From 328019125e034d8e87c6ebf95e42b05dc4635afa Mon Sep 17 00:00:00 2001 From: Google Code Exporter Date: Sun, 19 Apr 2015 03:50:14 -0400 Subject: [PATCH] Migrating wiki contents from Google Code --- MifareClassicDefaultKeys.md | 21 ++ MifareClassicEnabledPhones.md | 21 ++ MifareClassicFullSoftTagEmulation.md | 311 +++++++++++++++++++++++++++ MifareClassicKnownCardsDataFormat.md | 42 ++++ ProjectHome.md | 90 ++++++++ 5 files changed, 485 insertions(+) create mode 100644 MifareClassicDefaultKeys.md create mode 100644 MifareClassicEnabledPhones.md create mode 100644 MifareClassicFullSoftTagEmulation.md create mode 100644 MifareClassicKnownCardsDataFormat.md create mode 100644 ProjectHome.md diff --git a/MifareClassicDefaultKeys.md b/MifareClassicDefaultKeys.md new file mode 100644 index 0000000..3e063a0 --- /dev/null +++ b/MifareClassicDefaultKeys.md @@ -0,0 +1,21 @@ +# Introduction # + +List of default keys presented as **examples** in NXP Application Notes, but which were used ad-litteram by vendors/system-integrators. + + +# Details # + +The list below details the publicly known and available default keys (specified in various application notes as examples): + +| **Default key** | **No. of known systems using it** | **List of those systems** | **Approx. no. of cards using it** | **Approx. % of cards from total Mifare Classic cards** | +|:----------------|:----------------------------------|:--------------------------|:----------------------------------|:-------------------------------------------------------| +| ffffffffffff | 1 | SKGT
+ + + + + + +
? ?
a0a1a2a3a4a5 1 SKGT
 ? ?
b0b1b2b3b4b5 ? ? ? ?
000000000000 ? ? ? ?
4d3a99c351dd ? ? ? ?
1a982c7e459a ? ? ? ?
d3f7d3f7d3f7 ? ? ? ?
aabbccddeeff ? ? ? ?
+ +As in the case of GSM COMP128, the example details from specifications/appnotes were taken ad-litteram, posing a security threat on the system. \ No newline at end of file diff --git a/MifareClassicEnabledPhones.md b/MifareClassicEnabledPhones.md new file mode 100644 index 0000000..a105584 --- /dev/null +++ b/MifareClassicEnabledPhones.md @@ -0,0 +1,21 @@ +# Introduction # + +Summarizes a list of known/available information regarding mobile phones/devices that have Mifare Classic Reader/Tag elements + + +# Details # + +| **Name/Model** | **URLs/Photo** | **Reader/Tag** | **RFID/NFC Chipset** | +|:---------------|:---------------|:---------------|:---------------------| +| Nokia 6131 | ? | Reader+Tag | ? | +| Nokia 6212 | ? | Reader+Tag | ? | +| Nokia 5140 | ? | ? (14443A) | ? | +| Samsung SGH X700 NFC | ? | ? | ? | +| Benq T80 | ? | ? | ? | +| Telefunken CS A108 | ? | ? | ? | +| Austro Montan | ? | ? | ? | +| Foxway Limited 5003 | ? | ? | ? | + + +# Links # +http://en.wikipedia.org/wiki/Near_Field_Communication#NFC-enabled_handsets \ No newline at end of file diff --git a/MifareClassicFullSoftTagEmulation.md b/MifareClassicFullSoftTagEmulation.md new file mode 100644 index 0000000..4043fdd --- /dev/null +++ b/MifareClassicFullSoftTagEmulation.md @@ -0,0 +1,311 @@ +# Introduction # + +**“Mifare Classic Full SoftTag Emulation”** = Software emulation (either in a PC, or a custom hardware programmable controller) of a physical Mifare Classic tag/device based on a dumped tag data, including: + * UID/Manufacturer Block information + * All sectors data, keys, AC bits, etc. + * Authentication and encryption + +# Mifare Classic 100% SoftTag Emulation – using ACR122U # + + * Seems like impossible because of not very accurate timings, USB timing delays, slow Crapto1 implementation + * Check this link for a small discussion: http://www.libnfc.org/community/topic/113/mifare-classic-softtag-emulation/ + +# Mifare Classic 100% SoftTag Emulation – using Proxmark3 # + + * Seems possible, but not too promising as of now + * Needs special firmware version to have proper timings + * Not very sure how to optimally stick Crapto1 implementation into Proxmark3 and making sure ISO 14443 timings are preserved + +# Mifare Classic 100% SoftTag Emulation – using Nokia 6131 or Nokia 6212 # + + * Some Mifare Classic with Nokia 6212 demo video: + + * As of now, the **most promising direction** for Mifare Classic 100% SoftTag Emulation + * Exploit vectors: + 1. Getting around the software checks using the holes in Nokia 6131/6212 SDKs + 1. Patching the cldc11.jar in the SDK and test the emulator + 1. Patching the cldc11.jar in the Nokia 6131/6212 device and test + +## Getting around the software checks using the holes in Nokia 6131/6212 SDKs ## + + * Block 0 operations and results: +``` +MFStandardConnection conn = null; +String internalUrl = System.getProperty("internal.mf.url"); +conn = (MFStandardConnection) Connector.open(internalUrl); + +MFBlock block; +byte KAbytes[] = { (byte)0xFF, (byte)0xFF, (byte)0xFF, (byte)0xFF, (byte)0xFF, (byte)0xFF}; +MFKey.KeyA KA = new MFKey.KeyA(KAbytes); + +block = conn.getBlock(0); + +byte block_FF[] = { + (byte) 0xFF, (byte) 0xFF, (byte) 0xFF, (byte) 0xFF, (byte) 0xFF, (byte) 0xFF, (byte) 0xFF, (byte) 0xFF, + (byte) 0xFF, (byte) 0xFF, (byte) 0xFF, (byte) 0xFF, (byte) 0xFF, (byte) 0xFF, (byte) 0xFF, (byte) 0xFF +}; +block.getBlockType(); // returns com.nokia.nfc.nxp.mfstd.MFBlock.BLOCKTYPE_MANUFACTURER == 2 +if (block instanceof MFBlock) // returns true +{ +} +if (block instanceof MFManufacturerBlock) // returns true +{ +} +block.write(KA, block_FF, 0); + +com.nokia.nfc.nxp.mfstd.MFStandardException + at com.nokia.mid.impl.isa.io.protocol.external.nfc.MFManufacturerBlockImpl.write(+8) + at nokiatest.startApp(+249) + at javax.microedition.midlet.MIDletProxy.startApp(+7) + at com.nokia.mid.impl.isa.ui.MIDletManager.callStartApp(+4) + at com.nokia.mid.impl.isa.ui.MIDletManager.activateMIDlet(+10) + at com.nokia.mid.impl.isa.ui.MIDletManager.run(+15) +``` + + * getBlock(-1) or getBlock(255) – operations and results: +``` +MFStandardConnection conn = null; +String