Cipurse Infineon hacks?

dk1206 · 2015-01-09 16:20:51

Hey guys,

After testing the MIFARE classic hacks, I was wondering if there are any existing hacks on the Cipurse's Infineon card with Proxmark III ?
If so, could you please provide some links to it on how to do it ?

Thanks

dk1206 · 2015-01-12 09:52:57

Hey guys,

Is noone working on this new Infineon cards by CIPURSE (OSPT Alliance) ?
If not, do you think PM3 can be used to read / write stuff using the ISO14443-A option ?

asper · 2015-01-12 11:29:55

CIPURSE is a kind of standard/specification, a standard cannot be "hacked", its implementation can
It realys on more than 1 card/tag type. You must identify which card do you have to try to study it.
It will probably be a smartcard and yes, pm3 can probably "talk" with that kind of hardware if it is ISO14443 compliant.

CIPURSE, a True Open Standard for Transit Fare
Collection
§ Especially designed for contactless card and NFC-based fare collection systems
§ Vendor-independent (all card suppliers can attain CIPURSE certification for their products)
§ Technology providers free to add functionality outside the common core (multi-application support)
§ All CIPURSE products undergo rigorous certification testing by third-party organization (Keolabs)
§ Incorporates advanced AES-128 security
§ Ensures interoperability of all forms of contactless payment media
§ Reader independent: Any ISO/IEC 14443 compliant reader can be used
§ Simple, low-cost licensing terms
5 Copyright © 2013 OSPT Alliance Based on Proven, Widely-Used Open Standards
§ ISO 24014: Interoperable fare management system
§ ISO/IEC 7816: Smartcards
§ ISO/IEC 14443: Contactless communication
§ ISO/IEC 18092: Near Field Communication
§ AES 128: FIPS encryption standard

Taken from here.

Last edited by asper (2015-01-12 11:32:17)

dk1206 · 2015-01-12 11:39:27

Thank you Asper. I am trying to do some comparisons between CIPURSE and MIFARE technologies for my study (and possible thesis).
The thing is, I cannot find much info on CIPURSE technologies / cards, any attempts to "talk" with them.. so I'm trying ot use my PM3 to do that, since it works beautifully with my MIFARE Classic card.

You are right, I have to identify what kind of card I have. It is probably a Smart Card since it's used in TAXI bussiness. But hand no luck with "READ UIDS" in PM3 GUI Tool, since it said "Card selection Failed".

Not sure where to proceed on this, trying to find some documentation online on CIPURSE to study it.

asper · 2015-01-12 12:05:36

You need to study ISO smartcard specifications (expecially APDUs and APDUs parameters) to communicate. Anyway if it does not respond to REQA command it is not ISO14443A compatible. Try to send a READER command and then a LIST command and post the results. The list command had been recently modified to hf list 14a insted of hf 14 list so if it doesn't work with the gui button send it manually after the reader command (the gui will be updated in the future).

dk1206 · 2015-01-12 13:11:21

Hey Asper,

Thank you very much for helping me out! Very kind of you, as I'm a beginner, but willing to study. Found some ISO's on the above mentioned Smart Card specs. Will start reading them, as they have quite some pages to go through.

Meanwhile, this is the output for READER and then LIST commands:

ATQA : 04 00          
 UID : 3f d4 7b 63           
 SAK : 38 [1]          
TYPE : Nokia 6212 or 6131 MIFARE CLASSIC 4K          
 ATS : 0c 78 77 84 03 77 43 32 54 00 08 01 61 3f           
       -  TL : length is 12 bytes          
       -  T0 : TA1 is present, TB1 is present, TC1 is present, FSCI is 8          
       - TA1 : different divisors are supported, DR: [2, 4, 8], DS: [2, 4, 8]          
       - TB1 : SFGI = 0, FWI = 8          
       - TC1 : NAD is supported, CID is supported          
       -  HB : 77 43 32 54 00 08 01           
proxmark3> 
proxmark3> hf 14a list
recorded activity:          
 ETU     :rssi: who bytes          
---------+----+----+-----------          
 +      0:    :     52              
 +    236:   0: TAG 04  00              
 +      0:    :     93  20              
 +    452:   0: TAG 3f  d4  7b  63  f3              
 +      0:    :     93  70  3f  d4  7b  63  f3  72  ce              
 +    308:   0: TAG 38  35  ec              
 +      0:    :     e0  80  31  73              
 +   1276:   0: TAG 0c  78  77  84  03  77  43  32  54  00  08  01  61  3f

