Dear viewer, these subtitles were generated by a machine via the service YouTube and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/2683 Thanks!
[Music]
with that we come to the speaker I
welcome with me uh nikil and he will
talk about the Curious Case of Indian
metros I hope you give him a warm
welcome on our stage and enjoy his
talk thank you
everyone so uh the talk title is not
really curious case of Indian Metro it's
traveling for free in India uh we are
going to uh I'm I'm going to teach you
how to travel for free in each and every
Metro that exists in India uh no matter
where you are uh metros in India uh
first of all I think I should explain
what Metro is but before that about me I
am a backend engineer by job that fills
my uh stomach uh I also am very
interested in breaking and making
software and Hardware mostly the
Breaking part not the making part uh so
what are we going to learn today uh we
are going to go through uh simple like
NFC bits uh some Theory uh then uh in
India we are like the Metro System there
they quite love old technology so they
are using a card that was launched in I
think 2008 uh it's called Mi fire desire
ev1 Mi desire ev1 sorry uh and then
we'll go through the problems uh with
the pentesting side of it solution and
some real world example which is the
real
part but uh before that
um now comes the mro part uh so mro is
very Sim similar to uh yuban that you
have in Germany we call it Metro over
there and it's a combination of yuban
and isban I think yuban is like very
similar to uh what Indian metros are and
uh ticketing is very different
so every Metro station you have to take
a ticket uh from a particular station to
a particular station it's not a general
ticket like it's not a 2-hour ticket or
something there is a Time limitation but
the tickets are always from one station
to other station those are uh we call
them tokens and there is also a travel
card we will go will I will come to that
later on so there is also a recharge
process uh that will come uh when we
talk about the travel C but before that
what is NFC NFC I think uh it's pretty
easy to understand if you like compare
it to uh sttp um it's just a protocol
you send data from one device to other
device here uh it's like small distance
because most of the cards that we use
for example I don't really have an
example over here of if you think that
this is a metro card oh sorry this is a
NFC card then uh I think 5 cm if it's in
a 5 cm range of a reader NFC Reader then
it will power itself and uh like send
data the read the reader basically
Powers the
card uh this is what uh metro card looks
like this is a travel card for Delhi
Metro and this is a mi Desy ev1 card uh
it's basically some fancy shansi name
for just the NFC card um some features
of of meair Desy ev1 is uh it's uh it
has a 7 by uid which can be randomized
which is a security feature and guess
what Indian Metro is no security
features so they are always stable um
Hardware crypto there is a hardware
cryptography engine uh it's there for a
and a three disc and this some some two
more protocols I think you can read
about it online uh we are not interested
in that so a data uh stored in uh files
there are four types of files and uh
there are like 16 application in which
the files can exist every application
has its own key to unlock it so
encryption is not just for the whole
card it's for the it's application wise
and it's normally used for travel card
because one of the file type is just the
currency a purse mode uh it's acts like
a purse you can credit debit from it and
you can uh you can check uh the money
basically it's there for money um why is
p pesting hard uh first of all it's
short range uh the main problem is MIT
tming the data there is no way you can
really like man in the middle uh this
particular line over here I can't hook
up uh scope in real world because one of
the way that you can mitm data is if you
have like two one active uh NFC card and
it is communicating with a NFC Reader uh
you could in theory take a oscilloscope
coil the cable around connect it to
ground and then put it between for
example uh this is the card this is the
reader you can put the coil in between
and and you could in theory read
it I can't carry a oscilloscope to a
metro station where all the policemen
are they are going to ask me questions
so we need to find something cheap
something small something concise and
we'll go through it lack of testing
Hardware I come from India um it's very
expensive there you can't really get for
example proxmark uh it's the best
hardware that you could buy for NFC
penting uh it's 300 something EUR here
uh that is like um and you will have to
like buy two of them for the full attack
that we are going to talk about that is
€600 it is well enough for a family of
four to feed themselves for 6 months 600
so that is like very expensive for me I
need to find a cheaper solution and the
major part encryption encryption and
encryption there's just too much
encryption we'll go through
it before that uh now comes the part
where I explained to you how the
recharge process works how the topup
works so uh the topup is normally like
two step you uh can uh use your phone
use uh some online medium to recharge
your card but that is not the final
stage that is the first stage you have
