Fun With School ID Numbers
--------------------------
By gLoBuS

I attend a medium sized high school with about one thousand students and a few
hundred faculty members. Our district has several elementary, junior, and
senior high schools. Every student and faculty member has a unique ID number
for many uses that I will get into later. Although I may show you ways to
circumvent a certain school's security, please insert the standard disclaimer
here and don't do anything stupid.

The Discovery

An art student at my school was working on a project one afternoon when I came
into the art room. This student had used the barcode generator from
barcodesinc.com to generate a random code for artistic expression in her
project. Anyways, I was passing through on my way to lunch when I noticed this.
With wallet in hand and eyes on my student ID card, the light bulb flashed. I
should see if I can recreate my own barcode online. So for the fun of it I
tried. Using the proper symbols (which I guessed), I was able to make a JPEG
file of my ID card's barcode. Well this is all good, but what use is this to me
if it's my own number? So I found a friend who willingly gave me his number and
I got to work.

The Application

Using plain old MS-Word, I was able to print up the proper sized barcode to fit
on the back of my card. Using my friend's ID number on my card, we went up to
the lunch line. Lunch was almost over so it was fairly quiet. I had the lunch
lady check the balance on the account and, sure enough, my friend's name showed
up on the screen. She reminded me that I only had $5 left in my account and we
happily returned back to the art room. Once we got there I got to thinking.

The Possibilities

This ID is used for not only lunch accounts, but also computer logins, book
checkouts, and teachers have many other uses for them. I brought my findings to
my computer class teacher. He was shocked and amazed that the account numbers
are as accessible and reproducible as they are. He had me copy his ID for him
and it was a carbon copy of his. Being that he is on staff and that he was once
a computer repairman for the district he reminded me of the access that his
card granted him. His barcode, along with other teachers, could be read and
used to gain access to the school. If activated his card would give him the
right to go to the main district server room. Going to my next class, I
remembered that I was able to access my grade s mass listing of student ID
numbers. By going up a few levels from my user account on our network, I was
able to see all the ID numbers for every student in alphabetical order.

Conclusion

I asked my computer class teacher to bring this to the attention of the right
people and not implicate me on the way. He did and we're waiting for the change
to take place. Until then, I plan on paying for my lunch with cash.