>> Today's episode is brought to you by Roman.
>> Head on over to getroman.com/rogue
for a free online visit and free two day shipping!
>> What kind of odds do you give
to this actually working?
>> I give 100%.
It's going to work.
>> I don't know, I give, I'm pretty optimistic.
I'm going to say 80% chance. >> Okay.
>> [laughing] Courtyard Marriott.
Come on, baby!
[deep synthetic rumble]
[electrical pop] [gentle vinyl static]
[rising chime]
All right, so we explored what's really on a magnetic strip
but I feel like you and I, again, just babes in the woods,
barely scratching the surface. >> Babes in the woods.
>> Babes in the woods.
That's why we have Deviant Ollam and Babak Javadi
from Red Team Alliance,
going to show us exactly what kind of mysteries
these magnetic stripes hold. >> Yes!
>> Where do we--
what is this?
What's on here?
[laughter]
Is it a spell?
Is there necromancy?
>> I love the fact that Jason instantly becomes
one of the apes around the monolith, like,
"What is this?"
>> What does it taste like?
>> This is a PVC card with a magnetic stripe on it,
which is basically a material
that can be partially magnetized
and then be read by a type of sensor.
>> I remember seeing some demo where somebody had taken
just a strip of cellophane tape
and just rubbed rust across it.
>> BABAK: Yes, that's what it is.
[mechanical snap]
>> MAN ON TAPE: This is recorded on [voice drowns out].
>> This is iron oxide.
A little science-y, but there's two kinds of iron oxide,
iron two oxide and iron three oxide.
One is red in color, one is black in color.
This is the one that's black in color.
So this is totally one of those things
that sounds simple, but even just looking at it,
you can't really see if there's any data on there.
Or can you?
>> We got one of these magnetic readers
and we were surprised to find out what data was in there
that we didn't even know was in there.
>> BABAK: Right. >> JASON: Like our names, drivers license,
and it immediately pulled up just some basic info.
>> Yeah, that's basically what we have here.
Now, I like to get even lower level.
I want to really see exactly how something is encoded.
>> You're familiar with barcodes, right,
like on products you buy?
>> Sure, it's basically like a Morse Code
but just stretched out vertically
so that a laser is able to see like [imitating beeping].
>> And you can see a barcode with your eyes.
This is like a barcode that you can't see with your eyes.
But we can try to make it visible.
Here, tilt your head back
and we'll give you robot eyes.
>> I don't know. [laughter]
>> What is this, LSD?
>> You're going to start hallucinating?
>> Ayahuasca, do I snort it?
>> We have a vial of nanites here.
>> You get out of here!
Put them all in me!
>> In all seriousness, what is this?
>> This is called magnetic developer.
It is really just two things.
It's really really fine iron particles
mixed into a solution that evaporates very, very quickly.
>> What is this usually used for?
>> Exactly what we're doing. >> DEVIANT: This.
>> Oh, okay! >> It's literally this.
This is the only purpose of this liquid.
>> So I am sure this is overly-reductionist,
but just picture iron filings in alcohol.
>> Basically.
You've seen ferrofluid? >> Sure, sure.
>> BABAK: So imagine ferrofluid,
but the liquid evaporates like that.
>> Okay. >> That's what we have.
>> And the point of this is?
>> We're going to reveal the secrets
that this card has for us.
So I think we're going to start with this.
This is Deviant's Costco card.
And as I drip this onto the stripe,
you'll immediately begin to see.
>> JASON: Whoa!
>> BABAK: Look at that.
>> JASON: That's the information!
>> BABAK: Yeah, how cool is that?
>> BRIAN: Am I right in assuming that when we scan it,
we'll see the exact same things? >> BABAK: Yes.
>> BRIAN: In digital form? >> Yes, exactly.
>> That looks amazing!
The solution flows over, everything aligns
according to the polarity of the magnetic.
>> Because remember, this is magnetized.
So all that little fine iron dust,
it's sticking to the parts of the card that are magnetized.
>> So if this is just dust on there, I can wipe it off?
>> You can, now we're not going to do that yet
because what I want to show you
is how different cards look.
So that's the Costco card, right?
Here's a hotel keycard.
It has far less data on it.
How much less?
I'll show you.
So again, I'm going to give that a quick shake.
