• (cs) in reply to AP2
    AP2:
    Satanicpuppy:
    Worse than that. If the encrypted data is just money (which it would seem that it has to be, for it to be so trivially transferred) the transactions are same-as-cash. Impossible to check.

    No doubt they realized that they'd been had when they did the accounting, but the odds of them being able to trace it back to the physical card are slim.

    It doesn't have to be, it could be copying everything including the user id. But there's an easy way to check: charge two different cards with the same balance (say, $5) and compare the data. If they're the same, the cards are untraceable.

    This was likely the case because it's obviously a hell of a lot cheaper to not require a client-server setup, and therefore was probably a lot more attractive to the uni vs. something that actually implements some sort of security feature(s).

  • (cs)

    What the hell is with the ponies and rainbows on selecting the word RS232?

  • (cs) in reply to whiskeylover
    whiskeylover:
    What the hell is with the ponies and rainbows on selecting the word RS232?

    Welcome to Remy Porter's twisted mind...

  • Belcat (unregistered) in reply to Severity One
    Severity One:
    Robert Hanson:
    Its fun to figure out how to rig the system; not so much fun when the system rigs you. Going to jail and being expelled just for free soda seems childish.
    Point is, how would they prove it? Somebody could prove his innocence by providing top-up chits, but you don't have to prove your innocence: the affected party needs to prove your guilt. Now, finding a card reader/writer would be highly incriminating, but for that you'd need to search the dorms.

    Not as easy as it sounds, unless they had a strong suspicion who was behind it (and most likely, they didn't).

    Actually, it's easier than you think, if they weren't scrupulous enough and let just about any student "recharge" their card. All they need is some guinea pig student to have it done to his card, and that this student be a witness to it done, then they have proof.

    Of course if you only do it to your card, it's hard to prove, unless it's tracking your card by serial number, but it doesn't sound like it these even have those (duh...).

    It'd be better to say you're selling "used card" you don't need anymore because you're dropping out and can't get a cash refund... it would take them a little longer to catch on ;P Keep the posting up a board, and sell many cards...

  • (cs) in reply to C-Octothorpe
    C-Octothorpe:
    whiskeylover:
    What the hell is with the ponies and rainbows on selecting the word RS232?

    Welcome to Remy Porter's twisted mind...

    Why???... pokes eyes out

  • Anonymous (unregistered) in reply to Rumen

    Counterfeiting doesn't apply only to legal tender. Even if it didn't apply to such tickets you'd still be guilty of fraud anyway.

  • ares (unregistered) in reply to Severity One

    Highly incriminating ? Then i think having penis counts as 'highly incriminating' in context of a rape case, oh ? Or having a knife when somebody has been knifed a few blocks away ?

    IMO unless the vending machines recorded purchases AND the cashiers kept records of deposits, it's all circumstantial evidence and the school is SHIT OUT OF LUCK (without some rats/witnesses).

  • xdiv0x (unregistered)

    CU Boulder did not have this problem in 2002, our student ID's worked like pre-loaded credit cards off-campus as well so we never questioned where things were being stored.

    But the basement CS labs were opened with cards, purchased by students, which gave them access to rooms depending on the courses enrolled in.

    Those, we could hack. They could hack, I mean. Not sure the benefit of gaining access to other labs, except maybe in case a lab was full during midterms or final projects. Didn't stop those modifications from being sold at $5/per.

  • trtrwtf (unregistered) in reply to Pol
    Pol:
    The Flaming Foobar:

    Tm8gc2hpdCwgU2hlcmxvY2suLi4=

    Lol!!

    Only on this site....

  • ares (unregistered) in reply to ares

    Unless there was no ID on the card (then logging 'transactions' is kinda pointless). But the person who designed this system/scheme already deserves to have their hands broken/cut off. Even if he was deans nephew.