asper · 2015-01-12 14:21:06

- Well, as you can see the card answered to the command 52 (this answer is called ATQA = 04 00) so it is ISO14443A compliant.
- The tag then answered to the 93 20 command with its own UID: 3f d4 7b 63 (in some cases this UID changes each time you try to read the tag)
- Then it has been selected by the reader: 93 70 + card answer to 93 20.
- Tag answered 38 (this is the SAK) to the 93 70 command.
- Then reader sent the Request Answer to Select [RATS] (E0...) that is to say "Hey card, tell me who you are and what you want".
- And the card answered with it's ATS (you can get lot of info from ATS as you can see in the 1st part of your pasted sequence ATS it is decoded for you by the proxmark3 client). The latest bytes of the ATS contains the historycal bytes that in your case say: "wC2T" (dunno wuat it is).

In most cases (not all cases) last 2 bytes of sent commands or received answers are the CRC (pm3 can auto-calculate it).

SAK = 38 let me imagine it is a smartcard with a mifare emulation feature.

Well now you have LOT of information about your card; study the ISO14443-3 and ISO14443-4 datasheets and try to figure out what that card is; good luck.

Last edited by asper (2015-01-12 14:25:21)

dk1206 · 2015-01-12 14:29:17

Thank you very much Asper for the wide answer! I'll do now some digging on standards. I might need your help later on, so hopefully you'll be around, if there'll be some missunderstandings - as I'd really like to know this standards and PM3's functionalities and abilities to get info's out of cards.

One questions are the abreviations that you types (ATS, etc.) mentioned in ISO standards or are they on Wiki for PM3 related stuff?

PS: The card I have is a harmless prepaid card and there's no intention into hacking into anything. I feel stupid for putting such title of this Topic. I just want to learn and analyze cards with help of PM3 and then compare results of 2 different manufacturers (MIFARE and CIPURSE). MIFARE has it easy, since there's an open hack already in GUI Tool. But for CIPURSE one, there's none yet.

Last edited by dk1206 (2015-01-12 14:30:14)

asper · 2015-01-12 14:34:22

And there probably never will be because it is not so common.
Mifare is not a manufacturer nor cipurse.
You received lot of info; now google and proxmark-forum's old threads are your friends so, beefore asking any further question, try to find the answers yourself (such as what the ATS is).

Again, good luck !

Last edited by asper (2015-01-12 14:35:03)

dk1206 · 2015-01-12 16:24:30

Asper could you give me a hint, about how to determine whether the two cards have similiraties ? For e.g. whether CIPURSE is using something from MIFARE or vice versa?

I was reading about SAK (=Select AcKnowledge) and found some datasheets where SAK's are unique to MIFARE CARDS. The 38H , reveals (according to the table I found on internet) that it uses ISO 1443-4 Type A. 0x38 is found in MIFARE ProX and SmartMX xD. However, I am not sure whether I can list this as Mifare feature, or these SAK values can be random (in other words: each card developer can use any value for SAK, even if for e.g. MIFARE uses that specific value).

asper · 2015-01-12 17:43:36

Rfid smartcards can emulate mifare card (mifare are not real smart cards). You cannot use atqa+sak to 100% identify a specific catd but they can be useful.

