Cloning MIFARE Classic Cards via Proxmark3 ·
↓<br>Skip to main content
Table of Contents
Table of Contents
🎬 Intro
This post will be about how you can easily clone MIFARE Classic cards with a Proxmark3 device. I have long been interested in how RFID works and the security behind it and the Proxmark3 is a great tool for this.
My apartment block uses MIFARE Classic cards for access control and they charge an unreasonable amount of money to get replacements/extras, so I decided to do this myself. Unfortunately it was not as simple as I initially anticipated but at the end of the day once I understood what protections were in place and how to bypass them, it was a breeze.
This post will be a somewhat technical dive into everything I learned during this process, as well as a guide on how to clone MIFARE Classic cards with a Proxmark3 device. If you’re just here to clone your cards, you can skip the technical stuff and just follow the steps below although I would advise reading the entire post to understand what’s going on and how exactly these things function.
📡 What is MIFARE Classic?
MIFARE Classic 1K uses NXP’s proprietary CRYPTO-11 cipher for authentication, which has been thoroughly broken since 2008. The cards have 16 sectors, each protected by two 6-byte keys (Key A and Key B), and the entire security model is considered insecure by modern standards, despite this they are one of the most widely deployed contactless smart card types in the world used in access control, public transit, and plenty of other systems.
Modern replacements like MIFARE DESFire and MIFARE Plus use proper AES encryption, but Classic cards are still everywhere.
🔧 The Proxmark3
The Proxmark3 is a full RFID research platform. Compared to tools like the Chameleon Ultra or phone-based NFC apps, it can run the full attack chain (dictionary, darkside, nested, and hardnested) using your computer’s processing power. Phone apps and the Chameleon Ultra are generally limited to dictionary attacks and lack the computational muscle for the heavier cryptographic attacks.
The Proxmark3 was originally designed by Jonathan Westhues back in 2007 as an open-source RFID research tool. The hardware schematics and firmware were released publicly, which is how it eventually became the community-driven tool it is today. The RRG (RFID Research Group) took the design forward and produced what became the RDV4, the “official” revision from the folks who maintain the Iceman firmware. If you want a more detailed history, the Proxmark3 wiki covers it well enough.
The “proper” device is the Proxmark3 RDV4 , sold by RRG for around $300. Swappable antennas, solid build quality, and it’s what the firmware is primarily developed against. If you’re doing RFID research professionally, sure, get that. For the rest of us there are clones all over AliExpress for £20–60 that do the same job. This is what I use and as a hobbyist it does everything I need. I would like to support the RRG and buy the RDV4 but I do find the cost steep just for supporting a project, personally.
The main things to know about the clones is that quality control varies and the firmware that ships on them is universally outdated and needs replacing immediately. More on that below. I have purchased several due to the micro usb ports on them being very easy to break (and in trying to repair them made things a lot worse). What I have done with my latest one is to put a generous amount of glue on the micro usb port and the port itself to try and prevent it from breaking again.
Iceman Firmware & Setup
If you’re buying a Proxmark3 (especially a clone/generic unit), the first thing you should do is flash the Iceman firmware. The stock firmware on most units is usually a relic. Iceman (maintained by the RRG / RFID Research Group) is the actively developed community firmware that adds the advanced attack methods, better hardware support, and ongoing bug fixes.
On macOS, the easiest way to install both the client and flash the firmware is via Homebrew:
bash
# Add the RRG tap<br>brew tap rfidresearchgroup/proxmark3
# Install (use --with-generic for clone/non-RDV4 devices, --with-flash to enable flashing)<br>brew install --with-generic --with-flash rfidresearchgroup/proxmark3/proxmark3
# Flash the firmware (device must be connected)<br>pm3-flash-all
For other platforms, the RRG wiki has setup guides for Linux and Windows. From what I have found, the clones require the use of the --with-generic flag when installing the firmware.
After flashing, verify with:
bash
pm3 -c "hw version"
You should see Iceman/master/v4.xxxxx in both the Client and ARM sections, and the bootrom and OS versions should match. If they don’t match, re-flash.
The USB device shows up as /dev/tty.usbmodemiceman1 on macOS, the pm3 wrapper script auto-detects this, so you generally just run pm3 without specifying a port.
All UIDs, keys, and...