Unlocking The Power Of the Magstripe

Acidus writes "While researching for an embedded systems project (a magstripe enabled Coke machine), I was shocked by the lack of magstripe information: Programs/code that would run on a modern OS were all but nonexistant, articles that were 6-10 years old, etc. Further research proved hard, because I had become google's authoritative source. So Stripe Snoop was born, and is now at 1.5 . Stripe Snoop is a suite of research tools that captures, modifies, validates, generates, analyzes, and shares magstripe data, with an ever-growing database of card formats. Decoding everything from driver's licenses to banking cards, its features can analyze non-standard cards, such as NYC's Metrocard."

Comments

Also in 2600

[Noryungi]

There was also an interesting article in this summer 2600 magazine about magstrips. Some information and code were supplied...

Re:Also in 2600

[pacc]

Linked from the Stripe Snoop page:

An article I wrote that is being published in the Summer 2004 issue of 2600 that is all about magstripe interfacing. This provided the basis for Stripe Snoop. Another application is this homebrew coke machine I built.

Re:Also in 2600

[shepmaster]

I consider myself lucky, in that I have met Acidus in person, and have actually shared a class with him. It was an embedded programming class, and we each had to do a semester project. As mentioned in the blurb, his project was a Coke dispenser that worked off magstripe technology.

What was far more interesting was the software backend he developed to run the system. It was very professional, and the software itself incorporated some intrigueing concepts, such as what to do when the system was cut off from the real world. I hope Acidus will care to chime in and explain some more of his higher-level ideas.

One thing that I was impressed with was the security concerns that he evidently thought of. Unlike other programmers I know, security was not an afterthought, but incorporated into the design (this was also evidenced in his Blackboard dissection, previously discussed on Slashdot).

I hope that Acidus has a chance to go far, he is one of those bright young Computer Scientists with a good future in front of him.

Cheers!

Re:Also in 2600

[brandonY]

He was president of our theatre organization. Do you know how many times we had to swear that we wouldn't let him get near the buzzcard reader in order to get one?

Working link

[Zorilla]

Here's the real link to the article:

Linky.

Re:Good link checking, well done the mods...

[LiquidCoooled]

http://www.yak.net/acidus/magstripe/coke.html

How long before DMCA is used?

[gilesjuk]

I can imagine some card company out there will try and put a stop to this, purely to save their own skins for putting out fairly weak systems.

Could be a useful tool though, I'd love to save car parking charges (place where I park sometimes uses magnetic cards) :)

Re:How long before DMCA is used?

[Anonymous Coward]

"Could be a useful tool though, I'd love to save car parking charges (place where I park sometimes uses magnetic cards) :)"

Smiley noted, but it's comments like this that make people think of "hackers" as criminals. Another example: P2P could be a useful tool though, I'd love to save the cost of a CD.

RIAA and the MPAA may be a bunch of wankers, but let's not encourage them. Let the same logic apply to smart & mag card manufacturers.

Re:How long before DMCA is used?

[t_allardyce]

I think its happened before - people calling up their bank etc and saying "hey, your card is insecure it stores your pin in plaintext" and the bank says "you shouldnt have a card reader! what do you think you're doing"

Its the standard bullshit you'll get from clueless people and experience says most cards in your wallet are probably badly designed, so yep, its probably not worth it to try and help these people by explaining whats wrong and what they can do because they are more likely to try and sue you.

Bu I think technically you have a legal right to see whats on the strip - its your personal data and would fall under the data-protection act?

Re:How long before DMCA is used?

[Anonymous Coward]

I can imagine some card company out there will try and put a stop to this

I used to work for a company that produced access control devices, including card readers. We managed to reverse engineer all of our competitor's card formats (the one's that didn't use the well-documented Wiegand standard) and build support for them into our product to reduce the cost of getting customers to switch. Most competitor's just shrugged it off, half of them were doing the same thing anyway, but one company that relied on defence contracts for a lot of its business got its lawyers to write a letter threatening to report us to the NSA for "breaking their triple-DES level encryption scheme". We sent the lawyers back full documentation of their snakeoil and pointed out that they'd lose a lot of Government and defense business if the NSA got wind of the fact that what was being marketed as "triple-DES level encryption" was in fact an 4-bit XOR pattern.

Re:How long before DMCA is used?

[Anonymous Coward]

A magstripe writer new costs like $500 or $600.

