Intro
During my participation in the DragonJAR conference as speaker, I had the opportunity to play with the PortaPack device during my trip. This beautiful device is a perfect add-on to my HackRF. Imaging that you have all the powerful features of the HackRF hardware and now add portability!
I updated the PortaPack and HackRF firmware. For the PortaPack, I used the impressive and beautiful Havoc version.
As security researcher, I was wondering if it was posible to use the PortaPack for a replay attack using tokenized NFC card or mag-stripe information to make a transaction. Basically, the idea was to implement somehow this device to achieved that purpose.
To understand properly how to generate Audio Spoof and how it works, we should take a look at previous posts:
Hardware
To read some data directly from the PortaPack, I had to create a magnetic stripe radio station to transmit the signal using a FM transmitter. At this point, I had two choices: The Elechouse FM transmitter or the Zus universal car adapter:
The connection was straightforward. I decided to use the Zus FM transmitter, so I implemented a Bluetooth connection from my laptop to the device:
After this, I was able to play a WAV file to be transmitted by Bluetooth and see if I can receive something in the PortaPack listening mode. The best way to do it is using a waterfall view:
To generate a magnetic field using this WAV encoding, I had to add a coil in the jack output of the PortaPack:
Software
For the mag-stripe audio generation part, I had two options. One was the AudioSpoof repository or the ViolentMag code. I decided to use the ViolentMag with a few changes in the original mag-stripe recommendation.
Normally, we can create mag-stripe audio files with 25 leading zeros:
But to have better results and avoid noise in the initial part of the receiving, I decided to use 100 leading zeros in the WAV generation:
Now, I just added a special coil in the jack output of the PortaPack; so it generates a magnetic field following the WAV file encoding which is detect by the card reader. Testing everything together:
With a few changes, this project could be implemented in Arduino, for example.
Salvador Mendoza 