RFID & NFC
Contactless cards and tags powered by the reader's field. LF (125 kHz) is often plain-ID and clonable; HF (13.56 MHz) carries NFC and real crypto, some of it broken.
RFID (Radio-Frequency Identification) and NFC (Near-Field Communication) are the contactless card and tag technologies behind building badges, transit passes, car keys, hotel locks, and phone payments. The tag has no battery: the reader's alternating field powers it by induction and the tag answers by modulating the same field. What separates a trivially clonable badge from a hardened payment card is almost entirely the frequency and the protocol running on top.
What it is
Two frequency bands dominate. Low frequency (LF), 125 to 134 kHz, is the old world: simple tags such as EM4100 and HID Prox that, when energized, loop out a fixed identifier and nothing more. High frequency (HF), 13.56 MHz, is where the interesting protocols live, standardized mainly as ISO 14443 (proximity cards) and ISO 15693 (vicinity cards). NFC is a set of modes layered on 13.56 MHz ISO 14443 that adds peer-to-peer exchange and a data format (NDEF) for URLs, contacts, and app payloads. Both bands work by inductive coupling: the reader's coil and the tag's coil form a loosely coupled transformer over a few centimeters.
Why it matters
Access control leans heavily on the weakest end of this stack. A huge installed base of door badges are LF tags that broadcast a static number, which means "authentication" is just presenting the right ID, and copying it needs only a reader and a writable blank. On the HF side, MIFARE Classic secured a generation of transit and access cards with the proprietary CRYPTO1 cipher, since thoroughly broken (see wiki:mifare-classic). Even where the crypto is sound, cards get cloned through key reuse, default keys, and readers that trust the card's own claim about who it is.
LF versus HF
The split drives everything you do:
| LF (125 kHz) | HF (13.56 MHz) | |
|---|---|---|
| Typical tags | EM4100, HID Prox, T5577 | MIFARE Classic/DESFire, NTAG, ISO 14443 |
| Data model | fixed ID, often no auth | sectors/files, real protocols |
| Read range | a few cm | a few cm |
| Security | usually none, clone the ID | ranges from broken (CRYPTO1) to strong (DESFire, EMV) |
| Attack | read then write a blank | key recovery, then dump and clone |
How you read and attack it
The Proxmark3 is the reference tool: a purpose-built RFID transceiver with LF and HF antennas that can read, emulate, and brute a huge range of tags. A cheap ACR122U (PC/SC USB reader) or a Flipper Zero covers many HF/NFC jobs.
# --- Proxmark3, low frequency ---
[usb] pm3 --> lf search # identify an LF tag on the antenna
[usb] pm3 --> lf em 410x reader # read an EM4100 ID
[usb] pm3 --> lf em 410x clone --id 1234567890 # write it to a T5577 blank
# --- Proxmark3, high frequency ---
[usb] pm3 --> hf search # identify an HF/ISO 14443 tag
[usb] pm3 --> hf 14a info # UID, SAK, ATQA, card type
[usb] pm3 --> hf mf autopwn # recover MIFARE Classic keys, dump sectors
# --- libnfc / ACR122U ---
nfc-list # enumerate a tag on a PC/SC reader
nfc-mfclassic r a dump.mfd card.mfd # read a Classic card with known keys
The workflow is always identify, then recover any keys, then dump, then write the dump to a compatible blank (a T5577 for LF, a "magic" gen1/gen2 UID-writable card for HF).
Pitfalls
- Frequency first. An LF antenna will not see a 13.56 MHz card and vice versa.
lf searchandhf searchexist precisely because you must pick the right band before anything responds. - UID is not identity. Many readers authorize on the card's UID alone. That is weak (UIDs can be emulated or written on magic cards), but it also means you may not need to break any crypto, just present the right UID.
- Cloning needs the right blank. You cannot write an EM4100 onto a MIFARE card. LF clones go to T5577; HF UID clones need a magic card whose block 0 is writable.
- Range is short by design. Near-field coupling means centimeters. Long-range "reading" is a different, antenna-heavy problem and usually out of scope for these tools.