How secure are Swipe Cards

by John_Magee

Swipe cards or RFID Cards are used for all aspects of security. Should we really be trusting them? Are there other security issues we should be aware of?

Swipe cards or RFID are used by most larger firms for security. I am not just talking about opening doors. They can be used for data security and storage, computer terminals and accessing the most sensitive materials.
Should we really be relying on swipe cards for security. What makes them so great?
Inside a swipe card is a small computer chip and an antennae. They have no batteries. The power needed to run the chip is very small only 1 volt is needed to operate the chip. The antennae is actually an induction coil. The number of windings and length of the antennae are finely tuned to receive a signal at a set frequency. Many transponders work at 125khz. It is the signal that powers the chip and also sends information to the chip. The chip responds and sends back data through the coil. As the chip receives and responds it is called a transponder.

Swipe card and lock

RFID Card reader
RFID Card reader

Not all swipe cards are the same

The type of chip used in swipe card determines what type of information is required for access.  Transponder chips have progressively been getting more sophisticated over the years.  Early chips had a fixed code that was read and matched to saved data for comparison.  Swipe cards with a fixed code had 2 problems.  The first is the card was easy to read and duplicate.  The second being that the data was retrievable from the card reader or security system.

Most swipe cards now use challenge /response codes.  With a challenge response system the card is sent a number or set of numbers and must give the correct answer to be acknowledged as the correct card. Eg the numbers 7 and 3 might be sent and the correct response is 21 (7*3)  The equation is unknown to everyone except the card and the reader.  The equation and the numbers are much more complicated then this example and there are trillions of possible combinations.  The cards also can store information such as a biometric scan or other data.

RFID card duplication

So are the challenge/response swipe cards safe to use?

Challenge /Response codes are much harder to copy then fixed codes.  The problem is once they are decrypted and the equation known the whole system is compromised.

Over the years most swipe cards have been cracked, making them vulnerable to attacks.  The most widely used swipe cards today are the Mifare system.  Mifare has been cracked and it has left most government and corporate buildings vulnerable.  Swipe cards can be easier to copy then a key.  With a key you have to physically copy it.  Swipe cards can be copied from a distance.  If you have a transponder copier you just need to walk close by a person with a swipe card in order to read the data on the card.  If can then be copied onto a new card.

There are newer swipe card systems on the market that offer higher security.  The problem is that the hackers who decrypt these systems are very good at what they do.  A fixed system is vulnerable as once it is cracked once, it can be repeated over and over.  Most systems now rely on obscurity to hide the codes.  If you hide the mechanics of the system it is much harder to crack.

Transponder Copier

Super AD900 Pro Key Programmer 4D Function Added!!

AD900 key programmer.It can read out and has detail explanation for such transponders as: 11,12,13,T5,33,40,41,42,44,45,4C.AD900 key programmer can program the eeprom of ecu and...

View on Amazon

What are we really securing?

The other consideration with swipe card systems is the physical security aspect.  What is the swipe card system attached to?

Most electronic security systems activate an electric strike.  The electric strike is fitted on the door frame and the latch of the mechanical lock closes into the strike hole.  When the electric strike is released the latch pushes past the opening in the strike.  Electric strikes are use because they can operate with existing locks and they are relatively cheap.

Electric strikes have some major drawbacks when it comes to physical security.  I do not want to point out their vulnerabilities for security reasons.

Personally I would not secure my property with an electric strike.  They are far too easy to compromise.  Most buildings are secured this way including our most high security government buildings. 

Kaba Simplex 8511221BLL2 LearnLok 850L System Solitaire Mortise Lock (Left Hand)

The Solitaire 850 easily replaces existing mortise door locks Kaba encrypted user and maintenance keycards encoded on-site Sophisticated access control with three security level...

View on Amazon

Access Control 1.8mm thick proximity cards pack of 5

Access Control 1.8mm thick proximity cards pack of 5 NEW IN BOX DESCRIPTION: Proximity cards (or access cards) are hybrid technology that incorporate a simple electric circuit (...

View on Amazon

2 Ch Electromagnetic Lock 300lb with Wireless Remote Kit

2 Ch Electromagnetic Lock 300lb with Wireless Remote Kit NEW IN BOX This is a complete kit that will allow the customer to control access to certain doors. This kit is commonly ...

View on Amazon

SECO-LARM - E941SA300 - Electromagnetic lock, 300 lbs. holding force weatherproof

Keep door secure with an electromagnetic lock. Prevent unauthorized visitors from gaining entry to your home or business. The 300-Pound Electromagnetic Lock mounts to your point...

View on Amazon

Electronic Locks

A better alternative to an electronic strike is an electronic lock.  There are a range of electronic locks, unfortunately most of them are absolute junk that is not a viable option to secure a door.  There are however a few high quality electronic locks that are reliable and difficult to compromise. 

Magnetic locks are another good alternative to secure doors.  Magnetic locks need to have power going to them at all times which is a drawback.  Their power consumption is very low and they can be run with a battery backup. The holding force of magnetic locks does vary greatly.  Magnetic locks should be fitted in a way that bending of the door id kept to a minimum.

All in all swipe cards give a lot in convenience and management.  Security of a system should not be taken for granted and a locksmith who as no financial interest in the installation of the system called to check for flaws.

Updated: 03/13/2013, John_Magee
Thank you! Would you like to post a comment now?

Swipe Card Comments

Only logged-in users are allowed to comment. Login
John_Magee on 03/16/2013

It is a really simple process to copy the cards, even brushing past someone in the street they can be scanned. Pretty scary from a security perspective.

Harrold on 03/15/2013

I had no idea cards could be coppied so easily. Never really thought about it though. Thank you for the info.

You might also like

The Engineering Mastery of the Wright Brothers

Most people recognize that the Wright brothers mastered powered flight, but f...

The Engineering Mastery of Isambard Brunel

Burnel changed civil and mechanical engineering by thinking big. But it wasn'...

Disclosure: This page generates income for authors based on affiliate relationships with our partners, including Amazon, Google and others.
Loading ...