I’ve been on the fence about this, but I finally decided I would share a smartcard exploit I found awhile back…
My apartment complex uses a smartcard system for it’s washers and dryers. We use a “transaction station” to recharge the cards. Being impatient one day adding credits, by chance I stumbled on a way to add “free” credits on to my smartcard.
I did some research, and found out the “transaction stations” are made by a company called Greenwald Industries. (there are no markings or stickers on the station, so it took me awhile to find the manufacturer )
Here’s what the transaction station looks like in case you have one in your building/dorm/etc:
Here’s what you do:
1. Put your smartcard into the machine like you normally do.
2. Insert some money into the dollar changer.
3. Now immediately as you inserted the first bill, take a second bill (doesn’t matter what denomination) and try to feed it into the changer while the station is still processing the first bill. Make an effort to really try and insert the 2nd bill. Don’t remove the 2nd bill until the next step occurs.
4. While you are inserting the 2nd bill the display should be showing “adding credits” on the screen but it should eventually say “bill error” and spit the first bill you put in, out.
5. As soon as it spits the first bill out, immediately pull the smartcard out of the machine.
When you put the card back into the station to check your balance, you will find that, even though the station got confused by you trying to stick another bill in while it was processing the first bill, it still manages to add the credits to your card.
Obviously since you pull the card out of the machine before it is able to reverse the credits, the credits remain on the card.
I don’t know how widespread these stations are, but I’d figure I’d share this exploit anyways. Enjoy!
-TheUrge
I have the same machine in my comlex too however it does not have a bill feeder. You insert the debit/credit card. I will try this though. However I think they lock your card in so that you cant pull it out. Thanks for sharing though
Comment by Joe — June 22, 2008 @ 3:33 pm
Good job digging up the manufacturer for these transaction stations. Thanks for sharing.
Comment by Motoma — June 30, 2008 @ 7:35 pm
hey, i have this exact machine and system at my apt. i have tried this several times and it has yet to work. any suggestions?
Comment by hill — February 27, 2009 @ 6:46 am
I have a Greenwald Industries transaction station in my apartment complex, however, when you stick the card in, the machine holds it there. Therefore, when the words “bill error” show up, you can’t pull the card out. I tried your method today and ended up putting $1 on my card, which isn’t bad but it’s not exactly good. I think I might try to tape the card with about 2-3 inches hanging off of it so that I can try and force-pull the card out when “bill error” shows up again.
Comment by Jon — July 22, 2009 @ 5:38 pm
Weird. I have since moved to a differant complex (with a washer/dryer in the unit
), but I remember when doing this trick that it would not lock the card. You could pull the card out freely without any sort of difficulty.
I don’t know if this is some sort of option set in the machine itsself, but that’s how ours was setup.
Comment by theurge — July 22, 2009 @ 7:04 pm
The machine I have here looks a little different than the one in your picture. Anyways, I added the tape and was able to pull the card out when it said “bill error” except now my card is unreadable and I just lost $10 for laundry
!!! I tried inserting it back into the transaction machine with a “error validating ID”. I also tried letting the washer/dryer machines read it but got a “card bad” notice. Welp, I wonder if I can talk to anyone here about getting my money back :/
Let that be a lesson to you all: do things the honest way. Hahaha.
Comment by Jon — July 23, 2009 @ 2:51 am