Loyalty Card EEPROM Point Rewriting: Exploiting Account Multiplier Glitches
Every loyalty card sitting in a player's pocket is a tiny computer running on borrowed trust. The EEPROM chip inside those contactless cards stores your point balance, your tier status, and your multiplier flags—and it does so with shockingly weak write protection that any halfway competent hardware hacker can walk straight through. I've pulled apart dozens of these card architectures, and the account multiplier glitch remains the single most exploitable flaw in the entire reward ecosystem. 🎯
The EEPROM Architecture Nobody Wants You to Inspect
Standard loyalty cards use low-cost I2C or SPI EEPROM modules, typically 24C-series or equivalent, mapped to fixed memory addresses. Point balances live at predictable offsets, and the multiplier byte—the value that determines whether your account earns 1x, 3x, or 10x on every transaction—sits right next to it with zero cryptographic binding. No MAC, no rolling checksum, no encrypted write token. Just raw bytes waiting to be rewritten. A $12 CH341A programmer and a SOIC-8 clip are all you need to dump the entire memory map in under ninety seconds.
Rewriting Multiplier Flags Without Triggering Validation
Here's where the Loyalty Card EEPROM Point Rewriting technique gets surgical. The multiplier byte usually follows a simple bitmask scheme—0x01 for base tier, 0x04 for silver, 0x0F for platinum, and so on. The terminal reader validates the card by checking a separate authentication sector that most deployments never rotate. Write 0x0F to the multiplier offset, recalculate the weak additive checksum at the end of the block, and the reader happily accepts your card as a platinum-tier account. The Account Multiplier Glitches compound from there: some systems apply the multiplier retroactively to pending point accruals, meaning a single byte flip can inflate months of accumulated rewards in one write cycle.
Timing Attacks on the Write-Protect Register
The write-protect register in these EEPROM chips is a joke. Most 24C-series parts use a software WP pin that clears on power cycle, and the reader terminal doesn't hold the line during the entire transaction window. If you know the polling interval—and you can learn it with a $30 logic analyzer in about ten minutes—you can slip a write command into the gap between the reader's authentication handshake and its balance read. The card firmware assumes the write-protect held. It didn't. 🤖 This is the glitch that account multiplier exploits rely on at the hardware layer, and it works because nobody at the deployment vendor ever tested adversarial write timing.
Checksum Collisions and Balance Injection
Point balances on these cards typically use a two-byte additive checksum stored at a fixed offset. The checksum algorithm doesn't include the multiplier byte in its calculation—a catastrophic oversight. That means you can raise the multiplier to maximum, leave the points untouched, and the checksum still validates. Next transaction, the reader awards points at the inflated rate and writes the new balance back with a freshly computed checksum. The system launders your forged multiplier through its own legitimate write path. I've seen this exact pattern replicate across four different card generations from three separate vendors, all sharing the same flawed integrity model.
The Rotation Blind Spot That Keeps the Door Open
Authentication keys on these loyalty systems rotate far less frequently than anyone assumes. In field captures, I've documented key pairs surviving unchanged for eighteen months or longer because updating them requires fleet-wide reader firmware pushes that operators avoid at all costs. 💀 That stagnation is the real vulnerability—not the EEPROM itself, but the operational laziness wrapped around it. An account multiplier glitch isn't a bug in the silicon; it's a bug in the deployment lifecycle. The card trusts the reader, the reader trusts the card, and neither party ever challenges the multiplier byte because the validation logic was written by someone who assumed physical access was impossible. Physical access is never impossible. It's just a SOIC clip away.
Reader-Side Buffer Overflows in Point Accrual
The terminal firmware allocates a fixed buffer for point accrual calculations, typically thirty-two bytes of stack space for the multiplier multiplication routine. Feed a multiplier value above 0x0F through a rewritten EEPROM byte and the multiplication overflows into adjacent memory, corrupting the transaction log pointer. In observed deployments, this overflow causes the reader to write the inflated raw value directly to the server-side balance field without running the sanity check that would normally cap per-transaction awards. The multiplier glitch becomes a direct balance injection primitive at that point, and the audit log shows a legitimate write from a legitimate terminal. Zero alarms triggered.