Anyone here skilled with physical access controls, prox cards, etc?

[viper]

I will try not to be windy but I am being tasked with updating a commercial building access control system.  To be honest, I understand about 75% of this stuff, but that other 25% is a tough mental climb.  For some less aware, a card reader near a door is presented with some type (several variants) of prox card.  The card has a wire loop and chip that is energized by the card reader, and a code is streamed from card to reader, which is then communicated to a main controller that makes the decision to make or break a power loop to the door holding device. 

The main reasons for the upgrade is the old system is using 20y tech with weigand prox cards, and missing several features we need.  The company is also out of business, have no documents, backups, etc.  The very primary reason for change is we need the 'combo' readers that accept a pin code as well as card. 

Anyway, I first thought this was run with software off a PC, but as I examine, it looks like a bit of software is in the controller and a PC simply remotes to it via ethernet cable to make changes. 

I am finding these systems to be insane expensive and the hardware side itself is fine, but I might be stuck with a total replacement just due to the software side. 

My goal was to make the system modern where we could access the system if needed on a phone.  I was really hoping to run the hardware side via software that we would maintain with an on-prem server, but this does not seem common in industry.  Some of these cloud based companies want $200/per reader/year in fees! 

I am trying to find economical solutions. 

But I don't have a full grasp on all of this yet.  I still do not understand how cards are "programmed".  I cannot find much info on this part other than people hacking them with Arduinos.  Seems there are other protocols like "mifare" that use a layer of encryption.  I'm honestly not as worried about insane hackers at the place, as much as being able to deny certain card access and get a better log of access attempts and such. 

If anyone has a better grasp than me on this, I could sure use the help!  Thank you! 

[Someone]

I am finding these systems to be insane expensive and the hardware side itself is fine, but I might be stuck with a total replacement just due to the software side.

Fairly normal situation.

I still do not understand how cards are "programmed".

Generally cards are not programmed by the user/operator/admin, you purchase pre-programmed cards and "add" them to the list of locally authorised cards.

[viper]

I am finding these systems to be insane expensive and the hardware side itself is fine, but I might be stuck with a total replacement just due to the software side.

Fairly normal situation.

I still do not understand how cards are "programmed".

Generally cards are not programmed by the user/operator/admin, you purchase pre-programmed cards and "add" them to the list of locally authorised cards.

Appreciate reply.  Yes, we were evaluating many DIY, self program type deals, and some lower cost systems.  Mainly because they will quickly change hands, dealer will dump the gear, etc.  Just trying to plan for future. 

As for cards, 100% learned what you typed today!  I was trying to understand this!  Actually have a card "reader" in the facility, but of course no docs on how to use it just yet.  But I realize that is just to read existing card codes and my goal is to burn every card in existence and start over as a temporary restart, so I can at least set the scheduling and door accesses for each card. 

[darkspr1te]

I used to do this for a business and yes, very expensive when turnstyles , security doors etc are involved. 
Currently i have done very cheap diy solution using fingerprint/NFC readers that use various outputs  e.g weigand , relay, 12v signal out, ethernet signal out. In most cases I use realand bio based products as the system allows function without pc side running 24/7 , example i can program front door to allow a card, second door to allow but third door denied and they will function like that stand alone until pc software updates/changes it.
a word of caution though, realand bio sell two differing products that have the same functions but the backend software is different. One type is aimed at access control and the other is time and attendance and the backend will only connect to one type depending of which backend see the unit. the two are names RIMS and RAMS , am just guessing that the AMS part is Attendance management system . the way the backend displays the data is different too as it's aimed at employee time control,
Anyway i digress,
I have seen people swap out the old card only for these units as the higher end ones use the same 24 ac and weigand outputs as the older card old systems.
I just checked my staff gate unit which is TA unit and it has all the access control options you could need, like exit only, timed lockouts , zone control, fire control, hilack control , anti passback , 2nd lock and 2nd input control , timed passthrough for dual doors (banks for example)

There are other budget system with the same features from ZKTeko & fingertech , however i dont know about software, I doo see both sell a backend system where as realandbio came with a functional one.


hope this helps.

darkspr1te

[Ian.M]

I am finding these systems to be insane expensive and the hardware side itself is fine, but I might be stuck with a total replacement just due to the software side.

Fairly normal situation.

Get this wrong and any hacker will be able to walk through your 'secured' doors, in many cases as fast as a legitimate user can present their token.  You pay big money to the professionals so it isn't your neck on the line when the facility is breached, and so your company has someone to sue!

There are lots of videos out there of physical access control system bypasses, some of which are as simple as squirting the gas from a can of air duster through a crack round the door to trigger a exit proximity sensor and unlock the door!   Others bypass card readers and keypads, or even crack the security encoding to generate an endless supply of master keycards . . .

[SteveThackery]

Get this wrong and any hacker will be able to walk through your 'secured' doors, in many cases as fast as a legitimate user can present their token.  You pay big money to the professionals so it isn't your neck on the line when the facility is breached, and so your company has someone to sue!

There are lots of videos out there of physical access control system bypasses, some of which are as simple as squirting the gas from a can of air duster through a crack round the door to trigger a exit proximity sensor and unlock the door!   Others bypass card readers and keypads, or even crack the security encoding to generate an endless supply of master keycards . . .

Search YT for "pen testing". "Pen" being short for penetration, not fountain pens. 

