NFC card with credit copy-able to phone? - NFC Hacking

As title suggests
Would it be possible? Or would it depends on the secruity/encryption of the original tag?
Here in Hong Kong there is a thing called an "octopus card" which contains credit that can be recharged from convenience stores, tube stations etc. Would it be possible to copy/transfer the data from that card to my phone so I can just use my phone?

droid_does said:
As title suggests
Would it be possible? Or would it depends on the secruity/encryption of the original tag?
Here in Hong Kong there is a thing called an "octopus card" which contains credit that can be recharged from convenience stores, tube stations etc. Would it be possible to copy/transfer the data from that card to my phone so I can just use my phone?
Click to expand...
Click to collapse
No, these cards are specifically designed with security to prevent such a thing.
The closest thing is if the provider of the card puts hooks into their financial to permit using NFC card emulation with their services, such as how Citi partnered with Google to allow PayPass accounts to be used with Google Wallet.

Every time you use your credit card, it reads/generates/writes a new code, so its never the same.
Sent from my Rogers SGH-I727R using my XDA Premium app

Try "八達通餘額閱讀器", search that on Google Play, that app should able to read the balance of your card.
AFAIK, octopus card has some kind of security lock and you are unable to modify the data inside, but you can read some of the data(like balance, card serial no., etc).

Related

[Q] Galaxy Nexus and SIM Toolkit?

