A NIMBUS TRANSIT fare card lands in your reader. 1 KB of MIFARE Classic.
Some of its blocks end in a single checksum byte the validators
trust. The algorithm that generates it is flawed. Your goal is to find that algorithm.
locked until the talk
...
Unlocks Aug 7, 2026 · 3:30 PM PDT at DEF CON 34
Got an early-access code? Enter it below with your handle and email to start now.
your mission
Poke the card: reload it, tap the gate, buy passes, then diff how the bytes move.
Issue fresh cards (up to 3) and compare them. Work out how each checksum byte is produced.
Prove it on the Final Exam: a card with the checksums blanked.
Fill them all in correctly.
New here? Create account. Coming back on another
browser or device? Log in with the same handle and email to reclaim your card.
leaderboard
loading…
// RIDING FOR FREE CTF
SOLVED
card clock...day ...
Tap, reload or buy a pass and this date is written into the
transaction bytes. Advance days to watch it change and passes expire.
card dump
checksum (underlined)trailerchanged (boxed)
LIVE
history (click to inspect & diff)
final exam: fill the blanked checksums
exam card UID
First 20 blocks below. Type each block's one-byte checksum into its
gold box (2 hex digits), or paste them underneath, one per line.
Trailer rows and blocks 20-63 have no checksum.