initiated a recharge for your card you
have paid for it the recharge is not
done to complete the
recharge to complete the recharge
complete the recharge you'll have to
find this uh machine at the Metro
premise it's called a AVM you go to the
AVM you change the language to English
and then you put the card over there
it's basically NFC Reader a modified NFC
Reader you click on inquiry there is a
check for topup button where the finger
is uh you click on check for topup and
it will show you a pending recharge the
one you initiated for earlier and then
you have to click on valid and the
recharge should be complete now this is
the second stage this is the stage that
we are going to exploit by the
way so um now how to hack it normally
you have those excess based NFC card
like for your office Etc you have a card
you put on the lock and it unlocks right
you go
in they don't really have an encrypted
section so you could could just copy to
Infinity those cards and emulate your
like emulate it on your phone or emulate
on a flipper zero or something and you
could be you are making an NFC card by
by doing that here it doesn't really
work because the card is encrypted and
the card is made like so that even if
it's encrypted uh um you will still have
to give it the proper key to unlock the
application and only then you could you
would be able to read the
data now uh you might be like a bit
confused because even if the data is
encrypted you should be able to like
copy to Infinity it's encrypted data but
I should be able to copy it right that
doesn't
work so uh now the sensible answer to
this is relay uh it's like a fancy fancy
mitm Relay can work but there should be
the identific ification problem in here
identif identification problem is
basically in a real world uh for example
I'm talking to uh a German I don't know
German but I I'm talking to a person who
is from Germany he knows German and um I
don't know German but somebody could
just tell me oh just say this it's fine
you don't really have to know the
meaning you could just say this and you
will receive answer just tell me that
right now uh if I just say the same
thing in know like a proper accent then
the person might not know that I do not
know German right that is the
identification problem they can't
identify that I am not a German so
something similar happens here uh this
is how a relay should look like on the
left you have the reader uh which is our
Metro reader the AVM and on the very
right you have the card is it even like
visible for you
guys okay okay I will zoom in uh so if a
data wants to go from the reader to the
card we could put some uh three machine
setup in between that will just read the
data and like log it or do whatever with
it and like keep the data going on so uh
this packet is meant for the pick pick
is just the uh card and it is coming
from the PCD which is just the reader
so uh the packet instead of directly
going to the uh card it will go through
a device that is acting like a card it's
not really a card that device is
connected to a server uh that server is
connected to another device which is
acting like a reader it is not really a
reader and uh then uh that particular
device is talking to the original card
so now it's the same scene here uh the
reader is for example it's speaking
German I am this particular device pick
I do not know German but I could speak
like that so I'm just whatever I learned
uh from this device I am just sending it
Forward uh till it re reaches the card
and I'm see doing the same thing uh
reverse so whatever the data that is
meant for the reader I'm uh it is going
through the server and two devices that
are acting like the card in the reader
and uh this particular server in between
which is uh connecting two devices it
can either log or modify data in some
way uh and that is a hacking part we
come to
it um so uh we need two devices and a
server for it a server can be literally
anything it can the it can be the device
as well I'm going to use like two
Android phones for this uh by the way uh
there's not going to be a demo uh
because there was some Visa implications
um some problem with the VISA if I could
I I I'm carrying with I am traveling
with one phone uh if I wanted to show
you the demo I would have like traveling
with like three extra phones though
there will be like four phones for a
tourist visa not not good to
go
so uh my original idea was uh maybe I
could use some cheap pn532 uh a pn532 is
basically NFC Reader and it can also
emulate things uh maybe I could just use
that breakout board and I should be able
to do it but it's not that easy because
first of all the documentation is very
[ __ ] up you don't really find
documentation that will and uh I
remember reading in some discussion that
uh you you can't really emulate 7 by uid
you could only emulate 4 by uid uh with
pn532 uh and our card is 7 by uid so you
can't really not good to go so this is
what uh my pn532 setup used to look like
uh there are two PN those red boards
that you see those are two pn5 32s there
is a Raspberry Pi Z on uh the bottom
over here and some U some U2 detail now
imagine something uh this is going uh
through uh a Metro secur security system
and they are able to see what I'm going
to do and and the policemen over there
they are not that technical if they see
that you are putting something else
instead of card on the reader they're
going to ask your questions so it
suddenly became a uh social engineering
problem as well so I used to travel with
some person who will keep talking to the
policemen nearby so he can't look at me
and I could do my shenanigans
sometimes I will like find a tall enough
person so they could stand so if the
reader is here I will do my [ __ ] here
and they are standing in in the line of
sight so they can't see what I'm doing
and I got got in trouble one time it was
easy when you get in trouble in India
you just AR Dum they will let you go
after 2 3
minutes so Android device um you can't
really use them directly because Android
uh emulation NFC emulation is just the
uid emulation and the hardware and the
software reion emulation but you need to
emulate the encrypted data as well uh
for that uh you need ex hook and expost
you need to directly communicate with
the uh lib NFC driver and not the hard
layer in between and um it sounds so
fancy to do all that but somebody has
already done it so uh this is the
project name NFC gate uh Rel is
officially supported by this but uh
while using it uh there was a problem it
ships with the python V server and the
python part is the problem here because
our next villain uh fwt uh fwt is frame
rate time uh when the communication
starts with uh starts from the reader in
the card uh the card tells some crucial
information to the uh to the reader one
of them is a frame weight time uh it's
basically defines that uh if I don't
reply the card doesn't reply in this
much amount of time that just close the
connection and this time is very low I
think 70 milliseconds something and uh
the python server is very very slow I
can't use python in this so like a
sensible person I rote everything in a
compiled language uh there was no
documentation for the server so I just
uh went through one day I just woke up
and like I will learn go I will rewrite
everything and go so I rewrote
everything uh it took 2 days to work and
out of the box it was like fast enough
it was two times faster than the python
server that uh uh that was there and it
was under the fwt time limit so I was
Gucci everything's fine and I could do
things and my servers uh is just rule
based you write very stupid if and if
and else cases to uh determine what
packet to drop or what packet to modify
I'll go through it um this is an example
packet for example
um this is just checking if uh the Cent
it's very bad code it is just checking
that the packet that is currently in the
server uh is it from the reader and if
it's from the reader then are the first
two bytes h90 h6a if they are then that
is the application ID uh uh command I
will let you know how to figure out what
commands are work for and instead of
sending it to the card I'm my server can
act like a card and respond in instead
of the card so I'm uh just responding
dead beef which doesn't really mean
anything for the uh reader uh but at
least I can like act like a card in send
data so uh now how do you figure out uh
What uh what heck 60 was so basically go
to Li freefare uh it's from lib NFC um
and they have a file called meair
desire. C although the documentation for
desire is not online you will have to
pay like2 $200 or something to get hold
of the documentation what this person
has done is uh instead of like making
making the documentation public they
just rewrote the documentation in like a
proper code and then made it public so I
think it's under n or something so here
you can search for the commands for
example uh what was the command that we
were looking for here uh it's 6A uh so
you uh go here and you search for 6A and
you find uh and you just read the
function name so function name is me
desire get application ID so it's just
reading all the 16 application IDs from
the card and uh let's go through the
talk now yeah now let's think of a real
world example uh a real world example is
like way too similar to Indian State
metros the recharge process uh is like
twostep here uh the final stage is the
AVM stage the video that you uh saw
previously and uh you can recharge using
any online medium and we are also using
the mey ev1 card so how will the AVM
part look like uh in communication so
this is how normally the communication
looks like uh when the recharge is
happening like real money is getting
transferred uh in the card so you have
the reader you have the card some Monkey
Business goes on before and then the
credit command gets sent the credit
command uh the first part is is always
unencrypted because it's the command
name the ID for the command and after
that it's the encrypted data encrypted
data just contains uh the money that's
the money W and um like a sensible uh a
good card the card is going to respond
with okay message it's like sttp 200
here it's he 00 and some Monkey Business
goes on it's like database whatever
changes that you make are normally
temporary you have to commit the changes
to make finalize them so the the moment
the communication ends uh just before
that the last packet should be HX C7
which is the commit change uh like
commit all the changes that are already
made now again we go here we search for
credit how credit uh is done we look for
a function uh by the name of credit this
is the function and it calls this
