It's known that card readers, which use the Wiegand format, can be attacked by installing a sniffer, such as an ESPKey. After the sniffer is installed, whenever anyone uses the reader, their credentials get saved, and the attacker can clone them.

What is the defense against this? The article mentions that card readers have a tamper sensor. Is a correctly installed tamper sensor enough to thwart this attack? What exactly does the tamper sensor do, and what happens when it's set off?

Also, since ESPKey attacks specifically target the interceptable wiegand protocol, is there some other protocol which provides secure communications? Many articles cite Wiegand as being the most common protocol. What percentage of card readers are vulnerable to this attack, and what's the next most common non-vulnerable protocol?


After doing some more research, as far as I could tell, this is how it works:

The tamper sensor is either a light sensor or a physical switch. If an attacker dismounts the reader from the wall, the sensor gets tripped and an alarm signal is sent down the wire to the controller. I have not researched what exactly the controller does with that alarm signal.

It seems like this sensor is not always installed by default. Example from HID manual:

All readers utilizing a physical tamper switch have tamper enabled automatically. By default, readers utilizing an optical switch do not come with tamper enabled.

The ESPkey manual states that the installation of such tamper sensors is "rare":

While rare, most modern readers have hardware support for a “tamper detection” feature of some kind. If such sensor is wired to the control panel for monitoring, it must be mitigated during ESPKey deployment to prevent detection of the field operator.


Wiegand by itself is insecure. Modern systems can use communication that is secure. For example OSDP or other (proprietary) communication protocols. These are able to prevent MITM attacks by enforcing TLS communication or some sort of key exchange between card reader and door controller.

The problem lies in the fact that companies need to invest in such products. Since they might have existing wiegand readers, they may choose to keep those even when replacing their access control system/software.

The tamper is also not always a solution since it needs to be configured and monitored correctly.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.