8 ms·
Hacking Oklahoma State University's Student ID
- samsnelling 12y agoWell I'll be honest, didn't expect this post to make it up HN. Happy to answer questions or field comments.
- pyrox420 12y agoIt was well written and had simple to follow examples. Plus it was interesting to see such a blatant security hole... Any follow up from the university on it?
- samsnelling 12y agoI appreciate it. The University definitely took it seriously at the time (the project became a neat recruiting story for the InfoSec class), however outside of taking down the website to check for ID validity, I do not believe there was any other recourse. There was such a high overhead to change systems and reissue the ID's (some professors have decade old ID's), that I think it was viewed as "not worth fixing."
- nadams 12y agoI'm kind of curious - since this was for a class it was kind of allowed but was there any fine lines that you weren't allowed to cross when doing research for the exploit? I assume as long as you didn't hurt the university's reputation (such as getting bad press) or caused massive amounts of monetary damage you would probably not get into trouble.
- samsnelling 12y agoWe had pretty strict guidelines to follow to be apart of the InfoSec class. We basically signed a waiver at the beginning saying that if we did exploit something, we would be subject to expulsion. It was a "theory" based class and all actual research had to be done within a certain IP range in a particular computer lab. With that said, this was the final report that I made in the Winter of 2013. I presented it Spring 2014 to the University staff. And now, graduated, with over a full 12 months behind it, I felt comfortable to post it.
- grecy 12y agoThey were not upset you made a "blank" ID card and tried to borrow a Surface Pro with it then use it at a cafe? I personally think you might have crossed the line on actually using it.
- colinbartlett 12y agoThese folks found a gaping security hole that can be exploited to gain physical access to secured areas as well as charge fraudulent financial transactions. I can't imagine the university getting upset with checking out a library book.
- rwallace 12y agoYou would be astonished at how crazy people can get. Honestly, the author of this study took a huge risk and got lucky. If you're thinking of doing anything like this in similar circumstances, DON'T carry out similar actions without first obtaining written permission for each specific action.
- samsnelling 12y ago@greyc Even though I made a blank card, it was still encoded with my student ID number. That was the only reason it was allowed. The point of trying it was to prove that the name or discretionary data did not affect the card working. While I definitely toed the line, I tried to be careful not to break any of the rules of the class.
- deleted 12y ago[deleted]
- remarkEon 12y agoIn your judgement how common do you feel this exploit would be across other university IDs in the country, or just IDs in general? Did your research uncover any data in that regard one way or the other? I'm just remembering my ID card...and my sister's...and my brother's. We used those for literally everything.
- samsnelling 12y agoWhile my research was specific to OSU, I do know that this is a larger issue than just my alma mater. I collected student IDs from other colleges, but did not publish them as I didn't want to get into hot water. The thing is though, a lot of these magstripe systems have problems. We brought up in the presentation that Walmart at the time was having a large problem with people encoding stolen credit card data onto gift cards. Cashiers at the time did not check driver licenses when paying with a gift card.
- jackweirdy 12y ago> people encoding stolen credit card data onto gift cards. Cashiers at the time did not check driver licenses when paying with a gift card That is top-quality social engineering.
- dferlemann 12y agoVery interesting. I attended OSU. I bet most of universities have the similar kind of security holes. They probably use the fact that not too many people can exploit those technical security flaws as the single line of defense.
- samsnelling 12y agoGlad to see another Poke! I agree, you have to be fairly clever to get this far. With that said, the barrier of entry is decreasing every day with things like Coin & loop pay.
- dferlemann 12y agoI wonder if FERPA, PCI-DSS apply here. We know they are vulnerable about student information, with extra functionality as a payment card, it is getting kinda scary.
- feelslikefelt 12y agoNo questions, but fantastic post.
- steakejjs 12y agoI went to a University in Virginia and ours, and other surrounding VA universities were equally insecure. We each had a 9 digit code that looked like 10XXXXXXX. These numbers were incremented from one student or faculty to the next. The only track that mattered was track 2. It had your 9 digit code, followed by a the school code (3 digits), followed by a "lost card digit" that was incremented each time a card was lost (obviously mod 10 here). So if my ID was 100000001, I went to school 002, had lost my card two times, my current card's Track 2 would say: 1000000010022 Needless to say there are tons of things that can be done here. From getting access to rooms does not, to getting free lunches. Pretty interesting things. I told my school and they didn't really care at all (as expected). The potential loss from this is so low that it they didn't bother since abusing these issues would get you arrested and expelled pretty quick. In reality, it is probably pretty serious. This student id is used somewhat as a School social security number. You can take tests as other students or impersonate other students in a lot of different situations.
- scuba7183 12y agoWhat do you mean by "school code"? Wouldn't they all be the same for everyone at your university?
- steakejjs 12y agoYes the school code was the same for everyone at the University. It differs from college to college, since this is a "solution" that the university purchases from a company.
- gresrun 12y agoThere are many schools in a university. School of Engineering, School of Music, etc. In most U.S. universities there is a hierarchy: university contains colleges which contain schools.
- davb 12y agoAnd for comparison, my experience of Scottish (and possibly other UK country) universities has been: University -> Faculty (e.g. Faculty of Technology) -> School (e.g. School of Engineering) -> Department. But this does vary from institution to institution.
