Hacker Pops Top On NFC Vending Machines

October 16, 2018 by Tom Nardi 23 Comments

Vending machines used to be a pretty simple affair: you put some coins in, and food or drink that in all likelihood isn’t fit for human consumption comes out. But like everything else today, they are becoming increasingly complex Internet connected devices. Forget fishing around for pocket change; the Coke machine at the mall more often than not has a credit card terminal and a 30 inch touch screen display to better facilitate dispensing cans of chilled sugar water. Of course, increased complexity almost always goes hand in hand with increased vulnerability.

So when [Matteo Pisani] recently came across a vending machine that offered users the ability to pay from an application on their phone, he immediately got to wondering if the system could be compromised. After all, how much thought would be put into the security of a machine that basically sells flavored water? The answer, perhaps not surprisingly, is very little.

The write-up [Matteo] has put together is an outstanding case study in hacking Android applications, from pulling the .apk package off the phone to decompiling it into its principal components with programs like apktool and jadx. He even shows how you can reassemble the package and get it suitable for reinstallation on your device after fiddling around with the source code. If you’ve ever wanted a crash course on taking a peek inside of Android programs, this is a great resource.

By snooping around in the source code, [Matteo] was able to discover not only the location of the encrypted database that serves as the “wallet” for the user, but the routine that generates the encryption key. To cut a long story short, the program simply uses the phone’s IMEI as the key to get into the database. With that in hand, he was able to get into the wallet and give himself a nice stack of “coins” for the next time he hit the vending machines. Given his new-found knowledge of how the system works, he even came up with a separate Android app that allows adding credit to the user’s account on a rooted device.

In the video after the break, [Matteo] demonstrates his program by buying a soda and then bumping his credit back up to buy another. He ends his write-up by saying that he has reported his findings to the company that manufacturers the vending machines, but no word on what (if any) changes they plan on making. At the end of the day, you have to wonder what the cost-befit analysis looks like for a full security overhaul when when you’re only selling sodas and bags of chips.

When he isn’t liberating carbonated beverages from their capitalistic prisons, he’s freeing peripherals from their arbitrary OS limitations. We’re starting to get a good idea about what makes this guy tick.

Continue reading “Hacker Pops Top On NFC Vending Machines” →

Samy Kamkar: Reverse Engineering For A Secure Future

January 2, 2018 by Dan Maloney 15 Comments

Show of hands: how many of you have parked your car in the driveway, walked up to your house, and pressed your car’s key fob button thinking it would open the front door? We’ve probably all done it and felt a little dopey as a result, but when you think about it, it would be tremendously convenient, especially with grocery bags dangling off each arm and the mail clenched between your teeth. After all, we’re living in the future — shouldn’t your house be smart enough to know when you’re home?

Reverse engineer par excellence Samy Kamkar might think so, but given his recent experiences with cars smart enough to know when you’re standing outside them, he’d probably have some reservations. Samy dropped by the 2017 Hackaday Superconference in November to discuss the finer points of exploiting security flaws in passive car entry systems, and also sat down with our own Elliot Williams after his talk for a one-on-one interview. Samy has some interesting insights on vehicle cybersecurity, but the practical knowledge he’s gained while exploring the limits of these systems teach some powerful lessons about being a real-world reverse engineer.

Continue reading “Samy Kamkar: Reverse Engineering For A Secure Future” →

Homebrew SNES Mini Aims For Historical Accuracy

November 15, 2017 by Tom Nardi 8 Comments

While “normies” are out fighting in the aisles of Walmart to snap up one of the official “Classic Mini” consoles that Nintendo lets slip out onto the market every once and awhile, hackers have been perfecting their own miniature versions of these classic gaming systems. The “Classic Mini” line is admittedly a very cool way to capitalize on nostalgic masses who have now found themselves at the age where they have disposable income, but the value proposition is kind of weak. Rather than being stuck with the handful of generation-limited games that Nintendo packed into the official products, these homebrew consoles can play thousands of ROMs from systems that stretch across multiple generations and manufacturers.

But for those old enough to remember playing on one of these systems when they first came out, these modern reincarnations always lack a certain something. It never feels quite right. That vaguely uncomfortable feeling is exactly what [ElBartoME] is aiming to eliminate with his very slick miniature SNES build. His 3D printed case doesn’t just nail the aesthetics of the original (PAL) console, but the system also uses real SNES controllers in addition to NFC “cartridges” to load different ROMs.

The project’s page on Thingiverse has all the wiring diagrams and kernel configuration info to get the internal Raspberry Pi 3 to read an original SNES controller via the GPIO pins. He also gives a full rundown on the hardware and software required to get the NFC-enabled cartridges working with EmulationStation to launch the appropriate game when inserted. Though he does admit this is quite a bit trickier than the controller setup.