You neex to study more my friend. ISO14443 pdfs have almost all the answers.

dk1206 · 2015-01-12 17:49:50

I understand, and I really did read PDFs, not only the ISO14443 ones, but the NXP Type Indetifier one.
However, I dont get exact results. I wonder why.

The SAK value 38 corresponds with MIFARE CLASSIC 4k EMULATED
However, ATQA value is 04 00 (if I understood ISO1443-4 correclty, this is actually 0x04?) , which doesn't corespond to MIFARE CLASSIC 4K EMULATED, but to either: MIFARE CLASSIC 1K.

I got confused a little bit. My ATQA + SAK is = 0x04 + 38 .. but this combination I cannot find. I will go again through PDF's. I wrote everything down that I got from the PM3 and converted into binary values and checked what each bit means. The above conclusion came to my mind, but it's confusing since ATQA and SAK dont really match in that sequence.

Gosh..hopefully some light will shine soon in my head!

EDIT: I just tested it with an Android App posted on these Forums called MCT = MIFARE CLASSIC TOOL.
This App gave me SAK value 56. Which si different than what PM3 gave me. I dont know which value is now correct, the PM3 one or the App's value?

Last edited by dk1206 (2015-01-12 17:57:00)

asper · 2015-01-12 21:46:44

asper wrote:

You cannot use atqa+sak to 100% identify a specific catd but they can be useful.

It is probably a tag never reported by anyone else so you are a bit out of luck and you need to figure it out all by yourself.

Both SAK values are correct, one is in decimal and the other one is in hex. It is preferrable to use hex values.

It is impossible that you read the whole iso14443 datasheet, if so you did not understand anything about what you read. It is along and tech doc impossible to understand in few hours.

dk1206 · 2015-01-14 12:21:50

Maybe it's true that I didnt understand the ISO datasheets completely. But I was only trying to indentify wether there are any MIFARE features inside the CIPURSE card.

Although PM3 suggests the TYPE as MIFARE Classic 4k, with further investigation of ISO 14443 (from 1-4) and MIFARE Type Indetificator, I concluded that there are none:

(Link to the MIFARE Type Indetificator PDF)

- SAK 38 is not known for MIFARE chips. The same value only appeared in a MIFARE's PDF (Read page 12 "Coding of SAK for MIFARE Implemenation), when you OR the value 18 (which is corresponding to SAK value for Mifare Classic card). They call the ORed SAK value, the Resultant SAK Value. But I dont think PM3 posts the resultant SAK values.
- ATQA 0400 is not found in any MIFARE type cards. There is a value 00 04 coresponding to the Mifare Classic Card. And there is a section in Mifare's PDF where it says "The ISO/IEC 14443 transfers LSByte first. So e.g. 0x 00 44 (ATQA of the MF UL) is often recieved as 0x 44 00." (found on page 8, Coding of ATQA). This would indicate to me that there's a possibility that PM3 recieves the ATQA by the ISO Standard and that the value should be transfered - I couldn't find any document of PM3 stating this.
- ATS is the only part I couldn't find in Mifare PDF's, so I couldn't conclude any comparisment. I only own a Mifare 4k Classic, which while read by PM3 says: "proprietary non iso14443a-4 card found, RATS not supported.", so I couldn't retrieve the ATS to compare it to CIPURSE's. Unfortunately I don't own Mifare Classic 1k.
From Cipurse's ATS I could only understand the Historical Bytes as you did, and got C2T (according to Cipurses Documentation, only 3 Bytes represent some sort of string - in that same documentation it says, that it's ussualy CIP, so the card I own might not be completely made by Cipurse standards). The first byte 77 states the Controller control type ( dont know what this means) . The remaining bytes tells us the software version.

This is all I could find out. Everything else in ATS is stated as in ISO 14443 standards, which is also used in Mifare cards, but that doesn't tell me that Cipurse is using Mifare technology inside it, since both are obligated to follows the standards.