internalUrl = System.getProperty("internal.mf.url"); +conn = (MFStandardConnection) Connector.open(internalUrl); + +MFBlock block; +byte KAbytes[] = { (byte)0xFF, (byte)0xFF, (byte)0xFF, (byte)0xFF, (byte)0xFF, (byte)0xFF}; +MFKey.KeyA KA = new MFKey.KeyA(KAbytes); + +block = conn.getBlock(-1); // getBlock(256); + +java.lang.IllegalArgumentException: Invalid block index + at com.nokia.mid.impl.isa.io.protocol.external.nfc.MFStandardConnectionImpl.getBlock(+21) + at nokiatest.startApp(+157) + at javax.microedition.midlet.MIDletProxy.startApp(+7) + at com.nokia.mid.impl.isa.ui.MIDletManager.callStartApp(+4) + at com.nokia.mid.impl.isa.ui.MIDletManager.activateMIDlet(+10) + at com.nokia.mid.impl.isa.ui.MIDletManager.run(+15) +``` + + * iii. getSector(0), read(), write() offset 0/16/32 etc – **no exception**, however **no change in block0** of the “Virtual 4K” “Embedded Tag” occurs, but block1, block2 and block3 changes the data. **Is there a physical/hardware check on this case?** +``` +MFStandardConnection conn = null; +String internalUrl = System.getProperty("internal.mf.url"); +conn = (MFStandardConnection) Connector.open(internalUrl); + +byte KAbytes[] = { (byte)0xFF, (byte)0xFF, (byte)0xFF, (byte)0xFF, (byte)0xFF, (byte)0xFF}; +MFKey.KeyA KA = new MFKey.KeyA(KAbytes); + +MFSector sector = conn.getSector(0); + +byte offset = 0; +byte sector_bytes[] = new byte[64-offset]; + +sector.read(KA, sector_bytes, 0, 0, 64-offset); + +// Overwrite with 0xFF all 4 block of sector0/sector1 +for (int i=0; i < (com.nokia.nfc.nxp.mfstd.MFBlock.BLOCK_LEN * 4) - offset; i++) +{ + sector_bytes[i] = (byte) 0xFF; +} + +sector.write(KA, sector_bytes, offset); +``` + + * getSector(0) – write offset other than 0/16/32 (i.e. multiples of BLOCK\_LEN==16) etc – **exception**: +``` +MFStandardConnection conn = null; +String internalUrl = System.getProperty("internal.mf.url"); +conn = (MFStandardConnection) Connector.open(internalUrl); + +byte KAbytes[] = { (byte)0xFF, (byte)0xFF, (byte)0xFF, (byte)0xFF, (byte)0xFF, (byte)0xFF}; +MFKey.KeyA KA = new MFKey.KeyA(KAbytes); + +MFSector sector = conn.getSector(0); + +byte offset = 4; // skip the UID, maybe we can overwrite some other parts of the manufacturer block? +byte sector_bytes[] = new byte[64-offset]; + +sector.read(KA, sector_bytes, 0, 0, 64-offset); + +// Overwrite with 0xFF all 4 block of sector0/sector1 +for (int i=0; i < (com.nokia.nfc.nxp.mfstd.MFBlock.BLOCK_LEN * 4) - offset; i++) +{ + sector_bytes[i] = (byte) 0xFF; +} + +sector.write(KA, sector_bytes, offset); + +com.nokia.nfc.nxp.mfstd.MFStandardException + at com.nokia.mid.impl.isa.io.protocol.external.nfc.MFStandardConnectionImpl.write(+183) + at com.nokia.mid.impl.isa.io.protocol.external.nfc.MFSectorImpl.write(+24) + at com.nokia.mid.impl.isa.io.protocol.external.nfc.MFSectorImpl.write(+10) + at nokiatest.startApp(+448) + at javax.microedition.midlet.MIDletProxy.startApp(+7) + at com.nokia.mid.impl.isa.ui.MIDletManager.callStartApp(+4) + at com.nokia.mid.impl.isa.ui.MIDletManager.activateMIDlet(+10) + at com.nokia.mid.impl.isa.ui.MIDletManager.run(+15) +``` + + * getSector (1) – write offset 0 – **no exception**, all data written +``` +MFStandardConnection conn = null; +String internalUrl = System.getProperty("internal.mf.url"); +conn = (MFStandardConnection) Connector.open(internalUrl); + +byte KAbytes[] = { (byte)0xFF, (byte)0xFF, (byte)0xFF, (byte)0xFF, (byte)0xFF, (byte)0xFF}; +MFKey.KeyA KA = new MFKey.KeyA(KAbytes); + +MFSector sector = conn.getSector(0); + +byte offset = 0; +byte sector_bytes[] = new byte[64-offset]; + +sector.read(KA, sector_bytes, 0, 0, 64-offset); + +// Overwrite with 0xFF all 4 block of sector0/sector1 +for (int i=0; i < (com.nokia.nfc.nxp.mfstd.MFBlock.BLOCK_LEN * 4) - offset; i++) +{ + sector_bytes[i] = (byte) 0xFF; +} + +sector.write(KA, sector_bytes, offset); +``` + + * getSector(-1) - operations and results: +``` +java.lang.IllegalArgumentException: Invalid sector index + at com.nokia.mid.impl.isa.io.protocol.external.nfc.MFStandardConnectionImpl.getSector(+21) + at nokiatest.startApp(+347) + at javax.microedition.midlet.MIDletProxy.startApp(+7) + at com.nokia.mid.impl.isa.ui.MIDletManager.callStartApp(+4) + at com.nokia.mid.impl.isa.ui.MIDletManager.activateMIDlet(+10) + at com.nokia.mid.impl.isa.ui.MIDletManager.run(+15) +``` + + +## Conclusions about code implementations and ways to patch/get around ## + + * _cldc11.jar/com/nokia/mid/impl/isa/io/protocol/external/nfc/MFManufacturerBlockImpl.class_ **possibly looks like**: +``` +public void write(MFKey key, byte src[], int dstOffset) +{ + throw new MFStandardException(0); +} + +public void write(MFKey key, byte src[], int srcOffset, int length, int dstOffset) +{ + throw new MFStandardException(0); +} + +public void writeValue(MFKey key, MFValue newValue) +{ + throw new MFStandardException(0); +} +``` + + * _cldc11.jar/com/nokia/mid/impl/isa/io/protocol/external/nfc/MFStandardConnectionImpl.class_ **possibly looks like**: +``` +public MFBlock getBlock(int blockIndex) +{ + // Some code + + if(blockIndex < 0 || blockIndex >= getBlockCount()) + throw new IllegalArgumentException("Invalid block index"); + + // Some code + + /* Need the below patched out. JVM opcode equivalent is: + * + * 22. iload_1 + * 23. ifne 31 (+8) + * 26. aload_0 + * 27. invokevirtual #17 + * 30. areturn + * + * Use BCEL from Apache to change bytecode of the class file. + */ + if(blockIndex == 0) + return manufacturerBlock; // implements the above restricted MfManufacturerBlock interface + + // Some code + + return normalBlock; // Implements the normal data block, non-restrictive MFBlock +} + +public MFSector getSector(int sectorIndex) +{ + if(sectorIndex < 0 || sectorIndex >= getSectorCount()) + throw new IllegalArgumentException("Invalid sector index"); + else + return new someMFSectorConstructor(); +} + +public void