Card-O-Rama: Magnetic Stripe Technology and Beyond
Card-O-Rama: Magnetic Stripe Technology and Beyond
Rama: Magnetic
Stripe Technology
and Beyond
or
"A Day in
the Life of a Flux
Reversal"
Written by
Restricted Data
Transmissions
November 22, 1992
*DISCLAIMER*
*A WARNING*
**
MAGSTRIPE FIELDS,
HEADS, ENCODING/
READING **
First, I am going to
explain the basics
behind fields, heads,
encoding and
reading. Try and
absorb the THEORY
behind encoding/
reading. This will
help
you greatly if you
ever decide to build
your own encoder/
reader from scratch
(more on that later).
FERROMAGNETIC
materials are
substances that
retain
magnetism after an
external magnetizing
field is removed.
This principle is
the basis of ALL
magnetic recording
and playback.
Magnetic POLES
always occur
in pairs within
magnetized material,
and MAGNETIC FLUX
lines emerge from
the
NORTH pole and
terminate at the
SOUTH. The
elemental parts of
MAGSTRIPES are
ferromagnetic
particles about 20
millionths of an inch
long, each of which
acts
like a tiny bar
magnet. These
particles are rigidly
held together by a
resin
binder. The magnetic
particles are made by
companies which
make coloring
pigments for the
paint industry, and
are usually called
pigments. When
making
the magstripe media,
the elemental
magnetic particles
are aligned with their
North-South axes
parallel to the
magnetic stripe by
means of an external
magnetic fields while
the binder hardens.
An unencoded
magstripe is actually
a series of North-
South magnetic
domains
(see Figure 1). The
adjacent N-S fluxes
merge, and the entire
stripe acts as a
single bar magnet
with North and South
poles at its ends.
Figure 1: N-
S.N-S.N-S.N-S.N-
S.N-S.N-S.N-S <-
particles in stripe
---------
represented as->
N--------------------
---------S
However, if a S-S
interface is created
somewhere on the
stripe, the fluxes will
REPEL, and we get a
concentration of flux
lines around the S-S
interface (same
with N-N interface).
ENCODING consists
of creating S-S and
N-N interfaces, and
READING consists of
(you guessed it)
detecting 'em. The
S-S and N-N
interfaces
are called FLUX
REVERSALS.
||| |||
<-flux lines
Figure 2:
N------------N-N-S-
S-----------------S
--------- flux lines
-> ||| |||
The external
magnetic field used
to flip the polarities is
produced by a
SOLENOID, which
can REVERSE its
polarity by reversing
the direction of
CURRENT.
An ENCODING head
solenoid looks like a
bar magnet bent into
the shape of a ring
so that the North/
South poles are very
close and face each
other across a tiny
gap. The field of the
solenoid is
concentrated across
this gap, and when
elemental magnetic
particles of the
magstripe are
exposed to this field,
they
polarize to the
OPPOSITE (unlike
poles attract).
Movement of the
stripe past
the solenoid gap
during which the
polarity of the
solenoid is
REVERSED will
produce a SINGLE
flux reversal (see
Figure 3). To erase a
magstripe, the
encoding head is
held at a CONSTANT
polarity and the
ENTIRE stripe is
moved
past it. No flux
reversals, no data.
||
<----wires leading to
solenoid
||
(wrapped around
ring)
/-|-|-
\
/ \
Figure 3: |
| <----solenoid (has
JUST changed
polarity)
---------
\ /
\N
S / <---gap in ring..
NS polarity across
gap
N--------------------
--SS-
N--------------------
-----S
^^
<<<<<-
direction of stripe
movement
S-S flux
reversal created at
trailing edge of
solenoid!
magstripe---
> -------NN--------
SS--------
NN---------SS------
Figure 4:
voltage-----> .......
+.........-.........
+...........-.....
---------
----------
-------------
peak
readout--> | |
| |
--------|
|----------|
|----
Figure 5:
----------
----------
----------
--------- | |
| | | | <-
peak
a) |
|--------|
|--------| |
readouts
* 0 * 0
* 0 * 0 * 0 *
----- -----
----- ----- -----
-
| | | | |
| | | | | |
b) | |----|
|----| |----| |----|
|----|
* 1 * 1
* 1 * 1 * 1 *
-----
---------- -----
----- -
| | | |
| | | | |
c) | |----|
|--------| |----|
|----|
* 1 * 0
* 0 * 1 * 1 *
**
ANSI/ISO BCD Data
format **
* Remember that b1
(bit #1) is the LSB
(least significant bit)!
* The LSB is read
FIRST!
* Hexadecimal
conversions of the
Data Bits are given in
parenthesis (xH).
