FareBot: Read data from public transit cards w/ your NFC-equipped Android phone

http://codebutler.com/announcing-farebot-for-android

by EricButler • 15 years ago

102 17 15 years ago

This is great! I was wondering if you could read data from RFID chips using the NFC since the protocols are nearly identical. I wonder if you could create an app that just indiscriminately reads data raw from the NFC chip?

EricButler3• 15 years ago

Thanks!

Many RFID cards are basically tiny computers with each with a proprietary command protocol, so you can't read everything generically. MIFARE DESFire cards (ORCA, Clipper, newer Oyster) for example have a command protocol and basic filesystem. FareBot asks the card for a list of all its files and dumps them out one by one.

I do believe there's a standard way to read NDEF data (used to store URIs, etc.) from different types of cards but haven't looked into this much yet. I think this is what the "Tag" app that comes with the Nexus S does.

estel• 15 years ago

Awesome app. I've been looking for some small nfc hacking projects, and might look at getting this working properly with Oyster or something (provided I can get my hands on an updated DESfire one rather than my existing Mifare Classic).

EricButler3• 15 years ago

Thank you! Although probably not as interesting, it would be great to add Mifare Classic support to FareBot, if you're looking for stuff to work on.

wgrover• 15 years ago

Very cool - tried it with my MBTA Charlie Card and it returns "Unsupported card type: Mifare1K". Are we Bostonians out of luck?

EricButler3• 15 years ago

For now, but support for Mifare Classic is a high priority.

megaframe3• 15 years ago

This is a serious security problem for San Francisco public transit... "in addition to being able to read cards, also have the capability to emulate a card". I had considered duplicating a card, since it's a tag based system. So two or more people could share things like a month Caltrain pass, or two people riding together on the bus could both tag and only pay once. Using this program would be certainly easier, than what I was thinking.

davidmathers• 15 years ago

How is it a security problem? The article doesn't say anything about a security problem. On the contrary it says the security of some older fare cards has been compromised possibly allowing someone to alter their balance, though I am unaware of any attacks against DESFire.

megaframe3• 15 years ago

I don't believe card in SF carry the balance information I thought that was on their side, issue is if people duplicate cards then they could share unlimited month passes.

phlux• 15 years ago

Assuming NFC works the same way Lockheeds RFID system works - you havea tag ID which is read against a back-end DB which holds the tags value, where the tag/card holds no value data itself, how can this work with SF Transit police checking cards?

Assume you dupe your friends card, then both go through the turn style -- wont the system error as the system will say that the second read is either "tagged for exit" or maybe it will read it as a 90-minute transfer read?

If you get stopped by the transit police, assuming you got through the turn style, you'd have to have a valid ticket/clipper on you, no?

megaframe3• 15 years ago

It's tag only so if you tag again because lets say you were unsure you tagged, the second tag is disregarded, it's the same idea if I ride a bus but have to transfer I tag again but I don't pay again. It's just to verify I've tagged once since getting on. Can't say I've ever seen transit police but could be the buses I ride, and their's a fine for not being able to show you paid, but buses and muni is just tag as you get on. So theirs a risk of course.

gcb• 15 years ago

because limiting that misdemeanor to people that bought from dealextreme.com a $20 RFID duplicator kit instead of a $500 phone makes the world so much more secure.

furyg3• 15 years ago

Honestly, this is a problem for a) The transit authority which implemented a broken system and b) the person who gets caught counterfeiting a card / riding for free.

It doesn't take much of a security expert to warn you that the system is insecure when you're implementing something which trusts the card (not a central database), and the protocol is proprietary and uses weak encryption (mifare is 48-bit or so?).

Implementing a system which trusts the card is just asking for trouble, certainly considering the amount of horepower your average commuters are carying around in their pockets nowadays.

eik3_de• 15 years ago

If you're interested in reverse engineering RFID payment systems in public transfer, I can recommend you this talk from 27c3: https://events.ccc.de/congress/2010/Fahrplan/events/4036.en.... Video: http://mirror.fem-net.de/CCC/27C3/mp4-h264-HQ/27c3-4036-en-r...

pirko• 15 years ago

Tried with my transit card from SL (Stockholm Public Transport). Got "Unsupported card type: Mifare4k". I'm going to look into it more tonight.

onlydnaq• 15 years ago

You can find a presentation about the cards used by SL from last years SEC-T conference here http://www.sec-t.org/2010/presentation-videos.html

The name of the presentation is Hacking the RKF ticket system, it can be found at the bottom of the page.

FareBot: Read data from public transit cards w/ your NFC-equipped Android phone

Related Stories