Magnetic Stripes
Translated from Hack-Tik, #8, #9/10, available at PO Bos 22953,1100
DL Amsterdam, The Netherlands
Translation by Dr. Abuse
Text/Schematics _copied_ from 2600 Magazine, Summer 1991 by:
* ..oooOO Count Zero OOooo.. *
* *
* -=Restricted -=Data -=Transmissions *
* *
* "Truth is cheap, but Information COSTS!" *
(Read _my_ article on Magstripe Technology in Phrack #37 if you want
_detailed_ descriptions of encoding tech, specification, etc. -c0 )
People KEEP ASKING me about this article that appeared in 2600,
and many people wanted the schematics. I figured I might as well
type it up in order to help spread the info around as efficiently as
possible. I hand-drew the schematics in 320x200 .GIF format.
Enjoy, and remember to always SHARE the knowledge...
(The following is a VERBATIM copy of Dr. Abuse's translation.
Thanks Doc!)
"Cash is out. Plastic is in. In the nineties, the question is:
who has the best hand of cards? We will help you play the big
magnetic card game.
Everybody has looked at those credit cards and wondered what
exactly was on them. Whoever dared to even ask about magnetic
readers/writers was shocked after hearing the price and they went
back to their daily living. And this while you would be very
anxious to know what the bits and bytes mean.
We now give you the opportunity to build your own credit card
reader/writer. For the cost of playing around with electronics plus
a few dollars, you can build your own magnetic card copier. This
device reads from one magnetic card and puts the data out onto the
other card. For the advanced electronic hobbyist, there is the
magnetic card reader and writer. Everybody who knows ehat a TTL is
and can squeeze something out of his computer and/or hold a
soldering iron will be able to make this credit card reader/writer
together with the schematics.
Far more interesting than all of the electronic mumbo-jumbo is to
first see what's really on the magnetic stripe. For that we give
you the first bit of information in this article.
The information on most credit cards is stored in binary form.
These ones and zeros are stored by changing the magnetic field of
the magnetic head by 180 degrees. To see what's really on the card,
you put some iron filings on the magnetic strip and tap the card
gently onto the edge of the table (keep paper underneath it because
it probably would have cost you lots of effort to make the iron
filings) and behold! Here's your magnetic information, plainly
cidible to the eye. Some cards have such big bits that you
theoretically should be able to change the information on it with a
magnetized razor blade (Paris Metro cards are a good example). On
other cards, the bits are so close to each other that you will only
see a magnetized solid bar.
To store away the information on magnetic cards, some
international standars were developed by ISO - the International
Standards Organization. To name one: the magnetic stripe is divided
up into three tracks. A lot of manufatcurers use other coding
methods to write the cards with and only the iron filing method will
give you insight as to what's on the card in these instances.
The first project as amntioned before is to copy the information
from magnetic card to another. This means that it doesn't matter
whether the information is encoded or not since you are just
copying. The only thing you need to know is the exact location and
height of the track with the information that you want to copy. As
long as the write head of your copier is bigger than the mangnetic
strip, you are safe. See the schematic on this page. (Schematic #1)
The Credit Card Copier
At the left of schematic #1 you will see the read head. For this
(as well as the write head) you cannot use any cassette player head
which happens to be lying around. You will need to use a data head
or a card reader head (you can obtain them from Michigan Magnetics
among others). If the head is bigger than the track you are reading
from, you will pick up extra noise but if the head is too small, the
signal might become too weak. Experimenting with the gain is
essential. The write head should be as big as possible unless you
want to write more than two narrow tracks next to each other.
Between points A and B you can jput a pair of headphones (which you
have put in series). If you pass the read head along the stripe,
you will hear a sound that might be familiar to you hobbyists who
used to once work with data cassettes. Now you will need to find a
way to make the read and write head go simultaneously along both
cards. The trick for this is to take a piece of wood and mount both
heads on both ends of it. Attach the cards (with scotch tape) to a
solid surface and gently slide the heads along both cards (making
sure that the heads go in parallel with the magnetic stripe).
There are, however, cards on which the infomation is not put on
the stripe at a nintey degree angle. If you see something like that
(using the iron filing method) you will have to adjust the position
on which the heads are mounted. A little trick to adjust the heads
is to replace the 220 ohms resister in front of the headphones by a
100 nF capacitor and then listening until you find the angle that
gives you the highest pitch sound.
You can only write to a card which you have erase previously by,
for instance, a demagnetizer. To doublecheck if your copy is good,
you can listen to it by passing the read head over it and checking
to see if the sound of the original and the copy are the same. We
found ou that the human ear is a very accurate meter to indicate the
accuracy of the copy. One last word about the dual opamp - pins 4
and 8 of that chip are used to supply positive and negative voltage
(see schematic #3).
The Reader/Writer
This schematic reads and writes to the same head. If you want to
write something with this schematic, you will have to come up with a
device which has a very accurate constant speed, like a modified
printer. The most suitable device, though, would be a real
reader/writer mechanism.
Most opamps want to have a positive as well as a negative
voltage. But by means of an active voltage divider (see schematics)
we can supply the whole card reader from one 12 volt power supply.
The active voltage dicider is used twice in the reader/writer.
First of all to divide the 12 volt down to 6 volts (in order to do
this you put a 5.8 kohm resistor where the asterisks are in the
schematic). The second voltage divider you make by putting a 3.3
kohm at that spot. This is done to divide the 5 volts out of your
computer into 2.5 volts. The best thing to do is to plave a relay
on the write line going to the head. This is so as not to introduce
noise while reading form the card.
Now all you need is an interface that can control the motor fo
your read/write unit and which can exchange the bits with the
circuitry described above. What you can do then is make binary
copies of your card. The credit card reader/writer can only be used
on cards which store their information in binary form, so go and
check first with iron filings.
In this section, we will describe several data formats which are
used in credit cards. We will only describe the three tracks as
they were described by ISO. On the third track a large quantity of
formats are used. Only two of them are published here. The real
formats as they are used by banks tend to differ from the original
ISO standards but a little bit of research can do miracles on these
occasions. You might wonder how the bits as described later are
encoded onto the card because the schematic as we described above is
only capable of putting 180 degree magnetic field changes onto the
card. To explain that we use track 2 because the bits are
physically the largest and this ought to work with homemade
electronics.
Track 2
The bits are encoded as follows: they are separated by reversing
the magnetic field. These reversals make the output of your reader
go from one to zero or vice versa. Beware: the fact of whether or
not it's a one or zero is not important, but the change in polarity
is important. And now, to make it even more complicated, not only
is there a magnetic reversal between tow bits but also in the middle
of a binary one is a reversal. So if you have a constant moving
head over your card, software should be able to determine whether
they are reading a zero or a one. In fact, nobody is capable of
speeding up the speed of his reading head twice within the time
period of one bit. THerefore, even a constant speed is not
required. SO you will get away with cheap, lousy equipment.
Now you have a whole lot of ones and zeroes inside your computer
and you still don't know anything. The important thing here is to
know the bit stream starts at the left side of the card so the strip
is being read from right ot left and after a couple of zeroes the
data will start in the following format: P1248P1248 etc.
The P stands for parity bit and the 1,2,4,8 stand for the
decimal values that they represent (0001 0010 0100 1000). If you
decode this, there is your data, which is similar to Track 2
specifications (ABA). How the LRC character work (a checksum) we
don't know yet. BUt our mailbox is open to any suggestions."
---Well, there is it. Pretty damn good. If you want greater
detail, be sure to check out my article in Phrack #37. Happy
hunting!
..oooOO Count Zero OOooo.. *cDc* -=RDT