The operators of a certain NZ public transport system told us it used a "safe and secure smart card", but of course it was proprietary, we just had to "trust" them. Someone might want to explain terms like "white-list", "encryption" and "server side validation" to them because they made some very non-smart security decisions. In this talk I'll explain the details of reverse engineering the system, the cards, protocols and formats used. While doing so I discovered a number of vulnerabilities in this smart card system. It turns out there are both client side and server side vulnerabilities, which allow total exploitation.