particular function if we search here we
find that the first bite that is added
is hexi so here you could be sure that
hexi is the credit command and whatever
that comes afterwards is the money
now uh what if the reply to hex C7 which
is 0 0 that never arrives to the reader
since good question right so let's just
go through it
um so this is the hexi which is the
recharge part the money transing part it
goes through uh it goes to the card the
card replies with oh I have done the
changes in the temporary memory uh it's
null and then uh the commit uh command
came comes in to finalize everything the
commit goes on and I drop the commit
message uh in the earlier now from the
cart POV the recharge is already done
and the cart has already acknowledged it
already acknowledged it from the reader
POV the acknowledgement never came so
for the reader the recharge is still
pending and you could just go on and on
and on recharge the same thing over and
over and over for example you're
recharging for 1 which is like 100
rupees uh you can do it as many times
you like you have the money and after
you have satisfied with the money you
leave the your 100 rupees uh in the
remaining balance it's still a remaining
thing there is a rule in Del Metro that
if you don't com if you don't do the
second Factor the AVM recharge for 25
days they will refund the
money so after 25 days it's basically
free but
but this is way too uh extensive time
extensive right uh the whole thing will
take like a minute or something like you
will have to wait for another minute to
do 100 rupes recharge again and again
and again we don't want
that before that let's go through how
the rules for this looks like so I'm
just checking if the uh CL the client
type is reader and I'm checking if the
bite is C7 if it C7 then I have to drop
the next particular next uh command uh
sorry next packet which is like the null
from um the card uh I just set a
variable over here drop next card equal
to two and uh when drop next card is two
and the client I is card I just drop the
packet I just reply with anything for
example I just made up 70 here instead
of 0 0 you just reply with anything and
it's fine and
um the extensive time part what if uh
you this encrypted encrypted data part
the which contains the money uh it is
the same for the same session if the
session never ends the encrypted part is
going to be the same right so what if
you just record the encrypted part uh
this particular command here 0 C and the
encrypted money part and you close the
connection at that particular point for
the reader but not for the card you keep
the card alive in the session and then
keep bombarding this hx0 C over and over
and over now every command is going to
take what um let's say 50 millisecond or
something maximum yeah so every 50
second every 50 millisecond you're
getting a one Euro recharge and whenever
you are satisfied you just send hex E7
on your own and it is
committed good right
so um let's see how it looks like uh in
action um please uh contr
e uh so this is the same uh AVM and uh
instead of the card uh I'm going to put
my
phone that phone is acting like a card
here not really the phone and you will
see another phone will come into the
picture this phone is acting like a
reader and it is attached to the real
metro card and I'm looking for a
transaction over here is currently like
352 rupees on the card I'm completing
the recharge now here's the funny bit
I'm pausing the video when the engineers
at Delhi Metro wrote this code they
never actually realize that somebody
could do this so the machine
crashes so you will have to wait like 30
40 seconds to let it like restart or
something so if you see the red red
thing over there it's like machine
doesn't know what to do and it's hanged
you can't really do anything you will
have to wait it for to restart it will
just show this and normally uh after the
restart it should go to the welcome
screen where it says welcome Etc blah
and blah but uh for some weird reason uh
it will go to the uh recharge screen
again it shouldn't work like
that so yeah let's just wait for 10 more
seconds I think oh never mind there's a
cancel button over there you click on it
nothing
happens and then you place the card
again instead of the wel welcome screen
you get the recharge it's still showing
352 rupes but the recharge has already
done it's 452 rupes now but the rear
still pending you can do it now some
bits how much time do I have
left
cool now uh something similar that you
can do uh so instead of recharging card
what if uh the the money never debits
from the card that is also something you
could do right um so this is how this is
what happens when you are exiting
through the ENT exit gates the entry
exit gates are also like Bonafide uh NFC
readers so the debit command is DC you
can go to lift free fa to cross confirm
that and the encrypted data is the same
and then the okay message comes in and
the commit it's very similar instead of
h0 C the credit command you have the
debit command there's also something
funny that you could do for for example
you're traveling for 20 rupees instead
of deducting 20 rupes if you could just
uh change this HX DC which is the
unencrypted part to hex 0oc the machine
is going to give you 20 rupees instead
of deducting it you could also do that
