Looks like https://app.it.okstate.edu/idcard/ is down.
Hacking Oklahoma State University's Student ID
31–40 of 51 posts
Re: Hacking Oklahoma State University's Student ID
#32Looks like https://app.it.okstate.edu/idcard/ is down.
Sorry if that wasn't clear in the post, I'll revisit it. The university took down that URL when I presented the vulnerability to them. So that site has been down for roughly a year.
Re: Hacking Oklahoma State University's Student ID
#33Looks like https://app.it.okstate.edu/idcard/ is down.
Sorry if that wasn't clear in the post, I'll revisit it. The university took down that URL when I presented the vulnerability to them. So that site has been down for roughly a year.
That's great. A "one year later" update would be fun to read. I'm curious what changes(if any) came about from this.
Re: Hacking Oklahoma State University's Student ID
#34Did the same thing at my university years ago. I was able to duplicate and switch IDs on the fly with just one device (part of a senior electrical engineering project that is way too public). Things like COIN are appearing on the market, making duplication far too easy. Having physical access to student ID cards means you can clone them, you need something that does bidirectional authorization if you want to be secure but that costs too much and takes time to upgrade. Easier to lock down the important stuff with ID + something (fingerprint or PIN) if you really want to solve this problem.
Re: Hacking Oklahoma State University's Student ID
#35Universities which use the popular and inexpensive Onity (nee TESA) lock systems, despite their overall problems, gain a bit of security from this problem in that the track used by the locks is written at a nonstandard high bitrate that throws off inexpensive reader/writers. This actually helps prevent duplication, although it's only a measure against people without the resources to obtain the Onity equipment. Outsid…
> Outside of physical tricks like this (and various physical anti-deduplication tricks that are surprisingly limited), duplication is really not something you can ever control. This type of control is the point of smart cards. The card contains a private key which can't be extracted (or at least is difficult to extract and may involve destroying the card) and a processor that can do signing operations which prove to…
Smart cards are super cool! The number of real applications is pretty limited, though, with computer authentication being almost all of them (payment cards, yes, but the fallback to 'conventional' processing negates a lot of the advantage). I think that challenge-response NFC authentication will make this kind of technique more practical for physical access control applications.
Re: Hacking Oklahoma State University's Student ID
#36Hey fellow poke! I'm an MSIS undergrad. I actually had this exact idea over coffee, great work.
Re: Hacking Oklahoma State University's Student ID
#37Nice write up. Just curious, how many of us are still in or near Stillwater (even in OK)?
Stillwater here.
Re: Hacking Oklahoma State University's Student ID
#38Hey fellow poke! I'm an MSIS undergrad. I actually had this exact idea over coffee, great work.
Go pokes :)
Re: Hacking Oklahoma State University's Student ID
#39I went to a University in Virginia and ours, and other surrounding VA universities were equally insecure. We each had a 9 digit code that looked like 10XXXXXXX. These numbers were incremented from one student or faculty to the next. The only track that mattered was track 2. It had your 9 digit code, followed by a the school code (3 digits), followed by a "lost card digit" that was incremented each time a card was los…
Back in 2005, I was at Rochester Institute of Technology, and our ID cards encoded our student ID... which was also our social security number. The Student Government made you take attendence by student ID number for certain functions, so at one point as officer of one of the campus's major clubs I was sitting with a spreadsheet of the names and socials of >1000 students. They were also low-cap magstripes, and the ch…
Get off my lawn. :)
When I was in college, 91-95, your SS# was your identifier. It was the unique code that everyone used when they needed a way to identify people.
I gotta dig it out, but I think my SS# was printed right on my school ID (and the state issued card allowing me to buy alcohol with my out of state driver's license -- Vermont).
Re: Hacking Oklahoma State University's Student ID
#40Nice writeup. I did something much like this in 2002 or 2003. The main difference was that I was malicious, trying to steal money from other students.
I went to Rochester Institute of Tech. The number shown on your card and encoded on the mag stripe were your ID number.
I had plastic card printers and an encoder so making a fake was no problem. The design was simple so it didn't take me long to make one that looked exactly like the real thing.
How did I get numbers to encode? At that time they distributed grades to students in folders outside each department's office. These grade sheets had your full ID number on them. All I had to do was dig through the folders and take grade sheets from people who hadn't bothered picking theirs up.
I think I only used one or two numbers to buy some stuff from The Corner Store. I was mainly doing it to see if I could, credit card fraud was far more profitable.
One of the worst parts about it was that the student IDs were your social security number. Had I wanted to I could have easily used the data and fake IDs for identity theft.