Will Galaxy Nexus come with SIM Toolkit? On Galaxy S it was a huge problem that even Gingerbread update did not have SIM Toolkit. This however is a must-have application when using certain pre-paid cards, bank authentications or identification.
Does anyone know if it has it?
So no one knows? Don't people use SIM cards with added functionality?
SIM Toolkit is just another way of the carrier pushing pointless services my way e.g. horoscopes, weather etc all at a cost and not as good as apps you can get in the market. This is my experience in the UK anyway, perhaps its different elsewhere.
In The Netherlands Sim toolkit is obsolete. The services it was used for, are now offered by Google and others. Sim toolkit uses a lot of (internet)data however and that is one of the reasons why many SGS-owners rooted their device, so they could use Titanium Backup to get rid of the Sim toolkit.
chandlerweb said:
SIM Toolkit is just another way of the carrier pushing pointless services my way e.g. horoscopes, weather etc all at a cost and not as good as apps you can get in the market. This is my experience in the UK anyway, perhaps its different elsewhere.
Click to expand...
Click to collapse
Perhaps I should enlighten what SIM Toolkit is used for in certain parts of Europe, especially Finland and Estonia. In Finland your pre-paid cards have SIM Toolkit related services, such as checking for balance and data usage without additional costs.
But in Estonia SIM cards can be used effectively as an identification device. That is, your mobile phone can double as your identification that is usable country-wide. You can authorize bank transfers, even do all bank-related activities right through your phone without having to fiddle with websites. It can be used to sign digital documents and authorize yourself for e-voting (Estonia was the first country in the world to effectively introduce internet-based voting for local government). All this uses a special SIM-card for that exact purpose.
SIM Toolkit is very important for those reasons. Just because some carriers blatantly misuse it does not mean it isn't important.
kristovaher said:
Perhaps I should enlighten what SIM Toolkit is used for in certain parts of Europe, especially Finland and Estonia. In Finland your pre-paid cards have SIM Toolkit related services, such as checking for balance and data usage without additional costs.
But in Estonia SIM cards can be used effectively as an identification device. That is, your mobile phone can double as your identification that is usable country-wide. You can authorize bank transfers, even do all bank-related activities right through your phone without having to fiddle with websites. It can be used to sign digital documents and authorize yourself for e-voting (Estonia was the first country in the world to effectively introduce internet-based voting for local government). All this uses a special SIM-card for that exact purpose.
SIM Toolkit is very important for those reasons. Just because some carriers blatantly misuse it does not mean it isn't important.
Click to expand...
Click to collapse
I'd rather get rid of the SIM completely, unfortunately it only seems Apple is interested in it at the moment, in their own patent pending insanely closed method, and even that is just a hack.
Don't really see the SIM as an important component in the features you're talking about, and especially something like checking your datausage could easily be done using web API's, like Three has done here in Denmark.
It doesn't even have to cost data, though i'm not sure whether or not it does, they simply have to allow traffic to and from that server freely.
Sure I would love a SIM-free future, but I would also love ID card and password-free future and so on. In fact, I would love username-password free future.
But reality today is that SIM Toolkit is useful part of infrastructure in many countries, there were a lot of complaints about it being missing from Nexus S, as many use SIM Toolkit for bank services.
This is why I'm wondering if Galaxy Nexus still has SIM Toolkit. I simply would be unable to use these services otherwise. It's 2011, I should not have to use a desktop computer or mobile browser to do bank transfers and so on.
no there will not and there will never be a sim toolkit on a nexus device.
i actually dont know any country's that do use a simtoolkit.
cheking your data usage?
App
bank services.?
App
App
App
App.
no need for a sim toolkit.
and seeing as NFC might be the future.
there even is more reason why sim toolkit is useless.
its indeed 2011.
we shouldn't even be using a sim toolkit.
its a technology thats been laid to rest in allot of country's.
Of course bank services through an app. But app alone is not secure enough. Our bank services run through Android app, but authenticate as an extra layer of security through SIM toolkit so that even if your data is stolen, they cannot access your bank, unless they also clone your SIM.
kristovaher said:
Of course bank services through an app. But app alone is not secure enough. Our bank services run through Android app, but authenticate as an extra layer of security through SIM toolkit so that even if your data is stolen, they cannot access your bank, unless they also clone your SIM.
Click to expand...
Click to collapse
The SIM just stores your private key. The same effect can be achieved if the phone itself stores your private key. It makes no difference whether it's the SIM or the phone that's used to store the private key, as long as the private key is used in the key exchange to derive a shared key to encrypt the communications between your device and the bank, the same effect is achieved.
kristovaher said:
Of course bank services through an app. But app alone is not secure enough. Our bank services run through Android app, but authenticate as an extra layer of security through SIM toolkit so that even if your data is stolen, they cannot access your bank, unless they also clone your SIM.
Click to expand...
Click to collapse
i dont know about your bank,but i have to certify my card and pin trug some sort of special card reader.and than note that code onto my phone.and make a pin code to access my bank account.
there is no way anywhere in that process that anyone can steal that data. unless i give the pin away.
ghost010 said:
i dont know about your bank,but i have to certify my card and pin trug some sort of special card reader.and than note that code onto my phone.and make a pin code to access my bank account.
there is no way anywhere in that process that anyone can steal that data. unless i give the pin away.
Click to expand...
Click to collapse
Well, in Estonia we have implemented country wide ID Cards. That is, something what UK tried and failed to implement, it works here and is a great success. Our ID cards double as passports and in fact we do not need to carry passports when traveling within EU.
These same ID cards are part of a wider infrastructure. We can sign documents with these ID cards digitally (just as valid as a written signature, for example). These ID cards carry chips that are specially encrypted for that purpose and carry public and private keys for communicating with various online services. Other than digital document signatures (for any kind of document), we also use our ID card to vote on the internet without having to go to voting offices or log into various government services and view/edit private data related to our citizen status.
We can also use these ID cards to log-in to all banks in Estonia. It is more secure than private password codes that are on a separate sheet of paper and is more convenient to the end user. When authenticating it always asks for a separate PIN code, just like with any other card of that type. These ID card chips are nearly impossible to clone, just like SIM cards.
As a result there's an option for Estonians to also make their SIM card in their phone double as identification device. Our bank applications require this on phones, when logging in it sends encrypted information to the phone that can only be unencrypted with information from the SIM card. If successful, it allows you to log in and do bank transfers. This is far more secure than any regular password-sheet methods. It works through your network and has methods to protect from middle-man attacks as well.
However, that relies on SIM Toolkit and would not be possible without it. Also note that regular SIM cards cannot be upgraded to work like that. Government issues new type of SIM cards for that purpose.
kristovaher said:
Well, in Estonia we have implemented country wide ID Cards. That is, something what UK tried and failed to implement, it works here and is a great success. Our ID cards double as passports and in fact we do not need to carry passports when traveling within EU.
These same ID cards are part of a wider infrastructure. We can sign documents with these ID cards digitally (just as valid as a written signature, for example). These ID cards carry chips that are specially encrypted for that purpose and carry public and private keys for communicating with various online services. Other than digital document signatures (for any kind of document), we also use our ID card to vote on the internet without having to go to voting offices or log into various government services and view/edit private data related to our citizen status.
We can also use these ID cards to log-in to all banks in Estonia. It is more secure than private password codes that are on a separate sheet of paper and is more convenient to the end user. When authenticating it always asks for a separate PIN code, just like with any other card of that type. These ID card chips are nearly impossible to clone, just like SIM cards.
As a result there's an option for Estonians to also make their SIM card in their phone double as identification device. Our bank applications require this on phones, when logging in it sends encrypted information to the phone that can only be unencrypted with information from the SIM card. If successful, it allows you to log in and do bank transfers. This is far more secure than any regular password-sheet methods. It works through your network and has methods to protect from middle-man attacks as well.
However, that relies on SIM Toolkit and would not be possible without it. Also note that regular SIM cards cannot be upgraded to work like that. Government issues new type of SIM cards for that purpose.
Click to expand...
Click to collapse
I know what you mean. At least one bank over here implemented login using something called BankID on SIM which required new sim cards and SIM Toolkit. It used service SMS in the background though and was recently deprecated for a BankID app that starts up in the background and handles the encrypting and decrypting personally issued certs.
I agree that SIM Toolkit should be included regardless because it's very small and doesn't show up at all in the app drawer unless your SIM includes something that needs it. The layout and icon is very outdated though but you usually never have to interact directly with it like that. The messages it pops up look fine.
blunden said:
I know what you mean. At least one bank over here implemented login using something called BankID on SIM which required new sim cards and SIM Toolkit. It used service SMS in the background though and was recently deprecated for a BankID app that starts up in the background and handles the encrypting and decrypting personally issued certs.
I agree that SIM Toolkit should be included regardless because it's very small and doesn't show up at all in the app drawer unless your SIM includes something that needs it. The layout and icon is very outdated though but you usually never have to interact directly with it like that. The messages it pops up look fine.
Click to expand...
Click to collapse
Yeah, exactly.
My main point is that it's used in many countries and is especially relevant here in Estonia. Just because some mobile service companies misuse it is no grounds for removing it. It's like removing e-mail notifications just because you're unable to use spam lists.
I just wonder if Galaxy Nexus has it or not.
Take a look at *THIS* thread. I dont know if its of any value as I havent read through the thread but it seems to be something on how to put it on your phone and I very much doubt the Galaxy Nedxus will come with it preinstalled.
Mark.
we also have ID cards here. with an NFC chip(i can scan my ID card to my phone)
but we dont use that system. only for criminal identifying.
though there might be the solution.
instead of sim toolkit.
youd have to scan your ID card to log in(NFC)
and seeing as you do need your ID card everywhere(by law)
According to this it does have it, but that phone seems to have some other abnormalities from the thread here http://91.151.218.11/showthread.php?t=18331065&page=51
Picture:
https://lh3.googleusercontent.com/-...AAAAAAcI/WEg1ScqOFLo/s800/20111117_103746.jpg
kristovaher said:
According to this it does have it, but that phone seems to have some other abnormalities from the thread here http://91.151.218.11/showthread.php?t=18331065&page=51
Picture:
https://lh3.googleusercontent.com/-...AAAAAAcI/WEg1ScqOFLo/s800/20111117_103746.jpg
Click to expand...
Click to collapse
Seems to be a dev-build. Those usually include it.
Alright, Galaxy Nexus DOES have SIM Toolkit, I have the phone and it is listed under all Apps, but not in app drawer. Some of its functionality also seems to be working.
But does anyone know how to make it visible in app drawer? Not sure I need it for all things, but still.
Anyways, glad it is there!
I have a UK sim-free Galaxy Nexus and the SIM Tool Kit does appear in the app drawer for me with a Telstra SIM. It works from what I can see but I never really use it and all it provides is a mobile news service (pocket news from BigPond)
From my experience with my S2 also, the app only shows in the drawer when a SIM card is in the phone that actually has something to be used with the Tool Kit. When I used another SIM card once it didn't show up.

