NFC cloning and relay attacks: is your badge a key or just a number?

TL;DR

You tap your badge and the door clicks open, you wave your phone at a terminal and the coffee is paid for, and it all feels secure because it is contactless and everyone says these things are encrypted. The truth is that some of them are, and some are just a bit of plastic shouting a number that anyone can copy in the time it takes to stand next to you in a queue. Which one you are carrying makes all the difference, and most people have no idea which it is.

This is NFC, the short-range radio in your access badge, your transport card, and your phone’s wallet. I build the NFC tools into the Evil-M5Project so you can hold your own badge to a reader and find out, in a few seconds, which bucket it falls into: the weak kind that clones in seconds, or the strong kind that gives up nothing. And for the strong kind, there is one trick left that does not copy the card at all, it borrows it live.

The tap that feels secure

Contactless has a particular kind of confidence to it. There is no slot, no PIN for small amounts, no fumbling, just a tap and a reassuring beep, and the whole experience is designed to feel modern and therefore safe. That feeling is doing a lot of unearned work. A tap tells you the system is convenient. It tells you nothing at all about whether the card in your pocket is protecting you or quietly handing out a number.

So this episode is really about one question you have never been given a reason to ask: is my badge the weak, copyable kind, or the strong kind? Below I will walk through how these tags actually work, why some clone in seconds while others cannot be copied at all, what a relay attack does to the ones that cannot be copied, and how to check your own card with hardware you can hold in your hand.

How an NFC tag actually works

NFC is deliberately short range, a few centimetres, and the reason is physical: the reader has to power the card to talk to it, because there is no battery in your access badge. When you bring it close, the reader’s field wakes the card up, the card introduces itself with an ID and some stored data, and the two have a very quick conversation before you have even finished the gesture.

On a cheap tag that conversation is basically « hi, my number is 04 A2 3F 1B, » and that is the entire exchange. Some cards even change that number on every tap, which is itself a quiet admission that it was never meant to be a secret in the first place. On a good tag, the conversation is completely different: the card proves it knows a secret key without ever handing the key over, the exact same challenge-and-response idea you saw in the Wi-Fi and Windows attacks earlier in this series. Same radio, same gesture, wildly different security, and nothing on the outside of the card tells you which one you are holding.

Not all cards are the same

The whole security of an NFC system comes down to what kind of card it uses, and the gap between the weak and the strong end is enormous. It is worth knowing the three rungs, because the name on the card is the only thing that actually decides whether a copy of it opens your door.

• UID-only systems just check the card’s serial number, its UID. That number is meant to be unique, not secret, and it is trivial to read and copy. If a door trusts the UID alone, a copy of the number is a copy of the key, full stop.
• MIFARE Classic is the workhorse of cheap access and transport cards, and its encryption (called Crypto1) is fundamentally broken. Its keys can be recovered whether or not they are the factory defaults: a card still on default keys dumps in seconds, and one with custom keys falls too, just with a little more effort. « We changed the keys » is not the fix people hope it is.
• DESFire with AES (that is AES, the modern encryption banks and governments rely on) and unique keys is the strong end. EV1 onward does this well, and a properly set-up DESFire cannot be copied by reading it, because it never reveals its secret. The one to avoid is the original DESFire generation, which used older crypto with a known weakness.

So the first question for any badge is the same one I asked about radio remotes in the sub-GHz episode: is this the weak, copyable kind, or the strong kind? Everything else follows from the answer.

Cloning the weak ones

If a badge is UID-only or a MIFARE Classic, cloning is simple in principle. You read the card, then write the same UID or the full memory dump onto a « Magic » card, which is a special card that, unlike a normal one, lets you set its UID to anything you like. The result is a working duplicate that the door cannot tell apart from the original, because as far as the reader is concerned it is seeing the same number or the same contents it has always trusted.

Recovering a MIFARE Classic’s keys in the first place is a well-known family of techniques, which people call mfkey. The attacker’s device either listens in on a genuine reader-and-card exchange, or presents itself as the card to a real reader and collects the authentication attempts the reader makes. Either way the keys come out of the maths, which is precisely why rotating them does not rescue this card type: the weakness is in the Crypto1 cipher itself, not in which particular keys you chose.

