Singapore Library Mischief

by Ghostie

If you have heard about Singapore, you probably know that gum is banned for sale here.  I would like to take this opportunity to share a bit more about this tiny little country to the rest of the world.

Singapore has in recent years made it to the top in those "IT Savvy" lists and "Top X Wired Nations" reports.  Perhaps it has something to do with a population of four million packed within about 683 square kilometers of land.  At the very least, wiring up takes lesser copper.  The government of Singapore has also been making a tremendous effort to keep up with the revolution by embracing technology to replace conventional processes.

It used to be required that a person present his library card (a laminated card with a barcode which bears the National Library Board's logo) to the librarian before walking out of the library with the books ink-stamped with the due date of return.

Now it's no longer required that anyone register for a library card as you can use your identity card to process the borrowing transaction.  To cut down on labor costs, self-service terminals are being set up for citizens to process the borrowing transactions themselves.  Since every book contains an RFID tag, the alarm would sound if you attempted to walk past the detectors without "borrowing" the books first.

At a self-service terminal, you would drop your identity card into a slot which is shallow enough for you to pick it back up again.  The barcode scanner's laser in the terminal has been adjusted to hit on the barcode area of your identification number so the barcode scanner retrieves your identification number as the first step of the borrow transaction.

Upon surrendering your identification number, you then place the books you want to check out one by one on a platform for the terminal to read via the RFID tags.

So the authentication mechanism is supposed to be "something you have," which is the identification card.  Strictly speaking, you do not need the identification card.  You need a card or a piece of paper about the same size as an identification card which is imprinted with a barcode of a legitimate identification number.

Allow me to describe how I would overcome this convenient-for-customers-without-a-thought-for-security system.  I need software that prints barcodes like Bar Code Pro, a legitimate identification number, and a piece of paper at least the size of an identification card.  If you question the availability of legitimate identification numbers, I can easily google for one (you may not be too lucky if you have your name and identification number appear on an announcement page as a winner of a pair of movie tickets in a lucky draw).

Having printed a barcode representing someone else's identification number on a piece of paper, I can insert my "identification card" (the paper) into the slot for the terminal to read the identification number and start borrowing books on someone else's account.  Since this is not a bank, you would not expect cameras to be pointing at every terminal.

There is an unmanned drop-off point outside every library that will mark the books you drop into the opening as "returned" by reading from the RFID tag.  Interesting to note, there is a built-in camera around the level your face would be when you drop a book into the opening.  If you have something to hide, would you look into the camera in the first place?

Anyway, I can just throw away that "identification card" and start building a library in my bedroom, leaving the unlucky fellow to bear the consequences of not coming back to the library with the books I had borrowed.

Being the kind person I am, I would remove the RFID tags from the books and secure them individually with a string.  I would then visit a drop-off point and throw the RFID tag into the opening while still holding onto the other end of the string.

Since the system would read from the RFID tag and mark the book as "returned," the books would have gone mysteriously missing from the library without any trace leading to you unless you have been caught loitering somewhere by the security cameras.  Oh yes, definitely you will need to pull the RFID tags back with the string or else that poor fellow would be invited for coffee by the authorities.

I think a quick patch to the problem is probably to add a PIN/password feature on top of slotting in the identification card.

This article is meant for educational (and amusement) purposes.