5 ms·

FareBot: Read data from public transit cards w/ your NFC-equipped Android phone

102 points by EricButler 16y ago

zitterbewegung 16y ago
This is great! I was wondering if you could read data from RFID chips using the NFC since the protocols are nearly identical. I wonder if you could create an app that just indiscriminately reads data raw from the NFC chip?
- EricButler 16y ago
  Thanks! Many RFID cards are basically tiny computers with each with a proprietary command protocol, so you can't read everything generically. MIFARE DESFire cards (ORCA, Clipper, newer Oyster) for example have a command protocol and basic filesystem. FareBot asks the card for a list of all its files and dumps them out one by one. I do believe there's a standard way to read NDEF data (used to store URIs, etc.) from different types of cards but haven't looked into this much yet. I think this is what the "Tag" app that comes with the Nexus S does.
estel 16y ago
Awesome app. I've been looking for some small nfc hacking projects, and might look at getting this working properly with Oyster or something (provided I can get my hands on an updated DESfire one rather than my existing Mifare Classic).
- EricButler 16y ago
  Thank you! Although probably not as interesting, it would be great to add Mifare Classic support to FareBot, if you're looking for stuff to work on.
wgrover 16y ago
Very cool - tried it with my MBTA Charlie Card and it returns "Unsupported card type: Mifare1K". Are we Bostonians out of luck?
- EricButler 16y ago
  For now, but support for Mifare Classic is a high priority.
megaframe 16y ago
This is a serious security problem for San Francisco public transit... "in addition to being able to read cards, also have the capability to emulate a card". I had considered duplicating a card, since it's a tag based system. So two or more people could share things like a month Caltrain pass, or two people riding together on the bus could both tag and only pay once. Using this program would be certainly easier, than what I was thinking.
- davidmathers 16y ago
  How is it a security problem? The article doesn't say anything about a security problem. On the contrary it says the security of some older fare cards has been compromised possibly allowing someone to alter their balance, though I am unaware of any attacks against DESFire.
  - megaframe 16y ago
    I don't believe card in SF carry the balance information I thought that was on their side, issue is if people duplicate cards then they could share unlimited month passes.
- phlux 16y ago
  Assuming NFC works the same way Lockheeds RFID system works - you havea tag ID which is read against a back-end DB which holds the tags value, where the tag/card holds no value data itself, how can this work with SF Transit police checking cards? Assume you dupe your friends card, then both go through the turn style -- wont the system error as the system will say that the second read is either "tagged for exit" or maybe it will read it as a 90-minute transfer read? If you get stopped by the transit police, assuming you got through the turn style, you'd have to have a valid ticket/clipper on you, no?
  - megaframe 16y ago
    It's tag only so if you tag again because lets say you were unsure you tagged, the second tag is disregarded, it's the same idea if I ride a bus but have to transfer I tag again but I don't pay again. It's just to verify I've tagged once since getting on. Can't say I've ever seen transit police but could be the buses I ride, and their's a fine for not being able to show you paid, but buses and muni is just tag as you get on. So theirs a risk of course.
eik3_de 16y ago
If you're interested in reverse engineering RFID payment systems in public transfer, I can recommend you this talk from 27c3: https://events.ccc.de/congress/2010/Fahrplan/events/4036.en.html https://events.ccc.de/congress/2010/Fahrplan/events/4036.en.... Video: http://mirror.fem-net.de/CCC/27C3/mp4-h264-HQ/27c3-4036-en-reverse_engineering_a_real_word_rfid_payment_system.mp4 http://mirror.fem-net.de/CCC/27C3/mp4-h264-HQ/27c3-4036-en-r...
pirko 16y ago
Tried with my transit card from SL (Stockholm Public Transport). Got "Unsupported card type: Mifare4k". I'm going to look into it more tonight.
- onlydnaq 16y ago
  You can find a presentation about the cards used by SL from last years SEC-T conference here http://www.sec-t.org/2010/presentation-videos.html http://www.sec-t.org/2010/presentation-videos.html The name of the presentation is Hacking the RKF ticket system, it can be found at the bottom of the page.

