yashsingh1/xdaforums huggingface dataset:
[Samsung Galaxy Nexus] pukemon:
Exactly what im talking about. Do you thonk your building management or x corporation is going to say suuuure let us put that on your phone so easily and skip all the other security that needs to go along with that now since it is now digitally accessible on an easy to hack phone? Get a grip. I have 4 badges and about 30+ keys and and about 15 elevator access keys. If a badge or certain key is lost you gotta thrlugh procedures. Hopefully nothing that involves gloves but still. If a certain key is lost all the locks gotta get changed if a badge is lost or cloned, a badge can be deactivated but if theyre constantly being cloned, manipulated or bypassed then other/greater security measures have to be used or taken out. So no i dont want a stinking badge on any of my phones.

Sent from my samsung gt i9250 which is in the wrong country.
[Samsung Galaxy Nexus] samizad:
You are surely correct. I am speaking about SG2s distributed within South Korea (where I am currently working) and, being a captive market, Samsung can easily adapt the Korean Touchwiz (or even the hardware of the Korean SG2s) to make it possible.

Actually, I have confirmed with people that the public transport NFC is not working with the SG2 but rather with the USim card (integrated NFC) that is given to them via SK Telecom and KT Telecom etc).
[Samsung Galaxy Nexus] gambiting:
My Nexus can read my university's smart card without any trouble(using NFC TagInfo). And I use it to open doors to rooms with restricted access. So I guess it would be possible to emulate it,but I have no idea how to do this.
[Samsung Galaxy Nexus] chandlerweb:
So how did you get your phone to open doors etc, did you have to ask your security team to enable something on the phone?
[Samsung Galaxy Nexus] krohnjw:
I believe he's referring to the fact that the card is used to open secure doors.
[Samsung Galaxy Nexus] Evostance:
It reads mine too and mine has a pin. Might try and test it tomorrow at work
[Samsung Galaxy Nexus] gambiting:
Yes, I meant that I use my card to open doors, not my phone :P
[Samsung Galaxy Nexus] indivisualist:
Did I understand that right: My Galaxy Nexus can read/write some NFC-Tags, but due to the lack of software protocols has no access to all of them?

I'm quite interested in NFC technology, so naturally I tested an ID card (was recognized) and my chip for the time tracking in the office (was not recognized, but is 13.56 MHz). So my question is – is this "just" a software issue or are there hardware limitations?
[Samsung Galaxy Nexus] :
Not true. Well maybe it is with paywave but I have a paypass card and can easily pull the info off of it using NFC on my Nexus. This technology was broken long ago (please Google it if you don't believe - I can't post links). Same with my RFID Enabled Debit card (Visa Debit - I think it's paywave).

On topic -

I am sure this will be done sooner or later. The phone can store data in the "secure element" and can emulate an NFC Tag. So maybe that could be used via an app to send an authorization key. Not exactly what you are looking for but RFID is still insecure. It is so easy to clone the encrypted data and broadcast it to the receiver (Many whitepapers on this), So I am still baffled to why people use it. RFID cards provide less overall security than a simple lock.

---------- Post added at 08:01 PM ---------- Previous post was at 07:44 PM ----------

I know that there is an app in the market that allows reading of paypass/paywave cards. They don't use standard NDEF responses so that's one example. I don't know about the cards the OP mentioned but I just tried with an RFID Smart Card I had and it doesn't recognize it. The freq. is the same but it doesn't use NDEF AFAIK. The best place to start would be using a computer with an RFID/NFC kit to see whats on the card. I know tag stand sells them. You can use the computer to do RAW reads/writes of the tags where as a phone can not (unless someone builds support for it).

(I can't edit posts yet sorry)
[Samsung Galaxy Nexus] indivisualist:
I still don't get the limitation – is it a hardware problem (e.g. "there is a special encryption chip missing") or a software thing (e.g. "there is no support for other stuff than NDEF")? In my understanding there is an antenna, a chip for accessing it and some NFC drivers so some stuff is possible … but why not everything?

