Full Report
Popl is a digital business card. The business cards contain NFC that allow someone to open a website so that you can connect with them later. The Popl app, used for setting up the electronic part of the business cards, has a $77 annual subscription fee. To me, this is a classic "I own these and therefore I should be able to do what I want with them". The goal was to edit the NFC data on the card to whatever information that we wanted, since we do own it. The author first tried playing around with the classic NFC Tools app to change the record information. The NFC card had a password write-protect feature (which can only be 4 bytes long). They tried the default passwords of 00000000 and FFFFFFFF but neither of these worked. Next, they tried the Unlock NTAG NFC action on the Flipper Zero to no avail. At this point, we know that the system is not using any default or easy-to-guess passwords. They tried using an iCopy tool, which just wraps the Proxmark tool. Using this, they dumped all available page information from it. Apparently, the Proxmark can sometimes pull out the password from the card but it was unable to do it in this place. From crunching numbers, they claim it would take 27 years to brute force the stored code, making this unviable as well. The iOS application for the business cards must communicate with the NFC chip to write the URL to it. If that's true, then the phone app must have access to the password! Since the password is required for writing and the app indeed does writes, we should be able to figure this out. Using the Proxmarks trace list command, we can see all commands for the card. In the output is an authentication command with the password in plaintext! There's the password, which is just the string test :) With a known password, the author wanted to edit the card. Using the NFC Tools app, they were able to successfully authenticate using the Advanced Commands to send a raw packet. For whatever reason, the authentication would succeed but would fail whenever they tried to do any writes. Although this could probably be solved by writing a custom app to do this, they wanted something easier. With NFC cards, it's possible to just remove the password! They tried to use the ProxMark for this and it worked! The password was removed. It should be noted (not in article) that NFC Tools will use the first 4 bytes of an MD5 hash of the password provided and not the actual bytes of it but there are other apps that will use the raw bytes, like NFC Read Write. Finally, they were able to write their NFC card! This was a good write up that was fun to see real-world application of NFC. In my mind, there is no good way to secure this from unauthorized writes because the password can always be sniffed or reverse-engineered from the app. There are more secure authentication protocols in newer NFC cards (I think?) that could potentially be proxied to a server to prevent writes in the future. But, regardless, I'm happy this got cracked!
Analysis Summary
# Tool/Technique: NFC Password Sniffing & Write-Protection Bypass
## Overview
This technique involves capturing the plaintext password used during an NFC (Near Field Communication) write operation by intercepting communication between a mobile application and an NTAG-based device. Once the password is recovered, the write-protection can be disabled, allowing for unauthorized data modification on the physical tag.
## Technical Details
- **Type**: Technique (Hardware Interception / Credential Sniffing)
- **Platform**: Hardware (NFC/RFID Tags, specifically NTAG series), iOS/Android Mobile Apps
- **Capabilities**: Password recovery via packet sniffing, removal of write-protection, raw NFC command injection.
- **First Seen**: Reported in 2024 (Context: Popl Digital Business Cards)
## MITRE ATT&CK Mapping
- **[TA0006 - Credential Access]**
- [T1557 - Adversary-in-the-Middle] (Sniffing NFC communication)
- [T1649 - Steal or Forge Authentication Certificates] (Extracting tag passwords)
- **[TA0009 - Collection]**
- [T1125 - Video Capture] (Not applicable, but context involves physical proximity)
- **[TA0005 - Defense Evasion]**
- [T1553 - Subvert Trust Controls] (Removing hardware-level write protection)
## Functionality
### Core Capabilities
- **Traffic Sniffing**: Utilizing hardware like the Proxmark3 to monitor the RF field and capture the `PWD_AUTH` command sent by a legitimate mobile app to an NFC card.
- **Password Recovery**: Extracting the 4-byte plaintext password from the captured command trace.
- **Data Modification**: Writing new NDEF (NFC Data Exchange Format) records to the tag once authenticated.
### Advanced Features
- **Write-Protection Removal**: Using the Proxmark3 or advanced NFC apps to send raw commands that clear the password-protected pages or disable the AUTH0 byte, permanently removing security constraints.
- **Raw Packet Injection**: Sending specific hex commands to bypass limitations in standard consumer NFC applications.
## Indicators of Compromise
- **File Hashes**: N/A (Hardware-based attack)
- **File Names**: N/A
- **Registry Keys**: N/A
- **Network Indicators**: N/A
- **Behavioral Indicators**:
- Presence of unauthorized NDEF records on issued hardware.
- Unexpected authentication failures for legitimate users (if the password was changed by an attacker).
- Use of NFC sniffing hardware (Proxmark3, Flipper Zero) in proximity to target devices.
## Associated Threat Actors
- Security Researchers / Hobbyists (Primary in this context)
- Social Engineers (Potentially for credential harvesting or URL redirection)
## Detection Methods
- **Signature-based detection**: N/A
- **Behavioral detection**: Monitoring for repeated failed `PWD_AUTH` attempts (Brute force detection), though hardware limitations often prevent logging on the tag itself.
- **Physical Inspection**: Using tools like the Flipper Zero to check if the `AUTH0` configuration on the tag has been altered from factory settings.
## Mitigation Strategies
- **Dynamic Authentication**: Use NFC chips that support AES-128 based mutual authentication (e.g., NTAG DNA) rather than static 4-byte passwords.
- **Server-Side Validation**: Instead of storing sensitive logic or passwords in the client-side app, use a proxied authentication method where the server handles secret keys.
- **Password Complexity**: Avoid using easily guessable strings (e.g., "test") for production hardware.
- **Encrypted Data**: Store encrypted payloads on the NFC tag so that even if write-protection is bypassed, the attacker cannot read or forge valid data without the master key.
## Related Tools/Techniques
- **Proxmark3**: An industry-standard RFID/NFC research tool used for sniffing and emulating tags.
- **Flipper Zero**: A multi-tool for pentesters capable of reading, emulating, and performing basic NTAG unlocking.
- **iCopy**: A simplified interface for Proxmark-based cloning and dumping.
- **NFC Tools / NFC Read Write**: Mobile applications used for interacting with NDEF records and sending raw commands.