-
Notifications
You must be signed in to change notification settings - Fork 2
Home
Welcome to zepassd! This is intended to be a quick tutorial on how to use zepassd for the curious.
Simply put, zepassd activates, reads and decodes E-Z Pass transponder serial numbers, using a USRP.
E-Z Pass is a multi-state toll collection scheme, used mostly on the eastern seaboard. It is supposed to facilitate quick and easy collection of tolls. Toll plazas contain highly directional antennas, that read the E-Z Pass transponder in a car as it enters a toll collection lane. In order to support this, each E-Z Pass transponder is programmed with a unique identification number. This number is printed on the front of the pass (as well as on a sticker on the back, in hex).
Every E-Z Pass participant has an E-Z Pass transponder in their car. The E-Z Pass reader activates the transponder, and then listens for the E-Z Pass serial number to be transmitted. More on the technical details of this later.
The serial number for an E-Z Pass is formed by concatenating the agency ID with a per-device unique identifier that is programmed in the factory. For example, one of my E-Z Passes has the serial number G4*00812052550. The Agency ID is 8, and the unique serial number is 12052550. On the back of the pass, the number is 366F046 -- decoding this is an exercise for you, dear reader.
Some people seem to immediately assume this can be used to defraud toll collection. This is not actually a reasonable use of this mess: for one, they also grab photos of your plates at most toll plazas, and check if those line up with the E-Z Pass transponder serial number you registered. So why bother?
However, there is a serious privacy implication to E-Z Pass. Like other technologies that make life more convenient, E-Z Pass does not have anything in the way of "security." Passes are dumb transponders, and with the right activation sequence they will wake up and start spewing their unique serial number on the air. As such, anyone who knows this sequence could collect these unique IDs to track you without even knowing who you are. Combined with some basic computer vision and some statistical analysis, they could even use something like this to eventually map your E-Z Pass transponder serial number back to your license plate. From there, it's easy to tie this back to personal identity in many states.
Additionally, there are some slightly less nefarious use cases for this -- tracking the number of cars in parking lots, for example, and so-called "smart city" initiatives. In Manhattan at least, they also use E-Z Pass to monitor traffic conditions. What else they use this for, is anyone's guess: there are rumours, for example, that police use E-Z Pass to track people who have been near the scene of a crime.
Of course, remember, any data that is unique about you, even if it isn't tied straight back to your personal identity, is a breach of your privacy. So let your imagination go wild.
An E-Z Pass is woken up by a 20 microsecond long carrier on 915.7 MHz, transmitted by the reader. Any longer than this, and the pass doesn't wake up. Shorter, it seems some passes start to ignore the call from ET, too.
After another ~90 microseconds, the EZ-Pass transponder will respond, at about 500kbps. This message is a 256 bits long, encoded using a Manchester code, modulated using on-off keying (OOK). There are 240 bits of data (most of which seem to be 0's, in the middle, and likely can be programmed by the "agency"), and 16 bits of CRC. The serial number is broken up into several groups, of which you can dive into the zepassd code to get the specifics.
The message transmitted by the transponder is always the same. As well, the delay between the end of the activation pulse and the start of the transmission is locally (i.e. over a short period of time) consistent between read attempts. This comes in handy later on.
Most E-Z Pass readers seem to be highly directional. This likely simplifies the decoding logic. However, being able to activate multiple passes to decode them is much more interesting when you're building a tracking technology. It turns out that the E-Z Pass transponders are really cheap, so every E-Z Pass transmits at a (random) slightly different frequency, between 914.2 and 915.3 MHz (or so). This frequency delta seems to be very consistent between readings at a given temperature. We can figure this delta out by simply searching for peaks in an FFT of the measured signal. We zero-pad the signal to the nearest power of 2 bins, to get a bit more frequency resolution.
By taking advantage of this offset, once we find a candidate E-Z Pass we can simply apply the time domain frequency shift property to the measured signal after activation, for each pass we find (effectively channelizing the received signals). It is then a simple matter of adding repeated received signals from the same pass together -- the other passes end up looking like noise after enough successive additions of repeated measurements. After a certain minimum number of responses, we attempt to decode the E-Z Pass transponder's signal. If the CRC matches, then we can declare victory. If, however, we fail after a certain number of decoding attempts, we throw away everything we have and start again.
See the code for implementation details and commentary.
All of zepassd is written in C++. You'll need a fairly recent version of g++ installed, because it uses C++14 features.
You will also need the following packages:
- boost.program-options
- boost.crc
- boost.circular-buffer
- libfftw3
- libuhd 3.9.5 or later
Most Linux distributions will provide these. For example, for Debian (and derivatives), something as simple as:
apt-get install build-essential libboost-all-dev libfftw3-dev libuhd-devshould get your environment to a buildable state.
Next, simply invoke make in the root of the source repo. That's it, you should have a zepassd executable in the same directory as the Makefile. Either leave it in place, or copy it where you like to keep your binaries.
Simply invoking zepassd -h should give you something like the following:
linux; GNU C++ version 7.3.0; Boost_106501; UHD_003.010.003.000-0-unknown
ZEPASSD: The E-Z Pass Reader Daemon
Copyright (C)2018 Phil Vachon <phil@security-embedded.com>
Licensed under the GPLv3 or later. See COPYING for more details.
Usage: ./zepassd {options} [output filename]
Options:
-h [ --help ] Get some help (this screen)
-d [ --device ] arg USRP device ID to use
-c [ --center ] arg (=915750000) Center frequency
-T [ --tx-gain ] arg (=75) Transmit gain
-t [ --tx-port ] arg (=A:A) Transmit port on USRP
-A [ --tx-ant ] arg (=TX/RX) Transmit antenna on specified USRP TX port
-R [ --rx-gain ] arg (=75) Receive gain
-r [ --rx-port ] arg (=A:A) Receive port on USRP
-a [ --rx-ant ] arg (=RX2) Receive antenna on the specified USRP RX
port
-P [ --pulse-len ] arg (=20) Length of activation pulse, in microseconds
--gps-pps Use the GPS PPS source and synchronize local
time
-p [ --pulse-spacing ] arg (=25) Pulse interval, in milliseconds
-m [ --max-age ] arg (=30) Maximum stale pass age, in seconds
Most of the default values are fine for experimentation. This means the only thing you have to do is tell zepassd how to connect to your USRP, what antennas to use, etc. I've only tested zepassd with a USRP B210, but the default settings will work to get a B210 up and running.
Details on how to specify your device connection string can be found in the UHD Device Identification page. Specify this string (in quotes!) using the --device parameter to zepassd. For my USRP B210, it's something like:
./zepassd --device "serial=30E6230" output.txt
If you can't read passes, check the following:
- Are your antennas screwed on tight?
- Do you have your transmit and receive gains set high enough? You might want to get close to the edge of what your USRP is capable of
- Are your antennas appropriate? Is the VSWR so high that the antenna is basically reflecting all that energy back at your transmitter? Do you need an intermediate power amplifier?
If these don't work, maybe file a ticket.
While this uses an ISM band, make sure you're legally authorized to transmit at the power you've specified. The FCC can be surprisingly efficient, so don't tempt fate. If you're unsure, find a lawyer and ask. I hear the EFF is pretty helpful. I tested this in an RF isolated environment, using transponders I bought from various New York Thruway bridges whenever I crossed them, so I suggest you do the same. Also, I highly recommend you do not read anyone's E-Z Pass transponder without their permission.
ZEPASSD is Copyright (c)2018 Phil Vachon phil@security-embedded.com. It is licensed under the GPLv3 or later license, whichever is less convenient for you.