Could you hint me to those whitepapers you mentioned? Feel free to PM me if preferred. :)

As already mentioned, I think NFC is very interesting. But if the security is flawed it is of little use for interesting stuff like NFC payments or authentication …
[Samsung Galaxy Nexus] Natolx:
The phone is unable to read my phones HID Identity card
[Samsung Galaxy Nexus] geemaan:
My phone can read my ski card here in Soelden, Austria.
[Samsung Galaxy Nexus] DarkCanuck:
How are you reading your cards? Is there an app that I can try this with?
[Samsung Galaxy Nexus] :
RSA Finds RFID to be flawed

Speedpass (Similar to PayPass) is shown vulnerable

and #2 From above link

These show how weak RFID cards are. They are great for convenience but not for security. NFC is more secure on the phone side of things. For example with Google wallet since NFC is ONLY on when you are paying you don't need to worry as much. PayPass cards are (in essence) always on. So anyone with a $20 high gain antenna and the proper equipment (Paypass reader) can read your card with in 30M.

For a demo of how you CAN read this data look in the market for an app called:

NFC Reader Demo Tap it to you PayPass or Paywave card and it will pull your visa/debit number right off of it.

With Credit cards it's worse because it pulls the FULL number and Security code enough for anyone to do online transaction OR clone your card.

Back to NFC now:

By default the Android only looks for Standard NDEF responses BUT if you use their API in an app you can make custom (non-standard) ones that "link" to your app. I.E if you made an NDEF Response called "Test" the phone would launch your app when it sees that NDEF response. So you can really make it accept any NDEF response using the API's. You would just have to make an app link to that response and than be able to understand the data. PayPass and PayWave both run on the same Frequency as NFC and neither transmit data securely. The data is Encrypted on the card but is sent OTA in plain text. Some new ones are encrypted but poorly. The same issues exist with Chip and Pin (you just need the card in hand).

EDIT: I haven't seen it yet, but it should be possible using the API's to allow android to do RAW reads of NFC tags. I know you can do it with a PC, Android may be more difficult but I am sure it could be down.
[Samsung Galaxy Nexus] indivisualist:
Thanks a lot!

I'll have a look at the links, but from skimming this already looks very interesting.

Regarding the raw NFC tag reading: That's what I already had in mind. Maybe I'll start working on a demo application … if the system is unsafe and the public is aware of that, it will hopefully be hardened so we can see some interesting (and secure!) NFC applications. :)
[Samsung Galaxy Nexus] geemaan:
oh, it's just raw reading with NFC TagInfo from ResearchLab Hagenberg and NXP TagInfo. The latter correctly identified the card as a Ski pass.
[Samsung Galaxy Nexus] :
The main issue is even if the data cannot be decrypted. The encrypted data can still be read (RAW read) and written (RAW Write) to another tag/card. This effectively clones the tag/card making cracking the encrypt unnecessary. Why crack it when you can just clone it and make a working copy?

Until there is some encrypted (SSL maybe?) communication between tags and readers I wont be using PayPass/PayWave. At least with Google Wallet it is off when the phone is locked.
[Samsung Galaxy Nexus] TEK112:
Door access cards are linked to a user profile, whether they have the card or the phone, it is still linked to their account. If the phone or card is lost they would still deactivate it the way they always have. Plus, if the phone is password protected, it is even more secure that an access card which all of the greatest action movies of all time exploit the ease of stealing and using. Plus, security systems have a time access that searches simultaneous access or random access threats, just like credit card companies monitor your spending habits. Irregular activity would be flagged and the account suspended until the user explained.

Honestly, it is more secure to have it on a locked phone than a lanyard.
[Samsung Galaxy Nexus] indivisualist:
Exactly – this is why I'm a bit worried about the whole thing. I found two interesting videos about NFC (and security):

http://www.youtube.com/watch?v=49L7z3rxz4Q

http://www.youtube.com/watch?v=66jdJBBUzkI

The protocol is per default unencrypted, the "security" seems to depend on the very low power transmission and the close proximity. Yeah … say hello to my parabolic antenna.

To make it secure, the content of the transfer has to be encrypted in some way without modifying the "envelope" for compatibility reasons. Something like PGP for emails.
[Samsung Galaxy Nexus] mutelight:
This is how my company's security works as well and I would love to have it built into my phone. Badge into my areas, the gym, pay for my lunch, etc.