  • (cs) in reply to boog
    boog:
    newfweiler:
    I'm old and I remember when we had these things called "Vending Machines". We had things called "coins" that we would carry around in our pockets. Each "coin" had a nominal value, typically five or ten cents. You would pay for your soda by putting a coin into the slot in the machine. What people would do is make "slugs" which were metal disks the same size and weight as coins. Sometimes these slugs would be accepted as coins by the machine. Another trick we learned was that if you dropped in a real coin and pressed two buttons all at the same time, sometimes two or three cans of soda would come out.
    When I was a senior in high school, one of my buddies found that if we reset one of the vending machines, it defaulted to $1. We got a round of free sodas and gave a few out to passers by.
    $1 is free?
  • The Great Lobachevsky (unregistered) in reply to mjk340
    mjk340:
    Penn State had a system like this in place in 2001 when I was a burgeoning computer science student. It was called LionCash, had a $99 dollar storage limit, the card machines worked way too fast to be phoning home, and if you lost a card your money was lost for good, so I knew the balance was stored on the chip itself.

    It was the same chip used on the AT&T SIM cards, pictured here : http://img.ehowcdn.com/article-page-main/ehow/images/a07/ob/3e/another-att-sim-chip-800x800.jpg

    The card readers were a bit pricey for a Raman noodle eating college student at the time so I never went through with trying to hack it.

    A quick google search shows they now have a LionCash+ system in place that boasts "added security" and appears to have data stored on a central server (family can add money from home)

    I graduated from there in 1998 - the last year before they rolled LionCash out. Before that we used plain old magnetic card readers. One of the reasons they gave for rolling it out was that local merchants down on College Ave could take it as well, not just the university. Wonder how well that went, if it went at all.

  • (cs)

    You know, I don't even see how such a system is even "easy and convenient" for the user. Students just don't walk around with bundles of cash, so the card is not that much easier to carry. And now, instead of just losing a single bill out of your pocket, when you lose your card you lose ALL your money. I'm sure that if the problem was people losing their cards or having them accidentally wiped, the system would never have been changed.

  • The Great Lobachevsky (unregistered) in reply to whiskeylover
    whiskeylover:
    What the hell is with the ponies and rainbows on selecting the word RS232?

    Welcome to TDWTF :)

  • Larry (unregistered) in reply to Hasteur
    Hasteur:
    We used a similar system at my campus. Printouts, Copiers, and a few vending machines used the system. I never kept more than $5 on my card as one of the primary crimes was mugging students for their card chip value.
    Larry: Good day fine sir, my name is Larry, and I'll be your mugger today. Please let me know if my service does not meet your expectations in any way.

    Hasteur: Fuck off.

    Larry: I'm sorry sir, but the regulations of the local thieves' guild won't allow me to do that. Now if you'd just hand over your chip card we can be on our merry way. No need to give me your whole wallet, I can see you aren't the sort of person to have any cash, and your identity probably isn't worth stealing either.

    Hasteur: But there's only $5 on my card.

    Larry: Goodness gracious, I've been fully foiled by your dastardly defenses! You look like the honest sort, so I'm going to believe you. Please accept my sincerest regrets for unnecessarily detaining you.

  • Brad (unregistered) in reply to newfweiler

    This story is completely untrue; everyone was honest in the Good Old Days and only the current generation are scallywags.

  • mjk340 (unregistered) in reply to The Great Lobachevsky
    The Great Lobachevsky:
    mjk340:
    Penn State had a system like this in place in 2001 when I was a burgeoning computer science student. It was called LionCash, had a $99 dollar storage limit, the card machines worked way too fast to be phoning home, and if you lost a card your money was lost for good, so I knew the balance was stored on the chip itself.

    It was the same chip used on the AT&T SIM cards, pictured here : http://img.ehowcdn.com/article-page-main/ehow/images/a07/ob/3e/another-att-sim-chip-800x800.jpg

    The card readers were a bit pricey for a Raman noodle eating college student at the time so I never went through with trying to hack it.

    A quick google search shows they now have a LionCash+ system in place that boasts "added security" and appears to have data stored on a central server (family can add money from home)

    I graduated from there in 1998 - the last year before they rolled LionCash out. Before that we used plain old magnetic card readers. One of the reasons they gave for rolling it out was that local merchants down on College Ave could take it as well, not just the university. Wonder how well that went, if it went at all.