True. Some are even more. I worked at a security company a few years ago testing, among other things, mag-stripe cards/readers/interfaces. We used American Magnetics' (I believe) Model 700's - and that 700 was roughly equivalent to the base-model price. It depended, of course, on whether you bought the models that could read just one stripe, two stripes, or all three stripes on a standard card - the 3-stripers were more, of course, but for some purposes unnecessary. For example, another tester and I duplicated the first two stripes of his ATM card (ignoring the third because either we didn't know what character set it was encoded in, or else we didn't yet have access to a 3-stripe reader/writer, I forget which), and successfully used it in an ATM (just to do a balance inquiry - not to actually withdraw cash - we were too afraid of setting off some kind of alarm). We'd suspected that would work beforehand, since the first two stripes were in ABA (American Bankers' Association) 7-bit (or was it 5-bit? - it's been three years, and I've slept since then) and the third stripe wasn't, so therefore probably not used for banking applications. We were satisfied enough when it succeeded to not experiment further.

But, with that in mind, it's immediately clear that you could earn back the initial hardware investment in a big hurry if you were of a black-hat kind of mind-set.

One of the more interesting/cute little facts when you're working with mag-stripe cards is that, to determine where some failures lie, you can use a spray-can of very fine iron or iron-oxide dust (basically, rust) to spray on the stripe and actually SEE the encoded magnetic patterns. If the patterns are sharp, then it's the reader's fault; if the patterns aren't there, then it's the card's fault.

Here's another project for someone with a bit more in-depth hardware knowledge than I have: figure out what encoding scheme is on the thin little cards used at some arcades where you buy credit on a proprietary card - I tried reading one of those in a 3-stripe reader and got unreadable, in consistent and totally unuseful results.

Re:How long before DMCA is used?

[Smidge204]

The difference is, I'm not the one hacking the system. Therefore the person who has hacked the system should be a bit more responsible in putting out the information.

In other words, not release it at all?

Let's ban chemistry books, then, because the informatioon in there can be used to develop lethal toxins and explosives. Those publishers shold be a bit more responsible in putting out the information.

Don't be an asshat. Information is information. He is not advokating it's use for illegal/immoral activities (quite the opposite, actually). If you choose to apply this knowledge to break the law, then you are responsible. Don't blame the publisher of the book if someone uses the information to build a bomb and don't blame the maintainer of the website if you use the information to commit fraud.
=Smidge=

Re:How long before DMCA is used?

[Telecommando]

Hmmm...
So do you suppose that all those "high security" cards the government buys are actually low/no security cards?

I feel safer already.

parking gates

[millahtime]

When I was in college they had bar code scanners for the parking gates. That was easy enough to duplicate. But, right when I was leaving they switched to mag stripes. Now it's easy for a new generation to figure them out and make working cards.

Not Difficult At All

[Anonymous Coward]

Hey all...

I have worked with developing Linux-based solutions with products from MagTek (manufacturer of hundreds of devices like stripe and card/check readers) and I have to point out that you may not find much information on the subject because the programming for such is so simplistic that a manual is not really needed. I am curious if other products from other providers work in a similar fashion.

MagTek devices will decode the stripes for you. The data contained within is sent to the computer in serialized format, so once the string of characters is received, you simply have to break the data into whatever pieces you need by looking for sentinal characters in ISO-defined positions. A dozen lines of code at most will handle this under most common programming languages.

When I was approached by my former employer to create a product with Linux and MagTek devices, (in mid-2000) I found absolutely no documentation on the devices whatsoever on the Net other than sales literature. The customer support personel did send me several pages of specs and such via FedEx Overnight, and when I received them, I saw that most of their then-current product line operated in a similar manner.

If possible, connect your reader device to some sort of I/O port and watch the data that is sent to the port with a terminal program (serial I/O in this case, similar methods used for parallel and USB-style interfaces...) Perform enough tests, and you should be able to get a more than adequate idea on how to parse the data sent.

In case you are really curious, go look at the older (now defunct?) Serial I/O HowTo at linux.org (or one of the mirrors). There are more than enough examples within to show you how to handle any type of serial-based interfacing project.

Hope this helps...

Brian

Re:Not Difficult At All

[wackysootroom]

Here's a fine guide on serial port programming from none other than the guys who brought us the cups printing system:
Serial Programming Guide for POSIX Operating Systems

Re:Not Difficult At All

[1shooter]

I work with this stuff all the time. Mag stripes typically have up to 3 tracks of information encoded. Usually all the data is in tracks one and two and of the many millions of cards the company has encode and shipped, none have used track three. The hardest part about decoding data is writing the regular expression to parse in to 3 lines. Now what you do with the data is whole nother thing.

