TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Hacking Oklahoma State University's Student ID

162 点作者 samsnelling大约 10 年前

11 条评论

jcrawfordor大约 10 年前
Universities which use the popular and inexpensive Onity (nee TESA) lock systems, despite their overall problems, gain a bit of security from this problem in that the track used by the locks is written at a nonstandard high bitrate that throws off inexpensive reader&#x2F;writers. This actually helps prevent duplication, although it&#x27;s only a measure against people without the resources to obtain the Onity equipment.<p>Outside of physical tricks like this (and various physical anti-deduplication tricks that are surprisingly limited), duplication is really not something you can ever control. So you need to train people to maintain physical custody of the credential and make it as difficult as possible to guess at a valid credential.<p>When cards are used for security identification purposes, the easiest thing to do (and this goes for NFC, RFID, etc) is to generate a long, non-sequential, random card value that is related to the identity of the person only by some database you control. That is, write your 9-digit student ID number to the card for convenience, but when checking identity read out a 16-byte random value that you put on the card just for this purpose. This at least requires that an imposter gain access to the card at some point (to skim it).<p>Ultimately, the best thing you can do in the context of identification cards is to verify the user photograph online. This is done actively by some police departments and guards in high-security installations by looking up the ID in an online system to retrieve the details and photograph of the cardholder for verification. This is also done passively in some high-security installations, for example by placing a monitor above an entry door that displays the photograph of each person unlocking the door, for casual verification by anyone nearby (particularly any guard nearby).<p>Physical access control is my favorite research area.
评论 #9099648 未加载
评论 #9098282 未加载
steakejjs大约 10 年前
I went to a University in Virginia and ours, and other surrounding VA universities were equally insecure.<p>We each had a 9 digit code that looked like 10XXXXXXX. These numbers were incremented from one student or faculty to the next.<p>The only track that mattered was track 2. It had your 9 digit code, followed by a the school code (3 digits), followed by a &quot;lost card digit&quot; that was incremented each time a card was lost (obviously mod 10 here).<p>So if my ID was 100000001, I went to school 002, had lost my card two times, my current card&#x27;s Track 2 would say: 1000000010022<p>Needless to say there are tons of things that can be done here. From getting access to rooms does not, to getting free lunches.<p>Pretty interesting things. I told my school and they didn&#x27;t really care at all (as expected). The potential loss from this is so low that it they didn&#x27;t bother since abusing these issues would get you arrested and expelled pretty quick.<p>In reality, it is probably pretty serious. This student id is used somewhat as a School social security number. You can take tests as other students or impersonate other students in a lot of different situations.
评论 #9097592 未加载
评论 #9097499 未加载
评论 #9097301 未加载
driverdan大约 10 年前
Nice writeup. I did something much like this in 2002 or 2003. The main difference was that I was malicious, trying to steal money from other students.<p>I went to Rochester Institute of Tech. The number shown on your card and encoded on the mag stripe were your ID number.<p>I had plastic card printers and an encoder so making a fake was no problem. The design was simple so it didn&#x27;t take me long to make one that looked exactly like the real thing.<p>How did I get numbers to encode? At that time they distributed grades to students in folders outside each department&#x27;s office. These grade sheets had your full ID number on them. All I had to do was dig through the folders and take grade sheets from people who hadn&#x27;t bothered picking theirs up.<p>I think I only used one or two numbers to buy some stuff from The Corner Store. I was mainly doing it to see if I could, credit card fraud was far more profitable.<p>One of the worst parts about it was that the student IDs were your social security number. Had I wanted to I could have easily used the data and fake IDs for identity theft.
samsnelling大约 10 年前
Well I&#x27;ll be honest, didn&#x27;t expect this post to make it up HN. Happy to answer questions or field comments.
评论 #9097197 未加载
评论 #9097447 未加载
评论 #9097602 未加载
评论 #9097194 未加载
评论 #9101028 未加载
joshtgreenwood大约 10 年前
Looks like <a href="https://app.it.okstate.edu/idcard/" rel="nofollow">https:&#x2F;&#x2F;app.it.okstate.edu&#x2F;idcard&#x2F;</a> is down.
评论 #9098438 未加载
stealthflyer大约 10 年前
Did the same thing at my university years ago. I was able to duplicate and switch IDs on the fly with just one device (part of a senior electrical engineering project that is way too public). Things like COIN are appearing on the market, making duplication far too easy. Having physical access to student ID cards means you can clone them, you need something that does bidirectional authorization if you want to be secure but that costs too much and takes time to upgrade. Easier to lock down the important stuff with ID + something (fingerprint or PIN) if you really want to solve this problem.
omgitstom大约 10 年前
This isn&#x27;t just a problem with just universities. I have a card reader as well, and any site that issues swipe-able ID cards is more than likely susceptible. You would be surprised how many use an incrementing ID that you can easily impersonate another user.<p>The equipment needed to create fake cards (not just blanks) that look good is trivial to purchase.<p>I would be curious if OSU built or bought this system to issue cards. If they built it, shame of them. If they bought it, shame on them as well. Any security audit would have caught this clearly. Cards like any interface require good design for use and security.
评论 #9097640 未加载
jtsan大约 10 年前
In your node.js script, once you find the first ID number couldn&#x27;t you just starting testing ID&#x27;s less than and greater than the found ID since it&#x27;s more than likely an incremented ID?
mralvar大约 10 年前
Hey fellow poke! I&#x27;m an MSIS undergrad. I actually had this exact idea over coffee, great work.
评论 #9098892 未加载
noblethrasher大约 10 年前
Nice write up. Just curious, how many of us are still in or near Stillwater (even in OK)?
评论 #9097690 未加载
评论 #9098881 未加载
评论 #9099531 未加载
评论 #9098272 未加载
smcquaid大约 10 年前
I am going to take a guess that you failed to publish the contents of encrypted track 3 due to INTEGRAl security concerns from your university?
评论 #9097895 未加载