RFID Locks are way too easy to "Hack"! Let me show you!

Sign up to Morning Brew for free today: morningbrewdaily.com/greatscott
Free Altium Designer Trial: altium.com/yt/greatscott!
Previous video: • Negative Voltages are ...
Wireless Power videos: • How Does Wireless Char...
• DIY Wireless Energy Tr...
• How far can I Wireless...
• In Search for the BEST...
TheLockPickingLawyers shown video: • [1052] Bugging an RFID...
Facebook: / greatscottlab
Twitter: / greatscottlab
Instagram: / great.scott.lab
Support me for more videos: www.patreon.com/GreatScott?ty=h
In this video I will try to pick an RFID lock electrically. Will I succeed or fail? We will find out. Along the way we will learn tons about 125kHz RFID locking systems and how "secure" they are. Reading and writing to RFID tags will of course also be a part of that. So let's get started!
Thanks to Morning Brew for sponsoring this video.
0:00 RFID Door Locking System Overview
1:17 Intro
2:12 How I built the Locking System
4:03 RFID Theory
5:54 Amazon RFID Writer/Reader
6:46 Amp Mod (Increase Reading Distance)
8:40 Coil Mod (Increase Reading Distance)
10:41 Verdict

[@greatscottlab]

Thanks to Morning Brew for my daily news briefing - sign up for free here: morningbrewdaily.com/greatscott

[@unheardgr]

this is not the lock picking lawyer

[@niranjanganesan9858]

Video idea: Make a cellular signal amplifier

[@Chocoffee_battery]

How the heck he commented this 10 days ago when he only posted it just now?

[@lolslim690]

@@Chocoffee_battery I was thinking the same thing, maybe it was unlisted 10 days ago? idk

[@unheardgr]

@@Chocoffee_battery among us

[@thisnamewastakentoo_]

"this is not the lock picking lawyer"..... Mounts hinge on outside of door.

[@-indeed8285]

Ha ha ha 😂

[@zerog2000]

Thinking about hinge placement… Deviant Ollam

[@tozpeak]

Well, I've seen some good home doors with hinges outside. It just have a secret pin somewhere in the thick frame, so with cut hinges it is still locked in place.

[@thisnamewastakentoo_]

@@tozpeak Fair.

[@yung_megafone]

@@tozpeak the same way safes can have their hinges on the outside as well.

[@bigclivedotcom]

When I was building an RFID door lock for my mum when she developed Alzheimer's, the hardest bit was getting a good range. I ended up getting a huge (and resin potted!) reader unit and using it with the long range cards. (The keyfob circuit but with a wider coil in a plastic card.) I got a decent range from it. It also greatly improved the range of the common keyfobs too. There does seem to be quite a precise science to reading the keyfobs accurately. I did a lot of experimentation with adding wider coils too.

[@davebrooks3914]

Great minds think alike! That's why they follow Bigclive and Great Scott!

[@absalomdraconis]

I wonder if antenna design would be better at increasing range, or active noise cancelation.

[@bosstowndynamics5488]

@@absalomdraconis For all intents and purposes the coil is the antenna in these systems

[@TripThink]

@@absalomdraconis See Rodin Coil antennas

[@silverhammer8464]

That could work, but you might have more luck by agitating the rf signal. You can do that just by shaking the tag a little. I deal with uhf systems and even on these high powered systems I have to move the tag around or the reader in a paint brush pattern

[@sleeptyper]

As LPL has proven so many times, that "lock" can be defeated with just a strong magnet - provided that it contains a relay to operate external circuits..

[@greatscottlab]

Haha true ;-)

[@LeePorte]

@@greatscottlab Though what about with a solid state relay, surely that would mitigate that attack

[@JosephTomasone]

@@KahruSuomiPerkele I have a HID brand 125Khz stand-alone reader that uses a relay and can be opened with a magnet.

[@ShahZahid]

@@LeePorte they also need to be shielded, as such locks are also prone to EMF attacks

[@radekt.7843]

That's why when I made my own DIY smartlock, I used solid state relay

[@arty2k]

I got one of those readers...got about 45 reads off random people in just one day! In my own building I can now get to 14 additional floors. Honestly, rfid on elevator control might provide some security, but the stairwell doors have no security. This is an important lesson here, security is usually only theatre;a show.

[@SongSteel]

Could you explain how you would do such a thing? I'm looking into copying RFID tags as well, and progress is slow. How did you learn how to set up a reader, and where did you get your necessary supplies off the internet? Any advice is helpful. Thank you very much!

[@akshatsingh1974]

congratulations, you have unlocked new level with the device DLC

[@CapitaineBleuten]

But you’re talking only about uncrypted RFID right ?

[@mathsfornineyearolds]

Some at IBM asked me how I got into a secure room at their facility. I was in the building trade.

