DCist: Dissecting the SmarTrip

Sesrun

Mon, 03 Nov 2008 12:46:22 -0500

The WMATA Smartrip cards appear to be 13.56 MHz manufactured by Cubic Transportation Systems Inc. The entire patent paper (even mentioning WMATA) is available thanks to Google Patent Search. I'm more interesting in actual manipulation and understanding of the information on the card though the 13.56mhz RFID readers look a bit too pricey. Happy hacking!

girlwithglasses

Thu, 14 Dec 2006 08:52:32 -0500

Thrilled to find this post. I contacted Metro a while back and asked them to tell me where the chip was located on the card (don't have the same geek chops as some of y'all), so that I could trim the card down to a more convenient sliver that I would then be able to fit onto my keychain. They were not amused and gave me no information (surprise, surprise).

Xoring

Fri, 07 Apr 2006 02:18:44 -0500

I would say it is probable that the balance is encrypted. However, even if these cards are easily susceptible to replay or other hacks, it's still a relative ease. I'm sure Metro isn't too worried about the 20-50 individuals in the DC area who have the equipment and expertise to pull off the attack and happen to ride Metro to work. If anyone actually goes to the trouble of hacking a SmarTrip card so they can save $3 a day on metro fare they deserve the free ride (possibly to jail because I don't think it would be difficult to track a suspicious card).

DCist Tom

Tue, 03 Jan 2006 23:16:04 -0500

Smartcard readers may be, but 2.4 ghz RFID dev kits are generally thousands of dollars. Also, you can bet that the balance would be encrypted. With that said, it does seem like the system might be susceptible to replay attacks. But presumably they've thought of that and mitigated it somehow.

n3ldan

Tue, 03 Jan 2006 22:47:15 -0500

balance is stored on card? anyone thinkin what I'm thinkin? smartcard readers are only $10 you know....

Dcist Tom

Tue, 03 Jan 2006 20:51:58 -0500

Thanks for the catch, Leo. It's been a while since AP physics. I've corrected the post.

Leo

Tue, 03 Jan 2006 18:12:09 -0500

Uhhh, the "photo-electric effect" is something completely different (electrons being knocked loose from the conduction band of a metal by high-energy photons; RF doesn't qualify for this). Rather, the phenomenon you are referring to is called "induction".

b

Sat, 17 Dec 2005 10:16:48 -0500

When my wallet got stolen in New York, the police were able to track the robber's movement on the subways because he used my Visa to buy a metrocard. Turns out Visa records the id number of any metrocard purchased with their cards and the MTA can track the use of any metrocard as long as they have that id number. I'd assume credit card companies do the same thing for the D.C. system-- only solution for the paranoid would be to use cash. But I'm sure they do that already. Awesome, jawsome post.

DUCK

Sat, 17 Dec 2005 01:10:05 -0500

Hehe, thats why you line your wallet in lead silly! Didn't you hear about the mastercard fiasco?

Am Turnip

Thu, 15 Dec 2005 19:45:13 -0500

Not registering your SmarTrip won't inconvenience the authorities trying to track your movements. All they have to do is figure out the unique ID of your SmarTrip, which presumably they can do by brushing you surreptitiously with a SmarTrip reader.

Sweth

Thu, 15 Dec 2005 10:56:30 -0500

Depending on how long your legs are, SmarTrip-in-the-pocket works great to open the handicapped faregates (where the sensor is on the inside of the gate, rather than the top), and the requisite little shimmy to wave the correct pocket against the sensor prompts all sorts of entertaining stares/questions from tourists. (The RFID-in-the-pocket thing is old hat, though. About a decade ago, the condo I lived in downtown (the Metropolitan) used RFID cards restrict access to the lobby, and about 90% of the residents would keep their cards in their pockets; the condo also piped the closed-circuit TV of the entrance to all of the units so that you could see who was calling up, so a common pasttime during parties was to just leave the TV on that channel and entertain ourselves watching our neighbors' unique variations on the "front door butt dance", as we called it. Some of the dancers would really get into it, with elaborate routines that were clearly meant to entertain whoever might be watching.)

