December 14, 2005
Dissecting the SmarTrip
Let's face it: most of the technology in the D.C. area is pretty boring. Okay, so the Raytheons and Lockheed Martins of the world get to play with their killer satellites, gigantic robotic spiders and assorted deadly curiousities. But aside from the de rigeur Blackberry, average Washingtonians haven't got many D.C.-specific gadgets for us to obsess over. With one exception: WMATA's SmarTrip card. Ever wonder how it works — or better yet, how to disassemble it and turn it into a keychain-ready size? If so, read on...
The SmartTrip card is composed of three sheets of laminated cardboard (or plastic; it's tough to tell). The middle one is where the important guts are located. The outer two serve a decorative and protective function. The first order of business is to remove those outer layers. But before you do, resign yourself to destroying the card. You might be able to transplant its brain into a new body, but DCist doesn't want any angry emails demanding money for replacement cards. You've been warned.
In order to plunge heedlessly onward you'll need to find some acetone — aka nail polish remover. Another word of caution: despite its over-the-counter status, acetone is not particularly good for you. It's very flammable, a skin irritant, and pretty bad for your kidneys. In addition to being an inhalation hazard it can be absorbed through the skin. So wear gloves, work in a well-ventilated space, and use common sense.
It's also worth noting that acetone can dissolve many types of plastic — that's why we're using it. But that also means that you should avoid using tupperware for this. So find a glass or ceramic bowl and fill it with about half an inch of acetone. If you have an x-acto knife handy, you might want to score the back of the card (not diagonally) in order to help the acetone penetrate, but it's not strictly necessary to do so. Plop the card in the bowl, cover with aluminum foil (to cut down on fumes) and wait for about 15 minutes. When that time is up, remove and dry it (use tweezers or gloves, please). You should find the outer laminate stretchy and pliable. Scrape off the layer of laminate from the back of the card — a butterknife should suffice, although this DCist irresponsibly used his fingernails. You'll end up with something like this:
Place the card back in the acetone and go to bed. It needs to soak for a bit. In the morning you should be able to remove it, dry it, and peel off the back layer of paper. If you're careful, you might be able to destroy less of the antenna than we did. Here's what the separated layers will look like:
At last, SmarTrip's mysteries revealed! Let's get down to it: the card is an RFID chip. You might have heard of RFID — Walmart is using the technology to revolutionize its inventory practices; others are concerned about its privacy implications. The chips work thanks to the photoelectric effect induction: when radio waves hit metal they produce an electrical current. Most radio devices amplify, read and respond to this signal using their own power sources. With RFID chips, the incoming signal is the power source. The chip uses it to transmit another, much weaker signal back to the RFID reader. The result is a sort of barcode that can be read from any direction within a range measured in inches or feet (depending on the specific RFID technology being used).
But the SmarTrip isn't just an RFID tag. It's also a Smart Card: an electronic identification card that performs calculations on its own. In SmarTrip's case, this means keeping track of the balance on your card — that's how the card can work on MetroBus. Because the balance is stored on the chip, there's no need for a network connection to a central database.
All of the action takes place on that little chip in the upper left (or upper right, when the card is viewed from the front). The chip should lift out easily. Here's a closer view, both from the front and back:
As mentioned, the rest of the card acts as an antenna — the card needs a pretty big one in order to gather enough charge for its return transmission. We estimated the antenna's length at around 40 inches. Say, forty inches of wire sounds like something we might have lying around the house...
A little soldering later, we ended up with this (slightly blurry) monstrosity. To be honest, it wasn't much smaller than the original card. But it still worked like a champ — its range might have even been better than the original card's.
Our subsequent experiments have been slightly less successful. We mounted the chip on a 40" loop of magnet wire, applied some heat-shrink tubing, and stuck the conveniently small loop that resulted on our keychain. It looked great. The only problem: it didn't work on about half of the SmarTrip machines we tested. More loops and a bigger gauge of magnet wire are on our to-do list. We'll let you know when we've got a winning recipe.