So wait, how do i hack my metrocard?

[StingRayGun]

I't not like a federal offense or anything is it?

Re:So wait, how do i hack my metrocard?

[bellevueGeek]

Actually it is a federal offense since it would be considered counterfeiting, but what is even more interesting is the security that have in place to stop that.

Remember when it first came out and the cards were blue? Apparently a bunch of people figured out that you could dupe 50$ of value to used ones, and sell them to idiots on the platform. They would swipe it to show the dope there was a value and get cash for it.

I sat in on a security lecture once where the expert discussed the complexities of preventing unauthorized use in a system that big. Basically every time you swipe it writes back to your card and a log at that turnstyle. Every 5 minutes or so that log is uploaded to a regional center and that in turn is uploaded to a central location. They then can detect detect things like if a card is used in more than one location, or if more than once in n minutes. If one of these potentially illegal conditions exist the system can add your card to a blacklist and push it back out to the turnstyles all in under 11 minutes.

The cooler thing is that then when you use a modified card that was blacklisted the little color lights on the opposite side flash yellow or red instead of green. Alerting the police who like to stand and watch people try to jujmp or squeeze by to pick you up.

I thought it was a brilliant use of a relativly old and low-security technology.

epos

[che.kai-jei]

i was going post as AC but i dont want people not taking this seriously. i have had to research this technology deeply for legitimate and non legitimate applications for different clients. the reason there is little info or programs or source code -- as mentioned in an issue of 2600.

it is because that there is alot of poor win32 closed source software out there costing $1000 upwards!

all pooorly written in VB and the like by programmers whose pooor coding is more than obvious once a button is pressed or a menu selected.

ramcwin , rencode 2000 being obvious candidates.

it seems this is one of those few areas in software applications where even on the vast breadth of the internet a conspiracy of supression of knowledge . non open code. [not that the code is worth anything to learn from] in order to force the sale of ridiclous 1000 dollar licences for extremely poor code. my project i s free open source mag stripe oswftare compatible with as many reders and writesr as possible including portable code and libraries to embed in dumb terminals for people wanting to make thin open source terminal clients for EPOS systems.

i hate poor elite pricey specialised software.

for instance in a few months a large electronics chain has moved over to linux for their epos. i will make sure their "custom" software does not violate the gpl. [i just applied for a job !!]

Re:epos

[dasmegabyte]

Okay. Really quick: the reason niche software is expensive and yet poorly written is not because it is considered "elite." It is because there is not a lot of money in the niche. See, if you need to bring in $100k with a program, and you have an audience of 2000 people, you can easily charge $50 for it. But if your audience is only 100 people...you have to charge $1000. In a niche, you really have no way to increase the size of the market, and your market often has little choice but to pay the high cost for what's essentially one step down from custom software.

And if you're one of the 100 people, that software might save you hours and hours of work, tens of thousands of dollars on custom software, and maybe even save you having to hire somebody. All that for $1000 is a pretty sweet deal, and doesn't seem ridiculous at all. Granted, if you could get the same thing for $50, you'd take it. But on a business scale, $1000 is fucking chump change.

Furthermore, many niche software companies use the cheapest programmers and cheapest practices to get the job done. This means VB, which is a powerful tool when you want to make a program in less than an hour. Sloppy code is sometimes the fault of bad programmers (what do you expect, offering 35% or less than the going rate) but just as often is the fault of high pressure development. Customers paying $1000 for software are VERY insistant and many times their complaints will almost completely drive development. If Customer A asks for some feature unique to their business flow, you have to put it in, even if it doesn't make any damn sense. Our old software (which I had nothing to do with or it'd be all objects) is 20% functionality and 80% stupid business logic (if company = "company a" then ...).

Incidentally, with Linux gaining ground in a lot of these market niches, expect to see a lot of really shitty TCL or VB code showing up in closed source Linux packages. It's lack of money that creates stupid software...

Writing the stripe

[DrStrangeLug]

Some newer card printers will actually write the magstripe as they print the card. The problem is that they're not too informative as to how you get the magstripe data into the printer to encode.

Usually this is achieved by a setting within the printer driver which defines which stripe (of the three) to write to and how to get the data out of the printing data. The sequence is usually marked out with start and stop character sequences (on Javelin printers these are usually "${n" and "}$" for start and stop, where n is the track number.)

This saves people the trouble of printing the cards and then writing them seperately.

Storage capacity

[Anonymous Coward]

Does anyone know how much data you can store on a typical strip?