--Data Bits--
Parity
b1 b2 b3 b4
b5 Character
Function
0 0 0 0 1
0 (0H) Data
1 0 0 0 0
1 (1H) "
0 1 0 0 0
2 (2H) "
1 1 0 0 1
3 (3H) "
0 0 1 0 0
4 (4H) "
1 0 1 0 1
5 (5H) "
0 1 1 0 1
6 (6H) "
1 1 1 0 0
7 (7H) "
0 0 0 1 0
8 (8H) "
1 0 0 1 1
9 (9H) "
0 1 0 1
1 : (AH) Control
1 1 0 1
0 ; (BH) Start
Sentinel
0 0 1 1 1
< (CH) Control
1 0 1 1 0
= (DH) Field
Separator
0 1 1 1 0
> (EH) Control
1 1 1 1
1 ? (FH) End
Sentinel
***** 16
Character 5-bit Set
*****
10 Numeric
Data Characters
3 Framing/
Field Characters
3 Control
Characters
The magstripe
begins with a string
of Zero bit-cells to
permit the self-
clocking feature of
biphase to "sync"
and begin decoding.
A "Start Sentinel"
character then tells
the reformatting
process where to
start grouping the
decoded bitstream
into groups of 5 bits
each. At the end of
the data, an "End
Sentinel" is
encountered, which
is followed by an
"Longitudinal
Redundancy
Check (LRC)
character. The LRC
is a parity check for
the sums of all b1, b2,
b3, and b4 data bits
of all preceding
characters. The LRC
character will catch
the remote error that
could occur if an
individual character
had two
compensating errors
in its bit pattern
(which would fool the
5th-bit parity
check).
The START
SENTINEL, END
SENTINEL, and LRC
are collectively called
"Framing
Characters", and are
discarded at the end
of the reformatting
process.
**
ANSI/ISO ALPHA
Data Format **
Alphanumeric data
can also be encoded
on magstripes. The
second ANSI/ISO
data
format is ALPHA
(alphanumeric) and
involves a 7-bit
character set with 64
characters. As
before, an odd parity
bit is added to the
required 6 data bits
for each of the 64
characters. See
Figure 7.
Figure 7:
---------
ANSI/ISO ALPHA
Data Format
* Remember that b1
(bit #1) is the LSB
(least significant bit)!
* The LSB is read
FIRST!
* Hexadecimal
conversions of the
Data Bits are given in
parenthesis (xH).
------Data
Bits------- Parity
b1 b2 b3 b4
b5 b6 b7
Character Function
0 0 0 0 0
0 1 space (0H)
Special
1 0 0 0 0
0 0 ! (1H) "
0 1 0 0 0
0 0 " (2H) "
1 1 0 0 0
0 1 # (3H) "
0 0 1 0 0
0 0 $ (4H) "
1 0 1 0 0
0 1 % (5H)
Start Sentinel
0 1 1 0 0
0 1 & (6H)
Special
1 1 1 0 0 0
0 ' (7H) "
0 0 0 1 0
0 0 ( (8H) "
1 0 0 1 0
0 1 ) (9H) "
0 1 0 1 0
0 1 * (AH) "
1 1 0 1 0 0
0 + (BH) "
0 0 1 1 0
0 1 , (CH) "
1 0 1 1 0 0
0 - (DH) "
0 1 1 1 0 0
0 . (EH) "
1 1 1 1 0 0
1 / (FH) "
0 0 0 0 1
0 0 0 (10H)
Data (numeric)
1 0 0 0 1
0 1 1 (11H) "
0 1 0 0 1
0 1 2 (12H) "
1 1 0 0 1 0
0 3 (13H) "
0 0 1 0 1
0 1 4 (14H) "
1 0 1 0 1 0
0 5 (15H) "
0 1 1 0 1 0
0 6 (16H) "
1 1 1 0 1 0
1 7 (17H) "
0 0 0 1 1
0 1 8 (18H) "
1 0 0 1 1 0
0 9 (19H) "
0 1 0 1 1 0
0 : (1AH)
Special
1 1 0 1 1 0
1 ; (1BH) "
0 0 1 1 1 0
0 < (1CH) "
1 0 1 1 1 0
1 = (1DH) "
0 1 1 1 1 0
1 > (1EH) "
1 1 1 1 1 0
0 ? (1FH) End
Sentinel
0 0 0 0 0
1 0 @ (20H)
Special
1 0 0 0 0
1 1 A (21H)
Data (alpha)
0 1 0 0 0
1 1 B (22H) "
1 1 0 0 0 1
0 C (23H) "
0 0 1 0 0
1 1 D (24H) "
1 0 1 0 0 1
0 E (25H) "
0 1 1 0 0 1
0 F (26H) "
1 1 1 0 0 1
1 G (27H) "
0 0 0 1 0
1 1 H (28H) "
1 0 0 1 0 1
0 I (29H) "
0 1 0 1 0 1
0 J (2AH) "
1 1 0 1 0 1
1 K (2BH) "
0 0 1 1 0 1
0 L (2CH) "
1 0 1 1 0 1
1 M (2DH) "
0 1 1 1 0 1
