How Hackers Extracted the ‘Keys to the Kingdom’ to Clone HID Keycards

The researchers' method extracts HID's important authentication cardinal retired of an HID encoder's Secure Application Module—the astir protected constituent of the encoder's memory—by reverse engineering the bundle that controls however an encoder interacts with a alleged “configuration” keycard. Those configuration cards are however HID and its customers determination authentication keys betwixt elements of the system, specified arsenic from encoders to the readers connected doors and gates. Javadi uses the analogy of an armored car designated to prime up bags of currency from a bank's vault. “As it turns out, we recovered a mode to fool the slope manager and fabricate the transportation orders that would let that cardinal transportation to instrumentality place,” says Javadi, “We fundamentally took our ain armored car—our ain configuration card—to the vault, and it gave america the keys.”

Compared with that cardinal extraction, the earlier measurement successful an HID cloning attack, successful which a hacker covertly reads a people keycard to transcript its data, isn't peculiar challenging, Javadi says. Javadi, who often performs carnal penetration testing for clients, says he's cloned HID keycards to surreptitiously interruption into customers' facilities, scanning the keycard of unsuspecting staffers with an HID scholar hidden successful a briefcase with the device's audible beep switched disconnected for added stealth. “It takes a fraction of a second,” Javadi says.

An HID scholar susceptible of pulling information disconnected a keycard from 6 to 12 inches distant is comparatively large: a 1-foot-square panel. But successful summation to hiding it successful a briefcase, Javadi has besides tested retired secreting the scholar wrong a backpack oregon a pizza container to silently work a target's keycards. His squad adjacent hid 1 successful a insubstantial toilet spot screen dispenser to work the keycard of employees wrong a bath stall. “We've gotten originative with it,” helium says.

A Complex Fix successful Progress

When WIRED reached retired to HID, the institution responded successful a connection that it's really known astir the vulnerabilities Javadi's squad plans to contiguous since sometime successful 2023, erstwhile it was archetypal informed astir the method by different information researcher whom HID declines to name. While details of the researchers' cardinal extraction method volition beryllium presented publically for the archetypal clip astatine Defcon, HID warned customers astir the beingness of a vulnerability that would let hackers to clone keycards successful an advisory successful January, which includes recommendations astir however customers tin support themselves—but it offered nary bundle update astatine that time.

HID has since developed and released bundle patches for its systems that hole the problem, it says, including a caller 1 that it intends to merchandise “very soon” pursuing the Defcon presentation. The institution declined to item what precisely this latest spot is for oregon wherefore it was indispensable aft its antecedently released bundle updates, but stated that its timing is unrelated to the researchers' Defcon talk. “Once available, we urge that customers instrumentality these caller steps arsenic soon arsenic they are able,” HID's connection reads.

HID and the squad researchers who recovered its vulnerabilities some accidental that the cloning method works astir practically against the bulk of HID's customers who usage alleged “standard” oregon “shared key” implementations of systems. In those installations, a azygous acceptable of keys extracted from an encoder could beryllium utilized to clone keycards for hundreds of customers. So-called “elite” oregon “custom key” customers, connected the different hand, usage a unsocial cardinal for their installation, truthful it would necessitate hackers to get an encoder oregon extract an encoder's keys for that circumstantial customer, a acold much hard prospect.

The squad presenting astatine Defcon accidental that they besides recovered a method to person an HID scholar taken from a lawsuit into an encoder, which would let cloning of keycards that usage those customized keys, too. But that method requires removing the scholar from the partition of a customer's building, vastly raising immoderate intruder's hazard of being caught oregon foiled. As such, HID recommends that customers power to that higher security—and much expensive—custom cardinal implementation.

HID besides points retired that for galore customers, stolen keycard information would lone let cloning if it's written to valid HID keycards. (“HID keycards are not hard to travel by,” Javadi notes.) But that safeguard doesn't use to a communal concern successful which HID customers' readers are configured to let for the usage of older keycard technologies. So HID recommends that customers besides update their cards and disallow the usage of older paper types successful their facilities.