Axis Releases Access Credentials - Insecure But Convenient

Published Nov 02, 2016 13:10 PM

Axis continues to build out their own end-to-end 'solution'. The company recently announced a series of credential cards, but instead of a cutting-edge and high security type, they are promoting a format that is easily exploited with equipment bought off the internet.

But it may not prove to a bad move, and rather may make using more Axis access product easier, especially for novice installers.

Inside we examine the new card offering, explain why it is an insecure choice, but why that largely may not matter to most users.

**********

*** ********** ** ***********, *** *** *********** ****** *********** *****.

Axis' *** *********** ***********

**** *** ********* * **** ** NXP-based **.** *** *********** ********** ***** [link ** ****** *********], ** ** industry-standard **-** **** (*.* * *.* × 0.03 **). **** **** ********** *****, construction ** ***, ****** ******* ********, and ***** *** **** ******** *** physical *****. *** ***** *** ***** *** ******** for ******** ** *********** ******* *** picture ** ********.

***** ***, ****' ********* ** ****** control **** *** ********* ** * **** ********** *** **** *******, *** ** ***********. **** ******** fills * *** ******' ***-**-*** ********* ********* ** ****** *******.

Card *******

****** ******* *** **** ***** *** ~$350 *** *** ** ***, *** standard ***** ********. ********** ******* ** ~$1.75 *** ****.

**** ** ***** **% **** **** generic, ***-**** ******* ***** **** **** the**** *************, ***** ****** ** ~$*.** or ********, ********* ** ****** ** $*.**.

Based ** ******* ****** ** ******

******* ***** **.** ***, ***** ********** cards *** *** *** ****-******** ************.

*** ***** *** ****** ******* ** format, ***** **** **** **** *******, with *** ***** ******* ******** *** verified ** *** ** *** *** 1990s. ****** ******** ****, **** **** ********* **** ***** ******* ***, *** ** ********* *** ~$*** and **** ** '*****' ***** *********** in ***** * *******.

Axis ****** **********

*** ******* ******* ** **** ********** cards ** **** *** ********* ** be ********** **** ****' *** *******:

  • *****-* [**** ** ****** *********]: *** standard **** ******* **** ****** ** a *****-*****, ******/*******, **** ********** ***** with * ****** ***** ** ~$***.
  • *****-*: *** ************ ** **** ***** are *** ****, *** *** * PIN ****** ** *** ****** **** for ******* *********** **************. ****** ****** *** ~$***.

********** ******** ** ***** *******, **** ******** or ******* *** ********* ** ********* of '********' *********** ** ***** *******. Axis ********** *** ******* ** ******** only *** ******** **** **** ***** with ***** *******, ** ************* *** reordering ** ********** *** ****** ******* ** end-users.

Not *** ********* *****

**** ***** *** ******** **** * **********, *** **** * *** *** 13.56 *** ******* **** ****** *** not *********, ***** ***** **** ** the ********* **** ******* *** *** used, **** ****** ** ***** ** properly ******* * ********** *** ***** reader.

** **** *****, ******* **.** *** readers, **** ***** ******** ** **** HID ***********, *** ** **** ** only *** **** ***** '**** ****** number' (***) ** **** **** ********* cards **** * ******.

Practical ***** ******** *****

***** '**** *********' ******* ******** ********** formats **** **** **** *******, **** this ****'* ****** ******* **, *** overall **** ** ******** *********** ** typically *** * ******* ** ******* by **** ***-***** *** *********** *** still******* ********** ******** *** **** **** ******/*********** ** open *** *** *** *******.

******* ******* ** ****** ** *********, the **** ** ******** ****** ******* credentials **** ** ************ *** **** access *****, *** *** *** *** rather ****** *** ****-***** ******* ******** to ***** **** * ******* ******* compared ** **** ********* ***** **** **********************, ****** **** ********.

Comments (7)
UM
Undisclosed Manufacturer #1
Nov 02, 2016

"But it may not prove to a bad move, and rather may make using more Axis access product easier, especially for novice installers."

Why would selling Mifare credentials make using Axis access product easier? It may make it easier to quote but there is not much benefit beyond that.

Mifare credentials have become commodity products and there's no money in selling those credentials.

IMO, it's not a very smart move on Axis' part.

(1)
Avatar
Brian Rhodes
Nov 02, 2016
IPVMU Certified

Why is this not 'a smart move'?

Many end-users do not know the differences between MIFARE or iClass or DESFire or ProxII, and they all look basically the same to someone who doesn't know what to look for.

Axis has a large portfolio of accessories to their camera products; brackets, extenders, lenses, etc. Are those not 'smart moves'?

UM
Undisclosed Manufacturer #1
Nov 02, 2016

Although they all look the same they are different under the hood. Mifare cards don't work on Prox readers and Prox cards don't work on Mifare/DESFire readers.

It's smart to sell brackets because they are specifically designed for Axis cameras and are required to install Axis cameras. Extenders, lenses etc not so smart a move since they are available from a plethora of other vendors. It's not to say that it doesn't make sense, I just wouldn't classify it as a "smart move".

Avatar
Brian Rhodes
Nov 02, 2016
IPVMU Certified

"Although they all look the same they are different under the hood. Mifare cards don't work on Prox readers and Prox cards don't work on Mifare/DESFire readers."

This is essentially the benefit for 'end-to-end' minded Axis. The supply clerk googles up 'axis access card' and finds the reorder product easy, avoiding ordering something that just doesn't work (but looks the same) by mistake.

(1)
UM
Undisclosed Manufacturer #1
Nov 02, 2016

More like they'll search for "access card" or "prox card" and will find Amazon, Alibaba selling $0.20 cards.

JH
John Honovich
Nov 02, 2016
IPVM

More like they'll search for "access card" or "prox card" and will find Amazon, Alibaba selling $0.20 cards.

Unrealistic for their target market, simply because the companies Axis is selling to are people who are buying Axis cameras for $200 - $2,000 when they could have already searched Amazon and Alibaba to get $20 - $60 cameras.

I am not defending Axis, I think the whole OEM / copy / package solutions is a failure to have a real strategy, I am just saying there are definitely organizations out there that will pay Axis an extra 50 cents per card just to get it from Axis.

UM
Undisclosed Manufacturer #1
Nov 02, 2016

I agree and disagree with you John. Sure, those integrators/dealers/end users who choose Axis for their products/support will spend the extra dollars for the right products. When it comes down to ordering "consumables", those decision makers are probably not even in the loop anymore. That task might be on the hands of the facility manager or similar. Why would they care that the cards they are sourcing are not "Axis".

We supplied an integrated system to a very high end Hotel who spared no expense in selecting high end gear. When it came down to purchasing cards for their suites we lost the annual 65000 piece per year card sale. They has a source for cards at $0.20 USD each.

(1)