Ez pass hacking

I think you will have to log this pin output while driving. Quote from: dmendesf on July 11, , pm. Of the five pins on the 14 pin unpopulated only pin 3 shows action. It goes high could be a short burst every 1 of 18 milliseconds when under a scanner. This could even be the demodulated receive signal. The transponder is dead. I must have killed it. I might have shorted something taking it apart. Maybe this is a case for Noopy.

So can anybody identify the two RF thingies? The labelling is almost unreadable, I make it out as "F V". Of course that agrees with the MHz. Not shown, but the big one has two small empty holes that go through body of the module.

I tend to think that the small one is the transmitter or even the switched RF load? Both are RF filters. The small one is a SAW filter from Epcos and the second one is a dielectric filter. The following users thanked this post: Renate. Quote from: eb4fbz on July 21, , pm.

Noopy Super Contributor Posts: Country:. The epoxy was a little pig-headed but I finally was able to remove most of it. The edge length of the die is 1,8mm. There is quite a big frame supplying the circuit.

The part was designed by AMI in The small circuit on the left could be a clock generator But what should this structure tell us? Too small That are mask revisions Most of the area is occupied by standard logic. In the upper right corner there is something different The typical standard logic. You can see the horizontal and the vertical supply lines. Between the horizontal supply lines there are the interconnections around the standard cells.

The standard cells are too small to be identified. There are at least two layers of interconnection probably more. You can see the bigger lines on top of the other. Perhaps some memory? But it could force tens of thousands of drivers who now use pocket change to switch to E-ZPasses. But experts say the electronic transponders are susceptible to hacking and already have triggered Big Brother concerns in New York. While most drivers stick them to their windshields and forget about them, Miliefsky advises drivers to store their E-ZPasses in the glove compartment or a secure spot to prevent hackers from accessing information.

Meanwhile, in New York, city and state officials have been tracking E-ZPass users all over the city — even in locations that were nowhere near a toll — according to a recent report by the New York Civil Liberties Union. The reader then relays the information to a computer server to bill the customer linked to the tag.

Unbeknownst to most E-ZPass users, however, the tags can be activated and read almost anywhere. But Mosquera also says the agency scrambles the serial numbers to anonymize vehicles and their owners.

But he says E-ZPass somehow hits a nerve. The lone engineer hopes his project raises awareness that cars are monitored a little more closely than one might think. Rotary tools and soldering irons can seriously maim or injure if used incorrectly and without adequate safety gear.

Instructions courtesy pukingmonkey and adapted for voice, clarity, and length. Barring a few items, almost everything below can be purchased at an electronics hobby store Puking Monkey says he boughthis at RadioShack :. Circuit bypass. Wire the shunt resistors R1 ohm and R2 ohm to the severed leads from the battery. These resistors will allow the current to pass into the circuit from your E-ZPass.

The operational amplifier reads the voltage drop across the resistors when your tag is transmitting. The higher the voltage drop, the more power the tag is using. When your tag transmits using battery power, the voltage drop will trigger the timer.