DEF CON 33 - RF Village - The dirty laundry of stored value washing cards - Aidan Nakache, Equip
Source: YouTube · DEFCONConference · published Oct 22, 2025 · 30:56
This presentation exposes critical vulnerabilities in stored-value laundry card systems using MIFARE Classic RFID technology, allowing researchers to manipulate balances after reverse-engineering the card's data structure and mathematical relationships 3:05-3:33.
Key Takeaways:
• The researchers discovered that card balances are stored in little-endian hex format as whole cent amounts, with values mirrored in multiple memory locations 5:56-6:34
• By analyzing the mathematical relationship between value bytes and middle bytes (y = -x + 255), they could precisely manipulate card balances 14:56-16:03
• The card data contains "function mirrors" that reveal how to hack the system by showing relationships between different bytes 16:33-18:52
• While cards cannot be created from nothing due to location-specific site keys, having just one card from a location allows creating working cards for that location 19:43-21:34
• The vulnerability is unlikely to be fixed by companies because the cost of replacing hardware across North America exceeds potential losses 21:35-23:06
The researchers successfully demonstrated manipulating a card balance from $20 to $80 using a Prox Mark device and custom Python script 23:07-25:06.
Sources:
- 3:05-3:33 Introduction to Kiosoft and vulnerable systems
- 5:56-6:34 Discovery of balance storage format
- 14:56-16:03 Mathematical relationship between bytes
- 16:33-18:52(https://www.youtube.com/watch?v=BNOmou
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
Okay. Hello. I know I'm at the mic. I don't want to get screwed close. Right. So, hello everybody. Most people here I know. Um, so my name is Equip. I am Alexander and this is Lou. Hi. Oh, oh yeah. I do get to say hi. Um, so today we are presenting uh our paper. course is a white paper is uh it's called hung out to dry and it's airing the dirty laundry of store value washcards. Go back. Okay. >> U if you guys want the the paper or the Google slides, whatever it just scan the QR codes, right? Okie dokie. No, wait, wait, wait, wait. It's kind of all right. Okay. So, we did the yellow line. No. All right. So, this is our outline. Take a quick look cuz I'm not going to take a quick look cuz I'm not going to read through it. Okay. So, a quick disclaimer is that this is educational research only…