Hacking NFC: NFC History, Technology and Capabilities

[Depov]

NFCGate: radio magic that breaks the boundaries of NFC


When it comes tocontactless systems – be it subway, passes, payment cards or accesscontrol systems – most users and developers perceive them asreliable and secure mechanisms. After all, the technology promises aquick and convenient way to interact without the need to insert acard or enter passwords. However, behind this smooth surface hides acomplex game of radio waves, in which not everything is so simple.Radio signals that allow maps and terminals to communicate areactually vulnerable: they can be intercepted, copied and even forged.And it was in this gray zone that the NFCGate program arose -powerful software that pushed the boundaries of the possible. Itopened a new era of radio security, demonstrating that the boundariesof the NFC are more conventional than absolute protection. Now anyonewho has the right equipment and little knowledge can bypass systemsthat used to seem almost impregnable, turning radio waves into avulnerability game tool.





Historical reference: from the first NFC games to NFCGate


The firstexperiments with NFC began in the mid-2000’s, when standards likeMIFARE and NTAG were just beginning to gain popularity. At the time,most systems used or completely used or did without it, making themvulnerable to elementary attacks. The most high-profile case was aseries of vulnerabilities in MIFARE Classic, identified in 2008. Theresearchers have shown that in a matter of minutes it is possible tocrack the keys and copy the cards, which has questioned the safety ofmillions of contactless systems around the world. These discoverieshave opened up their eyes to how weak defense mechanisms can be, andhave been the beginning of an era of radio security that requiresmore complex solutions.

Gradually, the first tools forworking with radio signals appeared - Proxmark3, Chameleon andothers. They allowed intercepting, analyzing and even cloneing NFCtraffic. At the same time, the understanding was formed that mostsystems are largely an “open book” for those who can read radiowaves. These devices have turned into real weapons for radio amateursand security professionals, opening new horizons for experiments andattacks on contactless systems. It soon became clear that in order toensure security, it is necessary not only to encrypt data, but alsoto complicate the process of their interception and analysis.

Inthe middle of the decade, in 2018, NFCGate appeared – software thathas become a new stage in the evolution of radio signals. Itscreators realized that you can not only listen and intercept signals,but also actively play with them: fake, modify and bypass any defensemechanisms. This toolkit was a turning point - now it was notnecessary to just hack the map, it was enough to imitate its work inreal time. NFCGate has opened up new capabilities for attacking andtesting systems, turning radio waves from a vulnerable point into apowerful weapon to bypass protection and create fake maps, whichradically changed the approach to radio security issues in the NFCenvironment.





Technical Base: What's Inside NFCGate


Combining everythingthat has been accumulated over the years - from cheap radio modulesto complex protocols - NFCGate has become a powerful tool based onseveral components:

• Intercept of radio signals:
  Intercepting radio signals is like a quiet whisper in the dark corridors of the digital world. Using gadgets such as ACR122U or PN532, you can easily eavesdrop on how maps and tags exchange data at a short distance. Even a smartphone in your hand is almost a mini-device for wiretapping, although its capabilities are inferior to professionals. Everything works on a wave 13.56 MHz – the same as most NFC tags, so there’s a chance to catch their secret conversations if you know where to look and how to listen. In this world of hidden signals, every moment is a chance to reveal a secret or leave your mark in the shadows.
  
• Decoding of protocols:
  Protocol decoding is like penetrating the hidden language of the machine shadow. Intercepted signals are turned into chains of APDU commands, which are essentially words and phrases in the conversations of cards and terminals. Each team is like the key to understanding what exactly is happening in the depths of the system: which map is hidden behind encryption, which commands are sent and what they require in return. Analyzing these ciphers, you can understand who is behind this, and even find vulnerabilities, like a master voil, thwarting the cover of secrecy. In this world, every transcript is like a step into a dark game, where knowledge makes you stronger and freer.
  
• Vulnerabilities analysis:
  Vulnerabilities analysis is like playing on the verge of law, where the weak point of the card becomes the key to its secrets. When encryption is pale or the keys are too simple, the program turns into a hunter that easily recognizes weak protection points. These vulnerabilities are like broken shields in battle: they can be used to copy, counterfeit or even a complete hack of the system. In this shadow world, every breach found is like a personal token of power that gives access to other people's secrets, and turning you from a random observer into a master of play undercover.
  
• Emulation and copying:
  Emulation and copying are like creating a doppelganger in a shadow who can play a role on the reality scene. The device turns into a virtual copy of the card, falsifying signals and responses, as if disguised as an original. With the help of RFID emulation - this skillful focus - fake radio signals are created that deftly deceive systems, perceiving them as real ones. In this world, counterfeiting is like art, and bypassing the defense is like playing cat-and-mouse, where each move brings closer to complete disguise, and therefore to full freedom from control.
  
