Slashdot Mirror
The Rising Barcode Security Threat
eldavojohn writes "As more and more businesses become dependent on barcodes, people are pointing out common problems involving the security of one- or two-dimensional barcode software. You might scoff at this as a highly unlikely hacking platform but from the article, 'FX tested the access system of an automatically operated DVD hire shop near his home. This actually demanded a biometric check as well, but he simply refused it. There remained a membership card with barcode, membership number and PIN. After studying the significance of the bar sequences and the linear digit combinations underneath, FX managed to obtain DVDs that other clients had already paid for, but had not yet taken away. Automated attacks on systems were also possible, he claimed. But you had to remember not to use your own membership number.' The article also points out that boarding passes work on this basis — with something like GNU Barcode software and a template of printed out tickets, one might be able to take some nice vacations."
> The article also points out that boarding passes work on this basis -- with something
> like GNU Barcode software and a template of printed out tickets, one might be able
> to take some nice vacations."
Yeah, in Guantanamo...
Think about this: you go somewhere that uses ID/membership cards with barcodes on it. Salesdrone asks for your card. If you just give them the number verbally and are security-minded, they'll probably ask for ID. However if you provide the card, they won't, because they the card *is* the ID.
Non-technical people don't understand how barcodes work, so they assume that nobody else does either. So if nobody else understands it, then it can't be forged.
I used to work at a semiconductor fab - basically a big chemical factory. Access control, security and timecards were all kept by a barcode system, printed on the back of your badge. I had a lot of fun making bar codes to see which would get me into places I shouldn't have been, like the spaces between the cleanroom walls, or the tunnel under the building, or the chemical storage area (that was a place I didn't ever like being in). Probably seems worse now than it did then.
Back in elementary school we had a stored-value system for buying lunch, with security based on bar codes on little plastic cards. This was nearly 20 years ago and there was free software available then (on my Commodore 64? Atari? Can't remember) to generate bar codes. I made a couple, based on the ID numbers of friends, and gave them to the lunch lady, telling her that those cards were a bad idea. They never changed anything, though. These days I'd have been kicked out of school for that, though, if not arrested.
Just my $0.55 (US inflation, 1774-2008, for $0.02)
L33t hackers discovered that with a certain amount of awareness and bravado it is possible to obtain quite tasty sandwiches for free, by hanging around the pickup counter at sub shops and pretending to hold the ticket number that was just called out.
Anyone who has done any work with barcodes knows they are encoding schemes, not encrypting schemes. A barcode is simply a way of representing data (may be alphanumeric or binary), in a way that is easily read by scanning equipment. The commonly used algorithms are well publicized and it is easy to obtain software to read or write them. If security is important, encryption must be applied before the data is encoded in a barcode. I've scanned many barcodes on many things, and if money is involved, such as tickets or postage, I've generally found that they decode to seemingly random binary data, which means that most likely, encryption was applied first.
If I can be modded down for being a troll, can I be modded up for being an orc, or a balrog?
I've done this for kicks just to see if I could do it, but once I brought one of my fake ID's and fake boarding passes to the airport and got through the "security" (security? BAHAHAHA!) and made it into the terminal. Bought some drinks, ate some food and went home.
:P
No one was the wiser.
You see, it's just a billion dollar FARCE and a WASTE OF TAXPAYERS MONEY for the *feeling* of safety when there really isn't any.
Of course I couldn't get on the plane. I couldn't get on a plane in 2001 without a correct ticket anyways. They had the barcode scanners to "check" you into the plane anyhow. At least, I remember them being available back in 1999 -AND- I wasn't too keene on getting onto a plane where there weren't enough seats where I'd get caught
Anyways, just as I said, this is easy to blow a hole through. There's nothing in the world that makes me more mad than being patted down, scanned or searched before boarding PUBLIC TRANSIT. I'm not a criminal, wtf are government agencies doing there?
(posted anon and through a couple anon proxies)