But for now, we're hoping that some like-minded geeks take up the gauntlet (let us know how it goes!). As for the rest of you: how about some inspiration? We know that the original card isn't that big, but it never hurts to remove an unnecessary card from your wallet. And we've seen too many ladies digging through their purses outside the Metro turnstiles for us to think that SmarTrip technology has reached its ideal form. What clothing or accessories would you like to see with integrated SmarTrip functionality? Let us know in comments.
|
Nice! I'm gonna go Mcguyver on my SmarTrip tonight :)
best post on DCIST ever
best post on DCIST ever
I agree Pinaki. This is why I read DCist. Thank you, Tom, excellent investigative reporting.
Why not a SmarTrip bracelet/cuff? With a bit of work, one could make something rather like your photo that is also aesthetically pleasing.
Turning it into a ring or embedding in a watch band would be cool.
We need more geek efforts on dcist.com. Actually, in the DC area. I wish there was a DC group for this kind of stuff (stuff like the makezine.com ).
It would be really handy to have a SmarTrip implant in my wrist, or in my finger. It would also be fun, and much less invasive, to integrate the Smart Card into a watch. Would a metal watch band make an acceptable antenna?
this post rocks!
Big next winter: Smart trip mittens.
I'd like to know how to incorporate the RFID into a set of brass knuckles so I can use the same device to ride metro and bludgeon the morons who stare at the smartrip machines like the monolith from 2001.
A lot of Japanese Cell phones now have imbedded smart currency capability.
Great post. It would be cool to have the SmartTrip rfid chip on the back of a cell phone.
On top of all the other things that I miss about SF, it's the out and open tech geek culture (and all those places to find recycled technology of yesterday -- vacuum tubes anyone? coming up.) With all the engineers around these parts, you gotta wonder where they get their basement-tinkering on. DCist should lead the way!
You know the best thing about this? It'll let me resurrect the broken (and unregistered) smartrip card i've been too lazy to take out of my wallet. Now I can get the value off my card!
In order to have an efficient antenna for any radio application, including RFID, it must be *resonant* at the frequency of interest. The electromagnetic field from the SmartTrip reader will induce a current in any loop of wire, but the currents will be much larger if the antenna is resonant. A rough explanation is that the EM field of a certain frequency needs to get the electrons in the wire to slosh back and forth at that frequency. The electrons in a resonant antenna *want* to slosh at that frequency. In a nonresonant antenna, you can still push them around, but it's harder to do.
It looks like the antenna in the card is a multi-layer loop, probably computer-designed to be self-resonant, but you could get the same effect by making an appropriate loop of wire and connecting a small capacitor of the proper value across the loop ends (where the chip attaches)
In order to figure out what the proper capacitor is, you need to know the frequency of operation of the SmartTrip system... might be 2.4GHz, but if someone knows, post it here.
It's a cool hack; I'd be happy to lend some of my 10 years of ham radio experience to this...
In order to have an efficient antenna for any radio application, including RFID, it must be *resonant* at the frequency of interest. The electromagnetic field from the SmartTrip reader will induce a current in any loop of wire, but the currents will be much larger if the antenna is resonant. A rough explanation is that the EM field of a certain frequency needs to get the electrons in the wire to slosh back and forth at that frequency. The electrons in a resonant antenna *want* to slosh at that frequency. In a nonresonant antenna, you can still push them around, but it's harder to do.
It looks like the antenna in the card is a multi-layer loop, probably computer-designed to be self-resonant, but you could get the same effect by making an appropriate loop of wire and connecting a small capacitor of the proper value across the loop ends (where the chip attaches)
In order to figure out what the proper capacitor is, you need to know the frequency of operation of the SmartTrip system... might be 2.4GHz, but if someone knows, post it here.
It's a cool hack; I'd be happy to lend some of my 10 years of ham radio experience to this...
Yeah, great post. How bout a smart trip head band, so we can headbutt the stupid machines.