uh whenever you travel you are just
earning more money earning more money
for traveling it's good for it's good
for your card don't really do it in
India
please so um
yeah no I don't want to update yeah
um this uh so HX DC uh now I don't want
the HX DC command to like actually go to
the card because the card will make
those changes right and like the commit
thing won't work here so we have to be
like a bit smart by bit smart here I
literally means uh never let the DC
command go to the card just drop it in
the mid and uh send C7 on your own it's
fine the debit never happens the the
machine is Happy the card is happy you
are happy and you are allowed to go and
you you could in theory also change the
D7 command to C7 and uh sorry DC command
to C7 and it should work
fine um there's one more thing which is
not in the slides uh I have some time
because there is no demo uh I will just
go through it it's funny I never
actually talked about it um let's go to
the recharge
part
here uh remember when I told you that
the encrypted part will be different for
every session because the session key
always changes for like whenever you
restart the session the session key
should change and that is required for
encrypting data so the encrypted part
should also be different somehow that's
not the
case security woo so for every other uh
every other packet that is sent it
follows that same rule the packet is
different every time because it's
encrypted with the session key for
whatever reason the hex zoc command or
the hix DC command the credit and the
debit command it's the same
so so you don't you don't really have to
like go through all the pain you could
just read the 100 rupees recharge
encrypted data and uh whenever you put
put your card on the uh the reader uh to
like check how much money you have left
the the reader is actually going to
unlock the application for you that
particular application which holds your
money so you are you you have already
completed the first hurdle that is UN
encrypting the part right that the the
reader is already doing it for you so in
theory uh you could just read the
encrypted data and when you click on uh
check current value or check current
money and the decryption part has
already been done you could just send a
malformed request hex 0c and then
encrypted data that you have recorded
before and do the recharge there you
don't really have to like go through the
whole the uh the whole pain that you
have to like do a online recharge of 100
rupees and then go there you could just
directly commit the second phase of the
recharge it's also allow
allowed um I have uh I will also tell
you one more thing uh it's not for the
card it's for the reader uh let's uh so
it's it's for the token so uh we have
something called Metro token for small
uh small
travel uh I'll show you how it looks
like so this this little thing here so
this is not a meare Desy ev1 card this
is just a meair ultral light card and
ultral light cards they have a security
feature which is called oh let's lock
this particular memory section so nobody
could write into
it and would you like to take a guess
what Delhi Metro has done they are not
utilizing the security bits so it is
open to your phone can read it your
phone can rewrite things in it so if
you're like smart enough there is only
like U um 1 KB or like 2 KB of data I'm
not sure you will have to check that
but you could get a token for like 10 uh
rupees uh which is like uh one uh 10
cents you could get a token for 10 cent
modify the bytes uh the money btes in
there to be to be 100 100 like 1o and
then there is a rule that if you don't
travel on that token like if you don't
get enter into metrop premis using that
token for like 1 hour you can refund it
and get the real money back like the
currency you you know where I'm going
with this so easy money Easy Money
earning hack Let's Lose the job and do
this every day we are going to earn
money uh don't go overboard with this uh
because the maximum token maximum amount
of token that you could buy is 0 rupes
of course if you like change it to like
a million rupees they will know they are
not that dumb so like maximum you could
do is like 90 rupes or 100 rupees but
yeah that's there also uh the money uh
the money bites here are uh 16 bits so
in theory you could earn a lot of money
in one go but not really that doesn't
really happen um at that note I'm going
to close this uh I'm very sorry about
that I don't really have a demo to show
I wanted to come
here yeah you could learn more about me
at this particular link if you want if
you have any questions uh you could just
send me a mail thank
you thank you very much are there
questions
no does this Metro provider know of this
yeah non-existing security see H so uh
This research started back in 2020
because of covid the research and
because of covid and my laziness the
research ended in uh 2022 February it
was 14th of febru I still remember it's
Valentine Day so um I on that same day I
uh wrote a bug report s sent it to them
not just them every Metro provider I
forgot to just tell you this uh so the
Metro phase the Metro era was started in
the capital of India which is Delhi
Delhi Metro and every other Metro in
India just copy pasted down that so this
bugs exist all around the India that's
why the talk name is traveling in India
