Can I pick this RFID Lock electrically from a distance?
video description
Date: 2022-04-25
Related videos
Comments and reviews: 10
а
When playing with RFID, you need a proxmark3. build your own custom antennas and build configs for them. not sure if this distance has been surpassed since though a while back, saw a tutorial on how to build a 2ft ( 60cm) highjacking rig, all inconspicuously inside of a backpack. technically you could post up near the reader and just hijack 125khz rfid credentials (as PoC to educate the public) all day long. With facemasks still being viewed as socially acceptable, I can see a lot of downtown condos and corporate buildings being at risk for tresspassers just walking through the front door, nosus.
reply
When playing with RFID, you need a proxmark3. build your own custom antennas and build configs for them. not sure if this distance has been surpassed since though a while back, saw a tutorial on how to build a 2ft ( 60cm) highjacking rig, all inconspicuously inside of a backpack. technically you could post up near the reader and just hijack 125khz rfid credentials (as PoC to educate the public) all day long. With facemasks still being viewed as socially acceptable, I can see a lot of downtown condos and corporate buildings being at risk for tresspassers just walking through the front door, nosus.
reply
Tim
Security on 125kHz is non-existant. My old office even had the number printed on the tag itself so I could clone it from a photo which is >30cm. 13. 56MHz cards actually have some security, but you can fully read many cards with a smart phone in around 1 minute. In most cases you can defeat low security locks by just cloning the UID onto a Magic Card or something microcontroller based like the Chameleon E which has low cost clones from China. The official proxmark stuff can apparently intercept 13. 56MHz signals between the reader and fob but I've not tried that.
reply
Security on 125kHz is non-existant. My old office even had the number printed on the tag itself so I could clone it from a photo which is >30cm. 13. 56MHz cards actually have some security, but you can fully read many cards with a smart phone in around 1 minute. In most cases you can defeat low security locks by just cloning the UID onto a Magic Card or something microcontroller based like the Chameleon E which has low cost clones from China. The official proxmark stuff can apparently intercept 13. 56MHz signals between the reader and fob but I've not tried that.
reply
bigclivedotcom
When I was building an RFID door lock for my mum when she developed Alzheimer's, the hardest bit was getting a good range. I ended up getting a huge (and resin potted) reader unit and using it with the long range cards. (The keyfob circuit but with a wider coil in a plastic card) I got a decent range from it. It also greatly improved the range of the common keyfobs too.
There does seem to be quite a precise science to reading the keyfobs accurately. I did a lot of experimentation with adding wider coils too.
reply
When I was building an RFID door lock for my mum when she developed Alzheimer's, the hardest bit was getting a good range. I ended up getting a huge (and resin potted) reader unit and using it with the long range cards. (The keyfob circuit but with a wider coil in a plastic card) I got a decent range from it. It also greatly improved the range of the common keyfobs too.
There does seem to be quite a precise science to reading the keyfobs accurately. I did a lot of experimentation with adding wider coils too.
reply
Gareth
Lookup some of the talks by deviant ollam. He has a physical pen testing company and a training school called red team alliance. In one of the talks they have a long range rfid reader off a car park entrance they rig with liion battery and a logger in a laptop bag and his walk around a coffee shop snagging all the tags the find. He also has a talk about keyed alike systems and the fact many of the rfid panels have keyed alike maintenance panels and can just be overridden
reply
Lookup some of the talks by deviant ollam. He has a physical pen testing company and a training school called red team alliance. In one of the talks they have a long range rfid reader off a car park entrance they rig with liion battery and a logger in a laptop bag and his walk around a coffee shop snagging all the tags the find. He also has a talk about keyed alike systems and the fact many of the rfid panels have keyed alike maintenance panels and can just be overridden
reply
elesjuan
Physical pentesting dudes often use a long range reader in a backpack to covertly get close to your target rfid card as to steal credentials. Notwithstanding the quality of your lock and security system, an easy way to safeguard against this type of attack, beyond rfid blockers on security badges, is to require a pin code after a successful badge scan. That pin code should be tied to a specific user/card, not just a general code for everyone.
