BEGIN:VCALENDAR
VERSION:2.0
PRODID:Data::ICal 0.24
BEGIN:VEVENT
DESCRIPTION:   'Title: Riding for Free - Breaking Public Transport RFID at 
 Scale\n   Tags: DEF CON Official Talk | Demo 💻 | Exploit 🪲\n   When:
  Friday\, Aug 7\, 15:30 - 16:30 PDT\n   Where: LVCCW Level 1 Hall 3 904 (M
 ain Track 4) and DCTV-4 - [1]Map\n\n   Description:\n\n   How many of you 
 tapped an RFID card to ride a train this year? How\n   many of you know wh
 at's actually stored on it? Every transit authority\n   in the world build
 s their own proprietary card formats\, and not one\n   has ever published 
 a spec. The security model is the same everywhere:\n   if nobody knows the
  format\, nobody can exploit it. I spent two years\n   testing that assump
 tion. Across 50+ cities and every major contactless\n   protocol\, I rever
 se engineered the proprietary data formats that\n   transit systems treat 
 as their last line of defense. Along the way I\n   built Metroflip\, an op
 en source transit card reader for the Flipper\n   Zero\, and found critica
 l vulnerabilities in Spain's two largest\n   transit systems that allow un
 limited free travel. On RENFE\, Spain's\n   national rail\, I cracked a pr
 oprietary checksum algorithm that lets\n   you directly modify trip counte
 rs\, expiry dates\, and zones on any card\n   in the country. On T-Mobilit
 at\, Barcelona's modern encrypted metro\n   platform\, I bypassed card-lev
 el crypto entirely by changing a single\n   byte in the mobile app's relay
 \, getting free trips and automatic\n   refunds. I'll walk through the met
 hodology\, demo the RENFE exploit\n   live on stage with a Flipper Zero\, 
 and share some hard lessons about\n   what happens when you try to respons
 ibly disclose vulnerabilities in\n   infrastructure you depend on every da
 y.\n\n   Garcia\, de Koning Gans\, Muijrers\, van Rossum\, Verdult\, Schre
 ur\,\n   Jacobs. "Dismantling MIFARE Classic." ESORICS 2008.\n   https://f
 laviodgarcia.com/publications/Dismantling.Mifare.pdf\n   Courtois\, N. "Th
 e Dark Side of Security by Obscurity." 2009. Darkside\n   attack on MIFARE
  Classic CRYPTO1. Anderson\, Ryan\, Chiesa. "Anatomy of\n   a Subway Hack.
 " DEF CON 16\, 2008. (Boston CharlieCard) Rauch\, B. "The\n   Boston Infin
 ite Money Glitch." DEF CON 31\, 2023. Garcia\, de Koning\n   Gans\, Verdul
 t. "Wirelessly Pickpocketing a Mifare Classic Card." IEEE\n   S&P 2009. NX
 P Semiconductors. "MIFARE DESFire EV2/EV3 Functional\n   Specification." (
 restricted distribution) Wouters\, Carroll. "Unsaflok:\n   Hacking Million
 s of Hotel Locks." DEF CON 32\, 2024. Rodriguez.\n   "Contactless Overflow
 ." DEF CON 31\, 2023. Hunt\, Nakache. "Hung Out to\n   Dry: Airing the Dir
 ty Laundry of Stored Value Washing Cards." 2025.\n   Metrodroid project. h
 ttps://github.com/metrodroid/metrodroid Metroflip\n   project. https://git
 hub.com/luu176/Metroflip Proxmark3 RRG.\n   https://github.com/RfidResearc
 hGroup/proxmark3 CRC RevEng catalogue.\n   https://reveng.sourceforge.io/c
 rc-catalogue/\n\n   SpeakerBio:  Aidan "luu176" Nakache\n\n   Aidan Nakach
 e is a 17-year-old CTO at dubblefilm\, where he leads\n   software and har
 dware development with a focus on automation\,\n   operational efficiency\
 , security\, and scalable growth. He develops and\n   maintains company se
 rvers\, hardware systems\, and transaction\n   equipment\, with much of hi
 s work centered around fintech\n   infrastructure\, system expandability\,
  and technology migration.\n\n   Alongside his role\, he is a cybersecurit
 y researcher and hardware\n   hacker specializing in RFID\, reverse engine
 ering\, and access-control\n   systems. He enjoys competing in CTFs at con
 ferences around the world\n   and has spoken at DEF CON 33 in the Radio Fr
 equency Hackers Sanctuary\n   village. He shares open-source work on GitHu
 b and continues to\n   collaborate and grow within the field.\n\n   '\n\n 
   1. #LVCCW_Level1_Hall3\n\n\n
DTEND:20260807T233000Z
DTSTART:20260807T223000Z
LOCATION:DEF CON Talks - LVCCW Level 1 Hall 3 904 (Main Track 4) and DCTV-4
SUMMARY:Riding for Free - Breaking Public Transport RFID at Scale
END:VEVENT
END:VCALENDAR