uh for free uh now to answer your
question I have sent them multiple times
it was also uh covered by dick crunch
just so the government notices and uh I
still now till this day I don't think I
have ever received a mail or a reply
that is written by a human I have I
replied by a I I I have gotten replies
which are computerized so I didn't I
think they don't really care so you
could in theory travel for free but
don't it's uh some part of it it is like
taxpayers money uh so
don't well uh yeah very cool I like it
very much so the other side of this kind
of game is um so the the the this is I
just I think it's more like a pro tip of
what the next heck could be is if you
think about the um the offline version
of the system so of course when you like
board the train or whatever they're not
connected to the internet but they
somehow validate that your you know that
your card is valid so there must be
something special Source in that reader
in that train right um and the special
source is a SIM card almost always
produced in 1990s so it's going to be a
good fun to hack it because like you can
pck it with a 50 equipment I mean I'm
exaggerating but a few thousand EUR
worth equipment and um it has a master
key in it and that's what the the all
the encryption that you're seeing here
is actually it's a session key that's
encrypted with this master key and that
allows it to
with the and all you need to wait for is
one of these people you know find one of
these machines that is that is not
working right it's not working so they
just like throw it away and sell it I've
gone through that I've been into
dumpsters yeah okay I I like I like your
and there's a SIM card in there
somewhere and if you legally buy the SIM
card you on paper legally own this thing
that's inside that thing which is a
digital key that doesn't only allow you
to upload which is what you can do right
so you can just I can do that but the
thing is uh I know I do not know where
their trash bag is I tried like asking
delh Metro people uh if somebody could
help me find their trash bag but nah I
also tried like getting a job into delh
Metro I like I like the way but they
don't hire uh people who are not from
college so then the trick is with the
next step of this the only thing that
you could do x-ray is that you can
actually sign your own keys so you can
have you can create any number of I
think I'll have to break into Metro
premise at night no no no just have to
wait for one of these to end up in the
dumpster yeah yeah yeah I I will go
through the dumpsters
again yeah to answer uh on that in India
government sector does not really
dispose the garbage like let's say for
next 10 years so they're going to keep
it for 10 years and then they're going
to throw it so they won't dispose it
anyhow they're just going to throw it in
some
dumpsters about you uh your setup so
when you are uh using your from the
reader from the AVM machine so you are
using your device to stop the
communication between the card and the
AVM machine and then after that you're
using your own phone to push the data to
the card yeah okay so in that case you
need only one
phone yeah but you need to start the
communication because you need uh the
reader to unlock that particular
application in which the money bits are
so you need anyway you need two phones
and after a certain point you when you
have read uh when you have like read the
uh hex zoc command which is the credit
command and the encrypted bit then you
could like lose that one phone which is
connected to the reader and you keep
that phone alive which is connected to
the card and you keep bombarding the he
zeroc command and when you whenever you
are done you send the C7 the commit
command okay okay yep
thanks uh de oh sorry uh thanks that's
very cool uh um let's say they do give
you that job at D Metro and you should
fix this is this actually fixable or do
they have to change all the cards and
all the readers before anything can be
that cool so uh uh the the fix is uh in
India we like to make fun of the
government uh so uh the fix is
uh I forgot the term for
it so you basically get rid of all the
cards that are like in publication for
now burn them give them all new cards
but that is not really feasible because
I think they are more than like 2
million card the currently active so how
will you do that and that 2 million card
is just in Delhi I think that number is
pretty weig don't quote me on that but
uh there are many major cities with the
same
bug uh and how will you like perform the
same thing everywhere it's hard right so
I gave them a separate example uh that
instead of like uh uh if you read like
uh remember the video the AVM video the
card you could just like tap on it and
like do the transaction I told them oh
what if you make the uh uh AVM uh wider
than the NFC uh NFC range like 10 cm
wide you make those avms and the people
will have to like put it put your card
in the middle so in no way you can make
a mitm device or a relay device that is
that thin thin as a card that can go
inside to like communicate that was like
a very janky idea but as far as I've
known Delhi Metro they could do it but
sadly they won't it's it costs money and
they are
lazy
are there further
questions if that's not the case I guess
uh we thank our speaker again and
um thank you thank
[Applause]
you