[@jbezzaplays]

@@CapitaineBleuten clone is a clone

[@klassichd10]

When my mother started to develop dementia, I added such a key fob to her wrist band, build such a reader using ESP8266 to command the electronic lock "Keymatic" to open the doors. So, she could continue to live in her home instead of a nursing home. That was really very helpful.

[@bigclivedotcom]

I did that too. A GPS tracker was also added to find her when she went on one of her long walks. It made life a lot easier for us all and took away a lot of the worry.

[@mmikhail123]

I hope you're also added GPS-tracker to second wrist band after that

[@CoolerQ]

I feel like the easiest way to "pick" that lock is to just pull the reader off the wall and short the appropriate pins to trigger the latch. That's why these systems usually use a separate controller - so there's nothing you can do to the external components to trigger the latch.

[@309electronics5]

It might have a button wich gets released when pulled from wall and trigger an alarm

[@nirodper]

This particular lock uses a relay, it's easier to just place a neodymium magnet on it and it will open

[@NZSpides]

Came here to make the same comment. Don’t get a product that has the relay inside the same housing as the reader. Also don’t use 125KHz technology, get MIFARE DESFire. Much more secure.

[@insolencePL]

No. The easiest way to pick that lock is using strong magnet to manipulate relay inside.

[@dozog]

@@nirodper Or modify the antenna coil to be an electromagnet instead... (since Scott is an electric engineer) 😉

[@RvNxBound]

Seems like a pretty topic. I’d like to see more „security research“ videos from you!

[@greatscottlab]

Noted!

[@sulochanakharat9033]

I am also waiting

[@sinpi314]

Lockpickinglawyer Electrical Engineer Edition.

[@btw111]

@@greatscottlab A good place to start with this research would be to look into a penetration testing tool called the Proxmark, and also one called an ESPkey. These combined with a long range reader (for reading at a distance of a couple feet/30-60cm) can be very powerful. Also check out some of the penetration testing videos on KZbin such as Deviant Ollam's channel, or his many talks. Good Luck!

[@RandomPerson-nz4kq]

I love how the Lockpickinglawyer has essentially become a meme on any lock-related video

[@matttzzz2]

Free advertisements for him

[@steven44799]

You can absolutely grab tags easily with off the shelf long range readers, adding a microcontroller with BT/wifi in line with the reader wiegand or rs485 data lines is also a good way to read/replay a code back to the controller.

[@ShahZahid]

but the long range ones are generally UHF around 900 mhz ish

[@Joel-gf4zl]

Only mentioning the show because it uses real tech as part of the scenes, but Mr. Robot had a good scene showing this being done with an off the shelf reader placed into a bag. Maybe not as long range as your referring to, but a good example of how it can be done and mirrors talks I've seen at hacking conferences. You can purchase a device like a chameleon off aliexpress to do cloning and other attacks as well with replaceable antennas and is nice and compact.

[@cuf_]

DONT LIKE THIS COMMENT HAS 69 LIKES

[@mrkv4k]

There are no off the shelf long-range readers for 125kHz, the best have about 1m range (in best conditions). On the other hand, coppying an EM41xx tag is really easy and can be done without any encoding. You can even use a very simple circuitry and a phone, because the data frequency is within audio range. Simple AM demodulation into mic input, record it in WAW and play it back - boom.

[@AlyssaNguyen]

I once worked at a place where access to the parking lot was controlled with a large RFID reader. I would stick my arm out the window with my card in hand and slow down to just the right speed for the card to be read and the gate to go up just barely in time. The terrified looks I got from some security guards were priceless. 😂

[@darylcheshire1618]

off topic but this reminded me of the deck-hand on a Sydney ferry, as the ferry was reversing from the wharf, the deckhand would just casually flick the rope loop off the bollard.

[@SongSteel]

@@darylcheshire1618 @AlyssaNguyen damn, seems like you two got quite comfortable with the ins and outs of your jobs

[@bitsofgeek]

Security is more a game of deterrence than anything else, and so you weigh everything from the value to bad actors to the (in)convenience for the valid users and find a solution that is sufficient for the scenario. I think the biggest takeaway should be “just because it has a computer in it doesn’t mean it’s automatically more secure than other options”, and that is something we would all do well to remember.

[@uraniumu242]

And sometimes the computer is what invites hackers to attempt to find exploits and vulnerabilities.

[@fabio-franco]

About 15 years ago, I was the developer of a production tracking system. At one point we started implementing controls of what leaves the production floor to be loaded into trucks. So we added an RFID tracking system. The system began printing RFID labels (yes, just like any other thin sticker) on our Zebra printers. If you think that product from Amazon is a lot, the reader we had installed on top of the exist door was over 3 meters high and could read the labels of all boxes in a pallet before they gotten directly under it. And they were passive and not active tags, as the cost of those would make the solution unviable. So you have an idea of what's possible. Now, If you want to maximize the range of your reader, I'd look on content for metal detector designs. Seeing how simplistic you design was if compared to the ones I saw for metal detectors, I know there is a lot of room to increase that range with some freely available designs. I am working towards building a metal detector and it is way more complicated than I was hoping for when I had this terrible idea. So it's going to take a while 😂. But I think you'd probably be able to adapt them in no time.

