Back to the 90s — Part Six: Hacking the College Swipe Card System

Every student was required to be present between 9 am and 3 pm, even if they had free periods. Lunchtimes were the exception.

Copying Swipe Cards

We used MS Paint, zoomed right in, to reproduce the barcodes. One pixel represented a thin stripe or space, while two pixels represented a thick one. Printing the image at 167% zoom produced an identical barcode.

We all had copies of one another’s swipe cards, complete with the respective names. A rota showing who needed to be swiped in or out was distributed to everyone in our group.

If someone was in college at 9 am, they might have to swipe in other members of the group who weren’t due to arrive until later. In turn, if your lessons finished at 1 pm but another member wasn’t due to finish until 3 pm, they would swipe you out, along with anyone else who had already left.

The overall system meant that, as far as the college’s records were concerned, everyone in our group was present between 9 am and 3 pm, whether they actually were or not.

There were exceptions, of course. Fire drills were announced in advance, so we made sure to be physically present for those.

The main problem was Friday afternoons. We were all free from noon onwards, as we had no lessons.

Getting Around Actually Being in College

This presented a problem. We took it in turns to stay behind each week until 3 pm.

One day, over a cup of hot chocolate, someone in the group asked a rather interesting question:

“What happens if we just put some random barcode through a swipe machine?”

There were machines scattered around every entrance to the college, so we decided to give it a try.

Someone suggested scanning the barcode on the wrapper of the Twix chocolate bar they were munching on. We all headed down to a swipe machine, and he fed the wrapper’s barcode through the reader.

A bunch of numbers appeared on the reader’s LCD display.

And then… nothing.

Have a Break, Have a…

Undeterred, others started trying various barcodes, with similarly disappointing results.

Then someone scanned the barcode on a Kit Kat wrapper.

Immediately, the LCD displayed what looked like garbage. Worse still, the reader refused to read anything else afterwards, including genuine college-issued swipe cards.

We tried other readers. Nothing worked.

The entire system had crashed.

We looked at one another, exchanging worried glances, until someone in the group finally broke the silence.

“Excellent! This is how we ALL get Friday afternoons off!”

He was right. If we crashed the system, nobody needed to stay behind to swipe everyone out.

The college had to call in engineers to reset the system, and our little discovery had given us the perfect solution.

This hack lasted for around two months, until the principal called every student into the main hall.

The Principal’s Error

He was not a happy man. In fact, he was absolutely furious.

He announced that someone, or several people, were deliberately crashing the swipe card system. Every time they had to call an engineer out, he explained, it cost the college money.

Then he made a fatal error of judgement.

He told us they knew that the barcode on a Kit Kat wrapper was responsible for the crashes.

Why?

Because, he explained, they had matched the number in their system to the barcode on a Kit-Kat wrapper.

Presumably, their research made the vending machine company very happy, given the sudden increase in product sales that week!

He went on to warn us that anyone caught running a barcode through the swipe card system that wasn’t on a college-issued card would face serious consequences.

Of course, by that point, nobody was listening.

Now that everyone knew how to crash the system, the vending machines were quickly depleted of Kit Kats. It was several weeks before the swipe card system was back up and running.

The college had to get the developers involved to write a patch that would reject any barcode that didn’t correspond to a number specifically listed in the student database.

As an additional, but entirely unnecessary precaution, Kit Kats were removed from the vending machine selections!

Back to Square One

And so, we were back to taking turns staying behind on Fridays. 😞

Still, it was better than nothing!

Coming Next

Next instalment: Busted! When the Hacking Went Too Far

Back to the 90s Series