I might not be the best in deducting Proximity Inductive Coupling Cards, but I wanted to give it a try, since I own a PM3 and was very interested in analyzing two different PICCs, which are used in same environments (for example: Transport Pay). Wanted to know if Cipurse uses their own technology (chips) or they use MIFARE ones.

Anyway, thanks for the help Asper.

dk1206 · 2015-01-14 12:23:50

Maybe it's true that I didnt understand the ISO datasheets completely. But I was only trying to indentify wether there are any MIFARE features inside the CIPURSE card.

Although PM3 suggests the TYPE as MIFARE Classic 4k, with further investigation of ISO 14443 (from 1-4) and MIFARE Type Indetificator, I concluded that there are none:

(Link to the MIFARE Type Indetificator PDF)

- SAK 38 is not known for MIFARE chips. The same value only appeared in a MIFARE's PDF (Read page 12 "Coding of SAK for MIFARE Implemenation), when you OR the value 18 (which is corresponding to SAK value for Mifare Classic card). They call the ORed SAK value, the Resultant SAK Value. But I dont think PM3 posts the resultant SAK values.
- ATQA 0400 is not found in any MIFARE type cards. There is a value 00 04 coresponding to the Mifare Classic Card. And there is a section in Mifare's PDF where it says "The ISO/IEC 14443 transfers LSByte first. So e.g. 0x 00 44 (ATQA of the MF UL) is often recieved as 0x 44 00." (found on page 8, Coding of ATQA). This would indicate to me that there's a possibility that PM3 recieves the ATQA by the ISO Standard and that the value should be transfered - I couldn't find any document of PM3 stating this.
- ATS is the only part I couldn't find in Mifare PDF's, so I couldn't conclude any comparisment. I only own a Mifare 4k Classic, which while read by PM3 says: "proprietary non iso14443a-4 card found, RATS not supported.", so I couldn't retrieve the ATS to compare it to CIPURSE's. Unfortunately I don't own Mifare Classic 1k.
From Cipurse's ATS I could only understand the Historical Bytes as you did, and got C2T (according to Cipurses Documentation, only 3 Bytes represent some sort of string - in that same documentation it says, that it's ussualy CIP, so the card I own might not be completely made by Cipurse standards). The first byte 77 states the Controller control type ( dont know what this means) . The remaining bytes tells us the software version.

This is all I could find out. Everything else in ATS is stated as in ISO 14443 standards, which is also used in Mifare cards, but that doesn't tell me that Cipurse is using Mifare technology inside it, since both are obligated to follows the standards.

I might not be the best in deducting Proximity Inductive Coupling Cards, but I wanted to give it a try, since I own a PM3 and was very interested in analyzing two different PICCs, which are used in same environments (for example: Transport Pay). Wanted to know if Cipurse uses their own technology (chips) or they use MIFARE ones.

Anyway, thanks for the help Asper.

dk1206 · 2015-01-14 12:23:52

Maybe it's true that I didnt understand the ISO datasheets completely. But I was only trying to indentify wether there are any MIFARE features inside the CIPURSE card.

Although PM3 suggests the TYPE as MIFARE Classic 4k, with further investigation of ISO 14443 (from 1-4) and MIFARE Type Indetificator, I concluded that there are none:

(Link to the MIFARE Type Indetificator PDF)

