Summary
This video compares the Proxmark3 and HydraNFC v2 for sniffing NFC communications. It highlights the limitations of Proxmark3, such as slow speed and potential for incomplete captures, especially with complex interactions like authentication. The HydraNFC v2, when paired with a logic analyzer and RF Swift, offers real-time debugging, detailed frame analysis, and a clearer view of the communication, making it a more robust tool for NFC security assessments and development.
Key Insights
Proxmark3 is slow for full NFC frame capture, leading to potential errors.
The Proxmark3 is commonly used for sniffing, but it is considered too slow for capturing all frames reliably, which can result in errors during the process.
HydraNFC v2 offers real-time NFC sniffing and debugging.
The HydraNFC v2 is presented as an upgraded tool that excels at real-time sniffing, allowing users to see and debug frames, timeouts, and other communication aspects between an NFC reader and tag.
HydraNFC v2 offers superior real-time visualization and decoding capabilities.
The HydraNFC v2, combined with a logic analyzer and tools like Pulseview or DSView, provides a much clearer and real-time view of NFC communication compared to Proxmark3. It allows for detailed inspection of decoded bits, packet structure, and communication timing.
HydraNFC v2 paired with HydraBUS enables advanced debugging and attacks on NFC crypto.
The combination of HydraBUS and HydraNFC v2 represents a significant advancement for NFC measurements, debugging, and security analysis. It allows for detailed study of communications, like MIFARE DESFIRE (even if plug-ins are not yet available, implementations are possible), and facilitates attacks on NFC cryptography.
Sections
Introduction to NFC Sniffing Challenges
NFC sniffing can be difficult, often requiring devices to be physically between the tag and reader.
The presenter introduces the challenge of sniffing NFC (Near Field Communication) traffic, noting that it's not always straightforward and can require being physically positioned between the NFC tag and the reader. Tools like Proxmark are mentioned, but their success rate for capturing all communication frames is not 100%.
Flipper Zero lacks native NFC sniffing capabilities.
The Flipper Zero, a popular hacking tool, is discussed. While it's versatile for various RFID attacks (LF and HF) and has a convenient form factor, it does not natively support NFC sniffing. For this purpose, other tools are needed.
Proxmark3 is slow for full NFC frame capture, leading to potential errors.
The Proxmark3 is commonly used for sniffing, but it is considered too slow for capturing all frames reliably, which can result in errors during the process.
HydraNFC v2 offers real-time NFC sniffing and debugging.
The HydraNFC v2 is presented as an upgraded tool that excels at real-time sniffing, allowing users to see and debug frames, timeouts, and other communication aspects between an NFC reader and tag.
HydraBUS is a versatile tool for interfacing with many protocols.
The HydraBUS is mentioned as a powerful tool for interfacing with numerous protocols, often used in conjunction with the HydraNFC.
Proxmark3 NFC Sniffing Demo and Limitations
Setup involves Proxmark3, a blank MIFARE Classic card, and a phone as a reader.
The demonstration of Proxmark3 sniffing uses a Proxmark 3 RDV4, a blank MIFARE Classic card with default keys, and a smartphone acting as the NFC reader to capture the exchange between the phone and the card.
RF Swift is used to manage tools and containers for the Proxmark.
RF Swift is utilized to conveniently manage tools and running environments (containers) for the Proxmark 3, ensuring the latest RFID image is used and TTY bindings (e.g., /dev/ttyACM0, /dev/ttyACM1) are correctly configured within the container for the Proxmark device.
Proxmark3's HF 14a sniff command captures communication, but results can be unreliable.
The Proxmark3 is put into 'sniff' mode using the 'hf 14a sniff' command to capture communication. The captured data is then listed using 'hf 14a list'.
Captured data with Proxmark3 shows partial or unclear authentication attempts.
The output from Proxmark3 sniffing shows frames like 'select UID', but also includes indications of writing attempts (e.g., 'writing block 50') which are unusual. Authentication attempts ('Auth with key A', 'Auth with key B') are present but partial, suggesting incomplete or erroneous capture.
Using Proxmark3's sniffed data for recovery tools like mfkey can be problematic.