Technical deep dive: UID, Crypto1, DESFire, and the cryptogram

This is the part worth slowing down on, and you can skim it if you only want the practical check. The three card rungs map onto three completely different security postures. A UID-only system performs no authentication at all; it reads a number and trusts it, which is why a Magic card that simply announces the same number is a perfect key. There is nothing to break because there was never a lock, only a nameplate.

MIFARE Classic does have a lock, but a broken one. Its Crypto1 cipher was reverse-engineered years ago, and the attacks (the mfkey family) exploit weaknesses in how it generates its challenges so that an attacker who sees even a few authentication attempts can recover the sector keys offline. Once the keys are out, the full card memory dumps and writes onto a Magic card. This is the crucial thing to understand: rotating to custom keys only raises the effort slightly, because the cipher itself leaks, so the fix is not better keys but a better card.

DESFire with AES is the strong end, and it works like the good handshakes elsewhere in this series: the reader sends a random challenge, the card encrypts it with a secret AES key it never transmits, and the reader checks the result. An eavesdropper hears only random-looking challenges and responses, nothing reusable, so reading the card a thousand times gets you nothing. Contactless bank cards (EMV) add one more idea on top: every transaction is signed with a fresh one-time cryptogram the card generates in the moment, which cannot be reused or guessed. That single mechanism is why you can skim a card number but cannot clone the card or replay a payment. It stops copying and replay cold. What it does not stop, as we will see, is a live relay, because a relayed tap makes the real card generate a real cryptogram right then.

Payment cards: what you can and cannot do

Contactless bank cards feel like the scariest target, so it is worth being exact about what is actually true, because the reality is both less and more alarming than the rumour. With a reader you can pull some information off an EMV payment card: the long number, the expiry, and sometimes the name. That part is real, and it is exactly why a shielded wallet is a sensible precaution rather than paranoia.

But you cannot clone the card or make a payment from that data, because every contactless transaction is signed with that one-time cryptogram your card generates fresh and that cannot be reused or guessed. Reading the number is skimming at best, a long way short of a clone, and it will not by itself let anyone tap-to-pay as you. The genuine exception is relay, which does not copy anything and so sails straight past the cryptogram, and that is the subject of its own episode.

When you cannot clone it, relay it

So what about the strong cards, the AES DESFire badge or the phone that gives up nothing to a reader? If you cannot copy the card, you borrow it live. A relay attack uses two devices: one sits near the real reader and pretends to be your card, the other sits near your actual card, in the bag on your shoulder in a queue, and pretends to be a reader. The two are linked over a network. When the reader asks its question, the question is relayed to your real card wherever it is, your card answers honestly, and the answer is relayed back, so the reader opens because as far as it can tell your card is right there against the glass.

Relay beats the one assumption every contactless system quietly makes, that a card near a reader is the real card in the owner’s hand, and it works even against cards that cannot be cloned. It is also the uncomfortable asterisk on payment cards: the one-time cryptogram stops cloning and replay, but it does not stop relay, because a relayed tap is a real, live transaction where the real card generates a real cryptogram in the moment. Within the small contactless limit, a relayed payment can actually go through. I pulled this one out into its own full episode, including the hardware I built for it, in the NFC relay attack, because it deserves more room than a section.

Two stops on the tram

Say you are Elena, and your office hands out plain white access cards you have never once thought about, because why would you. On a crowded morning tram, someone stands a little too close with a phone-sized gadget tucked in their jacket, and for the two stops you are pressed together it quietly reads your badge. Your card is an old MIFARE Classic, so there is nothing even to crack in any real sense; the whole thing dumps in seconds while you are reading the news on your phone.

That evening the attacker’s gadget writes your badge onto a Magic card, the kind whose UID can be set to anything. The next morning a stranger badges into your building behind the usual crowd, and the access log shows your name walking in at a time you were still asleep in bed. Nobody forced a door and nobody stole a physical key, which is the part that makes it so hard to notice: the only trace is a timestamp that does not match your life.

Why it works

Two things keep this alive, and neither is going away quickly. The cheap, broken card technologies are everywhere because they were installed before anyone cared about any of this, and ripping out a whole building’s readers and reissuing every badge costs real money that no facilities budget wants to spend on a system that appears to work fine. Inertia, not ignorance, is most of the problem.

