5 ms·

I work for a company that manufactures access control and communication systems. The readers we develop support a variety of ID standards, from unencrypted EM-M

I work for a company that manufactures access control and communication systems. The readers we develop support a variety of ID standards, from unencrypted EM-Marin and a long time ago cracked Mifare Classic to modern Desfire EVx standards. According to our statistics, more than 95% of customers still continue to use the most insecure identifiers because of their low cost and ease of operation. Many of the installed devices are not properly maintained, even if the manufacturers continue to support them, because you have to pay for maintenance. In addition, not all equipment can be updated remotely over the network or even have a network connection to do so remotely. Even if your cards are encrypted, it still can't guarantee you protection, because in most cases card readers are connected to controllers (not in the case of all-in-one devices like this lock) via Wiegand protocol, which doesn't provide any data encryption, so the identifier ID is transmitted over two wires in the clear form.

lol768 2y ago
At some point, isn't there some responsibility that rests with manufacturers for choosing to continue to support known-insecure standards? How many browsers do you think support the TLS_NULL_WITH_NULL_NULL cipher?
- Nextgrid 2y ago
  It's often a compatibility thing too. Insecure standards can often coexist because they're the lowest common denominator. It's just a "password" stored and transmitted as plaintext. A secure system would involve a PKI which increases complexity and management overhead significantly (you won't be able to just copy "passwords" from one system to another, etc).
  - sonicanatidae 2y ago
    Compat is a factor and valid in some instances. It's not valid at all in this case. The old systems are wholly insecure, and should not be offered at all. This is just some faceless corp being cheap and ignoring the consequences, not their problem.
- noselasd 2y ago
  Browser manufacturers normally don't have contracts that binds them to supply product X for Y years.
  - pixl97 2y ago
    Heh, You mean IE6 and ActiveX controls :D
- ryandrake 2y ago
  > At some point, isn't there some responsibility that rests with manufacturers for choosing to continue to support known-insecure standards? There should be. Also there should be liability for access control system customers for choosing low cost, insecure solutions. But just like in the InfoSec world, there are simply no consequences to companies that cheap out and fail at security. These companies just issue a press release saying “we take security very seriously” and continue on with their business.
- int_19h 2y ago
  I think the only reason why we have the amount of attention to security that we do in the software industry is because Internet enabled cheap automated large-scale attacks - enough so that even very low-value targets are well worth it.
michaelt 2y ago
For a while I've had a question about hotel keycard technology, maybe you can answer. Essentially every time I've stayed in a hotel with contactless keycards (usually in a group needing 3-5 rooms for 2-3 nights) at least one person has needed to get a keycard reissued. What's up with that? My workplace's smartcards and my contactless bank cards keep working for years on end.
- lxgr 2y ago
  Hotel keycards usually work by having dynamic data written to them at the front desk (as the locks are often not network connected, at least in older systems, so they write things to the card like "works for room 123 until March 30th noon and the gym" or "works for room 456; sequence number 2, invalidate all prior keys"). There are two types of magnetic stripe cards available: High-coercivity (HiCo) and low-coercivity (LoCo). The field-rewritable kind used in hotels is usually LoCo, to make the writers smaller and cheaper. But that also makes the cards much more prone to accidental corruption by magnets you might have on you, like earbuds, magnetic wallets etc. Bank cards are usually only ever programmed once (these days), i.e. when they're issued, so they're usually HiCo, making them much more robust against that. In addition to that, magnetic stripe usage has been phased out for payment cards in most countries and is getting rare even in the US, so for all you know, and depending on where you live/shop, your magnetic stripes might have already been demagnetized without any adverse effects! Bonus trivia question: Guess which kind NYC MTA Metrocards are :) Edit: Oh, I just saw that you asked about contactless keycards! For these I actually have no idea, and I haven't had one fail on me yet. I just know that they often use a similar scheme ("works for rooms x, y, z, until timestamp n"), sometimes with a bit of cryptography on top (often with a single shared key across all instances of the same lock and even across hotels...) but using non-networked locks, so there can definitely be synchronization/propagation issues too.
  - neuralRiot 2y ago
    I used to work as maintenance on a big chain hotel and we had magstripe card locks, I don’t think strong security is their primary goal as in a hotel the staff can enter any room at any time, the cards me and my team had were “god mode” we could open any door at any time even when locked from inside. If the lock didn’t work “firmware problems, dead batteries, stuck mechanism” we had another device that worked by removing a cover and connecting with a wire, this was also used for testing and FW updates.
throwway120385 2y ago
I'm in a similar space and a lot of our customers continue to use old-school Wiegand low-frequency badges even though they're ridiculously vulnerable to replay attacks to the degree that Flipper Zero has automated it.
aaronax 2y ago
Same as basically any physical lock can be trivially picked. Yet no one is buying office door locks based on pick-resistance. Burglars will smash their way in anyways.
factormeta 2y ago
>Even if your cards are encrypted, it still can't guarantee you protection, because in most cases card readers are connected to controllers (not in the case of all-in-one devices like this lock) via Wiegand protocol, which doesn't provide any data encryption, so the identifier ID is transmitted over two wires in the clear form. It is true, seems like probably better to go back to keys and lock.
- Rebelgecko 2y ago
  Unfortunately most physical keys also transmit their bitting in the clear
wnevets 2y ago
> so the identifier ID is transmitted over two wires in the clear form. I'm much more worried about someone using to a clothes hanger looking tool [1] to break into my hotel room than someone exposing cables and reading data over the wire to unlock the door. [1] https://www.youtube.com/watch?v=-3G9pyvCBcM https://www.youtube.com/watch?v=-3G9pyvCBcM

lol768 2y ago

At some point, isn't there some responsibility that rests with manufacturers for choosing to continue to support known-insecure standards? How many browsers do you think support the TLS_NULL_WITH_NULL_NULL cipher?

