HACKING

.-. .-.  .--.   .---. .-. .-..-..-. .-. .---. 
| {_} | / {} \ /  ___}| |/ / | ||  `| |/   __}
| { } |/  /\  \\     }| |\ \ | || |\  |\  {_ }
`-' `-'`-'  `-' `---' `-' `-'`-'`-' `-' `---'

During our Special isse 27, I decided to do something with the chipknip cards I borrowed from the Houweling Telecom Museum. I wanted to do a tarot reading but I wanted the information of the future to be stored in the cards. I still don't know much about chip cards but through this bried experiment(I think C3, Josef and I spent a total of 3 days with this) we called it quits. It was hard and we didn't see any progress. I didn't have the time to experiment with Flipper(mentioned later down the page) which was unfortunate. There is also a small but in my opinion fascinating update at the end of this journey below. I didn't edit out my writing because I like how chaotic and bloggish I sound.

Side tracked from all the Time related stuff into the wondrous world of CardPeek and Telefoonkaarts or ChipKnip as a lot of people know them. I hope some day someone else goes to the Telecom Museum and they wonder, hey are these telefoonkaarts readable, rewritable, can I get some information out of them? Tldr; no. But this is not what it's about. It's about the process.

I think these chips are really important in the way that they hold an important part of transaction history. You can easily find out that they used to be used for everything especially in Rotterdam like being used as the only payment method for parking, and replaced a lot of cash. When they were still in circulation, there was a term for this: Chippen and I think Chipper, pinnen followed(not sure which came first, pinnen or chippen?). The ceaselessness of the Netherlands makes a lot more sense the more I learn about this. Is there more to know? Let me know.

Initial steps

Collect chippen. maybe from marktplaats

Get an EMV smart card reader that is suitable for chipped cards. maybe from coolbleu

Download Cardpeek?

Cardpeek

"Cardpeek is a Linux/Windows/Mac OS X tool to read the contents of ISO7816 smart cards."

Here is the GitHub for Cardpeek: https://github.com/L1L1/cardpeek

Here is what we followed at first and had errors after the make command.

We installed card peek by just installing it on Linux. I think we did something like: 

sudo apt-install cardpeek

Next:

autoreconf --install
./configure
make
make install

Joseph ran these commands one by one to see the specific error. I don't remember how we resolved it. Hehe, sorry this is not a great tutorial.

AID codes and .lua files(what the hell is lua)

In the dot_cardpeek_dir/scripts folder you can find all the analyser settings written in Lua language. I didn't know what Lua was before this, but followed the manuals tutorial and wrote a short Hello World card analysing script. If you want to do the same or look into how the card reading works atr.lua file is the best one to look at.

Here is the example lua script: 

   card.connect()

   atr = card.last_atr()

   if atr~=nil then
        root = nodes.root()

   mycard = root:append({ classname="card",
                               label="My card" })

        mycard:append({ classname="block",
                        label="Cold ATR",
                        size=#atr,
                        val=atr })

   end

   card.disconnect()

the last tag val is value and ' A val: the bytestring value displayed in the third column of the tree view (i.e. the hexadecimal value of the ATR).' This is how we tested the telefoonkaartjes. We tried all the France, Denmark and Norway ones as well. Alas! No luck.

Here is the guide book to Cardpeek and how it works, how it was built: CARDPEEK 0.8 Reference Manual(the original link is gone but there is this github substitue)

more AID codes and EMV file editing

On the scripts folder you can find the EMV.lua which has a section of AiD's. 

-- AID_LIST enhanced with information from Wikipedia
-- http://en.wikipedia.org/wiki/EMV