Last year when it got cold, I started putting my Smartrip Card in my hand and then put my glove over both. That way, I didn't have to take off my gloves to search for my card before bording the bus; I could just wave my hand over the sensor. It would be awesome to use this to temporarily sew the chip into my glove, or another clothing article in the summer. I was quite worried about those ideas of implanting them into one's skin, but since we all carry them around everywhere anyway, that pretty much wouldn't change the RFID privacy concerns. I'd imagine it wouldn't be to pratical to install all that wire under your skin as well...
Thanks for all the great feedback, folks.
And let me respond to Dan in particular: I knew there were antenna design issues I was ignoring, but that's a pretty complicated area to get into. If you can lend a hand, though, I'd love to come up with a simple circuit that'd improve the operation of this hack. And I believe you're right: most professional RFID systems work in the 2.4 ghz range. There are kilohertz tags available, too, but I doubt this is one of them. If you've got a circuit tuned to 2.4ghz that I could try, please let me know.
And Malachai: actually, some members of the Mexican defense cabinet have RFID installed in their arms for secure access to a military facility. And one or two super-hip bars in europe have started offering their regulars the option to track and pay their tabs via implanted RFID that's tied to their credit cards. Finally, pets are frequently implanted with grain-of-rice-sized RFIDs nowadays, in order to make it easier to find their owners when they get lost.
Great post! I wonder how WMATA feels about this? I remember when FlexCar first came into the area, Metro said they could not guarantee FlexCar alterations would not affect SmartCard effectiveness. I would think disassembling the entire card itself would be a similiar situation.
Tom,
If they're 2.4GHz, you might try 4 7/8 inches of wire (one full wavelength) formed into various shapes. Try a circle or square first.
This ends up being about an inch and a half diameter circle... maybe a bit large, but you can try squishing it in various ways (making it a really long narrow rectangle or oval isn't advised though.)
If it's not 2.4 GHz this will be an absolutely miserable antenna, because from the point of view of frequencies considerably lower than 2.4GHz it will be a dead short circuit.
don't mean to be a party pooper, but if we're talking about putting this chip in clothing, wouldn't it just be easier to maintain the current structural integrity of the card and sew the whole card into a hat or something?
Malachai:
When you waived your hand, did you say "These are not the droids you're looking for."
That'd be awesome.
Dan Z.: I'd presume that SmartTrip operates on a 2.4GHz band because:
Personally, I'm happy to just slap my wallet against the reader, generally, I can walk through without breaking stride.
SmarTrip RFID tags are having the best week ever!
Finally, DCist, something worth reading. Something I couldn't read somewhere else. Awesome post--keep more like this coming!
I understand a lot of people are bothered by the fact that many posts on DCist are from other sites, but I just wanted to let DCist know that at least someone, namely me, likes that.
I honestly don't feel like trolling through 5 newspaper and tv websites,etc. I'd rather DCist highlight the more interesting items.
I also like posts like this even more. But I just hope that DCist won't forgo indexing news items available elsewhere.
Am I the only person who keeps their SmarTrip in one of those plastic badge holders clipped to a beltloop or around my neck? I keep my drivers license in there too. I've misplaced my wallet many times, but never my badge holder. I love the plastic badge holder. Hail plastic badge holder.
There should be a DC group for this kind of stuff. Make mag rules!! I'd join...
There should be a DC group for this kind of stuff. Make mag rules!! I'd join...
Yes, a DCist geek group is definitely in order. Good to see so many hackers are out there, or at least think this kind of stuff is cool.
Also, EZPass/Smart-Tags use RFID, in case you've ever wondered why you never need to change batteries in them.
At the next DCist / Blogger MeetUp everyone can share their SmarTrip hacks, and maybe DCist can bestow the honor of the "Smartest Trip" to the DCist reader who has made the best hack...just an idea...
Hmmm, if I could just place the RFID tag in my RAZR cell phone I could wave that over it. There might be room in my batter compartment of it...hack away.
To Alexandra: "hail plastic badge holder"? You sound cute. E-mail me and maybe we can rent Flash Gordon (1980) and watch it together?
dc_latina_300@yahoo.com
Hahahaha, oh man.
dc_latina_300 I'm bored...what plaything can you offer me today?