Tom

Thu, 15 Dec 2005 09:49:56 -0500

I push my butt up to the reader all the time. Works fine, and I don't know why the Metro po-po would care. They haven't bothered me. Were you wearing pants? And it always works through my wallet too.

Ben

Thu, 15 Dec 2005 09:08:19 -0500

I tried the same thing on Metro (using my butt to open the faregate) and I got yelled at by Metro po-po :(

John Hlinko

Thu, 15 Dec 2005 08:38:16 -0500

You know, I've not done this with a smart card, but I think it would work... In my old office, you used to have to press a card against a reader to open the door. The thing was sensitive enough that you could just hold your wallet next to it -- you didn't need to have the card actually out. Well, the next step was obvious. I stuck my wallet in my back pocket, and would just stick my butt up to the reader, and... it worked! That of course led to the next step -- convincing all my friends who visited that office security was all based on "ass prints." Like fingerprints, but even more unique. They would look at me like I was crazy, but as soon as I stuck my butt up to the reader, and the door opened... well, they were shocked. I don't believe anyone ever caught on. Think this would work with a smart card? Are they sensitive enough? I would like to see this analyzed please.

Evzilla

Wed, 14 Dec 2005 23:50:01 -0500

If you haven't registered your SmarTrip card, being tailed by the federalies is probably not going to be an issue. My boyfriend refuses to register his (and subsequently is also afraid to have than $50 at a time on it) for this exact reason.

JohnS

Wed, 14 Dec 2005 23:41:56 -0500

So, do the police have access to Metro SmarTrip data, like if they wanted to verify where you were or weren't on any given day, could they subpoena your SmarTrip records? How long does WMATA keep that data? Sorry, I'll get back to my tinfoil hat...

Brian

Wed, 14 Dec 2005 22:31:53 -0500

You realize that the SmartCard is just like badge readers at work. They are proximity cards. That's all. You can do the same thing with your work badge which you wave at a sensor. The trick is figuring more about the smart chip. Sure, WMATA could always tell that someone is going specifically from one stop to another. With a SmartCard, if you registered it with your name, they know where you specifically are going. I'm really interested in finding out what other functions besides arithmetic with some memory the smart chip is doing. That would be neat. Too bad I am not an electrical engineer, but a computer science major in college.

Ming

Wed, 14 Dec 2005 20:10:03 -0500

dc_latina_300 I'm bored...what plaything can you offer me today?

Matt

Wed, 14 Dec 2005 19:18:58 -0500

Hahahaha, oh man.

Manuelito

Wed, 14 Dec 2005 19:02:38 -0500

To Alexandra: "hail plastic badge holder"? You sound cute. E-mail me and maybe we can rent Flash Gordon (1980) and watch it together? dc_latina_300@yahoo.com

Dental_FlossTycoon

Wed, 14 Dec 2005 17:16:56 -0500

Hmmm, if I could just place the RFID tag in my RAZR cell phone I could wave that over it. There might be room in my batter compartment of it...hack away.

Nikolas ® Schiller

Wed, 14 Dec 2005 17:02:51 -0500

At the next DCist / Blogger MeetUp everyone can share their SmarTrip hacks, and maybe DCist can bestow the honor of the "Smartest Trip" to the DCist reader who has made the best hack...just an idea...

Dan

Wed, 14 Dec 2005 16:55:22 -0500

Yes, a DCist geek group is definitely in order. Good to see so many hackers are out there, or at least think this kind of stuff is cool. Also, EZPass/Smart-Tags use RFID, in case you've ever wondered why you never need to change batteries in them.

Biff

Wed, 14 Dec 2005 16:34:01 -0500

There should be a DC group for this kind of stuff. Make mag rules!! I'd join...

