Equip equipter

Mifare Classic - SAK Swapping Explained

What is SAK Swapping

Behaviour has been observered where some system using Mifare Classic credentials will identify with one SAK (0x08/18) on a basic search (Wake up) but when the block 0 is dumped, the SAK appears to be different (0x88/0x98)

This is because the SAK reported on a Wake up is not coming from Block 0 but is instead burned into the card, The SAK in Block 0 is merely a Vanity SAK.

If the dump is loaded onto a Magic Mifare Classic that Mirrors the vanity SAK as the actual SAK on Wake up it will tell the system that the credential is a duplicate & to deny access.

iOS NDEF Record Compatibility

Introduction

NDEF (NFC Data exchange format) is a method of transferring (relatively small amounts of) information from a passive or actively emulated tag by way of "records" which specify the type of information is being received and the function it is meant to have.

iPhones do not have a full suite of NDEF compatibility, the reason for this is unknown (to me at least), what this means is the background polling on iPhones will not interpret some specific record types, with compatible NDEF records, a notification will pop up directing the user to follow the received data into its respective app to complete whatever action was intended by the record.

Compatibility Table

Below are the options offered by NFC Tools on IOS for NDEF Encoding, some of the options below are other record types but with a specific function IE social links are just URLs.

	BEGIN:VCARD
	VERSION:3.0
	FN;CHARSET=UTF-8:Samwise whiskey Gamgee
	N;CHARSET=UTF-8:Gamgee;Samwise;whiskey;NFC;jr
	NICKNAME;CHARSET=UTF-8:Sam
	GENDER:M
	UID;CHARSET=UTF-8:54838c80
	BDAY:20030103
	EMAIL;CHARSET=UTF-8;type=HOME,INTERNET:[email protected]
	PHOTO;ENCODING=b;TYPE=JPEG:/9j/4AAQSkZJRgABAQAAAQABAAD/2wCEAAkGBxMTEhUSEhMVFRUVFRUVFRUVEhUVFRUVFRUWFhUVFRUYHSggGBolGxUVITEhJSkrLi4uFx8zODMtNygtLisBCgoKDg0OGhAQGy0lHR8tLS0tLS0rLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLf/AABEIAOEA4QMBIgACEQEDEQH/xAAbAAACAwEBAQAAAAAAAAAAAAADBAACBQEGB//EADgQAAIBAgQEBAUDAgUFAAAAAAABAgMRBCExQQUSUWETcYGRFCKhsfAGMsEV8TNCUnLRI2JzwuH/xAAaAQADAQEBAQAAAAAAAAAAAAABAgMABAUG/8QAJhEAAgICAgICAgIDAAAAAAAAAAECEQMhBBIxQRMiFFEyQgUVcf/aAAwDAQACEQMRAD8A+cYt55CkhmvHMUa1PRxw0Gb2DR2m7EIkW6kuwxUV/mXqcouzX56EoTtqElT3RPr6KL9hqtFWU4vLp0fRl6Ks+z+gtCbV++qC4Sqv2y0enZiPG6GUlYzVoatWa7CjgNSp7ry1JyXNFUMIyp6B6egz4F1lqifD6dx20zdRS2aYenR3LuhqEw8c7AktaMkHw9OLTUjOxFH5uUekmtBbDq8u9svM0INWwyfhBcJB7f7fRlFJ3jHV6I0/AcKav+5zDYbhjivF32VjlnKKtsqosB8C+R31eojCleF+