PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

MIFARE Classic: exposing the static encrypted nonce variant... and a few hardware backdoors

blog.quarkslab.com | research | #cryptography | #backdoor | #rfid | #nfc | #proxmark3 | #mifare
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Quarkslab breaks the static encrypted nonce protection of FM11RF08S MIFARE-compatible cards, uncovering a hardware backdoor enabling keyless authentication and related backdoors in older chips.
Published
Collected

Related coverage

research · blog.quarkslab.com
RFID: Monotonic Counter Anti-Tearing Defeated
Using Proxmark3 tear-off techniques, Quarkslab defeated the anti-tearing monotonic counters in NXP MIFARE Ultralight EV1 and NFC cards, disclosing the issue to NXP which published mitigations.
research · blog.quarkslab.com
RFID: New Proxmark3 Tear-Off Features and New Findings
An overview of new Proxmark3 tear-off tooling and findings, covering attacks against EM4305 chips and Mikron Ultralight variants, and news from the open-source RFID/NFC hacking community.
research · blog.quarkslab.com
EEPROM: When Tearing-Off Becomes a Security Issue
Demonstrates how deliberately interrupting EEPROM writes on RFID tags (e.g. ATA5577C) with a Proxmark3 can bypass password protection and recover tag memory content, plus countermeasures.
blog · bugcrowd.com
How to hack with the Flipper Zero
A hands-on guide to the Flipper Zero: CC1101 sub-GHz radio for capturing and replaying garage and car keyfob signals, plus reading and writing NFC/RFID access cards like hotel and transit cards.
research · blog.quarkslab.com
State of Post-Quantum Cryptography implementations
In this blogpost, we first review the landscape of Post-Quantum Cryptography implementations across some of the most popular cryptographic libraries. Following that, we present the results of a differential fuzzing campaign on few of the presented implementations.
research · eshard.com
Evaluating Botan’s Resistance to Physical Attacks: An End-to-End Study
We evaluated Botan 3.7.1’s ECC against side-channel attacks, from source code to real hardware. Three attack paths found. Accepted at HS3 2026.
Back