The deeper reason is the assumption baked into NFC itself, that a card next to a reader is the real card held by the real person. Cloning breaks that for the weak cards by making a second real-looking card, and relay breaks it for the strong ones by stretching the distance between the card and the reader. It is the same quiet shape as the rest of this series: a system trusting a convenient proxy (a number, or mere proximity) instead of verifying the thing it actually cares about.

How to protect yourself

The fixes split cleanly between the people who run an access system and the people just carrying a card, and both halves are genuinely actionable.

If you run the access system

• Find out what your cards actually are. If doors trust a bare UID or run on MIFARE Classic, that is the thing to migrate, to DESFire (EV1 or later) with AES and unique, properly managed keys. This one change removes the easy clone entirely.
• Never trust the UID on its own for anything that matters. It was never meant to be a secret, and treating it as one is the single most common mistake in cheap access systems.
• For sensitive doors, add a second factor, a PIN pad or a biometric, so that a copied or relayed card is not enough on its own to get in.
• Where relay is a real concern, use readers and systems designed to resist it (tight response timing, distance checks), and watch access logs for impossible journeys, like one badge entering two places at once, or at a time the person demonstrably was not there.

If you are just carrying a card

• A shielded sleeve or wallet (an RFID-blocking one) stops casual reading of both access badges and payment cards. It is cheap and it genuinely works.
• For payments, the one-time cryptogram already blocks cloning, so the useful habits are the ordinary ones: keep tap limits sensible, turn on transaction alerts, and actually read your statements.
• Keep your phone’s wallet locked so a tap cannot pay or badge in without you unlocking it. A phone is usually safer than a plastic card precisely because it insists on that unlock.

Doing it with the Evil-M5Project

Evil-M5Project, the firmware I build, pairs with an ST25R3916 NFC add-on to read, write, emulate, and relay the common card types. In a demo I want to show someone, with their own badge, which bucket it falls into, because that realisation is the whole lesson.

• Read Tag identifies the card, dumps what it can, and for MIFARE Classic automatically tries the usual default keys. In a few seconds you know whether a badge is wide open or not.
• Write Clone and Write UID copy a dump or a UID onto a Magic card, and the device can emulate a saved card’s UID directly, so a duplicate can be shown working on a test reader.
• EMV Reader pulls the readable fields off a contactless payment card (number, expiry) for analysis, and stops where the standard stops it: no cryptogram, no payment.
• DESFire tries the default keys a card ships with, which is how you show the difference between a DESFire left at factory settings and one set up properly. The second one simply says no.
• Relay/Emul relays a live card between two devices over WiFi or ESP-NOW, which is how you demonstrate a relay attack in a controlled setup, and mfkey captures the exchanges needed to recover MIFARE Classic keys offline, so the « rotating keys will not save you » point stops being theoretical.

The limits are the lesson. A properly configured DESFire (AES, unique keys) cannot be cloned by reading it, and the tool shows that by failing. EMV payment cards cannot be cloned or charged by copying them. Relay is the exception, and only within the small contactless limit, and it needs two devices, a live link, and the real card present and answering at that moment, so it is a setup, not a pocket trick. Range is tiny throughout: reading a card means being right next to it, which is why the tram and the queue are the realistic settings, not across a room.

Evil-M5Project is for ethical and educational use only. Only read, clone, emulate, or relay cards you own or are explicitly authorized to test, and follow the laws where you are.

Firmware and docs: https://github.com/7h30th3r0n3/Evil-M5Project.

A key, or a number?

Contactless does not mean secure. It means the security moved into the card, and cards run all the way from a serial number anyone can copy to an AES chip that gives up nothing. If your building still runs on UID-only readers or MIFARE Classic, a copy of your badge is a copy of your key, and the fix is a card that proves itself rather than just announcing its name. For the strong cards, the one trick left is relay, which borrows the real card instead of copying it.

I build the NFC tools into Evil-M5Project so you can hold your own badge to a reader and find out, in a few seconds, which kind you have been carrying all this time. It is a small test with a disproportionate payoff, because the difference between a key and a number is the difference between a door that trusts you and a door that trusts anyone who once stood close enough to you on a tram.