Re:Storage capacity

[Orne]

Here's a summary, but to recap:

There are three tracks on the magstripe. Each track is .110-inch wide. The ISO/IEC standard 7811, which is used by banks, specifies:

Track one is 210 bits per inch (bpi), and holds 79 six-bit plus parity bit read-only characters.

Track two is 75 bpi, and holds 40 four-bit plus parity bit characters.

Track three is 210 bpi, and holds 107 four-bit plus parity bit characters.

Do it the good ole way

[Rosco P. Coltrane]

When I was at school, in the physics lab, we had a jar of very fine iron powder that was used to demonstrate ferromagnetic liquids properties. We used to pour a little on the backside of a credit card, lightly shake the credit card to spread it around, and we could see the patterns left by the magnetic record on the stripes (which, incidently, weren't located where the visible black stripes were).

I imagine you could do the same with any magnetic card and a little fine iron sawdust that you could make yourself with a grinder.

Re:Do it the good ole way

[xsbellx]

Buddy, when I started working we used to do this on a daily basis to get data off of damaged magenetic tapes for input to a billing system. There was a product called "Visimag" or something similar. Essentially, it was the same sutff as you used in your physics lab, iron powder suspension in some type of alcohol.

For those who are old enough to remember such things, the tapes were 100bpi/7 track used on a Univac III. And this was the upgrade from 4 inch wide punched paper tape.

Re:hotels

[rampant poodle]

Normally none. The card will have a unique number, (usually room nr.), and some instructions telling the lock the validity periiod of the guest key. If you just checked in it will also invalidate all previous guest keys. In some cases the card will also have additional information about your entitlements such as health club, meal plans, etc. Note that the ID number on the card is very likely linked to the hotel's property management system -- which has all of the information you gave when you made your reservation.

Re:hotels

[GuyFawkes]

Speaking today at the holiday inn chain of motels in the room cards definitely record the time and date the card is used, eg every time you use it to enter your room, and every wrong room you try it in.

HTH etc

(PS, this hotel chain still relies on PC's running windows 95b for all the booking / reservation / billing stuff.)

HOKY SHIT! THERE'S LIKE NO MAGSTRIPE INFORMATION!

[Chess_the_cat]

I was shocked by the lack of magstripe information.

Maybe you were mildly suprised?

MSR

[Alioth]

Having worked on retail apps, working with magstripes is a pretty trivial thing. Most magstripe readers are either RS-232 or keyboard wedge, and it's quite easy to tell where you have to look for the data you're interested in by just looking at what comes up when you swipe the kind of card you are interested in.

The biggest problem was dealing with keyboard wedge scanners - if your app expects some kind of event, or possibly a dedicated communication channel (like a serial port) you have to muck around with keyboard hooks to make it work.

Better interface?

[no_such_user]

This project would open up to many more people if a more simplistic way of interfacing to the card reader was introduced. How 'bout via the soundcard?

I was poking around the links provided on the site, and found this: The simplest magnetic stripe reader. He wrote software to analyze the audio generated by the card when passed over the read head. This means that any old cassette player has a chance at being used to hack magstripes! Any comments on how accurate this method is, versus the F2F decoder chips?

What is REALLY on your card?

[commonchaos]

I just got the idea of setting up a computer running Strip Snoop in a public place. Put a single board computer inside, a cheap LDC and card reader outside.

It should be made to look offical and be housed in an hard-to-destroy case. It would be bolted down on the sidewalk in the middle of the night, near an ATM or in a shopping center.

Have a big sign that says "what is REALLY on your magnetic cards?".

If you are an art student you could pull off doing something like that and get credit for doing instalation art. :-)

Re:What is REALLY on your card?

[zempf]

This was done by an art museum in Pittsburgh: see this article at Wired for details.

"Researching an embedded systems project..." ?

[El Kevbo]

While researching for an embedded systems project (a magstripe enabled Coke machine)

In other words you wanted to get a Coke the other day and didn't have any spare change, right? :)

Blocked!

[W2k]

Couldn't access the site through the computer at work, it was blocked by the Internet filter, something about "Criminal skills". Only application that seemed to have anything to do with the Internet in the taskbar was a Symantec anti-virus/internet shield app. Now why is it a "criminal skill" to know about magcard readers?

Re:hotels

[4of12]

PS, this hotel chain still relies on PC's running windows 95b for all the booking / reservation / billing stuff.

An important and practical lesson that what is good enough to get the job done gets used and used and used. No matter that it smells bad to those of us on the bleeding edge of technology.