This document summarizes security testing performed on access cards for the 2018 Asian Games. The summary is: 1) The access cards were found to use holographic laminate, hologram stickers, user information, barcodes, and ID numbers for security on the front side and provide conduct of usage and access control information on the back side. 2) An RFID tag inside the card was discovered that had access to all venues using a single card. 3) Security testing revealed the cards used a Mifare Classic 1K RFID chip that could be cloned, allowing full access to venues, demonstrating a potential security vulnerability.

1. Yo..yo..ayo, deep inspection on
ASIAN GAMES 2018 Access Card
by rama

2. Front card
component
- holographic laminating.
- hologram sticker.
- user info.
- barcode.
- ID number.

3. Back
Conduct of usage.
Access controll
information.
handsign etc.

4. Hidden ID
RFID TAG inside
the card.

5. Potential target
- this ID have
access to all venue.
*one card to rule them all.
- some venue is
very crucial.

6. –Anonyms
“What could be wrong”
Analysis

7. Tools
QRreader (phone), Proxmark3, S50 UID changeble card, NFC reader

8. Barcode
ID number == barcode

9. Rfid identification
- mifare classic 14a
https://github.com/Proxmark/proxmark3/wiki

10. Rfid identification
- mifare classic 14a.
- using default
‘FFFFFFFFFFFF” key.
- Unique data is UID.
(604EE2DC)
https://github.com/AdamLaurie/RFIDIOt

11. Mifare 1K layout

12. Sun Tzu - Art of War
“To know your enemy, you must
become your enemy”
Attack

13. Clone the UID to S50 card

14. DEMO
https://youtu.be/XuSG829_9tc