Thursday, September 27, 2007

AWID and LSU, parking hacking

Recently Louisiana State University started up a program called "Easy Streets" which cuts off students or general traffic from using any streets that pass through the university campus. They are using lifting barriers and RFID detectors made by AWID (Applied Wireless IDentification). I haven't quite figured out a way to bypass the RFID system yet so I am looking for your help. Here's what I've learned so far:

1) The readers are model LR-911 units. This design has been in production for a number of years and probably has backend software from iAnywhere. The benefit of this is that iAnywhere supports a billion protocols and basically no encryption. The drawback is finding out how to access this functionality.
"RFID Anywhere Appliance Edition"
supports TCP/IP, HTTP and the EPC reader protocol. It also adds security functions, software for configuring the readers remotely from a Web browser and an application programming interface for executing business logic on the reader itself."


2) The wand is given to each member of the faculty or staff who has access to park on our precious streets and mow down pedestrians (aka, the people who pay them). The model of the wand is the "MT tag", and it the system operates on the 900-928 Mhz unlicensed band, from a distance of ~5 meters.

3) Here are the instuctions on cloning a verichip, with code and blueprints ready to go. While Bruce Schneier discusses cloning a US Passport and how it's done. This is the home-made kit to clone a verichip, all that should be required is a different number of wraps for the antenna.


4) Make.org has tons of info on projects to play with RFID, and there are kits with readers and tags available but they all seem to focus on the 14khz spectrum (only good for inches away), and not the relatively uncommon 900Mhz band.

This RFID system is basically unencrypted and requires no handshake or verification. It is also quite likely that part of the tag is writable and that a blank tag ($15) could be cloned. The technology is virtually identical to Verichip except for using the 900Mhz range instead of 14khz. Tools written for cloning Verichips and US Passports *should* be able to clone these chips also, except that building such tools is too time-consuming and difficult for me, and I cannot find a cheap source for a chip reader/writer.

My next idea involves bypassing verification altogether and perhaps activating the induction loop for the exit side, however that could get me in trouble if i'm spotted going in the "out" door and would only be good for parking lot access, not general travel. Please send ideas in the comments. I'll add more as I get time to do more research.

2 comments:

Anonymous said...

any luck on this? i have been researching the same for the parking facility at my office.

Blogger said...

[Download] $12,234 in 2 months Casino App?

Let me get it straight.

I dont care about sports. Shame on me but I dont even know the baseball rules. Never cared less.

I tried everything from forex & stocks to internet marketing and affiliate products.. I even made some money but then lost it all when the stock market went south.

I think I finally found it. Download TODAY!