Understanding a debit card reader through RFID

Question

I work in the bus industry and today I went to a meeting that gave me an idea for a project. In order to start the project, I need to gather a technical perspective of how the product that I saw in the meeting worked.

The device I was shown worked as follows (pseudo terms):

1. Place a contactless debit card against the device
2. The device reads the card data and then sends the card information to a server over a secure TLS connection (with all the information required to make a payment using the card, the number, CSC etc). This was known as "touching on"
3. Touch the device again to "touch off"

Then, the server calculated the difference in seconds between when you touched on and when you touched off, and created and performed a transaction for seconds * £0.01.

To be clear, the transaction was made on the server not from the device. This means that the device must have sent card information to the server.

My goal of posting on this site is to try and understand further how the card information was read and then eventually decrypted. I already fully understand how to use a merchant gateway to make a payment securely, how to send data using a SIM etc.

What I know so far:

So to start off, there's gotta be a board in there running something. My guess is it'll be running a Linux distro. I believe that in order to access the data within the debit card (the number, csc etc) an RFID reader must have been used. This would then interact with the Linux distro when the debit card was placed near.

Here's where I get stuck. After they waved the card, they showed us that the card information was then in their server's database. Where have they read the data and decrypted its contents? Did they send encrypted bits and then decrypt them on the server, or did they decrypt the data using the RFID reader and then send the debit card number, expiry, csc etc over the connection. It's this bit I can't get my head around.

I appreciate I have very little knowledge here but if anyone could lighten this up for me I'd really appreciate it. I am primarily a software developer so I'm new to hardware, but I'd love a bit of an insight into what's going on here.

Answer 1

I believe contactless payment cards usually don't 'give out' the card number, CSC, expiry etc... Otherwise, that wouldn't make them much more secure than magnetic strips.

AFAIK, contactless bank cards generally receive a cryptographic challenge from the bank, sign it and return the result to prove they are a real card.

I suspect what happened was that the RFID reader at the meeting you were at just read the unique identifier of the card and matched it to their database. I doubt they actually used anything else on the card since they likely don't have the means to decrypt or send challenges to it.

In other words, they probably simply read off the ID from an RFID card (not difficult, you can do it with smartphones and special apps) and sent this ID to their backend database to match the card with an account.

Doing it this way could be a potential security issue. It's next to impossible to emulate a bank card due to the fact that they use a challenge-response protocol to prove they're a real card. That's what makes it impossible to clone a contactless bank card.

However, it's quite easy to spoof or clone a card ID and can be done with essentially off-the-shelf equipment. For a transport system, it could mean random customers would get charged for fares they didn't take and people could free-ride.