24 Share It Gold
About Hacking Citi Bike Keys

We are big fans of NYC's Citi Bike system. However, as engineers and product designers, we can't help ourselves from making it better!

For this design hack, we were tipped off by this post on Adafruit's blog, regarding the ability to crack-open Citi Bike's key fob. What if we ported the Citi Bike key's enabling technology (the tiny RFID tag inside) to a new form? Given the general shape requirements for the key fob to work, we wondered: what if you could wear the Citi Bike key as jewelry? To test, we created a necklace prototype to hold the antenna snuggly inside.

A bit of specifics we discovered along the way: Using an RFID reader app on an Android Phone, we were able to extract the following information about the RFID antenna inside the Citi Bike key fobs.

  • UID: e00401007a3b63ef
  • rfTechnology: Type V (ISO/IEC 15693 / Vicinity)
  • tagType: SL2 ICS2001 (ICODE SLI)
  • manufacturer: NXP Semiconductors (Germany)
  • Application family identifier (AFI): all families and sub-families
  • icRef: 01
  • memorySize: 112 Byte
  • blockSize: 4 Byte
  • numberOfBlocks: 28

    • The tag itself has 28 blocks of data. The first 27 blocks are empty (containing "00 00 00 00"), with the last one (the 27th block since it is 0-indexed) containing "57 5F 4F 4B". This number appears to be the system ID, since it is the same across all CitiBike keys we tested. The UID is the only differentiator which links the key fob with your account.

    We used the NFC-V Reader App for Android to read/write to and from the key fob.

    Upon further research, it appears that Citi Bike uses this line of RFID chips:

  • NXP Semiconductor - ICODE SLI
  • Part Number: SL2ICS2001DW
  • 13.56mhz

    • INVOLVED
    Product Design
    Prototyping
    TIMELINE
    2013
    LINKS
    BUY Part 1 on Shapeways
    BUY Part 2 on Shapeways
    The process to deconstructing the key fob is fairly simple: we used a small screw driver, a circular punch, and a hammer.
    Pry-open the key fob with a small screw driver.
    User a circular punch and a hammer to remove the RFID.
    Prototyping began with a deconstruction of the Citi Bike key fob, to reveal the tiny RFID chip and copper antenna inside. The copper antenna is less than half the diameter of a penny coin. After experimenting with the bare chip and antenna within the Citi Bike docking stations, we found that unlocking a bike required exact positioning of the RFID chip and antenna within the Citi Bike dock. Differences of mere millimeters prevented the antenna from reading properly.
    NFC-V Reader App for Android. Showing the overview of the content.
    NFC-V Reader App for Android. Showing the content of blocks 0012 - 001B.
    Given the demands of the antenna position, we couldn't stray too far from the fob shape, so with design support from Architectural Journalist, Laura Raskin, we began to scope the concept into a model. We designed the antenna to fit snuggly inside.
    After understanding the antenna demands and shape requirements, we considered the design direction and decided that it would be fun (and fashionable!) if the key fob could be worn as jewelry.


    This clever product concept deserves a clever name: Bike Share + 24 Carat Gold = 24 SHARE IT GOLD.

    The on-demand 3D printing service, Shapeways.com, allowed us to create a gold-plated stainless steel version of the product.