I get it — these cards are out there, how can they be copied?

Previous posts on our blog explore how HID cards can be hacked and how the Wiegand protocol, used by HID readers, can be copied by HID card cloners. This post doesn’t go into as much technical depth but, rather, should be a fast and easy way for you to understand the card copying component.

How to Copy 125khz Cards — the Old Way:

A reader, like the one seen here, can easily copy the ID of an existing 125khz EM4100, or a similar type of protocol chip, and copy it to another card or fob. One of the first people to attack this security standard, in 2013, was Francis Brown—managing partner at the security firm, Bishop Fox. Brown set out to deliberately test the security of the standard and developed an Arduino powered reader/writer that could copy existing 125khz tags and fobs.

It's now been five years since Brown developed his tool to hack into these systems and plenty of companies have switched to a more secure, higher frequency standard; however, there are still many businesses that have not updated and still use the 125khz EM4100 cards and fobs, which makes them very vulnerable to attacks.

How to copy 125khz cards with an RFID copier—it's as easy as printing an email!

The “Handheld RFID Writer” (buy one here for as little as $11) works like this:

Turn on the device and hold a compatible EM4100 card or fob to the side facing the hand grip and click on the “Read” button.

The device will then beep if it succeeds, now replace the copied tag with an empty tag and press “Write”

The information stored on the original tag or fob will then be copied onto the new device

Done! Don’t believe how easy it is? Here’s a video to show you:

That’s how easy it is to copy or clone an access card or RFID key fob.

How to copy HID cards and get them on your phone

People ask questions like: “How can a mobile’s NFC be used as an HID proximity card (used at the doors of a corporate office)?“ and “Is the iPhone 6’s NFC transmitter capable of being used as a contactless card reader?” and so on.

In the following segment, we’ll focus on your typical HID card, which works off of 13.56 MHz and is a bit more advanced to copy:

Why are these cards more difficult to copy?

Since the frequency is significantly higher, compared to the 125 KHz version, the amount of bits that can be sent per second is significantly higher. That means the data on the chip to be encrypted will be greater, rendering it more secure. Now that encryption is available for these cards, the way they communicate with a reader device is to send out a signal and the reader reads it. Unlike before, however, it no longer advertises all of its data; instead, it only broadcasts data that is public—like its ID and name.

Ok, I get it—they're difficult to duplicate, but how do we copy them?

To access sensitive information, you have to provide that sector of memory with the right key—otherwise, it will show up blank. Even though these cards are a lot more secure, once you know the encryption algorithm you can decrypt them and access the sensitive information. With that, people can also clone these cards relatively easily.

Since most Android smart phones running the Android OS have NFC on them, reading these cards and, in certain cases cloning them, is easy.

—(If you don’t want to order equipment on Ebay, skip over this part and learn how to duplicate the card using a smartphone and an app)—

Prepare to copy your HID cards—the tools you need: To get started, we need a few cheap components from Ebay—it’s sold under “NFC reader.” You can also check the NFC reader on Alibaba if you need higher volumes. I got my NFC reader/writer on NewEgg, which lists it as “NFC ACR122U RFID” reader/writer tool. It runs on Windows, Mac, and most Linux systems. Once you have the copy tool, you need a Windows-based computer. Install its drivers and start using it. You’ll also need a computer to run the software and, following this guide, you can hack Mifare Classic 1K Cards. Here’s the BlackHat Guide.

Hold on! I hope you didn’t order the NFC reader yet, because if you have an Android you can also do it with your phone!

‍Cloning Mifare NFC cards with a mobile phone:

Here's the easiest way to copy NFC cards to phone:

Although the BlackHat guide works well it can be a bit frustrating to use, since you have to get some components together and hack away at a guide for an hour or two to see some results.

The easiest way to clone Mifare NFC Classic 1K Cards is by using an Android smartphone with NFC capabilities. That’s right, your cellphone can be used to compromise the security of a company if they are using these types of cards (RFID security system). Just download the “Mifare Classic Tool” for Android. Pro Tip: It took me a while to figure out why it doesn’t work, but of course you need to turn on NFC. Go to your settings and search for NFC, make sure to enable it. Now we can start cloning cards that have never changed their default sector password.

How the app is used to copy the card:

The app comes with the default keys set by the manufacturer of NFC cards, you would not believe how many people never bother to change this. Tim Theeuwes has a great guide on how to clone NFC cards using your NFC-enabled smartphone. The following images are from his guide, which can be found here.

Hacking NFC via an app:

Once we have read the key or fob we want, we can store all of the information onto a file. We can then use this information and write it back onto an empty card, essentially cloning the original or fob. Figure 5 below shows the “Write Sector” portion of the app, in which you can write individual sectors or write all of them. The important sector to keep in mind is sector 0 as it is what contains the UID and manufacturer's data, basically if you copy sector 0 to another fob then you’ve made a copy.

The Kisi Reader Pro uses the Mifare Desfire EV1 2K NFC cards, these are some of the most secure NFC cards out today. They provide an added level of security to the already existing Mifare Desfire NFC cards, making them incredibly secure.

If you want to know how we at Kisi use mobile credential and 128bit AES-encrypted NFC cards, check this overview of our mobile access control system or get in touch with us. If you are more interested in how access systems work then download our free PDF guide.

Are you looking for secure access control?

Request a quote on our website!