MOBIB

See also RFID

Technology

• STIB site about MOBIB (MIVB)
• ASK, the card manufacturer
• Press releases
  • here (en)
  • here (fr)
• On wikipedia:
  • Calypso, see also here
  • MoBIB (fr)
  • Passe Navigo (fr) is not fully ISO14443-B compliant (Innovatron "standard", also referred as type B') so without proper reader it can be accessed only via contacts. Mobib readers cannot read Navigo pass, so no compatibility whatsoever with the anonymous Navigo card, sigh.

• Cards:
  • ASK dual interface cards, according to the ASK productsheet for Calypso a CD21 of 8K bytes with as IC a ST19WR08 from ST Microelectronics
  • C.ticket in the future?
• Other cities with Calypso (pdf)

Security/Privacy

• On the news:
  • 2011-06-02 La vidéo d'un possible piratage du système Mobib circule sur le Net
    • Une première vidéo a circulé puis a été retirée rapidement, une deuxième est toujours visible sur Youtube
    • Ces vidéos sont plus que probablement des faux, montrant tout au plus le problème connu depuis 2009 de confidentialité des données de l'usager. La confusion d'outils liés à la Mifare alors que la Mobib est de technologie Calypso et d'autres inepties dans la première vidéo tentent à confirmer ce fait.
    • Voir aussi l'interview de Gildas Avoine sur TVBrussel.
  • 2011-03-22 MOBIB: la STIB craint la justice (fr)
  • 2010-12-02 La STIB veut sécuriser la carte Mobib (fr)
  • 2010-08-05 La STIB communique-t-elle les données de ses clients à des tiers? (fr)
  • 2010-07-06 Mobib: intrusion dans la vie privée (fr)
  • 2010-06-30 La Ligue des Droits de l'Homme s'en mêle... (fr)
  • 2010-01-13 According to SpringCard, Atmel has released a 14443-B card where one can very easily program the UID (PUPI), demo with a Mobib.
  • 2009-08-27 Carte blanche (fr, in Le Soir) by François-Xavier Standaert & François Koeune about what should be expected from a metro ticket
    • The full version on UCL website
  • 2009-01-16 Flanders will also make a MOBIB card
  • 2009-01-09 La carte Navigo belge peut jouer les indics (fr)
  • 2009-01-09 Mobib : la carte trop curieuse (fr, in Le Soir)
  • 2009-01-09 UCL have shown anybody can read it, see your name, date of birth and details on last three payments. Some say the Navigo pass contains also details of the last three badgings.
• Privacy Commission, about the access STIB has on the National Registry in the context of the introduction of MOBIB & external suppliers
  Objet : demande de la S.T.I.B. visant à obtenir l'extension des autorisations en sa possession (RN/MA/2007/056)
  Betreft: aanvraag van de MIVB tot uitbreiding van de machtigingen waarover zij beschikt (RN/MA/2007/056)
  • Délibération RN n° 05/2008 du 23 janvier 2008
  • Beraadslaging RR nr. 05/2008 van 23 januari 2008
• Voir aussi le dossier de la Ligue des Droits de l'Homme

Tools

• UCL software to read Mobib cards (mobib extractor) seems to not be available anymore, but there is still a copy here
• SpringCard offers a SDK with a Calypso explorer for Windows and its sources, find here the SDK PC/SC for Calypso. See also their blog post
• An article from P. Gueulle describes a program in Basic to dump the memory content of a Calypso card
• Cardpeek is a Linux tool to read the contents of ISO7816 smartcards. It features a GTK GUI to represent card data is a tree view, and is expandable with a scripting language (LUA). The tool currently reads the contents of: EMV cards, Navigo public transport cards, Moneo ePurse cards and the French health card "Vitale 2"
• you may try Edouard Lafargue's tool
• UCL researchers wrote a nice article (in French) in MISC Mag #48 on how to read a Navigo card, see pages 74-82

Disclaimer

Under Belgian law of 28 november 2000 relative to computer/cyber criminality, is punishable the one, knowing he was not allowed to do so, accesses a computing system.
Without exception for academic security research.
Without need for demonstrating an intention of bad behavior.
Without need for demonstrating an intention of getting financial benefit (=fraud).
The sole intention to access the computing system is also punishable.

And, oh, btw, apparently your Mobib is not yours, it's STIB property.
Now, don't say I didn't warn you.

As pointed out on this blog, this may explain why UCL researchers removed their tool from their website, as it's hard to write such a tool without reading any Mobib and considering who owns the transport card company and who subsides the university... Sound a bit like a conspiracy, but we can't say for sure.

So this is how you can deploy a privacy-savvy technology in Belgium: no technical protection whatsoever required as there is already a law prohibiting to read the unprotected data. And you won't be blamed as anyone demonstrating publicly that your technology is a privacy nightmare is committing a crime.
Quod erat demonstrandum.