2

first of all, i really apologize for asking this kind of generic question, but since i am a complete newbie in this area, i hope you wont mind.

I found a nice and cheap RFID powered locking system (http://www.alibaba.com/product-detail/Waterproof-Digital-rfid-Card-Electronic-locker_60561282753.html) that i plan to use on swimming lockers for users to store their things.

Since i dont understand this area, i was wondering is this secure? I saw somewhere that RFID cards/bracelets can be cloned and that doesnt sound good. So, if somebody rents a locker today and clones the card, he can keep opening them until he wants, right (because the card/bracelet stays the same?)

Again, i know this is very broad question but if anybody have any suggestions or comments, please let me know.

Thanks a bunch!

Improve this question
1
  • This happened at the gym I used to attend. I used to put my RFID entry card beneath my smartphone cover. Not to mention my phone is NFC-enabled. When I touched with the combo, the locker closed. But I was never able to open it again until an attendant came with the passepartout card. A few days of try and fail, and I ended up locking half the gym's lockers. Android smartphones randomize their NFC ID for obvious privacy reasons, so when you close a locker with a key you lose chance to open it again with the same ID. Forever. The attendant made a video and sent it to their business Whatsapp chan
    – usr-local-ΕΨΗΕΛΩΝ
    Jan 18 at 9:51

3 Answers 3

Reset to default
2

Clear answer: it depends.

I've read the linked product description but it simply doesn't give enough information to tell whether it is really a secure solution or not.

It could be done in a secure way (using state of the art secure elements inside the cards/token, using approved cryptographical algorithms and an appropriate protocol), but it could also be done in a more or less superficial way.

Given only the information in the product description you can't tell.

Improve this answer
0

The Temic card supports Cipher coding to key card so that each card has a different code that can not be copied. Compulsory or force iteration decoding will destroy the card automatically.

Security depends on both master and slave keys so both must be managed with secure master.

Improve this answer
5
  • "supports Cipher coding to key card so that each card has a different code" sounds like marketing speak but doesn't say much. Is it safe against simple replay attacks (e.g. by using challenge-response-method with random challenges)?
    – Curd
    Sep 4, 2017 at 17:01
  • BTW: destruction of the card by too many wrong trials is very bad. That's an open door for very effective denial of service attacks. I would not trust my belongings to a lock whose key can be destroyed so easily.
    – Curd
    Sep 4, 2017 at 17:04
  • but duplicate keys are easy with secure master
    – Tony Stewart Sunnyskyguy EE75
    Sep 4, 2017 at 17:05
  • but do you have it with you? (at the swimming pool, at the hostel, etc.)
    – Curd
    Sep 4, 2017 at 17:07
  • Security of the key from damage or theft is not the same as dual key encryption and content security. The question here focused on cloning, which AFAIK is secure.
    – Tony Stewart Sunnyskyguy EE75
    Sep 4, 2017 at 17:12
0

At the $10 price point, it is nearly guaranteed that this lock can be defeated trivially. Cloning keys may well just be the tip of the iceberg.

The product description includes:

Card type: 125khz TK4100 or 13.56MHZ M1 Chip

This means EM4100 or Mifare Classic 1k formats.

For EM4100, a blue "Handheld RFID Writer" can be found right now on Amazon for less than 15 USD. It even comes with 5 each writeable fobs and cards. This cheap tool will likely duplicate the included keys in seconds.

For Mifare Classic 1k, a little more work and cost may be involved. White "10 frequency RFID" duplicators can be found on Amazon for 42 USD. If unique codes are used when programming the M1 cards, then it will take a little longer to crack (minutes with cheap hardware). If default codes are used, then the handheld device can duplicate a token in seconds.

Unless the proprietor reprograms the lock after each rental, the described scenario of a person returning later with a cloned key is entirely possible and inexpensive. The same tools described above can be found on AliExpress or other sites for even lower prices. More powerful tools like variants of the Proxmark 3 can be found for around 40 USD.

Since this lock uses a spring latch mechanism without a deadlatch, it can be slipped/loided. Power is exposed externally, potentially allowing spiking, shorting, glitching or other power attacks. The enclosure is not mechanically robust, allowing drilling, prying, pounding or other kinetic attacks. My security rating for this lock: poor.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy