HID: Stop Selling Cracked 125 kHz Credentials

Author: IPVM Team, Published on Nov 05, 2018

HID should stop selling cracked 125 kHz access control credentials, that have been long cracked and can easily be copied by cheap cloners sold on eBay and Amazon.

To its credit, HID has long acknowledged the vulnerability and does take steps to warn customers of the risks, as HID has explained to IPVM inside this post.

Vulnerable / Cannot Be Fixed

However, since these products are vulnerable and cannot be 'fixed', they should not be sold at all. If HID or Axis or any responsible manufacturer found a vulnerability in their firmware, they would stop selling such products until they fixed it. Since the 125 kHz vulnerability cannot be fixed via firmware or software upgrade, they should be discontinued. The video below demonstrates exploiting the vulnerability:

Transition Time

Reasonably, HID can set a period of time in the near future where they will stop manufacturing such that existing users can transition their hardware and/or credentials as appropriate.

Facilitating an EOL deadline would not exclude HID from upgrades, as HID already has 'migration hardware' available with Multiclass readers supporting an immediate reader upgrade and slower/budgeted/planned credential migration.

Using those intermediate readers is a primary method HID itself suggests for transitioning, one of the three solutions we detail in our Cracked 125kHz Access Control Migration Guide.

Get Video Surveillance News In Your Inbox
Get Video Surveillance News In Your Inbox

HID Largest Provider

We are calling on HID because they are the largest credentials provider and the only ones, short of government, capable of making a major market impact.

Moreover, HID could even use this as a differentiator against their smaller competitors to position themselves further as the 'market leader' who takes a strong stand in favor of 'security' at the expense of easy profits from selling vulnerability access control credentials. Notably, if HID did this, it would put pressure on rivals still selling these cracked credentials who would be viewed as still profiting from such insecurity.

Acknowledges Vulnerability

To their credit, HID acknowledges vulnerability, including a statement they provided to IPVM in response to our inquiry about discontinuing 125 kHz cards:

Moreover, HID emphasized in follow-up remarks that:

Our field teams disclose these known vulnerabilities in virtually every 1-on-1 customer (channel partner, consultant, or end customer) meeting regarding readers/credentials. These conversations are always followed by discussion of steps to mitigate the vulnerability through credential migration.

Most of our field team members have cloning devices for demonstration of attack methods.
We typically bring common cloning devices to tradeshows (e.g. GSX) where we conduct demonstrations during customer meetings in HID booth.

Despite this, HID says ~40% of the market is still using these cracked credentials and that, given that they would prefer they buy it from HID, a 'trusted partner':

as 125 kHz represents approximately 40% of the global physical access control credential market. Until there is a more substantial market shift away from the technology, we prefer that customers source it from a trusted partner.

No Warnings on HID Product Documentation

While HID has marketing materials warning of the vulnerabilities, they do not do so on their 125 kHz product documentation. The product pages and datasheets make no mention of any vulnerability nor defect. Indeed, HID markets their 'value' and how 'cost-effective' they are:

Indeed, the ProxCard II datasheet markets these cards 'security':

This is, at best, highly misleading since the issue is not the number of codes, it is that regardless of the specific code used, it can be read and copied using a cheap cloner.

The direct product documentation is quite important since specifiers and buyers often review or cite those documents when purchasing. Minimally, by including the vulnerability warning there, it would make it clearer what the risks are being exposed.

Conclusion

HID, by its own remarks, has placed itself in the rather remarkable position of selling against a vulnerable / defective product while simultaneously selling that defective product.

Surely, HID wants to be a 'trusted partner', as they say, and discontinuing cracked 125 kHz credentials would increase that trust while driving scores of users away from these credentials.

Vote / Poll

Comments (25) : PRO Members only. Login. or Join.

Related Reports

ISC East 2018 Mini-Show Final Report on Nov 16, 2018
This is our second (updated) and final show report from ISC East. ISC East, by its own admission, is not a national or international show, billed...
ASIS Offering Custom Research For Manufacturers on Nov 15, 2018
Manufacturers often want to know what industry people think about trends and, in particular, the segments and product they offer.  ASIS and its...
French Government Threatens School with $1.7M Fine For “Excessive Video Surveillance” on Nov 14, 2018
The French government has notified a high-profile Paris coding academy that it risks a fine of up to 1.5 million euros (about $1.7m) if it...
Directory of Video Intercoms on Nov 13, 2018
Video Intercoms, also known as Video Door-Phones or Video Entry Systems, have been growing in the past decade as more and more IP camera...
Beware Amazon Go Store Hype (Tested) on Nov 13, 2018
IPVM's trip to and testing of Amazon Go's San Francisco store shows a number of significant operational and economic issues that undermine the...
Axis 2N Intercom Tested on Nov 08, 2018
Axis expanded its video intercom business buying Czech-based 2N in 2016. Despite competing against owner Axis' intercoms, 2N recently registered as...
Haven Targets School Security with Lockdown Lineup on Nov 08, 2018
Haven, a US startup founded in 2014 as a residential-focused company, has now raised funding and is offering a lineup of commercial grade locks for...
Directory Of Video Doorbells on Nov 06, 2018
Video doorbells are one of the fastest growing categories in video surveillance, especially among residences. The optimal placement of these...
Winter 2019 IP Networking Course on Nov 05, 2018
This is the only networking course designed specifically for video surveillance professionals.  Lots of network training exists but none of it...

Most Recent Industry Reports

'Sticker' Surveillance Camera Developed (CSEM Witness) on Nov 16, 2018
The Swiss Center for Electronics and Microtechnology (CSEM) has announced what it calls the: world’s first fully autonomous camera that can be...
ISC East 2018 Mini-Show Final Report on Nov 16, 2018
This is our second (updated) and final show report from ISC East. ISC East, by its own admission, is not a national or international show, billed...
Facial Detection Tested on Nov 16, 2018
Facial detection and recognition are increasingly offered by video surveillance manufacturers. Facial detection detects faces in an image/video...
Throughtek P2P/Cloud Solution Profile on Nov 15, 2018
Many IoT manufacturers either do not have the capabilities or the interest to develop their own cloud management software for their devices....
ASIS Offering Custom Research For Manufacturers on Nov 15, 2018
Manufacturers often want to know what industry people think about trends and, in particular, the segments and product they offer.  ASIS and its...
Hikvision Silent on "Bad Architectural Practices" Cybersecurity Report on Nov 14, 2018
A 'significant vulnerability was found in Hikvision cameras' by VDOO, a startup cybersecurity specialist. Hikvision has fixed the specific...
French Government Threatens School with $1.7M Fine For “Excessive Video Surveillance” on Nov 14, 2018
The French government has notified a high-profile Paris coding academy that it risks a fine of up to 1.5 million euros (about $1.7m) if it...
Integrator Credit Card Alternative Divvy on Nov 13, 2018
Most security integrators are small businesses but large enough that they have various employees that need to be able to expense various charges as...
Directory of Video Intercoms on Nov 13, 2018
Video Intercoms, also known as Video Door-Phones or Video Entry Systems, have been growing in the past decade as more and more IP camera...
Beware Amazon Go Store Hype (Tested) on Nov 13, 2018
IPVM's trip to and testing of Amazon Go's San Francisco store shows a number of significant operational and economic issues that undermine the...

The world's leading video surveillance information source, IPVM provides the best reporting, testing and training for 10,000+ members globally. Dedicated to independent and objective information, we uniquely refuse any and all advertisements, sponsorship and consulting from manufacturers.

About | FAQ | Contact