1 N (2EH) "
1 1 1 1 0 1
0 O (2FH) "
0 0 0 0 1
1 1 P (30H) "
1 0 0 0 1 1
0 Q (31H) "
0 1 0 0 1 1
0 R (32H) "
1 1 0 0 1 1
1 S (33H) "
0 0 1 0 1 1
0 T (34H) "
1 0 1 0 1 1
1 U (35H) "
0 1 1 0 1 1
1 V (36H) "
1 1 1 0 1 1
0 W (37H) "
0 0 0 1 1 1
0 X (38H) "
1 0 0 1 1 1
1 Y (39H) "
0 1 0 1 1 1
1 Z (3AH) "
1 1 0 1 1 1
0 [ (3BH)
Special
0 0 1 1 1 1
1 \ (3DH)
Special
1 0 1 1 1 1
0 ] (3EH)
Special
0 1 1 1 1 1
0 ^ (3FH) Field
Separator
1 1 1 1 1 1
1 _ (40H)
Special
***** 64
Character 7-bit Set
*****
* 43
Alphanumeric Data
Characters
*3
Framing/Field
Characters
* 18
Control/Special
Characters
The two ANSI/ISO
formats, ALPHA and
BCD, allow a great
variety of data to be
stored on
magstripes. Most
cards with
magstripes use these
formats, but
occasionally some do
not. More about
those later on.
**
Tracks and Encoding
Protocols **
Now we know how
the data is stored.
But WHERE is the
data stored on the
magstripe? ANSI/ISO
standards define *3*
Tracks, each of which
is used for
different purposes.
These Tracks are
defined only by their
location on the
magstripe, since the
magstripe as a whole
is magnetically
homogeneous. See
Figure 8.
Figure 8:
--------- <edge
of card>
_______________________
_______________________
___________________
| ^
^ ^
|------------------|
0.223"--|---------|--
---------------------
--
| |
| 0.353" | ^
|..................|.........|.....
....| 0.493" |
| Track #1
0.110" | |
|
|............................|.....
....|...
<MAGSTRIPE>
|
| | |
|............................|.....
....|... |
| Track #2
0.110" |
|
|..................................
....|... |
|
| |
|..................................
....|... |
| Track #3
0.110"
|
|..................................
........ |
|
|
|---------------------
---------------------
---------------------
---
|
|
<body of card>
|
Figure 9:
--------- ANSI/
ISO Track 1,2,3
Standards
Track Name
Density Format
Characters
Function
---------------------
---------------------
---------------------
-----
1 IATA 210
bpi ALPHA 79
Read Name &
Account
2 ABA 75
bpi BCD 40
Read Account
3 THRIFT
210 bpi BCD
107 Read
Account &
*Encode* Transaction
| SS | FC |
PAN | Name | FS |
Additional Data | ES |
LRC |
SS=Start Sentinel
"%"
FC=Format Code
PAN=Primary Acct. #
(19 digits max)
FS=Field Separator
"^"
Name=26
alphanumeric
characters max.
Additional
Data=Expiration
Date, offset,
encrypted PIN, etc.
ES=End Sentinel "?"
LRC=Longitudinal
Redundancy Check
| SS | PAN |
FS | Additional Data
| ES | LRC |
Track 3 is unique. It
was intended to have
data read and
WRITTEN on it.
Cardholders would
have account
information
UPDATED right on
the magstripe.
Unfortunately, Track
3 is pretty much an
orphaned standard.
Its *original*
design was to control
off-line ATM
transactions, but
since ATMs are now
on-line
ALL THE TIME, it's
pretty much useless.
Plus the fact that
retailers and banks
would have to install
NEW card readers to
read that track, and
that costs $$.
Encoding protocol
specifies that each
track must begin and
end with a length
of all Zero bits, called
CLOCKING BITS.
These are used to
synch the self-
clocking feature of
biphase decoding.
See Figure 10.