• Modification of data:
  Modification of data is how to hack someone else's lock from the inside, rewrite its code and leave its traces. Not just copy, but completely rewrite the contents of the card - to change the balance, add or delete access parameters, insert your commands, as if picking up the keys to other people's systems. In this shadow world, you can become not just a deceiver, but a real master of manipulation: turning the map into an instrument of your goals, blurring the boundaries between legal and illegal, creating the illusion of authenticity where it has long been gone.

How it all works:radio shows in real numbers


Let's understandeach phase a little more detail to understand what is happening underthe hood.


1. Signal Interception - Wiretapping


The signalinterception is like a shadow that hides next to each word in theair. The device is quietly placed next to an NFC tag or map, like aninvisible observer who listens to every movement, every radiomessage. In this world of hidden technology, you can overhear themost important secrets, collect information and leave your markwithout arousing suspicion. This is a game on the verge of shadow andlight, where every listening is like a step in the dark, bringingcloser to the full picture of what is happening.

• Example:
  You have a smartphone with an NFC-reader - it seems that nothing special, but inside the power is hidden. Or a more advanced gadget - NFC sputer, which turns into a shadow that spits behind other people's cards. These devices work in the shadows, catch each signal, like secret hunters, and allow you to access the data without the owner’s knowledge. In this underground world, tools such as weapons for those who know how to play by their own rules, bypassing security systems and staying in the shadows.
  
• What is happening:
  It's like eavesdropping on a black wave, when the device hangs quietly in the shade, capturing every movement of the radio signal. The map and terminal - like two in a secret conversation, exchange data on radio waves, and the device, hiding next to, catches them in real time. Without noise and dust, it records every word, every command, every detail that flies in the air. This process is like a hidden reconnaissance, where each radio signal is the key to an invisible chain that connects everything in the shade, leaving only a whisper of radio waves.
  
• Detail:
  These radio waves are not just noise or random signals, but complex pulses encoded in a thin network of ISO/IEC 14443 or ISO/IEC 15693. Each wave is a low-level mosaic filled with point pulses that follow strict rules: tempo, length, packet structure. These signals are like a cipher that needs to be decrypted to understand what exactly the card or terminal is transmitting. In this world, everything is subject to the protocols hidden behind the mask of an ordinary radio wave, and only those who know the code have a chance to penetrate these invisible walls.

2. Protocol analysis - analysis of commands


The captured signalsare decoded.

• What is APPDU:
  APDU is like secret orders, encrypted messages sent directly to the heart of the card. They are not just words, but strictly structured commands hidden behind the layers of protocols, ready to open up only to those who know the language. For example, the “read balance” command or “check the password” is like the code words that trigger a response inside the chip, activate its hidden mechanisms. In this world, every APDU is the key to the doors behind which data and the possibilities are hidden, access to which only the chosen ones, who know the right cipher.
  
• What is important:
  It’s like a vulnerable point in the cold armor system that uses standard APDU – an open door for those who are aware. Some do not encrypt these commands at all, as if they leave their access code in front of everyone - it's like writing a password on the wall or leaving the key on the hook. In underground circles, this is considered a weakness that can be expensive: anyone who knows where to dig, easily infiltrates, cracks the defense and gains full control. These weaknesses are like cracks in the wall that you can crawl through to get inside, see what is hidden, and use it against the system or its owner.
  
• Technical nuance:
  It’s like playing in the shadows and lights at the same time – sometimes the signals are encrypted so tightly that it becomes almost impossible to bite them without deep cryptanalysis. In such hidden circles, where protection is strengthened to the limit, you have to twist: look for loopholes in algorithms, break the stereotypes of encryption or look for vulnerabilities within the system itself. Every attempt at hacking is like a game on the verge of risk, where one wrong move can lead to failure, and success can lead to penetration into closed zones. It’s not just a hack, it’s a real art of disguising and bypassing cryptographic walls hidden behind invisible barriers that create an impenetrable shield around data.

3. Detecting Weaknesses and Vulnerabilities

• Example:
  It’s like leaving your secret code in front of everyone – a MIFARE Classic card, on which the keys are only 4 bytes, often find itself vulnerable because of this. Many use the same keys or choose weak combinations, turning protection into a fiction. In shadow circles, this is known as the “open door”: attackers easily scan such cards, break the keys in a matter of minutes and get full access to the systems. This flaw is like leaving a valuable artifact in the open air, knowing that anyone can steal it, because the protection is built on the sand, and not on the stone.
  
• What is being done:
  It’s like using the dark side of hacking – algorithms like Nested Attack or Darkside turn MIFARE Classic hack into a game in a matter of minutes. These tools disassemble the weaknesses of protocols, look for repetition cycles and vulnerabilities within cryptographic schemes to quickly pick up the keys. In underground circles, this is considered one of the fastest and most effective methods of penetration, turning protection into empty noise. The whole process is like a stabbed in the shadows: imperceptibly, quickly and without unnecessary traces, leaving behind only a void and a broken lock.
  
