Matteo Drera sevenissimo

Cloning a 7-byte UID MFC (Mifare Classic) 1k card and more

This is a little blog about my trials of figuring out how to clone a 7-byte 1k MFC card and more I discovered. I'm not an expert, this is just what I found out. I'm writing it down because I couldn't find a single place where this info was grouped together.

A little while ago I bought a Flipper Zero because I was interested in the world of NFC/RFID tags and I wanted to figure out a way to clone my NFC card used to open the underground waste container in my neighbourhood.

Findings

It turns out most of my NFC cards used for various services are so called MIFARE Classic (MFC) 1K cards. These appear to be the most common card used for semi-secure things. The tag used to enter my office is a MIFARE DESfire card, which as far as I know, isn't clonable unless you have the decryption keys.
- There is also a MIFARE Classic 4K version which can store more data. I haven't encountered this one yet so nothing I can tell you about it.
The MFC Classic

Create a manual scene in Mi Home for the device you'd like to control
Use Http Toolkit to figure out the scene id.
- Install the app on PC and Android, follow the instructions - install CA certificate and connect
- Set to only intercept the Mi home app
- While snooping, start the scene in Mi home, then you can disconnect http toolkit
- Look for this request: https://de.api.io.mi.com/app/scene/start
- The request body should look like this (actual values replaced with *) data=*&rc4_hash__=*&signature=*&_nonce=*&ssecurity=*
- You will need the values for data, nonce and ssecurity. Run each one by https://www.urldecoder.org/.

Download this python script: https://gist.github.com/socram8888/4b8949023c8e8153970764d20c935785

Arch Linux ARM on Crostini

I got Arch Linux ARM installed on a Lenovo Chromebook Duet! I mostly used the instructions from the Arch Wiki as reference.

0. Before we begin

Reverse Engineering SP110e LED Controller

Through Bluetooth sniffing, using this method I've been able to (semi reliably) control the SP110e controller via Homebridge.

You can find this controller for very cheap here: https://www.aliexpress.com/item/4000773623427.html?spm=a2g0o.productlist.0.0.4f09329cJ7C1H4&algo_pvid=542e757b-587f-4540-8652-2195883f1349&algo_expid=542e757b-587f-4540-8652-2195883f1349-0&btsid=0bb0622a16012309671478585ed4bd&ws_ab_test=searchweb0_0,searchweb201602_,searchweb201603_

This entire guide is for Bluetooth LE libraries, and uses hexidecimal.

LE configuration

Enter this in the search box along with your search terms:

Get all gists from the user santisbon.
user:santisbon

Find all gists with a .yml extension.
extension:yml

Find all gists with HTML files.
language:html

security and hardening options for systemd service units

A common and reliable pattern in service unit files is thus:

NoNewPrivileges=yes
PrivateTmp=yes
PrivateDevices=yes
DevicePolicy=closed
ProtectSystem=strict

	// Writes link comment to text file
	// Trigger: "A download has stopped"
	// Has some settings, just search for "settings" in this code

	// Main function that runs the script based on the early return principle
	function run() {
	// Early return if the download is not finished
	if (!link.isFinished()) {
	// console.log("Link is not yet downloaded");
	return;

	# Triggerable nmap sensor v1.1
	# Created by Auriiolym ([email protected]).
	#
	# This is a custom nmap presence sensor that can be triggered by running the command_line.reload service.
	# The nmap tracker integration (https://www.home-assistant.io/integrations/nmap_tracker/) does not
	# support a service that can manually trigger an nmap scan. Such a feature can be useful when you
	# want a motion sensor to trigger a presence scan.
	# These steps create a binary_sensor entity synced to a device_tracker entity that you can add to a person
	# entity. This is necessary because binary_sensor entites can not be added to a person, but device_tracker
	# entities can.

	var zip = new JSZip();
	var count = 0;
	var zipFilename = "zipFilename.zip";
	var urls = [
	'http://image-url-1',
	'http://image-url-2',
	'http://image-url-3'
	];

	urls.forEach(function(url){

	#Requires AutoHotkey v2.0
	<^>!'::Send "``" ; AltGr + ' => `
	<^>!vkDD::Send "~" ; AltGr + ì => ~