I must say right away that I am not a hacker or a cracker, but a simple front-end developer, my knowledge of working with a PC, if we discard knowledge in front-end development, can be described as an “experienced user”.
I did not develop special applications, as the authors of the mentioned articles did, but I will show how transport cards can be easily hacked using available means. Hacking methods have been known for a long time (5-7 years for sure).
If I, as a developer, used old versions of frameworks with known vulnerabilities, my employer would have torn my head off a long time ago, but this, in my opinion, does not apply to developers of transport systems. Perhaps this is due to the low savvy of the developers themselves.
But back to hacking. So, first things first.
I carried out all the actions I described in the fall of last year, but, as far as I know, everything works now.
So, I have an inexpensive smartphone with NFC. I once bought Citycard transport cards (it so happened that I have several of them - sometimes I forgot the card at home or at work and had to buy a new one).
I downloaded the official Mifare NXP Taginfo card maker app and scanned my transport card:
It turned out that the card is based on the Mifare Plus S chip, but most importantly, it works in security mode No. 1. This means that in essence it is a simple Mifare Classic card that is easily hacked.
I downloaded the wonderful Mifare Classic Tool app from Google Play and scanned the transport card with standard keys:
Here I was disappointed - none of the known keys fit. Accordingly, it was not possible to use hacking in the way described in the article about Plantain.
“Wait a minute,” I thought, “but you can try the method, as described in the article about hacking the Troika.
Indeed, Citicard also has an application from Google Play, which allows you to check the balance of the card, and later they added the ability to replenish the card.
I have downloaded and installed this application. But now I'm faced with a dilemma: the keys to the card are protected either in the application itself, or they "arrive" from the server. Decompiling Android apps is easy enough, but I'm not very good at it.
Surely, a more or less intelligent developer can do this quite easily. I didn’t have such skills and turned to my brother who repairs intercoms, I thought he had a familiar programmer, but he offered a more elegant and simple solution.
By that time, he had received a fee from Kickstarter, which allows you to spy on the protocol between the reader and the card. It turns out that key fobs began to be used in intercoms, inside of which the same Mifare chip is sewn, and he needed this board for some business related to these key fobs (I did not go into details).
So, he took his board, placed it on my smartphone, which acted as a reader, and the transport card itself acted as a card, and removed the data exchange log between the reader and the card.
I give a screenshot of the utility below (taken from one of the sites on the Internet, so the data there is not real, which we used).
In general, it is enough to insert the necessary pieces of the log into this utility and the 6-byte key is instantly calculated. I myself was surprised how easy it is to do, the most difficult thing was to copy the necessary parts from the log and paste them into the appropriate fields of the program.
Then I opened the same Mifare Classic Tool (MCT) application, inserted the received key into the application, and this time I was shown the contents of the 0th and 8th sectors.
In the zero sector, there were mostly only zeros, but in the eighth there was some data, from which I concluded that the data on the transport card is stored in the 8th sector (as in the Troika card - is it really the same developer?), and the resulting key turned out to be key B (the sector has two keys A and B).
Further, for the sake of interest, with the help of the libnfc open source utility and a contactless card reader, I received all the other keys to the card (more on this was written in the article about Plantain - I also used this method. It is also described on the libnfc website).
With the help of the received keys, I tried to read the contents of another transport card. It turned out that key A matched, but key B did not. But with the help of the mentioned utility, it also turned out to be easy to get.
Then I began to examine the contents of the transport card. The 8th sector consists of 4 blocks of 16 bytes. With the help of MCT, it became clear that the first block is the so-called. Value block. The first thing that came to my mind was that the balance of the card is stored in this block. With the help of MCT, we managed to decode it - it contained the number 2147483647. It clearly did not look like the balance of the card, even if it was in kopecks.
Then I toured this map and found, by reading the contents of the sector, that the value had not changed, but the contents of other blocks had changed. From which it was concluded that the balance of the card is stored in them.
There was no particular desire to parse the contents of the map, because I wanted to try the so-called replay attack (I later found out how it was called correctly).
In the morning before the trip to the subway, I saved the contents of the eighth sector, attached the card to the turnstile and went to work. In the afternoon, having gone on business, I recorded the previous state of the card with the help of MCT and tried to ride the subway ... And I succeeded!
(the picture is not mine - I did not want to attract attention at all)
So I realized that in this way you can make an “eternal travel card”. I decided to indulge a little and wrote down the contents of the transport card sector in the intercom key fob.
