Flipper Zero Makes 125 kHz Prox Cards "Actually Dangerous," Says HID Director

While HID refuses to stop selling 125 kHz Prox cards, an HID director, this week, publicly declared that Flipper Zero makes these cards and readers "actually dangerous," the latest in a series of remarks challenging his employer's HID's profitable sales.

IPVM has in-depth testing and reporting on Flipper Zero and HID vulnerabilities, including:

• Flipper Zero Access Control Hacking Tested
• How Flipper Zero Increases The Risks Of Access Control Hacks
• How HID High-Frequency Only Readers Are Vulnerable To Downgrade Attacks
• HID Standard Profile Makes 13.56 MHz SE / Seos As Vulnerable As Cracked 125 kHz For Downgrade Attack
• The Booming Business Of Flipper Zero
• How the Seader App Works With HID SAMs and Flipper Zero
• Flipper Zero's Advertising Campaign For Cloning Access Control
• The Case For and Against Banning Flipper Zero Analyzed

HID Director: Flipper Makes 125 kHz Cards "Actually Dangerous"

HID Business Development Director Phil Coppola commented on a LinkedIn post about a Flipper Zero advertisement on copying/cloning 125 kHz credentials, saying, "the flipper renders 125kHz Prox-based cards and readers not just obsolete, but actually dangerous." [emphasis added]

We contacted HID HQ, asking them if they agreed with this. However, HID never responded to us, but shortly thereafter, Coppola edited his comment, softening the language:

Ongoing Criticism Of 125 kHz Prox

This criticism is part of a long series of public pleas that HID's Copolla has made to stop using 125 kHz prox, especially because of the rise of Flipper Zero. Below are four more posts from the last five months highlighted:

HID Continues To Sell And Support 125 kHz Prox

Despite acknowledging the security risks of 125 kHz Prox credentials and declaring them "legacy," HID continues to sell and support these outdated products. Nearly half of all physical access credentials in use still rely on insecure 125 kHz Prox technology (see Prox / 125 kHz Access Control Credential Usage Statistics). HID's inconsistent messaging undermines the security of physical access control systems.

Migration From "Legacy" Falls Short

HID's narrative on "migration" away from 125 kHz Prox technology has been prominent for over a decade. However, HID continues to sell and support these credentials, shifting the blame to its partners and customers for buying outdated and insecure credentials from them.

No Comment From HID

HID did not respond to IPVM's request for feedback on questions. If they do, we will update the report with their comments.