HID: Stop Selling Cracked 125 kHz Credentials

By: IPVM Team, Published on Nov 05, 2018

HID should stop selling cracked 125 kHz access control credentials, that have been long cracked and can easily be copied by cheap cloners sold on eBay and Amazon.

To its credit, HID has long acknowledged the vulnerability and does take steps to warn customers of the risks, as HID has explained to IPVM inside this post.

Vulnerable / Cannot Be Fixed

However, since these products are vulnerable and cannot be 'fixed', they should not be sold at all. If HID or Axis or any responsible manufacturer found a vulnerability in their firmware, they would stop selling such products until they fixed it. Since the 125 kHz vulnerability cannot be fixed via firmware or software upgrade, they should be discontinued. The video below demonstrates exploiting the vulnerability:

Transition Time 

Reasonably, HID can set a period of time in the near future where they will stop manufacturing such that existing users can transition their hardware and/or credentials as appropriate.

Facilitating an EOL deadline would not exclude HID from upgrades, as HID already has 'migration hardware' available with Multiclass readers supporting an immediate reader upgrade and slower/budgeted/planned credential migration.

Using those intermediate readers is a primary method HID itself suggests for transitioning, one of the three solutions we detail in our Cracked 125kHz Access Control Migration Guide.

Get Notified of Video Surveillance Breaking News
Get Notified of Video Surveillance Breaking News

HID Largest Provider

We are calling on HID because they are the largest credentials provider and the only ones, short of government, capable of making a major market impact.

Moreover, HID could even use this as a differentiator against their smaller competitors to position themselves further as the 'market leader' who takes a strong stand in favor of 'security' at the expense of easy profits from selling vulnerability access control credentials. Notably, if HID did this, it would put pressure on rivals still selling these cracked credentials who would be viewed as still profiting from such insecurity.

Acknowledges Vulnerability

To their credit, HID acknowledges vulnerability, including a statement they provided to IPVM in response to our inquiry about discontinuing 125 kHz cards:

Moreover, HID emphasized in follow-up remarks that:

Our field teams disclose these known vulnerabilities in virtually every 1-on-1 customer (channel partner, consultant, or end customer) meeting regarding readers/credentials. These conversations are always followed by discussion of steps to mitigate the vulnerability through credential migration.

Most of our field team members have cloning devices for demonstration of attack methods.
We typically bring common cloning devices to tradeshows (e.g. GSX) where we conduct demonstrations during customer meetings in HID booth.

Despite this, HID says ~40% of the market is still using these cracked credentials and that, given that they would prefer they buy it from HID, a 'trusted partner':

as 125 kHz represents approximately 40% of the global physical access control credential market. Until there is a more substantial market shift away from the technology, we prefer that customers source it from a trusted partner.

No Warnings on HID Product Documentation

While HID has marketing materials warning of the vulnerabilities, they do not do so on their 125 kHz product documentation. The product pages and datasheets make no mention of any vulnerability nor defect. Indeed, HID markets their 'value' and how 'cost-effective' they are:

Indeed, the ProxCard II datasheet markets these cards 'security':

This is, at best, highly misleading since the issue is not the number of codes, it is that regardless of the specific code used, it can be read and copied using a cheap cloner.

The direct product documentation is quite important since specifiers and buyers often review or cite those documents when purchasing. Minimally, by including the vulnerability warning there, it would make it clearer what the risks are being exposed.

Conclusion

HID, by its own remarks, has placed itself in the rather remarkable position of selling against a vulnerable / defective product while simultaneously selling that defective product.

Surely, HID wants to be a 'trusted partner', as they say, and discontinuing cracked 125 kHz credentials would increase that trust while driving scores of users away from these credentials.

Vote / Poll

Comments (26) : Members only. Login. or Join.

Related Reports

Vulnerability Directory For Access Credentials on Feb 20, 2020
Knowing which access credentials are insecure can be difficult to see, especially because most look and feel the same. Even insecure 125 kHz...
Directory of Access Reader Manufacturers on Nov 27, 2019
Credential Readers are one of the most visible and noticeable parts of access systems, but installers often stick with only the brand they always...
Uniview OEM Directory on Sep 11, 2019
This directory lists 20+ companies that OEM products from Uniview, with a graphic and links to company websites below. It does not cover all...
3 Weeks Later, Honeywell Still Cannot Say Whether They Are Vulnerable To Dahua Wiretapping [Now Admits] on Aug 27, 2019
The Dahua wiretapping vulnerability and Dahua's decision to delay disclosing it until IPVM inquired underscored problems with cybersecurity and...
Suprema Biometric Mass Leak Examined on Aug 19, 2019
While Suprema is rarely discussed even within the physical security market, the South Korean biometrics manufacturer made global news this past...
Honeywell Speaks On NDAA Ban, New Non-Banned Cameras and Cybersecurity on Aug 06, 2019
For years, Honeywell has depended on Dahua, a company with a poor cybersecurity track record and now banned by the US NDAA, for the development and...
Mobile Access Usage Statistics 2019 on Jul 18, 2019
The ability to use mobile phones as access credentials is one of the biggest trends in a market that historically has been slow in adopting new...
Poor OSDP Usage Statistics 2019 on Jul 09, 2019
OSDP certainly offers advantages over decades-old Wiegand (see our OSDP Access Control Guide) but new IPVM statistics show that usage of OSDP, even...
Security Fail: ASISNYC Auto Emails Passwords In Plain Text on May 14, 2019
ASIS NYC automatically emails a user with the password the user just entered, in plain text, when one registers for the site / event, as the...
Startup GateKeeper Aims For Unified Physical / Logical Access Token on Apr 04, 2019
This startup's product claims to 'Kill the Password' you use to keep your computers safe. They have already released their Gatekeeper Halberd...

Most Recent Industry Reports

USA's Feevr Thermal Temperature System Examined on Mar 31, 2020
This US company has burst on to the scene, brashly naming itself 'feevr' and branding itself as a "COVID 19 - AI BASED NON CONTACT THERMAL...
JCI Coronavirus Cuts on Mar 31, 2020
JCI has made coronavirus cuts, the company told employees in an email that IPVM has reviewed. Inside this note, we examine the cuts made, the...
Add Door Operators To Fight Coronavirus on Mar 31, 2020
IPVM recommends that integrators advocate and end-users consider adding door operators to fight the spread of coronavirus. This delivers...
Video Surveillance Business 101 on Mar 30, 2020
This report explains the fundamental elements of the video surveillance business for those new to the industry. This is part of our Video...
FDA Gives Guidance on 'Coronavirus' Thermal Fever Detection Systems on Mar 30, 2020
The US FDA has given IPVM guidance on the use of thermal fever detection systems being marketed for coronavirus, as an explosion of such devices...
Worsen: Integrators Hit Even Harder By Coronavirus on Mar 30, 2020
Integrator's problems have worsened over the past 2 weeks, according to new IPVM survey results. Inside this report, we share statistics and...
Pivot3 Mass Layoffs on Mar 27, 2020
Pivot3 has conducted mass layoffs, the culmination of grand hopes, a quarter of a billion dollars in VC funding, and multiple failures to gain...
Athena CEO Criticizes 'Deplorable' 'Nitpicking', IPVM Refutes on Mar 27, 2020
UPDATE: NBC News Report Cites IPVM On Coronavirus 'Fever Detection' Cameras Athena Security's CEO Lisa Falzone has strongly objected to IPVM's...
Hikvision Admits Sanctions Harming Its Financial Performance on Mar 27, 2020
While Hikvision initially downplayed being sanctioned for human rights abuses, the company is now admitting a significant impact in a new PRC...