ADI Pushing Cracked 125 kHz Access Control

Thanks for highlighting this issue. Our company has been supplying restricted masterkey systems for over 40 years to solve the problem of unauthorized key duplication. We supply these systems in the majority of commercial applications. I would often point out to the customer that the access reader for the same door they have installed a restricted system on an have the cards easily duplicated. I purchased a cloning device 5 years ago and would show them how it is done. The main issue I would point out to them is identity theft. When someone duplicates your access card they assume your access level and in the audit trail of the systems software the name of the person accessing the door is you. 

125KHz just continues to get pounded...

Here's the latest long range skimmer just posted 2 days ago: https://www.trustedsec.com/2018/10/lets-build-a-card-cloner/

Looks 90% similar to Bishop Fox's version.

125kHz is not necessary vulnerable in all cases. It depends on how this technology is applied. Impro Technologies - a South African manufacturer - and part of Assa Abloy, has launched their S-Series already a year ago featuring anti-cloning credentials. See their website http://www.impro.net/box.

Copying a tag or card with the mentioned copy devices will not grant you access when you use these 125 kHz products 

This is one of the many reasons we always require card plus pin. Doesn’t matter what cards we’re using, this is what we require our customers to use. No matter what credential you use a card can be stolen. We’ve found employees are also more hesitant to give up both their card and pin when asked to lend to an coworker. I’m not sure why card + pin isn’t more common. 

I see prox on designs and client standards all the time.  It is crazy.

We've known about this since reading an article about an intern working at RIM (now known as Blackberry) who built a sniffer well over 10 years ago. We have been transitioning away from 125kHz for several years. Now that the cost differential is negligible on new jobs we only quote smart card format. On existing clients we have notified them and look for opportunities to swap out if they upgrade old systems or do major addons. If you change out the readers to HID multiclass you can support older formats while issuing 13.56 credentials on anything new.

It will happen eventually, maybe slowly but at some point the format will be retired. I remember when Wiegand swipe cards were the standard and how many of those are still being used? A major vertical for us is condos and this is a big problem, especially in Toronto. In addition to losing control over who has access to facilities there have been stories of people renting out the building's guest suites on Air BNB and selling "fitness club memberships" using cloned 125 kHz credentials.

I agree that Bluetooth and NFC are still a bit too flaky for everyday use at present so the best you can do is advise your clients and make recommendations. If they can't/won't take your advice then so be it.

As for blaming ADI for selling insecure products I think that's a bit of a reach. They move boxes to make money. The products are legal and it's up to the person buying the product to understand the product's limitations and to determine if it's appropriate for the application. We rely on our own experience and expertise to be able to do the right thing for the customer. Expecting the distributor to do that is unrealistic, and in my view, unnecessary. ADI sells to the trade (well, mostly the trade) not retail consumers. The tradesperson should have requisite knowledge to design and install the system in accordance with the customer's requirements. Are they not "professionals"?

NOTICE: This comment has been moved to its own discussion: The Tradesperson Should Have Requisite Knowledge To Design And Install The System In Accordance With The Customer's Requirements. Are They Not "Professionals"?