Upgrade to Pro — share decks privately, control downloads, hide ads and more …

NFCとしゃべってみよう

Aruneko
November 10, 2019

 NFCとしゃべってみよう

セキュリティミニキャンプ北海道 2019で発表した講義資料です

Aruneko

November 10, 2019
Tweet

More Decks by Aruneko

Other Decks in Technology

Transcript

  1. ࣗݾ঺հ w ౻ా༏و !BSVOFLP  w ॴଐ w ߹ಉձࣾ(FPSFQVCMJD+BQBO w

    Ұൠࣾஂ๏ਓ-0$"- w ਆށࡏॅࣨའग़਎ w ೥ηΩϡϦςΟΩϟϯϓશࠃେձमྃ w ʙϛχΩϟϯϓ๺ւಓࢀՃ w ೥౓4FD)BDLࢥࡧۦಈίʔε w ϚΠφϯόʔΧʔυܳਓ
  2. ࣗݾ঺հ w ձࣾͰԿͯ͠Δʁ w "84ͰͷΠϯϑϥ࡞੒ w 1ZUIPOͰͷ"1*αʔόʔ࡞੒ w 3FBDU΍7VFΛ࢖ͬͨϑϩϯτΤϯυͷ࡞੒ w

    झຯ w ετϦʔτϐΞϊΊ͙Γ w ਆށʹ͸ແବʹՕॴ͙Β͍͋ͬͨΓ͢Δ w ࡳຈͷϊϧϕαʹ΋͋ΔΒ͘͠ࡢ೔ߦ͖ͬͯͨ
  3. /'$ͷϞʔυ w /'$ػث ϦʔμεϚϗ ʹ͸࣍ͷͭͷϞʔυ͕͋Δ w λά Χʔυ ͷಡΈॻ͖ ඞਢػೳ

     w 11௨৴ ඞਢػೳ  w ػثಉ࢜Ͱ௚઀௨৴͢Δػೳ w ΧʔυΤϛϡϨʔγϣϯ Φϓγϣϯػೳ  w /'$ΧʔυͷΑ͏ʹৼΔ෣͏ػೳ
  4. /'$λάͷن֨ w /'$λά͸/%&' /'$%BUB&YDIBOHF'PSNBU ʹଇͬͯ௨৴͢Δ w /%&'͸ύέοτ΍ίϚϯυʹؔ͢Δϓϩτίϧͷن֨ w 5ZQF5PQB[ ࠃ಺Ͱ͸ݟͨ͜ͱͳ͍

     w 5ZQF.JGBSF6MUSBMJHIU "NJJCP  w 5ZQF'FMJ$B ަ௨ܥ*$OBOBDP  w 5ZQF"*40" UBTQP7JTBQBZ8BWF  w 5ZQF#*40# ϚΠφϯόʔΧʔυύεϙʔτӡస໔ڐূ
  5. 3$4ͷ઀ଓ֬ೝ w λʔϛφϧΛ։͍ͯʮQZUIPONOGDʯίϚϯυΛೖྗ w OGDQZͱ͍͏ϥΠϒϥϦ͕༻ҙ͍ͯ͠ΔίϚϯυ w σόΠε͕ݟ͔ͭΕ͹४උ׬ྃʂ security@minicamp:~$ python3 -m

    nfc This is the 1.0.3 version of nfcpy run in Python 3.6.8 on Linux-5.0.0-32-generic-x86_64-with-Ubuntu-18.04-bionic I'm now searching your system for contactless devices ** found SONY RC-S380/P NFC Port-100 v1.11 at usb:001:004 I'm not trying serial devices because you haven't told me -- add the option '--search-tty' to have me looking -- but beware that this may break other serial devs ୺຤͸͜Εˠ
  6. 'FMJ$B಺෦ͷσʔλߏ଄ ϓϥΠϕʔτྖҬ ৄࡉෆ໌  ݸਓ৘ใͳͲͷ֨ೲʹར༻ ڞ௨ྖҬ γεςϜྖҬ αʔϏε ྖҬ ϒϩοΫ