- SAK 38 is not known for MIFARE chips. The same value only appeared in a MIFARE's PDF (Read page 12 "Coding of SAK for MIFARE Implemenation), when you OR the value 18 (which is corresponding to SAK value for Mifare Classic card). They call the ORed SAK value, the Resultant SAK Value. But I dont think PM3 posts the resultant SAK values.
- ATQA 0400 is not found in any MIFARE type cards. There is a value 00 04 coresponding to the Mifare Classic Card. And there is a section in Mifare's PDF where it says "The ISO/IEC 14443 transfers LSByte first. So e.g. 0x 00 44 (ATQA of the MF UL) is often recieved as 0x 44 00." (found on page 8, Coding of ATQA). This would indicate to me that there's a possibility that PM3 recieves the ATQA by the ISO Standard and that the value should be transfered - I couldn't find any document of PM3 stating this.
- ATS is the only part I couldn't find in Mifare PDF's, so I couldn't conclude any comparisment. I only own a Mifare 4k Classic, which while read by PM3 says: "proprietary non iso14443a-4 card found, RATS not supported.", so I couldn't retrieve the ATS to compare it to CIPURSE's. Unfortunately I don't own Mifare Classic 1k.
From Cipurse's ATS I could only understand the Historical Bytes as you did, and got C2T (according to Cipurses Documentation, only 3 Bytes represent some sort of string - in that same documentation it says, that it's ussualy CIP, so the card I own might not be completely made by Cipurse standards). The first byte 77 states the Controller control type ( dont know what this means) . The remaining bytes tells us the software version.

This is all I could find out. Everything else in ATS is stated as in ISO 14443 standards, which is also used in Mifare cards, but that doesn't tell me that Cipurse is using Mifare technology inside it, since both are obligated to follows the standards.

I might not be the best in deducting Proximity Inductive Coupling Cards, but I wanted to give it a try, since I own a PM3 and was very interested in analyzing two different PICCs, which are used in same environments (for example: Transport Pay). Wanted to know if Cipurse uses their own technology (chips) or they use MIFARE ones.

Anyway, thanks for the help Asper.

dk1206 · 2015-01-14 12:25:52

Maybe it's true that I didnt understand the ISO datasheets completely. But I was only trying to indentify wether there are any MIFARE features inside the CIPURSE card.

Although PM3 suggests the TYPE as MIFARE Classic 4k, with further investigation of ISO 14443 (from 1-4) and MIFARE Type Indetificator, I concluded that there are none:

(Link to the MIFARE Type Indetificator PDF)

- SAK 38 is not known for MIFARE chips. The same value only appeared in a MIFARE's PDF (Read page 12 "Coding of SAK for MIFARE Implemenation), when you OR the value 18 (which is corresponding to SAK value for Mifare Classic card). They call the ORed SAK value, the Resultant SAK Value. But I dont think PM3 posts the resultant SAK values.
- ATQA 0400 is not found in any MIFARE type cards. There is a value 00 04 coresponding to the Mifare Classic Card. And there is a section in Mifare's PDF where it says "The ISO/IEC 14443 transfers LSByte first. So e.g. 0x 00 44 (ATQA of the MF UL) is often recieved as 0x 44 00." (found on page 8, Coding of ATQA). This would indicate to me that there's a possibility that PM3 recieves the ATQA by the ISO Standard and that the value should be transfered - I couldn't find any document of PM3 stating this.
- ATS is the only part I couldn't find in Mifare PDF's, so I couldn't conclude any comparisment. I only own a Mifare 4k Classic, which while read by PM3 says: "proprietary non iso14443a-4 card found, RATS not supported.", so I couldn't retrieve the ATS to compare it to CIPURSE's. Unfortunately I don't own Mifare Classic 1k.
From Cipurse's ATS I could only understand the Historical Bytes as you did, and got C2T (according to Cipurses Documentation, only 3 Bytes represent some sort of string - in that same documentation it says, that it's ussualy CIP, so the card I own might not be completely made by Cipurse standards). The first byte 77 states the Controller control type ( dont know what this means) . The remaining bytes tells us the software version.

This is all I could find out. Everything else in ATS is stated as in ISO 14443 standards, which is also used in Mifare cards, but that doesn't tell me that Cipurse is using Mifare technology inside it, since both are obligated to follows the standards.

I might not be the best in deducting Proximity Inductive Coupling Cards, but I wanted to give it a try, since I own a PM3 and was very interested in analyzing two different PICCs, which are used in same environments (for example: Transport Pay). Wanted to know if Cipurse uses their own technology (chips) or they use MIFARE ones.

Anyway, thanks for the help Asper.

dk1206 · 2015-01-14 12:34:26