Temperature implant testing and hacking

I got my hands on a spare NFC temperature implant that will remain unnamed. You’re not really supposed to have this particular implant (outside of your body) and I don’t want to mess with the company associated hence why I won’t name it. But hacker habits never die so of course I’m going to reverse engineer the heck out of it.

I will share my findings here and take suggestions too.

So far I’ve noticed the following:

  • The proprietary app can be downloaded on another device and logged in with a different google account from the one provided to get the download link.

  • The chip operates fine at room temperature so I will be testing it’s accuracy in a controlled environment compared to other thermal sensors. I will also test its limits down to freezing and up to whatever I judge reasonable.

  • The implant inside the injector is covered in a transparent viscous and sticky substance. My guess is it’s lubricant although I don’t see the point of covering the implant instead of the needle.

My ultimate goal here is to get the temp reading without any proprietary software. I don’t know if it’s possible but it’s worth a try. I’m also really curious about it’s accuracy.

Will be compiling all the information and images HERE

6 Likes

Let’s start with some closeups:






I was able to stitch these together from my DIY microscope:

The IC reads : “D21 1301 D035”

Can a pcb wizard give us an overview of what’s going on? I could easily take more shots if someone wants to map out the circuit.

3 Likes

That’s a QFN16, isn’t it? The only NFC chip that I could find on Mouser with that package is the NXP NCF3310AHN. There’s also a die sized chip on there.

Also, what did TagReader say about the chip?

Can I ask for the dimensions of that glass vial transponder? It looks rather large. And by the looks of how the glass was sealed, I’ve got the impression that it’s not even close to DT’s quality.

3 Likes

Dimensions: 13*3mm



The seal doesn’t look too bad in person. Part of it is filled but there are plenty of air bubbles.

The specs say:

Read only locking and 32- or 64-bit PWD or AES mutual authentication

That sounds bruteforce-able to me. Or maybe I’m missing something. Google says 3 days for 64bit, let’s say there’s some serious delay due to NFC even then it must be under a month right?

2 Likes

It’s not an icode DNA chip. It’s like an ntag5. They “look like” and icode DNA if told to act like one.

4 Likes

The AES is 128 bit… The password function is 32 or 64-bit.

2 Likes

Well… quantum computers are around the corner :sweat_smile:

An app setup with implant A will refuse to read implant B: “This is not one of your registered devices”.

New though… is AES used only for the initial authentication step or is the subsequent data exchange also encrypted?

3 Likes

For anyone wanting to play along here is the stuff and some useful resources:
[Edit: Stuff removed, I hope you had time to grab it]

It’s getting late so I will get to that tomorrow :wave:

3 Likes

Repo to keep everything in one place: github repo

1 Like

Disclaimer: This was a very rough test and there are many thing to improve :sweat_smile:

Both the chip and a thermal probe ( IDM99IV RS PRO) were stuck to the side of a plastic 3-4L container with a drop of hot glue. It was filled with hot tap water. While it cooled I took measurements aprox. every 2 minutes.
It gets messy at 39 C, since that’s pretty close to ambient I had to start adding ice cubes. I completely ignore the importance of stirring until 34 C when I finally come to my senses. That could partially explain the chip’s behavior on that range but still… suspicious?
The not-so-slight constant offset could be attributed to the chip having more surface area in contact with the plastic container wall.

Anyway, that was 1 hour and 30 minutes of my life, not counting the 3 previous attempts that failed in multiple ways.
I will be doing it again someday with a smaller container to make things faster. A stir bar and more regular measurements.
I wonder how I can avoid sticking the chip to a wall. A waterproof version of this maybe?

Edit: My impressions?
Excluding the chaos under 40C, I’m kinda neutral about it. I remember @JennyMcLane , I think, posted something similar about the xBT and it didn’t look great. I can’t find it :confused: but based on that I expected worse.
But I also hoped for better. I don’t know how much my crappy test conditions influenced the measurements but I don’t see the point of giving us two decimal points when you have almost a degree of variation compared to a presumably accurate probe. I don’t see either what kind of meaningful statistics we could do with it other than here’s when you had fever and here’s when you were in hypothermia…
But I’ll wait until I’ve done a test I can be proud of before taking any conclusions :sweat_smile:

Edit: The full test is on tape if someone wants it. I won’t be posting it online.

Edit again: Notice how consistently it flattens out at exactly the human body temperature? Sure I forgot to stir but really? Thats the suspicious part to me… Unless 37C was the ambient temperature at that moment, that could also be a thing.

1 Like

I wasted a bunch of time doing a similar test with xBT but my water container was far too small and the temp was dropping so fast between probe and chip reads that i couldn’t get accurate differentials.

I’ll be making a much better test soon with a stir bar and everything… just a low priority for now

4 Likes

looking in the closeup it appears to me like they sanded down the corners of the chip so it will fit in the tube.

2 Likes

Ahh, thank you comrade. I’ll take a look over the next couple days and try to get a schematic for ya.

I filmed the whole thing and pulled the values from the video. It took more time but was easier to do than writing them down while I was trying to get a read and resetting the timer :wink:

Dunno if you meant that…

But in that case, it was me and not Jenny, and yeees, it looks chaotic. Happy to see someone doing more serious testing about that :wink:

2 Likes

I meant the results weren’t great :sweat_smile: not the post ! And sowy for mixing up the names :pensive:

Well, I’m only a couple of months late.

And yeah now that I see your results they are in fact very different from what I got. I wonder if that’s because it’s in vivo. Were the two temperatures measured in the same spot? Do you have a spare xBT? I’d love it if we could run the same test in parralel.

No problem, I almost forgot about the topic myself :smile:

The implant is in my chest, pretty deep but above the muscle tissue - not visible, can’t even feel it when poking around, but the flipper reads it well. The temperature I took with the thermometer was measured in the mouth for a period of 3 minutes - I notice that the values are a bit more “off” when I take the temp for a shorter time (as in, just measuring until the thermometer beeps).

I’m pretty sure that the sensor of the xBT is accurate and gives out a “correct” temperature by itself, and that the reason for the variance I (and others) experience has to do with placement and such… I hoped for a chest install to be more steady, temperature-wise, compared to the recommended armpit install, and the data provided by @biospoonie seemed to verify that, but like I said in the other thread already, two people is a very small group to get significant data :wink:

The thing I don’t get is why Destron Fearing shows a solid offset of 3° or so on their homepage when this thing is installed in a horse’s neck… I mean, this might just be advertising to be honest…

I read a bit about the chip being used for dogs and cats that hate thermometers (I think it was in switzerland), but for obvious reasons, their owners were just happy with reading the chip and didn’t take rectal temperature simultaneously…

I do, but I’d be happy to keep it sterile - if it turns out that there is a better placement for the implant, I might very well try it out :wink:

1 Like

Yeah that makes sense for the xBT. If you ever change your mind though and want to give it a little bath in hot water lemme know :wink:

That makes sense. I think the oral thermometer might not be ideal either (maybe armpit would be closer?).

If you give it enough time (and as long as you do it correctly), oral measuring is the most exact one except for rectal / vaginal - and I just don’t want to do that every. freakin. day. :wink:
I already wrote in the other thread that the way I track my temperature is used by women to prevent pregnancy - I wouldn’t rely on that alone, but quite a lot of women do. When it is used correctly, it’s about as safe as taking the pill, that’s why I think using an oral thermometer is kinda okay-ish.

Will do! :wink:
For now, I just hope that more people from the xBT-hype at the beginning of the year are willing to chime in and share some data :slight_smile:

Huh okay! Never tried it personally. Good to know

:crossed_fingers: