The smartcards used to pay for public transportation in the Netherlands may now be hacked with an Android phone, according to a report from NOS.nl. The crack requires two free apps that allow the cracker to load the card with money and travel without paying anything.
NOS carries little detail on the nature of the hack, but Dutch hackers appear to have a somewhat long and storied history of cracking Netherlands’ smartcard, the OV-Chipkaart. The chip inside the card has been modified repeatedly by the card creator, Trans Link, but there is no shortage of tutorials on how to hack them, and there are plenty of stories about hacks that have taken place. There are also less technical Android apps to circumvent paying for transport, like OV Hacker, which plays the tone a Chipkaart would make when successfully scanned in order to trick bus drivers.
A research article from 2009 laid out how the RFID chip inside the card can be read with an NFC reader, decrypted with one application, and then reloaded with the desired amount by another application. The chip has been modified since then, but there’s at least one thread on the xda-developers forums where a user notes that his Android smartphone was able to read out the (encrypted) contents of his OV-Chipkaart with the NFC reader inside his phone.
Read 4 remaining paragraphs | Comments