Biff

Wed, 14 Dec 2005 16:26:31 -0500

There should be a DC group for this kind of stuff. Make mag rules!! I'd join...

alexandra

Wed, 14 Dec 2005 16:08:20 -0500

Am I the only person who keeps their SmarTrip in one of those plastic badge holders clipped to a beltloop or around my neck? I keep my drivers license in there too. I've misplaced my wallet many times, but never my badge holder. I love the plastic badge holder. Hail plastic badge holder.

Obi Wan

Wed, 14 Dec 2005 15:17:25 -0500

I understand a lot of people are bothered by the fact that many posts on DCist are from other sites, but I just wanted to let DCist know that at least someone, namely me, likes that. I honestly don't feel like trolling through 5 newspaper and tv websites,etc. I'd rather DCist highlight the more interesting items. I also like posts like this even more. But I just hope that DCist won't forgo indexing news items available elsewhere.

Lgreen

Wed, 14 Dec 2005 14:59:37 -0500

Finally, DCist, something worth reading. Something I couldn't read somewhere else. Awesome post--keep more like this coming!

Bob

Wed, 14 Dec 2005 14:10:28 -0500

SmarTrip RFID tags are having the best week ever!

Dan S.

Wed, 14 Dec 2005 14:01:51 -0500

Dan Z.: I'd presume that SmartTrip operates on a 2.4GHz band because:The interior of the card says "2.4", andI have a strong feeling that WMATA would use COTS rather than developing their own, one-off system. Personally, I'm happy to just slap my wallet against the reader, generally, I can walk through without breaking stride.

Obi Wan

Wed, 14 Dec 2005 13:49:22 -0500

Malachai: When you waived your hand, did you say "These are not the droids you're looking for." That'd be awesome.

matt

Wed, 14 Dec 2005 13:47:31 -0500

don't mean to be a party pooper, but if we're talking about putting this chip in clothing, wouldn't it just be easier to maintain the current structural integrity of the card and sew the whole card into a hat or something?

Dan Zimmerman

Wed, 14 Dec 2005 13:42:25 -0500

Tom, If they're 2.4GHz, you might try 4 7/8 inches of wire (one full wavelength) formed into various shapes. Try a circle or square first. This ends up being about an inch and a half diameter circle... maybe a bit large, but you can try squishing it in various ways (making it a really long narrow rectangle or oval isn't advised though.) If it's not 2.4 GHz this will be an absolutely miserable antenna, because from the point of view of frequencies considerably lower than 2.4GHz it will be a dead short circuit.

lamaccountant

Wed, 14 Dec 2005 13:26:00 -0500

Great post! I wonder how WMATA feels about this? I remember when FlexCar first came into the area, Metro said they could not guarantee FlexCar alterations would not affect SmartCard effectiveness. I would think disassembling the entire card itself would be a similiar situation.

DCist Tom

Wed, 14 Dec 2005 12:59:54 -0500

Thanks for all the great feedback, folks. And let me respond to Dan in particular: I knew there were antenna design issues I was ignoring, but that's a pretty complicated area to get into. If you can lend a hand, though, I'd love to come up with a simple circuit that'd improve the operation of this hack. And I believe you're right: most professional RFID systems work in the 2.4 ghz range. There are kilohertz tags available, too, but I doubt this is one of them. If you've got a circuit tuned to 2.4ghz that I could try, please let me know. And Malachai: actually, some members of the Mexican defense cabinet have RFID installed in their arms for secure access to a military facility. And one or two super-hip bars in europe have started offering their regulars the option to track and pay their tabs via implanted RFID that's tied to their credit cards. Finally, pets are frequently implanted with grain-of-rice-sized RFIDs nowadays, in order to make it easier to find their owners when they get lost.

Malachai

Wed, 14 Dec 2005 12:42:03 -0500

Last year when it got cold, I started putting my Smartrip Card in my hand and then put my glove over both. That way, I didn't have to take off my gloves to search for my card before bording the bus; I could just wave my hand over the sensor. It would be awesome to use this to temporarily sew the chip into my glove, or another clothing article in the summer. I was quite worried about those ideas of implanting them into one's skin, but since we all carry them around everywhere anyway, that pretty much wouldn't change the RFID privacy concerns. I'd imagine it wouldn't be to pratical to install all that wire under your skin as well...

bman

Wed, 14 Dec 2005 12:40:22 -0500

Yeah, great post. How bout a smart trip head band, so we can headbutt the stupid machines.