reply
Physical pentesting dudes often use a long range reader in a backpack to covertly get close to your target rfid card as to steal credentials. Notwithstanding the quality of your lock and security system, an easy way to safeguard against this type of attack, beyond rfid blockers on security badges, is to require a pin code after a successful badge scan. That pin code should be tied to a specific user/card, not just a general code for everyone.
reply
Christie
You had me glued to the screen with this. I'm working on an RFID product using Gen2 tags ( 900MHz. I have read tags over 2m and I have a more powerful reader I haven't tried yet. I assumed that lock tags would perform some kind of encryption, or at least use a unique number that can't be easily copied. Gen2 tags include a permanent, unique identifier as far as I know. I'm shocked that those tags can just be copied and work.
reply
You had me glued to the screen with this. I'm working on an RFID product using Gen2 tags ( 900MHz. I have read tags over 2m and I have a more powerful reader I haven't tried yet. I assumed that lock tags would perform some kind of encryption, or at least use a unique number that can't be easily copied. Gen2 tags include a permanent, unique identifier as far as I know. I'm shocked that those tags can just be copied and work.
reply
Chris
Do it the Mission: Impossible way (The TV series, not the way overdone movies) Modulate a microwave frequency with the RFID carrier. Use a directional microwave antenna to transmit. Since the coil is tuned for the lower frequency, it effectively de-modulates the RF and powers the RFID chip normally. Then you just need to read the code back. (Yes, this will never work, but that's how they would have done it. )
reply
Do it the Mission: Impossible way (The TV series, not the way overdone movies) Modulate a microwave frequency with the RFID carrier. Use a directional microwave antenna to transmit. Since the coil is tuned for the lower frequency, it effectively de-modulates the RF and powers the RFID chip normally. Then you just need to read the code back. (Yes, this will never work, but that's how they would have done it. )
reply
Bernd
The LPL hack with the magnet to the relay was more fun: ) (I think a general good indication: if you connect the lock contacts to the outside device it s not safe)
BTW the better RFID systems go a long way to document that they should not be used as access control: )
Only rfid Chips with smart card function can do challenge/response and are (partially, think relay attacks) safe.
reply
The LPL hack with the magnet to the relay was more fun: ) (I think a general good indication: if you connect the lock contacts to the outside device it s not safe)
BTW the better RFID systems go a long way to document that they should not be used as access control: )
Only rfid Chips with smart card function can do challenge/response and are (partially, think relay attacks) safe.
reply
Banana
Great video and idea, I just wanted to add up by looking at the internal circuit of the lock ( 3: 57 ) that this lock uses a regular relay (almost certain to trigger the lock to open) which makes me sure you can open it just by using a powerful magnet (say neodymium) on the side of the lock, which is a known venerability to most cheap and even some premium security systems.
reply
Great video and idea, I just wanted to add up by looking at the internal circuit of the lock ( 3: 57 ) that this lock uses a regular relay (almost certain to trigger the lock to open) which makes me sure you can open it just by using a powerful magnet (say neodymium) on the side of the lock, which is a known venerability to most cheap and even some premium security systems.
reply
JohnMartin512
I noticed the ruler your were using to measure distance. Is this a metal ruler? If so, is it steel? (I am thinking iron core inductor here) Just wondering if this ruler could be affecting things inductively? Yes, of course, if the ruler is just there for reference while filming, then nothing strange could happen. :) John M.
reply
I noticed the ruler your were using to measure distance. Is this a metal ruler? If so, is it steel? (I am thinking iron core inductor here) Just wondering if this ruler could be affecting things inductively? Yes, of course, if the ruler is just there for reference while filming, then nothing strange could happen. :) John M.
reply
Add a review, comment
Other channel videos