It would be great!
[Samsung Galaxy Nexus] kjwalker:
Anyone have any luck reading HID cards? I cannot, and saw one other user mention the same.
[Samsung Galaxy Nexus] :
Exactly. The same thing happened when PayPass first came out; Some guy bought a paypass reader on Ebay for $100 wired a high-gain antennae onto it and Viola he could sniff the cards within 30 metres. Now a days it can be done up to 300m (Line of Sight).

This is why I am buying a RFID blocking credit card holder :D But as I said at least with cell phones it only broadcasts when you tell it too. That does add some security (albeit through obscurity).
[Samsung Galaxy Nexus] slickromeo:
i'm interested in what this person said.

Why can't an app copy the encrypted output of an RFID tag? and keep it encrypted without decrypting it?

and then transmit that encrypted data on command to a reader, or copy it for storage?
[Samsung Galaxy Nexus] Evangelion01:
It should indeed be possible to copy the encrypted data, by taking a dump of the card.

However, transmitting the data back to the reader would, I believe, require card emulation from the phone. Google doesn't enable/allow card emulation in Android, except for in Google Wallet. So I don't know if we'd be able to send that data to the reader and imitate a RFID card from the phone.
[Samsung Galaxy Nexus] slickromeo:
I dont understand the difference between emulating a card, and simply transmitting NFC data.

so you mention that copying encrypted data is possible.

so therefore, why not simply transmit the encrypted data instead of "emulating" a card.

there are apps out there, such as 'NFC TagWriter by NXP' which can transmit NFC data.

so why not create a "dumb" app that transmits copied encrypted data.

---------- Post added at 11:32 AM ---------- Previous post was at 11:24 AM ----------

the app "NFC Classic Tag Reader Writer" in the android market has a user review which states "works fantastically, allows me to emulate my university ID card. printing from my phone and building access.. all flawless galaxy nexus" -andew
[Samsung Galaxy Nexus] ceribaen:
Just out of curiousity... saw this thread and got curious of course about my cards. Never really did anything with NFC before and don't know anyone else with a Nexus to have played with Android Beam.

But is the basic process:

1. Enable NFC on phone.

2. Install an NFC taginfo app (NFC Taginfo by Research Labs or TagInfo by NXP for example)

3. Open app.

4. Put card near phone

5. It should then scan it and display info

Or am I missing a step somewhere? Curious because nothing seems to happen when I try. So curious if I have a hardware problem or missing a step.
[Samsung Galaxy Nexus] slickromeo:
try the "electronic pickpocket RFID" app
[Samsung Galaxy Nexus] cabagekiller:
Does anyone know if NFC can emulate PEDs(personal entry devices) that some universities use? I know it is RFID but not positive as to the frequency of it.
[Samsung Galaxy Nexus] Evangelion01:
From what I understand, using your phone as a card with existing infrastructure requires it to be in card emulation mode - this is the case when using Google Wallet with the sales terminals.

Transmitting the data might work, but I have no idea about that.

That user review is indeed very interesting. I'll test that out and report back at some point next week.

---------- Post added at 05:31 PM ---------- Previous post was at 04:59 PM ----------

Well, I just tried emulating a tag but it doesn't seem to work? Could someone else try and confirm?

The developer of the application is a member of XDA, but hasn't been online for nine days.
[Samsung Galaxy Nexus] smicbee:
i also tried in university to copy the card and emulate it again. without success. we will need card emulation mode for it i think.
[Samsung Galaxy Nexus] Wilsonium:
OK... not my area of expertise...

However, I believe part of the problem is the phone needs to know how to respond to a request. Android does support NFC P2P which I believe is what enables this kind of building access. There are companies already that have access systems that are compatible with Android NFC phones.
[Samsung Galaxy Nexus] dartho:
RFID protocols can have a challenge and response system which is where simply emulating a card does not work, the correct responses must be sent to the card before it gives up it's payload - you'd need an app specifically for the job which knows what to do. These types of cards may have value stored on them, but are more likely just the equivalent of a secure key which provides authorisation.

There are instances where RFID cards are used merely as a way of storing, and when needed (ie holding card up to reader) transmitting, a serial number, which would usually then be checked against a database by the authorisation system. Ultimately no smarter than a mag stripe on your credit card or a barcode. RFID cards encoded in this manner could be copied and emulated. These types of cards have no value stored on them.

