Don’t you hate having to pull out your wallet or cellphone in order to pay for something? What if you could just wave your hand and transfer money that way? Well [David] did, so he decided to do something about it. He made the vending machine in his hackerspace, FamiLAB, cyborg friendly.
The problem was, the vending machine wasn’t technically his to play around with… so he had to do this hack without actually modifying the machine itself — which we admit, actually makes it quite a bit more interesting!
But first, why is [David] even doing this? Is he a cyborg or something? Well, not quite, but he’s quite enthusiastic about bio-tech (is that what we call it now?) — anyway, he has NFC implants in his hand, and magnets in his fingertips to give him a sixth “electro-sense”. Wanting to take the most advantage of these augmented abilities, he put together this clever NFC credit card emulator.
To read his hand, he’s using an Adafruit RFID/NFC Shield stuck on the front of the machine, with an Arduino Mega 2560 to control it. To get around messing with the credit card unit, he’s placed a solenoid next to it, which is close enough that when energized with his information… the credit card machine reads it. Whether or not you like the cyborg action itself, what [David’s] put together is pretty incredible. He has detailed instructions and material on GitHub if you’re interested in knowing more.
Alternatively you could just get an NFC ring… or for the electro-sense, a neodymium ring magnet.
The card reader already supports NFC. For those not wanting to stick random things under their skin, a simple gauntlet would hold a lot more sensors and capabilities to work with normal objects. Google Wallet for example works with those vending machines without a problem.
Also, Isis on a phone…
Even if you don’t know much about NFC, you only have to read the first paragraph – “the security and technology in the type of NFC tags used for PayPass financial transactions are radically different from the chips in my hands.” Unsurprisingly and reassuringly, you can’t just clone a credit card by faking its tag ID.
Having said that, it is a little worrying how easy it is to effectively mimic the magnetic strip on the card.
Yeah, I found this part the coolest/hackiest. Just put a coil next to the reader to spoof a swipe? Interesting!
You would think there would be some type of sensor to check for the presence of a card, and indeed some of the older machines I had did have photo sensors. But yeah, the presence of the card, baudrate (based on swipe rate) etc.. is all initiated by the header programmed into the card. In modern machines, the only ones I have seen with the sensors are the type that “eat” your card.
Using this same coil, I’m sure it would be possible to also read cards swiped by picking up the energy in the pickup head. If you can write, then you can also read. I hope the people using the vending machine trusts this dude.
Dunno if there’d be a need to sense the card is actually there. The only reason it wouldn’t be, is in cases like this, which aren’t common. Cards are usually copied by duplicating the tracks onto a blank, which looks much more normal to use in front of people. If you WERE trying to somehow hack a machine with this, you could of course just put a correctly-shaped bit of plastic in. Detecting a physical card wouldn’t help prevent much fraud, and could be simply defeated anyway, so I’d bet they don’t bother.
So I can’t actually reply to the comment level below this, but the magnetic flux strength is way too low to be read by the coil I’ve got installed. Only good for emulating, no way you could use it to read card data. And yes, people trust me, if you look at the hack, they have to hand me their card data to get put into the system.
Other people have their cards stored in this system? Is that so they can activate it with NFC dongles too? Don’t suppose anyone else has them as implants.
yup I trust David, and it’s my vending machine. I even put my own NFC tag in the system. I’m literally willing to put money on it. lol (yes duh I could just unlock the machine with my key, but not paying for product messes up the accounting. and I’d eat all the things.).
The reason it’s useful for the machine to read NFC tags instead of credit cards, is because many FamiLAB members use NFC tags or key fobs for door entry. Now that the machine can associate NFC tags with credit cards, people don’t have to have their wallets to get a snack. Which is handy on all-night hackathons.
BTW regarding google wallet and isis. This credit card reader accepts Isis, but Google Wallet is setup as a Mastercard debit card and the machine won’t accept it. Neither transmitted from a phone, or even a physical google wallet card. Interesting to know.
The whole implanted magnets thing worries me. What if you need an MRI?
There’s no effect, I know a few guys with the little neodymium magnets in their ring fingers who’ve had MRIs but the technicians can shield things like that really well.
Google wallet doesn’t work with this reader. We’ve tried both the cellphone app and a physical google wallet card. This particular reader won’t accept Mastercard debit cards.
is it me or does this thing look like a fleshlight
Nice for others to be able to record the credit data….. will spread the concept quite quickly.
No way that coil will pickup a creditcard number. The head head in those things hardly work when you want them half the time, expecting a crude coil several inches away to do the same thing is unrealistic.