[@Elberto71]

Mount the reader on the inside of the door for more security, the tag can be read through the door if its thin enough and not metal lined. Plus nobody knows it's there 👍🏻

[@TheAzynder]

You would lose out on the code option though... but not the worst idea, it would require the reader to have atleast 5-6cm of reading distance.

[@Roboticlay]

Please continue! The Mythbusters were looking into this years ago and were discouraged from looking further. It would be very interesting to see what you could pull off!

[@malcolmdrake6137]

Well, if they can't blow it up, or drop it from a great height, they aren't exactly intelligent guys to come up with anything else.

[@Itsdirtnaptime]

I haven't been on KZbin as much as I use to, but I love the new intro. It is cool that you kept the premise the same. The artist did a very good job.

[@lasciencedelamusique6245]

You the best GreatScott! So quality content here! Thank you :)

[@giorgos8324]

Nice video! A good idea for future video is to explain how NFC works and differences with RFID. And of course why it is more secure.

[@amaanqureshi1286]

Never been so early! love your channel!, You have single handedly inspired my love for electronics for the past 4 years!

[@greatscottlab]

Glad to hear that :-)

[@michaelbyron1166]

This was a most excellent lesson. Very inspiring, it makes me want to learn more about this subject.

[@sirmiro2]

Fantastic timing! I want a system with RFID to see which lawn mower is going for a recharge. This larger reader in the lawn and then an arduino telling which station it should go to. =)

[@Banana_sa]

Great video and idea, I just wanted to add up by looking at the internal circuit of the lock ( 3:57 ) that this lock uses a regular relay (almost certain to trigger the lock to open) which makes me sure you can open it just by using a powerful magnet (say neodymium) on the side of the lock, which is a known venerability to most cheap and even some premium security systems.

[@GeezRvonFart]

So the magnet cause the relay to close, instead of the electro magnet inside the relay?

[@linuxguy1199]

9:45 You might want to consider using a smith chart, it will make it a lot easier to calculate the impedance matching networks.I do the same thing however in my work a capacitor is usually just a thicker PCB trace and an inductor a thinner PCB trace :)

[@mrkv4k]

Nah. Smith chart is pretty much useless for 125kHz matching, because it's just a very simple LC tank.

[@linuxguy1199]

​@@mrkv4k Smith charts will work at any frequency, his method works great too! And nothing is purely a simple LC tank, everything has parasitics. The parasitics in this case are fortunately (mostly) negligible. I just mentioned it because smith charts are fun!

[@mrkv4k]

@@linuxguy1199 Smith chart is not usefull for this, because it all works on one frequency.

[@mrkv4k]

@@linuxguy1199 It's not usefull, because it's more complicated than having simple 1/(L*w^2) formula in excel (which is what I do). They way how you'd calculate the capacitance on a smith chart would be 1. Calculate the inductor impedance. 2. Make a point on a smith chart 3. Make a straight line and measure new point. 5. Take the new value and convert it back into capacitance. All this is pretty useless, because the impedance of antenna coil for 125kHz systems is usually somewhere in 380i+30 range and you don't have to bother with the resistive part. Just compute what capacitance would have the -380i impedance (which is what you're doing with that formula). There is no advanced matching needed, because the frequency is low and the coil can be energized by one transistor fed by a square wave signal. Plus it's usually a serial resonant circuit. Smith charts are very usefull if you are computing antennas for 13.56MHz systems, but that's a different story.

[@linuxguy1199]

@@mrkv4k You're missing the point, It would be cool if he made a video using them! :P Also, smith charts can and are very commonly used for multiple frequencies (by tracing an impedence curve from your start to stop frequency, then doing each operation on two points of the curve). For simple stuff like this they aren't practical, they become far more practical when doing higher frequency stuff where the impedance matching is far more critical (RF filters, FET RF amplifiers, crystal detectors, crystal filters,, etc).

[@hippynurd]

Thanks for making this video, I watch the LPL video, and thought the exact same thing you did!

[@freshgino]

You can get commercial long distance RFID readers and reverse engineer how they work… they are used in tolling and parking entrances to read rfid tags on cars as they drive in

[@berndeckenfels]

The LPL hack with the magnet to the relay was more fun :) (I think a general good indication: if you connect the lock contacts to the outside device it’s not safe) BTW the „better“ RFID systems go a long way to document that they should not be used as access control :) Only rfid Chips with smart card function can do challenge/response and are (partially, think relay attacks) safe.

[@ShahZahid]

all the designers need to do is place a hall effect sensor near the realy, so that if you bring a magnet near it, it will just sound the alarm, but then again a seperate control units makes much more sense

[@ShahZahid]

Well GreatScott turned into Kevin Mitnick real quick

[@bvcdi]

In the schematic at 7:45, play with the other part of the circuit also. Yes raise the voltage but also play with the receiving circuit, like the forward loss on D2 and also with the capacitance of C3, and at the end if you filter the noise down by playing with this part you can rise the gain of the OpAmp.

