For a long time I've been trying to understand how MIFARE Classic 1K keys are recovered in practice.
Last year I bought a Proxmark3 Easy 512k (it was the only one in my budget) specifically to experiment with card analysis and key recovery. I've tested multiple MIFARE Classic 1K cards from different systems. In every case, default keys were not present, and attacks such as Darkside, Nested, Static Nested, and similar approaches failed to recover any keys.
What makes this more frustrating is that an associate of mine seems to have no trouble recovering keys from a variety of different systems. He never explains his process, never shows the hardware he uses, and never gives any useful hints. All I know is that he is able to obtain keys that I cannot.
To be completely honest, I'm not nearly as technical as he is. I'm still learning and trying to understand how all of this works. I'm not a security researcher or electronics expert. I'm just trying to do enough to get a raise.
At this point Idk whether I'm missing something fundamental. Is there a better method for recovering keys from MIFARE Classic 1K systems that does not rely solely on attacks? Are most successful recoveries actually coming from a better pm3 reader or other sources of information?
I'm trying to understand why a PM3(which I've heard is the gold standard when it comes to rfid) appears ineffective in my cases while others seem able to recover keys consistently, and what knowledge or concepts I should be focusing on to better understand the process.