#DEFCON: Hacking RFID Attendance Systems with a Time Turner

If a computer science student has a scheduling conflict and wants to attend two different classes that occur at the same time, what should that student do?

In a session at the DEF CON 29 conference on August 7, Ph.D. student Vivek Nair outlined a scenario where a hack of the attendance system could, in fact, enable him, or anyone else, to be in two places at the same time. Nair explained that many schools use an RFID-based attendance system known as an iClicker to track whether or not a student is present. The system includes a base station for each classroom or lecture hall, and then each student is required to carry a device, which can also be used to answer multiple-choice questions.

Nair noted that in the popular Harry Potter fiction series there is a magical device known as a Time Turner, which is used to help enable a student to be in two classes at the same time, via time travel.

"Without the luxury of magic, what is the next best thing?" Nair asked. "It is, of course, hacking."

Building a Time Turner to Exploit a Modern University

In his talk, Nair outlined how the RFID-based system was reverse engineered so he could learn how it works. With that knowledge, he realized that there was no encryption on the device transmissions and it could be possible to mimic a real device.

"It is hard to overstate how vulnerable the system is, and it's even more shocking that this exact model is currently ..

Support the originator by clicking the read the rest link below.