write(MFKey key, byte src[], int srcOffset, int length, int dstOffset) +{ + // Some code + + if(dstOffset % 16 != 0 || length % 16 != 0) + { + // Some codef + while(someCondition) + { + currentBlockIndex = getCurrentBlockToWrite(); + + if (currentBlockIndex == 0) + throw new MFStandardException(0); + } + } + + // Some other code, where no check for block index 0 is made, so sector0's write(keya, bytes, offset_0) goes thru +} +``` + + +## Patching the cldc11.jar in the SDK and test the emulator ## + + * Check out this book for techniques _"Covert Java: Techniques for Decompiling, Patching, and Reverse Engineering"_ (http://www.amazon.com/Covert-Java-Techniques-Decompiling-Engineering/dp/0672326388) + + * Possible approaches: + 1. Directly patch the needed class files and update them in the cldc11.jar of the SDK/emulator – not easy, but preferable + 1. Recompile needed classes and update them in cldc11.jar – seems easier, but not preferable since the decompiled sources are not 100% trustworthy, it is not very easy to compile them back and/or preserving unpatched functionality intact + + * TODO list of patching/recompilation for the SDK: + 1. _cldc11.jar/com/nokia/mid/impl/isa/io/protocol/external/nfc/MFManufacturerBlockImpl.class_ - instead of throwing an exception on write(), to call super.write() + 1. _cldc11.jar/com/nokia/mid/impl/isa/io/protocol/external/nfc/ MFStandardConnectionImpl.class_ - in getBlock() method instead of returning a MFManufacturerBlock class in case of block 0, just remove that “if() return;” statement + 1. _Unlock\_Midlet.jar_ - Is obfuscated, maybe some juicy things are there which might give some insight for exploitation, since this midlet somehow accesses at low-level the Mifare Classic and Secure Smart Card elements, resetting the keys for Mifare Classic and doing some other certificates/keys nasty things + + +## Patching the cldc11.jar in the Nokia 6131/6212 device and test ## + + * As far as I know from a GSM tech guy, getting to filesystem and files is not very easy – please let me know if you know how to access and/or patch/replace cdlc11.jar on a physical device (JTAG, other techniques) + * As far as I know from a GSM tech guy, the flash is encrypted and possibly signed by Nokia, so preparing an already-patched flash (i.e. a flash memory dump with an already patched cldc11.jar and/or other files as required) is a bit of a problem (not to say pain in the arse) – please let me know if you know an exploit in the chain of trust of software booting and loading of these (wish these 6131 and 6212 had the same hype as iPhone :) ) + + +## Open items ## + + * In case of physical unlock with Unlock\_Midlet.jar, does the UID of Mifare Classic element changes? + * In case of software upgrade/downgrade using “PC Nokia Suite” or JTAG reflash in GSM service centers, does the UID of Mifare Classic element changes? + * What is the hardware chip (and it’s specifications) that emulates/implements Mifare Classic and Secure Smart Card elements in Nokia 6131/Nokia 6212? + + +# Mifare Classic 100% SoftTag Emulation – using iCarte adapter with an iPhone # + + * Possibly is achievable using low-level UNIX programming and given iCarte is “exploitable” for this + * TODO + 1. Need some detailed specs for iCarte hardware design, API/SDK design, etc. + 1. Need some dissected iCarte (pictures from someone else also might give some insights on implementation) + * Exploit vectors + 1. Unknown. Anyone? + +# Mifare Classic 100% SoftTag Emulation – using MiKeyCard # + + * Main project page: http://www.mikeycard.org/ + * Another **promising direction** + * It's good that project is open-source/open-hardware project + * It's good it has smart guys' support + * Need a testing version of hardware to play with + * Sort of resembling Proxmark3, though have specific usage direction + +# Mifare Classic 100% SoftTag Emulation – using OpenPCD # + + * Also a promising direction + * Not much information gathered on the progress of emulation though + * Some demo video: + \ No newline at end of file diff --git a/MifareClassicKnownCardsDataFormat.md b/MifareClassicKnownCardsDataFormat.md new file mode 100644 index 0000000..37319db --- /dev/null +++ b/MifareClassicKnownCardsDataFormat.md @@ -0,0 +1,42 @@ +# Introduction # + +Summarizes known/publicly implemented Mifare Classic cards - default keys, data storage format, known-plaintexts on card, etc. + + +# How to contribute # + +If you legally own a publicly available Mifare Classic card, which **is not** listed here or which you think **is more accurate/updated** than presented one, we would like to hear from you. + +Please DO NOT contribute: + * private card dumps (examples: office building, fitness centers, etc.) + * card dumps which do not legally belong to you (examples: a test dump made by a friend on your computer, dump you made from your friend's card, etc.) + + +# Legal disclaimer # + +This information is presented in good faith and for informational purposes only. It is not intended to disclose private/sensitive information nor to affect in any other ways holders or issuers of such publicly available cards. The information is gathered from personally and legally owned cards. The information presented here is intended to raise awareness to the possible security threats and privacy implications when using Mifare Classic cards. + + +# Details # + +| **Country** | **City** | **Card Name** | **Estimated number (date)** | **URL/Photo** | **Card type** | **Default keys** | **Reused keys patterns** | **Data format** | **Known plain-text** | **Risk level** | +|:------------|:---------|:--------------|:----------------------------|:--------------|:--------------|:-----------------|:-------------------------|:----------------|:---------------------|:---------------| +| Romania | Bucharest | RATB SAT Card Activ | ? | http://card.ratb.ro/