Figure 10:
end sentinel
start
sentinel |
longitudinal
redundancy check
|
| |
000000000000000
SS.................ES LRC
0000000000000000
leading
data, data, data
trailing
clocking bits
clocking bits
(length varies)
(length varies)
** A Bit
About Magstripe
Equipment **
2600 Magazine
recently had a good
article on how to
build a machine that
copies
magstripe cards. Not
much info on the
actual data formats
and encoding
schemes, but the
device described is a
start. With some
modifications, I bet
you could route the
output to a dumb
terminal (or thru a
null modem cable) in
order to READ the
data. Worth
checking out the
schematics.
As for making your
own cards, just paste
a length of VCR, reel-
to-reel, or
audio cassette tape
to a cut-out
posterboard or
plastic card. Works
just as
good as the real
thing, and useful to
experiment with if
you have no expired
or
'dead' ATM or calling
cards lying around
(SAVE them, don't
TOSS them!).
**
Examples of Data on
Magstripes **
Track 2 (BCD,75
bpi)-> ;
1111222233334444=
9912101000000000
0000?
***
Track 1 (ALPHA,210
bpi)->
%B11112222333344
44^PUBLIC/JOHN?
*
Note that the "101"
was common to all
MC cards checked,
as well as the "B".
---------------------
---------------------
---------------------
----------------
-=VISA=- Number on
front of card -> 1111
2222 3333 4444
Expiration date
-> 12/99
Track 2 (BCD,75
bpi)-> ;
1111222233334444=
9912101xxxxxxxxxxxx
x?
***
Track 1 (ALPHA,210
bpi)->
%B11112222333344
44^PUBLIC/
JOHN^9912101xxxxx
xxxxxxxx?
*
Track 2 (BCD,75
bpi)-> ;
1111222233334444=
991210100000?
********
Track 1 (ALPHA,210
bpi)->
%B11112222333344
44^PUBLIC/
JOHN___^991210100
000?
********
Note, the "10100000"
and "B" were
common to most
DISCOVER cards
checked. I
found a few that had
"10110000" instead.
Don't know the
significance. Note
the underscores after
the name JOHN. I
found consistently
that the name data
field had *26*
characters.
Whatever was left of
the field after the
name was
"padded" with
SPACES. So...for all
of you with names
longer than 25
(exclude
the "/") characters,
PREPARE to be
TRUNCATED! ;)
---------------------
---------------------
---------------------
----------------
-=US Sprint FON=-
Number on front of
card -> 111 222 3333
4444
Track 2 (BCD,75
bpi)-
> ;xxxxxx1112223333
9==xxx4444xxxxxxx
xxx=?
*
Track 1 (ALPHA,210
bpi)-> %B^ /
^^xxxxxxxxxxxxxxxxx
?
*
Track 2 (BCD,75
bpi)-> ;
1111112223333333=
9912120100000000x
xxx?
****
Track 1 (ALPHA,210
bpi) ->
%B111111222333333
3^PUBLIC/
JOHN___^991212010
0000000000000xxx
x000000?
*
****
Track 2 (BCD,75
dpi)-> ;
1111222333333=991
2101?
*******
**
Cards of All Flavors
**
People wanted to
store A LOT of data
on plastic cards. And
they wanted that
data to be 'invisible'
to cardholders. Here
are the different card
technologies that
were invented and
are available today.
HOLLERITH - With
this system, holes are
punched in a plastic
or paper card and
read optically.
One of the earliest
technologies, it is
now seen
as an encoded
room key in hotels.
The technology is not
secure,
but cards are
cheap to make.
BAR CODE - The use
of bar codes is
limited. They are
cheap, but there is
virtually no
security and the bar
code strip can be
easily damaged.
INFRARED - Not in
widespread use,
cards are factory
encoded by creating
a
"shadow
pattern" within the
card. The card is
passed thru a swipe
or insertion
reader that uses an
infrared scanner.
Infrared card
pricing is
moderate to
expensive, and
encoding is pretty
secure.
Infrared
scanners are optical
and therefore
vulnerable to
contamination.
PROXIMITY - Hands-
free operation is the
primary selling point
of this card.
Although
several different
circuit designs are
used, all proximity
cards permit
the transmission of a
code simply by
bringing the card
near the
reader (6-12").
These cards are quite
thick, up to
0.15" (the ABA
standard is 0.030"!).
WIEGAND - Named
after its inventor, this
technology uses a
series of small
diameter wires
that, when subjected
to a changing
magnetic field,
induce a
discrete voltage
output in a sensing
coil. Two rows of
wires are
embedded in a
coded strip. When
the wires move past
the read head,
a series of pulses is
read and interpreted
as binary
code. This
technology produces
cards that are VERY
hard to copy
or alter, and
cards are moderately
expensive to make.