• Result:
  After a successful hack, everything turns into a game into cat-mouse - the attacker gets full control over the map. He knows what data is stored on it, and can not only read the information, but also copy it as if creating an exact copy. In shadow circles, this is called “cloning” and it opens the door to the dirtiest things – counterfeiting of tickets, access to protected areas or financial transactions. For him, the map becomes an empty shell, inside of which the key to the whole system is hidden - and no one else will be able to distinguish a fake from the original, because everything is hidden under the mask of the present.

4. Emulation and counterfeiting

• Creating a clon:
  When an attacker creates a clone, the device turns into a real fake card - it begins to emit the same signals as the original, as if replacing reality. This fake signal is a neatly designed counterfeit that simulates all the characteristics of this map: from frequency to unique codes. In underground circles, this is called “fake on the fly”, and it allows the device to freely log into systems, access or perform transactions as if it were the original. Everything comes down to convincing the host side - terminals, readers - in authenticity, because for them the signals seem absolutely real, and the map - legal.
  
• Dynamic emulation:
  This is a real masqueration art, when with the help of powerful devices like Proxmark3, an attacker can fake the work of the card in real time. These modules don’t just copy the signals – they know how to mimic them dynamically, changing contents depending on the situation. As a result, the card turns into a living, changing object, which can adapt to the conditions, imitating any operations. This approach allows you to easily enter secure systems, make transactions or bypass checks - as if it is happening with a real card, only on the fly and without its actual availability. It’s like a cat-and-mouse game, where the device constantly changes the game, making a fake almost impossible to detect.
  
• Protection bypass:
  It's like breaking down a door that seems impenetrable. When the system uses simple password encryption, an attacker can bypass it just by forging signals without knowing the key. It all comes down to intercepting and replicating the right signals, imitating a true exchange, as if it was going through a legitimate channel. In dark circles, this is often called the “deception of the system”, because you deceive it at the level of protocols, without revealing your secret. All you need is the ability to intercept and accurately play signals, as if you are a legal owner, only without any passwords and ciphers. This approach allows you to bypass any simple protection and penetrate inside, like a shadow, imperceptibly sneaking through the cracks.

5. Modification of data - make "clean" hack

• You can insert your commands, change balance, remove or add rights.
  In this world of underground wars and hidden cracks - you can creep into the system and insert your commands, like a spy embedded in other people's ranks. To change the balance is to shuffle the game, place your priorities and twist the indicators to your needs. Deleting or adding rights is how to disable security or connect your agents by expanding the control area or removing obstacles. Everything is done secretly, imperceptibly - as if you are a shadow that manipulates the system from the inside, changing the rules at its discretion and leaving no traces. In this world, you are an invisible master playing on the verge of permissible, pushing the boundaries of the system as you want.
  
• In case of payment - you can change the amount or disable the payment function.
  When it comes to payment, it’s like playing by other people’s rules – you can move the amount, make it lower or higher, as if pulling threads out of the shadows. To disable the payment function means completely disconnect the system from the outside, leave it without the ability to receive money or interact with the outside world. All this is done covertly, like a burglar, disables the alarm or changes the script for the fly. In this underground movement, you are like a shadow that can change the rules of the game at any time, break the chain or switch the system so that it can no longer work according to the standard. The whole game is on the verge, and you hold carte blanche to do everything at your discretion.

Real Cases: How It All Is Used


Hacking subways and access systems

• Intercept the exchange between the turnstile and the map.
  In this world of underground movements - hacking the subway and access systems - you are like a shadow that penetrates the very heart of the infrastructure. Intercept the exchange between the turnstile and the map - catch this invisible dialogue, as if you are eavesdropping on secret negotiations in a dark corner. You can turn off the signal, cloned the card or simply replace the data to go without a queue and without unnecessary questions. Everything happens quietly, like a whisper in the dark - you control the flow of information, like a shadow master, playing the game, where all the rules are yours. In this underground, you are an imperceptible agent, manipulating the system so that no one will notice that their protected route has become yours.
  
• Analyze the protocol - often they use standard MIFARE or NTAG without strong protection.
  On the dark side of the network, you are like an invisibility analyst, you solve the codes and protocols that are hidden behind ordinary faces. Often use standard MIFARE or NTAG - just codes that are kind of protected, but in fact it is like a lock on a door that is easy to crack. Without strong protection, these protocols are like an open book that can be read between the lines, picking up the keys and bypassing the system. You delve into these schemes, like a master thief who understands the weaknesses - know where and how to break the defense to penetrate to get where the other entrance is closed forever. All this is a game on the verge, where knowledge is your weapon, and weaknesses are your entry points.
  