+ + + + + + + + + + +
1K None Sector_0_A=Sector_1_A
Sector_0_B=Sector_1_B 		Unknown
encoded/mangled/in-house crypto?
encrypted?
block/stream cipher? 		0xFF sequences in blocks: 1, 2, 32, 33, 34, 36, 37, 38 low
Romania Timisoara RATT Acces Card ? http://www.ratt.ro/taxare/
 ?K ? ? ? ? ?
Bulgaria Sofia SKGT ? http://www.skgt-bg.com/index_en.htm
 4K FFzzzzzzzzzz
A0zzzzzzzzzz 		Default keys heavily reused
Sector_5_A=Sector_6_A 		Sector 1 (administration code 0x00 0x04) contain card holder information (Run-Length-Encoded)
Sector 2 contain card publisher information (code 0x00, 0x15)
Sector 3 electronic purse, city traffic
These sectors do not change during card usage
Sector 4 Block 0,1 = unknown data
Sector 4 Block 2 = last travel
Example: 00 04 00 01 01 00 e1 05 58 12 c2 00 00 70 00 93
00 04 = line number 4
05 e1 (hex) = 1505 (dec) = car number
00 c2 12 58 (hex) = 1100 0010 00 01 0010 0101 1000 (bin), lower 14 bits = number of days since 01.01.1997, higher bits = number of minutes since the start of the day
Sector 5 Block 0,1 = Value blocks 		Hex password for last sector key B represents string "SofiaM" HIGH
U.K. London Oyster card ? https://oyster.tfl.gov.uk/oyster/entry.do

