Metro Bus Fare Token Fun.

So today I was able to get one of the token back home to see what kind of data they have in there and is it writable or not, so here is what happened.

 

Tag Info:


It's a Mifare Ultralight of Type A

 

Viewed the Internal Memory of the Tag.


Total number of Pages are 16 so 4 sectors.

 

Okay now view of the Security how secure it is.

 

2 pages are locked by default and one is reserved and the rest of the tag memory is fully open for writing as expected.

 

Going to write last 2 pages for P.O.C:


Changed the last pages to 12345678 and 87654321

 

Now writing them...


 

Now I蛟、l read the memory again with two different apps.


Take a look at the sector-3 last 2 lines/pages.

 

Here with another app:


 

Apps used:

->         Mifare++ Ultralight

->         NFC TagInfo

Hardware used:

->         Sony Xperia Z2 (D6503)

->         Mifare Ultralight tag (Pakistan Metro Bus Fare Token)

Well it was fun.