Slashdot Mirror
Smart-Card Hacking?
W3bbo asks: "With the ever-increasing information being stored on so-called 'Smart-Cards', including credit cards with the chips, how do we know what data is read by stores when you hand over your plastic? Seaching for 'smart-card hacking' just turns up satelite TV piracy websites and virtually nothing for (sort-of) legitimate investigation to our cards. So what methods are available to hack smart-card chips and see what information about us our banks store on our cards?"
Well, you can always read the mag-stripe with a audio tape player's read head. As for the chip, you could always try eBay for used reading hardware. ;x
so have a few searches on this termp
http://www.kallipse.com/creaweb/galaad/carding.ph
Also there is an open source project devoted to reading cards and chips, don't remember the name right now...
Was on slashdot, so have a check 8)
It takes 40+ muscles to frown, but only four to extend your arm and bitchslap the motherfucker
The best way to learn is to latch onto someone who really knows their stuff (which is what I did on a previous project.) If you don't have that luxury, start looking at vendor pages (Schlumberger, ActivCard, Siemens, Utimaco, Gemplus, etc.) and chipset manufacturers (Infineon, Sagem or Giesecke & Devrient for example.)
,a href="http://java.sun.com/products/javacard/refere nce/docs/">Java card docs from Sun, and the Open Card platform.
Depending on how far down you want to dig (do you want to learn about applications? Circuit design? Interfaces? Security issues?) you should probably browse around related manufacturers' pages and related newsgroups. A good example would be looking at PKCS#11-related docs, Entrust implementation docs, the Javacard specifications, how Javacards differ from other implementations, docs on "Open Platform", types of card readers (class 1 through class 4, what is "middleware", how hardware key storage works, etc.)
A lot of card-related documentation and information is strongly vendor-specific, poorly documented and, to be honest, largely irrelevant for someone who wants to learn about it in a not-too-hardcore manner.
If you're professionally seriously interested, I recommend talking to one of the serious pros, such as Jerome Ajdenbaum who really know their stuff. For starters, though, a quick google search on "smart card" +documentation turned up a number of good results, including from Microsoft (whose card interface for many manufacturers and variants is surprisingly well-written),
Cole's Law: Thinly sliced cabbage
That the story below this one is "Security Breach Exposes 40M Credit Cards" ?
"I realise this is not a very popular opinion but it's the truth, and there for needs to be said" -Bill Hicks
1:) finding out what personal data is stored on your card ,Some of us just can shake the urge to explore discover and create.
2:) hacker(traditional meaning) mentality
3:) setting up your own credit card reader to go into bussiness as a manufacturer
The only things certain in war are Propaganda and Death. You can never be sure which is which though
I think it's important to understand that there is no "sort-of" about it. We have every right to know what information is contained on the cards that we use. Why wouldn't we? What can there possibly be there that is none of our business?
"Who are in control, they are not in control of anything - they don't even control themselves!" - Glen Beck
Have you tried calling your card company?
Brett
These break down to a few different kinds:
Information leaking e.g. power analysis: observe the power consumption of a divide to determine what operations it is executing and what data it is working on. Usually these will only tell you the number of bits which are on in a particular stage. I found the ARM 6 gave a very clear signature of the result of the adder and could determine the number of on bits down to the nearest 2.
Error introduction e.g. clock glitch attack: This is an asynchronous engineers favorite. Basically a method of inserting errors into the processor in a deterministic method. Say the processor stage calculating a compare operation is the worst case path, the attack inserts an early clock forcing the comparison to be incorrectly made. Place this in the "are the checksums correct" code. Usually though these are a little more difficult than that.
Brute force with limited tries e.g. Flash charge pump: So to crack your card it only takes as many attempts as there are pin code combinations. To stop people from just trying out the 10,000 or so combinations the card remembers how many tries you had. Before it writes something to the flash it needs to drive up a charge pump. This is visible using power analysis and at this point you cut the power and try again.
More interestingly why are these not investigated? Well because there is no money for it. The async community has been offering better methods but the companies who make the only get a tiny profit are not inclined to make them any better.
Mouse powered Chips, Open source Processors and Lego
http://www.dachb0den.com/projects/scard/smartcards .ppt
can you help?
Circuit Cellar magazine has articles on smart cards, RFID, etc, now and then.
One line blog. I hear that they're called Twitters now.
Could you tell me where I can get an $50 HP oscilliscope?
Information from the MUSCLE smartcard-on-Linux project be useful:
http://www.linuxnet.com/
My Web Page
There may be a potential DMCA violation involved with doing this, especially if credit card company-issued smart cards contain proprietary copyrighted information on them. In any case, the threat of a lawsuit (whether it's valid or not) may be enough to silence any efforts to figure out what sorts of personally identifiable info is stored on these cards.
Please pardon the cowardly post but I thought it might be helpful to mention a site that is compiling information on just such a topic. http://www.smartcardscanada.com/> is just starting out but has links to National identity card sites, smart card manufacturers, smartcard software sites and chipcard discussion and programming sites.
There was an article in the last phrack issue that dealt with precisely this, with specs on making a data sniffer for smartcards and what tools to use in the process. www.phrack.org, find it from there (the title was stylish with the word "cards" in the title, I can't give you a link as I'm at work).
twitter.com/gravitronic
www.cardcoders org for more information on that spec =)