AID_LIST = { 
  "#A0000000031010",        -- Visa credit or debit
  "#A000000003101001",      -- VISA Credit
  "#A000000003101002",      -- VISA Debit
  "#A0000000032010",        -- Visa electron
  "#A0000000032020",        -- V pay
  "#A0000000033010",        -- VISA Interlink	
  "#A0000000034010",        -- VISA Specific	
  "#A0000000035010",        -- VISA Specific	
  "#A0000000036010",        -- Domestic Visa Cash Stored Value
  "#A0000000036020",        -- International Visa Cash Stored Value
  "#A0000000038002",        -- Barclays/HBOS		
  "#A0000000038010",        -- Visa Plus
  "#A0000000039010",        -- VISA Loyalty
  "#A000000003999910",      -- VISA ATM	
  "#A000000004",            -- US Debit (MC)
  "#A0000000041010",        -- Mastercard credit or debit 
  "#A00000000410101213",    -- MasterCard
  "#A00000000410101215",    -- MasterCard
  "#A000000004110101213",   -- Mastercard Credit
  "#A0000000042010",        -- MasterCard Specific
  "#A0000000043010",        -- MasterCard Specific
  "#A0000000043060",        -- Mastercard Maestro
  "#A0000000044010",        -- MasterCard Specific
  "#A0000000045010",        -- MasterCard Specific
  "#A0000000046000",        -- Mastercard Cirrus 
  "#A0000000048002",        -- NatWest or SecureCode Auth
  "#A0000000049999",        -- Mastercard
  "#A0000000050001",        -- UK Domestic Maestro - Switch (debit card) Maestro
  "#A0000000050002",        -- UK Domestic Maestro - Switch (debit card) Solo
  "#A0000000250000",        -- American Express (Credit/Debit)
  "#A00000002501",          -- American Express
  "#A000000025010402",      -- American Express
  "#A000000025010701",      -- American Express ExpressPay
  "#A000000025010801",      -- American Express
  "#A0000000291010",        -- ATM card LINK (UK) ATM network
  "#A0000000421010",        -- French CB
  "#A0000000422010",        -- French CB
  "#A00000006510",          -- JCB
  "#A0000000651010",        -- JCB
  "#A00000006900",          -- FR Moneo
  "#A000000098",            -- US Debit (Visa)
  "#A0000000980848",        -- Schwab Bank Debit Card
  "#A0000001211010",        -- Dankort Danish domestic debit card
  "#A0000001410001",        -- Pagobancomat Italian domestic debit card	
  "#A000000152",            -- US Debit (Discover)
  "#A0000001523010",        -- Diners club/Discover
  "#A0000001544442",        -- Banricompras Debito (Brazil)
  "#A0000001850002",        -- UK Post Office Card Account card
  "#A0000002281010",        -- SAMA Saudi Arabia domestic credit/debit card
  "#A0000002282010",        -- SAMA Saudi Arabia domestic credit/debit card
  "#A0000002771010",        -- Interac
  "#A0000003156020",        -- Chipknip
  "#A0000003241010",        -- Discover
  "#A0000003591010028001",  -- ZKA Girocard (Germany)
  "#A0000003710001",        -- InterSwitch Verve Card (Nigeria)
  "#A0000004540010",        -- Etranzact Genesis Card (Nigeria)
  "#A0000004540011",        -- Etranzact Genesis Card 2 (Nigeria)
  "#A0000004766C",          -- Google
  "#A0000005241010",        -- RuPay (India)
  "#A000000620",            -- US Debit (DNA)
  "#D27600002545500100",    -- ZKA Girocard (Germany)
  "#D5780000021010",        -- BankAxept Norwegian domestic debit card
}

In theory Cardpeeks EMV analyser should work for all of these cards but in reality this is so not the case. Wikipedia doesn't have a good collection of AID codes so I looked into this list: EFTlab AIDs. I added all the Proton, Chipknip, Netherlands related things to the list and tried again and again and again.

I then realised the AID information for Proton is listed as GP not EMV.

Conclusion: failure...

The chipknip cards are obsolete. This is just the truth. But we can get inspired by the sheer inconvenience and anonymity they provided and eventually changed the Netherlands. We can admire their cosmetic structure and how they represent the weird ad-esthetics of the guilder era.

There is a FAQs section of Cardpeek that reveals it is hard to overwrite a chipkaart that was not made with the intention of being overwritten. It is also clearly stated how cloning is not possible with Cardpeek. I still think it was possible to gather some information that could be used to scam people. I just don't believe that back in 2004 there was nobody using Cardpeek for honest reasons. But you never know!

Next possible steps:

I think I would like to see what else we can add to the simple ATR val reading part of the Hello World script. I think it is possible to see some sort of information, at this point I don't care what the information is.

Try another EMV reader?:

https://github.com/ansjdnakjdnajkd/emv/blob/master/README.md

Reading this thesis about the two competing companies that released two different chipknip(I think it Is chipper vs. chipknip) brands:

https://repub.eur.nl/pub/81/erimrs20010322174833.pdf

Update June 2026!

After our visit to the Studieverzameling, I am now 100% sure these cards could be hacked with the dolphin device Imane and Maritno suggested. Here is the link for it. Because I have seen something so incredible hidden behind boxes and at the last step of the musuem. After standing up for 3 hours listening to an old man yap... I coudln't believe my eyes. Behold, the og chipknip card reader:

I'm sad I didn't ask them if I could tinker with it. They will definitely say yes... Next time! I still have some borrowed cards from the Telecom museum ;)