Writing the RFID tag of a Bluetooth keyboard
So today I got my new keyboard, a Thinkpad Compact Bluetooth Keyboard. Other than working just fine as keyboard this device does have an RFID tag inside. This tag is used to simplify pairing with an NFC-capable device by just holding both device very close. In order for this to work the tag needs to store at least the keyboard’s MAC so I wondered what exactly was stored on that RFID tag.
This is what I found.
The RFID tag is actually writeable! It’s a NFC Forum Type 1 Tag manufactured by Innovision Research and Technology Plc (UK) capable of storing up to 462 bytes.
Well, let’s try writing some data.
That just worked. So this tag can be used to store about any kind of data one could store. Some secret data could even be hidden in any of the 43 unused pages while keeping the original function of unaffected. That’s pretty interesting.
I’m still wondering why Lenovo didn’t make the tag write protected.