Learn, hack!

URL

http://mirror.fem-net.de/CCC/27C3/mp3-audio-only/27c3-4036-en-reverse_engineering_a_real-world_rfid_payment_system.mp3

File name

27c3-4036-en-reverse_engineering_a_real-world_rfid_payment_system.mp3

File size

26.7 MB

MD5

eef2f35af6d43040b058b2d3ee1cf7a2

SHA1

6eb99df5def1a56f27aee7cd9b1df154101b5f81

How to reverse engineer the data format of a real-world RFID based debit card system. One of Asia’s most popular electronic payment systems uses insecure technology. The EasyCard system, established in 2001, is the most popular stored-valued card in Taiwan. With more than 18 million issued cards, it is the predominant means of paying for public transportation services in the capital Taipei. In 2010, use of the EasyCard was extended beyond transportation. Card holders can now pay in all major convenience stores like 7eleven, coffe shops like Starbucks and and major retail companies like SOGO. Despite the large fraud potential, the EasyCard system uses the MIFARE Classic RFID technology, whose proprietary encryption cipher CRYPTO1 relied on obscurity and was first publicly broken several years ago at 24C3 This presentation analyzes the results of combining the practical attacks on the MIFARE Classic CRYPTO1 system in the context of the EasyCard payment system. It describes the process of reverse- engineering the actual content of the card to discover the public transportation transaction log, the account balance and how the daily spending limit work. Furthermore, the talk will present how fundamentally flawed the system is, and how easy it is to add or subtract monetary value to/from the card. Cards manipulated as described in the talk have been accepted by the payment system.