FareBot – Android NFC Proof of Concept

farebot_logo

Upon learning that the Nexus S smartphone was equipped with a Near Field Communications NFC) radio, [Eric Butler] decided he would put the newly released Gingerbread SDK to good use.  Focusing initially on ORCA fare cards used by several Washington state transit systems, he built an open-source application he calls FareBot, which can read data from any MIFARE DESFire branded cards.  Utilizing the NFC radio in the Nexus S, he was able to dump all of the unprotected information from the fare cards, including  the remaining card balance and the last 10 locations where the card was used.

The author hopes that his proof of concept application encourages other developers to expand on his project and to explore the data stored on transit cards around the world. While it is in its early stages, [Eric] would ultimately like to see this project expanded to allow the use of NFC-enabled smartphones as transit cards themselves via downloadable apps.  He suggests that helping people understand the amount of data which can be freely obtained from these cards will eventually force the manufacturers to better inform consumers of the existing system’s shortcomings, which in turn might spur on smartphone-based transit initiatives.

Scratch built RFID tags

rfid

[nmarquardt] has put up an interesting instructable that covers building RFID tags. Most of them are constructed using adhesive copper tape on cardstock. The first version just has a cap and a low power LED to prove that the antenna is receiving power. The next iteration uses tilt switches so the tag is only active in certain orientations. The conclusion shows several different variations: different antenna lengths, conductive paint, light activated and more.

RFID reader denial of service


While in Vancouver, Canada for CanSecWest we had a chance to catch up with [Marc]. He showed off a very simple Denial-of-Service attack that works for most commercial RFID reader systems. He worked out this physical DoS with [Adam Laurie], whose RFID work we featured last year.