About Hitag2 and NXP letter

asper · 2013-11-17 17:20:06

Hi dears, expecially Roel,

I re-read with interest the "gone in 360 seconds" documents and I would like to ask a question about that sentence:

Following the principle of responsible disclosure, we
have contacted the manufacturer NXP and informed
them of our findings six months ahead of publication.
We have also provided our assistance in compiling a document
to inform their customers about these vulnerabilities.
The communication with NXP has been friendly
and constructive. NXP encourages the automotive industry
for years to migrate to more secure products that
incorporate strong and community-reviewed ciphers like
AES.

In particular is it possible to read the letter and the correspondant NXP answer/s and "encourages" to automotive industry ? Is a link available ?

Last edited by asper (2013-11-17 21:24:30)

rule · 2013-11-17 21:05:19

To my knowledge, there is no public document about this particular notification. However, there is a public document from 2009, that notifies collaborating parties of preliminary weaknesses in Hitag products.

asper · 2013-11-17 21:31:22

Thank you very much for your answer; looking at this NXP partner list there seems not to be any relation with car manufacturers... so who received that public document in automotive industries ? ECU producers ?

Last edited by asper (2013-11-17 21:34:40)

djrocket · 2013-11-21 17:59:07

the document you read is
Gone in 360 Seconds: Hijacking with Hitag2
Roel Verdult Flavio D. Garcia Josep Balasch
?

it's a 16 pages?

asper · 2013-11-21 21:31:40

Yes, it is.

asper · 2014-01-18 13:53:43

Hi Roel, recently someone stole my brother's car (Renault Megane Scenic); it is written it has an Hitag2 security "device" so I thought it was stolen by expert car-thieves but opening the remote control/immo i found this:

It is a PCF7943 but there seems to be no info on this "device"... do you have something to read ?

Also is there anyone who know a way to "read" that pseudo-QRcode in the pcb ? Here it is a higher resolution verison.

midnitesnake · 2014-01-18 18:43:38

PCF7943 https://avtotools.com/products_files/Hi … al_eng.pdf

marshmellow · 2014-01-19 04:21:52

btw, the barcode is a data matrix with a value of 10059750810611

asper · 2014-01-19 08:09:52

@midnitesnake: thank you for the link ! I wasn't aware it belongs to hitag2 family ! I Updated the RFID tag list !

@marshmellow: thanks to you too ! Can you explain how you decoded it ?

Can someone also explain the whole circuitery on the PCB ?

marshmellow · 2014-01-19 22:56:37

I recognized the type but I didn't have a proper reader so I made it black and white and read it with a barcode scanner app on my android phone. (The app reads only black and white codes.)

asper · 2014-01-19 22:58:24

Name of the app for those matrix code?

marshmellow · 2014-01-19 23:01:44

Barcode Scanner by ZXing team

marshmellow · 2014-01-19 23:02:52

That app reads most barcode types.

asper · 2014-01-19 23:19:54

Thanx i was using qrdroid without success (also black and white).

marshmellow · 2014-01-19 23:43:36

NP. A lot of apps only read QR codes which is a very different standard.

vivat · 2014-01-20 04:37:05

On the left side of your photo is S100 circuit-probadly a voltage regulator. Nearby ripped battery holders contacts.
Next 13.56 D:4Z crystal 13.56 Mhz. Used to generate 433.92 Mhz signal. I think that PCF7943 have a x32 multiplier, so that 13.56*32=433.92.
On the right side I see damaged element with coil-maybe a 125 khz antenna? Then 3 yellow buttons, a buzzer and some IC from NXP/Philips 23967 that I couldn't identify.
The QR code can be an unique identifier.

r011 · 2015-03-31 18:07:36

I just start to work on renault card key rf and rfid and maybe someone will be intrested for chip info s100 from picture.
It is infineon tda 5100 ASK/FSK Transmitter 868/433 MHz.In renault card key rf modulation is 2fsk deviation 100khz,baud rate 10khz,
433.95 mhz

r011 · 2015-03-31 18:10:56

I am looking for pcf791,7943,7946 etc FULL datasneet if somebody have this please contact me

iceman · 2015-03-31 18:40:41

I think the pcf7931 datasheet is available if you google.

r011 · 2015-04-01 14:01:28

iceman wrote:

I think the pcf7931 datasheet is available if you google

Yes pcf7931 is available but I am intrested in pcf7941,7943,7946,7947 FULL datasheet not only one page pdf
Thanks

Proxmark3 community

Announcement

#1 2013-11-17 17:20:06

About Hitag2 and NXP letter

#2 2013-11-17 21:05:19

Re: About Hitag2 and NXP letter

#3 2013-11-17 21:31:22

Re: About Hitag2 and NXP letter

#4 2013-11-21 17:59:07

Re: About Hitag2 and NXP letter

#5 2013-11-21 21:31:40

Re: About Hitag2 and NXP letter

#6 2014-01-18 13:53:43

Re: About Hitag2 and NXP letter

#7 2014-01-18 18:43:38

Re: About Hitag2 and NXP letter

#8 2014-01-19 04:21:52

Re: About Hitag2 and NXP letter

#9 2014-01-19 08:09:52

Re: About Hitag2 and NXP letter

#10 2014-01-19 22:56:37

Re: About Hitag2 and NXP letter

#11 2014-01-19 22:58:24

Re: About Hitag2 and NXP letter

#12 2014-01-19 23:01:44

Re: About Hitag2 and NXP letter

#13 2014-01-19 23:02:52

Re: About Hitag2 and NXP letter

#14 2014-01-19 23:19:54

Re: About Hitag2 and NXP letter

#15 2014-01-19 23:43:36

Re: About Hitag2 and NXP letter

#16 2014-01-20 04:37:05

Re: About Hitag2 and NXP letter

#17 2015-03-31 18:07:36

Re: About Hitag2 and NXP letter

#18 2015-03-31 18:10:56

Re: About Hitag2 and NXP letter

#19 2015-03-31 18:40:41

Re: About Hitag2 and NXP letter

#20 2015-04-01 14:01:28

Re: About Hitag2 and NXP letter

Board footer