[ElBartoME] has put a video up on YouTube that shows him inserting his mock cartridges and navigating the menus with an original SNES controller. If it wasn’t for the fact that the console is the size of a smartphone and the on-screen display is generations beyond what the SNES could pull off, you’d think he was playing on the real thing.

We’ve seen some incredibly impressive emulation boxes based on the Raspberry Pi, and builds which tried to embrace original hardware components, but this particular project may represent the best of both worlds.

Continue reading “Homebrew SNES Mini Aims For Historical Accuracy” →

“Borrow” Payment Cards With NFC Proxy Hardware

July 31, 2017 by Mike Szczys 31 Comments

Contactless payments are growing in popularity. Often the term will bring to mind the ability to pay by holding your phone over a reader, but the system can also use NFC tags embedded in credit cards, ID card, passports, and the like. NFC is a reasonably secure method of validating payments as it employs encryption and the functional distance between client and reader is in the tens of centimeters, and often much less. [Haoqi Shan] and the Unicorn team have reduced the security of the distance component by using a hardware proxy to relay NFC interactions over longer distances.

The talk, give on Sunday at DEF CON, outlined some incredibly simple hardware: an NFC antenna connected to a PN7462AU, an NRF24L01 wireless transceiver, and some power regulation. The exploit works by using a pair of these hardware modules. A master interfaces with the NFC reader, and a slave reads the card. The scenario goes something like this: a victim NFC card is placed near the slave hardware. The master hardware is placed over a payment kiosk as if making a normal payment. As the payment kiosk reader begins the process to read an NFC card, all of the communications between it and the actual card are forwarded over the 24L01 wireless connection.

The demo video during the talk showed a fast-food purchase made on the Apple Pay network while the card was still at a table out in the dining area (resting on the slave hardware module). The card used was a QuickPass contactless payment card from China UnionPay. According to a 2016 press release from the company, over two billion of these cards had been issued at the time. With that kind of adoption rate there is a huge incentive to find and patch any vulnerabilities in the system.

The hardware components in this build aren’t really anything special. We’ve seen these Nordic wireless modules used in numerous projects over they years, and the NXP chip is just NFC build around an ARM core. The leaps that tie this together are the speed-ups to make it work. NFC has tight timing and a delay between the master and slave would invalidate the handshake and subsequent interactions. The Unicorn team found some speedups by ensuring the chip was waking from suspend mode (150 µS) and not a deeper sleep. Furthermore, [Haoqi] mentioned they are only transmitting “I/S/R Block Data” and not the entirety of the interaction to save on time transmitting over the 24L01 wireless link. He didn’t expand on that so if you have details about what those blocks actually consist of please let us know in the comments below.

To the card reader, the emulated payment card is valid and the payment goes through. But one caveat to the system is that [Haoqi] was unable to alter the UID of the emulator — it doesn’t spoof the UID of the payment card being exploited. Current readers don’t check the UID and this could be one possible defense against this exploit. But to be honest, since you need close physical proximity of the master to the reader and the slave to the payment card simultaneously, we don’t see mayhem in the future. It’s more likely that we’ll see hacker cred when someone builds a long-range link that lets you leave your NFC cards at home and take one emulator with you for wireless door access or contactless payments in a single device. If you want to get working on this, check out the talk slides for program flow and some sourcecode hints.

Making A Wearable NFC Bus Pass

June 20, 2017 by John Baichtal 34 Comments

[Stephen Cognetta] is trying to get the total number of things he owns down below 115, and he’s always looking for ways to streamline his life.

Toward this goal he dissolved his SF Transit Clipper Card in acetone to get at the NFC tag embedded inside. The tag consists of a tiny chip attached to an antenna the size of the card itself. It took about three days (video below the break) for the layers to separate and [Stephen] was able to extricate the tag.

He ended up trying a few different ways of storing the delicate chip and antenna, including a lump of Sugru as well as a waterproof aspirin band, pictured to the right.

One supposes the transit pass idea might save you a little time, but what would really simplify your life would be having a single wearable tag that unlocked a bunch of things. Also it should be noted that, un-coolly, damaging a card violates SF Transit’s terms of service…

HaD has covered NFC wearables before, including the phone-unlocking NFC ring as well as the NFC ring box. This NFC-controlled infinity mirror makes great use of the technology.

Continue reading “Making A Wearable NFC Bus Pass” →

Skin Bling: Wearable Electronics From Golden Temporary Tattoos

August 16, 2016 by Adam Fabio 21 Comments

MIT Media Lab and Microsoft have teamed up to take wearable devices one step further — they’ve glued the devices directly to the user’s skin. DuoSkin is a temporary tattoo created with gold leaf. Metallic “Flash” temporary fashion tattoos have become quite popular recently, so this builds on the trend. What the team has done is to use them to create user interfaces for wearable electronic devices.