[@hadibq]

that quite a motor on a fancy bench for winding :) Always good to watch your videos!

[@dappermuis5002]

To me this kind of lock would be used where you just want to keep unwanted walk ins out, but not for securing it for locking up and keeping your items safe from thieves. Kind of like a staff only area and you don't want to keep having to use an actual key to get in and out all the time.

[@TheAzynder]

Yeah, it's not bad for example coffee rooms for staff, it will keep stragglers out fine, and can probably use just a code instead of a tag. It's not too shabby for an apt building front door either, as you can get those open usually just by randomly buzzing people.

[@SierraGolfNiner]

Interesting stuff. Always wondered how easy it was to NFC at a distance. Realistically from a home security perspective this is no worse than most door locks. Average door? Easy to pick/rake/bump. A thief will probably just break something (like the window next to the door) instead.

[@andreasu.3546]

Once RFID door locks become popular, then it's probably not a far stretch to imagine read made hacking devices showing up on Aliexpress for a few dollars. We are basically at this point with car locks now.

[@ShahZahid]

@@andreasu.3546 with older cars that works, you cant use SDR based spoofing with newer cars, as the key is randomly generated by an algorithm

[@andreasu.3546]

@@ShahZahid Even rolling codes can be tricked, e.g. with RF repeaters that forward signals between the keyfob and the car, even if both are a significant distance apart.

[@ShahZahid]

@@andreasu.3546hmm intresting, but wouldn't you have to press a button on the keyfob to activate it, cuz it cant be pinging to the car all the time, that would absolutely kill the battery life

[@EvanAristyaYudha]

NFC =/= RFID. There's encryption method required. NFC tags carry an ic capable to solve specific key challenge that the reader gives out when it gets in range. Most would have write-once memory that the reader sets to 'pair' the tag the first time it is used. RFID at its simplest form like shown here just carries its own id. That's why it is usually only used to, well, identify things in warehouses.

[@stavrakistv]

A proxmark with some kind of amplification could work. It can also crack vulnerable Mifare classic, or loaded with custom firmware for other kinds of automation like saving keys in the onboard memory for later retrieval.

[@kirillvoloshin2065]

your videos must be shown in schools! they are so good and informative!

[@greatscottlab]

Glad you think so!

[@HammondOfTexas0]

There's a lot more to rfid systems than these simple readers use. This one only reads the serial number of the tag. A secure system would use read and write keys for the rfid tag, preventing anyone without the key from reading anything other than the SN, and those readers would be looking for the data stored on it, rather than the SN. You can easily clone a mifare classic serial number, but getting the secured data is far more difficult (not going to go into the ways to do so here). This video does a good job of showing you why you don't want to use one of these cheap readers though, not including the fact you can just pull it off and jump connections with a paperclip to open the lock.

[@johnsmith34]

This method is pretty similar to taking a picture of someone's keys, only the range is occluded by metal rather than opaque things. So, if you just store your RFID tags in an RFID blocking container, then you'll actually be about as secure as regular keys since the range should be similar.

[@davidmueller3650]

Normally you've got an encrypted rolling code. Something like mayfair desfire ev2. As an antenna you could maybe use a retail shop gate.

[@L3aRn2Th1nK]

3:31 From what I can see, your little power supply module has a "push button to activate" function via relay built-in to it and you confused that with the wires coming out of the bolt lock. In the PSU module, when energised, if you apply 12V to the "PUSH" terminal, it will trip the relay and the contacts COM/NC/NC will change accordingly. The bolt lock wiring has nothing to do with this function though. The manual shows that RED/BLACK are for 12/24V power source and the WHITE/YELLOW are for a "locked" contact for monitoring. Meaning if the bolt is out, you get a short (NC) between those two wires. When the bolt retracts you get an open circuit (NO). You would wire that to an input on the door controller so you can monitor if the lock is actually locked or if the bolt is stuck half-way out or something. In short, although the manual has many spelling mistakes, it showed the correct information regarding the four wires coming out of the lock.

[@ANANTHASANKAR_UA]

Long Range RFID system use UHF 433MHz & 928 MHz Transmitter along with sensitive receivers that can detect a fraction of change in the transmitted wave. If we increase the operating frequency of RFID system then the power required for transmission is decreased and improve the sensitivity also. Another way is modify the 125khz coil circuit with high speed switching transistor and adjust the gain of opamp at detector end with optimal level with pot...I think it works ✌️

[@OgbondSandvol]

It seems to me that the chip in each 125 kHz tag (close range) is precisely bounded to that frequency, isn't it?

[@ANANTHASANKAR_UA]

@@OgbondSandvol Yes It's Resonance frequency

[@SebastienLeclerc]

Nice job. It's a pleasure to watch your videos.