[Q] Copy tag to phone

Hi
Here at the university we use a NFC card to check in. Is it possible to copy the tag to my phone so I don't have to carry my student card around?
Depends
Sent from my LS670 using XDA
Shark_On_Land said:
Depends
Sent from my LS670 using XDA
Click to expand...
Click to collapse
Wow, helpful much?
I'd like to know this too.
thx
arjun rajput
+1
I like to know this to.
(Here at the university we use a NFC card to check in. Is it possible to copy the tag to my phone so I don't have to carry my student card around?)
Hi Samuel
I believe this is not possible right now, as there are security measures in place to prevent fraudulent use, but give it a couple of months there will be apps you can download , to copy re-writeable NFC tags to your phone, making your phone work as an emulator of some sort.
virus007 said:
(Here at the university we use a NFC card to check in. Is it possible to copy the tag to my phone so I don't have to carry my student card around?)
Hi Samuel
I believe this is not possible right now, as there are security measures in place to prevent fraudulent use, but give it a couple of months there will be apps you can download , to copy re-writeable NFC tags to your phone, making your phone work as an emulator of some sort.
Click to expand...
Click to collapse
To emulate cards with your NFC phone, you have to have full control of the secure element. In the Nexus phones, access to the secure element is restricted to Google - only they have the codes to access it. In non-Nexus phones like the SGS2, they don't even have built-in secure elements and therefore have to rely on SIMs, which are in turn controlled by operators. Without access to the secure element, you won't be able to emulate another card. So, no, even in a few months you won't be able to copy a tag and emulate it from your phone. Unless Google opens up the secure element to, which is unlikely.
To OP: Even if you could actually copy the contents of the card and then emulate it, this might not be enough. Many schools use just the UID of the card to associate it with your account on their system. This means that there's a good chance that your card actually has no data on it. Furthermore, phones aren't currently able to emulate UIDs. You're out of luck.
LoveNFC said:
To emulate cards with your NFC phone, you have to have full control of the secure element. In the Nexus phones, access to the secure element is restricted to Google - only they have the codes to access it. In non-Nexus phones like the SGS2, they don't even have built-in secure elements and therefore have to rely on SIMs, which are in turn controlled by operators. Without access to the secure element, you won't be able to emulate another card. So, no, even in a few months you won't be able to copy a tag and emulate it from your phone. Unless Google opens up the secure element to, which is unlikely.
To OP: Even if you could actually copy the contents of the card and then emulate it, this might not be enough. Many schools use just the UID of the card to associate it with your account on their system. This means that there's a good chance that your card actually has no data on it. Furthermore, phones aren't currently able to emulate UIDs. You're out of luck.
Click to expand...
Click to collapse
Clearly, a direction NFC will follow. There's no way users will allow something like that to remain as neutered as it currently is. It just (seemingly) has not worked that way in the past.
thanks
thanks

