We had a very similar situation at my college. ID cards with mag stripes were used for a lot of stuff-meal plans, restricted access academic areas, and housing.

We had a very similar situation at my college. ID cards with mag stripes were used for a lot of stuff-meal plans, restricted access academic areas, and housing. I had an inkling that these were pretty insecure, so I read mine and found that the mag stripe had a zero padded ID number, issue number, and a single digit XOR checksum. Through a separate issue, I was able to learn most student's IDs in the student intranet system. Also, all this info was printed on the front of the cards, which students did not secure well. I built myself an arduino mag spoofer: http://lifehacker.com/5677465/diy-arduino-magstripe-emulator http://lifehacker.com/5677465/diy-arduino-magstripe-emulator And figured out how to iterate through the issue numbers. Got into someone's apartment with their permission, then went to the IT people. The lead IT guy was cool (we had a friendship from my first day there), asked me to read his card and we went and opened the server room. He escalated it up the chain. Not sure if it was ever replaced with something more secure (doubtful).