Readers
based on this
tech are epoxy filled,
making them immune
to weather
conditions,
and neither card nor
readers are affected
by external
magnetic
fields (don't worry
about leaving these
cards on top of
the television
set...you can't hurt
them!). Here's an
example of
the layout of
the wires in a
Wiegand strip:
||| || || | ||| |
|| || | || || | | ||
| | || ||
|||| || |||| ||
**
Magstripe Coercivity
**
Magstripes
themselves come in
different flavors. The
COERCIVITY of the
magnetic media must
be specified. The
coercivity is the
magnetic field
strength required to
demagnetize an
encoded stripe, and
therefore determines
the encode head field
strength required to
encode the stripe. A
range of media
coercivities are
available ranging
from 300 Oersteds to
4,000 Oe. That boils
down to HIGH-
ENERGY magstripes
(4,000 Oe) and LOW-
ENERGY magstripes
(300 Oe).
** Not
All that Fluxes is
Digital **
Not all magstripe
cards operate on a
digital encoding
method. SOME
cards
encode AUDIO
TONES, as opposed
to digital data. These
cards are usually
used with old,
outdated, industrial-
strength equipment
where security is not
an
issue and not a great
deal of data need be
encoded on the card.
Some subway
passes are like this.
They require only
expiration data on
the magstripe, and
a short series of
varying frequencies
and durations are
enough. Frequencies
will vary with the
speed of swiping, but
RELATIVE
frequencies will
remain the
same (for instance,
tone 1 is twice the
freq. of tone 2, and .5
the freq of
tone 3, regardless of
the original
frequencies!). Grab
an oscilloscope to
visualize the tones,
and listen to them on
your stereo. I haven't
experimented
with these types of
cards at all.
**
Security and
Smartcards **
Many security
systems utilize
magstripe cards, in
the form of
passcards and ID
cards. It's
interesting, but I
found in a NUMBER
of cases that there
was a
serious FLAW in the
security of the
system. In these
cases, there was a
code
number PRINTED on
the card. When
scanned, I found this
number encoded on
the
magstripe. Problem
was, the CODE
NUMBER was ALL I
found on the
magstripe!
Meaning, by just
looking at the face of
the card, I
immediately knew
exactly
what was encoded
on it. Ooops! Makes
it pretty damn easy
to just glance at
Joe's card during
lunch, then go home
and pop out my OWN
copy of Joe's access
card! Fortunately, I
found this flaw only in
'smaller' companies
(sometimes
even universities).
Bigger companies
seem to know better,
and DON'T print
ALL of the magstripe
data right on card in
big, easily legible
numbers. At
least the big
companies *I*
checked. ;)
Other security
blunders include
passcard magstripes
encoded ONLY with
the
owner's social
security number
(yeah, real difficult to
find out a person's
SS#...GREAT idea),
and having
passcards with only 3
or 4 digit codes.
Smartcard
technology involves
the use of chips
embedded in plastic
cards, with
pinouts that
temporarily contact
the card reader
equipment.
Obviously, a GREAT
deal of data could be
stored in this way,
and unauthorized
duplication would be
very difficulty.
Interestingly enough,
not much effort is
being put into
smartcards by the
major credit card
companies. They
feel that the tech is
too
expensive, and that
still more data can be
squeezed onto
magstripe cards in
the
future (especially
Track 1). I find this
somewhat analogous
to the use of
metallic oxide disk
media. Sure, it's not
the greatest
(compared to
erasable-
writable optical
disks), but it's
CHEAP..and we just
keep improving it.
Magstripes will be
around for a long
time to come. The
media will be refined,
and data density
increased. But for
conventional
applications, the vast
storage capabilities
of smartcards are
just not needed.
**
Biometrics: Throw
yer cards away! **
Remember.... "Truth
is cheap, but
information costs!"
Peace.
..ooo
OO Count Zero
OOooo..
Usual greets to
Magic Man, Brian
Oblivion, Omega,
White Knight, and
anyone
else I ever bummed a
cigarette off.
(1/18/92 addition:
Greets to everyone I
met at
Xmascon..including
but not
excluding Crimson
Death, Dispater,
Sterling, Mack
Hammer, Erik
Bloodaxe,
Holistic Hacker, Pain
Hertz, Swamp Ratte,
G.A.Ellsworth,
Phaedrus, Moebius,
Lord MacDuff, Judge
Dredd, and of course
hats off to
*Drunkfux* for
organizing
and taking
responsibility for the
whole damn thing.
Hope to see all of you
at SummerCon '92!
Look for Cyber-
striper GIFs at a BBS
near you..heh heh)
Comments,
criticisms, and
discussions about
this file are welcome.
I can be
reached at:
[email protected]
m