Proximity Card Vulnerabilities

Author: Brian Rhodes, Published on Aug 22, 2012

Even though it is the most common credential in access control today, proximity cards face notable security problems. The effort to move end users to newer card technologies is no accident; technology vendors are not only trying to sell new readers, but they are trying to mitigate the risk inherent in every single one of these older cards.

What are these risks, and what can be done to make them more secure short of overhauling all the readers and cards in an access control system? In this note, we dig in to this issue and provide our recommendations.

**********

** ** ********** *** **** ** ******* **** '********* *****' have **** ** *** *** **** ** *****. **** **** technologies, *** **** ****** ** ** ****, *** **** ********* it ******* ******* ************. ***** ** **** *****, *** ******* of ************ ********* ***** *** ****** *********:

  • **** ** ***** & *****:*** ******** ** **** **********,******, ********-**-***** ************ ** ********* **** ** ********* ********** *****.
  • **** ** *********: **** ** * ******** ******* ** ********, **** ********** a '******* ******' **** * ******** **** ********** ***** ***** ** **** *** *********. ****** '******* ***********' ** *****-***** ********* ************ **** ***, proximity ***** *** ** **** ******* **** ****** ********* ** fifty ** **** **** ****. ********** **** ******** *** ******* can ****** ******* *** *** **** **** ***** ********** ********* from ***** ***********.
  • ****** ********* ** ************:********* '*****' ********* ***** ** **** *** *****. ** ** ************ **** ***** **** * *** ***** details ***** *** ***** ** ***, **** *** ******* '***** matches' ** ****** ***** ** **** ********** **** ****** ******. While ********** ********* *** ******** *********, **** ***** ******* ********** cutting ****** ***** **** **********. ** **** *****, ****** ***** copies ** ****** ***** ** **** *********.
  • *********** ***** *** ******** ******:***** *** ***** ***** ***** **** ** ******* **********, ********** cards *** ***** **** **** ******** ****** ****-**** ******* ** stuffed **** ****** **** ***** ****, *** *** ** ****** stolen ** '****' *** *** ******** ** *******. ***** *** commonly **** ** ********* *** **** ***** ** *** ********* the ******** ************* ********** **** **** *******.

The ***** ** *** ******

***** **'* ************ ** *** ******** ****** ** *******'*, *********** **** *** **** *** ******** ****** ** ********** credentials **** ******** ****** ******* *******. *** **** ** ***** find ********* (****) ***** **** ** *** - **** * card ** ***** ** * ****** - ** ******** ******* equipment ** **** ** **** *** *********** ** ****. *******, the ******** *** ******* ******* ** '******** ******* *********'.

***** *** ********** ** ***** ****** ********, ** ** ** no ***** '*********' ** '**********'. ** ********** **** * ****** amount ** ********* ****/****** ********* *** **** * ****** ** exploits *** ******* ********* ** **** ********* ** ****. ** recent *****, * **** *** ** ** ******* ******** ***********,********** ******** ********, ** ** **** ************* ***** ************ ** ******* ******* ** *** ******* *** ****** **** card ********** *** ** ***** ********* **. *******, ******* *** buzz,**** ** ***** ******* ****** *** ** *** ***** ** common *********.

Really * *******?

********** ***** *************** ** ***** ** ****** **** ** *********. It ** ******** **** ** ********** ****** ** ************ ***** will ** ******* ****** *** **** *** *********** ********* ******** to **** ********* ** ***** ********. **** *** ******** ***** in *** ****** ****** ** ******* ******** * ******** *** Prox **** ***************, *** **** *** ***** *** ***** **** their ******* ****** **** ***** ******** **** ***************** ************* *******. * **** ********** ****** ******* **** *** chance ** ******* ******** ** ******* ** ****** **** ** unlikely *** ******** ** *** *********** ********.

