This report deals with RFID systems and how to detect nearby tags with the Mifare standard using only a microcontroller and an antenna circuit. The aim was to investigate whether there was any possibility to continuously search for a nearby tag for a system operated with batteries without compromising   the lifespan of the battery. At this time the system would take too long time to wake up and look for a tag to give a satisfactory battery lifespan, which should be done a couple of times every second. The report has two issues, namely: Is it possible to direct the microprocessor to detect and identify a nearby tag after the Mifare standard? What hardware is required for this to be possible? As the research method to provide answers to the above questions an action research was used. This approach has meant that the group worked on information retrieval, examined existing solutions, tested their own solutions and documented the results. The group examined an existing solution that can search for nearby tags with minimal energy consumption. An antenna circuit was built that was connected to the processor. The program code was made in AVR Studio on a PC and programmed with a AVR one!. The processor was in an AVR Xplain development board for processors made by Atmel. The software is designed to wake up the system to search for a tag as quickly as possible, and then go back to sleep. By only activating the carrier and measure the amplitude of the received signal could determine whether a tag is around or not. This made it possible to conduct a search for a tag of less than 4 µS.

In this thesis, we used a encryption mechanism based on AES(Advenced Encryption Standard). Except for this mechanism, we also combine RS-232 Serial Communication Control, Smartcard and EM card which originally used in the Entrance Guard System to implement a new system. Eventually, this new system applies to a certain rental system practically. We also introduce some functions of this rental system based on the encryption mechanism, station initialization, bike rental, bike allocation and bike rental for credit card for example. In addition, we will describe what problems we met and the solutions we introduced to the problems finally.

Context. In today’s society we use smart cards in many areas, NFC is a smart card technology that allows contactless interaction between a reader and the tag, the tag is often in the form of a card. NFC can be used for various payment methods or as access card to a building which makes life easier. In previous studies, the technique has proven to be weak to attacks using an NFC reader connected to a computer. Among today’s smartphones, there are phones that have built-in read and write support for NFC tags. Objectives. In this study, I examine the NFC tags that are frequently used in our society, entry cards and debit cards to determine the security against the increasing use of smartphones as a potential attack tool. If there is a threat I will try to remedy the found lack. Methods. My approach was to select a number of test items and analyze the objects using only a smartphone with NFC support to determine the risk for each of the items. The test conducted was the modification, cloning and unique copy. Results. Through this investigation, I concluded that four of the non-empty items was at risk of being intimidated. All four are used in public transport and the objects were vulnerable to unique copy. Conclusions. In order to remedy this vulnerability should be the management of the tag’s data is handled in a different way, perhaps by storing the data in a internal system or to replace the tags for a safer tag alternative. / I dagens samhälle används smartcards i många områden, NFC som är en smartcard teknik som tillåter kontaktlös interaktion mellan en läsare och taggen, taggen är ofta i form av ett kort. NFC kan användas till olika betalnings metoder eller som inpasseringskort vilket gör vardagen enklare. I tidigare studier har tekniken visat sig svag för attacker med hjälp av en NFC-läsare kopplad till en dator. Bland dagens smartphones finns det telefoner som har inbyggt läs- och skriv-stöd till NFC taggar. I den här studien ska jag undersöka de NFC taggar som används flitigast i vårt samhälle, inpasseringskort och betalkort för att fastställa säkerheten mot den ökade användningen av smartphones som ett potentiellt attackverktyg, om det finns en hotbild ska jag försöka avhjälpa den funna bristen. Mitt tillväga gångsätt var att välja ut ett antal testobjekt och analysera de objekten med hjälp av endast en smartphone med NFC-stöd som verktyg. För att fastställa risken för vart och ett av objekten, de test som utfördes var modifiering, kloning och unik kopiering. Genom denna undersökning kom jag fram till att fyra av de icke tomma objekten löper risk att bli utsatta för hot alla fyra används i kollektivtrafiken och objekten var sårbara för unik kopiering, för att avhjälpa denna sårbarhet bör hanteringen av taggens data hanteras på ett annat vis, kanske genom att lagra data i ett inre system eller att byta ut taggarna till ett säkrare alternativ.

The master’s thesis aims to design an access control system using the RFID technology. The system should reduce security risks associated with its use. While working on project two devices were created. First is the access terminal operating on frequency of 13.56 MHz and second is the RFID reader for PC operating at frequency 125 kHz. Software for devices was created as well as system control application for PC. The document contains an overview of the RFID principles and possibility of implementation access control system. Next part of the project describes in detail step by step the process of designing electrical circuit for system parts. Last part talks about realized software, libraries which are used and the system control application for PC.

