Breaking Samsung firmware, or turning your S8/S9/S10 into a DIY “Proxmark”

This post is a companion to the DEF CON 28 video available here Breaking the Firmware of Samsung’s NFC Chips Recently I have been looking into how to push the capabilities of my old smartphones beyond what you could traditionally do just by rooting it. Smartphones contain huge amounts of hardware...

CVE-2020-15912

Tesla Model 3 vehicles allow attackers to open a door by leveraging access to a legitimate key card, and then using NFC Relay. NOTE: the vendor has developed Pin2Drive to mitigate this issue...

Design/Logic Flaw

Tesla Model 3 vehicles allow attackers to open a door by leveraging access to a legitimate key card, and then using NFC Relay. NOTE: the vendor has developed Pin2Drive to mitigate this issue...

CVE-2020-15912

Tesla Model 3 vehicles allow attackers to open a door by leveraging access to a legitimate key card, and then using NFC Relay. NOTE: the vendor has developed Pin2Drive to mitigate this issue...

CVE-2020-15912

CVE-2020-15912 affects Tesla Model 3 vehicles. The available documents describe a door-opening vulnerability where an attacker with access to a legitimate key card can relay NFC to unlock/open the door. The root cause is a vulnerability in NFC relay/authentication handling (as described across th...

CVE-2020-15912

Tesla Model 3 vehicles allow attackers to open a door by leveraging access to a legitimate key card, and then using NFC Relay. NOTE: the vendor has developed Pin2Drive to mitigate this issue...

Yubico YubiKey 5 NFC Information Disclosure Vulnerability

Yubico YubiKey 5 NFC is a multi-protocol secret key device supporting NFC Near Field Communication functionality from the Swedish company Yubico. An information disclosure vulnerability exists in the Yubico YubiKey 5 NFC versions 5.0.0 through 5.2.6 and 5.3.0 through 5.3.1. The vulnerability can ...

CVE-2020-15001

An information leak was discovered on Yubico YubiKey 5 NFC devices 5.0.0 to 5.2.6 and 5.3.0 to 5.3.1. The OTP application allows a user to set optional access codes on OTP slots. This access code is intended to prevent unauthorized changes to OTP configurations. The access code is not checked whe...

Design/Logic Flaw

An information leak was discovered on Yubico YubiKey 5 NFC devices 5.0.0 to 5.2.6 and 5.3.0 to 5.3.1. The OTP application allows a user to set optional access codes on OTP slots. This access code is intended to prevent unauthorized changes to OTP configurations. The access code is not checked whe...

CVE-2020-15001

An information leak was discovered on Yubico YubiKey 5 NFC devices 5.0.0 to 5.2.6 and 5.3.0 to 5.3.1. The OTP application allows a user to set optional access codes on OTP slots. This access code is intended to prevent unauthorized changes to OTP configurations. The access code is not checked whe...

CVE-2020-15001

CVE-2020-15001 affects Yubico YubiKey 5 NFC, specifically firmware versions 5.0.0–5.2.6 and 5.3.0–5.3.1. The OTP application allows optional access codes on OTP slots, but the access code is not checked when updating NFC-specific OTP configurations. As a result, an attacker could read configured ...

CVE-2020-0156

In NxpNfc::ioctl of NxpNfc.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-139736127...

CVE-2020-0139

In NDEFMsgValidate of ndefutils.c, there is a possible out of bounds read due to an integer overflow. This could lead to local information disclosure if a malformed NFC tag is provided by the firmware. System execution privileges are needed and user interaction is not needed for...

Integer overflow

In NDEFMsgValidate of ndefutils.c, there is a possible out of bounds read due to an integer overflow. This could lead to local information disclosure if a malformed NFC tag is provided by the firmware. System execution privileges are needed and user interaction is not needed for...

Out-of-bounds

In nfcncifproct3tpollingntf of nfcncif.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID:...

CVE-2020-0139

In NDEFMsgValidate of ndefutils.c, there is a possible out of bounds read due to an integer overflow. This could lead to local information disclosure if a malformed NFC tag is provided by the firmware. System execution privileges are needed and user interaction is not needed for...

CVE-2020-0139

CVE-2020-0139 affects Android 10. The vulnerability is a flaw in NDEF_MsgValidate (ndef_utils.c) where an integer overflow can cause an out-of-bounds read, potentially enabling local information disclosure when a malformed NFC tag is processed by the firmware. Exploitation is described as requiri...

CVE-2020-1798

HUAWEI P30 smartphones with versions earlier than 10.1.0.135C00E135R2P11 have an improper authentication vulnerability. A logic error occurs when handling NFC work, an attacker should establish a NFC connection to the target phone, and then do a series of operations on the target phone. Successfu...

Authentication flaw

HUAWEI P30 smartphones with versions earlier than 10.1.0.135C00E135R2P11 have an improper authentication vulnerability. A logic error occurs when handling NFC work, an attacker should establish a NFC connection to the target phone, and then do a series of operations on the target phone. Successfu...

CVE-2020-1798

CVE-2020-1798 affects Huawei P30 smartphones with versions earlier than 10.1.0.135 (C00E135R2P11). A logic error in NFC handling allows an attacker who establishes an NFC connection to perform actions beyond the guest user’s privileges. Documented affected component: NFC work handling logic; impa...