HOWTO graft the RFID from a payment-card onto your phone

Hardware hacker Andrew "bunnie" Huang is living in Singapore, and he's finding it difficult to board the public transit system because he habitually carries so many RFID-embedded cards that the automated turnstiles can't get a read from his EZlink card. So he decided that he would remove the RFID from his transit card and delicately graft it onto the back of his cell phone ("transplanting RFID chips is a much cleaner solution from both the legal and technical perspective versus cracking the security and programming your own RFID to be compatible with the existing payment system. While many of the security systems used in RFID are already broken or have serious known vulnerabilities, I can't think of any country where the authorities would take kindly to you doing it.")

When cutting the chip out, be sure to leave the antenna contacts on either side, as these will be used to solder to the EZlink RFID chip's leadframe tabs. Below is a photo of the chip itself, after it has been freed of its bond to the antenna.
Next, lay some kapton tape down in the region of the RFID chip bonding area to protect the delicate antenna traces underneath. Slide the RFID chip in between the antenna contacts, and solder it down:
Soldering the chip takes a deft hand, since you're soldering onto soft plastic that will melt if you apply too much heat. However, a bit of solder flux applied before the operation and a temperature-controlled iron set to the lowest temperature that will still melt solder makes things easier.
And that's basically it! The final EZlink chip + grafted antenna assembly is very thin and flexible:

RFID Transplantation

I write books. My latest is a YA science fiction novel called Homeland (it's the sequel to Little Brother). More books: Rapture of the Nerds (a novel, with Charlie Stross); With a Little Help (short stories); and The Great Big Beautiful Tomorrow (novella and nonfic). I speak all over the place and I tweet and tumble, too.

MORE: Gadgets • singapore • transit

More at Boing Boing

Ants and Stars: Bruce Sterling and Jasmina Tesanovic visit the Sardinia Radio Telescope in Italy

The Snowden Principle

rebdav

Here is an idea, melt all three cards with acetone and harvest the chips, keep one antenna(assuming they all operate on the same freq) stick them down on a new card or the back of your phone and use some thin membrane switches like on cheap calculators to connect the antenna and ‘turn them on’ when scanning in or loading them with credit. This also fixes the privacy issue quite well since they only transpond when you want them to.
Marcel

Out here public transportation will switch to these ‘smartcards’ over the next few months as well.

So I bought a bicycle.
dayf

In the movie bug, the guy thinks the place is infested with aphids. I always wondered if this was a reference to RFIDS or just a coincidence.
- dequeued
  
  I do believe it is, I suspect
- spocko
  
  I love this idea! I don’t need something like that, but others might.
  I just wanted to give you some kudos for thinking of it!
dequeued

RFID is of the devil.
First, they want you to implant your cellphone, then, your hand.
It will be sold as a convenience.
Do not take the chip!

And, it’s pronounced “aphrid”, Afrid, being the Norse messenger for RagnarÃ¶k, a blatant pagan symbol of the New World Order.
You should be “afraid” of “aphrid”.

If you vote for Dr Minister Ron Paul, he will prevent the state from ever having the authority to implement such a draconian and Orwellian scheme.
Dr Ron Paul is “just what the doctor ordered” for this country.

You fools already tolerated the barcode, and, sadly, I fear for this great nation, accepting aphrid.
You don’t have to accept the barcode!
I take a box cutter with me to Wal Mart, and simply cut the barcodes off in protest before I get to the register, and have the cashier ring up my items by manually entering the serial numbers.
It may take a lot longer, but I at least have my soul.
- Headbone
  
  Dequeued. I can’t believe you are so anarchistic to hate barcodes on the products you buy. If I ever find myself in line behind you, I promise to introduce you to a bootprint on your ass and you will be dequeued. What are you hoping to gain? THE MAN realizes the futility of his evil ways because you thwart his plan to get you through the checkout faster? Just pay cash and wear a mustache so you don’t slow the rest of us down. And if you feel so strongly about such issues, why are you shopping at Walmart?
  
  RFID speeds up traffic through toll gates tremendously. OMG EVIL!
  
  Don’t get an RFID implant, wear my bootprint on your ass instead.
  
  Barcodes and RFIDs have great applications. I support your opposition of applying them to individual human beings. I oppose your opposition of their existence. Luddites are obselete. Go take your chickens for trade elsewhere today.
- Marcel
  
  What is of the devil is a system which is being sold as ‘more efficient’, but confronts you with a rise in travel fare of up to 30% on certain routes.
  
  Me, I’m just being a practical consumer.
awjtawjt

I no unnerstan. Why not just tape the whole EZ card to the back of the phone? Or carry it in a different pocket or wear a sombrero and stick it in your hatband?
- netsharc
  
  or, since his problem is 2 other RFID cards from 2 other different countries interfering with it, why don’t just leave those other cards at home?!?! Less bulk in your wallet, and if he’s afraid he’s going to forget them when he travels, put them next to his passport.
  - Anonymous
    
    The bonus side effect of keeping your out-of-whatever-country-you’re-in RFID cards away from your primary RFID vard and next to your passport is that it makes it that much harder to pull your passport’s RFID data from it.
    
    Heck, instead of a tinfoil hat/wallet, maybe you need to extend and embrace it all by putting as many RFID tags on your person to create a personal RFID wall of noise. Sort of like putting the blinking IR transmitter on yourself to confuse CCTV cameras.
    
