2

I have some kind of authentication token device delivered by a bank (that I do not expect to use for its initially-intended purpose any more). I’d like to learn how it works and whether I can recycle it for some other purpose.

On the outside, it’s a pretty simple device, resembling a USB flash memory stick. On the opposite side of the USB plug, there is a button and some LEDs. When I plug it in, the LEDs flash green, and the device reports a VID:PID pair of 0483:a188 and a description claiming it’s a ‘[software company] Smart Token ECC’.

I don’t have any software that supports this device, and don’t really know where to look for it. No luck with OpenSC: it doesn’t recognise the device at all. In fact, the token doesn’t even use the ‘smartcard’ USB device class; instead, it presents itself as a HID device. The report descriptor looks pretty strange:

00000000: 06ff ff09 01a1 0109 0209 0385 0115 0026  ...............&
00000010: ff00 7508 9508 8102 0904 0905 8501 1500  ..u.............
00000020: 26ff 0075 0895 0891 0209 0a09 0b85 0415  &..u............
00000030: 0026 ff00 7508 95fe b102 090c 090d 8505  .&..u...........
00000040: 1500 2609 0075 0895 08b1 0209 0609 0785  ..&..u..........
00000050: 0815 0026 4000 7508 9540 b102 0906 0907  ...&@.u..@......
00000060: 8509 1500 26ff 0075 0895 feb1 02c0       ....&..u......

Dumping the above reveals that this device should support exchanging reports with ID 1 on the normal channel and report IDs 4, 5, 8 and 9 on the ‘feature’ (configuration) channel. But it doesn’t agree with how the device actually works: I cannot communicate with the device other than through feature reports 4, 5 and 9, and the reports don’t even follow the format specified in the descriptor (feature report 5 should carry 8 decimal digits, one per byte, but actually carries 254 bytes). When the token receives a report it doesn’t like, it provides no answer at all and times out instead of returning an error response. Feature report 9 is read-only and provides, among other things, some kind of identification string naming the device(?) as a ‘[software company] ECC Token HW Button’. Meanwhile, pressing the button produces no effect.

I don’t know where to go from here. What else can I try?

(I fear this kind of question may be too open-ended or too narrow-scoped for the Stack Exchange Q&A format, but maybe it’s worth a shot.)

0
-1

How is the device supposed to be used? If there’s software provided by the bank, try to figure out how it communicates with the dongle.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.