def con 34 · riding for free

RIDING FOR FREE // CTF

A NIMBUS TRANSIT fare card lands in your reader. 1 KB of MIFARE Classic. Some of its blocks end in a single checksum byte the validators trust. The algorithm that generates it is flawed. Your goal is to find that algorithm.

your mission

  1. Poke the card: reload it, tap the gate, buy passes, then diff how the bytes move.
  2. Issue fresh cards (up to 3) and compare them. Work out how each checksum byte is produced.
  3. Prove it on the Final Exam: a card with the checksums blanked. Fill them all in correctly.
New here? Create account. Coming back on another browser or device? Log in with the same handle and email to reclaim your card.

leaderboard

  1. loading…