(here is the same keychain I used to write a transport card into it)
I tried to pass through the turnstile with the key fob attached, but then I was disappointed - the key fob, to my surprise, did not work. I thought that my transport card was blocked (after all, the key fob was its clone), but when I applied the “original” (transport card), I managed to get through the turnstile.
I talked to my brother, I wanted to know what he thinks about this, and he told me that each card and key fob has its own identification number. Apparently, my "clone" was not complete, and the contents in the card are somehow tied to its number.
But it turned out that there was a way out of this situation: there are some types of key fobs that look exactly the same, but they can change their number (ordinary transport cards will not be able to do this). Moreover, the MCT has such a function to rewrite the number, since it is stored in the first block of the zero sector.
True, for some reason, changing the number using MCT did not work. But it turned out to be done using the reader and the same libnfc.
This time I got a complete clone of the transport card in the form of a keychain, because even the number was the same. I tried to get through the turnstile using the intercom key fob, and I did it easily. I didn’t dare to put the key fob on the bus, because the aunt conductor could be very surprised, but the “eternal” transport card also worked without problems.
So, summing up, we can say the following: transport cards for paying for travel in Nizhny Novgorod are just as easily hacked as Troika (Moscow) and Plantain (St. Petersburg).
Even I, a girl, without special knowledge, but who knows how to download Android applications and use the search in Google and Yandex, was able to do this using improvised tools and programs and utilities available in the public domain (if I were a developer, it would probably be even easier , although much easier ...) Yes, it took me some time to search the Internet and study the forums, but everything turned out to be very simple.
I want to note right away, anticipating questions, that no damage was done to the subway - I took into account all the trips made on the "eternal travel card", so I did not spend the balance on the card corresponding to the amount of such trips, and then destroyed the card itself.
But the attackers are not so conscious, they probably take advantage of such a vulnerability and cause damage to public transport. We, on the other hand, receive regularly growing fares (maybe, including due to losses due to forgery of transport cards). By the way, the deposit for the transport card is 50 rubles. But exactly the same security Mifare Classic cards cost 12.5 rubles and less.
It feels like everything transport systems where transit cards are used are unsafe. I don’t want to argue why this is happening (this topic is not for Habr), it remains only to ask the question: who (what city) is next and when should we expect an article about this on Habré?
PS This story is, of course, fictional. All characters are fictitious, all coincidences are random. Well, you get the idea...
The original is here - habrahabr.ru/post/325776/
Shanghai is one of the largest metropolitan areas in Asia. One of the attractions of the city is its subway. In this article, we will tell you everything about the Shanghai metro: we will give a map with a diagram, opening hours, talk about the fare, types of tickets and privileges.
Tim Adams/flickr.com
short info
The Shanghai metro can rightly be called the epitome of modern elegance and engineering genius. Here, elements of Eastern culture are skillfully intertwined with the latest achievements of Western architecture. The stations of the Shanghai Metro are extraordinarily beautiful, and the trains that run between them resemble super-fast cars of the future.
Tim Adams/flickr.com
In a relatively short period of time (its history is 14 years old), the Shanghai metro managed to break into the ranks of the leaders in a number of indicators. So, this is the world's first subway in terms of length (548 km) and the fourth in terms of daily passenger traffic (8.5 million people).
Subway lines and stations
The Shanghai metro scheme is represented by 14 operating branches and 329 stations. Due to the popularity and convenience of this type of transport, the subway is developing at a rapid pace. According to the project, by 2020 the number of branches on the Shanghai metro map should be increased to 18, some of which will connect the most significant objects of urban infrastructure.
The Shanghai metro map shows that the main number of stations is concentrated around the city center, which is considered the norm in the construction of the subway.
Stations of the Shanghai "subway" are built with the latest technology and architecture. They are distinguished by perfect cleanliness and great information content. Plasma panels show information about the arrival of the next two trains. The announcements themselves are made in two languages: Chinese and English.
Unfortunately, there are no announcements in Russian in the Shanghai metro yet. But no less important innovation was the introduction of a record that announces information about everyone located near the station.
Issue price
The fare depends on the distance. The first 6 kilometers of the journey will cost you 0.44 USD or 3 yuan. Fans of long trips will have to pay 0.15 USD or 1 yuan for every next 10 kilometers. Such a payment system is not universal: the fifth metro line has its own prices.
