Card, mobile credential, payment and security
A computer science course at the University of Virginia tested whether the mag-stripe student ID cards at the school were vulnerable to copying and were successful in creating new IDs, according to a report in The Cavalier Daily.
Since the students knew the format of the data encoded on the mag-stripe they didn’t even need the original ID but just the student ID number. Multiple fake student IDs were created, tested and then destroyed.
The project showed that with a couple of hundred dollars of equipment, someone could create a fake ID and gain access to residence halls, meal plans, Cav Advantage accounts and anything else that accepts the ID.
The university is aware of the vulnerabilities and is looking at solutions but a timeline of when changes might be made was not available. The student ID system includes more than 30,000 cards and more than 2,500 readers across campus so a new system would be costly.
An editorial in The Cavalier Daily takes the university to task for not seeing the threat as more serious.
“It is not merely experienced students in computer science classes who devote two months to the task that can pull this off. Several first-year Engineering students conducted a similar study before the higher-publicity study was released, first overwriting their own cards with a volunteer’s information, then making a brand new card from scratch using only an index card and some cassette tape. The actual project took less than two hours to complete. It cost $250, which was even more expensive than necessary, as a cheaper card reader would have done just as well as the one they bought,” the column stated.
