Nils Schneider

Writing the RFID tag of a Bluetooth keyboard

So today I got my new keyboard, a Thinkpad Compact Bluetooth Keyboard. Other than working just fine as keyboard this device does have an RFID tag inside. This tag is used to simplify pairing with an NFC-capable device by just holding both device very close. In order for this to work the tag needs to store at least the keyboard’s MAC so I wondered what exactly was stored on that RFID tag.

This is what I found.

Location of RFID tag
Location of RFID tag

The RFID tag is actually writeable! It’s a NFC Forum Type 1 Tag manufactured by Innovision Research and Technology Plc (UK) capable of storing up to 462 bytes.

All pages are writeable
All pages are writeable

Well, let’s try writing some data.

Data written successfuly
Data written successfuly

That just worked. So this tag can be used to store about any kind of data one could store. Some secret data could even be hidden in any of the 43 unused pages while keeping the original function of unaffected. That’s pretty interesting.

I’m still wondering why Lenovo didn’t make the tag write protected.