[Q] Google Wallet Top Up In The UK

Has anyone managed to top up Google Wallet in the UK or anywhere outside of the USA? I've used my free $10 and it worked like a charm in McDonalds and it would be great if we could figure out a way to get it topped up without having to have a friend in the USA etc...
There's a method listed here:
http://www.modaco.com/topic/354635-region-device-root-patched-google-wallet-apk-11-r67-v4/
EddyOS said:
There's a method listed here:
http://www.modaco.com/topic/354635-region-device-root-patched-google-wallet-apk-11-r67-v4/
Click to expand...
Click to collapse
Thanks for the reply however I cannot see any info in that forum with regards to topping up outside of the USA. Could you point me in the direction of which page it is?
Thanks again.
From that link...
"Topping Up
So you've installed the APK and spent your initial $10 at Greggs or maybe Mcdonalds. Healthy. Now you need to top up... there's a problem!
Google Wallet only allows you to load the prepaid card using a US card, which most of us accessing Wallet this way don't have! The card that you use needs to support AVS (address verification) with a US address, something that also excludes a number of US cards. I'm hoping that we as a community can collaborate to work out the best way to do this, but i've tried a few methods and i've chronicled them below. I'll update this post as more methods / information surfaces. I'm hoping we can find a low cost disposable Visa solution or similar that makes the process easy. Getting a US address is easy enough to associate with a card, just sign up (free) for US Unlocked.
BFPS- Virtual credit card in various denominations, configurable AVS address, use coupon 'modaco' for 5% discount - WORKING
EntroPay - Virtual credit card, turns out to be Malta registered and doesn't support AVS - FAILED
US Unlocked card - Virtual credit card, currently untested - UNKNOWN"
I found that extremely expensive. A virtual-card of US$50 for US$69 ? they are charging like 20% for the service alone.
This is so far what I've done.
-Went to Borderlinx to get an U.S. based address (borderlinx.com)
-I received an email with such address
-Went to EntroPay (entropay.com) to get a Virtual debit card using my UK details.
-Then after the card was set up and topped, I went to Google Wallet directly (wallet.google.com) and added the card using the Borderlinx address details.
-I tested the card in play.google.com, buying a game (where's my perry) and even though my account is UK based, I decided to make the EntroPay card my default and it charged me in US$ ($0.99 instead of £0.69). Checked in Wallet and the transaction was successful.
Next thing to do:
-Try to pay using Google Wallet in my Galaxy S3 in any Paypass vendor (Greggs, McDonalds, you name it). Since the card was accepted in Google Play, I guess it will be OK when I try to pay using the card in Greggs.
Keep in mind I'm using the latest version, the one that allows to use any card and pulls the cards you have used in Google Play.
Fingers crossed!
Seeing as they now accept Visa Debit and Mastercard it should be easier now

[Q] NFC uses in transit cards

I recently downloaded an app called FareBot.
It basically reads the amount of money left and the trips taken in my transit card. It uses the NFC capabilities to read them.
Is there a way to make my phone act as my transit card? Can the transit card be cloned and added to the phone's NFC capabilities?
ahse0w said:
I recently downloaded an app called FareBot.
It basically reads the amount of money left and the trips taken in my transit card. It uses the NFC capabilities to read them.
Is there a way to make my phone act as my transit card? Can the transit card be cloned and added to the phone's NFC capabilities?
Click to expand...
Click to collapse
Funny, I was looking today on my way into work on how to do the same thing...
No.
To emulate a card, you need access to the Secure Element of your NFC chip.
It's called Secure Element for a reason, Google ain't going to let any Tom, **** and Harry have access to the Secure Element.

if a nfc/rfid card is disactivated?

lets say a nfc/rfid card for a job or apt is disactivated. Is there a way you can reprogram the card in anyway for it to be able to gain access again to those places?
bump
q-live said:
lets say a nfc/rfid card for a job or apt is disactivated. Is there a way you can reprogram the card in anyway for it to be able to gain access again to those places?
Click to expand...
Click to collapse
Afaik, there is no 'activation' or 'deactivation' on nfc.
Afaik, again, the readers interpret what the card has written on it. Let's take opening a door. On the card you have an unique ID, the reader goes through a list of authorized IDs, and if yours is in there, it opens the door.
Via an NFC reader app you should be able to replicate any card you like, and I also think reprogramming is possible. If your ID is not allowed to cross a gate anymore, you would have to scan a tag which can and emulate it. This goes without saying, don't do anything illegal.
Also, there could (should) be some more layers of protection, like encryption of the data on the tag, which could prevent advanced editing.
Of course, these are my two cents, I may be ridiculously wrong.
Sent from my XT1068 using XDA Free mobile app
Wow

Categories

Resources