ChameleonMini RevG color

The credit-card shaped ChameleonMini is a versatile tool for practical NFC and RFID security analysis, compliance and penetration tests, and various end-user applications. The freely programmable platform can create perfect clones of various commercial smartcards, including cryptographic functions and the Unique Identifier (UID). Further, the tool includes a basic RFID reader functionality that can be used to read out and write to cards, as well as realize certain attacks. The Chameleon is capable of sniffing RFID communication and can be employed to assess security aspects in RFID and NFC environments in different attack scenarios, such as replay or relay attacks, state restoration attacks, sniffing of NFC communication, or functional tests of RFID equipment (e.g., by appearing as different contactless cards whose content can be arbitrarily changed via a PC).

The ChameleonMini hardware can read and emulate various RFID cards and transponders that are compatible to ISO 14443, ISO 15693 and other NFC standards at 13.56 MHz, e.g., NXP Mifare Classic, Plus, Ultralight, Ultralight C, ntag, ICODE, DESfire / DESfire EV1, TI Tag-it, HID iCLASS, LEGIC Prime and Advant, Infineon my-d, and many others. Please have a look at the open-source project on github which cards and transponders are already supported by the current Firmware; the ChameleonMini developer community is regularly fixing bugs, adding new card types and other features.

Note that this prototypical product as developed in our recent kickstarter project is supposed to be used by experts that understand RFID/NFC technology, the usage of the ChameleonMini command set, and can thereby program and control the PCB via the USB port of a PC, Smartphone or similar. The ChameleonMini is shipped preprogrammed with a Test Firmware that includes a USB bootloader that can be used to upload your own firmware via USB, e.g., the one from the open-source project on github - please follow the "getting started" instructions there. Directly after reception, please make sure the green LED is lighting when switching on the Chameleon before doing anything else: this indicates all factory tests have been passed. Changing the firmware and using the ChameleonMini is at your own risk and liability, please make sure to respect the legal situation in your country to avoid trouble. The warranty is lost when upgrading to another firmware different from the supplied one.

The order includes one rechargeable LIR2032 Li-Ion battery (3.6V, 40 mAh) to power the ChameleonMini. The battery is automatically recharged when ChameleonMini is connected to a USB port or USB power pack. Use any standard Micro-USB Type B cable to connect your ChameleonMini with your PC, tablet, smartphone, or other device.

Technical Specifications:

• operating voltage 5V
• typ. operating current min. 26mA (emulation only and LEDs off), max. 200 mA (reader field and LEDs on)
• typ. power consumption min. 130 mW, max. 1W
• tested with: SCM SCL3711 reader, Mifare Classic 1k new version, HID/Omnikey 5427 CK reader, Mifare Ultralight sticker "touchatag" (round), Baltech ID-Engine reader, Mifare Classic armband (round), Mifare DESfire MF3ICD40 "Opencard", Blackberry Bold 9000, Mifare Ultralight "Moscow Metro", Sony Xperia, Mifare Classic old version, ACG Multi Passport reader and various others not in the picture, e.g., DESfire EV1 "Oyster card", HID/Omnikey 5321 reader and Samsung Galaxy S5 Mini. All tested devices with no exception can be read out or emulated/virtualized by the Chameleon.
• emulation range: reader-dependent, e.g., SCL3711 1-4.4 cm, Baltech ID engine 0-5.9 cm, HID Omnikey 5427 CK 0-4cm ; HID Omnikey 5321 V2 0-8,5 cm, and S5Mini smartphone 0-1.4cm.
• reading range: depends on the shape and type of chip that is hosted inside the card or transponder. The reader is not intended as a long-range reader: For normal contactless cards, with ChameleonMini RevG a reading range of more than 1.5cm is possible. Other tags, e.g. the small, round touchatag (Mifare Ultralight) sticker, have to be placed directly on the antenna of ChameleonMini in order to read and copy them