[Zipdox]

I'm no expert, but here's what I know on the subject.
There are several aspects to the security of such a system:

• Physical security (e.g. can the reader be bypassed with a maget)
• Card security (e.g. can it be read/cloned by a third party, brute forced, or forged)
• System architecture/security (are card readers independent, or is there a central control system)

Many old systems used the insecure MIFARE classic cards, which could be brute forced and cloned. Some of them even relied on just the serial number of the card, which could be reprogrammed with certain card types. More modern systems use cards with integrated cryptography functionality to protect against unauthorized reading and cloning. You should look for these.

[digger]

have a look at unifi's door access stuff
https://ui.com/door-access

doesn't seem expensive, so maybe try some of it and see if it fits your use case? not a huge investment if it doesn't work out.
idk how many doors you have to do though. maybe it would get real expensive to do a huge building.

[PGPG]

The very primary reason for change is we need the 'combo' readers that accept a pin code as well as card. 

So you need higher security (dual person identification - card + PIN).

like a bit of software is in the controller

Access control standards require system continues to work even when communication with server is interrupted.
Many access systems don't get their dedicated Ethernet connection that can't be interrupted by other communication. Imagine what will happen if attacker even not being able to take over access system communication will be able to load Ethernet enough to stop access working. In many ceses peoples first reaction to be able to move around the company will be to temporarily open all doors what may be what attacker wants.

I still do not understand how cards are "programmed".

I don't know details (it is done by my brother) but generally having empty card you are allowed to program into it a master key allowing you to add 'applications' to card. Than each application can be added with its own key needed to log to it. You need not to know the master key to log into your application, but you need it if you want to add new application to card. For example if you want to add your access system application into city card then someone who made these cards (and has the master key) have to add your application with your key.
If you need to use cards only in your system then you program into it only one application.

Seems there are other protocols like "mifare" that use a layer of encryption.

From my point of view there are two standards: 125kHz (Unique) and 13.56MHz (mifare), but what is popular can depend on country. I remember I have read something about TI 132kHz standard.
At 125kHz there were cards with ASK, FSK and PSK modulations (Unique uses ASK). Modulation is one subject, the protocol is the other.
Unique cards are not programmed and if powered just continuously send 64 bit data in which there are some synchronization bits (I think 9), and some parity control bits (1 in each 5, I think) so the true unique number is may be 44 bits (I'm just not sure).

There are mifare Classic cards. In the Ferguson and Schneier "Practical Cryptography" book written in 2003 I have read that authors are sure Classic cards will be broken and they say it only because Classic algorithm is secret and civilian cryptography does not know the case of a secret but good algorithm. Because of this we decided to not use these cards in our system few years before they were broken.
We use mifare DesFire and mifare Plus cards both giving comparable security level (they use public algorithms).

Generally cards are not programmed by the user/operator/admin, you purchase pre-programmed cards and "add" them to the list of locally authorised cards.

Many customers still choose this solution as the cheapest.
But nowadays for few $ you can buy a reader/programmer and 10 empty cards allowing you to copy any such pre-programmed card if you have it for few seconds in your hand or if you know its number. There probably are suitcase readers being able to read card number from 1m distance (so without needing to take it out of someone's pocket).
So such solution can be assumed being organization of people's movement around the facility but certainly not the true access control.

Actually have a card "reader" in the facility, but of course no docs on how to use it just yet.

First question - interface?
If it is Wiegand than it should be easy to read it.
If it is RS485 then there are the whole spectrum of possibilities from an openly transmitted card number to sending the contents of a file from the card in an encrypted session (established between the reader and the card), which the reader sends to the controller in an encrypted session established between the controller and the reader, and only then the controller decrypts the data from this file from the card. In this way, the most important keys are never (even in RAM) in system elements (readers) located outside the protected area.

[viper]

Wow!  Some great responses.  Some that I am still reading, but I wanted to plug in a quick reply. 

1.  When I say "need to use a pin", I mean ONLY a pin, meaning either/or a pin or a card.  The reason is we have people locking themselves out by leaving a card somewhere. 
2.  While we could use better, encrypted type card reading for better security, our fight is not with hackers, it is with crack heads and homeless!  Kid you not, the criminal mind will scale the fence before trying to 'hack' a card reader. 
3.  This place has like 5 buildings with some areas being rented so the card are for renters.  This means no one else is there.  No one is currently running a business there. 
4.  After doing some work and realizing the more urgent need to make a change, as a temporary I plan to gather some new wiegand cards and delete all the others and start over just so I can document who has what card and get a handle on this!  Simply amazing how screwed up this all is. 

[viper]

[/quote]
First question - interface?
If it is Wiegand than it should be easy to read it.
If it is RS485 then there are the whole spectrum of possibilities from an openly transmitted card number to sending the contents of a file from the card in an encrypted session (established between the reader and the card), which the reader sends to the controller in an encrypted session established between the controller and the reader, and only then the controller decrypts the data from this file from the card. In this way, the most important keys are never (even in RAM) in system elements (readers) located outside the protected area.
[/quote]

So I made progress yesterday and found the control system manual via PDF on the main computer.  Yes, appeared there is a connected "desktop reader" connected to the PC right now.  As for RS485 or not, I cannot yet confirm but probably.  two ports on the back which appear to go to the controller, then USB cable on the front connecting to the PC. 

The manual only briefly covers this device as an accessory but guides to refer to the manual for the reader...lol  Of course I cannot find that online anywhere.  It would be nice to solve this riddle, but it would seem just getting all new cards would eliminate the need for this at present.  Still a good learning exercise I think. Looking around online right now. 

[PGPG]

The reason is we have people locking themselves out by leaving a card somewhere. 

Someone is using his card for 2 years and then when it happens to leave a card somewhere then - how long PIN you think he will remember provided it is not 1234...
The shorter PIN the more people then the higher chance for random number to be someones PIN and open the door.