*******, **** ********** *** '**** ********' ************* **** **** **** vulnerabilities *** *** *** ********* ** ****** *******. ******** ******** in ***** ********** ***** ****** **** ********** **** **** ***** as **** ** ** ** **********. ** **** *****, **** means **** ********* ***** **** **** ********** **** *** ** those **********. *** *******, **** *** ****** ** ****-**, *** US ********** *** ******* ****-*** *** ********* **** ********* *** of **** ***** ********, ** **** ** ********* ***** ***************.

Mitigating *** ****

************* ***** ******* ********* ****** **** *** **********, *** **** incentivize ***** **. *** *******, ****** ** ******* **** **** II. *******, ******* ********** *** ****** *********** ** *** ****** necessary ** ******** *** ******** ** * ******. *** ***** end ***** *** ** ******** ** *** *** ********, **** are **** ********* ***** ** ******** **** ******** *********:

  • ***-****** **************: * ****** **** ** **** ******* *** "********* *** Have *** ********* *** ****" ************ ****. ** **** *****, this ***** ********* **** * **** ********** *** * *** to ****** ** *******. ***** *** **** ****** ***** ** slowing **** *** ********** *******, ** ********* ******** ** ******* a **** **** **** *** ****** ****** ** **** ******.
  • ******* **** ****** ******: **** ** ** ***** **********, *** ******* **** ******** aspect, ** ******** ** ********** ****** ******* ******. **** **** requires *********** *** ****** ** ****** **** ******* ****** **** during ******* ***** *** ** ******* ****. ** ***** *****, first-shift ********* **** **** ****** ****** ***** ***** ******* ** workdays, *** ** **. ******, **** ****** ****** ******** '*******' the ****** ** *********** ****** ******** ** ****** ********** * card ****** ****** *** **** ** *** ***. *******, ***** tightening **** ****** *********** *** ******** ************* ****** '***-********' *************, it *** ************* ******** ******* ******** ** ******** *** ******* of ***** ****** *****.
  • *** ******** '******** *****': * ******** ***** ** *********** **** ****** ******* *** to ****** *********** ** *** '******** ****'. **** ******* ******* **** **** ** ** * ******* value ** ***** *** * **** ** **** ** '****' by *** ******. *******, **** *** ***** ** *** ******* the ********** ** **** ****, *** **** *** ******** ***** system ** ********* ** ***. ** *** **** *** **** a '********** ******' ****** *** ****** ** ********* **** *** ** **** to **** * ******* ****, ***** * ****** *** ** 'factory *****' ****** *** ********* ****** ** ***** **** ***** to *** ******* * ******. ***** **** **** **** *** prevent ************* ******** **** ******* **** ****, ** ** **** layer ** ******** ** *** ** ***** *******.
  • ***** ***** ************ **** ******:***** **** *** ***** ** ****** ****** ******* ***** ** a ********, ****** ******* ** *****, *** *********** ***** **** access ******* **** ****** ********* *** ************ ***** ********. **** the **** ************* ******** *** **** **** **** *** ******, and ********** ***** ******* ******* ******** ****** *** ******* ******** before **** ****** *******.
  • ********* ******** ** ***** *********** ** ****:**** ********** ******** *** ***** ** * ******* ** ***** rather **** ** *********** *** ******* ** **** ************ ******. In *** **** *** **** ***** ***** *** ***** *** rings ** ** ******** ******, ** ** ********* ** ********* prox ***** ** * ****, ****** **** **** *** ***** used. ********* *** ********** ** ******* **** ********** ****** ** their ****** ** ******** ****** ** *** ***** **** ************* reduce *** **** ** ************ *****.
Login to read this IPVM report.
Why do I need to log in?
IPVM conducts unique testing and research funded by member's payments enabling us to offer the most independent, accurate and in-depth information.