- omgitstom 12y agoThis isn't just a problem with just universities. I have a card reader as well, and any site that issues swipe-able ID cards is more than likely susceptible. You would be surprised how many use an incrementing ID that you can easily impersonate another user. The equipment needed to create fake cards (not just blanks) that look good is trivial to purchase. I would be curious if OSU built or bought this system to issue cards. If they built it, shame of them. If they bought it, shame on them as well. Any security audit would have caught this clearly. Cards like any interface require good design for use and security.
- samsnelling 12y agoI think you hit the nail on the head here - this isn't a super sophisticated reverse engineer. Total equipment cost is $300 (for one that prints a full color front!) and you could theoretically impersonate anyone on a wide array of systems.
- noblethrasher 12y agoNice write up. Just curious, how many of us are still in or near Stillwater (even in OK)?
- samsnelling 12y agoCan't speak for anyone else, but I'm currently in OKC.
- infosecpoke 12y agoI ended up in Iowa.... After a 6 year run on the East Coast straight out of college. Good article. Go Pokes.
- sfall 12y agochicago
- mralvar 12y agoStillwater here.
- pauldcox 12y agoTulsa
- smcquaid 12y agoI am going to take a guess that you failed to publish the contents of encrypted track 3 due to INTEGRAl security concerns from your university?
- samsnelling 12y agoOklahoma State Student ID's did not use Track 3. We only encoded track 1 & 2 on the blank card.
- jcrawfordor 12y agoUniversities which use the popular and inexpensive Onity (nee TESA) lock systems, despite their overall problems, gain a bit of security from this problem in that the track used by the locks is written at a nonstandard high bitrate that throws off inexpensive reader/writers. This actually helps prevent duplication, although it's only a measure against people without the resources to obtain the Onity equipment. Outside of physical tricks like this (and various physical anti-deduplication tricks that are surprisingly limited), duplication is really not something you can ever control. So you need to train people to maintain physical custody of the credential and make it as difficult as possible to guess at a valid credential. When cards are used for security identification purposes, the easiest thing to do (and this goes for NFC, RFID, etc) is to generate a long, non-sequential, random card value that is related to the identity of the person only by some database you control. That is, write your 9-digit student ID number to the card for convenience, but when checking identity read out a 16-byte random value that you put on the card just for this purpose. This at least requires that an imposter gain access to the card at some point (to skim it). Ultimately, the best thing you can do in the context of identification cards is to verify the user photograph online. This is done actively by some police departments and guards in high-security installations by looking up the ID in an online system to retrieve the details and photograph of the cardholder for verification. This is also done passively in some high-security installations, for example by placing a monitor above an entry door that displays the photograph of each person unlocking the door, for casual verification by anyone nearby (particularly any guard nearby). Physical access control is my favorite research area.
- hamburglar 12y ago> Outside of physical tricks like this (and various physical anti-deduplication tricks that are surprisingly limited), duplication is really not something you can ever control. This type of control is the point of smart cards. The card contains a private key which can't be extracted (or at least is difficult to extract and may involve destroying the card) and a processor that can do signing operations which prove to the kiosk/register/whatever that the card is physically present.
- jcrawfordor 12y ago
- joshtgreenwood 12y agoLooks like https://app.it.okstate.edu/idcard/ https://app.it.okstate.edu/idcard/ is down.
- samsnelling 12y agoSorry if that wasn't clear in the post, I'll revisit it. The university took down that URL when I presented the vulnerability to them. So that site has been down for roughly a year.
- joshtgreenwood 12y agoThat's great. A "one year later" update would be fun to read. I'm curious what changes(if any) came about from this.
- stealthflyer 12y agoDid the same thing at my university years ago. I was able to duplicate and switch IDs on the fly with just one device (part of a senior electrical engineering project that is way too public). Things like COIN are appearing on the market, making duplication far too easy. Having physical access to student ID cards means you can clone them, you need something that does bidirectional authorization if you want to be secure but that costs too much and takes time to upgrade. Easier to lock down the important stuff with ID + something (fingerprint or PIN) if you really want to solve this problem.
- mralvar 12y agoHey fellow poke! I'm an MSIS undergrad. I actually had this exact idea over coffee, great work.
- samsnelling 12y agoGo pokes :)
- driverdan 12y agoNice writeup. I did something much like this in 2002 or 2003. The main difference was that I was malicious, trying to steal money from other students. I went to Rochester Institute of Tech. The number shown on your card and encoded on the mag stripe were your ID number. I had plastic card printers and an encoder so making a fake was no problem. The design was simple so it didn't take me long to make one that looked exactly like the real thing. How did I get numbers to encode? At that time they distributed grades to students in folders outside each department's office. These grade sheets had your full ID number on them. All I had to do was dig through the folders and take grade sheets from people who hadn't bothered picking theirs up. I think I only used one or two numbers to buy some stuff from The Corner Store. I was mainly doing it to see if I could, credit card fraud was far more profitable. One of the worst parts about it was that the student IDs were your social security number. Had I wanted to I could have easily used the data and fake IDs for identity theft.
- jtsan 12y agoIn your node.js script, once you find the first ID number couldn't you just starting testing ID's less than and greater than the found ID since it's more than likely an incremented ID?