You. Are. Awesome. !

We have RFID stuff here with nothing stored on the card itself...

:)
Most of the people from Paris have that sort of RFID cards too, with only an ID. But they still kept half of the equipment from the 70's (8080 powered !) for regular paper tickets, which are dead simple to reload...

Umh.. I guess that's not legal, is it? X3

I guess not :( Will probably use it 5 times and feel bad about it.

I guess thats a smart thing to do. Openly submitting and admitting you are stealing not only from the 'subway' but from everyone that uses it.

Bragging about (maybe) stealing $4 from the company over these next 10 years ! Fuck the police !

It's a know fact that all the checking hardware, and people checking, selling the tickets, and the printing of said tickets, cost more money than the ticket price, or the RFID cards too.
In other words, the RATP would lose less money if the Parisian subways, busses and tramways were free. (note : as you can guess, it's a public company, not a private one).
This may not apply to the sub-Parisian transportation network which is mixed with the national railway grid and depending of the SNCF.

Was this a kit or did you assemble and code everything yourself?

It's almost all homemade, except for the mag head which was offered by a repair guy from the subway company itself.

So this isn't just like a music tape player magnetic head?

Old heads for large tapes should work, but all I ever got until now are 3mm stereo ones, which aren't wide enough.

about 2 years ago we made an RFID reader/writer/spoofer using an LPC1768 and only a few fets and passives and one quad opamp ... it worked very well and we were able to use it to crack many security keys for all RFID ranges from 100khz to 15mhz

funny enough we got in trouble (deep trouble) for using it on the metro as a brute force example ... luckily it was for university research so the school paid all the fines!

BUT it put a stop to our research in sploofing magnetic strips BUT we were able to get our rig to work that took mag data from a dirt cheap cell phone magnetic stripe reader ($2.50) and sploof it out to a simple strip of metal with some wire coiled around it with a simple cheap CLPD

just keep in mind that in MOST places its a SERIOUS crime to get caught stealing public transportation using an exploit ... when we used it on a metro we used tags that we had LEGAL ownership of and payed for the trip and still got slapped with a $100,000 fine
we know its illegal in the US, canada, europe, france, germany, spain and south africa for a fact but thats all the research we did at the time (not that much)

I'm just dropping by to say, you are awesome !

$100k is crazy. I did way worse than using a piece of paper over here and never got to pay that much... And I'm speaking of the same sort of thing, no burglary or burning cars...

its a failed method of trying to contain such exploits ... same goes for breaking in to cars using keyfob sploofing and cellphone auth exploitation ... you slap a huge fine on anyone trying to do research in to the subject and hope the criminals dont do there own studying

it never works ... but it alllll started not too long ago at defcon 14 with this kinkos attack http://www.youtube.com/watch?v=NCCap1Rqv9s that after someone made a PCB card and started selling them put kinkos out of millions ... it soon spread to other price-on-card devices and anything private they sue and anything public they ban to try and cover it up but like i said it never works its still happening today

we made an exploit as a (failed) bid for a defcon talk that uses a TI Chronos wristwatch that uses a CC430F6137 processor thats MSP430 based with a built in 1ghz transceiver running at 433 MHz we were able to both monitor and playback car lock and unlock commands and brute force (some of) themall on this $50 watch ... these exploits are too easy to do and using tools and materials that are increasingly easy to get your hands on ... there needs to be newer standardizations and an "ok you got us we will fix it" approach to hackers not a "oh you figured us out? we will remove it from the internet and sue the shit out of you!"

but if you need any info on our sploofing of magnetic card readers let me know ... in theory you can generate a sound using simple software and upload it to an MP3 player then pass that directly thru the $1 spoofing method, but we were unable to test it practically

The tickets go through a (long) internal conveyor belt thing, so it's not possible to reach the read heads to play some audio file in front of it. The ticket lengths are also checked ;(

ah damn thats a pickle ... well if there is a will there is a way but with these cards you can get for $5 im not sure if there is much of a will XD

just be sure to keep an eye on the legal aspects (and watch how much you share with your name attached)

Ah ! Tu a enfin réussi à décoder cette mystérieuse trame :p
Je suivais ton projet quand ils ne te restait que quelques bits a comprendre sur de multiples trames.
En tout cas pas mal pas mal ! :3
Maintenant il ne te reste plus qu'a éviter les contrôles :D

What did you use as a head.

http://www.brushindustries.com/sear.....sp?prod=905362 :)

Ahh nifty :)

dayum, gotta show me how to make one

Merde c'est vrai que j'ai tout un stack de ticket a te filer encore :')