    ྖҬ γεςϜྖҬ αʔϏε ྖҬ ϒϩοΫ ྖҬ ৐ंɾߪങཤྺͳͲͷ ֨ೲʹར༻
  7. *%Nͱ1.NΛऔಘͯ͠ΈΔ w ʮNJOJDBNQ@IPLLBJEP@ʯσΟϨΫτϦʹDE w ʮHJUQVMMʯͰ࠷৽൛ΛҾͬுͬͯ͘Δ w ʮQZUIPO@EVNQ@TZTUFNTQZʯͰΧʔυΛಡΈऔΔ w ޙͰ࢖͏ͷͰ*%Nͱ1.NΛϝϞ͓ͯ͜͠͏ security@minicamp:~$

    cd minicamp_hokkaido_2019/ security@minicamp:~/minicamp_hokkaido_2019$ git pull security@minicamp:~/minicamp_hokkaido_2019$ python3 01_dump_systems.py IDm: 01010a107816b822 PMm: 100b4b428485d0ff System Code: 0x0003 System Code: 0xfe00 System Code: 0x86a7
  8. αʔϏεྖҬͷଐੑ छྨ આ໌ ϥϯμϜ 3BOEPN ࡶଟͳσʔλ֨ೲ༻ αΠΫϦοΫ $ZDMJD ϩʔςʔτ͢Δ ϩάͷ֨ೲ༻

    ύʔε 1VSTF ਖ਼ͷ੔਺ઐ༻"1* w ͬ͘͟Γछྨ w ͜ͷछྨΛݟͯதͷσʔλΛ૝૾ w ͦΕͧΕʹ w ಡΈऔΓઐ༻ϑϥά w ൿີ伴͕ඞཁ͔ w ͓෼͔Γͷ௨Γɺ伴ෆཁͷσʔλ͔͠ಡΊͳ͍
  9. ϒϩοΫྖҬͷऔಘ w 3FBE8JUIPVU&ODSZQUJPOίϚϯυΛൃߦͯ͠த਎ΛಡΉ w ൿີ伴࣋ͬͯͳ͍ͷͰ࢓ํͳ͍Ͷ w ʮQZUIPO@EVNQ@CMPDLTQZ<4:4><4&37*$&>ʯͰμϯϓ w ·ͣ͸γεςϜίʔυͱαʔϏείʔυΛࢦఆ w

    ͋ͱ͸3FBE8JUIPVU&ODSZQUJPOίϚϯυͰద౰ͳճ਺μϯϓ w ԿճμϯϓͰ͖Δ͔͸αʔϏεଐੑʹΑ͍ͬͯΖ͍Ζ w 3BOEPNͩͱճɺ$ZDMJDͩͱճͱ͔
  10. ४උ w 7JTVBM4UVEJP$PEFΛىಈ w λʔϛφϧͰʮNJOJDBNQ@IPLLBJEP@ʯσΟϨΫτϦʹ͍Δ͜ͱΛ֬ೝ w ʮDPEFʯͰىಈʢ࠷ޙͷυοτΛ๨Εͣʹʣ w ʮ@EJBMPHVF@XJUI@OGDQZʯΛ։͘ w

    ʮදࣔʯ͔ΒʮλʔϛφϧʯͰλʔϛφϧΛදࣔ w $USM 4IJGU !Ͱ΋0, security@minicamp:~/minicamp_hokkaido_2019$ code . security@minicamp:~/minicamp_hokkaido_2019$
  11. 1PMMJOHίϚϯυͷൃߦ w NBJOؔ਺Λฤू w 5ZQF5BHʹ઀ଓͯ͠੾அ͢Δͱ͜Ζ·Ͱ͸هड़ࡁΈ w QPMMJOHίϚϯυΛൃߦͯ͠ɺͦͷ݁ՌΛϑΥʔϚοτͯ͠දࣔͯ͠ΈΔ def main() ->

