[s4ltyt04st]

Hi there,

I'm trying to look for any references for hacking NXP - Mifare DESFire EV1 4k NFC Card
This is a card for public transport from I city I've visited some time ago and I'm guessing if it's possible to get free travels
Any good reference you know I can read to get more information into NFC Hacking in general I'll appreciate it.

Thanks in advance

[s1ic3r]

I have recently dove deep into this world since I have been playing with the flipper and proxmark3. I hate to say it but what you are looking to do is probably not going to happen. At least in my research I haven't found a way. Some NFC you can clone but the one you reference is quite difficult. Here is an interesting article I learned some things from:
https://rfid-cusp.org/rfidsec/files/RFID...erEtAl.pdf
It is pretty dry so put your big boy pants on and pour a large coffee.

---

Also, check this out. It's a little more enjoyable to read:
https://smartlockpicking.com/slides/Conf...ID_NFC.pdf
And if anyone has more info I would be interested in it as well.

[Quetzali]

It depends on the way that the card work, if just storage credentials maybe you can try to copy the info of some sequential bought cards and find out the credential sequence.
Then find out credential with credits or any with some kind of admin access.

Hope I helped you.

[CallMaker]

Most transport systems have the card only store the ID and the fare is deducted by a back-end system, but there is often a balance stored on the card for fallback when the back-end cannot be reached by the reader. Depends a lot on the system and how it works. In some cases it might be just easier for you to jump over the fare gate.
Your first bet should probably be able to get a few cards and experiment with them (after tapping the card to the gate, every time check what has changed) and slowly understand how the system works and if it can be manipulated.