Capturing USB Traffic from Smart Card Readers using Wireshark

Wireshark is a powerful network protocol analyzer that allows users to capture and analyze various types of network traffic, including USB communications. In this post, we will explore how to use Wireshark to sniff the USB traffic and view APDUs being sent to smart cards from other software.

To get started, you'll need to identify the bus and device ID of your smart card reader. You can do this by running the command `lsusb` in your terminal. This will list all connected USB devices, including their bus numbers and device IDs. For example:

Bus 2 device 10: SCM Microsystems, Inc.

In my case, I have a Smart Card reader on Bus 1 device 03 and another on Bus 2 device 10.

Once you've identified the correct device, you'll need to set up some permissions for Wireshark. This involves running the command `sudo adduser $USER wireshark` followed by a reboot to take effect.

Next, you'll need to load the usbmon kernel module by running the command `modprobe usbmon`. You will need to run these two commands each time you want to capture USB traffic.

With Wireshark set up and configured, you can start capturing USB traffic. To do this, open Wireshark and go to Capture > Options > Interface > USB. Select the correct interface (in my case, Bus 2 device 10) and click OK.

Once you've started capturing traffic, you'll be able to see all USB communication happening on that bus. You can filter the capture by selecting 'usb' as the protocol in the filter bar at the top of the Wireshark window.

Wireshark's ability to decode APDUs (Application Protocol Data Units) makes it a powerful tool for understanding what is being sent between your device and SIM card. By using pySim or other proprietary SIM software, you can capture and analyze APDU traffic in real-time, giving you valuable insights into the communication between your device and SIM card.

In conclusion, Wireshark is an incredibly versatile network protocol analyzer that allows users to capture and analyze a wide range of network traffic, including USB communications. By setting up permissions, loading the usbmon kernel module, and configuring Wireshark to capture USB traffic, you can gain valuable insights into what's happening between your device and SIM card.

For example, if you're using a Osmocom SIMtrace to sniff data sent between your phone and SIM card, you'll be able to see all APDU traffic in real-time, giving you a better understanding of how the communication works. Whether you're working with Smart Card readers or SIM cards, capturing and decoding USB traffic can be super useful, and Wireshark is an essential tool for getting the job done.

Wireshark usb