I work in the bus industry and today I went to a meeting that gave me an idea for a project. In order to start the project, I need to gather a technical perspective of how the product that I saw in the meeting worked.
The device I was shown worked as follows (pseudo terms):
- Place a contactless debit card against the device
- The device reads the card data and then sends the card information to a server over a secure TLS connection (with all the information required to make a payment using the card, the number, CSC etc). This was known as "touching on"
- Touch the device again to "touch off"
Then, the server calculated the difference in seconds between when you touched on and when you touched off, and created and performed a transaction for seconds * £0.01.
To be clear, the transaction was made on the server not from the device. This means that the device must have sent card information to the server.
My goal of posting on this site is to try and understand further how the card information was read and then eventually decrypted. I already fully understand how to use a merchant gateway to make a payment securely, how to send data using a SIM etc.
What I know so far:
So to start off, there's gotta be a board in there running something. My guess is it'll be running a Linux distro. I believe that in order to access the data within the debit card (the number, csc etc) an RFID reader must have been used. This would then interact with the Linux distro when the debit card was placed near.
Here's where I get stuck. After they waved the card, they showed us that the card information was then in their server's database. Where have they read the data and decrypted its contents? Did they send encrypted bits and then decrypt them on the server, or did they decrypt the data using the RFID reader and then send the debit card number, expiry, csc etc over the connection. It's this bit I can't get my head around.
I appreciate I have very little knowledge here but if anyone could lighten this up for me I'd really appreciate it. I am primarily a software developer so I'm new to hardware, but I'd love a bit of an insight into what's going on here.