RFID projects have been pretty prominent recently, ranging from projects here in Instructables, to our local Silicon Chip magazine in Australia publishing a RFID door lock project in their November issue. Even I recently purchased a RFID door lock on eBay for $15 to lock my garage (so my front neighbor could get tools if he wanted to). We have known that the cheaper RFID technologies were pretty insecure for a number of years. Researchers have demonstrated cloners of all varieties, but simple RFID tags are still being used for access control. Even my current employer uses them. A while ago, I was looking at Hack A Day, and I saw an amazing project that somebody had made. It was an RFID card with a keypad on it. For the next couple of days, I couldn't get the image of the card out of my mind; the project reminded me of how much I wanted to build a RFID spoofer myself. The original author didn't release source code for their project, but they left enough clues that I could follow.
So, in typical fashion, I built my own reader hardware so I could have a look at the data from a card, and created my own version of the Universal RFID key. The key I made works beautifully both on my garage door, as well as a number of other RFID readers I have tried! I have decided to publish this, as more people should be aware of the design flaws that are inherent in older RFID implementations, and to allow others to make their own universal key. Will this key let you into anybodies RFID protected office? Yes it will, assuming a couple of things are true 1) The have to be using 125kHz RFID tags that use the same encoding standard as I have designed this project for, and, 2) You have to have access to the number printed on the back of the tag - with that number, you can simply key it into the Universal RFID key, and it will emulate that tag. So there you go - I hope you enjoy making this project. - And remember, with great power comes great responsibility!
Step 1: How does RFID work? RFID, or Radio Frequency IDentification is the term used to describe a wide variety of standards that allow data stored within electronic 'tags' to be read by a reader without using wires. There are a number of standards, encoding formats, and frequencies in common use. I will describe the 125 kHz standard that is common for access control mechanisms. 125 kHz RFID tags are commonly encased in a business card sized piece of plastic, or a round disk. The tag consists of a coil of wire, connected to a microchip. When the tag is brought into close proximity to a reader, energy is coupled inductively from the reader to the microchip within the tag. The energy from the reader has dual use; firstly, it provides power to run the card, and secondly, it provides a communication medium for data to be transmitted. Once powered up, the tag modulates the bit pattern that is programmed into the tag using a signal that the reader can detect. The reader then reads this bit pattern, and passes it onto the door controller.
If the bit pattern matches one that is authorised, the door will be unlocked. If the bit pattern does not match an authorised one, then the door won't unlock. In the RFID system I was playing with, the bit pattern looked like this; I will describe what this pattern actually means in the next page. One interesting feature of the data transfer between the card and the reader, is that data is encoded using Manchester Encoding, which is a way of encoding data so that it can be transmitted over a single wire ensuring that the clock information is able to be recovered easily. With Manchester encoding, there is always a transition in the middle of a bit. If you want to transmit a 1, the transition would be from low to high, and if you want to transmit a 0, the transition would from from high to low. Because the transitions are in the middle of each bit, you can ensure that you have locked onto valid data. For a detailed description, have a look a this page. The actual data is transmitted by the card effectively shorting the coil out - this applies an additional load to the transmitter in the reader, which can be detected.
A keycard lock, commonly found on commercial buildings and hotel rooms A keycard lock is a lock operated by a keycard, a flat, rectangular plastic card with identical dimensions to that of a credit card or American and EU driver's license which stores a physical or digital signature which the door mechanism accepts before disengaging the lock. There are several common types of keycards in use, including the mechanical holecard, barcode, magnetic stripe, Wiegand wire embedded cards, smart card (embedded with a read/write electronic microchip), and RFID proximity cards. Keycards are frequently used in hotels as an alternative to mechanical keys. The first commercial use of key cards was at automated parking lots to raise and lower the gate where users paid a monthly fee. Keycard systems operate by physically moving detainers in the locking mechanism with the insertion of the card, by shining LEDs through a pattern of holes in the card and detecting the result, by swiping or inserting a mag stripe card, or in the case of RFID cards, merely being brought into close proximity to a sensor.
Keycards may also serve as ID cards. Many electronic access control locks use a Wiegand interface to connect the card swipe mechanism to the rest of the electronic entry system. Newer keycard systems use radio-frequency identification (RFID) technology such as the TLJ infinity. A mechanical keycard, with "bumps" that operate pins inside of the lock (similar to a pin tumbler lock) Mechanical keycard locks employ detainers which must be arranged in pre-selected positions by the key before the bolt will move. This was a mechanical type of lock operated by a plastic key card with a pattern of holes. There were 32 positions for possible hole locations, giving approximately 4.3 billion different keys. The key could easily be changed for each new guest by inserting a new key template in the lock that matched the new key. In the early 1980s, the key card lock was electrified with LEDs that detected the holes. A keycard with a magnetic stripe Main article: Magnetic stripe card
Magnetic stripe (sometimes "strip") based keycard locks function by running the magnetic stripe over a sensor that reads the contents of the stripe. The stripe's contents are compared to those either stored locally in the lock or those of a central system. Some centralized systems operate using hardwired connections to central controllers while others use various frequencies of radio waves to communicate with the central controllers. Some have the feature of a mechanical (traditional key) bypass in case of loss of power. RFID cards contain a small chip and induction loop which the transmitter on the keycard reader can access. The main advantages with RFID cards is that they do not need to be removed from the wallet or pass holder - as the keycard reader can usually read them from a few inches away. Computerized authentication systems, such as key cards, raise privacy concerns, since they enable computer surveillance of each entry. Currently RFID cards and key fobs are becoming more and more popular due to their ease of use.