    Did a search for 'LionCash' on the Collegian website and there is an article about dropping the system in 2004 "To improve technology and money usage on campus". I'm guessing they discovered fraud but wanted to keep a lid on it.

  • (cs) in reply to operagost
    operagost:
    boog:
    When I was a senior in high school, one of my buddies found that if we reset one of the vending machines, it defaulted to $1. We got a round of free sodas and gave a few out to passers by.
    $1 is free?
    Technically no; you couldn't hit the return to "get your money back," since no money was put in.

    All you could do was spend it on soda, so it was the soda that was free. Not the $1.

  • goob (unregistered) in reply to boog
    boog:
    operagost:
    boog:
    When I was a senior in high school, one of my buddies found that if we reset one of the vending machines, it defaulted to $1. We got a round of free sodas and gave a few out to passers by.
    $1 is free?
    Technically no; you couldn't hit the return to "get your money back," since no money was put in.

    All you could do was spend it on soda, so it was the soda that was free. Not the $1.

    C'mon boog, you've been watching too many unicorns and you're starting to write like a TDWTF writer.

    I think you meant to say "it defaulted to assume that $1 had already been deposited, and fortunately the sodas cost exactly $1, so you could just press the button and get free product". Or something like that. Right?

  • (cs) in reply to goob
    goob:
    C'mon boog, you've been watching too many unicorns and you're starting to write like a TDWTF writer.
    Actually, my NoScript settings have "cornify.com" forbidden, so I'm safe.

    For now.

    goob:
    I think you meant to say "it defaulted to assume that $1 had already been deposited, and fortunately the sodas cost exactly $1, so you could just press the button and get free product". Or something like that. Right?
    Right, and amazingly enough, what I said was something like that.

    Imagine that.

  • Jay (unregistered) in reply to Rumen
    Rumen:
    How is it illegal to "counterfeit" a non-official currency? It is like when you have a big festival where you need to buy tickets for beer, and you decide to print those tickets yourself. I always wondered which law you are supposed to be breaking there.

    If someone says, "I will sell you a beer for $2", and you take the beer without giving him $2, that is called "stealing". Whether you do it by giving him counterfeit money, forging a receipt, grabbing the beer when he's not looking, or knocking him over the head and taking the beer while he's unconscious, it's still stealing.

    Okay, technically the law has different terms for various forms of stealing. It may be "theft", "burglary", "fraud", "counterfeiting", "theft by deception", "embezzlement", etc, etc.

    I'm sure many people have fantasized at one time or another that they could come up with some way to steal someone else's property that the lawyers haven't thought of, and thus confound the courts with an act that everyone intuitively knows is stealing, but which is not actually prohibited by any law.

    Fortunately or unfortunately, depending on which way you looking at it, the lawyers are smart enough to make the laws very broad. Like, here's a section of my state's (Michigan's) law on fraud: "(1) A person who, with the intent to defraud or cheat makes or uses a false pretense to do one or more of the following is guilty of a crime punishable as provided in this section: ... (c) Obtain from a person any money or personal property or the use of any instrument, facility, article, or other valuable thing or service. (d) By means of a false weight or measure obtain a larger amount or quantity of property than was bargained for. ..." Etc. Note that this is very general. Any false statement intended to obtain property "or other valuable thing or service" is a crime. It would be pretty tough to weasel out of that on some technicality. Likewise the law on counterfeiting applies to "any finanacial instrument or bank note". They specifically spell out checks and credit cards and electronic codes that give access to an account, but end up throwing in "any other document, device," etc etc.

    Oh, I'm sure there are smart people who have found loopholes. But it's not as easy as, "This receipt isn't legal currency, therefore there's no law against me making a fake one."

    Hey, total by the way, while I was looking up that quote, I stumbled across another interesting law. In the state of Michigan, it is a crime, punishable by a year in prison or a fine of $1000, to deliver a message challenging someone to a duel. Whew, read that just in time. Sorry, Bob, I guess I won't be delivering that note for you after all ...

