Scramblepad Teardown Reveals Complicated, Expensive Innards

November 18, 2022 by Donald Papp 28 Comments

What’s a Scramblepad? It’s a type of number pad in which the numbers aren’t in fixed locations, and can only be seen from a narrow viewing angle. Every time the pad is activated, the buttons have different numbers. That way, a constant numerical code isn’t telegraphed by either button wear, or finger positions when punching it in. [Glen Akins] got his hands on one last year and figured out how to interface to it, and shared loads of nice photos and details about just how complicated this device was on the inside.

Just one of the many layers inside the Scramblepad.

Patented in 1982 and used for access control, a Scramblepad aimed to avoid the risk of someone inferring a code by watching a user punch it in, while also preventing information leakage via wear and tear on the keys themselves. They were designed to solve some specific issues, but as [Glen] points out, there are many good reasons they aren’t used today. Not only is their accessibility poor (they only worked at a certain height and viewing angle, and aren’t accessible to sight-impaired folks) but on top of that they are complex, expensive, and not vandal-proof.

[Glen]’s Scramblepad might be obsolete, but with its black build, sharp lines, and red LED 7-segment displays it has an undeniable style. It also includes an RFID reader, allowing it to act as a kind of two-factor access control.

On the inside, the reader is a hefty piece of hardware with multiple layers of PCBs and antennas. Despite all the electronics crammed into the Scramblepad, all by itself it doesn’t do much. A central controller is what actually controls door access, and the pad communicates to this board via an unencrypted, proprietary protocol. [Glen] went through the work of decoding this, and designed a simplified board that he plans to use for his own door access controller.

In the meantime, it’s a great peek inside a neat piece of hardware. You can see [Glen]’s Scramblepad in action in the short video embedded below.

Continue reading “Scramblepad Teardown Reveals Complicated, Expensive Innards” →

RFID Sticker On Bike Helmet Grants Garage Access

November 13, 2022 by Donald Papp 11 Comments

[Glen] might describe his project of opening his garage door by way of an RFID sticker on his bike helmet as simple, but some of the interfacing he needed to do was quite complex. He walks through the project from beginning to end, and there’s plenty to learn from.

When designing an RFID access control system, one has to decide what kind of reader and what kind of tags one wishes to use. They all function more or less the same way, but there are a lot of practical considerations to take into account such as cost, range, ease of use, and security options. After a lot of research, [Glen] decided on inexpensive sticker-style tags and a compatible reader supporting credentials with an ISO14443 UID that could be suitably mounted on a building’s exterior.

The actual opening of the door was the simple part, done by interfacing to a spare remote.

Breakout boards with ready-to-use code libraries exist for some RFID readers, but that wasn’t the case for the reader [Glen] had. He ended up rolling his own code to handle communication with the reader, with a Microchip PIC18F45K50 doing all the work of reading tags and performing access control. His code is on the project’s GitHub repository, and if you also find yourself needing to interface to a reader that uses the Wiegand protocol, you might want to give it a look.

Controlling the actual garage door was the easy part. All that took was soldering two wires across the switch contacts of a spare garage door opener remote, and using a relay to close the contacts. Simple and effective. You can see it in action in the short video, embedded below the break.

Overhead door access control might be a simple concept, but it comes in all shapes and sizes when enterprising hackers start looking for solutions. We’ve seen garage doors given the DIY IoT treatment, and even seen access controlled by a car’s headlamp flashes, which actually turned out to be more secure than it sounds.

Continue reading “RFID Sticker On Bike Helmet Grants Garage Access” →

Front Door Keys Hidden In Plain Sight

October 18, 2022 by Bryan Cockfield 27 Comments

If there’s one thing about managing a bunch of keys, whether they’re for RSA, SSH, or a car, it’s that large amounts of them can be a hassle. In fact, anything that makes life even a little bit simpler is a concept we often see projects built on to of, and keys are no different. This project, for example, eliminates the need to consciously carry a house key around by hiding it in a piece of jewelry.

This project sprang from [Maxime]’s previous project, which allowed the front door to be unlocked with a smartphone or tablet. This isn’t much better than carrying a key, since the valuable piece of electronics must be toted along in place of one. Instead, this build eschews the smartphone for a ring which can be worn and used to unlock the door with the wave of a hand. The ring contains an RFID which is read by an antenna that’s monitored by a Wemos D1 Mini. When it sees the ring, a set of servos unlocks the door.

