RFID and NFC Security

Contactless tags control physical access, payments, transit, inventory, and identity. RFID (Radio Frequency Identification) and NFC (Near Field Communication) power building badges, hotel keys, transit cards, and tap-to-pay.

Because these systems gate physical security, weaknesses translate directly into doors that open and payments that move. Many deployments still rely on technology with known, decade-old breaks that organizations never replaced.

• Cloning a badge can grant full building access.
• A weak hotel lock system can be opened with a cheap reader.

Understanding the frequency and chip type is the foundation of any assessment.

Contactless tags split into two main frequency families with very different security:

• Low Frequency (125 kHz) — older proximity cards like HID Prox and EM4100. Short range, no cryptography; they simply broadcast a fixed ID.
• High Frequency (13.56 MHz) — NFC, MIFARE, transit, and payment cards. Supports memory, sectors, and in better chips, cryptography.

The 125 kHz cards are trivially cloned because they have no authentication at all. The 13.56 MHz family ranges from broken (MIFARE Classic) to robust (DESFire EV2/EV3).

The Proxmark3 is the industry-standard RFID research device. It handles both 125 kHz and 13.56 MHz, can read, write, emulate, and run attack scripts.

Other useful hardware:

• Flipper Zero — convenient for LF cloning and basic NFC work.
• ACR122U — a cheap PC/SC NFC reader for 13.56 MHz.
• Chameleon — emulates multiple card types for testing readers.

The Proxmark client gives low-level access to the radio, letting you analyze tags that consumer tools cannot.

125 kHz proximity cards have no defense. The card transmits a fixed ID, the reader checks it against an access list, and that is the entire security model.

With a Proxmark you read the ID and write it to a blank T5577 rewritable card, producing a perfect clone in seconds.

MIFARE Classic is one of the most widely deployed access cards, and its Crypto-1 cipher has been thoroughly broken since 2008.

The card divides memory into sectors, each protected by two keys. Multiple attacks recover those keys:

• Darkside — recovers a key with no prior knowledge by exploiting cipher weaknesses.
• Nested — once one key is known, recovers all others quickly.
• Default key dictionaries — many cards still use factory keys like FFFFFFFFFFFF.

Once keys are recovered, the entire card content can be dumped and written to a blank.

The Proxmark automates the full MIFARE Classic attack chain: recover keys, dump all sectors, then write the dump to a magic card whose block 0 (the UID block) is writable.

NFC builds on 13.56 MHz and defines tag types and a data format called NDEF (NFC Data Exchange Format). NDEF stores records such as URLs, text, or app launch data.

Security concerns at this layer include:

• Malicious NDEF — a tag pointing to a phishing URL or triggering an action on tap.
• Locked vs unlocked tags — a writable NTAG can be reprogrammed by anyone.
• UID-based access control is weak because UIDs can be spoofed on magic cards.

Never trust a UID alone for authentication; it is an identifier, not a secret.

Beyond cloning, tools can emulate a card to a reader. A Proxmark or Chameleon presents a captured card to fool an access reader without a physical clone.

A relay attack is more powerful: two devices bridge the radio link in real time, so a card far away appears present at the reader. This defeats systems that assume proximity equals authorization.

• One device sits near the victim card.
• Another sits at the target reader.
• Commands and responses are relayed over the network between them.

Relay attacks threaten payment and keyless-entry systems that rely solely on physical closeness.

Modern, well-designed contactless systems resist these attacks:

• MIFARE DESFire EV2/EV3 — AES-based mutual authentication and encrypted communication.
• SmartMX / secure elements — tamper-resistant chips used in payment cards.
• EMV contactless — uses dynamic cryptograms so each tap is unique and cannot be replayed.

The key property is challenge-response authentication: the reader and card prove knowledge of a secret without ever transmitting a clonable static value.

A structured RFID assessment follows a clear progression:

• Identify the frequency and chip with lf search and hf search.
• Classify the technology: is it broken (125 kHz, MIFARE Classic) or strong (DESFire, EMV)?
• Test cloning on cards you are authorized to assess.
• Check UID reliance in the backend; spoofable UIDs are a common finding.
• Evaluate relay exposure for proximity-trusting systems.

Always operate within a documented authorization scope and only against the client's own credentials and readers.

Recommendations from a contactless assessment commonly include:

• Retire 125 kHz and MIFARE Classic in favor of DESFire EV2/EV3 or equivalent.
• Use mutual cryptographic authentication, never UID-only access control.
• Add a second factor (PIN pad, mobile credential) for high-security doors.
• Implement anti-relay measures such as timing bounds or distance bounding for payment and entry.
• Rotate keys and disable factory default keys.

The recurring theme: any system that trusts a static, readable value will be cloned. Security must come from secrets the card never reveals.

Test your understanding of contactless card security.

You can now evaluate RFID and NFC access and identity systems:

• 125 kHz LF cards have no crypto and are cloned to T5577 blanks instantly.
• 13.56 MHz ranges from broken (MIFARE Classic / Crypto-1, beaten by darkside and nested attacks) to strong (DESFire, EMV).
• The Proxmark3 reads, dumps, writes, and emulates across both frequencies.
• UID-based access control is weak because UIDs are spoofable; relay attacks defeat proximity trust.
• Secure designs use mutual cryptographic authentication so the card never reveals a clonable secret.

Next you will study capturing and replaying RF signals more broadly.