
So, I got a VivoKey Spark. No, not a VivoKey Flex. This is a new product from VivoKey, that is currently 100% unreleased.

The Spark is similar to the Flex One from VivoKey, but this one, instead of being a flat flexible strip, is in a small glass tube just like every other RFID implant. It's small, compact, and feature rich. 

First, let's talk about what VivoKey is trying to accomplish. While all of their marketing is practically non-existent on just about anything they're doing, going so far as to have a one page website with no feature or technical information. However we can still work out some things from what is available. 

The VivoKey is...

- RFID-based implantable technology
- Runs on NFC frequency and protocol.
- Aims to be a device capable of

- PGP/GPG storage
- 2FA storage
- Payment applications

- Tap to pay
- Wallets
- Addresses

- Access control
- Any other RFID/NFC-based technology implementations

VivoKey is a product that's still in it's very early stages, all things considered. The [VivoKey Flex recently just entered beta](https://dangerousthings.com/shop/vivokey-flex-one/). The VivoKey Spark has not even been announced yet (it is expected to be announced at BDYHAX in the 15th of December). Very little is known about this product, and all information is coming from secondary sources. It is reported that the Spark has less overall storage space, due to its physically small size, but unknown how much of a disparity in storage there will be.

I acquired the Spark through [@c00p3r](https://twitter.com/c00p3r_7), who runs the Dangerous Minds podcast and is a good friend of DC801. Cooper acquired the Sparks early, directly from Amal @ Dangerous Things. It turns out that neither Amal or Cooper have gotten these implanted. Looks like I am the very first person to have a VivoKey Spark doin' things in their body.

> Oooo, what&#39;s this? 😁[@DangerousThings](https://twitter.com/DangerousThings?ref_src=twsrc%5Etfw)[@c00p3r_7](https://twitter.com/c00p3r_7?ref_src=twsrc%5Etfw)[@dmindspodcast](https://twitter.com/dmindspodcast?ref_src=twsrc%5Etfw)[pic.twitter.com/UhtW7mDKZb](https://t.co/UhtW7mDKZb)
> &mdash; Pips (@Pips801) [December 10, 2018](https://twitter.com/Pips801/status/1072276390173532162?ref_src=twsrc%5Etfw)

![](2018/12/image.jpg)

On opening, there is a card that tells you to STOP! and not continue until you visit [vivokey.com/spark](http://vivokey.com/spark). Sadly, the page does not exist (yet). Once I got it, I immediately drove over to a local piercing studio and got it installed. 

Below is the installation video of the VivoKey Flex.You don't have to watch it, but if you're curious about the process, it's a quick video.

A description of the video: Hand is sanitized and the needle comes pre-loaded with the glass tag alredy. the needle is pushed through the skin, and the plunger is pressed while removing the needle and leaving the tag behind. In the video, the tag actually was slightly stuck to the needle on removal, so  the needle/tag was pushed back in to make sure it stayed.

Once installed, it was time to scan. The major exciting feature is Fidesmo and their application development stack. However, scanning the tag with the Fidesmo app did not work at all. It appears this does not directly register as a Fidesmo/Fidesmo-capable chip.

If you scan it with an NFC app, it reveals this information about the tag.

![](2018/12/image-1.jpg)

The tag appears to be emulating a standard NFC tag with enough storage to store a URL on it in the standard NFC URL format. The url is unique per chip. However, when I visit the URL, it forwards me to [https://www.vivokey.com/claim-my-spark](https://www.vivokey.com/claim-my-spark), which just says "coming soon". 

It appears that the chip used in the VivoKeys has the ability to emulate/virtualize NFC partitions on it. This one virtualized a standard ISO 15693 tag with a size just big enough to store the registration URL (49/49 Bytes).

I assume that this is the page where you register the Spark, and probably download an app or something that allows you to actually interact with the device.

Now that a member of DC801 has a VivoKey Spark, we can finally start hacking on it and writing applications for it. All of our research, development, and hacking will be cataloged right here on the 801Labs Research site. Click subscribe below to be kept up to date! 🙌


Biohacking: New VivoKey Spark Implant


### Fingerprint readers are silly

DISCLAIMER: I used to work for a physical security company architecting access control and surveillance solutions. 

One job I was tasked with was getting a fingerprint-based reader tested and operational for demoing our new level of hardware support for more secure facilities, 2 factor physical access control; something you are (fingerprint) and something you know or have. (pin/card)

We were given these readers to test. The readers had a TON of wiring on the back of them. The two important things that the reader pinouts contained was

1. Weigand 2-pair access control wire
2. POE-enabled RJ45 port   

The way that these readers work with existing access control systems **completely invalidates** the security benefits of using a fingerprint-based authentication system. Let me explain the architecture and design of this system.

First, you must enrol fingerprints on the reader. You essentially scan a fingerprint a handful of times, give it a name, and assign it a badge. Wait, a badge? Yes. The reader contains a **local** database of every fingerprint in it's system, as well as a **card **associated to this fingerprint. When a fingerprint authenticates and is validated to the local database on the reader, the reader takes the card associated with that fingerprint and relays it over Wiegand wiring to an access control box. This reader is essentially functioning the exact same as a normal fingerprint-less card reader.

![](2018/10/Untitled-Diagram.png "Finger is read, authenticated against a print DB, then the card associated is passed over to the access control system")

The fingerprint reader on the back end/access control provides the exact same level of authentication as a standard card-based system. If the reader is configured to pass through card reads (passthrough mode for 2nd factor, or for card or fingerprint setups) the fingerprints are **completely useless**.

---

# Potential attack 1: network permeter comprimise

This edge device has an ethernet port. 

Which means it has an ethernet cable, which is going to have to tie into an internal access control network to allow it to talk to the provisioning server. Most people put their ICS on the same network. Cameras, access controls, gate controls, HVAC, etc. From the exterior of the building, you now have hardline access to an internal control network. 

If this network has any kind of network security (for instance, MAC address filtering), you can pull the MAC of the fingerprint reader directly from a sticker located next to the ethernet port. Spoof that MAC and you have access.

---

# Potential attack 2: device fingerprint datastore compromise

The database containing **fingerprint** data is stored non-centrally, and every reader has a copy. The enrolment process is

1. Scan fingerprint on central server
2. Associate card, name, etc to fingerprint
3. Push new user profile to all readers on the network
4. Reader receives profile, adds it to internal datastore

If you compromise the edge device (reader), you can potentially access this database through their control software, or directly through chip-off forensics. This datastore is going to not just contain fingerprint data, of which I would consider **incredibly valuable and sensitive information**, it would also contain all associated cards for every user profile. 

Unless a mass card revocation is initiated, you now also have a datastore of every functioning, authenticating, door-opening card in the system. Additionally, you may have full names, positions, teams, pictures, etc for every user.

---

# Potential attack 3: Weigand man-in-the-middle

This isn't specifically a fingerprint reader specific attack, but it is just as effective. You can purchase a device that clamps onto the Weigand data wires and can Man-in-the-middle cards over the wire. With this, you can 

- offload all cards as they get sent to the access control system
- in-line replace/denial of service on all/selected cards (lock someone out of the building)
- Replay a functioning card without having to have a card cloner/spoofer

Devices like the [ESPKey](https://redteamtools.com/espkey) are cheap ($99) and usable with bluetooth or wifi.

![](2018/10/ugdTOpe.jpg "ESPKey in-line man-in-the-middle")


801 Labs Research Portal

RFID

Biohacking: New VivoKey Spark Implant

Access-control exploitation (part 1)