
Not everything I do with my Zune is a success. I had grand ideas for the title of this post. Two that came to mind were ‘Zune does NFC’ and ‘Zune HD: Movie Music, Bus Ticket?’ Neither of them came to be. This is a look into my thought process behind wanting to use my Zune to pay for the bus while living in Boston. In the process of trying to remove some plastic from my wallet (i.e. make my Zune RFID capable) I learned something about electrical engineering and RFID chips in the process.

A CharlieCard is Boston’s stored value transit card that the Massachusetts Bay Transit Authority, affectionately known as ‘the T,’ uses to collect fares on its bus, train, and subway network. This card exists thanks to a radio frequency identification chip (RFID) built into the card. See that square outline illuminated in the light spot from the picture above? That is the chip. It is manufactured under the MIFARE brand. When you hear people talking about NFC (near field communication), they are typically referring to the use of RFID chips. One current example of RFID use in a consumer device is how Google’s Nexus S Phone has an RFID chip built in to the phone, thus giving it NFC capabilities. When it comes to paying to ride mass transportation, the idea behind using a CharlieCard is that waving the card with an RFID chip over a RFID card reader should be faster than inserting money into a machine for tokens, waiting for a ticket from a human being, or using a coin machine on the bus or train. Overall the idea works pretty well. Not having a Nexus S Phone, I wanted to see if I could pull off the same type of magical RFID wizardry using my Zune HD.

As you can see in the picture above, the CharlieCard, being the size and thickness of a normal credit card, is almost the size of the Zune HD. Simply removing the back cover of my Zune, placing the entire card inside the device, and covering it back up was not going to work. First, the sides of the Zune are tapered. Secondly, if put behind enough aluminum (like say the back panel of a Zune HD), an RFID chip’s ability to be read can be severely diminished.
Try #1:

Going off of the square outline, plus bits of reading about smart cards and RFID interference I had read up to this point, I set out to remove the chip from the card. I wanted to put the extracted chip into my Zune. I had a rough idea about the size of the chip and knew to give the square indentation some leeway when extracting the chip. For the most part, I could see where I needed to cut.
Looking at the above photo, the marks you see at the end of “Autho” are parts where I nicked the seating area of the RFID chip as a result of my cutting. The raised shadow, seen on the left side of the right-most card piece is another indication where I nicked the RFID chip. This time, the peeled-back plastic is on the bottom side of the card piece. I did not make the best first cut. Still, with the RFID chip liberated, it was time to find a place to put it inside my Zune HD. Realizing the aluminum-backed portion of the Zune HD would be off limits I looked up ‘Zune HD disassembly’ and followed the first result.


Thanks to Anything But iPod I learned how to remove the back bottom cover on my Zune HD. Before this, I had only gone as far as removing the aluminum panel of my Zune. the In doing so, I found the perfect place to put the RFID chip. See the lower left corner? Those of you who know about MIFARE RFID cards can already see where I jumped off the rails when it comes to hacking this CharlieCard. Bear with me, this is a story.
With a little effort I replaced the back bottom cover and aluminum panel on my Zune HD. Now, to test my the RFID chip and gauge my success. One thing about any mass transit system be it, Boston, New York, or LA, you do not want to be ‘that guy’ holding up the line to use the T, MTA, or Metro. As a result my test needed to be quick so my test was: Swipe my Zune HD with the RIFD chip inside over the card reader, check to see if anything registered on the fare box, no? “Oops silly me, this music is really good! Oh, yeah it’s a Zune…” Pull out my wallet, swipe with a known working CharlieCard in my wallet, get on the train. --In short, the test did not work. My Zune was not recognized so I had to use a backup, uncut, CharlieCard in my wallet.
Try #2:

You would be surprised how often in searching for information about the CharlieCard I came across articles on the MIT students who reverse engineered the card in 2008. I was not trying to hack the CharlieCard. I just wanted to hack the CharlieCard. I knew I had some adjustments to make, namely with my cutting ability. Foremost for Try #2, do not nick the chip. To that end I wanted to know, just how big was the RFID chip inside the CharlieCard. Based on experience with Try #1, Wikipedia articles discussing MIFARE, and more articles talking about ISO standards, I had a pretty good idea about the size of the chip. Even though I had seen pictures of chips in smart cards, read articles discussing the frequency those chips used and physical size of the cards in which the chips resided, I did not know the dimensions of the actual RFID chip. As a result, I guessed that the chip could be at its smallest the size of a SIM card.