 1K None None Unknown
encoded/mangled/in-house crypto?
encrypted?
block/stream cipher? 		0xFF sequences in blocks: 2, 17, 56, 57, 58, 60, 61, 62
"–ABCDEFGHIJKLM" string at block 1 		.
Netherlands Amsterdam OV Chipkaart ? http://www.ov-chipkaart.nl/
 ? ? ? ? ? .
Taiwan Taipei EasyCard 18.2 millions (Apr 2010) http://www.trtc.com.tw/
 1K ? ? Unknown
encoded/mangled/in-house crypto?
encrypted?
block/stream cipher? 		? .
Czech Czech Technical University in Prague, Institute of Chemical Technology Prague Student CVUT/VSCHT Card ? http://www.techlib.cz/en/customer-account/registration/id-cards-of-cvut-and-vscht/ 1K FFzzzzzzzzzz Sectors 0 to 3 have equal key A
Sectors 0 to 3 have equal key B 		Cleartext
Block1 = National ID (?)
Block2 = Passport No (?)
Block4 = Name (space padded)
Block5 = Surname (space padded)
Block8 = Valability (?) in format DD.MM.YYYY
Block12/13 = Telephone numbers (?) 		None HIGH
Czech Czech Czech ISIC Card ? http://www.isic.cz/ 1K FFzzzzzzzzzz None Cleartext (?)
Block4 = some kind of serial number 		None HIGH
Czech Liberec Liberec City Card ? http://www.mikroelektronika.cz/custom-made-electronics/novinky
http://www.mucl.cz/mestska-autobusova-doprava/opuscard/karta-opuscard.html 		4K A0zzzzzzzzzz Block 0x5F to 0xFF have equal key A
Block 0x5F to 0xFF have equal key B 		Partially cleartext
Block4 = Surname Name (seem null terminated C strings)
Rest encoded/encrypted (?) 		Block 1 and 2 = lots of every second byte is 0x18 MEDIUM
Luxembourg Luxembourg Luxembourg (Public Transport) Card ? ? 1K FFzzzzzzzzzz Block 0x00 to 0x33 have equal key A
Block 0x00 to 0x33 have equal key B 		Encoded, seems no encryption or dynamic keys Block 0x34, 0x35, 0x36, 0x38, 0x39, 03a, 0x3c, 0x3d, 0x3e = filled with 0xFF MEDIUM
Russia Moscow Бесконтактные транспортные карты 5-30 millions (1998-2007) http://www.metro.ru/fare/contactless/ ?K ? ? ? ? ?
Russia Russia Rossiyskie Zheleznye Dorogi/Russian Railways (RZhD) ? Forum notes
News notes 		? ? ? ? ? ?
+ + + +