[@marcogenovesi8570]

Eh, since the control unit is basically just sending power to door latch to open the lock, it's easy to just smash it open and connect the wires that go to the door latch. So this is only barely better than a zip tie. Somewhat secure systems have an external panel with only the keypad and RFID plate, while the controller with the relays that control the door latches is internal. So even if you smash the external panel you can still just press the keypad buttons

[@TheAkaish]

Actually, sniffing works only for standards that do not use encryption or some standards, that use compromised security protocol such as Mifare Classic variants vulnerable for Nested and HardNested attacks. Sniffing is useless, for example, for Mifare Plus standard readers, that uses unique session key generation for encrypting data stream between reader and tag with AES-128. So, basically, sniffing would be efficient only for old RFID tag standards or for standards that not designed for to use in high security systems. Using outdated standards or standards that not designed for such purposes is only manufacturer fault. I assume, if you need secure something important with RFID locks, use only Mifare Plus or Mifare Ultralight-C reader variants and tags.

[@TheAkaish]

@@johndododoe1411 this is question of price, actually. Produce rate for Mifare Plus is millions for readers and billions for tags and they use optimized chip topology and provides great capabilities in security, actually it is used all over the world in banking applications. To launch a new simple tag you would have to invest starting from 200k$ only to produce lithography at outsource factory (and this is only starting prices). And also you need to pay engineers who would create tag topology for you. More logic on tag - price increases. Universal tags with strong security are really expensive to launch as a product and I suppose, best solution for RFID locks manufacturers is to use well known mass market non compromised standards, because this is a question of cost efficiency. Also, well designed products would not give a chance to bypass security system without vandalism. Usually, the only way to unlock the lock in good designed system is to physically get to open\close electrical lock pins, however, you can bring a little more efforts and instead of usage simple locks, you can add controller to lock and encrypt signal between lock and reader controller, so it wouldn't be enough to send simple open signal to lock pins.

[@ARE123CKI]

Amazing job, thanks for Your effort!

[@feynthefallen]

What you try there is one of the original flaws of RFID systems that has been known pretty much since the beginning. The communication between the reader and tag can be eavesdropped on from up to 20x the effective working distance for an actual tag - more with the right equipment. Since virtually all RFID tags are no more than passive memory devices, they are thoroughly unsuitable for any security critical application - as is all unencrypted wireless technology by the way. On the other hand, the important upside of digital keys of all sorts is that unlike in mechanical keys, each key is different and can be invalidated easily if lost. There are actually three solutions to this proplem: One, have a second factor like a pin that is needed to access the secure resource, or two, use cryptographic tags like DESFire instead of the cheapest option or three, use a secure-by-design reader that requires you to insert the key fob into an electromagnetically shielded slot to open

[@danirebollo]

You can get enough security with RFID. First you need to choose between failsafe and failsecure lock options, and second You need to read hidden data or request processing, not only read the tag designator.

[@CruzMonrreal]

Pretty sure you need something more than a larger coil to increase tbe distance. Think you need to increase the antenna's directionality gain (focusing the rf). Think pringles can or a yagi antenna

[@greatscottlab]

Thanks for the feedback. Definitely worth considering for the maybe follow up video✌️

[@dragosmihai9410]

There is no real RF in those tags, they work with eddy current and the chip inside just shorts the coil briefly to transmit data, only the UHF tags have real radio in them.

[@mohammedalameri4039]

Excellent video!! keep it up 👏

[@ChristieNel]

You had me glued to the screen with this. I'm working on an RFID product using Gen2 tags (~900MHz). I have read tags over 2m and I have a more powerful reader I haven't tried yet. I assumed that lock tags would perform some kind of encryption, or at least use a unique number that can't be easily copied. Gen2 tags include a permanent, unique identifier as far as I know. I'm shocked that those tags can just be copied and work.

[@ShahZahid]

yes this is exactly what i was thinking about as well, the long range rfid readers are mostly of UHF which is around 900mhz. the 125khz ones are just horrible in terms of protection, heck even the 13.5mhz ones have ton of exploits due to security flaws

[@desiv1170]

It really comes down to use case tho. If you are worried about "random bad guy" dropping by, then tag copying isn't really a concern. The "random bad guy" is unlikely to bother making sure they get close enough to you to copy the tag. I see you thought about that a bit, with your 30cm range requirement. But I still think that's not the random bad guy who is hanging around most neighborhoods. So you are right, yeah, RFID isn't the best if you are worried about a targeted attack. But I don't think that is the use case for these devices.

[@asmaulhabib6721]

Hi Scott, great video. I have got a question, How do you calculate the number of turns and AWG for the coils used as antenna?

[@akuuka666]

Your products are amazing and I really look up to you as an intellectual superior- I have a question which i was hoping you could answer please. Q) is it possible it increase the reception of the proxmark pro?

[@megadeth369]

You know whats crazy about these cheap units? There's a relay on the board, and if you use a magnet you can trigger it to open.

