fabernovel loader

Oct 13, 2014 | 2 min read


Hacking the Navigo

Tarek Belkahia

Senior Software Engineer

If you ever use public transportation in Paris, you might have noticed the apparition of a slightly different Navigo pass since mid-January. This new pass stars a brand-new Philippe Starck design and first and foremost has a built-in NFC chip which is compatible with most Android phones (for the iPhone 6, the NFC API is currently exclusively reserved for Apple Pay).

This mobile-friendly feature has inevitably raised our interest, so we decided to give it consideration. How do those cards work ? What pieces of information can we find on them ?
We realised that the Navigo pass is a smartcard obeying the electronic ticketing system Calypso and more particularly the INTERCODE standard. Therefore, following those norms, we can have reading access to some files within the card.
Among those files, several pieces of information are available. It is possible to access a validation log containing data on the three last “punches” of the Navigo pass. Besides, another file stores details on the owner’s subscriptions (duration, areas of validity, …). Nonetheless, no personal piece of information concerning the owner of the pass can be read.

Following these findings, we conceived a demo app called Ticket Puncher for Android. It allows the user to see the content of any Navigo card surrounding the device. To do this, just put a Navigo pass against your device for it to be detected and analyzed.
Following that, the app will display information on the last three validations: date, time, type of transport (subway, tramway, bus,…), line and station (only for subway and RER for the latter two).
Interestingly, all this readable intel is not encrypted and we just use a lookup table for the subway stations.

We believe that the compatibility of these cards with smartphones is a huge step forward. In fact, it paves the way for a wide range of applications that were previously technically impossible. As an example, we could consider to recharge the Navigo card through our mobile rather than queuing at the counter at the beginning of each month. Even better, we could create bounds between the user’s pass and a mobile solution for travellers in order to personalize the features of the app: favourite stations, customized traffic alerts, network consumption data…
Last but not least, thanks to the introduction of the host-based card emulation with Android 4.4, we can even imagine having a Navigo app replacing the card and using the public transportation network with our smartphone.
We don’t doubt that more original user cases can be considered 😉

Do not hesitate to ask us for a demo or to give us your impressions on Twitter!

logo business unit


150 talents to face technological challenges of digital transformation

next read