Wake up, it’s not the 90’s…You’ve long since axed your MP3 player, car phone and any other technology product made in the 90’s, so why would you use Proximity cards?
There are now innovative solutions that allow you to keep your legacy physical access control system in place and reduce the need to issue and use prox cards. You can eventually reduce your dependence on prox cards and transition at your own pace. Sentry Interactive’s readerless mobile credential software sits within legacy systems to provide the option of secure NFC mobile access. Reader hardware is unnecessary for upgrades, when a wireless Smart Access Tile can simply be applied next to the door, to provide NFC mobile access. The existing prox reader can remain in place if you wish, however Sentry doesn’t require the reader for their mobile access to function. The user’s smartphone becomes the reader and credential that connects with secure cloud services to offer the options of in-app, remote widget, or NFC tap to unlock a door.
A bit of prox history
Prox readers and cards became a cornerstone of modern access control systems and gained widespread popularity in the 1990s. Utilizing radio frequency identification (RFID) technology, cards grant access when placed near a compatible reader. Readers and cards operate at a low frequency of 125kHz.
Proximity technology is a crucial component in physical security systems. However, these systems come with several exposed security vulnerabilities that can compromise the safety of facilities and organizations. So, if you are an organization or institution using a prox system, listen up, the security vulnerabilities of your system might shock you.
Key security vulnerabilities of proximity access cards
Lost or stolen cards
If a proximity card is lost or stolen, unauthorized individuals can easily use it to gain access, as there is no inherent user verification beyond possession of the card. Experts in cybersecurity, SentinelOne, mention that according to a report “over 62% of breaches are caused by stolen or brute-forced credentials”.
Cloning
The lack of encryption in 125kHz proximity cards makes them highly susceptible to cloning. A card copying device can easily extract essential information such as the site code and card number, transferring it to a blank card.
Today, cloning equipment is widely available. For example, handheld RFID writers like the Flipper Zero can be purchased for under $200 and used to duplicate prox credentials. Additionally, key copying kiosks offer convenient but dangerous access to duplication services.
Eavesdropping and Sniffing attacks
Malicious actors can intercept signals from prox cards to extract sensitive information. This interception compromises the security of the access control system and exposes facilities to unauthorized access.
Limited authentication capabilities
Proximity cards lack robust authentication mechanisms. They rely solely on static identifiers, making them vulnerable to replay attacks where a copied signal can be reused for access.
Downgrade attacks
A company might upgrade to a more secure reader solution such as a multi format reader to accommodate smart cards or even mobile credentials. However, if they never turn off the capability to read prox, cyber attackers can exploit the outdated format and protocols that continue to carry the vulnerabilities associated with prox. An example of how backwards compatibility in new hardware can become a serious liability.
Widespread prox technology still in use
According to Luke Bencie, Managing Director of Security Management International, more than 80% of proximity card access control systems have easily exploitable vulnerabilities that can be taken advantage of to bypass their security.
Despite these vulnerabilities, the scary part is that prox systems are still widely used in many organizations and institutions across the globe. HID states in their ‘The 2024 State of Physical Access Trend Report’, that surveyed a sample of end-users and channel partners, that 33+% of access control systems still support 125 kHz low frequency proximity.
The persistence of this outdated technology poses significant risks, especially today where the internet offers easily accessible tutorials and devices for cloning cards. The risks associated with these systems have never been higher.
Recommendations
Sentry Interactive’s readerless mobile credential software sits within legacy prox systems to provide the option of secure NFC mobile access. No new reader hardware is necessary to upgrade, a wireless Smart Access Tile can simply be applied next to the door and existing prox reader to provide the option of NFC mobile access. The user’s smartphone becomes the reader and credential that connects with secure cloud services to provide fast and secure entry.
By using the smartphone as the active NFC reader and credential, vulnerabilities arising from failed firmware updates and downgrade attacks on reader hardware are avoided. The software on the smartphones is constantly being updated to the latest cybersecurity measures and when paired with cloud services that are encrypted at rest, it quickly becomes the most secure mobile access solution out there.For organizations that still require physical IDs, this is not a problem. Simply issue physical ID badges without access capabilities, deactivate access ID passes or use in-app digital IDs within your building or workplace management application.
Conclusion
The security vulnerabilities of 125kHz proximity systems today highlight the need for organizations to rethink their access control strategies. Why use anything other than mobile credentials for access control that are encrypted at rest and biometrically secured for use only by the assigned user.
It doesn’t have to be an expensive and timely process to migrate to mobile, by adopting Sentry Interactive’s readerless mobile credential software for your legacy PACS you can significantly reduce your costs when upgrading to mobile access, from both a reader purchasing and installation perspective. You’ll also benefit from reduced ongoing costs of physical credential provisioning and deployment while avoiding disruption to infrastructure or high costs of new hardware. Facilities can significantly enhance their security and protect against unauthorized access from eavesdropping, sniffing, reply or downgrade attacks as well as the more common security risks that stem from lost, stolen or cloned cards.
If you’re an access control OEM with prox customers that would upgrade to mobile access if complexity and cost wasn’t prohibitive, get in touch, we want to hear from you.
We have an SDK for your customers and your platform.