[@Skyper100MC]

Well this only works when the RFID system being used is static, most comercial rfid systems use a encryption scheme and have other solutions to this problem, this is only so if you set an id an a tag.

[@JonathanKimberley]

LF tags are ideal for implanting into pets as they are about the size of a grain of rice so don't cause irritation and the read range and security are not a problem. HF is still used, especially its NFC variant where security is more important and the slightly better read range is useful. In industry UHF is the most common standard now as it has a much better read range (even small hand held devices can read a few metres) and multiple tags can be read at once.

[@lolslim690]

The HID maxiprox 5375 rfid readers at garages can read up to 3 feet away (~90cm), That is obviously much farther than the 30cm goal you want, but the coil wrapped in there is roughly 30cm x 30cm

[@gakich.]

An RFID alarm in the market might help you with your project, since it need to keep a quite far distance and read the data in the tag, I'm sure there must be some kind of information of these theft-proof system!

[@BetaSeven]

Do the anti-theft systems use RFID? Here they all use the metal strips that are disabled with a magnet.

[@gakich.]

@@BetaSeven These kinds of anti-theft most come with high value electronics or small products，mostly a sticker with some wire(coil) in it.

[@TheSiriusEnigma]

Type 1 is unsafe. That’s the 125 KHz one. The type 2 is bi-directional and have updatable data in the chip. It’s the 2 MHz+ one. Implementation becomes the key factor.

[@cuf_]

Great video scott! Keep these videos coming!

[@greatscottlab]

Thanks! Will do!

[@chillydickie]

Look forward to the next video on this!

[@RazorSkinned86]

should have not been using unsecured 125khz and instead been using the more modern NFC standard that can use an encrypted key. I'm kinda surprised they still sell 125khz systems.

[@ShahZahid]

a lot of attendance systems still use those, a lot. its honestly baffling

[@greatscottlab]

There are tons of such 125kHz system out there.

[@liucyrus22]

Contractors probably know that they are unsafe. But it only has to be as secure as the useable needs.

[@blackkissi]

Remember that "S" in "RFID" stands for security

[@MrCh0o]

I mean, ID stands for "identification", not "authentification", so makes sense

[@chinesepopsongs00]

We used to make coils that where rectangular about 1meter x 1 meter in size and where build to be hidden in concrete floors to read tags in prison buildings. Not used for opening doors but for tracking people, so nobody could escape because rfid is indeed a bad idea for locking doors. We could read tags up to about 3 meters. The electronics for this was made in house as well. Had a sizeable amplifier for driving the coil i remember, can't remember what exactly we did to get the range it had something to do with waveforms and filtering.

[@avejst]

Great video as always Thanks for sharing 🙂

[@greatscottlab]

Thanks for watching!

[@steubens7]

hey neat, that RFID reader with the keypad is the one they used in better call saul as a jaguar key fob clone. they took the case off but left the keypad on the PCB

[@cursosdediferentesplatafor3031]

Excellent work. Cheers

[@mrkv4k]

As someone who has been designing RFID readers for the last 8 years, let me point some things: - The 125kHz systems (often called EMARINE) usually works on one of the EM41xx standards. It was developed decades ago, back when microchips were not that common. This standard, while widely used, is outdated, and shouldn’t be used for a security purposes. They are so widespread because they are extremely cheap. And they work great for some stuff, like if you have a lunch ordering system or a digital timeclock. You can get ISO datasheets with detailed descriptions of those cards and readers if you look up EM4000 or EM4002. - Readers which work with 125kHz frequency use near field because the wavelength is about 2.4km. Reader with the most range that I’ve seen, and which is commercially available, has about 1m range. The problem is in the fact that you have to power the tag from the antenna coil. Transmission of energy is not efficient at these low frequencies and antenna shape doesn't really help that much. It’s a good idea to make a simple circuit which measures the field strength. Just make a small coil (like the tag), connect a capacitor for 125kHz resonance, rectifier, divider and another capacitor. You can measure the output directly with a multimeter. - Making a long-range spoofer should be possible. Just make an 125kHz receiver and detect the signal from the reader itself. Since you don’t have to energize the tag (it’s already energized by the reader), you should be able to catch the communication. Using some digital filters to process the output, you should be able to get at least 10m range. The only downside is, that you can capture the communication only when the tag is being used, but that can be solved by leaving that device somewhere near the reader and recording tags as they come. - More secure standards usually use 13.56MHz frequency (f.e. your credit card) and they have a two-way communication between the reader and tag. Many standards support advanced encryption (look up Mifare Desfire or Legic).

[@SongSteel]

Hello! I'm also looking into the field of RFID technologies now, and wanted some advice. How would you identify what type of infrastructure your RFID system uses? More specifically, what is the cheapest way to scan/copy RFIDs, without investment into expensive technologies such as proxmark 3? Is it possible to copy/identify/read/write to RFID for cheaper? Also, I'm interested in the idea you brought up about "intercepting" the authentication key while the tag is being actively used. I've done a decent amount of research, but have not seen anyone brought this up yet. Is this all theoretical, or have you seen something similar being used in reality? Any advice helps. Thank you!