Links

+http://www.dib.com.br/dib%20cd/C2007/Palestras/Palestra%20Francimar%20Santos%20Cards%202007.pdf
+http://www.skyscrapercity.com/showthread.php?p=39116178
+http://www.ratt.ro/forum/index.php?showtopic=157&st=0
\ No newline at end of file diff --git a/ProjectHome.md b/ProjectHome.md new file mode 100644 index 0000000..f87d28f --- /dev/null +++ b/ProjectHome.md @@ -0,0 +1,90 @@ +**IMPORTANT: Due to constant lack of time, I (Andrei Costin) cannot support/maintain this project. If there is any volunteer to maintain/develop, please contact me or leave a message on libnfc's forum.** + +**M**_FCUK_ - `MiFare Classic Universal toolKit` + + + + + +Toolkit containing samples and various tools based on and around libnfc and crapto1, with emphasis on Mifare Classic NXP/Philips RFID cards.
+
+Special emphasis of the toolkit is on the following:
+ + +
+Wishlist for next version: + + +More of research type long-term activity (any volunteers :)?):
+ + +
+ +PACKAGE HISTORY:
+ + +
+ +IMPORTANT NOTICE - would greatly appreciate if someone can donate (even used, smashed, but still programmable) things below:
+ + +These things are aimed to research, implement the 100% software emulation of Mifare Classic Cards (including UID) and release it open-source under GPL.
+
+Please contact zveriu through my zveriu's blog regarding donations.
+
+ +DISCLAIMER - The information and reference implementation source/binary contained herein is provided:
+
+ + + +

Contacts

+ +

Andrei

+ +Andrei Costin - mailto:zveriu@gmail.com + +http://andreicostin.com + +http://code.google.com/p/mfcuk/ + +

Nethemba Team

+ +mailto:mifare@nethemba.com + +Pavol Luptak - mailto:pavol.luptak@nethemba.com + +Norbert Szetei - mailto:norbert.szetei@nethemba.com + +http://nethemba.com + +

Papers

+ +http://eprint.iacr.org/2009/137.pdf + +http://www.cs.ru.nl/~petervr/web/papers/grvw_2009_pickpocket.pdf + +

Links

+ +http://www.mikeycard.org + +http://www.libnfc.org forum
+
+http://www.proxmark.org forum \ No newline at end of file