• Open the keys, create a virtual copy.
  In this underground world, you are like an alchemist who turns simple information into a powerful weapon. Open the keys - you understand their structure to the smallest detail, as if you break locks with the help of ancient secrets known only to a few. You create a virtual copy - it's like cloning the soul of the system, which opens the doors to where the other entrance is closed. In this shadow space, you are a master of hand-made keys, you know how to create copies that work flawlessly, bypassing all the traps and protections. Everything happens quickly and quietly, like magic - you own the art of turning chaos into control, and the weaknesses of the systems into your trump cards.
  
• You pass through the turnstile, bypassing the payment or entrance on a fake card.
  You are like a shadow sliding on the brink of reality, you pass through the turnstile without unnecessary noise, bypassing all the official obstacles. Payment? Forget it, it's just a game for others - for you there is a fake card made in a hurry, but accurate enough to deceive the system. In this underground, the details decide everything - the correct electronics, the correct codes, and a little bravery. You're like a camouflage master, you go to where the other entrance is closed without arousing suspicion. All this is not just bypassing the defense, but the art of merging with the shadows, leaving behind only the void and quiet whisper of the system that has slipped bypassing the system.

Bypass control of the pass systems

• In the offices, intercept the signals of access cards.
  In this shadow world, you are a signal hunter, like a ghost hunter. Bypassing through the pass systems is your game, and you know all their weaknesses. In the offices, you intercept the signals of access cards, like a hacker, clever and quiet, like a shadow sliding over wires and radio channels. You hack into the chain of ciphers, eavesdropping your spikes, and you instantly create a virtual copy of the key. Everything happens on the verge of a possible one - you don't just bypass the system, you turn its weakness into your trump card. It is the art of stealth and speed, where every second and every signal is your chance to get to where others are closed forever.
  
• After analysis, you create a clones that work as an original.
  After a thorough analysis of the system and its vulnerabilities, you create your doppelganger - an exact copy that works as an original, like a shadow in the night. This clone is not just a copy, but a full-fledged mask under which you can pass any checks. Inside it - all the necessary parameters, all the keys, all the signals, so that no one distinguishes it from the present. It acts autonomously, as if an integral part of the system, and your role is to control it from the shadows. In this world, forgery and sneaking, the creation of a clone is the highest form of art, where each movement is precisely calculated so as not to leave a trace.
  
• As a result, a free passage into a building or server room.
  When everything is in place, the clone works flawlessly, like a shadow that has passed through the walls. Free passage to the building or server room is his reward, the final touch in your operation. At this point, you are like a ghost, disappearing in the shadows, you leave only a emptiness behind you. All systems think that everything is in order, and you are already inside, in the heart of an object where you can do anything - from hacking to the collection of information. This moment is the pinnacle of your skill, when the boundaries between reality and shadows are blurred, and you get complete control under the cover of night.

Falsification of goods or meters

• In some cases - copying NFC tags on goods or packages to bypass the accounting system.
  When it comes to falsification, everything turns into a game of shadows and deception. In some cases, the key to success is to copy NFC tags on goods or packages. These tiny chips, like magic keys, allow you to deceive the accounting system by issuing counterfeiting for the original. At this point, you are like an alchemist who turns a fake into a legitimate commodity, bypassing all checks and restrictions. All you need is accurate duplication of the signal so that the system believes that a real product is in front of it. In this world, where everything is based on trust and technology, such a focus is your secret move, allowing you to play by your own rules and stay in the shadows.

Challenge to modernsystems


NFCGate - it's notjust a toy for hackers, but a real alarm for those who buildprotection. It shows that NFC is not magic, but radio signals thatcan be listened to, analyzed and counterfeited. At this point,everything turns into a game on the verge, where every vulnerabilityis a chance to penetrate the closed zone.

Hackers use itas a weapon, researchers are a tool to search for a breach, andcompanies like a reminder that security is an eternal race without afinish. In this shadow world, where technology is evolving fasterthan you can tracheat, NFCGate becomes the key to understanding thatno protection is eternal, and any lock can be hacked if you know how.


The game of radio waves on the verge of possibilities


NFCGate - it is notjust a tool, but a symbol of a new era, where the boundaries ofsecurity are blurred, and radio waves become a battlefield. It showsthat NFC is not a magic shield, but just radio signals that can belistened to, analyzed and counterfeited if you have the rightequipment and a keen desire to play by the rules of radio waves. Inthis shadow world, where every signal is a potential vulnerability,NFCGate opens the eyes - systems that seemed impenetrable, easilybreak under the onslaught of those who know how to read andmanipulate radio frequencies. In the future, of course, systems willbecome more difficult - with cryptography, dynamic keys, encryption -but the essence will remain the same: play and break the boundariesof radio signals - this is a challenge that no one is going to giveup.

 

[Vyperfox]

thx

 

[vinoth94]

respect