Hacking Mifare BIP

You might also like

Download as pdf or txt
Download as pdf or txt
You are on page 1of 8

BIP / TranSantiago

jorge705 #1 November 17, 2022, 4:10pm

Would like to request support for BIP cards, those are commonly used as travel cards in Santiago - Chile.

There currently are android apps that fetch the content of such cards (reference: Zaldo - Consulta Bip! NFC )

Dump:
Bip840.nfc (4.0 KB)

Keys:

0263DE1278F3
A3F97428DD01
067DB45454A9
F124C2578AD0
937A4FFF3011
C4652C54261C
68D30288910A
B736412614AF
51284C3686A6
D49E2826664F
3A42F33AF429
32AC3B90AC13
2A3C347A1200
643FB6DE2217
4AD1E273EAF1
6338A371C0ED
6A470D54127C
63F17A449AF0
693143F10368
3DF14C8000A1
1FC235AC1309
64E3C10394C2
F59A36A2546D
15FC4C7613FE

Filetype: Flipper NFC device


Version: 2
# Nfc device type can be UID, Mifare Ultralight, Mifare Classic, Bank card
Device type: Mifare Classic
# UID, ATQA and SAK are common for all formats
UID: 86 59 B6 F1
ATQA: 04 00
SAK: 08
# Mifare Classic specific data
Mifare Classic type: 1K
Data format version: 2
# Mifare Classic blocks, '??' means unknown data
Block 0: 86 59 B6 F1 98 88 04 00 C9 03 00 20 00 00 00 22 - UID *
Block 1: 00 00 00 00 D6 CB 4F 06 00 00 00 00 00 00 00 51 - ID BIP!
Block 2: F5 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Block 3: 3A 42 F3 3A F4 29 78 77 88 00 1F C2 35 AC 13 09
Block 4: F5 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Block 5: F5 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Block 6: F5 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Block 7: 63 38 A3 71 C0 ED FF 07 80 00 24 3F 16 09 18 D1
Block 8: F5 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Block 9: F5 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Analysis (in Spanish):


Analisis-de-seguridad-de-la-Tarjeta-Bip!.pdf (1.8 MB)

Content of the card include:

ID
Balance
Ride details
Top ups and transactions
Bug on FlipperZero: Can’t emulate bip!, When I try to do it from any application it throws an error
Spildit #2 November 19, 2022, 4:09pm

You can save the original card with a payment on it, then use the card and then restore the original state with the
function to write to initial card but if you do so be aware that you can go to jail by using the transport system with
edited cards to avoid paying. DON’T DO THIS. Also what you are requesting is a “parser” that will allow you in
an easy way to change the travels/money on the card so don’t expect for this sort of thing to be implemented. Ever.

jorge705 #3 November 20, 2022, 2:42am

no, the only thing I would like to do is that when emulating with Flipperzero it is detected in the android
application :(, I may have made the post on wrong subforum, sorry for my bad english

Spildit #4 November 20, 2022, 3:36pm

Ok !!! No problem !
1 Like

Ragnar_Lodbrok #5 March 27, 2023, 7:52pm

Hola bro, has avanzado en esto ?

1 Like

byzard #6 May 17, 2023, 4:06pm

Existe alguna novedad?

Community For developers

Kickstarter Documentation
Habr.com GitHub
Discord Design Guide
Forum
Blog

Distributors About

Lab401 Contacts
Joom Compliance
How to buy Company
Become a Partner Abuse Report
Privacy Policy

Copyright © 2023 Flipper Devices Inc.

You might also like