Hacking Oklahoma State University's Student ID
1–10 of 51 posts
Re: Hacking Oklahoma State University's Student ID
#2Well I'll be honest, didn't expect this post to make it up HN. Happy to answer questions or field comments.
Re: Hacking Oklahoma State University's Student ID
#3I went to a University in Virginia and ours, and other surrounding VA universities were equally insecure.
We each had a 9 digit code that looked like 10XXXXXXX. These numbers were incremented from one student or faculty to the next.
The only track that mattered was track 2. It had your 9 digit code, followed by a the school code (3 digits), followed by a "lost card digit" that was incremented each time a card was lost (obviously mod 10 here).
So if my ID was 100000001, I went to school 002, had lost my card two times, my current card's Track 2 would say: 1000000010022
Needless to say there are tons of things that can be done here. From getting access to rooms does not, to getting free lunches.
Pretty interesting things. I told my school and they didn't really care at all (as expected). The potential loss from this is so low that it they didn't bother since abusing these issues would get you arrested and expelled pretty quick.
In reality, it is probably pretty serious. This student id is used somewhat as a School social security number. You can take tests as other students or impersonate other students in a lot of different situations.
Re: Hacking Oklahoma State University's Student ID
#4Well I'll be honest, didn't expect this post to make it up HN. Happy to answer questions or field comments.
It was well written and had simple to follow examples. Plus it was interesting to see such a blatant security hole... Any follow up from the university on it?
Re: Hacking Oklahoma State University's Student ID
#5Well I'll be honest, didn't expect this post to make it up HN. Happy to answer questions or field comments.
I'm kind of curious - since this was for a class it was kind of allowed but was there any fine lines that you weren't allowed to cross when doing research for the exploit? I assume as long as you didn't hurt the university's reputation (such as getting bad press) or caused massive amounts of monetary damage you would probably not get into trouble.
Re: Hacking Oklahoma State University's Student ID
#6Well I'll be honest, didn't expect this post to make it up HN. Happy to answer questions or field comments.
It was well written and had simple to follow examples. Plus it was interesting to see such a blatant security hole... Any follow up from the university on it?
I appreciate it. The University definitely took it seriously at the time (the project became a neat recruiting story for the InfoSec class), however outside of taking down the website to check for ID validity, I do not believe there was any other recourse. There was such a high overhead to change systems and reissue the ID's (some professors have decade old ID's), that I think it was viewed as "not worth fixing."
Re: Hacking Oklahoma State University's Student ID
#7Well I'll be honest, didn't expect this post to make it up HN. Happy to answer questions or field comments.
I'm kind of curious - since this was for a class it was kind of allowed but was there any fine lines that you weren't allowed to cross when doing research for the exploit? I assume as long as you didn't hurt the university's reputation (such as getting bad press) or caused massive amounts of monetary damage you would probably not get into trouble.
We had pretty strict guidelines to follow to be apart of the InfoSec class. We basically signed a waiver at the beginning saying that if we did exploit something, we would be subject to expulsion. It was a "theory" based class and all actual research had to be done within a certain IP range in a particular computer lab.
With that said, this was the final report that I made in the Winter of 2013. I presented it Spring 2014 to the University staff. And now, graduated, with over a full 12 months behind it, I felt comfortable to post it.
Re: Hacking Oklahoma State University's Student ID
#8I went to a University in Virginia and ours, and other surrounding VA universities were equally insecure. We each had a 9 digit code that looked like 10XXXXXXX. These numbers were incremented from one student or faculty to the next. The only track that mattered was track 2. It had your 9 digit code, followed by a the school code (3 digits), followed by a "lost card digit" that was incremented each time a card was los…
What do you mean by "school code"? Wouldn't they all be the same for everyone at your university?
Re: Hacking Oklahoma State University's Student ID
#9I went to a University in Virginia and ours, and other surrounding VA universities were equally insecure. We each had a 9 digit code that looked like 10XXXXXXX. These numbers were incremented from one student or faculty to the next. The only track that mattered was track 2. It had your 9 digit code, followed by a the school code (3 digits), followed by a "lost card digit" that was incremented each time a card was los…
What do you mean by "school code"? Wouldn't they all be the same for everyone at your university?
Yes the school code was the same for everyone at the University. It differs from college to college, since this is a "solution" that the university purchases from a company.
Re: Hacking Oklahoma State University's Student ID
#10I went to a University in Virginia and ours, and other surrounding VA universities were equally insecure. We each had a 9 digit code that looked like 10XXXXXXX. These numbers were incremented from one student or faculty to the next. The only track that mattered was track 2. It had your 9 digit code, followed by a the school code (3 digits), followed by a "lost card digit" that was incremented each time a card was los…
What do you mean by "school code"? Wouldn't they all be the same for everyone at your university?
There are many schools in a university. School of Engineering, School of Music, etc.
In most U.S. universities there is a hierarchy: university contains colleges which contain schools.