Marc van der Chijs/flickr.com
You can drive up to 6 kilometers along it for 2 yuan. This feature is explained by the fact that the authorities stimulate the development of the area through which this small branch passes. The Shanghai metro map does not deceive - its length is only 15 km.
Much to the surprise of the Russian tourist, travel privileges in Shanghai are established on an anthropometric basis. So, children whose height does not exceed 1.2 meters have the right to a free trip. The authorities have not forgotten to take care of the elderly: pensioners over 70 are also entitled to free travel.
However, there are some bureaucratic nuances here. This privileged opportunity is given only by the Chinese social card, so this rule does not apply to tourists.
Ticket types
The following types of tickets are used in the Shanghai Metro:
- Disposable.
- Shanghai Transportation Card - Shahghai Public Transportation Card.
- Travel cards for tourists for 1-3 days.
- Maglev.
A one-time ticket can be bought from vending machines at any station. The passenger must enter the final destination of the trip, and the system will automatically calculate its cost. These tickets are valid only during the day. When leaving the station, the used ticket must be inserted into the turnstile. You can stay on the Shanghai subway for no more than 3 hours. Otherwise, the turnstile will not let you out.
The Shanghai transport card is an analogue of a plastic card. The passenger replenishes her account, which she spends on travel. When purchasing it, you must pay 3 USD as a security deposit. If the amount spent on trips exceeds $10, you will receive a 10% discount on all subsequent trips.
Passes for 1-3 days are the most advantageous. By purchasing a one-day or three-day pass for 3 or 7 USD, respectively, you can travel on the Shanghai subway without restrictions. This option is the most popular among tourists.
Maglev is a high-speed metro line. It links Pudong Airport and Luoyang Road Station. Trains here run at a speed of 300-430 km/h. Such a trip will cost $ 7.5 one way.
Video: how to use the Shanghai subway?
Schedule
Those who like to walk until late are interested in the question: how long does the local subway work? After all, life in the metropolis is in full swing, so a tourist can inadvertently lose track of time. So, the operating time of the Shanghai Metro starts at 6 am and ends at 11 pm.
On holidays, the metro can run until one in the morning. It should be remembered that each branch has its own opening hours. But in any case, it's not worth the risk - come to the station half an hour before the official closing.
For me, the Shanghai subway is associated with eternity! On my first trip, we lived very far from the center and spent about an hour on the metro every day on only 1 branch. But in reality, it's not all that bad!
Features of the subway in Shanghai
The subway in Shanghai includes 16 branches and allows you to get almost anywhere. Well, at least to everything that a tourist needs.
Each station has a security control service, everything is like at airports - luggage passes through an x-ray, and you yourself go through a metal detector frame. All platforms are separated from the tracks by a fence (a handrail at a height of a meter and a glass surface, sometimes the fence is completely glass from floor to ceiling), the doors of the cars stop in front of the fence doors. Entrance to the car is from the side, exit from the center. There are special graphic clues on the floor to help you navigate.
In the carriages, there are monitors on the walls, on which, mixed with news, recipes and even karaoke, they play information about actions in an emergency. On the platforms there are large TVs showing the time until the arrival of the train and other information.
Let's start with some basic information:
Subway map
Now, in the age of technology, I advise you to download the application in advance to be prepared for the trip. The best, in my opinion, is: Shanghai Metro (Metroman), the application is blue.
With regards to the functionality, everything is standard: interactive map subway, in which you can, by selecting the necessary stations, build a route. Unlike other applications, it is constantly updated.
Website and Opening Hours
The official website of the Shanghai Metro always provides up-to-date data. Using them, you can build your route in advance. It is especially convenient that all information is provided on English language.
On average, the metro is open from 6:00 to 23:00, but each branch functions differently. You can see exactly what time the branch you need is open only in the metro, there are signs indicating the time or on the website, but keep in mind that sometimes the time changes. Therefore, it’s not worth the risk: it’s better to be at the station you need 30 minutes before the metro station closes.
You will never get lost in the subway - there are signs pointing to the right branch everywhere. The main thing is to carefully look at the map: some transitions involve only a transfer from one train to another, and not go through long tunnels.
Types of tickets and fares
If you have already been to other cities in China, then it will not be news to you that the price varies depending on the distance. If your journey does not exceed 6 kilometers, then the ticket will cost 0.44 USD. If you need to drive further, then for every next 10 kilometers you will have to pay another 0.15 USD. However, some lines have their own rates. The maximum value is 1.3 USD.