  • JF (unregistered) in reply to boog

    TE9MLCB5b3UgYmV0IDpQ

  • Rookierookie (unregistered) in reply to The Great Lobachevsky

    LionCash today is tied to your student ID card, and you can use it in many of the stores in the downtown area.

  • Jay (unregistered) in reply to Severity One
    Severity One:
    Point is, how would they prove it? Somebody could prove his innocence by providing top-up chits, but you don't have to prove your innocence: the affected party needs to prove your guilt. Now, finding a card reader/writer would be highly incriminating, but for that you'd need to search the dorms.

    Not as easy as it sounds, unless they had a strong suspicion who was behind it (and most likely, they didn't).

    Hmm, how dumb do you think our police and courts are? Like, "Well, we caught this man twenty feet from the bank, running away, holding a bag full of money with serial numbers that match the stolen bills, with a gun in his hand that ballistics tests show matches the bullets that killed the bank guard. But he claims that he just found the money sitting on the sidewalk where the thief must have dropped it and that he was on his way to return it to the bank but must have taken a wrong turn. His gun might just by coincidence have similar ballistics patterns to the murder weapon. Oh, and he says he always wears a ski mask in the middle of summer because he comes from a hot climate and gets cold very easily. So I guess we just can't prove anything. We'll have to let him go."

    Also, I don't see how Clark Kent could possibly be Superman, because Clark Kent wears glasses and Superman doesn't.

  • (cs) in reply to XXXXX
    XXXXX:
    How hard would it have been to track which cards seemed to have the most suspicious money on them? Then flip those weenies on the guy with the dongle?

    Hey, watch your language!

  • Marcelk (unregistered) in reply to Severity One
    Severity One:
    Paco:
    In Holland, [...]
    No, the Netherlands. Holland as an independent state ceased to exist over two centuries ago.

    No, Holland. It wasn't rolled out in the rest of the Netherlands.

  • (cs) in reply to Quango

    I was impressed when it didn't turn out to be ROT-13 encoded!

  • Nagesh (unregistered) in reply to boog
    boog:
    operagost:
    boog:
    When I was a senior in high school, one of my buddies found that if we reset one of the vending machines, it defaulted to $1. We got a round of free sodas and gave a few out to passers by.
    $1 is free?
    Technically no; you couldn't hit the return to "get your money back," since no money was put in.

    All you could do was spend it on soda, so it was the soda that was free. Not the $1.

    Really, booger? Are you trying to be convincing us u are old enough to be in secondary school system? Try again, matterhorn.

  • ac (unregistered)
    http://en.wikipedia.org/wiki/Sneakers_(film):
    In exchange for overlooking his past, as well as a sizable cash payment, they ask Martin to recover a "black box" decoder device that mathematician Dr. Gunter Janek (Donal Logue) has been developing for the Russian government under the guise of a company called "Setec Astronomy," one that the NSA can't even find, let alone steal or duplicate.
    Someone feeling nostalgic?
  • michael scott (unregistered)

    our university had a similar system but the amount was stored on a server and strong encryption was used (rc4 i think). too bad it was still vulnerable to replay attacks. encryption is easy. key management is hard and implementation is harder.

  • Michael Scott (unregistered) in reply to michael scott
    michael scott:
    our university had a similar system but the amount was stored on a server and strong encryption was used (rc4 i think). too bad it was still vulnerable to replay attacks. encryption is easy. key management is hard and implementation is harder.

    That's what she said.

  • (cs) in reply to Nagesh
    Nagesh (cheap substitution):
    Really, booger? Are you trying to be convincing us u are old enough to be in secondary school system? Try again, matterhorn.
    I'm trying, but you're not making it very easy.
  • Rollin you (unregistered) in reply to Severity One
    Severity One:
    Robert Hanson:
    Its fun to figure out how to rig the system; not so much fun when the system rigs you. Going to jail and being expelled just for free soda seems childish.
    Point is, how would they prove it? Somebody could prove his innocence by providing top-up chits, but you don't have to prove your innocence: the affected party needs to prove your guilt. Now, finding a card reader/writer would be highly incriminating, but for that you'd need to search the dorms.