[@mrkv4k]

​@@SongSteel Well, the best way to identify type of RFID system is to get a multitag reader, which supports good ammount of both 125kHz and 13,56MHz tags. I use TWN4 from Austrian company elatec, but we buy them in bulk and price for end customer is probably higher. There are many options if you are willing to buy from China, but I can't really recommend anything as I don't have experience with them. The most basic way how to tell what kind of RFID system you have is to get an oscilloscope and connect one channel to a coil. You can then scan the communication between tags and reader. The most common 125kHz EM41xx tags can be coppied easily, all you need is a microcontroller and few components. Other tags are much harder to copy, especially if it uses some encryption (for example your debit/credid card). But again if you wanna try some cheap stuff, the best way is to look up experience with some chinese readers/writers. And to that last part, no, it's not just a theory. We've had an issue with one type of the long distance 125kHz readers, which is installed on a driveway of a warehouse. Sometimes, when the truck driver was leaving the warehouse, he unintentionally opened both gates with one card. After few hours of testing, I realized that the there was a specific place and if you put the RFID tag in that place, both readers could read it. They were 10m apart and their normal range is 1m. Second reader was picking up a signal boosted by the first reader. We had to change the software so it would ignore that second reading within few seconds.

[@raphaelsainte-claire4861]

I built one of these after seeing this idea on the Lockpicking Lawyers channel.

[@mamchristian]

Spannendes Video. War Thema meiner Diplomarbeit 2007 bei Braun...

[@Samuel-eu1ts]

I bought a proxmak3 rdv3 a while back to tinker with rfid, it's very clear that security in this domain isn't very widespread, there are some HF tags (like the mifare desfire ones) that are pretty good, but there is till a big lack of awareness on the consumer side

[@billschwanitz669]

This is really cool! I'd love to see how to set off those little puck restaurant thingies ;) I can't imagine its too hard given what you just did

[@theobaldkuehne]

So ein Teil baut man nicht wegen der Sicherheit, sondern wegen der Bequemlichkeit. ❤❤❤

[@Foga001]

Great intro, Scott!

[@john1182]

this is why at the pharmaceutical factory i worked security at for 15 years i insisted that all the card readers also require a pin (which only some doors had). after cloning a fewer people higher access rfid cards i showed them how easy it was to clone a card. I had to compromise as set up a anti pass back system to prevent the same card from entering a door twice with out scanning out.

[@bardenegri21]

Some of these will try to write to the fob before reading it, meaning you can't really use rewiteable tags. Of course you can get around this by using a more advanced transmitter than just a normal fob.

[@phantom3474]

Great topic 👍👍here is an idea of the next video. How about if you make a portable device to bruteforce the lock by sending random numbers combination

[@RustOnWheels]

In the early days of WiFi I used to design corporate WiFi networks and the first thing I need to do was check or set the access points output to 25mW because pda’s weren’t that powerful. People thought it was counterintuitive to place more individual AP’s in stead of one big antenna at 100mW at the center of a room. What they forgot was that it’s a half-duplex communication and just turning up the WiFi amp is like SHOUTING REALLY LOUD whilst putting fingers in your ears. Changing the op-amp in this video reminded me of this. And it reminded me of a time before lithium ion and that pda’s were a thing…

[@technowey]

A more secure approach is the unit to send an encrypted random code to the key, which then has to send back the correct corresponding code. Of course, the mechanical parts also have to be strong and secure.

[@ReneSchickbauer]

It should be possible to do a passive read from a distance when someone opens the door. With a proper directional antenna directed at the door lock, you could probably detect the communication between reader and tag and decode it.

[@allezvenga7617]

Thanks for your sharing

[@supremaunus7100]

Good thing you looked over the instryctions

[@soundpreacher]

Seven words into the video, you got a thumbs-up.

[@jovar7545]

The Intro is already legend!

[@CanadianBullFrog]

Very interesting intryctions.

[@JustPyroYT]

Great and interesting video as always 👍👍👍

[@HECKproductions]

alternatively bring a very strong magnet close to it sometimes they will directly pull the bolt open sometimes they will trip a solenoid that opens the bold sometimes they will crash the software which then resets and defaults to open

[@9SMTM6]

I just recently looked a bit into something somewhat related. The new Webauthn standard. You could likely create a lock with that via NFC, and that should be secure at least from the non-physucal standpoint. Webauthn uses stuff like "challenge response", where the "key" never leaves the Webauthn device, but instead you only prove its presence. The challenge is provided by the resource to be opened and contains both host information as well as stuff that's temporary (like the precise start time of the authentification), and IIRC should also be signed by the resource to be opened, to avoid people just faking that resource to get a valid key.

