The dirty laundry of stored value washing cards

The dirty laundry of stored value washing cards

Speakers: Aidan Nakache (Equip); Equip

Conference: RF Village

YouTube: https://www.youtube.com/watch?v=BNOmouHeAOw

Overview

In "The dirty laundry of stored value washing cards," speakers Alexander and Lou (Aidan Nakache) from Equip unveil critical vulnerabilities within Mifare Classic RFID-based stored-value laundry systems, predominantly those powered by Kiosoft. The talk, presented at RF Village, details their meticulous reverse engineering journey to uncover how these ubiquitous cards store monetary value, transaction identifiers, and other sensitive data, ultimately demonstrating how an attacker can manipulate card balances at will.

This presentation is a compelling case study in the often-overlooked security posture of low-to-medium security RFID systems that manage real-world value. It highlights that convenience frequently trumps robust security, leaving common infrastructure like university dorms, apartment buildings, and public laundromats susceptible to simple, yet effective, financial exploitation. The research not only exposes the underlying flaws but also delves into the economic realities that prevent system operators from addressing these long-standing vulnerabilities.

The work by Alexander and Lou serves as a stark reminder that even seemingly trivial systems, such as those for laundry, warrant thorough security scrutiny. Their findings provide actionable intelligence for security professionals and researchers, illustrating how a combination of open-source tools, reverse engineering techniques, and a deep understanding of RFID protocols can unravel complex, proprietary implementations and expose significant weaknesses.

Background

▶ Watch: Talk introduction: 'Dirty laundry of stored value washcards' (0:00)

The genesis of this research began after Defcon when Alexander encountered a stored-value laundry system in Miami using Mifare Classic RFID cards. Recognising the common security weaknesses associated with Mifare Classic technology, he posed the question: "Are these hackable? Can I put money on them?" This inquiry set in motion a collaborative investigation with Lou, leading to the detailed white paper "Hung Out to Dry" and this presentation.

Mifare Classic cards are widely adopted for various applications due to their low cost and ease of implementation. However, they are also notorious for their cryptographic weaknesses, which have been publicly known for over a decade. Designed for low-to-medium security applications like public transport tickets or access control, they store data in 16 sectors, each protected by two 48-bit keys and access bits. Despite these known vulnerabilities, many systems, including those by Kiosoft, continue to rely on them for stored value, assuming that the obscurity of their proprietary data structures or the perceived low value of the assets (laundry money) would deter sophisticated attacks.

The problem persists because the cost of upgrading existing infrastructure is astronomically high. Replacing card readers, encoders, and the cards themselves across thousands of locations (universities, apartment complexes, commercial laundromats) in North America would entail a massive financial undertaking that operators, including Kiosoft, are unwilling to bear. This economic reality creates a classic security dilemma: known vulnerabilities persist because the perceived risk and cost of inaction are lower than the cost of remediation. The speakers explicitly state that Kiosoft and affected entities are "willing to risk the amount of money that they are willing to lose because it costs too much money and they're like, 'Gh, it's been 20 years. We've had a good run.'"

Key Findings

▶ Watch: Vulnerable systems: Kiosoft and university laundry services (2:40)

The core findings of Alexander and Lou's research reveal a fundamental insecurity in Kiosoft's implementation of Mifare Classic cards for laundry systems. They successfully demonstrated the ability to manipulate card balances, effectively "topping up" a card with arbitrary amounts of money without legitimate payment.

The primary discoveries include:

• Simple Value Storage: The monetary balance is stored on the card in plain sight as a whole cent amount (e.g., $18.75 is stored as 1875) using little-endian byte order. This straightforward representation made it relatively easy to identify the value bytes within the card's memory dump.
• Multiple Value Representations: The card stores the current balance in mirrored blocks (Blocks 4 and 8) and an "immutable" value at last top-up in Block 2. This redundancy, rather than enhancing security, provides more targets for manipulation.
• Bypassing Transaction Identifiers: While a transaction identifier (or Transaction ID) exists in Block 2 and is checked by the card encoders to prevent inconsistent top-ups, the crucial finding is that washing machines do not validate this ID. This allows an attacker to manipulate the balance and use the card in a washing machine, even if the encoder would reject a subsequent top-up attempt.
• Function Mirrors: A key insight was the discovery of "function mirrors" – specific static bytes within the card (e.g., in Blocks 9, 7, and F8) that do not contribute to the card's functionality but reveal the exact mathematical operations and relationships applied to the dynamic value bytes. These mirrors essentially act as an "exploit guide" embedded within the card's own data.
• Linear Relationships and XOR Operations: The researchers uncovered a linear relationship between certain bytes, specifically the last value byte (the incremental meabyte) and the third middle byte. This relationship follows the equation y = -x + 255, which is equivalent to a bitwise negation (x XOR FF). Understanding this mathematical relationship was critical for correctly calculating and manipulating the various mirrored bytes required for a successful top-up.
• Local Card Cloning: While new cards cannot be generated from scratch (due to unique site keys and backend-registered card numbers), possessing just one legitimate card from a specific location allows an attacker to extract the necessary site keys and clone/manipulate cards for that location.