    Not as easy as it sounds, unless they had a strong suspicion who was behind it (and most likely, they didn't).

    Dear sir,

    We have recently conducted an audit of all cards and detected that you have recently spent $XXXXX on softdrink/books. According to our records, your card has been credited with $YYYYY. Would you please stop by the administration building to discuss this discrepency.

    Please be sure to bring your payment card and a change of clothes.

    Many regards, AnySanePerson

  • (cs) in reply to Nagesh
    Nagesh:
    Really, booger? Are you trying to be convincing us u are old enough to be in secondary school system? Try again, matterhorn.

    You're trying too hard man...

  • trtrwtf (unregistered) in reply to Rollin you
    Rollin you:
    Severity One:
    Robert Hanson:
    Its fun to figure out how to rig the system; not so much fun when the system rigs you. Going to jail and being expelled just for free soda seems childish.
    Point is, how would they prove it? Somebody could prove his innocence by providing top-up chits, but you don't have to prove your innocence: the affected party needs to prove your guilt. Now, finding a card reader/writer would be highly incriminating, but for that you'd need to search the dorms.

    Not as easy as it sounds, unless they had a strong suspicion who was behind it (and most likely, they didn't).

    Dear sir,

    We have recently conducted an audit of all cards and detected that you have recently spent $XXXXX on softdrink/books. According to our records, your card has been credited with $YYYYY. Would you please stop by the administration building to discuss this discrepency.

    Please be sure to bring your payment card and a change of clothes.

    Many regards, AnySanePerson

    Read the article - no basis for the audit, as no records are kept of what is spent on each card. The assumption was apparently made that there would be only one way to put value on a card, and that would be through a cashier. That assumption turned out to be false. Oops.

  • (cs) in reply to Rollin you
    Rollin you:
    Dear sir,

    We have recently conducted an audit of all cards and detected that you have recently spent $XXXXX on softdrink/books. According to our records, your card has been credited with $YYYYY. Would you please stop by the administration building to discuss this discrepency.

    Please be sure to bring your payment card and a change of clothes.

    Many regards, AnySanePerson

    Dear AnySanePerson,

    Assuming you even track card numbers/accounts, please be sure to also bring proof of me using my stolen card on those dates.

    Thanks and take care,

    BastardStudent

  • eric76 (unregistered) in reply to Belcat
    Belcat:
    Actually, it's easier than you think, if they weren't scrupulous enough and let just about any student "recharge" their card. All they need is some guinea pig student to have it done to his card, and that this student be a witness to it done, then they have proof.

    Of course if you only do it to your card, it's hard to prove, unless it's tracking your card by serial number, but it doesn't sound like it these even have those (duh...).

    For that matter, if someone only did it to their card and noone else figured out the scam, it would almost surely be more costly to investigate or to fix than to take a loss from just one student getting free soft drinks.

  • vereor (unregistered) in reply to whiskeylover
    whiskeylover:
    What the hell is with the ponies and rainbows on selecting the word RS232?
    What the hell is with someone this day an age who hasn't heard of homosexuality?
  • (cs) in reply to RichP
    RichP:
    I was impressed when it didn't turn out to be ROT-13 encoded!
    Sublime, dude.

    For those who missed it. The ROT13 of "$25.00" is "$25.00".

  • publicucs (unregistered)

    The Federal Reserve is the biggest counterfeiter in the world.

  • John Evans (unregistered)

    When I was in college, some anonymous person cracked the encoding on our ID cards...then they wrote up their findings on a flyer that they printed up and put in a big lecture hall before a large class. So, EVERYONE knew what the encoding was.

    It's been years, but I'm pretty sure the card merely stored a student ID number. Not a balance or anything...because that would be stupid.

