diff --git a/tools/mf_fudan_rf08s/rf08s_nested.c b/tools/mf_fudan_rf08s/rf08s_nested.c index 82e0e5f1b..1f58976e9 100644 --- a/tools/mf_fudan_rf08s/rf08s_nested.c +++ b/tools/mf_fudan_rf08s/rf08s_nested.c @@ -1,3 +1,13 @@ +// Reused Keys Nested Attack against Fudan FM11RF08S tags +// +// Attack conditions: +// * Know a first key, to be able to activate the nested authentication protocol +// * The card must reuse some keys across several sectors. Or several cards of an infrastructure share the same key +// +// Strategy: +// * Find all possible key candidates for one reference sector, and check on-the-fly if they are compatible with any other sector we want to compare with +// +// Doegox, 2024 #include #include diff --git a/tools/mf_fudan_rf08s/rf08s_nested_known.c b/tools/mf_fudan_rf08s/rf08s_nested_known.c index 7c068e7e3..245f76cfd 100644 --- a/tools/mf_fudan_rf08s/rf08s_nested_known.c +++ b/tools/mf_fudan_rf08s/rf08s_nested_known.c @@ -1,3 +1,14 @@ +// Backdoored Nested Attack against Fudan FM11RF08S tags +// +// Attack conditions: +// * Backdoor +// +// Strategy: +// * Use backdoor on the targeted sector to get the clear static nested nT +// * Enumerate key candidates based on clear and encrypted nT +// * Use the resulting dictionary to bruteforce the key +// +// Doegox, 2024 #include #include diff --git a/tools/mf_fudan_rf08s/rf08s_nested_known_collision.c b/tools/mf_fudan_rf08s/rf08s_nested_known_collision.c index 97b8aab57..a48b370b5 100644 --- a/tools/mf_fudan_rf08s/rf08s_nested_known_collision.c +++ b/tools/mf_fudan_rf08s/rf08s_nested_known_collision.c @@ -1,3 +1,16 @@ +// Faster Backdoored Nested Attack against Fudan FM11RF08S tags +// +// Attack conditions: +// * Backdoor +// * keyA and keyB are different for the targeted sector +// +// Strategy: +// * Use backdoor on the targeted sector to get the clear static nested nT for keyA and for keyB +// * Generate 2 lists of key candidates based on clear and encrypted nT +// * Search couples of keyA/keyB satisfying some obscure relationship +// * Use the resulting dictionary to bruteforce the keyA (and rf08s_nested_known_match for keyB) +// +// Doegox, 2024 #include #include diff --git a/tools/mf_fudan_rf08s/rf08s_nested_known_match.c b/tools/mf_fudan_rf08s/rf08s_nested_known_match.c index f4298ee51..2c20e5004 100644 --- a/tools/mf_fudan_rf08s/rf08s_nested_known_match.c +++ b/tools/mf_fudan_rf08s/rf08s_nested_known_match.c @@ -1,3 +1,14 @@ +// Faster Backdoored Nested Attack against Fudan FM11RF08S tags, part 2 +// +// Attack conditions: +// * Backdoor +// * keyA and keyB are different for the targeted sector +// +// Strategy: +// * Use f08s_nested_known_collision to crack keyA +// * If keyB not readable, find keyB in its dictionary based on the obscure relationship between keyA, keyB and their nT +// +// Doegox, 2024 #include #include