Ed: BTW - I'm no expert, just a little, little bit of experience. Since found this: https://groups.google.com/group/android-developers/browse_thread/thread/418c9b370f08a9f7 which may give you more accurate answers
[Samsung Galaxy Nexus] jazmatician:
You clearly have no idea what you're talking about. An RFID badge is just a number incorporated into a physical object. The number is the important thing, not the object. If you lose the badge, they just deactivate that number & issue you a new badge with a new number embedded in it. If you're fired for your moronity or incompetence (I'm sure that's happened to you a number of times) they deactivate the number in the system, they don't care if you turn in the badge or not.

In short, there is little to fear from your employees making a copy of the badge number & emulating it with their phone.
[Samsung Galaxy Nexus] fuimeng:
talking abt emulate RFID for access control system like uni,apartment n etc...

apparently NFC in Android phone is using 13.56Mhz HF (high freq), (so no hope for those people if their staying place is using 13.56Mhz)

wherelse most of the access control system are using 125khz LF (low freq), ive been told some places already implementing 13.56Mhz HF for their access control system (for more security purpose?..i suppose)

n there is actually many types of IC read at both freq.

i've been looking/reading/finding thread like emulate RFID in Android phone for home/uni/etc access control system,and i couldnt find much info for it.

im doing this becoz my apartment only allow to have 2 proximity card but i have more than 5 members staying together...so its quite a trouble when im coming back late from work/party.

i end up.....get a RFID reader/writter from ebay...and duplicate them for my family member...also make sure u buy the right freq if u plan to get a RFID reader/writter.
[Samsung Galaxy Nexus] Dri94:
4badges 30keys and more than 15 elevator access. . . Sooooo. your a janitor lmao... Although the corps tracking is nutjob, your point of being unsecure is true. When a card can be duplicated on the phone it ca give more than one person now access that "room". One person can say emulate it on their phone, another use the actual card. To OP, the feature would be useful but unsecure, unless a company could think of a way of registering your phone with an ID, to only allow one particular phone to do this and require and ID to be sent along rfid tag . Which would then loop around to ^soapboxguy ;) giving the company some form of access to your phone.
[Samsung Galaxy Nexus] TEK112:
I don't see what the mans job has to do with it.

Aside from that, you can duplicate an access card just the same, in fact easier if you have the equipment. As with all major businesses, it is the sole responsibility of the card owner to make sure their card is secured. Just like porting corporate exchange email to an "unsecure" phone or accessing it on a public computer, it is the user's responsibility and if a security breach occurs, they are liable.

As I said before, a locked phone is more secure than a lanyard.
[Samsung Galaxy Nexus] msk514:
Funny misconception about RFID and NFC is security. Initially both device and terminal appear to be secure with their encrypted keys and handshake. Keep in mind that they are susceptible to a replay attack. Indeed the approach of cloning the said device (card) is not the best nor easiest approach, and is unnecessary. Essentially what you wamt to do is capture the entire handshake and save it so you can replay it later to generate the same response from stimulus. This method is not new in any way, and is incredibly easy to implement.
[Samsung Galaxy Nexus] Mach3.2:
Card emulation requires access to the secure element, either on device or on the sim card........................................

For the sim card secure element to work on a gnex, you will have to "merge" a API so that the phone can use the secure element.................................................
[Samsung Galaxy Nexus] TEK112:
Ahhhhhhhhh.... zombie thread!
[Samsung Galaxy Nexus] FrodoBaggins08:
Well I just tried that nfc reader demo you mentioned.

Worked perfectly. Read my credit card number and expiry date. Awesome.

Then I thought to myself oh cr@p. That app has now probably sent all those perfectly read nfc fields and info off to China somewhere.! What an idiot I am !

Credit card now cancelled ! Oops
[Samsung Galaxy Nexus] coldmow:
so it is possible to copy the encrypted data to an nfc tag?
[Samsung Galaxy Nexus] msk514:
just capture the handshake and do a replay attack with the data captured. no need to "copy" the nfc tag
[Samsung Galaxy Nexus] karlschmutzwasser:
Is it possible that there are various types of contactless id cards? I tried reading mine with this app, but I couldnt get access to any data.

