(untitled)

My apartment building is moving from 6-pin bolt locks to these HID RFID key fobs, just wondering if any of you know how if there's any vulnerabilities there. I know these things are super widespread, so I'm sure there's little concern, but "academic breaks" are fun to think about, whatever.

>>16349 A friend of mine cloned his key fob so he could get spare keys for his apartment. These things are by no means secure, if you could provide a model number or brand I could be more specific with exploits or vulnerabilities you may be interested in knowing for your own safety.

>>16350 I've got serial numbers on the back, as for brand/manufacturer I'd probably have to talk to building management and find out their distributor. I'm not about to share the serial number online until I understand what all parts of it identify.

HID is a brand isn't it?

>>16351 There is a big difference between serial and model number. If you want to go ahead and share them both along with your location, at least you wont be lonely Present Day, Present Time! AHAHAHAHAHA!

>>16353 I work too hard to be lonely to compromise that now Anyway, this seems to be the fob https://www.hidglobal.com/products/cards-and-credentials/hid-proximity/1346

>>16354 You're lonely, im lonely, we can be lonely together :) https://www.getkisi.com/blog/hack-hid-keycard

>electronic 'security' >if there's any vulnerabilities >if ..if you need to ask.... Seriously....Yes. There are. There always is. There always will be. Do you think they would move to a system that is *more* secure for you - a user who has no alternative security option but to accept it? It's easier for the landlord to access apartments without tenants knowing. >that's against the law / illegal Those with power give themselves excuses to break law A quick heads up, post scamdemic companies everywhere are clawing power away from customers - shorter credit terms, etc. I'm not going to drift into any off-topic rant on the geopolitics of why they are doing this here, but tl;dr the real dystopia hasn't even begun. With the device specifics it should be fairly easy to phreak. See Blackhat archive for more.

>>16362 P.S. >>16354 >Your HID fob link >links to product datasheet.pdf >datasheet mentions "No Weigand stripe" and "Corporate 1000" extra security >search Weigand + Corporate 1000 >https://www.hidglobal.com/sites/default/files/hid-understanding-corp1000-wp-en.pdf >HID fob confirmed as using Weigand protocol See anons link here >>16355 at foot of article... >Pro Tip: HID proximity cards, popular access cards used by offices all over the world, and the protocol that underlies them, known as Wiegand, are inherently obsolete and should not be used anymore. >protocol inherently obsolete . should not be used . article published 2018. The best you can do is show everyone in the apartment it's insecure, but expect pushback for rocking the boat.

>>16349 Couldn't one copy those with an RFID scanner from a distance of about 50 centimetres? Correct me if I'm wrong. But if I'm right, you could potentially get into any door in the complex with ONE SIMPLE TOOL. CLICK HERE.

>>16363 The best way is to hint that "it's probably insecure" and abruptly end the conversation giving them the subconscious memory, then later try breaking your own lock and demo this over the people around you (maybe with stuff you could buy or DIY but beware buying stuff for phreaking could put you in watch if you're in some 20 eyes dystopian colony).

>>16362 >>16363 Thanks for the info my dude! Yeah, I seriously plan on somehow demonstrating their insecurity in some way. My only concern is with something that would require modification of the wall mounted reader, there are cameras and I'd be evicted lol, so I'd like to avoid exploits like that. Honestly, alluding to their inherent insecurity could be a good step, or maybe a formal email if I gather my sources. And to clarify, it's being installed on the entry doors, units are still keys (which they have duplicates of, they can still enter my unit for almost any reason anyway).

>>16363 Also, just poking around in their product configuration, I'm pretty sure Corporate 1000 is just for generating identifiers or whatever, I don't understand what kind of security it provides.

>>16371 >lock is insecure when you change the lock you have set of keys for. What is your problem?

>>16373 What? I don't get what you're asking, please elaborate.

just buy a rfid clone maker of amazon and scan it with a rfid reader. That's the most common and easy way.

>>16363 Wiegand is simply the format in which the card reader communicates with whatever device is managing the access control (and to a lesser extent the format of the data on the card itself, that is a facility code, card ID, and parity bits). https://www.hidglobal.com/sites/default/files/hid-understanding_card_data_formats-wp-en.pdf (the link also talks about the Corporate 1000 card data format) The device in question appears to be a ProxKey III, the 'Prox' branding suggesting that it is uses the standard HID Prox (Proximity) communications protocol. In fact, a closer look at the datasheet confirms that the device uses 'HID Proximity 125 kHz'. https://www.hidglobal.com/sites/default/files/resource_files/prox-proxkey-iii-keyfob-ds-en.pdf HID Prox works similar to most 125kHz protocols in that it is a unidirectional protocol from card to reader, that is, the reader transmits a steady 125kHz signal, powering up the device, to which it responds by continuously transmitting its information back. This is usually by some sort of frequency shift keying (by de-tuning the antenna by shorting it out, for example). You can easily clone a HID Prox credential by simply transmitting this 125kHz signal and monitoring the data being sent by the card. You would then program another card, such as a T5557/67 to replay this information. In fact, this is what 'card cloners' do. You could also invest in a device such as a Proxmark3, which is designed for reading and writing RFID cards. I did some quick research and found a research paper that has some details on how these cards communicate. https://core.ac.uk/download/pdf/83115201.pdf In particular, see section 4.1 on HID Proximity Cards.

>>16384 If a lock fends off most intruders who did not modify it's internals, it is a good lock. You do not regularly let burglars change locks on your doors to one they have spare keys for, don't you, don't you? All your made-up reddit-tier hacking scenarios are feasible only after buying thousands of dollars worth of vendor key override equipment or cracking the security by a genius cracker (who has better things to to than breaking in some ghetto ass amerishart apartment building) are fended off by simple event: an intruder slips in the crack of a closing door behind air-headed grandma. Intrusion job done, funds spent = 0, lock technology irrelevant.

>>16349 If you've got an android you can download an app and check what type of card they are usually. I've cloned 13.56mhz Mifare cards before with a cheap ebay read-write module. No idea if they can be tampered with other ways for your apartment though.

>>16371 yw Perhaps show a video of a similar system being easily compromised to fellow residents, or tape the url to the communal notice board entitled "Is this really safe?". >>16479 >All your made-up reddit-tier hacking scenarios are feasible only after buying thousands of dollars worth of vendor key override equipment or cracking the security by a genius cracker Ummm, no. There's an episode of Modern Rogue's youtube channel that deals with cloning rfid and installing a cheap esp8266 to sniff data. One person with clip board and hi-vis vest to stand nearby while the other installs. Communal / common entryways are susceptible to such attacks because all authorized users think someone else approved the works. You don't have to wait to slip-in behind air head grandma when you have the keys to the kingdom.

>>16501 Yes, someone would definitely sped their time obtaining a valid service company uniform, an accomplice, spend a few hours tampering with a tamper-proof lock on a closed door to copy someone's key for what could be done by calling a random apartment intercom and saying you're mailman, or slipping behind random grandma. Here's stuff from some articles posted above, if it does not work by sniffing radio channel between key and reader, it's not worth bothering with: https://github.com/LinkLayer/BLEKey /watch?v=7VVpg6Fh1a4