Generally speaking, gold leaf is incredibly fragile. In this process to yield the cleanest looking leaf the gold is not actually cut. Instead, the temporary tattoo film and backer are cut on a standard desktop vinyl cutter. The gold leaf is then applied to the entire film surface. The cut film/leaf can then be “weeded” — removing the unwanted portions of film which were isolated from the rest by the cutting process — to complete the temporary tattoo. The team tested this method and found that traces 4.5 mm or more thick were resilient enough to last the entire day on your skin.

The gold leaf tattoos make excellent capacitive touch sensors. The team was able to create sliders, buttons, and even 2 dimensional diamond grids. These controls were used to move a cursor on a computer or phone screen. They were even able to create a wearable NFC tag. The gold leaf is the antenna, and the NFC chip itself is mounted on the temporary tattoo backer.

These devices all look great, but with the exception of the NFC chip, we’re not seeing the electronics driving them. Capacitive touch sensors used as a UI for a phone will have to have a Bluetooth radio and a battery somewhere. We’re that’s all hidden under the arm of the user. You can see what we’re taking about in the video after the break. That said, the tools and materials are ubiquitous and easy to work with. Take a quick read through the white paper (PDF) and you can be making your own version of this today.

Continue reading “Skin Bling: Wearable Electronics From Golden Temporary Tattoos” →

Hacklet 117 – NFC Projects

July 23, 2016 by Adam Fabio 5 Comments

Near Field Communication (NFC) is something we take for granted these days. Nearly all smartphones have it. We even have NFC interfaces for all our favorite development boards. NFC’s history goes back all the way to 1997, when an early version was used in Star Wars special edition toys. Radio Frequency Identification (RFID), which NFC builds on, goes back even further. The patent citation trail leads all the way back to 1983 in a patent awarded to [Charles Walton]. NFC is much more than RFID though. The idea of two way communication between devices opens up tons of possibilities for projects and hacks. This week on the Hacklet we’re checking out some of the best NFC projects on Hackaday.io!

We start with [Patrick] and Ctrl-O. Somewhere in the hackerspace bible there is a clause that states “Thou shalt build an electronic access control system”. In [Patrick’s] case, a door lock became a complex membership subscription management database. Members who have paid can use an NFC tag to gain access to the hackerspace. The system consists of a Raspberry Pi with an NFC interface. A relay allows the Pi to control the door lock. The Pi can be manually configured through a web interface. It connects to Paypal to verify that each user’s membership has actually been paid. Of course a project like this is never done. The last we heard from [Patrick], he was planning future upgrades such as startup company memberships with multiple people.

Next up is [Pierre Charlier] and KeyDuino. KeyDuino is an Arduino compatible board with all the NFC hardware baked right in. The board is based upon the Arduino Leonardo, with an ATmega32u4 processor. [Pierre] must be on to something, because the KeyDuino had a successful Kickstarter back in 2015. It’s also open source hardware, so you can build your own whenever you want. The real gem is checking out [Pierre’s] other projects. He’s documented all his KeyDuino example projects right on Hackaday.io. These include an NFC Controlled infinity mirror coffee table, a locking wooden gift box, and NFC controlled car door locks, just to name a few.

Next we have [John McLear] with 2016 NFC Ring. [John] jumped into wearable technology with one of the toughest form factors imaginable – a ring. Between the tiny amount of space and the lack of batteries, you might think there isn’t much you can do with a ring. Undaunted, [John] managed to fit two NXP NFC chips and their antennas inside a standard ring. This is the upgraded 2016 version of the ring. [John] was nice enough to supply several hundred of the earlier models to hackers at the Hackaday Supercon back in 2015. [John’s] rings would be hard for the average hacker to reproduce. [Sean Hodgins] comes to the rescue here with his own project, DIY NFC Bentwood Ring.

Finally, we have [CaptMcAllister] with RFID air pressure sensor. As the name implies, this sensor measures air pressure. It could be in open air, a tire, or even a football used by the New England Patriots. Sure, cars all have Tire Pressure Monitoring Systems (TPMS) sensors which do something similar. [CaptMcAllister’s] design has one important difference – it has no batteries. The heart of the system is a Texas Instruments RF430FRL15X, a device with the NFC radio and a low power MSP430 microcontroller in one chip. The system is energy harvesting, being powered by an external reader. As you can imagine, tuning the antenna was critical to this design. You can read all about it in [CaptMcAllister’s] 24 project logs.

If you want to see more NFC projects and hacks, check out our new near field communication projects list. See a project I might have missed? Don’t be shy, just drop me a message on Hackaday.io. That’s it for this week’s Hacklet, As always, see you next week. Same hack time, same hack channel, bringing you the best of Hackaday.io!