NFCGate: Setup and Execution of a Relay Attack

From Embedded Lab Vienna for IoT & Security
Jump to navigation Jump to search

Summary

We used NFCGate to do a relay attack. In this attack, the data from a real card is sent to a phone and then to the card reader. The card doesn’t need to be close to the reader. This can be used to trick the system, for example in contactless payments or door access.

Architecture

The following diagram illustrates the architecture we used to implement our relay attack. One smartphone functions as the Tag, while the other acts as the Reader. Communication between the two devices is routed through a server, which for the purpose of this project, was hosted on a laptop.

Architecture.jpg

Requirements

smartphones used

  • Samsung Galaxy A40
  • LG nexus 5G

smartphone Applications

Laptop Applications

Installation

Smartphones

Download NFC Gate

Download the APK v2.4.4.apk: Download NFCGate

Install NFC Gate

Install via ADB:

adb install Downloads/NFCGate.2.4.4.apk

Ubuntu

Download NFC Server

Create a folder:

mkdir nfcGate
cd nfcGate

Install NFC Server

Clone the repository:

sudo git clone https://github.com/nfcgate/server.git


Attack

Hotspot

Enable hotspot from smartphone and connect the server (Ubuntu)

Run server

go to the folder:

cd nfcGate/server

run the server:

python3 server.py

ServerListening.png

Ip server

Check the IP address (from hotspot)

ip a

IpHotspot.png

NFC Gate settings

Open the NFCGate app and go to settings:

AppNFCGate.png NfcGateMenue.jpg

Go to "Hostname and Port":

HostnamePortnumber.jpg

The hostname is the same IP address as the server:

NFCGateHostname.jpg IpHotspot.png

Port number is always 5566:

NFCGatePortnumber.jpg

In the NFCGate app, go to Relay mode. Use the Tag option for the card and the Reader option for the NFC terminal.

RelayModeReaderTag.jpg

Now you have a connection through the server:

ConnectionStatus.jpg

Relay Attack

Hold the smartphone with the Tag side near the card:

SmartphoneToCard.jpeg

Hold the smartphone with the Reader side near the terminal:

PhoneToAutomate.jpg


Used Hardware


References