    None: felica = Type3Tag.connect() # ͜ͷ2ߦΛ௥Ճ polling_result = felica.polling() print(polling_result.format_data) felica.disconnect()
  12. 1PMMJOHͷ݁ՌΛಡΈղ͘ w ͻͱ·ͣฦ͖ͬͯͨੜύέοτΛݟͯΈΔ w ϝϞͱݟൺ΂ͯΈΔ w ͢ΔͱͪΌΜͱ֨ೲ͞Ε͍ͯΔͱΘ͔Δ d7 05 00

    00 00 00 08 14 01 01 01 0a 10 78 16 b8 22 10 0b 4b 42 84 85 d0 ff 00 03 IDm: 01010a107816b822 PMm: 100b4b428485d0ff d7 05 00 00 00 00 08 14 01 01 01 0a 10 78 16 b8 22 10 0b 4b 42 84 85 d0 ff 00 03 *%N 1.N ͜Ε͸Կʁ
  13. 1PMMJOHͷ݁ՌΛಡΈղ͘ w ͻͱ·ͣฦ͖ͬͯͨੜύέοτΛݟͯΈΔ w ϝϞͱݟൺ΂ͯΈΔ w ͢ΔͱͪΌΜͱ֨ೲ͞Ε͍ͯΔͱΘ͔Δ d7 05 00

    00 00 00 08 14 01 01 01 0a 10 78 16 b8 22 10 0b 4b 42 84 85 d0 ff 00 03 IDm: 01010a107816b822 PMm: 100b4b428485d0ff d7 05 00 00 00 00 08 14 01 01 01 0a 10 78 16 b8 22 10 0b 4b 42 84 85 d0 ff 00 03 *%N 1.N ͜Ε͸Կʁ
  14. 1PMMJOHͷ݁ՌΛಡΈղ͘ w ͻͱ·ͣฦ͖ͬͯͨੜύέοτΛݟͯΈΔ w ϝϞͱݟൺ΂ͯΈΔ w ͢ΔͱͪΌΜͱ֨ೲ͞Ε͍ͯΔͱΘ͔Δ d7 05 00

    00 00 00 08 14 01 01 01 0a 10 78 16 b8 22 10 0b 4b 42 84 85 d0 ff 00 03 IDm: 01010a107816b822 PMm: 100b4b428485d0ff d7 05 00 00 00 00 08 14 01 01 01 0a 10 78 16 b8 22 10 0b 4b 42 84 85 d0 ff 00 03 *%N 1.N γεςϜίʔυ
  15. ͪͳΈʹ d7 05 00 00 00 00 08 14 01

    01 01 0a 10 78 16 b8 22 10 0b 4b 42 84 85 d0 ff 00 03 *%N 1.N Ϩεϙϯεϔομ Ϩεϙϯε௕  γεςϜίʔυ
  16. γεςϜίʔυͷҰཡΛऔΔ w 3FRVFTU4ZTUFN$PEFίϚϯυΛൃߦ͢ΔͱऔΕΔ w ͨͩ͠಺෦తʹ*%Nͱ1.Nͷ஋Λ࢖͏ͷͰࣄલʹ૊ΈࠐΜͰ͓͘ def main() -> None: felica

    = Type3Tag.connect() polling_result = felica.polling() # ͔͜͜Β3ߦ௥Ճ felica.set_idm_and_pmm(polling_result) service_codes = felica.request_system_code() print(service_codes.format_data) felica.disconnect()
  17. 3FRVFTU4ZTUFN$PEFͷ݁ՌΛಡΉ w ΍ͬͺΓੜύέοτΛோΊͯΈΔ w ϝϞͯ͋ͬͨ͠4ZTUFN$PEFͷҰཡΛݟͯΈΔ w ͪΌΜͱ֨ೲ͞Εͯͨ d7 05 00

    00 00 00 08 11 0d 01 01 0a 10 78 16 b8 22 03 00 03 fe 00 86 a7 d7 05 00 00 00 00 08 11 0d 01 01 0a 10 78 16 b8 22 03 00 03 fe 00 86 a7 System Code: 0x0003 System Code: 0xfe00 System Code: 0x86a7 γεςϜίʔυY ͜Ε͸Կʁ
  18. 3FRVFTU4ZTUFN$PEFͷ݁ՌΛಡΉ w ΍ͬͺΓੜύέοτΛோΊͯΈΔ w ϝϞͯ͋ͬͨ͠4ZTUFN$PEFͷҰཡΛݟͯΈΔ w ͪΌΜͱ֨ೲ͞Εͯͨ d7 05 00