Related Reports

Dedicated Vs Converged Access Control Networks (Statistics) on Apr 20, 2018
Running one's access control system on a converged network, with one's computers and phones, can save money. On the other hand, hand, doing so can...
Worst Access Control 2018 on Apr 18, 2018
Three access control providers stood out as providing the most problems for integrators. In this report, we analyze the answers to: "In the...
Key Control For Access Control Tutorial on Apr 16, 2018
End users spend thousands on advanced systems to keep themselves secure, but regularly neglect one of the lest expensive yet most important aspects...
Alarm.com Business Market Expansion on Apr 13, 2018
Alarm.com has millions of subscribers, but the company has traditionally been mostly a residential/home focused offering.  ADC's new Smart Business...
GDPR For Video Surveillance Guide on Apr 12, 2018
The European Union’s General Data Protection Regulation (GDPR) comes into force on May 25, but there is much confusion and no clear guidelines on...
Average Access Control Project Size 2018 on Apr 10, 2018
  The most common access control project size is 5 - 16 doors per project. This 2018 result mirrors previous statistics, most recently in 2016...
ISC West 2018 Access Control Rundown on Apr 06, 2018
For ISC West 2018, what is new and interesting in access control?  This rundown will bring you up to speed on the exhibitors, what they are...
VMS New Developments Spring 2018 (Avigilon, Exacqvision, Genetec, Hikvision, Milestone, Network Optix) on Apr 04, 2018
What's new with VMS software? In this report, we examine new features and releases for Spring 2018 to track different areas of potential...
Forced Door Alarms For Access Control Tutorial on Apr 04, 2018
One of the most important access control alarms is also often ignored. "Forced Door" provides a vital and even critical notification against...
The 5 Major Lock Profiles Guide - Euro, Oval, KIK, Interchangeable Core, Mortise on Apr 03, 2018
Locks are used everywhere, but they are not all the same. In fact, even the shape of the lock changes, sometimes for no other reason than...

Most Recent Industry Reports

May 2018 Camera Course on Apr 20, 2018
Save $50 on early registration until this Thursday, the 26th. Register now (save $50) for the Spring 2018 Camera Course This is the only...
Global Real-Time Video Surveillance - EarthNow on Apr 20, 2018
A new company, EarthNow, with backing from Bill Gates, Airbus and more, is claiming that: Users will be able to see places on Earth with a delay...
Dedicated Vs Converged Access Control Networks (Statistics) on Apr 20, 2018
Running one's access control system on a converged network, with one's computers and phones, can save money. On the other hand, hand, doing so can...
April 2018 IP Networking Course on Apr 19, 2018
This is the last chance to register for our IP Networking course. Register now. NEW - 2 sessions per class, 'day' and 'night' to give you double...
Rare Video Surveillance Fundraising - Verkada $15 Million on Apr 19, 2018
Fundraising in video surveillance (and the broader physical security market) has been poor recently. Highlights are few and far in between...
'Best In Show' Fails on Apr 19, 2018
ISC West's "Best In Show" has failed. For more than a decade, it has become increasingly irrelevant as the selections exhibit a cartoon level...
Security Camera Cleaning Frequency Statistics on Apr 18, 2018
150+ integrators told IPVM how often they clean cameras on customer's sites and why.  Inside we examine their answers and break down feedback...
Worst Access Control 2018 on Apr 18, 2018
Three access control providers stood out as providing the most problems for integrators. In this report, we analyze the answers to: "In the...
Axis VMD4 Analytics Tested on Apr 17, 2018
Axis is now on its 4th generation of video motion detection (VMD), which Axis calls "a free video analytics application." In this generation, Axis...
Arecont CEO And President Resign on Apr 17, 2018
This is good news for Arecont. Arecont's problems have been well known for years (e.g., most recently Worst Camera Manufacturers 2018 and starting...

The world's leading video surveillance information source, IPVM provides the best reporting, testing and training for 10,000+ members globally. Dedicated to independent and objective information, we uniquely refuse any and all advertisements, sponsorship and consulting from manufacturers.

About | FAQ | Contact