Attempting to use tools like 'mfkey' from the Proxmark repository with the sniffed data, including provided UIDs and nonces, proves difficult. The captured data is described as 'garbage', and recovering keys requires multiple attempts ('sniffs') or luck, depending heavily on range and positioning.
Proxmark3 struggles with debugging timeouts and providing clear communication logs.
The presenter notes that debugging issues like timeouts would be very difficult with Proxmark3 due to its limitations in capturing and presenting communication data clearly. The process can be time-consuming and success is not guaranteed.
Recovering keys with Proxmark3 requires manual effort and often multiple attempts.
After several attempts and using the 'mfkey64' tool with a manually extracted UID and relevant nonces from a 'partially good' capture, a key is finally recovered. The presenter acknowledges being lucky to get a complete conversation in a few tries, implying it often takes much longer.
HydraNFC v2 Real-time Sniffing and Analysis
HydraNFC v2 setup requires a logic analyzer and RF Swift's hardware container.
The setup for HydraNFC v2 sniffing involves connecting it to a logic analyzer (compatible with Pulseview/DSView), grounding a pin, and connecting the CSO pin. The HydraNFC is put into debug sniff mode via HydraBUS, and a separate 'hardware' container is instantiated in RF Swift.
Logic analyzer data is captured and decoded using RF Swift's plugins.
Data from the logic analyzer (e.g., DSLogic) is streamed and then decoded using the HydraNFC decoder plugin within RF Swift. This provides a real-time view of the communication, allowing analysis of frames, select commands, and authentication attempts.
HydraNFC v2 offers superior real-time visualization and decoding capabilities.
The HydraNFC v2, combined with a logic analyzer and tools like Pulseview or DSView, provides a much clearer and real-time view of NFC communication compared to Proxmark3. It allows for detailed inspection of decoded bits, packet structure, and communication timing.
Communication data can be exported as CSV for further analysis.
The sniffed data from the logic analyzer can be saved as a CSV file, enabling further analysis in other tools or software. The process involves converting the data format if necessary (e.g., using dsl2grok for Pulseview).
Pulseview provides a lighter and more detailed view of decoded NFC traffic.
Importing the converted capture file into Pulseview (which is used by DSView) offers a more manageable and visually clear representation of the NFC communication. This includes decoded data, reader/tag responses, and encrypted data segments.
HydraNFC decoder in Pulseview allows precise channel and timeout configuration.
Within Pulseview, the HydraNFC decoder can be configured with specific channels and timeouts (e.g., 1000 microseconds) to accurately interpret the communication. The visualization clearly distinguishes between reader and tag data using different colors.
HydraNFC v2 successfully decodes complex interactions like authentication and encrypted data.
The HydraNFC v2, with its logic analyzer integration, successfully captures and decodes intricate communication steps, including authentication processes and encrypted data exchanges. This is significantly more reliable than the partial captures from Proxmark3.
The tool supports multiple NFC technologies like MIFARE Ultralight and NTAGs.
The HydraNFC v2's capabilities extend beyond MIFARE Classic, supporting other technologies such as MIFARE Ultralight and NTAGs, with potential for future expansion to all NFC technologies. The plugin architecture is open-source, allowing for community contributions and implementation of new features.
HydraNFC v2 paired with HydraBUS enables advanced debugging and attacks on NFC crypto.
The combination of HydraBUS and HydraNFC v2 represents a significant advancement for NFC measurements, debugging, and security analysis. It allows for detailed study of communications, like MIFARE DESFIRE (even if plug-ins are not yet available, implementations are possible), and facilitates attacks on NFC cryptography.
Conclusion and Future Outlook
HydraNFC v2 offers a superior, real-time approach to NFC communication analysis.
The video concludes by emphasizing that the HydraNFC v2, when used with a logic analyzer, provides a vastly improved experience for sniffing and analyzing NFC communications in real-time, capturing complete conversations that Proxmark3 often misses.
Open-source nature of tools like Pulseview encourages community contribution.
The presenter mentions that projects like Pulseview are open-source and welcomes contributions from the community to support more devices and improve features, highlighting the collaborative aspect of these tools.
Ask a Question
*Uses 1 Wisdom coin from your coin balance