NFCGate: Opening the Door for NFC Security Research with a Smartphone-Based Toolkit
summary
A smartphone toolkit that hooks into Android’s NCI layer to set static tech data and capture APDUs turns ordinary phones into full NFC labs, adding relay and replay features and PCAPNG export for Wireshark. It emulates randomized tag UIDs so enterprise-level locks can be probed without custom hardware. A tested lock accepts replayed traces because AES‑CBC is misused with a static nonce and a productwide static key exists, letting an attacker brute force privilege changes in about twenty minutes at three tries per second.
AI-written summary · about
chapters (20)
- 0:00Intro
- 0:22Near-Field Communication (NFC)
- 0:55NFC Research Toolkits Requirements
- 1:43Related Work
- 3:02NFC on Android
- 3:56Hardware Limitations? No.
- 5:07The NFCGate Proof of Concept
- 6:30A New NFCGate
- 7:20Case Study: Smart Door Lock
- 7:58First Look at the Lock
- 8:30Capturing NFC Traffic
- 9:08Open Sesame!
- 9:41Analyzing NFC Traffic
- 10:22DESFire AES Authentication
- 11:23The Protocol in Detail
- 12:10More Attacks
- 14:17Preventing Relay Attacks
- 14:57NFCGate Latency Measurements
- 16:36Relay Attack Countermeasures
- 17:46Get in Touch
related talks
27mNGate:Novel Android malware for unauthorized ATM withdrawals via NFC relay
40mEasy NFC Life with Host-based Card Emulation
41mOpening Doors with JSON Web Tokens
41mGrand Theft House: RF Lock Pick Tool to Unlock Smart Door Lock
40mBiohacking: The Invisible Threat
54mExposing device features on 4G & 5G networks
18mNo Key, No Problem: Vulnerabilities in Master Lock Smart Locks
41mJust Another Live Hacking - How Insecure Is Secure Enough?