HID: Stop Selling Cracked 125 kHz CredentialsBy: IPVM Team, Published on Nov 05, 2018
HID should stop selling cracked 125 kHz access control credentials, that have been long cracked and can easily be copied by cheap cloners sold on eBay and Amazon.
To its credit, HID has long acknowledged the vulnerability and does take steps to warn customers of the risks, as HID has explained to IPVM inside this post.
Vulnerable / Cannot Be Fixed
However, since these products are vulnerable and cannot be 'fixed', they should not be sold at all. If HID or Axis or any responsible manufacturer found a vulnerability in their firmware, they would stop selling such products until they fixed it. Since the 125 kHz vulnerability cannot be fixed via firmware or software upgrade, they should be discontinued. The video below demonstrates exploiting the vulnerability:
Reasonably, HID can set a period of time in the near future where they will stop manufacturing such that existing users can transition their hardware and/or credentials as appropriate.
Facilitating an EOL deadline would not exclude HID from upgrades, as HID already has 'migration hardware' available with Multiclass readers supporting an immediate reader upgrade and slower/budgeted/planned credential migration.
Using those intermediate readers is a primary method HID itself suggests for transitioning, one of the three solutions we detail in our Cracked 125kHz Access Control Migration Guide.
HID Largest Provider
We are calling on HID because they are the largest credentials provider and the only ones, short of government, capable of making a major market impact.
Moreover, HID could even use this as a differentiator against their smaller competitors to position themselves further as the 'market leader' who takes a strong stand in favor of 'security' at the expense of easy profits from selling vulnerability access control credentials. Notably, if HID did this, it would put pressure on rivals still selling these cracked credentials who would be viewed as still profiting from such insecurity.
To their credit, HID acknowledges vulnerability, including a statement they provided to IPVM in response to our inquiry about discontinuing 125 kHz cards:
Moreover, HID emphasized in follow-up remarks that:
Our field teams disclose these known vulnerabilities in virtually every 1-on-1 customer (channel partner, consultant, or end customer) meeting regarding readers/credentials. These conversations are always followed by discussion of steps to mitigate the vulnerability through credential migration.
Most of our field team members have cloning devices for demonstration of attack methods.
We typically bring common cloning devices to tradeshows (e.g. GSX) where we conduct demonstrations during customer meetings in HID booth.
Despite this, HID says ~40% of the market is still using these cracked credentials and that, given that they would prefer they buy it from HID, a 'trusted partner':
as 125 kHz represents approximately 40% of the global physical access control credential market. Until there is a more substantial market shift away from the technology, we prefer that customers source it from a trusted partner.
No Warnings on HID Product Documentation
While HID has marketing materials warning of the vulnerabilities, they do not do so on their 125 kHz product documentation. The product pages and datasheets make no mention of any vulnerability nor defect. Indeed, HID markets their 'value' and how 'cost-effective' they are:
Indeed, the ProxCard II datasheet markets these cards 'security':
This is, at best, highly misleading since the issue is not the number of codes, it is that regardless of the specific code used, it can be read and copied using a cheap cloner.
The direct product documentation is quite important since specifiers and buyers often review or cite those documents when purchasing. Minimally, by including the vulnerability warning there, it would make it clearer what the risks are being exposed.
HID, by its own remarks, has placed itself in the rather remarkable position of selling against a vulnerable / defective product while simultaneously selling that defective product.
Surely, HID wants to be a 'trusted partner', as they say, and discontinuing cracked 125 kHz credentials would increase that trust while driving scores of users away from these credentials.
Vote / Poll