    00 00 00 08 11 0d 01 01 0a 10 78 16 b8 22 03 00 03 fe 00 86 a7 d7 05 00 00 00 00 08 11 0d 01 01 0a 10 78 16 b8 22 03 00 03 fe 00 86 a7 System Code: 0x0003 System Code: 0xfe00 System Code: 0x86a7 γεςϜίʔυY ͜Ε͸Կʁ
  19. 3FRVFTU4ZTUFN$PEFͷ݁ՌΛಡΉ w ΍ͬͺΓੜύέοτΛோΊͯΈΔ w ϝϞͯ͋ͬͨ͠4ZTUFN$PEFͷҰཡΛݟͯΈΔ w ͪΌΜͱ֨ೲ͞Εͯͨ d7 05 00

    00 00 00 08 11 0d 01 01 0a 10 78 16 b8 22 03 00 03 fe 00 86 a7 d7 05 00 00 00 00 08 11 0d 01 01 0a 10 78 16 b8 22 03 00 03 fe 00 86 a7 System Code: 0x0003 System Code: 0xfe00 System Code: 0x86a7 γεςϜίʔυY ͜Ε͸Կʁ
  20. ͪͳΈʹ ͦͷ d7 05 00 00 00 00 08 11

    0d 01 01 0a 10 78 16 b8 22 03 00 03 fe 00 86 a7 γεςϜίʔυY *%N γεςϜίʔυͷ਺
  21. ༗ޮͳαʔϏείʔυΛௐࠪ w ·ͣ͸αʔϏείʔυͷҰཡΛ࿈൪Ͱ࡞੒ w ·Δ͝Ͳ3FRVFTU4FSWJDF໋ྩͷҾ਺ͱͯ͠౉͢ w ֤αʔϏείʔυʹରͯ͠伴όʔδϣϯΛฦͯ͘͠ΕΔ def main() ->

    None: felica = Type3Tag.connect() polling_result = felica.polling() felica.set_idm_and_pmm(polling_result) # ͔͜͜Β௥Ճɾมߋ service_codes = [ServiceCode(i) for i in range(0, 8)] key_versions = felica.request_service(service_codes) print(key_versions.format_data) felica.disconnect() w ͍͍ͨͯY w ແޮͳ৔߹͸Y''''
  22. 3FRVFTU4FSWJDFͷ݁ՌΛಡΉ w ੜύέοτ w 伴όʔδϣϯ w YPSY'''' w ͪΌΜͱ֨ೲ͞ΕͯΔ d7

    05 00 00 00 00 08 1b 03 01 01 0a 10 78 16 b8 22 08 03 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff d7 05 00 00 00 00 08 1b 03 01 01 0a 10 78 16 b8 22 08 03 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ,FZ7FSTJPOͷ਺ ,FZ7FSTJPOY
  23. 3FRVFTU4FSWJDFͷ݁ՌΛಡΉ w ੜύέοτ w 伴όʔδϣϯ w YPSY'''' w ͪΌΜͱ֨ೲ͞ΕͯΔ d7

    05 00 00 00 00 08 1b 03 01 01 0a 10 78 16 b8 22 08 03 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff d7 05 00 00 00 00 08 1b 03 01 01 0a 10 78 16 b8 22 08 03 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ,FZ7FSTJPOͷ਺ ,FZ7FSTJPOY
  24. 3FRVFTU4FSWJDFͷ݁ՌΛಡΉ w ੜύέοτ w 伴όʔδϣϯ w YPSY'''' w ͪΌΜͱ֨ೲ͞ΕͯΔ d7

