The Dirty Laundry of Stored Value Washing Cards
Details reverse engineering stored-value contactless laundry cards, uncovering data structure vulnerabilities that allow arbitrary balance modification.
Summary
The Ubiquity of Stored-Value Contactless Cards
Commercial laundry facilities and municipal services worldwide rely on offline stored-value contactless smartcards to process payments without real-time backend network connectivity.
Reverse Engineering RFID Memory Layouts
Aidan Nakache and Equip analyze the internal memory structures, sector keys, and cryptographic checksum algorithms of popular commercial laundry smartcards.
Discovering Balance Modification Flaws
Analyzing memory dumps before and after transactions revealed predictable counter fields and flawed integrity verification, allowing arbitrary balance manipulation.
Global Implications for Offline Payment Systems
The vulnerabilities identified in laundry cards reflect systemic architectural weaknesses across legacy offline stored-value and transit payment systems globally.
Related talks
Main Stage·43 min
Christopher Wade
Christopher Wade reverse engineers closed proprietary NFC controllers in modern smartphones, patching microcontroller firmware to expand RF capabilities.
Main Stage·43 min
Yaniv Balmas · Lior Oppenheim
Yaniv Balmas and Lior Oppenheim demonstrate reverse engineering KVM switch firmware, subverting the 8051 microcontroller to install an undetectable, persistent hardware keylogger.
Car Hacking Village·26 min
collin · oblivion
Reverse engineers a commercial odometer rollback tool, extracting locked STM32 firmware and showing how CAN messages are intercepted and rewritten.