These findings collectively demonstrate that the security of these systems relies on obscurity and the assumption of low attack interest, rather than robust cryptographic or architectural defenses.

Technical Deep Dive

▶ Watch: Technical deep dive: MyFair Classic card structure (3:30)

The technical investigation began with analyzing a dump of a Mifare Classic card known to hold $18.75. The Mifare Classic architecture, consisting of 16 sectors each with four 16-byte blocks, was the canvas for this exploration. Block 0, the manufacturer block, contains immutable data like the UID, BCC, SAK, and ATQA, which can be cloned but not rewritten on the original card. The subsequent blocks hold the application-specific data.

The first breakthrough involved locating the card's balance. The team initially searched for decimalized representations like 1875 or 18 and 75. They quickly confirmed that the value was stored as a whole cent amount, 1875, and, more importantly, in little-endian byte order. This meant that 1875 (hex 0753) appeared in memory as 5307. This 5307 pattern was found in multiple locations, specifically in Block 2 (representing the value at last top up) and mirrored in Blocks 4 and 8 (representing the current mutable balance).

Key data elements identified on the card included:

• Sector Trailer: Each sector has a trailer block containing two 6-byte keys (Key A and Key B) and access bits that define read/write permissions for the sector's blocks. The default access conditions for writing were 078069, allowing standard write, transfer, and restore operations.
• Card Number: Printed on the back of the physical card, this number (e.g., 0129889) was stored in memory as a decimalized hexadecimal representation. This means the decimal digits themselves were converted to hex, not the entire number, making it visually obvious but requiring careful interpretation.
• Value at Last Top Up (Vault Byte): Located in Block 2, bytes 9 and 10. This value updates only when money is added to the card, not when it is spent. If a card had $45, and $5 was added, it would update to $50. If $25 was then spent, the 'vault byte' would remain $50 until the next top-up.
• Transaction Identifier (Transaction ID): Also in Block 2, this ID is critical for the encoders to verify the integrity of the card's memory during top-ups. If the balance doesn't align with the transaction ID, the encoder will reject the top-up and ban the card from further additions. Crucially, the washing machines themselves do not check this Transaction ID, which is a significant bypass vulnerability.
• Incremental Mirror Byte (Meabyte): This byte, located near the Transaction ID and mirrored in value blocks, increments every time money is added to the card. It serves as a counter for top-up events.
• Terminal Byte: The last byte of Block 2 (and Block 1) was observed to change on every read but appeared to have no functional purpose. Through collaboration with Buru Steve from the RFID hack community, it was confirmed to be an XOR of Block 2. This highlights that seemingly random data changes can often be simple checksums or obfuscations.
• Value Pad: This refers to the actual value bytes, stored in little-endian, with the last byte typically being the incremental meabyte.
• Middle Bytes: Initially mysterious, these bytes, mirrored in Blocks 4 and 8, were found to have a specific linear relationship with the value bytes.
• Under Value Bite: A single byte beneath the value pads on Block A (likely Block 0A or a specific offset) that acts as a counter for washing machine usage, incrementing with each load.
• Under Middle Bite: Another mirrored byte, an XOR of the value block above it, which the researchers found did not contribute to the card's use case and could be manipulated without consequence.

The breakthrough in manipulating the balance came from understanding the metabytes and their linear relationships. By observing the changes in the first byte of the value pad and the first byte of the middle bytes after a top-up, the team deduced a linear relationship. This led to the discovery of the equation y = -1 * x + 255, or more simply, y = x XOR FF. This bitwise negation was the key to correctly calculating and updating the middle bytes to match the desired new balance, preventing the encoder from detecting an inconsistency (should it be used for another top-up).

Perhaps the most elegant finding was the existence of function mirrors. These are static byte pairs (e.g., FF09 and 0F00, 09F6) found in various blocks (like 9, 7, and F8). These pairs, while not dynamic or contributing to the card's function, revealed the exact mathematical operations and relationships applied to the dynamic value bytes. As the speakers noted, "If you watch the relationship between them, they tell you exactly what you need to do to apply to the different bites in the further up blocks to completely gain control over the card." This effectively means the card's own data structure contains the blueprint for its exploitation.

Finally, the speakers addressed the creation of cards from "nothing." They clarified that site-specific site keys are tied to the location where cards are created and can only be retrieved from local washing machines using Mifare Classic attacks. Similarly, card numbers are generated by encoders and registered in the backend system upon purchase. Therefore, an attacker cannot simply generate a valid card out of thin air. However, the crucial caveat is that only one legitimate card from a location is needed to extract the site keys and subsequently clone or manipulate other cards for that specific site.

Demo / Proof of Concept

▶ Watch: Endianness and mirrored value storage in card memory (5:40)

The speakers demonstrated their ability to manipulate card balances through a video recorded in Miami, showcasing the first successful top-up. The proof of concept involved using a Proxmark device, a powerful RFID research tool, in conjunction with a custom Python script developed by Alexander. This script automates the complex calculations for the middle bytes, value bytes, and all other necessary fields to achieve a "perfect top up" with a desired amount.