    But I can understand not wanting to rubber band a card to your phone- it’s just that much cleaner to make it internal.
- Anonymous
  
  I had exactly the same thought — this seems like a complicated solution to a simple problem. Seems like taping or even rubberbanding the card to the phone does the same thing, and makes it easier to replace, too.
  
  On the other hand, it was probably a lot of fun to do, which makes it okay in my book.
- Anonymous
  
  Just leave some of the Tin Foil for the rest of us…
Clemoh

I used to own this Nokia 3220 that could read & write rfid info. I think it was developed to solve just this problem. Unfortunately, this technology is rarely seen in newer phones like the iphone or android handsets now, although it stands to reason that as this technology becomes more prevalent in credit cards, identification systems, and entry keys for home and automobile that it would be convenient to be able to compile all of your rfid transmitters into your phone and have the ability to activate them at your convenience. To some extent, if they were embedded in your phone, you could theoretically have them linked to GPS systems and automatically activate based on proximity, ie when you are near the entrance to your workplace, etc. Lots of kinks to work out as of yet with privacy and piracy issues.
http://mobilementalism.com/2005/12/12/prototype-nokia-3220-nfc-rfid-phone-could-reshape-society/
JonStewartMill

You don’t have to accept the barcode!
I take a box cutter with me to Wal Mart, and simply cut the barcodes off in protest before I get to the register, and have the cashier ring up my items by manually entering the serial numbers.
It may take a lot longer, but I at least have my soul.

Please tell me this is a Poe.
InsertFingerHere

Great (?) idea, until a hacking app for the iPhone comes out and simulates the function of this card .. and get flagged for waving your phone near a turnstile sensor.
Anonymous

frankly, a better way is for a wallet with rfid proof layers. ie: the outer most layer is where you put your active ezlink activated card, the inner most layers are protected by some magnetic flux diverting material (will aluminium foil do?) so that it becomes rfid proof and will not conflict with the active card.

my uob atm card is also an ezlink card, now that posb has replaced its posb everyday card with an ezlink type card, I can’t have them both in my wallet so POSB = you lose.
holtt

I was really thinking of stitching mine into a handkerchief. During cold & flu season it would be so handy to not have to fumble with cards and wallets and what not, just swipe the handkerchief to scan, and continue with nasal management!
bolamig

I call my “Clipper” RFID card for the San Francisco BART/Muni my “Clipper Chip” because it often denies me service for no good reason. Just today I automatically bought an electronic transfer with an outbound bus ride, then the system was down on my inbound ride so I couldn’t access the transfer.

I now carry five RFIDs on a regular basis: Fastrak bridge toll pass, car smart entry key, garage door key, front door key, and my Clipper. I also use a passport and passport card with RFIDs. Most require me to take them out to use them which is a pain, but it’s comforting to know that “the man” has similar trouble accessing them.

I don’t know whether to be afraid or comforted that the spooks advise me to keep the passport card in the provided foil-lined pouch.
Clemoh

Placing the card in a container of acetone will also reveal the chip and antenna a little more cleanly. Acetone will eat up the plastic card but will not damage the chip or the wiretape that acts as the antenna.
Baldhead

this does seem like a complicated solution to a simple problem. In my case the cell phone is usually in the same pocket so it would solve nothing. Also, why would it be pronounced “afrid” when the r is clearly before the f? It would logically be “arfid” wouldn’t it? Or, y’know just say the letters.
Anonymous

Is there a link or something? I really want to hack my EZLINK card as well, though it’s implanted inside a citi-bank credit card. I used to hide the card at the back side of my iPhone casing, but it seems mastering this technique will greatly reduce the awkwardness of of a bloated iPhone.
MythicalMe

Are you serious? I feel sorry for the person who rings up your order. Barcodes only represent numbers. The poor cashier, because of your ignorance, has to manually key the numbers because he/she likely has no other way to put in the price. It’s much easier to do with the barcode scanner.

Also, you’re confused. The Universal Product Code (UPC) was introduced as standard to be used between manufacturers and retailers. That’s the barcode most widely panned by Luddites such as yourself, but in fact there are many other types of barcodes and there are even scanners which read a dot pattern.

In my business, I use a barcode that doesn’t use numbers because all of my “product numbers” are alphabetic. To generate the barcode I use a font which prints the code on a label. It makes tracking the hundreds of items I stock much easier.
Toplus

I’m sure that tampering with the card in any way is still illegal
TNGMug

Hey man, if you take the word “RFID”, flip it backwards, upside down, flatten it, bath it in ketchup…. it looks remarkably like the Devil’s blood soaked pubes.

And if you think that’s a co-inidence THAT’S WHAT THEY WANT YOU TO BELIEVE!!
EeyoreX

This has been the bestest Boing Boing comment thread ever! LULZ 4REALZ!

Although I kinda suspect that this post, in itself, is deliberate trollbait.
I mean, gutting a RFID card just for the heck of it is probably a fun and educational exercise, but the whole convenience/privacy aspect of it seems contrived as all heck, as awjtawjt allready pointed out.

Me, I have a little pocket on my jacket sleeve into wich the card fits perfectly. I think those are becoming kinda common in modern city couture.
holtt

Be arfid. Very arfid.
Tweeker

Well I don’t take kindly to people who don’t take kindly.