>> JASON: Well that one's not going to talk
about the bulk porn that Deviant always buys.
>> BABAK: So if I do this...
>> BRIAN: Bulk porn? >> JASON: At Costco, there's a--
>> BRIAN: Oh, got it [laughing].
>> DEVIANT: Support creators. >> JASON: Oh so that one,
there's far less information there.
>> BABAK: Far less data, yeah.
>> JASON: What kind of data would they store on there? The code...
>> BABAK: On a hotel keycard?
It's generally going to be just what's called a magic number
that the lock recognizes and goes, "Oh, this is
"this is a valid key for me," and there's some expiry information
and stuff in there, but no name.
>> Okay. >> No credit card information,
no personally identifiable information, or PII
as it's referred to in the industry.
>> And all of them are like that
or do some hotels have like, oh your personal information
is on your keycard? >> No, no, no.
>> Okay good to know.
>> Yeah, that's a huge privacy thing.
>> Okay, how do we see exactly what is on there?
>> Another way that we can look at the data
is swiping it.
Now I have a special tool here
that's a little bit different than the swiper
that you folks were using
in that we get to see the data at a much lower level.
>> Yeah, we only just got the plain text.
>> Yeah, you just got the characters.
I'm going to show you the raw bits.
So, I'm going to do that.
[electronic beeping]
>> DEVIANT: There's my identity stolen. >> BABAK: Here's what you saw, right?
You saw the characters.
But when we do the signal analysis,
that is the same thing that you saw here.
>> BRIAN: Can we see if that exactly lines up
with what we did? >> BABAK: Absolutely, absolutely.
So if you look for the dark spots,
you're going to see some similarities.
>> BRIAN: Oh man, you got to get in real close.
>> BABAK: You got to get in real close.
Yeah, yeah you got to get in real close.
>> It's like a magic eye illusion.
>> DEVIANT: But you can see it's a very regular start sentinel.
And then you have data and then you have kind of a block.
>> BABAK: And you can see how each character is encoded.
>> Oh! >> Yeah.
>> Oh neat.
>> Isn't that cool?
>> Yeah!
>> Oh wow. >> So for example,
there's the seven.
So that is how a seven is encoded.
>> JASON: Oh!
>> BABAK: This is how a zero is encoded.
>> JASON: Huh!
>> BABAK: Freaking cool right? >> BRIAN: That's great. >> JASON: Yeah!
Okay so, is there some sort of method
where if someone were to get the visual representation
like we see here or here,
if they could see it,
then they could copy it?
>> 100 percent.
>> Like we did in another episode seeing a key
from across the room and just taking the picture.
>> Similar situation. >> Okay.
>> Hold on, it's just now occurred to me what you're saying.
You're saying drip that on there, take a photo if it,
and then wipe if off and hand it back?
You don't even need a skimmer?
>> No, you don't.
It might be a lot of work, skimmer's a lot easier
if you just use a skimmer. >> I guess, yeah.
>> But that works!
That's a very low tech solution on the first part of it.
>> And that's what I wanted to show you guys
is how low tech this technology actually is.
And I feel like this really brings that out.
>> Well, magnetic storage has been around
for decades and decades.
And so it really hasn't evolved very much.
>> It hasn't, and that's why it's so easy
to copy a card.
>> Okay, speaking of which, let's say you've got
somebody's card, let's say you successfully skimmed it,
let's say you have the information.
Ain't no reason it seems to me
like you can't put that anywhere you want!
>> I bet you I can copy Dev's credit card
to a hotel key card.
>> This is like a Scam Nation episode.
Where you're like I'll buy you a beer
if you can do that, sir.
>> I want all of my credit cards
to actually be old Blockbuster Video cards!
>> Oh yeah. >> You could do that.
>> Oh that would we awesome! >> That would be so great!
>> Get into so many arguments with merchants
and have the cops called on you.
[laughter]
>> And that's legal...
>> Probably, yeah! >> Is that within the usage agreement?
Probably not. >> Yeah. >> Screw your real ID, TSA!
Blockbuster Video!
>> What do you think, should we try it?
>> Yes! >> Yes.
>> Of course, of course. >> We still have
our hotel safe.
And this hotel safe accepts credit cards
as a way to lock the safe.
>> Okay and when you say accepts credit cards,
you don't mean it processes it,
you mean it just uses your information as the code.
