Live data from Hacker News

FareBot: Read data from public transit cards w/ your NFC-equipped Android phone

codebutler.com

1–10 of 18 posts

Re: FareBot: Read data from public transit cards w/ your NFC-equipped Android phone

#2
This is great! I was wondering if you could read data from RFID chips using the NFC since the protocols are nearly identical. I wonder if you could create an app that just indiscriminately reads data raw from the NFC chip?

Re: FareBot: Read data from public transit cards w/ your NFC-equipped Android phone

#3

This is great! I was wondering if you could read data from RFID chips using the NFC since the protocols are nearly identical. I wonder if you could create an app that just indiscriminately reads data raw from the NFC chip?

Thanks!

Many RFID cards are basically tiny computers with each with a proprietary command protocol, so you can't read everything generically. MIFARE DESFire cards (ORCA, Clipper, newer Oyster) for example have a command protocol and basic filesystem. FareBot asks the card for a list of all its files and dumps them out one by one.

I do believe there's a standard way to read NDEF data (used to store URIs, etc.) from different types of cards but haven't looked into this much yet. I think this is what the "Tag" app that comes with the Nexus S does.

Re: FareBot: Read data from public transit cards w/ your NFC-equipped Android phone

#5
post #4

Awesome app. I've been looking for some small nfc hacking projects, and might look at getting this working properly with Oyster or something (provided I can get my hands on an updated DESfire one rather than my existing Mifare Classic).

Thank you! Although probably not as interesting, it would be great to add Mifare Classic support to FareBot, if you're looking for stuff to work on.

Re: FareBot: Read data from public transit cards w/ your NFC-equipped Android phone

#7
This is a serious security problem for San Francisco public transit... "in addition to being able to read cards, also have the capability to emulate a card". I had considered duplicating a card, since it's a tag based system. So two or more people could share things like a month Caltrain pass, or two people riding together on the bus could both tag and only pay once. Using this program would be certainly easier, than what I was thinking.

Re: FareBot: Read data from public transit cards w/ your NFC-equipped Android phone

#8

This is a serious security problem for San Francisco public transit... "in addition to being able to read cards, also have the capability to emulate a card". I had considered duplicating a card, since it's a tag based system. So two or more people could share things like a month Caltrain pass, or two people riding together on the bus could both tag and only pay once. Using this program would be certainly easier, than…

How is it a security problem? The article doesn't say anything about a security problem. On the contrary it says the security of some older fare cards has been compromised possibly allowing someone to alter their balance, though I am unaware of any attacks against DESFire.

Re: FareBot: Read data from public transit cards w/ your NFC-equipped Android phone

#9

This is a serious security problem for San Francisco public transit... "in addition to being able to read cards, also have the capability to emulate a card". I had considered duplicating a card, since it's a tag based system. So two or more people could share things like a month Caltrain pass, or two people riding together on the bus could both tag and only pay once. Using this program would be certainly easier, than…

Assuming NFC works the same way Lockheeds RFID system works - you havea tag ID which is read against a back-end DB which holds the tags value, where the tag/card holds no value data itself, how can this work with SF Transit police checking cards?

Assume you dupe your friends card, then both go through the turn style -- wont the system error as the system will say that the second read is either "tagged for exit" or maybe it will read it as a 90-minute transfer read?

If you get stopped by the transit police, assuming you got through the turn style, you'd have to have a valid ticket/clipper on you, no?

Re: FareBot: Read data from public transit cards w/ your NFC-equipped Android phone

#10
post #9

This is a serious security problem for San Francisco public transit... "in addition to being able to read cards, also have the capability to emulate a card". I had considered duplicating a card, since it's a tag based system. So two or more people could share things like a month Caltrain pass, or two people riding together on the bus could both tag and only pay once. Using this program would be certainly easier, than…

Assuming NFC works the same way Lockheeds RFID system works - you havea tag ID which is read against a back-end DB which holds the tags value, where the tag/card holds no value data itself, how can this work with SF Transit police checking cards? Assume you dupe your friends card, then both go through the turn style -- wont the system error as the system will say that the second read is either "tagged for exit" or ma…

It's tag only so if you tag again because lets say you were unsure you tagged, the second tag is disregarded, it's the same idea if I ride a bus but have to transfer I tag again but I don't pay again. It's just to verify I've tagged once since getting on. Can't say I've ever seen transit police but could be the buses I ride, and their's a fine for not being able to show you paid, but buses and muni is just tag as you get on. So theirs a risk of course.
Post reply on HN