if it’s gen 4?

@dt_ops Ай бұрын

I've been playing with one we snagged from Amazon... I'm pretty sure it's not a gen4. Or at least not the "ultimate gen4" we typically refer to. I suspect it is a USCUID. Why? Because while it had a gdm block it doesn't seem to support gen4 commands via the Flipper or hf_mf_ultimatecard script. The hf_mf_uscuid_prog script works well enough.

@zachbrenner9959 2 ай бұрын

Biohacker question: If I were to get a T55 implant in the meaty part between my thumb and index, would I have to switch hands to enter a pin on a reader/pin pad? I know that the read reliability with the small antenna being in your hand isn't great. I wonder if its bad enough that I wouldn't have to switch hands.

@Forge366 2 ай бұрын

Are there cheaper options for programming hardware? I found the proxmark3 you're using here. The price is a bit much for playing around outside of a job. Edit: looks like aliexpress has some cheaper clones? $30 to goof around is more my style

@tarickw 2 ай бұрын

i'd love to see some recommendations (and those that might work for us eu folk)

@DirtyPlumbus Ай бұрын

How do you enable shadow mode?

@DirtyPlumbus Ай бұрын

Nevermind, just had to think about it. Lol

@anthonycampos7417 2 ай бұрын

Thoughts on the Chameleon Ultra instead of a ring?

@Evgeni491 2 ай бұрын

I tried to clone my Gym membership card to a Gen 4 Gdm Tag. i dissabled Magic Wake up cload my dump on to the the tag. But when I try to turn off magic wakeup it says auth error.

@jmr 2 ай бұрын

Very cool!

@dudu8009 Ай бұрын

Is there maybe a bracelet or something like that instead of cards and rings?

@CarmeloEstablier 2 ай бұрын

Tungsten Carbine ring gang represeeeent

@tannershackelford27 2 ай бұрын

What's the chip you're using to read on your PC?

@dangerdc5482 2 ай бұрын

Can the gen4 credentials be set up to emulate gen2 / direct write mode? Its nice to be able to write block 0 with a phone instead of needing a laptop and proxmark, and if you could switch it to gen1a mode if you accidently lock the access bits, this sounds like it would be perfect

@eltrick__ 2 ай бұрын

It is possible to turn on gen2 mode, using the configuration block (the same one where you turn on/off magic wakeup, just a different byte, I recommend reading the documentation for this). You can also turn on gen1a mode, rewrite access bits, and turn it off if you accidentally write bad access bits to a sector.

@bosstowndynamics5488 2 ай бұрын

I'm kind of surprised the gen 4 still has a standard set of commands, this will fool gen1 detecting readers but it's just playing cat and mouse. Is there some technical reason that they couldn't make these fully pretend to be real credentials in the absence of, say, a password containing magic wakeup command?

@rosalina-dev 2 ай бұрын

real gen4 (non GDM) magic cards have password authentication

@daRock1212 2 ай бұрын

Gen4 backdoor commands are password protected, and without the correct password the chip won't respond to magic commands. So it's pretty invisible to reader provided magic commands, for now

@bosstowndynamics5488 2 ай бұрын

@@daRock1212 As far as I could tell from the video this gen 4 credential at least was responding to some magic commands without any authentication (it happily reported itself as a locked magic credential for instance)

@Dabbleatory 2 ай бұрын

I'm hoping someone starts making silicone RFID rings. If a flex implant can be put in squishy meat, why not in squishy silicone?

@DeviantOllam 2 ай бұрын

that would be great. i bet that concerns about antenna damage are the only thing that prevents it right now

@Dabbleatory 2 ай бұрын

@@DeviantOllam I would rather risk damaging the antenna than damaging a finger. Rigid rings can be dangerous (search for "finger degloving injury", but be warned the images are NSFL!). As long as the price isn't outrageous, I would be fine with the idea that a silicone ring has a limited lifespan and I might have to buy a new one every year or whatever as they wear out / break. Heck, if it works out that way, that repeat business is all the more reason for someone to manufacture these! That said, I am wearing a rigid ring currently for lack of an alternative other than an injectable, for which I'm not quite ready to take the leap. Things like this arms race with magic mifare generations make me leery of a injectables. It's a lot easier to upgrade a ring!

@java230 2 ай бұрын

So with the magic turned off, do the credentials still work? It just doesn't ping back? This may push me over the edge to trying this out. I like the idea of the implant, but it's a bit permanent

@eltrick__ 2 ай бұрын

The data you wrote will still be on the chip, it just won't respond to any magic wakeup commands the reader might throw at it until you turn on magic wakeup again.

@java230 2 ай бұрын

@eltrick__ thanks, that was what I was hoping!