Dan Zimmerman

Wed, 14 Dec 2005 12:37:13 -0500

In order to have an efficient antenna for any radio application, including RFID, it must be *resonant* at the frequency of interest. The electromagnetic field from the SmartTrip reader will induce a current in any loop of wire, but the currents will be much larger if the antenna is resonant. A rough explanation is that the EM field of a certain frequency needs to get the electrons in the wire to slosh back and forth at that frequency. The electrons in a resonant antenna *want* to slosh at that frequency. In a nonresonant antenna, you can still push them around, but it's harder to do. It looks like the antenna in the card is a multi-layer loop, probably computer-designed to be self-resonant, but you could get the same effect by making an appropriate loop of wire and connecting a small capacitor of the proper value across the loop ends (where the chip attaches) In order to figure out what the proper capacitor is, you need to know the frequency of operation of the SmartTrip system... might be 2.4GHz, but if someone knows, post it here. It's a cool hack; I'd be happy to lend some of my 10 years of ham radio experience to this...

Dan Zimmerman

Wed, 14 Dec 2005 12:36:47 -0500

BrodyV

Wed, 14 Dec 2005 12:19:32 -0500

You know the best thing about this? It'll let me resurrect the broken (and unregistered) smartrip card i've been too lazy to take out of my wallet. Now I can get the value off my card!

DC1974

Wed, 14 Dec 2005 12:17:30 -0500

On top of all the other things that I miss about SF, it's the out and open tech geek culture (and all those places to find recycled technology of yesterday -- vacuum tubes anyone? coming up.) With all the engineers around these parts, you gotta wonder where they get their basement-tinkering on. DCist should lead the way!

plj

Wed, 14 Dec 2005 12:08:15 -0500

Great post. It would be cool to have the SmartTrip rfid chip on the back of a cell phone.

Yoko ono

Wed, 14 Dec 2005 11:49:18 -0500

A lot of Japanese Cell phones now have imbedded smart currency capability.

dk

Wed, 14 Dec 2005 11:43:41 -0500

I'd like to know how to incorporate the RFID into a set of brass knuckles so I can use the same device to ride metro and bludgeon the morons who stare at the smartrip machines like the monolith from 2001.

my inner nerd comes out

Wed, 14 Dec 2005 11:27:40 -0500

Big next winter: Smart trip mittens.

cestmoi

Wed, 14 Dec 2005 11:17:15 -0500

this post rocks!

Kraplana Hrvatska

Wed, 14 Dec 2005 11:15:36 -0500

It would be really handy to have a SmarTrip implant in my wrist, or in my finger. It would also be fun, and much less invasive, to integrate the Smart Card into a watch. Would a metal watch band make an acceptable antenna?

M@

Wed, 14 Dec 2005 11:15:29 -0500

Turning it into a ring or embedding in a watch band would be cool. We need more geek efforts on dcist.com. Actually, in the DC area. I wish there was a DC group for this kind of stuff (stuff like the makezine.com ).

Meredith

Wed, 14 Dec 2005 11:10:54 -0500

Why not a SmarTrip bracelet/cuff? With a bit of work, one could make something rather like your photo that is also aesthetically pleasing.

Jeff

Wed, 14 Dec 2005 10:44:08 -0500

I agree Pinaki. This is why I read DCist. Thank you, Tom, excellent investigative reporting.

Pinaki

Wed, 14 Dec 2005 10:32:48 -0500

best post on DCIST ever

Pinaki

Wed, 14 Dec 2005 10:32:05 -0500

best post on DCIST ever

Nikolas ® Schiller

Wed, 14 Dec 2005 10:23:25 -0500

Nice! I'm gonna go Mcguyver on my SmarTrip tonight :)