You realize that the SmartCard is just like badge readers at work. They are proximity cards. That's all. You can do the same thing with your work badge which you wave at a sensor. The trick is figuring more about the smart chip. Sure, WMATA could always tell that someone is going specifically from one stop to another. With a SmartCard, if you registered it with your name, they know where you specifically are going. I'm really interested in finding out what other functions besides arithmetic with some memory the smart chip is doing. That would be neat. Too bad I am not an electrical engineer, but a computer science major in college.
So, do the police have access to Metro SmarTrip data, like if they wanted to verify where you were or weren't on any given day, could they subpoena your SmarTrip records? How long does WMATA keep that data?
Sorry, I'll get back to my tinfoil hat...
If you haven't registered your SmarTrip card, being tailed by the federalies is probably not going to be an issue. My boyfriend refuses to register his (and subsequently is also afraid to have than $50 at a time on it) for this exact reason.
You know, I've not done this with a smart card, but I think it would work...
In my old office, you used to have to press a card against a reader to open the door. The thing was sensitive enough that you could just hold your wallet next to it -- you didn't need to have the card actually out.
Well, the next step was obvious. I stuck my wallet in my back pocket, and would just stick my butt up to the reader, and... it worked! That of course led to the next step -- convincing all my friends who visited that office security was all based on "ass prints." Like fingerprints, but even more unique.
They would look at me like I was crazy, but as soon as I stuck my butt up to the reader, and the door opened... well, they were shocked. I don't believe anyone ever caught on.
Think this would work with a smart card? Are they sensitive enough? I would like to see this analyzed please.
I tried the same thing on Metro (using my butt to open the faregate) and I got yelled at by Metro po-po :(
I push my butt up to the reader all the time. Works fine, and I don't know why the Metro po-po would care. They haven't bothered me. Were you wearing pants? And it always works through my wallet too.
Depending on how long your legs are, SmarTrip-in-the-pocket works great to open the handicapped faregates (where the sensor is on the inside of the gate, rather than the top), and the requisite little shimmy to wave the correct pocket against the sensor prompts all sorts of entertaining stares/questions from tourists.
(The RFID-in-the-pocket thing is old hat, though. About a decade ago, the condo I lived in downtown (the Metropolitan) used RFID cards restrict access to the lobby, and about 90% of the residents would keep their cards in their pockets; the condo also piped the closed-circuit TV of the entrance to all of the units so that you could see who was calling up, so a common pasttime during parties was to just leave the TV on that channel and entertain ourselves watching our neighbors' unique variations on the "front door butt dance", as we called it. Some of the dancers would really get into it, with elaborate routines that were clearly meant to entertain whoever might be watching.)
Not registering your SmarTrip won't inconvenience the authorities trying to track your movements. All they have to do is figure out the unique ID of your SmarTrip, which presumably they can do by brushing you surreptitiously with a SmarTrip reader.
Hehe, thats why you line your wallet in lead silly! Didn't you hear about the mastercard fiasco?
When my wallet got stolen in New York, the police were able to track the robber's movement on the subways because he used my Visa to buy a metrocard. Turns out Visa records the id number of any metrocard purchased with their cards and the MTA can track the use of any metrocard as long as they have that id number.
I'd assume credit card companies do the same thing for the D.C. system-- only solution for the paranoid would be to use cash. But I'm sure they do that already.
Awesome, jawsome post.
Uhhh, the "photo-electric effect" is something completely different (electrons being knocked loose from the conduction band of a metal by high-energy photons; RF doesn't qualify for this).
Rather, the phenomenon you are referring to is called "induction".
Thanks for the catch, Leo. It's been a while since AP physics. I've corrected the post.
balance is stored on card?
anyone thinkin what I'm thinkin?
smartcard readers are only $10 you know....
Smartcard readers may be, but 2.4 ghz RFID dev kits are generally thousands of dollars. Also, you can bet that the balance would be encrypted.
With that said, it does seem like the system might be susceptible to replay attacks. But presumably they've thought of that and mitigated it somehow.
I would say it is probable that the balance is encrypted. However, even if these cards are easily susceptible to repl