The document summarizes the history and development of the ChameleonMini, an open source multifunctional RFID/NFC tool. It began as early prototypes in 2006 and has continued evolving, with recent versions adding features like FRAM memory, battery power, and RFID reader/sniffer capabilities. The ChameleonMini can emulate various contactless smartcards and has uses like a virtual wallet, access control, compliance and security testing of RFID/NFC systems, and research/education.

1. A Multifunctional RFID/NFC Tool
A Bit of History

2. 2
2006: Coffee Cup Tag Emulator

3. 3
2006: Coffee Cup Tag Emulator
1. Antenna Design

4. 4
2006: Coffee Cup Tag Emulator
2. Load Modulation

5. 7
2007: Fake Tag

6. 8
2010: The Primal-
A Versatile Emulator for Contactless Smartcards
 Mifare Classic: Crypto1 stream cipher
 Mifare DESFire MF3ICD40: Auth. with (3)DES
 Mifare DESFire EV1: Auth. with AES-128, (3)DES
 … and other ISO14443 / ISO15693 cards
Atmel
ATXmega

7. 9
2013: Rev.D

8. 10
2014: Rev.E
open source project: https://github.com/emsec/ChameleonMini
• 8 card slots
• Breakable
antenna
• Improved USB
command set
• Widespread

9. 11
Rev.E
Block Diagram of Hardware

10. 12
Rev.E
Block Diagram of Firmware

11. 13
Rev.E is not enough…
Testing FRAM and ATXMega128A4U

12. 14
Rev. F
• FRAM
• Li-Ion Battery
• (Basic) RFID Reader
• ISO 14443/15693
• Sniffing
• Log Mode

13. 15
Rev.F
Log Mode / Sniffing
• Emulation: monitor RFID reader and Chameleon
• Sniffing: Chameleon is „invisible“ during recording
• Precise time stamps
• Live logging

14. 16
 Virtual wallet with up to eight cards
 User-definable token for access control
 upgrade of (cryptographic) algorithms possible
 Compliance tests (in fab)
 Functional tests with NFC door lock systems
 Pentesting/Fuzzing of RFID/NFC Readers:
send unexpected data  buffer overflow, …
 Power-switch: effective privacy protection/
Relay-attack countermeasure (user interaction)
 Research / teaching (RFID / NFC / lightweight crypto)
 ….
Some Use Cases

15. 17
as a Flight Recorder
1. System in test mode
(everything is allowed)
 Record and analyze all communication
 Distinguish normal behavior / attacks / bugs / user errors
2. Block all unwanted actions
3. System in „normal operation“ mode
 Keep track of further errors and react

16. 18
Creative Usage of
(Florian Bache @ RUB)

17. 19
Long Range ISO14443 Contactless Card

18. 20
A Useful Book:
(NFC Tag Range Extension: more than 70cm)

19. 21
Thanks for supporting the ChameleonMini project!