    05 00 00 00 00 08 1b 03 01 01 0a 10 78 16 b8 22 08 03 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff d7 05 00 00 00 00 08 1b 03 01 01 0a 10 78 16 b8 22 08 03 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ,FZ7FSTJPOͷ਺ ,FZ7FSTJPOY
  25. ϒϩοΫΛಡΉ w 3FBE8JUIPVU&ODSZQUJPO໋ྩΛൃߦ͢ΔͱಡΊΔ w 4FSWJDF$PEFͱ#MPDL$PEFΛࢦఆͯ͠ಡΜͰΈΑ͏ def main() -> None: felica

    = Type3Tag.connect() polling_result = felica.polling() felica.set_idm_and_pmm(polling_result) service_codes = [ServiceCode(0x008B)] # ͜͜͸޷͖ͳServiceCodeͰ for i in range(0, 20): block_codes = [BlockCode(i, 0)] block_responses = felica.read_without_encryption(service_codes, block_codes) print(block_responses.format_data) felica.disconnect()
  26. 3FBE8JUIPVU&ODSZQUJPOͷ݁Ռ w ੜύέοτʢϔομͱ*%N͸লུʣ w ઌʹಡΈࠐΜͰ͋ͬͨϒϩοΫͷத਎ w ͪΌΜͱೖͬͯΔ 00 00 01

    00 00 00 00 00 00 00 00 20 00 00 dc 00 00 01 d7 0000000000000000200000dc000001d7 00 00 01 00 00 00 00 00 00 00 00 20 00 00 dc 00 00 01 d7
  27. 3FBE8JUIPVU&ODSZQUJPOͷ݁Ռ w ੜύέοτʢϔομͱ*%N͸লུʣ w ઌʹಡΈࠐΜͰ͋ͬͨϒϩοΫͷத਎ w ͪΌΜͱೖͬͯΔ 00 00 01

    00 00 00 00 00 00 00 00 20 00 00 dc 00 00 01 d7 0000000000000000200000dc000001d7 00 00 01 00 00 00 00 00 00 00 00 20 00 00 dc 00 00 01 d7
  28. 3FBE8JUIPVU&ODSZQUJPOͷ݁Ռ w ੜύέοτʢϔομͱ*%N͸লུʣ w ઌʹಡΈࠐΜͰ͋ͬͨϒϩοΫͷத਎ w ͪΌΜͱೖͬͯΔ 00 00 01

    00 00 00 00 00 00 00 00 20 00 00 dc 00 00 01 d7 0000000000000000200000dc000001d7 00 00 01 00 00 00 00 00 00 00 00 20 00 00 dc 00 00 01 d7
  29. ϦόʔεΤϯδχΞϦϯάମݧ w ͜ͷߨٛͷऴΘΓʹάϧʔϓͣͭ୅දऀ͕෼͙Β͍Ͱൃද w ࣍ͷ߲໨ʹ͍ͭͯ·ͱΊͯΈΔ w σʔλ͕ೖ͍ͬͯΔγεςϜίʔυαʔϏείʔυ w ϒϩοΫதʹ͋Δ֤σʔλͷΦϑηοτͱύʔεํ๏ w

    ྫʣOόΠτ໨ʙNόΠτ໨ʹϏοάΤϯσΟΞϯͰ࢒ߴΛ֨ೲ w ༨༟͋Δਓ͸1ZUIPOͰύʔαʔॻ͍ͯ΋0, w ϝϞఔ౓ʹ·ͱΊͯ΋ΒͬͯɺલͰϓϩδΣΫλʔʹܨ͍Ͱൃද͍ͯͩ͘͠͞ʂ
  30. ࢀߟจݙ w 'FMJDB͔Β৘ใΛٵ͍ग़ͯ͠ΈΔ'FMJDBͷ࢓༷ฤ w IUUQTRJJUBDPN:BTVBLJ/BLB[BXBJUFNTEGBGBGE w ௨৴༻ޠͷجૅ஌ࣝ w IUUQTXXXXEJDPSH w

    'FMJ$BΧʔυϢʔβʔζϚχϡΞϧൈਮ൛ w IUUQTXXXTPOZDPKQ1SPEVDUTGFMJDBCVTJOFTTUFDITVQQPSUEBUB DBSE@VTFSTNBOVBM@QEG w OGDQZ w IUUQTHJUIVCDPNOGDQZOGDQZ