MOBIB Avenger forensics

2012: a talk given at the rump session of RFIDSec2012 (http://rfidsec.2012.rump.cr.yp.to/) investigating two videos uploaded on Youtube in 2011 that were claiming some hack of the MOBIB system. The first video was deleted by the author and the second one is still visible here:
https://www.youtube.com/watch?v=P-YQ6wT0Y48
and a mix of both videos (as presented during the rump session) is available for download here: https://mega.nz/#!vVNTmJ5Q!otRDcl5AuJb4Irum6P8ipNaQJbNmFV9AqL5zbUKk9sE

Transcript

1. MOBIB Avenger forensics
2. Plot • June 2011: anonymous video on Youtube MOBIBAvenger claims to have broken MOBIB and promise free ride to everybody, as revenge against the (real) privacy concerns of MOBIB card • Lame answer from STIB “all systems can be hacked, that's life”
3. Goal of this forensics game REAL or FAKE? Bonus question: Who is MOBIBAvenger?
4. A few facts on MOBIB • Calypso standard • Smartcard ISO14443-4B with file structure • (obviously nothing to do with MIFARE Classic) • Privacy nightmare... ask Gildas
6. Forensics time Did you find incoherences?
7. The easy ones :-)
8. What's this Open MOBIB software?
9. Well actually...
10. It's MOBIBextractor by UCL
11. MIFOC <> MFOC
12. Actually his “sw” credits a few ones
13. C:\mfoc> OpenMobib.py OpenMOBIB 0.5 Using MFOC (from LIBNFC project) Mobib Extractor (from UCL) MifareClassicWriter (from This app is for proof­only purpose Put your MOBIB smartcard in the...
14. C:\mfoc> OpenMobib.py OpenMOBIB 0.5 Using MFOC (from LIBNFC project) Mobib Extractor (from UCL) MifareClassicWriter (from This app is for proof­only purpose Put your MOBIB smartcard in the...
15. Oh BTW... which RFID reader?
16. Microsoft Wireless Receiver (for keyboard / mouse)
17. Who's MOBIB Avenger?
18. For sure he's shy
19. From his card number?
20. Actually that's even not his card But the card of one of Gildas' colleagues Captured from TV news reportage (remember it was about privacy concerns)
21. Let's look closer to the mem dump
22. Let's look closer to the mem dump
23. Let's look closer to the mem dump => MICHAEL ...?
24. His name was hidden... But not the raw memory dump Holder1: 040098...? Holder2: ACF8C32...
25. MOBIB coding: 8 to 5 bits Holder2: ACF8C3271694230? ACF8C3291694280? AC F8 C3 27 16 94 28 0 29 23 10101100 11111000 11000011 00100111 00010110 10010100 00101000 00101001 00100011 01100 11111 00011 00001 10010 01110 00101 10100 10100 00101 0 10010 00100 01100 L _ C A R N/R E T T E/DL => Michael Carnette/Carrette?
26. Let's ask our big friend brother michael + carrette + mobib
28. Hello Mr Carrette
30. Actually he contacted Gildas in the past to get info on the system Je ne cherche pas a pirater le système, mais bien en faire un sujet de travail de fin d'année. Merci, Michaël CARRETTE
31. Conclusions? • Many incoherences: – MIFOC ≠ MFOC – Calypso ≠ MIFARE – RFID reader ≠ wireless keyboard station – Roel's video misuse – Gildas' video misuse • Chance for him that STIB didn't go to the police... as his identity could be revealed
32. But remember • MOBIB extractor is real (ok, hard to find...) • It shows unprotected personal data • This video only brings confusion between debunked allegations and real privacy problems
33. Last minute update STIB announced this Monday that anonymous cards are now available Still remains (probably) the last 3 rides issue