  • INTERNETS (unregistered) in reply to Someone, somewhere

    I believe you're referring to the "Go Card". Unfortunately simple cloning doesn't work any more :(

  • Gunslinger (unregistered) in reply to Severity One
    Severity One:
    Robert Hanson:
    Its fun to figure out how to rig the system; not so much fun when the system rigs you. Going to jail and being expelled just for free soda seems childish.
    Point is, how would they prove it? Somebody could prove his innocence by providing top-up chits, but you don't have to prove your innocence: the affected party needs to prove your guilt. Now, finding a card reader/writer would be highly incriminating, but for that you'd need to search the dorms.

    Not as easy as it sounds, unless they had a strong suspicion who was behind it (and most likely, they didn't).

    Since the card likely had the name of the student encoded in the string, just doing the simple copy they did meant everyone's card would have their name on it, so it'd be really easy to track who was the master criminal.

  • Gunslinger (unregistered) in reply to whiskeylover
    whiskeylover:
    What the hell is with the ponies and rainbows on selecting the word RS232?

    If you don't like it, don't click on it.

  • Gunslinger (unregistered) in reply to Jay
    Jay:
    Hey, total by the way, while I was looking up that quote, I stumbled across another interesting law. In the state of Michigan, it is a crime, punishable by a year in prison or a fine of $1000, to deliver a message challenging someone to a duel. Whew, read that just in time. Sorry, Bob, I guess I won't be delivering that note for you after all ...

    They'd have to prove that you were in Michigan at the time...

  • (cs) in reply to Gunslinger
    Gunslinger:
    Severity One:
    Robert Hanson:
    Its fun to figure out how to rig the system; not so much fun when the system rigs you. Going to jail and being expelled just for free soda seems childish.
    Point is, how would they prove it? Somebody could prove his innocence by providing top-up chits, but you don't have to prove your innocence: the affected party needs to prove your guilt. Now, finding a card reader/writer would be highly incriminating, but for that you'd need to search the dorms.

    Not as easy as it sounds, unless they had a strong suspicion who was behind it (and most likely, they didn't).

    Since the card likely had the name of the student encoded in the string, just doing the simple copy they did meant everyone's card would have their name on it, so it'd be really easy to track who was the master criminal.

    Let me get this straight: You're assuming the developers of this boondoggle were smart enough to put a name on it?

    Sorry, but dumb usually is as dumb does. I'm betting that the only content was the amount.

  • (cs)

    Our dorm floor had a pay phone where you could pry away the plastic instructions and there was a hole drilled where you could insert a paper clip and press a lever to make the quarter you had put in drop back to the coin return slot while keeping the dial tone. (If you recognize this hack send me an email at gmail with the name of the dorm and floor and we can reminisce!)

    Sure it's fraud, but it wasn't about the money. It was about the conquest, a political statement: Own or be owned!

  • Rollin you (unregistered) in reply to Gunslinger
    Gunslinger:
    Severity One:
    Robert Hanson:
    Its fun to figure out how to rig the system; not so much fun when the system rigs you. Going to jail and being expelled just for free soda seems childish.
    Point is, how would they prove it? Somebody could prove his innocence by providing top-up chits, but you don't have to prove your innocence: the affected party needs to prove your guilt. Now, finding a card reader/writer would be highly incriminating, but for that you'd need to search the dorms.

    Not as easy as it sounds, unless they had a strong suspicion who was behind it (and most likely, they didn't).

    Since the card likely had the name of the student encoded in the string, just doing the simple copy they did meant everyone's card would have their name on it, so it'd be really easy to track who was the master criminal.

    let me guess.. the person who had their card stolen frist?

  • (cs) in reply to John Evans
    John Evans:
    because that would be stupid
    Yes? And…?

    People who should know better do dumb stuff. All. The. Time. Some of that is with technology. This site is founded on this basic observation.

  • NMorrison (unregistered)

    Nothing EVER changes. Why is that? Why? Really?

    http://www.thenewstribune.com/2011/03/23/1597092/new-readers-dont-pick-up-narrows.html

Leave a comment on “Wild Card”

Log In or post as a guest

Replying to comment #:

Log Out

« Return to Article