You should not have any difficulties with paying for the fare: there are vending machines at each station where you can buy a one-time ticket. The departure station is already automatically filled in the system, you just need to choose which station you want to go to, and the machine will automatically calculate the cost.
Do not try to be smarter than the system and buy a ticket to the station you need, because when entering and exiting, it will be necessary to insert it into the turnstile. Otherwise, you will not be able to get out of the subway to the street.
Now let's move on to an option with which there are a little less problems if you come for a long time.
For free children up to 130 cm tall are allowed in the subway. In addition, disabled people and pensioners with Chinese citizenship.
The Shanghai Metro has excellent navigation, all exits are marked, and there are often maps next to them. So you won't get confused. When you are navigating to a point of interest, always look for the nearest exit.
The “single” ones familiar to Muscovites are made at the Zelenograd Mikron plant. The enterprise has been producing microcircuits since Soviet times. In the early 1990s, it was corporatized. Then the plant became part of the Sitronics concern, owned by AFK Sistema. In July 2006, the concern signed an agreement with STMicroelectronics on the transfer of technologies for the production of microcircuits based on the topology of 180 nanometers. This line produces microchips, which are now included in every Moscow ticket. In addition to them, the plant produces SIM-cards and plastic cards with chips for Visa and MasterCard, chip modules for a universal electronic card and a biometric passport.
Plant "Mikron"
Location: Moscow, Zelenograd
The number of employees: 1 700
Foundation date: 1967
The main element of the Moscow transport card is a microchip measuring 0.2 square millimeters. Microchip crystals are made on silicon wafers in clean rooms where powerful air conditioners maintain a constant temperature of 21 degrees and 45% humidity. Only employees of the plant in overalls and masks can enter the clean rooms - this is necessary in order to prevent the ingress of dust or foreign particles from clothing and skin onto plates with future chips or equipment.
The manufacture of a crystal is a complex technological process, which is similar to the repeated developing of a photograph. The surface of the silicon wafer is coated with a special dielectric layer. A photosensitive composition is applied to it - a photoresist. Then, using an ultraviolet beam, the plate is illuminated through a photomask with a pattern of one of the layers of the future microcircuit. This procedure is repeated many times on the entire surface of the plate, as long as there is enough space, depending on the size of the chip itself. So one plate with a diameter of 200 millimeters "fits" 90 thousand transport chips.
Ultraviolet radiation, passing through the photomask, illuminates certain areas of the surface, which are then developed using special compositions. As a result, as if "drawn" lines from the photoresist remain on the surface. Free areas are subjected to various effects: etching or ion implantation, when ions of other substances are “shot” into the wafer from a high-voltage accelerator, penetrating into the surface layers of silicon to a certain depth. This is how tens of millions of tiny transistors are obtained, which in the desired sequence must be connected to each other by conductors. The density of the elements is so great that it is impossible to combine them all on one layer. Therefore, several layers are made where the conductors do not cross with each other. All layers and conductors form a complex structure, similar to branched passages in an anthill.
The entire process of manufacturing crystals on a wafer takes about two to three months and requires sequential execution of more than three thousand different operations. There are nine sections in the clean room of the plant, which are responsible for different stages of production. Every day and around the clock, specialists control the technological process, ensuring the quality and accuracy of all operations. In total, Mikron, which, in addition to the production of crystals, is also engaged in scientific research, design of microcircuits and assembly of finished products, employs about 1,700 employees.
When the production of crystals is completed, the plates are sent to the transport card production workshop. In the bumping section, the machine puts tiny gold bars (bumps) on each chip at great speed. Then they will become the contact between the chip and the antenna of the transport ticket. The antenna is needed to power the chip with electricity using electromagnetic induction. When a ticket is applied to the turnstile validator, the ticket antenna enters an electromagnetic field and starts to generate a weak electric current. The chip “wakes up” and starts transmitting information about its number, the number of trips, and the validity period via the radio channel. The information is checked against the database, and if everything matches, the trip is debited from the card and the turnstile doors open.
At the stage of thinning, the plates become ten times thinner. The machine cuts off excess silicon from below and the wafer thickness is reduced from 750 to 75 microns. This avoids the appearance of a bump at the place where the chip will be installed on the transport card.
