DEFCON 33 RF Village Hung out to dry: Airing the dirty laundry of stored value washing cards

Presented by Aidan Nakache & Equip Aidan is a 16-year-old cybersecurity researcher and hardware hacker with a focus on RFID, reverse-engineering, and access-control systems. He developed the Metroflip app for the Flipper Zero, enabling metro-card interaction, and has also cloned AirTags onto microcontroller boards using BLE and reverse-engineering techniques. Aidan competes in CTFs, earning second place at Bsides Las Vegas, and shares his open-source work on GitHub (luu176) to connect with like-minded peers. Equip is an access control researcher based in Britain, with a focus on RFID systems. Known for his hands-on approach, he’s often found experimenting with RF tech and spreading the good word. Equip is an active contributor in RFID-focused Discord communities, where he regularly helps others troubleshoot and learn. He shares his RFID projects and discoveries on GitHub & Gists, making his work accessible for others in the field. This talk details a comprehensive reverse engineering analysis of stored-value laundry cards, prevalent in facilities worldwide. The widespread adoption of localised contactless payment solutions, attributed to their convenience, necessitates understanding their internal operations. This analysis explores the mechanisms behind value storage and modification within these cards. During this investigation, a data structure was identified that presented a significant vulnerability. The implications of this vulnerability raise serious concerns, which extend beyond laundry facilities, potentially impacting the security of similar contactless systems globally.