102 points by EricButler 16y ago

This is great! I was wondering if you could read data from RFID chips using the NFC since the protocols are nearly identical. I wonder if you could create an app that just indiscriminately reads data raw from the NFC chip?

EricButler 16y ago
Thanks! Many RFID cards are basically tiny computers with each with a proprietary command protocol, so you can't read everything generically. MIFARE DESFire cards (ORCA, Clipper, newer Oyster) for example have a command protocol and basic filesystem. FareBot asks the card for a list of all its files and dumps them out one by one. I do believe there's a standard way to read NDEF data (used to store URIs, etc.) from different types of cards but haven't looked into this much yet. I think this is what the "Tag" app that comes with the Nexus S does.

estel 16y ago

Awesome app. I've been looking for some small nfc hacking projects, and might look at getting this working properly with Oyster or something (provided I can get my hands on an updated DESfire one rather than my existing Mifare Classic).

EricButler 16y ago
Thank you! Although probably not as interesting, it would be great to add Mifare Classic support to FareBot, if you're looking for stuff to work on.

wgrover 16y ago

Very cool - tried it with my MBTA Charlie Card and it returns "Unsupported card type: Mifare1K". Are we Bostonians out of luck?

EricButler 16y ago
For now, but support for Mifare Classic is a high priority.

megaframe 16y ago

This is a serious security problem for San Francisco public transit... "in addition to being able to read cards, also have the capability to emulate a card". I had considered duplicating a card, since it's a tag based system. So two or more people could share things like a month Caltrain pass, or two people riding together on the bus could both tag and only pay once. Using this program would be certainly easier, than what I was thinking.

davidmathers 16y ago
How is it a security problem? The article doesn't say anything about a security problem. On the contrary it says the security of some older fare cards has been compromised possibly allowing someone to alter their balance, though I am unaware of any attacks against DESFire.
- megaframe 16y ago
  I don't believe card in SF carry the balance information I thought that was on their side, issue is if people duplicate cards then they could share unlimited month passes.
phlux 16y ago
Assuming NFC works the same way Lockheeds RFID system works - you havea tag ID which is read against a back-end DB which holds the tags value, where the tag/card holds no value data itself, how can this work with SF Transit police checking cards? Assume you dupe your friends card, then both go through the turn style -- wont the system error as the system will say that the second read is either "tagged for exit" or maybe it will read it as a 90-minute transfer read? If you get stopped by the transit police, assuming you got through the turn style, you'd have to have a valid ticket/clipper on you, no?
- megaframe 16y ago
  It's tag only so if you tag again because lets say you were unsure you tagged, the second tag is disregarded, it's the same idea if I ride a bus but have to transfer I tag again but I don't pay again. It's just to verify I've tagged once since getting on. Can't say I've ever seen transit police but could be the buses I ride, and their's a fine for not being able to show you paid, but buses and muni is just tag as you get on. So theirs a risk of course.

eik3_de 16y ago

If you're interested in reverse engineering RFID payment systems in public transfer, I can recommend you this talk from 27c3: https://events.ccc.de/congress/2010/Fahrplan/events/4036.en.html https://events.ccc.de/congress/2010/Fahrplan/events/4036.en.... Video: http://mirror.fem-net.de/CCC/27C3/mp4-h264-HQ/27c3-4036-en-reverse_engineering_a_real_word_rfid_payment_system.mp4 http://mirror.fem-net.de/CCC/27C3/mp4-h264-HQ/27c3-4036-en-r...

pirko 16y ago

Tried with my transit card from SL (Stockholm Public Transport). Got "Unsupported card type: Mifare4k". I'm going to look into it more tonight.

onlydnaq 16y ago
You can find a presentation about the cards used by SL from last years SEC-T conference here http://www.sec-t.org/2010/presentation-videos.html http://www.sec-t.org/2010/presentation-videos.html The name of the presentation is Hacking the RKF ticket system, it can be found at the bottom of the page.