Then the plate is transferred to a sticky film and sent for cutting, where diamond cutters cut it vertically and horizontally, carefully cutting out each of the 90,000 chips. The thickness of the cut is minimal, and the appearance of chips on the edges is unacceptable.
On the conveyor, the chips are attached to a special non-stretch polyethylene tape with an aluminum antenna. First, the device applies glue exactly to the attachment point, and then a chip is placed on it: on the back of the adhesive film, the chip is lifted with a thin needle so that the vacuum suction cup can pick it up and install it in the right place. A film with an antenna and an installed chip is called an "inlay". The inlays are tested, cut into strips and rolled into tight bobbins. 
After cutting down the tickets are personalized. The drum grabs the ticket and writes the card number on its chip, which will later allow it to be identified in the database. The packers stack the cards in boxes that are sent to the subway and ticket offices in the city. The numbers of tickets and batches are entered into the computer, and then, when selling, the cashier simply “assigns” a certain number of trips to the ticket.
Each month, Mikron makes over 30 million transport cards for the Moscow Transport Department and the Moscow Metro. Their selling price has not exceeded 5 rubles for three years.
Photo: Ivan Gushchin
The transport network of Shanghai is represented by metro, buses, trolleybuses, ferries and magnetic planes (maglev trains).
Almost all modes of transport are subject to travel cards - SPTC cards, which provide a number of benefits. You can buy them at ticket offices or order on the website Sptcc.com. It makes sense to purchase this card if the expected period of stay in the city is more than a week.
Shanghai Metro
The Shanghai Metro is one of the fastest growing in the world. Currently, the metro network includes 12 lines, and almost all of them intersect. Line number 3 runs along the surface of the earth.
The Shanghai Metro is a fast, but rather expensive mode of transport. The ticket price depends on the distance traveled and varies from 3 to 10 yuan. Tickets can be purchased at the box office or special vending machines. SPTC passes are also sold here, providing a 10% discount when traveling on the metro. Different metro lines operate on different schedules, but on average, trains run from approximately 5.30 to 22.30.
Below is a map of the Shanghai metro. To enlarge the image, click on the picture; for an additional increase - click on the "Expand to actual size" icon (a square with an arrow) that appears at the bottom of the picture.
Buses in Shanghai
The bus network in the city is much more extensive. Bus tickets usually cost 2 yuan, although there are long routes where the price depends on the destination and averages around 5 yuan. You can also use travel card SPTC, reducing the cost of a second bus ride within 90 minutes from 2 yuan to 1 yuan.
In buses with a fixed price, there is a container for money near the driver - a kind of cash desk. Keep in mind - change is not given out here; if you did not have an even amount, then you will have to collect the change on your own, charging a fee from the incoming ones. Buses running on remote routes have a conductor.
Timetables and routes can be found at stops. For tourists, there are also special sightseeing buses.
Trolleybuses
Shanghai has one of the oldest trolleybus systems in the world. Now there are about 20 trolleybus routes in the city. They go mainly in the city center, with an interval of about 10-15 minutes.
The ticket price is 2 yuan. To pay for the fare, you need to put money in the cash desk at the entrance to the salon. If you have a magnetic card, you can pay for the trip through the validator.
Ferry
The ferry runs between the most popular tourist areas of Shanghai. This is a fairly cheap mode of transport: the fare ranges from 0.5 to 2 yuan. Ferries run every 10 minutes.
Magnetoplane
This type of transport is a maglev train capable of speeds up to 430 km/h. It runs from Long Yang Road to Pudong Airport with no intermediate stations. The working hours of the magnetoplan are from 6.45 to 21.40. The fare is 50 yuan; upon presentation of an air ticket - 40 yuan. More detailed information information about this mode of transport is available at Smtdc.com.
Taxi in Shanghai
Shanghai taxi is a fairly comfortable and inexpensive means of transportation. The fare consists of a landing fee and the first three kilometers (12 yuan) and the price for the subsequent journey (2.1 yuan for each kilometer). The night rate is 30% more expensive than the day rate.
In addition to ordinary taxis, rickshaws and private motorcycles are very popular in Shanghai. Their services are much cheaper.
To some points of the city (for example, to airports) a taxi can be ordered online - for this, use the search form below:
Fill in the required fields and click Find. A separate page will open a list of possible transfer options along the route you specified. Having chosen the right one, you can immediately place and pay for the order.
