Arduino Hacking Village THOTCON 0x9

Transcription

1 RFID Lock Analysis Lab Use an Oscilloscope to view RFID transponder signals Use an Arduino to capture and decode transponder signals Use Arduino to spoof a transponder Lab time: 10 minutes Lab 1: Viewing an RFID signal RFID locks that use the EM400 and HID access card protocols work by generating a 125Khz electromagnetic field around the reader. This field provides power to transponders (badges or key tags) brought into the field. These transponders manipulate the field to transmit their code to the reader. We will use an oscilloscope to view the RFID signal. Step 1: Connections The USB Oscilloscope should already be connected as follows Channel 1 connected to the antenna signal on the lock Channel 2 connected to a data signal on the lock A black ground connection between the lock, Arduino and Oscilloscope Step 2: Start the Oscilloscope software Launch DSO 2090 Oscilloscope from the desktop Configure the software as follows: o Time/DIV set at 20.0 us (microseconds) o Channel 1 enabled, set to 1.00V, AC, x1 o Channel 2 disabled 1

2 Step 3: View the raw signal data Without a transponder near the lock, the RFID signal is a flat 125Khz wave. Now place the RFID card labeled Step 3 -HID onto the lock. You ll se the wave is now bumpy on the top and bottom. This bumpiness is the signal that the transponder is introducing into the EM field produced by the lock. (This HID RFID card is not compatible with the EM400 lock, so the lock does not beep) 2

3 Feel free to change the Time/DIV setting to further inspect the signal To change this bumpiness into a data signal, the lock uses an Envelope Detector Circuit, which outputs the overall shape of the wave. Step 4: View the Envelope data Channel 2 of the Oscilloscope is connected to the data coming out of the envelope detector circuit being fed into the processor of the lock. Remove the Step 3- HID card from the lock. Turn on channel 2 now. 3

4 Notice that without a card present at the lock, the #2 data channel doesn t seem to have a clean, discernable signal. Now place the Step 3 HID card back on the lock. The second signal will show a square signal with highs and lows. If you look closely you can see the highs and lows correspond to when the envelope of the raw RFID signal is rising or falling. In the next lab, we will feed this channel 2 signal into an Arduino to decode it and view the card number. 4

5 Lab 2: Using an Arduino to Decode RFID Signals In this lab we will use an Arduino to decode an RFID signal and retrieve a key code Step 1: Connecting to the Arduino Find the Arduino that is glued onto the RFID lock and connect it to the laptop with a USB cable. Disconnect any other Arduinos from the laptop. Open the Arduino software. Under the tools menu choose Port and select the COM port of the Arduino. There should be only one COM port available. Now choose Tools..Serial Monitor. Set the Serial baud rate to The Arduino should report Starting That means it is ready to read tags. 5

6 Step 2: Scan a Tag Scan a blue RFID tag. The serial output should report the tag ID that the Arduino read. Check that the number reported matches the number on the back of the tag. Feel free to inspect the Snooper source code under RFID Snooper Code on the desktop of the laptop. 6

7 Lab 3: Using an Arduino to Spoof a Tag We will use an Arduino and a hacked keyfob to generate the signal necessary to spoof other keyfobs. Step 1: Connecting to the Arduino Find the Arduino that is connected to a keyfob. Plug it into the laptop via USB. The Arduino spoofer keyfob should already be configured to be an EM400 key. Hold it next to the RFID lock. The lock should beep, and you should see the keyfob code in the serial Window if you left it running in the prior lab. Step 2: Writing a new key code to the keyfob Open the spreadsheet on the desktop titled Tag_ID_Calculation_Worksheet Type the code you want to spoof into the Tag ID field Copy the result in Cell B3, which starts with int data_to_spoof Open the Arduino program RFID_Spoofer from the RFID_Spoofer folder on the desktop Replace the line that starts with int data_to_spoof with your new data Go to Tools, Port and select the COM port that has the Spoofer Arduino. It is probably the only COM port that you haven t already used. Make sure the Arduino IDE Tools menu shows Board: Arduino Nano and Processor: Atmega 328 Select Sketch Upload to upload your Arduino sketch with your custom code to the Arduino keyfob Hold the keyfob near the RFID lock. It should beep, and the serial snooper should show your new RFID value. 7

8 Lab 4: Putting it all together In this lab you will read a key code for a badge configured to open the demonstration door, and then program the Arduino Spoofer to open the door. Step 1: Decode the signal Find a key fob that works for the door Follow the instructions in Lab 2 to collect the key fob value. Step 2: Create the code to write Follow these steps from Lab 3 to write that code to the Arduino key fob o Open the spreadsheet on the desktop titled Tag_ID_Calculation_Worksheet o Type the code you want to spoof into the Tag ID field o Copy the result in Cell B3, which starts with int data_to_spoof, into the Arduino RFID_Spoofer program o Write the program to the Arduino spoofer using the Arduino IDE Step 3: Create the code to write Hold the Arduino spoofer fob near the reader. The door should open. 8