Is that what he means, or is he referring to just this one case, where a guy’s transmitting the magnetic stripe data through the coil? Cos that’d certainly be easy to pick up. Although with a PIN, it’s not going to do him much good with a machine. On humans it’s going to be even less use, since the entire card is missing.
In either case, ATM machines have long been hacked by putting a small enclosure in front of the card slot, with a little read head snuck in there. I imagine the handheld restaurant-type readers have been hacked too. They have the advantage of not just ripping this one cyborg bloke’s number off.
Yeah, you could very easily record the card data coming out of the coil. Keep in mind though, that’s only going to “play” if the original owner of the card just swiped their NFC tag. It’s in a location I trust, and I imagine it would be pretty obvious if someone were trying to record the signal.
I disagree. I think it could pick it up. Not from the card itself of course but from the coil in the read head. In this case, he is injecting power into the read head. But he could almost as easily pickup the pulses in the read head coil and with some amplification and filtering, the data passing into the read head could be intercepted.
Nope. Way, way too weak of a signal. The antenna design would have to be radically different from this coil, and I’m not sure even then you could do it. Keep in mind to read a card you normally have to have a very sensitive magnetic head *directly* on the magstrip.
“Electron sense”
yeah, ok then, Have fun going through airports.
ignore that extra n
I imagine a handheld scanner would locate the metal as being in his fingers. And they’re no more likely to set one off than, say, a wedding ring. Though in these paranoid times, perhaps they’re obsessed enough to search for every last scrap of metal.
I really don’t think they are going to just accept that he says he has magnets in his fingers and just go “oh, neat. Move along then.” At least I certainly hope not. When a wedding ring sets it off, they ask you to remove it and then swipe again.
People can hide razor blades and all sorts of things under their skin or under a synthetic skin. Implants set these off too, and they deal with those by inspecting scars, etc… but come to think of it, you could probably get something nefarious onto a plane that way if someone was determined enough to dig out a weapon from their bodies.
As hackers, we are aware that total security is really just an illusion.
Actually, the implants don’t set off even handheld wands. I’ve had them try and put the wand right on my fingers, no dice. And the airport scanners are even less sensitive. I get through security fine.
Hmm… odd. The type of metal they are made from perhaps?
Again, I can’t reply to your comment :\ They’re standard N52 neodymium magnets, they’re just very small and the wands are turned down to not pick up metal objects that small. (Think about how many veterans are walking around with shrapnel, surgery screws, etc)
:-) I can understand why someone with magnets in his fingertips might not regard credit cards as that very useful… (I guess the feeling is mutual)
Good point. lol. I hadn’t even considered that.
Heh, sadly the magnets are too weak to mess with credit cards :p
Next time he asks for a file, hand it to him on a floppy.
if im reading the comments right people are discussing reading data as it is swiped
if so i was under the impression that the signal was so low frequency that you can not pick it up from an inch away?
so you would need to open the device anyway, negating any security issues.
i would on the otherhand assume you can EMULATE a swipe by creating a field around device… you’d need enough power tho.
this too is not a security worry because if you have the data already, you can just use it online or sell it
my assumption is that people are correct when they say the analog head signal can be passed along audio equipment.
Correct, but it’s not the frequency, it’s the strength of the magnetic flux. Also the density. There’s just no way to read it from anything more than directly on or very very close to the card. And yes, my hack does use the coil for emulation. Read the article, that’s exactly what I’m doing.
Just FYI. It requires at least a 700 gauss *moving* magnetic field, directly in contact with the magstripe to alter the data on it. Mythbusters did a bit on what can or cannot erase credit cards in your pocket or purse.
They built a magnetic coil and laid cards on it, with MYTHBUSTERS encoded on the stripe. IIRC they went all the way up to 2,000 gauss with no effect. It was only when Jamie removed the card from the coil before Adam turned it off that the data was corrupted. So then they lowered the strength while moving the cards through the field until they got it down to a level where it didn’t affect the data.
Different magnetic materials have different levels of coercivity. The strength of magnetic field it takes to coerce the magnetic fields of the particles in the magnetic media.
Ordinary audio tape and low density floppy disks have low coercivity while “chrome” and “metal” audio tapes and high density floppy disks and credit cards have higher coercivity.
Hotel room cards must have lower coercivity than credit cards. I’ve had hotel cards get corrupted by being in in the same pocket as a cell phone (even though it didn’t receive any calls or other incoming or outgoing data) but never a credit card.
This trick of placing a magnetic coil outside the card reader would be simple to defeat by placing a thin sheet metal shield around the read heads, leaving only the card contact surface exposed. Might still be able to get the magnetic field to the head by holding the coil up against the card slot.