[@SongSteel]

That... is actually quite smart. This is essentially two-factor authentication, where you would need both the RFID tag in ADDITION to a physical code in order to gain access. An earlier comment had suggested something similar, and even with my experience with RFID mechanisms, I have never seen anything that functioned in this way. I hope Webauthn gets widely adopted, since it seems (at least theoretically) more secure than existing RFID infrastructures.

[@9SMTM6]

@@SongSteel yeah and they key can not be copied which was a design goal. Webauthn can also already contain 2FA, with some implementations (eg Yubikey Bio) validating the 2nd factor entirely on device, which means that 2nd factor is also a lot harder to steal. Though I don't believe that you can power a fingerprint reader like that with NFC (which is likely the reason that key doesn't have NFC). Webauthn is available in a few sites as 2nd Factor (but not very prevalent yet, Google, Microsoft, Github etc). In all fairness that Standard isn't making things easy for adopters, while it's open it's also complex and really has a mess of terms. Webauthn is actually the term mostly used in connection to websites, it's also referred to as FIDO2, and CTAP2. So yeah😅. But it ought to be very secure and I was a bit surprised nobody seems to use that with Physical Locks.

[@brandonlui]

That’s what HID and other commercial access control systems already uses with one time password verification.

[@9SMTM6]

@@brandonlui nope, just dug around a bit. HID offers its own brand of FIDO2 keys, but they're only used for websites. They also gave some kind of statement that may mean they're working on something like a lock, but I didn't want to spend that time understanding that corpo speach, clearly there are no products yet. One-Time-Passwords (OTP) are a separate technology. It's certainly more secure than just using a simple ID as a secret, but compared to what FIDO2 does it falls short in a decent number of ways. Relevant for the web, less so for these physical keys, it's a lot easier to brute force. But, and that is very relevant for physical locks too, it is also a lot easier to get your fingers on its secret compared to FIDO2. The secret for FIDO2 never leaves the "token" as they're called but is just identified in some other way, with OTP you need to transfer the key to the token from the device that you want to authenticate at, and on that way it could be intercepted. Also these tokens are often not secured in a way to avoid the secret being copied. FIDO2 also has these other advantages: Because none of the things you authenticate against need their own data on the FIDO2 device you can use ONE token to authenticate against UNLIMITED parties, whereas every party with OTP needs its own secret on such a token. FIDO2 also, as I said, can be its OWN multifactor authenticator, so in that way there's no way for your first factor to be stolen of (or by) the party you authenticate against. OTP is a cast improvement over the presented RFID "security", and I'd agree with the statement that that improvement is larger than that from OTP to FIDO2, but still FIDO2 has a large number of improvements over OTP that make it a lot more secure and also often convenient.

[@davidr1050]

Can you overwhelm an RFID lock by using a stun gun? IE: generating a high frequency random signal by sparking the gun near the reader? --- When trying to "break" security, you either try to get through in a normal way, or an alternate way. -- An alternate way in this case would be to cook the RFID read so everyone has to use the keypad and then note the numbers or dust the pad.

[@lol-xx9kn]

This just illustrates that when you make something wireless: encryption is even more necessary. Hell I remember back in the day with 900mhz cordless phones: I would be able to hear my neighbor's phone conversations unintentionally on my radio scanner. Back then cordless phones sent an entirely analog signal. No encryption at all.

[@genjitsu7448]

Your penmanship is extraordinary! Wow, I am not kidding I am jealous, this is how i wish my hand printing would look. But it is so hard to change the way you write as an adult, I have tried but it seems like it is really hard to make changes. Also the video was really great, very interesting and I also like to watch the lock picking lawyers videos as well! By the way, does anyone have experience with trying to change/improve your handwriting as an adult? Is there a reason that this is difficult and is it just me or for anyone/everyone?

[@edindelic4841]

You should try directing your magnetic field with half open pot cores. You can use femm for simulation.

[@MCsCreations]

Pretty interesting indeed! 😃 I would love to see a system you would approve! Stay safe and creative there! 🖖😊

[@scienceandtech7164]

Great work

[@StrsAmbrg]

There is particular way in designing the receiving signal coil, which is called "loop antenna." It can received much longer distance.

[@ibnewton8951]

Really enjoy your channel! 👍

[@greatscottlab]

I appreciate that!

[@nihal19961]

I LOVE THE NEW INTRO

[@Gallardo6669]

Gutes video, wie immer. Gruss aus California

[@Max78224]

As a simple more secure solutions there are also tags with a button on it you have to press in order to unlock the door

[@thejunkbox]

thank you bro

[@cokemillion]

Work had one of these installed but it wasn't a pin lock system, it was just a magnet. If you yanked the door open you could still get in if you forgot your badge that day.

[@tnt123skeleton9]

i need one of these

[@XxTWMLxX]

Skip cloning the tag with this kind of system. Just bring a magnet to bypass/trip the relay in the keypad. :)

[@JoeJ-8282]

Where did you get that LCR meter that you have there? I want one too!

[@TojTekSpeaks]

We need a part two of thiss