Contactless card-based access control systems were developed to better and more easily protect facilities from unauthorized visitors. Of course, then, the bad guys figured out how to capture and use card-based information to fool the system and let the unauthorized in by using skimming, eavesdropping or relay attacks. Skimming occurs when the attacker uses his reader to access information on the victim’s RFID token without consent. An eavesdropping attack occurs when an attacker can recover the data sent during a transaction between a legitimate reader and a token. A successful relay attack lets an attacker temporarily possess a “clone” of a token, thereby allowing him to gain the associated benefits. Using any of these relatively inexpensive methods will let an unauthorized person in.
Adding to the problem is that Wiegand, the industry standard over-the-air protocol commonly used to communicate credential data from a card to an electronic access reader, is no longer inherently secure due to its original obscure and non-standard nature. Today, no one would accept usernames and passwords being sent in the clear nor should they accept such vulnerable credential data. ID harvesting has become one of the most lucrative hacking activities. In these attacks, a credential's identifier is cloned, or captured, and is then retransmitted via a small electronic device
But, now, there is an even bigger problem. To get into Information Technology (IT) and critical infrastructure Operational Technology (OT) systems, hackers are looking for the easiest path in, leveraging many different physical assets, including those within the enterprise security system itself. They typically start with hardware which will give them access to specific computers. Then, those computers will give them access to the target's internal Internet.
Unfortunately, many security manufacturers and installers don’t seem to secure their own security equipment. For instance, IP wireless cameras and card readers in the access control system are favorite targets of hackers. Unsecured, they can become irresistible backdoors.
How to Protect the Card System from Hacking
Leading card and card reader manufacturers offer security options. The first is to provide a higher-security handshake, or code, between the card or tag and reader to help ensure that readers will only accept information from specially coded credentials. The integrator will never provide another organization with the same code. As a result, no other organization will have this reader/card combination. Only that single company's readers will be able to read their cards or tags and their readers will read no other organization's cards or tags.
The second major solution is Valid ID, an anti-tamper feature available with contactless smartcard readers, cards and tags. It adds an additional layer of authentication assurance to NXP’s MIFARE DESFire EV1 smartcard platform, operating independently, in addition to, and above the significant standard level of security of DESFire EV1. Valid ID lets a smartcard reader help verify that the sensitive access control data programmed to the card or tag is not counterfeit.
At manufacture, readers, cards and tags are programmed with this fraudulent data detection solution. The Valid ID algorithm cryptographically assists in ensuring the integrity of the sensitive access control data stored on the card or tag. With Valid ID, readers scan through the credential's access control data searching for data discrepancies, which may occur during the counterfeiting, tampering or hacking of the credential. If tampering is detected, the reader reports it promptly to the access controller, identifying the credential in question.
Don't Let Them Hack Your System
Hacking has become a threat far bigger than most think. Indeed, the biggest threat to national security these days comes from not from aircraft carriers or infantry divisions, but a computer with a simple Internet connection. The U.S. federal government suffered a staggering 61,000 cybersecurity breaches, that it knows of, last year alone. Protecting users from professional hackers is imperative.
Odds are that most groups not as large as the U.S. government or as big of target as a major corporation, an organization not of interest to a professional hacker. That should not give you rest. The majority of hackers are teenage boys in basements just trying to get into any system that they can. It's referred to as "opportunistic hacking." And, when they get in, they like to change code that will create mayhem. Providing anti-hack card-based access control systems eliminates one of the more popular opportunities that hackers like to leverage.
