Metro Bus Fare Token Fun.
So today I was able to get one of the token back home to see what kind of data they have in there and is it writable or not, so here is what happened.
It's a Mifare Ultralight of Type A
Viewed the Internal Memory of the Tag.
Total number of Pages are 16 so 4 sectors.
Okay now view of the Security how secure it is.
2 pages are locked by default and one is reserved and the rest of the tag memory is fully open for writing as expected.
Going to write last 2 pages for P.O.C:
Changed the last pages to 12345678 and 87654321
Now writing them...
Now I蛟､l read the memory again with two different apps.
Take a look at the sector-3 last 2 lines/pages.
Here with another app:
-> NFC TagInfo
-> Sony Xperia Z2 (D6503)
Well it was fun.