Genom att använda enkla medel i de undersökande experiment som utförts påvisas fortsatt stora brister i RFID-säkerheten hos MIFARE-enheterna. Där dyr och avancerad utrustning tidigare varit ett krav för att utnyttja bristerna kan nu betydligt billigare och mer lättillgänglig utrustninganvändas. Med hjälp av en Arduino och en mobiltelefon kan exempelvis resekort, passerkort och bankkort läsas av och delvis eller helt kopieras för att utnyttjas i ont syfte. Diskussion förs kring CIA-triangelns tre delar, konfidentialitet, integritet samt tillgänglighet. I och med att det i dag är mer eller mindre omöjligt att välja bort RFID-tekniken, ger examensarbetet även förslag på lösningar till de säkerhetsbrister som påvisas. Utöver detta tar uppsatsen även upp RFID-relaterade brott samt den pågående rättegång där en busschaufför misstänks för bedrägeri genom att sälja falska resekort.

Cílem této práce bylo implementovat emulaci tagu MIFARE Classic na NFC-A periferii vestavěné v mikrokontroléru. K implementaci řešení byl použit mikrokontrolér nRF52832 vyráběný firmou Nordic Semiconductor. Byla implementována základní sada příkazů MIFARE Classic (autentizace, čtení, zápis). Implementace byla otestována s několika čtečkami, za pomoci různých aplikací. Výsledné řešení bylo porovnáno s existujícími, jako je Proxmark a Chameleon Mini.

This paper is about security of the RFID systems, attacks on them and countermeasures. Attack to obtain secret key from Mifare Classic card was implemented. Options for eavesdropping RFID communication, security of the NFC technology and biometric passports are descibed too.

RFID-kort har ett utbrett användningsområde i dagens samhälle för bland annat passage, resekort och pass. RFID-kort av märket MIFARE Classic har i tidigare arbeten visats innehålla säkerhetsbrister. Detta undersöks för att se hur situationen ser ut idag med fokus på RFID-kort som attackvektor och i jämförelse med tidigare arbeten. Användandet av RFID-kort som attackvektor har i utförandet av experimenten visats fortfarande vara möjligt och även betydligt mindre begränsat. Där lagringskapacitet och användningsområde tidigare begränsat skadan man kan åstadkomma med RFID-kort, har nu standarden ökat och med det även lagringskapaciteten att skapa elak-artad kod. Med hjälp av en Arduino och en mobiltelefon är det möjligt att kopiera information från RFID-kort som till exempel lokaltrafikens resekort till ett mycket mindre säkert RFID-kort i ont syfte. Diskussionen tar upp möjligheterna att genom korsreferensering identifiera specifik information från varje kort, samt huruvida mer avancerade attacker som ransomware är applicerbara eller ej. Vidare utforskas även hur möjligheterna ser ut att lägga till egen kod och ser även där farhågor i användandet av RFID-kort utan ytterligare säkerhets-lager.

This master thesis describes the design of a battery-powered smart lock using IoT networks and NFC technology for user authentication. The first part of the thesis describes the individual components to be used for the device design and also deals with the design of matching circuits and the antenna for the NFC. The following part of the thesis describes the design of the hardware, particularly the design of the printed circuit board. The third part describes the firmware and the final part of the thesis is dedicated to the security analysis.

The wireless communication methods Near Field Communication (NFC) and Radio FrequencyIdentification (RFID) are today used in different products such as access cards, smartphones, andpayment cards. An effective attack against this type of technology is cloning attacks. Cloning attacks can deceive access control systems which may cause serious damage to organizations such asinformation leakage and financial loss. This type of attack attempts to deceive a system with anillegitimate cloned card that may be an identical copy of all the data on a card, parts of the data, orperhaps only by using its identification number. Therefore the existing security flaws that cloningattacks exploit are an important threat for organizations to acknowledge and manage. This thesis focuses on evaluating three different access control systems in use and demonstratessecurity flaws that exist in these systems. The systems are evaluated by how data can be extractedfrom the access control cards, this includes the time to collect all the data, reading distance, andinterfering objects. Systems are also evaluated by what information the systems validate. Compatible equipment for evaluating the different systems is necessary such as readers, writers, and otherpenetration testing tools. The type of card that the systems use is called Mifare classic whereastwo of the systems used a 1K version and one a 4K version, specifying the amount of availablememory on the card itself. The equipment also made it possible to perform and verify cloningattacks through different processes such as simulation and sniffing to explore what information certain access control systems deem necessary on the access cards. Rigorous experiments on the systems and the results reveal that crucial information on the accesscards could easily be extracted, reused, and simulated for accessing two of the systems. One systemproved to be more secure since it required more advanced methods to clone cards that the systemaccepted. The results of this thesis demonstrate that the evaluated access control systems cannotbe considered secure without additional layers of security added to them, instead, it is important tokeep the back-end system maintained through various applicable means.