>> Right. >> Correct.
>> And this is actually your real credit card
that we have right now doing this.
>> Absolutely!
>> This show has me checking my wallet a lot lately.
>> You're going to keep doing that.
>> JASON: Okay.
>> So we want to lock our safe up, and there it is, closed.
>> BRIAN: So at this point,
this guy knows your actual information.
>> Yes.
Now if someone were to compromise this card,
let's say someone with a skimmer.
>> BABAK: I'll just kind of skim his card.
[electronic beeping]
So now I have his data.
>> These things, I thought they were just readers.
I didn't think they could write as well.
>> It depends on what kind of device it is.
So some of them are just readers
and some of them are read and write.
Now this particular one is no longer sold.
It was made by a German hacker
that stopped selling them some years ago.
The one that you get on Amazon isn't going to provide you
this level of detail, unfortunately.
>> So does this software you're using come with that
or do you get that elsewhere to pair with it?
>> This software came specifically with this reader,
which is heavily modified.
We could do a whole episode about how hilarious
the modifications inside this are.
>> But usually when you get one of these,
it comes with some sort of software that you can use,
like the one that we had.
>> Very basic, but yes, yes, absolutely.
>> How does it work?
>> BABAK: I can take Dev's card
and I'll swipe that. [electronic beeping]
And I have a pretty good swipe there.
>> So I could walk away and no longer be in the picture.
And you still have my data.
>> So I'll take a regular hotel key card, right,
this is not currently a credit card.
But then what I'll do is I'll come over here
and I'll write it.
[electronic beeping]
>> That was it!
>> That was it. >> That was all.
You pushed one button, and then you pushed another,
and now you've got his money.
>> BABAK: We're going to check our work,
make sure that it worked.
[electronic beeping]
>> Oh that's me.
>> All right, all right [laughing].
>> That's not your credit card.
>> That is now my credit card on my old hotel room key.
>> And stripe down. >> Okay stripe down.
This way. >> Fingers crossed.
>> BRIAN: Oh, please.
[triumphant laughter]
That is amazing!
I'm just going to hold onto this.
>> Hey, come on now. >> If people want to get
even more terrified, where can they go?
>> We are online at redteamalliance.com.
We don't just play around with this stuff for fun
with cool friends, we train professional people
who need these kind of skills for covert entry.
>> Like as a job or something.
>> I pinky promise we'll destroy this afterwards,
but could we try actually seeing if this would work
in the wild?
Could we go to a gas station or something?
>> Hell yeah, let's do it.
[Brian imitating dance music]
>> I'm going to buy so many Slim Jims!
[laughter] >> Smart man. >> All of them.
>> You know what I love about this building right behind us?
>> What's that?
This entire erection is made of hard steel.
>> It is!
[laughter]
>> Could you imagine if this thing
was embarrassed of itself
and it refused to admit that it was made of jello?
>> Man I'm glad you shelled out the extra money
for the non-jello construction
because it is magnificent and turgid?
>> Turgid. >> Is that?
Yes, buildings can be turgid
and so can you! [Brian laughing]
>> That was smooth, yeah dude!
Over 50% of men over the age of 40
are less steely than they would like to be.
And get this, three quarters of them,
they don't talk about it to anyone!
>> And that's why Roman is there
so you can get treated for your erectile dysfunction
in the privacy of your own home.
>> Heck yeah dude, real doctors through the chat.
You do the whole diagnosis.
You don't have to look at their beady eyes
and their judging faces.
Instead, you walk in as a soft bowl of jello.
You walk out like this building here.
>> Magnificent!
>> All of this was just a visual prop for this one ad
that we're doing right now.
>> That's all we ever wanted!
>> I hope it was worth it.
Head on over to getroman.com/rogue.
Sign up, get a free consultation
and free two day shipping.
I'm pretty optimistic, I'm going to say 80% chance.
It's going to feel so weird.
>> All right. >> Oh yours is on this side.
>> Yeah, it's weird.
It's taking some getting used to.
>> Courtyard Marriott, come on, baby!
Yes!
>> Here it is!
>> BRIAN: It's funny, I feel more guilty
the higher that number goes.
>> JASON: That is wild.
There it is.
>> Thank you, Courtyard Marriott!