Subscriber Discussion

RFID Access Vulnerability

Undisclosed

•Jul 28, 2013

It's July. Which means the press is saturated with pre-Black Hat vulnerability announcements. Like this one on RFID:

LONG-RANGE RFID HACKING TOOL TO BE RELEASED AT BLACK HAT

So... this says you can do PROX from a meter away, and PROX is an unencrypted number, and PROX is clonable. Is that all correct? Oh, and urban legend is that if I ever breath while thinking about this, an HID patent attorney will threaten me. I say that to respectfully document the urban legend, I don't mean to be rude here.

Comments? Is it really this bad? Do physical security directors really not know about this stuff? Is this really news?

Brian Rhodes

•Jul 29, 2013

IPVMU Certified

Saying 'low frequency prox (125 kHz) is unsecure' is like saying 'The Beatles are a successful band'.

Even HID agrees! I don't think the swarms of black helicopters are going to buzz you or these guys at Black Hat for thinking/talking/YouTubing about it.

In fact, HID will use the opportunity to tell you this is why it's a great time to switch to iClass (13.56 MHz) instead.

Check our Prox vs. iClass Explained post for a rundown of the differences. (Surprise! It's primarily encryption!)

Undisclosed Manufacturer #1

•Jul 29, 2013

The urban legend is also growing that all of your credit / ATM cards can be read through your wallet

Of course as soon as the legend spread a cottage industry sprang up for secure wallets

If paying $49.99 for that piece of mind isn't your thing, you can always make your own out duct tape

Tin foil hats are a nice way to accessorize

Margarita Castillo

•Jul 30, 2013

This is old news actually and not really an urban legend. The issue is you still have to be fairly close to read the card... duct tape does work. Identity Stronghold has been around for over 10 years I believe.

I took an RFID class moons ago while working on my masters in computer science at New Mexico Tech. The application of the technology was so amazing that I purchased the sleeves for my credit cards...did I mention my degree focused on information assurance?

Mark McRae

•Aug 03, 2013

Inaxsys Security Systems

125 KHz is very simple to copy/clone. It is a passive technology and is truly not secure.

In general, smart cards (13.56 MHz) are much more secure but some of the smart card technologies have been hacked/cracked already.

The 2 most common platforms that have been cracked are Mifare Classic and iClass. Online guides exist that explain very clearly how to copy and reproduce both of these card platforms.

Stay away from passive cards like 125 KHz and steer towards secure smart-card technology like DESFire EV1. Many manufacturers offer DESFire EV1 smart cards and readers.

New discussion

Ask questions and get answers to your physical security questions from IPVM team members and fellow subscribers.

Newest discussions