It is a new mastercard creditcard, so maybe they secured it more in the latest cards
[Samsung Galaxy Nexus] msk514:
you might be able to capture any of the data, some apps are pretty closed in what sets of data you can capture. while it's really neat to do it on your phone, there are pc software suites which are far more suited for this type of activity. you (in theory) can probably do this by using linux on your phone, and should it be properly configured, capture handshakes or copy tags as you please (there are a lot of rfid apps for linux).

however... bottom line, as a consumer - if your credit cards get duped or charged without your auth, who cares... you're not held liable for any of these charges. it might be "more secure" for a little while, but this is always a game of cat and mouse.
[Samsung Galaxy Nexus] arutazzaps:
Any news?

Inviato dal mio Nexus 5 utilizzando Tapatalk
[Samsung Galaxy Nexus] ZakBrindle:
Been a while, any updates with this, would love to replace this university ID and just use my OnePlus One.

My ID has a wireless icon on it which made me think, would this work

[IMG="Contactless Icon"]http://i.gyazo.com/f0a009573d7e3e86790b972f3f09969b.png[/IMG]
[Samsung Galaxy Nexus] Sisyfos42:
Well, there is a hack. It does not actually copy anything, but just embeds some rfid tags into phone casing.

hackaday.com/2014/06/15/simple-hack-puts-an-rfid-tag-inside-your-mobile-phone/
[Samsung Galaxy Nexus] Bobakanoosh:
HID Proximity

I've been looking into this for about a week now, because a co-worker mentioned something about scanning his HID proximity badge on his phone and using his smart watch to get in the building! I would LOVE this, and I KNOW it's possible, because he showed me! But when I asked him about the app, he pointed me to this website, and told me I could download the ADK from here. False... I can't find jack on her about any app that will help me get into the building without my badge. So what's up with that? Is this guy (who makes 9/hr) secretly a super hacker? Or do they just make it that hard to find? lol I would really appreciate any help finding this app! I'm getting tired of banging on the door any time I forget my badge!

Thanks!

Bob
[Samsung Galaxy Nexus] plskillme:
I'd love to have this too.
[Samsung Galaxy Nexus] PGHammer:
It's not that Google Wallet OR Samsung Pay won't work with a Galaxy Nexus, either; both do (and entirely because of the NFC support). The problem is that neither work on rooted devices - and there are way too many USES that require root (such as third-party recoveries like TWRP installation). Until the no-root requirement (this includes systemless root) goes away, we will have to choose between Android/Samsung Pay and root.
[Samsung Galaxy Nexus] Gizmo45:
Bumping this blast from the past again.

My office is using RFID tags for building access. With NFC enabled on my Galaxy S7, I'm able to have the card reader on the door recognize my phone when I use it. This tells me that our system is using a high frequency reader, so that's half the battle.

The other half is the access control software that we use on the back end. It appears that every time I scan, I can see the card number that registers in the access control software is different, just like a rolling code. I am assuming that this is some sort of encryption that NFC is using, but I'm not certain. Is there still no way to emulate a card, or no way to set a static card ID? RFID reader apps on my phone work, but I don't have a way to save and re-use them in anyway.
[Samsung Galaxy Nexus] amzoa:
Bumping too...

I need to know the answer to this as well, It is interesting because I think even with NFC cards the data can be read but I do not think it can be emulated due to the encryption on them. I have tested this with my university smart card and no avail.
[Samsung Galaxy Nexus] NeedleGames:
Helooooo
[Samsung Galaxy Nexus] domaniqs:
copy RFID cards to NFC enabled phone

BUMP of an old thread as I think this would simplify life of many people having to carry car park cards, staff cards all sort of cards along with their banking cards. If the phone software is called a "wallet", make it a real wallet.
[Samsung Galaxy Nexus] cipherswitch:
Bumping an old thread but any google search ends up back here anyway.

I personally use a GS3 Frontier to get in and out of my office. While it is true that the ID of the watch changes with every scan, if you turn on Samsung pay, the ID is the same every time. So I usually walk up to the door, tap the Samsung pay button on the watch and scan on the card reader - works like a charm.

I installed and manage the access control for my office, so this is all verifiable fact.

Here's my fat hand:
[Samsung Galaxy Nexus] siraitisme:
how did you do that?

i've try all available NFC card emulator (example: NFC Tools - Pro Edition, etc.), but none of them were able to help me.

All of the available software, were only able to read my access card, but unable to re-use it.