Beschreibung

Ein RFID-Kopiergerät, auch als RFID-Duplicator oder Cloner bekannt, ist ein Gerät, das die eindeutigen Identifikationsdaten von einem vorhandenen RFID-Tag oder einer Karte ausliest und dann diese gleichen Daten auf einen leeren, kompatiblen RFID-Tag oder Schlüsselanhänger schreibt.

Die „Decodierung“ innerhalb einer RFID-Kopiermaschine umfasst mehrere Schritte, deren Komplexität je nach RFID-Frequenz und den Sicherheitsmerkmalen des ursprünglichen Tags variiert.

Allgemeine Decodierung Prozess:

Kommunikation etablieren (Powering the Tag):

• Der RFID-Kopierer fungiert als Lesegerät. Wenn ein RFID-Tag (das „Original“) in seinem Lesebereich platziert wird, sendet der Kopierer ein elektromagnetisches Feld bei der Betriebsfrequenz des Tags aus (z. B. 125 KHz, 13,56 MHz oder gelegentlich UHF).
• Dieses elektromagnetische Feld paart sich induktiv mit der Antenne des Tags und erzeugt einen kleinen Strom, der den internen Mikrochip des Tags antreibt. Passive RFID-Tags haben keine eigene Energiequelle; sie ziehen Energie aus dem Feld des Lesers.
• Empfangen des Tags-Signals (Modulation und Demodulation):
• Sobald der RFID-Tag mit Strom versorgt ist, moduliert er das elektromagnetische Feld des Lesers (dies wird bei passiven Tags als Rückstreumodulation bezeichnet). Im Wesentlichen ändert es seine elektrische Last, die der Leser als eine Änderung des reflektierten Signals erkennt.
• Das Tag verwendet spezifische Kodierungsschemata (z. B. Manchester, Miller, NRZ), um seine digitalen Daten (die eindeutige ID und alle anderen gespeicherten Informationen) als Änderungen in diesem modulierten Signal darzustellen.
• Die Antenne des RFID-Kopierers empfängt dieses modulierte Signal. Seine interne Schaltung demoduliert dann das Signal und wandelt die analogen Radiowellen in den digitalen Bitstrom der Daten des RFID-Tags um.

1. Decoding the Data (Protocol Interpretation):

   • This is where the „decoding“ truly happens. The RFID copier’s internal processor (or connected software) interprets the raw digital bitstream according to the specific RFID protocol the tag adheres to.
   • Low Frequency (125 KHz) Tags (e.g., EM4100, HID Prox):
     • These are generally simpler. The copier looks for a specific preamble and then extracts the raw ID number. For read-only tags like EM4100, this ID is often directly translated into a hexadecimal or decimal format.
     • For more complex LF tags like HID Prox, the copier needs to understand the proprietary encoding structure (e.g., facility code, card number) to correctly interpret the data. Some basic copiers might only read the raw bitstream, while more advanced ones can decode the actual card number and facility code.
   • High Frequency (13.56 MHz) Tags (e.g., MIFARE Classic, NTAG, ISO 15693):
     • These tags are more complex. The copier needs to adhere to standards like ISO/IEC 14443 Type A/B or ISO/IEC 15693.
     • For chips like NTAG213, the copier reads the NDEF (NFC Data Exchange Format) message, which is a standardized way to store URLs, text, vCards, etc. It simply extracts the data stored in the user memory area.
     • For MIFARE Classic 1K/4K, this is where „decoding“ becomes more challenging:
       • Sector-based Memory: MIFARE Classic tags are divided into sectors, and each sector has two 48-bit authentication keys (Key A and Key B).
       • Crypto-1 Encryption: Data communication on MIFARE Classic uses a proprietary cipher called Crypto-1.
       • Decoding Encrypted MIFARE Classic: A basic RFID copier often cannot read encrypted MIFARE Classic tags directly if the keys are unknown. More advanced copiers or software-driven readers (like the Proxmark3 or ACR122U with specific software) employ various „cracking“ or „decoding“ techniques to derive these keys:
         • Default/Common Keys: Attempting to authenticate with widely known default keys.
         • Dictionary Attacks: Trying a list of common or leaked keys.
         • Vulnerability Exploits: Utilizing known vulnerabilities in the Crypto-1 algorithm (e.g., nested attack, darkside attack) to recover keys. This process can be time-consuming and requires significant computational power.
         • Sniffing: Capturing communication between a legitimate reader and tag to extract key information (requires tapping into an active system).
       • Once the sector keys are determined, the copier can then decrypt and read the data blocks within those sectors.

2. Displaying/Storing the Decoded Data:

   • After successful decoding, the RFID copier will display the raw ID number (for LF tags) or the decoded data (for HF tags, once decrypted) on its screen.
   • More advanced copiers or accompanying software can store this data, allowing users to manage a library of cloned tags.

Limitations of RFID Copier Machines:

It’s crucial to understand that not all RFID tags can be easily copied:

• Encrypted/Secure Tags: High-security RFID systems (e.g., MIFARE DESFire, HID iCLASS, SEOS) use advanced cryptographic algorithms (AES, 3DES, elliptic curve cryptography) and mutual authentication processes. These are generally very difficult or impossible for standard RFID copiers to „decode“ or clone without knowing the cryptographic keys, which are typically kept secret and unique to each system. Professional-grade security systems are designed to be resistant to casual cloning.
• Proprietary Formats: Some older or niche RFID systems use proprietary encoding formats that a generic copier might not understand without specific firmware or software.
• Active Tags: RFID copiers are primarily designed for passive RFID tags. Active RFID tags (which have their own battery) are much more complex and cannot be simply „copied“ in the same way.
• Hardware and Software Requirements: Decoding complex or encrypted tags often requires more than just a handheld copier. It typically involves connecting the copier to a computer and using specialized software (like the Proxmark3 client) that can execute sophisticated attacks and data analysis.

In summary, an RFID copier machine „decodes“ signals by powering the tag, receiving its modulated response, and then interpreting that digital data according to the specific RFID protocol and encoding scheme. While effective for basic, unencrypted tags, their ability to „decode“ more secure or encrypted RFID credentials is limited and often relies on exploiting known vulnerabilities in older protocols.