The vulnerabilities in HID iClass cards are primarily due to their use of a static key.

A static key is a digital code that is used to authenticate the card and allow access to secure areas.

In the case of iClass cards, the static key is stored on the card itself and is not encrypted with an open source encryption but instead with a proprietary encryption using a rainbow table, this type of proprietary encryption can be found in many other security systems such as URMET FDI, ICT, Gallagher and much more.

Ethical hackers and crackers have warned the public for over a decade that using proprietary encryption ultimately gives ways for crackers to decrypt the keycards, it’s also referred to the security through obscurity.

This means that anyone with access to the card can easily copy the static key and use it to create a cloned keycard.

Another vulnerability in iClass cards and their readers is the TTL communication between the reader and the door controller, which doesn’t uses  RFID technology.

RFID stands for Radio Frequency Identification, and it’s a technology that uses radio waves to communicate between the card and the reader.

However, the communication between the reader and door controller (software management) is not secure, and the data transmitted can be intercepted by anyone with the right equipment, exposing the building facility code (site code).

This means that an attacker can easily intercept the data from an iClass card and use it to create a cloned keycard.

Again another vulnerability with HID Global BLE for multiple reader lines, including HID iClass SE and HID Signo…

The risks associated with keycard cloning are significant.

When an unauthorized individual gains access to a building or secure area, they could steal confidential information, cause damage, or harm occupants. Additionally, people who clone keycards are often keeping copies for potential clients looking to access the building facilities or to use parking illegally.

This is a common practice for many unlicensed service providers, who offer keycard cloning as part of their services.

These individuals are not vetted and may have ulterior motives, such as theft or vandalism.

People who choose to clone their keycards are also putting themselves and the entire building at risk.

By using an unlicensed service provider, they are allowing a stranger access to sensitive information and secure areas. Furthermore, the cloned keycard can be easily shared or sold to other individuals, increasing the likelihood of unauthorized access and security breaches.

The solution to the problem of keycard cloning is to transition to more secure access control systems.

HID Global has already released a new version of their iClass cards, called iClass SE then SEOS, which uses more advanced encryption and secure communication protocols.

This makes it much harder for attackers to intercept data and clone keycards but not impossible thus right now the entire iClass credentials can be cloned…