RFID Tag Cloning

In the second half of the RFID TTJ episode we covered how to clone or spoof an existing RFID tag. This was partially to expose the security flaws of RFID, but also because it can be very useful. I’ve stayed in a few apartments now that require an RFID tag to get in and out of the main gate. Sometimes you’ll end up getting only one or two RFID tags for the main gate when you have more people living in the same apartment. It’s also inconvenient if you have friends that come over often and you have to let them into the gate every time.

Almost all of this information and work was put together by Micah Elizabeth Scott over at scanlime.org. We simply experimented with the technology and found what works best for us.

Hand Wrapped Coil Antenna and ATtiny85

At this point, if you haven’t already watched the RFID episode of TTJ, you’ll want to check that out now.

As shown in the video, using the code provided at scanlime.org, you can easily create a clone of an EM4102 (Parallax) RFID tag or a standard HID 125kHz tag.

Although it is shown on scanlime.org that you can clone an RFID tag simply using an AVR ATtiny85 and an inductor, we had a lot of trouble getting this to work well. Our first attempt at this used only the ATtiny85 and the inductor and we were only able to get Parallax readers at very close proximity to detect the spoofed tag. It definitely works, but we wanted to build something that would work from a bit greater range.

For some experimentation, we went to our local RadioShack and found this pack of magnet wire for $7.39. Our plan was to hand wrap a coil:

Magnet Wire from RadioShack

After making a few different coils, we found that the 30 gauge wire and approximately 100-125 wraps gave us the best results. For actually wrapping the coils, we dug out an old perf board that another project had been built on. We found an empty space on the board that was 3″ x 1.5″ and then placed four screws into the board. This then allowed us to easily wrap the coil and simply remove the screws after wrapping. We went with this size because it was close to the existing RFID tag and we were curious how well it would work.

Old Perf Board

Wrapping the Coil

As for programming the ATtiny85, you’ll need some sort of programming cable and something that can act as an ISP programmer (Arduino can do this). For our purposes and in line with the previous RFID post, we used a USBtinyISP. We found a small perf board and wired up the 6 pin header to an 8 pin socket. Below are the pinouts for the ISP programming header and the ATtiny85:

ISP Header (USBtinyISP connects through this)

ATtiny85 Pinout

Alright, time to get down to programming. If you haven’t already “acquired” your target tag that you’ll be cloning, you’ll need to do this now. As stated in the video, you can get a Parallax EM4102 tag key by using a Parallax serial RFID reader and anything that can talk TTL serial. For our example, we used an FTDI cable. The easiest way to get data from the FTDI cable is to simply load up the Arduino IDE and select serial monitor. Set your baud rate to 2400 and wave the tag in front of the reader. Write down this value and save it for when we load up the code.

As for getting an HID tag key, you’ll need an HID reader (we prefer the Wiegand version of the MiniProx). We then used an Arduino to connect to our HID MiniProx and get the tag value. Below is a download of our Arduino sketch that explains how to hook up the reader and get the usable site code and unique key that you’ll be entering into the program to be loaded onto the ATtiny85.

HIDReader_v01.zip

The rest of the code loading process is covered in detail in the video. The zip file below contains the source code from scanlime.org, the Makefile, and a text file with the avrdude commands you’ll use to flash the code to the chip. Keep in mind, you will not be able to reprogram the chip again after executing these commands unless you have an external clock source.

rfid_cloning_v01.zip

If you don’t already have the AVR toolchain for compiling and writing code to AVRs, make sure to grab the software package for your OS:

OS X: CrossPack
Windows: WinAVR + USBtinyISP Driver
Linux: avr-gcc/avrdude from your package manager

Once you’ve loaded up your ATtiny85 with code, pop the AVR out of the socket and wire up your coil to the clock pins (PB3 and PB4 on the Pinout above). For our purposes, it doesn’t matter which wire is connected to which pin. At this point you may wish to neatly pack your ATtiny85 in with the coil and wrap it in electrical tape or use some sort of rubberized coating. Now go try out your new spoofed tag!

Wrapped RFID Tag Clone