After trimming the top of the RFID chip I used in Try #1 (hence those two thin strips in the Try #1 photo) I came up with chip dimensions of roughly 9/16” x 7/16” or 14.4mm x 11.1mm. I thought these dimensions would help me make more precise cuts in Try #2. At this point I was all set to make a second set of cuts on a second CharlieCard. Unfortunately, I did not get past the first cut as I came across as issue that ultimately stopped this project.

See the wire sticking out the chin of the person on the right of the card? To my knowledge at the time, it should not have been there.


One thing I learned by reading some of what the MIT students did was that the type of RFID chip in the card they hacked was a MIFARE Classic version. After searching for ‘MIFARE Classic chip size,’ and looking through links on the first page of results, I realized my mistake. The result in particular that helped the most was, from SmartCardSupply.com. Speaking technically, my project ended when I cut the antenna built-into the ISO-7810 ID-1 sized card that allowed the ISO 14443 RFID chip embedded within to communicate with any ISO 14443 card readers. Even though my second attempt made sure to have proper clearance around the RFID chip, there was no way I could remove the chip from the CharlieCard without cutting though the card’s antenna. In both pictures above you can see five tiny dots just to the inside of the outer edge of the CharlieCard. That is the card’s antenna. Because I could not remove the chip without cutting the antennas there was no way for this project to work. The RFID chip was more like an RFID unit. After seeing the first wire, the subsequent cuts you see in the Try #2 pictures confirmed what I learned about the antenna coils running the perimeter of the CharlieCard.
Final Thoughts:



[Image Sources, from left to right: SmartCard Supply, iFxit, Patently Apple]
In writing this post I did some subsequent searches, namely for a ‘teardown of the Nexus S’ phone. How did that phone incorporate its NFC chip? Looking at the Nexus S iFixit teardown guide and noting Step 3, you see the RFID chip and its antennas are placed as close to the edge of the device as possible. In particular, the RFID chip and antenna sit on the inside of the rear battery cover, between the battery and the back cover. My guess is this is done to improve RFID signal reading ability.
My question then moves to how does one incorporate RFID into any device? Thinking about device building materials and RF interference, it makes sense that the back of the Nexus S would be plastic. Considering the potential for aluminum interference putting the RFID unit as close to the edge as possible makes sense. But, what if you wanted a metal-backed device and wanted to incorporate RFID? Perhaps you could do something similar to what Apple patented and pack the RFID unit and other antennas behind a logo-window in a hallowed out cavity on the back of an otherwise metal encased device. Another thought is building the RFID antennas around the face of the device, into the bezel, below the glass/plastic front and around the display panel.
In thinking about adding RFID to an existing product, such as my Zune HD, it seems that I needed something more stripped down than a CharlieCard and something smaller than the patch in the back of the Nexus S. Since I could not use a CharlieCard, it is my understanding I would need my own RFID chip writer so that I could program the stripped down unit to function as a CharlieCard. This idea is similar to how a person turned their HTC EVO 4G into a security badge. However, I am sure I do not have the money to put together my own off-the-shelf solution. On a tangent similar to modding a Zune and EVO, one XDA member managed to get the RFID unit in their Nexus S to read their Seattle-based ORCA RFID transit card, via a homemade app known as FareBot.
After reading the FareBot blog post and remembering that Boston uses the hackable MIFARE Classic, the potential for fare evasion is there. Even though Seattle uses a newer card technology known as MIFARE DESFire, the same potential for unauthorized rides remains when you have the ability to tell your RFID chip what to do via software. However, I would argue that the potential to have one less card in my wallet and the ability to use a device I already have in my hand when using public transit is more salient than trying to rip off the T or Sound Transit. Among other uses, hopefully this use as a stored value transit card, is something the next Windows Phone or Zune device could incorporate via the addition of an RFID chip and antenna. RFID has potential. It would have been cooler to say “I can pay my subway fare with my Zune, here are the steps” than sharing this story as to why it is not possible. For the time being, this awesomely informative post will have to do.