Disclaimer (for once) : This article is for educational purposes only ! What you’ll do with it is your responsibility !
Context
When people talk about « security issues » or « information leaks », they often think of vulnerabilities you can find in computers or computer networks. But that’s not just for machines, for from it ! You can find that kind of issues anywhere from an ATM to the digital pad that lets you inside your building…Or on your basic scratch-panel card !
Perplex City fix par Knolleary - Licence CC BY-NC-SA
A few years ago, as I was looking for puzzles and riddles to encourage my students to play and think at the same time (I’m a teacher-librarian in a little middle school near Paris, remember ?), I stumbled upon a British collectible cards game called Perplex City – a fantastic game full of brilliant players, and that remains in my memory the best ARG I ever played.
Each card in the game was sporting a different puzzle and when players would find (or think they had found) the solution, they’d connect to the game’s website and type in the Unique IDentifier on the card that could be revealed by scratching the silver panel on it, before typing in your solution to claim the amount of points that matches the difficulty of the puzzle.
The leak
Back in May 2007, in order to let my students enjoy some of these puzzles, I made poster-size copies of some of the cards with the authorization of the company that created the game, Mind Candy Design. These were more visual puzzles, accompanied with a translation of the original text from English to French and the original card, stuck to the tabletops and pillars of our school library under a layer of transparent, adhesive plastic film from Eurefilm- which we usually use to cover our books, comic books, magazines, etc.
How the cards were posted : scale-up version, original card on top, all under a layer of adhesive film...
...And the same, on site.
The cards and their design had great success with the kids and one evening while cleaning the library before leaving, I noticed some of the cards had been altered since I had taped them up. The colours hadn’t changed despite being exposed to sunlight, but the UID under the silver scratch panel was more or less visible under the cards while the scratch panel itself was intact.
From what I had seen, the cards under the plastic film were probably revealing more or less rapidly their UID depending on the amount of sunlight or heat they were exposed to : the ink used to print the UIDs might be partly evaporating, crossing through the silver panel without damaging it before fixating on the plastic film, drawing the characters of the UID for anyone to read.
I got in touch with Mind Candy Design to let them know of what I had noticed and my contact then asked me for more information – and to remain discrete – regarding this flaw in the security system that guaranteed that the cards one would buy could actually be traded for points.
Here's how I think the UIDs are revealed...
I tried to reproduce what had happened based on that theory, installing only the original cards under the film and using :
- cards of varying difficulty levels
- cards from different waves/printing dates
- in places more or less exposed to sunlight and hear
The UID of all the cards I tested was revealed within the next 3 to 4 days, depending on how important the exposition to the sun was, and the integrity of the scratch panel was still complete even after carefully removing the film (at worst, a few very very light scratches). It is thus possible to use the UID of a Perplex City card without it being noticeable if you based your judgement on the integrity of the scratch panel.
Card XXX after having spent a few days in the sun - before, and after removing the film.
Card Seven Bridges after a few days spent in the sun. Top, before removing the adhesive film. Bottom, after removing the film.
Getting back in touch and publishing
After having sent all the information, pictures and theories to my contact at Mind Candy Design and sent her all the information, pictures and theories I had, she thanked me and told me she’d get in touch with the manufacturer before asking me remain discrete about this security flaw – and so I did, until today !
In the meantime, a lot of things changed : first, I asked for advice from computer engineers that regularly face the problem of having to bring out security flaws in programs (including my father-in-law, a network and security engineer for a group of hospitals) as well as from security expert Bruce Schneier on what to do to bring up such an issue to the attention of a company. All suggested that I get in touch with the company in question before publishing anything and that’s what I did by writing an e-mail to Michael Smith, CEO of Mind Candy Design with whom I had had the occasion to talk for a series of commemorative Perplex City interviews in 2008 : it is with his authorization that I publish this post today. And of course, Perplex City now being in hibernation mode means that the disclosure of this « information leak » will not hurt the game’s sales 
Le schéma des affichages au CDI : l'agrandissement en noir et blanc tout en bas, la carte originale sur l'agrandissement, le tout recouvert par le film plastique...