Furthermore, Lou (Aidan Nakache) developed a Flipper Zero plugin. This plugin, built upon an existing CSC parser by Toron, enables the popular Flipper Zero multi-tool to read crucial card information such as the card ID, the current balance, the last value of top-up, and the top-up count. The demo video clearly shows a card that was legitimately topped up with $20, subsequently displaying a balance of $85 after manipulation, an amount not even possible to load through the official encoder. This tangible evidence underscores the effectiveness of their reverse engineering efforts and the practical feasibility of exploiting these systems. The ability to set an arbitrary value, such as $69.69, further illustrates the complete control gained over the card's balance.

Defensive Implications

▶ Watch: Understanding 'value at last top up' and transaction ID (8:00)

The defensive implications of this research are complex, primarily due to the deeply entrenched nature of the vulnerable Mifare Classic technology and the economic realities faced by system operators.

1. Fundamental Technology Weakness: The core issue is the reliance on Mifare Classic cards, which are known to be cryptographically weak. Any system using them for stored value without robust server-side validation is inherently vulnerable.
2. High Cost of Remediation: The most significant barrier to fixing this vulnerability is the prohibitive cost. Upgrading the hardware (card readers, encoders, and potentially the washing machines themselves) across thousands of university campuses, apartment buildings, and laundromats throughout North America would require an astronomical investment. As the speakers highlighted, operators like Kiosoft and their clients are likely to deem this cost too high, preferring to absorb potential losses rather than undertake a massive system overhaul.
3. Low Perceived Risk: Operators currently perceive the risk of exploitation as low. The "washing machine money" involved is not high-value, and the primary users (students, residents) are considered less likely to engage in widespread fraudulent activity or to even be aware of such vulnerabilities. This low-risk perception further disincentivizes investment in upgrades.
4. Lack of Server-Side Validation: The fact that washing machines do not validate the Transaction ID (which is only checked by encoders) indicates a lack of robust server-side or centralized validation for card usage. A truly secure system would verify card balances against a backend database for every transaction, rendering on-card manipulation ineffective.
5. Backward Compatibility Challenges: Any upgrade would need to consider backward compatibility with existing cards and machines, adding another layer of complexity and cost.

For defenders, the immediate actions are limited by these systemic issues. However, if an organization is willing to invest:

• Upgrade to More Secure RFID: Transitioning away from Mifare Classic to more secure RFID technologies (e.g., Mifare DESFire) is the long-term solution. This would require replacing all card readers, encoders, and issuing new cards.
• Implement Robust Online Validation: Integrate washing machines and encoders into an online system that performs real-time balance checks against a central database. This would shift the trust from the card itself to a secure backend.
• Enhanced Physical Security: While not a technical fix, increasing physical security around encoders (where legitimate cards are first created and value is added) could deter initial card acquisition for cloning.

In the near term, given the operators' stated reluctance to fix the issue, the vulnerability will likely persist. End-users in affected locations should be aware that their laundry cards are easily hackable, and there's little incentive for the system providers to implement a fix.

Key Takeaways

• Mifare Classic Insecurity: Laundry systems relying on Mifare Classic cards for stored value are fundamentally insecure due to well-known cryptographic weaknesses and poor implementation practices.
• Simple Value Manipulation: Monetary balances are stored on the card in a straightforward, little-endian format, making them susceptible to manipulation through simple byte modifications.
• Transaction ID Bypass: While encoders check a transaction identifier, washing machines do not, allowing manipulated cards to be used without detection by the point-of-use device.
• "Function Mirrors" as Exploit Guides: The discovery of static "function mirrors" within the card's data provides the exact mathematical relationships (e.g., XOR operations, linear equations) needed to correctly calculate and update other dynamic bytes, effectively making the card self-documenting for exploitation.
• Local Cloning Feasibility: Acquiring just one legitimate card from a specific location allows attackers to extract site-specific keys and clone/manipulate cards for that entire system.
• Economic Barriers to Fixes: Operators like Kiosoft are unlikely to address these vulnerabilities due to the prohibitive cost of upgrading hardware across a vast infrastructure and a low perceived risk associated with "washing machine money."

About the Speaker(s)

The talk was presented by Alexander and Lou (Aidan Nakache), both associated with Equip. Their dedication to this research is evident through their personal anecdotes, including staying up until 3:00 AM, hiding from security guards to test washing machines, and engaging in late-night voice calls across an 8-hour time difference.

Their work exemplifies collaborative research, as they openly acknowledged contributions from the RFID hacking community. They specifically thanked Buru Steve from the RFID hackers Discord for confirming their findings regarding the "terminal byte" and its XOR function, and Toron for developing the existing CSC parser that their Flipper Zero plugin built upon. They also credited "the champ" for confirming details about Coinomatic systems and expressed gratitude to the Pirates Club Discord for enduring their "insane ramblings." This highlights their roots in the community and their commitment to open knowledge sharing within the security research space.