Nextgrid 2y ago
It's often a compatibility thing too. Insecure standards can often coexist because they're the lowest common denominator. It's just a "password" stored and transmitted as plaintext. A secure system would involve a PKI which increases complexity and management overhead significantly (you won't be able to just copy "passwords" from one system to another, etc).
- sonicanatidae 2y ago
  Compat is a factor and valid in some instances. It's not valid at all in this case. The old systems are wholly insecure, and should not be offered at all. This is just some faceless corp being cheap and ignoring the consequences, not their problem.
noselasd 2y ago
Browser manufacturers normally don't have contracts that binds them to supply product X for Y years.
- pixl97 2y ago
  Heh, You mean IE6 and ActiveX controls :D
ryandrake 2y ago
> At some point, isn't there some responsibility that rests with manufacturers for choosing to continue to support known-insecure standards? There should be. Also there should be liability for access control system customers for choosing low cost, insecure solutions. But just like in the InfoSec world, there are simply no consequences to companies that cheap out and fail at security. These companies just issue a press release saying “we take security very seriously” and continue on with their business.
int_19h 2y ago
I think the only reason why we have the amount of attention to security that we do in the software industry is because Internet enabled cheap automated large-scale attacks - enough so that even very low-value targets are well worth it.

michaelt 2y ago

For a while I've had a question about hotel keycard technology, maybe you can answer. Essentially every time I've stayed in a hotel with contactless keycards (usually in a group needing 3-5 rooms for 2-3 nights) at least one person has needed to get a keycard reissued. What's up with that? My workplace's smartcards and my contactless bank cards keep working for years on end.

lxgr 2y ago
Hotel keycards usually work by having dynamic data written to them at the front desk (as the locks are often not network connected, at least in older systems, so they write things to the card like "works for room 123 until March 30th noon and the gym" or "works for room 456; sequence number 2, invalidate all prior keys"). There are two types of magnetic stripe cards available: High-coercivity (HiCo) and low-coercivity (LoCo). The field-rewritable kind used in hotels is usually LoCo, to make the writers smaller and cheaper. But that also makes the cards much more prone to accidental corruption by magnets you might have on you, like earbuds, magnetic wallets etc. Bank cards are usually only ever programmed once (these days), i.e. when they're issued, so they're usually HiCo, making them much more robust against that. In addition to that, magnetic stripe usage has been phased out for payment cards in most countries and is getting rare even in the US, so for all you know, and depending on where you live/shop, your magnetic stripes might have already been demagnetized without any adverse effects! Bonus trivia question: Guess which kind NYC MTA Metrocards are :) Edit: Oh, I just saw that you asked about contactless keycards! For these I actually have no idea, and I haven't had one fail on me yet. I just know that they often use a similar scheme ("works for rooms x, y, z, until timestamp n"), sometimes with a bit of cryptography on top (often with a single shared key across all instances of the same lock and even across hotels...) but using non-networked locks, so there can definitely be synchronization/propagation issues too.
- neuralRiot 2y ago
  I used to work as maintenance on a big chain hotel and we had magstripe card locks, I don’t think strong security is their primary goal as in a hotel the staff can enter any room at any time, the cards me and my team had were “god mode” we could open any door at any time even when locked from inside. If the lock didn’t work “firmware problems, dead batteries, stuck mechanism” we had another device that worked by removing a cover and connecting with a wire, this was also used for testing and FW updates.

throwway120385 2y ago

I'm in a similar space and a lot of our customers continue to use old-school Wiegand low-frequency badges even though they're ridiculously vulnerable to replay attacks to the degree that Flipper Zero has automated it.

aaronax 2y ago

Same as basically any physical lock can be trivially picked. Yet no one is buying office door locks based on pick-resistance. Burglars will smash their way in anyways.

factormeta 2y ago

>Even if your cards are encrypted, it still can't guarantee you protection, because in most cases card readers are connected to controllers (not in the case of all-in-one devices like this lock) via Wiegand protocol, which doesn't provide any data encryption, so the identifier ID is transmitted over two wires in the clear form. It is true, seems like probably better to go back to keys and lock.

Rebelgecko 2y ago
Unfortunately most physical keys also transmit their bitting in the clear

wnevets 2y ago

> so the identifier ID is transmitted over two wires in the clear form. I'm much more worried about someone using to a clothes hanger looking tool [1] to break into my hotel room than someone exposing cables and reading data over the wire to unlock the door. [1] https://www.youtube.com/watch?v=-3G9pyvCBcM https://www.youtube.com/watch?v=-3G9pyvCBcM