Risk Assessments of Unattended Smart Contactless Cards

Contactless smart card technology serves various applications ranging from personal identification to financial payment. A well-known brand, Mifare cards, supplies more than three-quarters of the world's smart contactless cards. When left unprotected and unattended, these cards are potentially vulnerable to external threats that enable an attacker to read the card and steal the UID (Unique Identifier) and write to the card, potentially corrupting it. This study assesses the risk of unattended Mifare Classic smart cards through a simulation of the attack. The mobile applications NFC Tools and Mifare Classic Tool which were installed on an NFC-capable smartphone were utilized as the primary card reader/writer to perform the said functions to the cards. The attack was performed against a Mifare Classic 1K card; Its contents were read and written to and its UID was duplicated/cloned using a UID-writable card and a Proxgrind Chameleon Mini Rebooted. The duplicates/clones were tested on a simulated card system scanner that was built using a CH340G Arduino board and an RC522 module that was designed to accept only the genuine Mifare Classic 1K card. The simulation of the attack presents that cards can easily be accessed, even when placed inside relatively thick layers of wrapping such as inside a wallet and a bag. Once accessed, the UID of the cards was obtained and its memory can also be read and written to. The duplication/cloning process was successfully executed as the simulated card system scanner accepted and recognized the duplicates/clones as if they were the original card.