The entire device is mounted on the front of the door about where a peephole would normally be, with the mechanical actuators on the inside. It seems just as secure (if not more so) than carrying around a metal key, and we also appreciate the aesthetic of circuit boards shown off in this way, rather than hidden inside an enclosure. It’s an interesting build that reminds us of some other unique ways of unlocking a door.

Continue reading “Front Door Keys Hidden In Plain Sight” →

Your Building’s RFID Access Tags Might Be Really Insecure

June 17, 2022 by Lewin Day 20 Comments

[Gabe Schuyler] had a frustrating problem when it came to getting into his building’s garage. The RFID access system meant he had to remove his gloves while sitting on his motorcycle to fish out the keytag for entry. He decided to whip up a better solution with less fuss.

His initial plan was to duplicate the keytag and to sew one into his gloves. Purchasing a 125 KHz RFID tag duplicator off eBay, he was able to quickly copy the tag, and create one that worked with his garage’s entry system. While the duplicate tags worked well, they were still too big to easily fit into a glove. Attempts to create a duplicate with a smaller tag failed, too. Eventually, [Gabe] turned up a ring complete with a compatible RFID chip, and was able to duplicate his entry tag onto that. Now, by wearing the ring, he can enter his garage and building with a simple wave of the hand, gloves on or off.

Of course, duplicating an RFID tag is no major hack. As per [Gabe]’s Shmoocon talk on the topic, however, it shows that many buildings are using completely insecure RFID access methods with little to no security whatsoever. Anyone that found an access tag lying on the ground could easily replicate as many as they wanted and enter the building unimpeded. It also bears noting that you can snoop RFID cards from further away than you might expect.

Hackaday Links: February 27, 2022

February 27, 2022 by Dan Maloney 15 Comments

If there’s one thing that can trigger people, it’s the printer racket. Printer manufacturers who put DRM-like features into their consumables are rightly viewed as Satan’s spawn, and while these monsters have been content so far to only put digital rights management features into their ink and toner cartridges, they appear to now have their rapacious gaze set on print media too. At least according to the good folks over at the Electronic Frontier Foundation, who claim that Dymo’s latest generation of label printers will have RFID tags in the label cartridges, apparently to prevent consumers from buying non-Dymo media. The company doesn’t bill it as a way to lock you into their exorbitantly priced consumables, of course; rather, this is an exciting new feature that’s called “Automatic Label Recognition,” which keeps track of what labels are installed and how many are left. Of course, this is just red meat to people like us, and we fully expect to see workarounds in the not-to-distant future.

Continue reading “Hackaday Links: February 27, 2022” →

Flipper Zero tool reading bank card, displaying data on LCD

What’s On Your Bank Card? Hacker Tool Teaches All About NFC And RFID

October 4, 2021 by Donald Papp 29 Comments

The Flipper Zero is a multipurpose hacker tool that aims to make the world of hardware hacking more accessible with a slick design, wide array of capabilities, and a fantastic looking UI. They are struggling with manufacturing delays like everyone else right now, but there’s a silver lining: the team’s updates are genuinely informative and in-depth. The latest update is all about RFID and NFC, and how the Flipper Zero can interact with a variety of contactless protocols.

Drawing of Flipper Zero and a variety of RFID tags — Popular 125 kHz protocols: EM-Marin, HID Prox II, and Indala

Contactless tags are broadly separated into low-frequency (125 kHz) and high-frequency tags (13.56 MHz), and it’s not really possible to identify which is which just by looking at the outside. Flipper Zero can interface with both, but the update at the link above goes into considerable detail about how these tags are used in the real world, and what they look like from both the outside and inside.

For example, 125 kHz tags have an antenna made from many turns of very fine wire, with no visible space between the loops. High-frequency tags on the other hand will have antennas with fewer loops, and visible space between them. To tell them apart, a bright light is often enough to see the antenna structure through thin plastic.

Low-frequency tags are “dumb” and incapable of encryption or two-way communication, but what about high-frequency (often referred to as NFC) like bank cards and applications like Apple Pay? One thing demonstrated is that mobile payment methods offer up considerably less information on demand than a physical bank or credit card. With a physical contactless card it’s possible to read the full card number, expiry date, and in some cases the name as well as recent transactions. Mobile payment systems (like Apple or Google Pay) don’t do that.

Like many others, we’re looking forward to it becoming available, sadly there is just no getting around component shortages that seem to be affecting everyone.

RFID Music Player Gets The Whole House Pumping

February 13, 2021 by Lewin Day 11 Comments

RFID tags are normally used for pedestrian tasks like tracking shipping crates or opening doors to workplaces we’d rather be absent from, but they can also be cool and fun. [hoveeman] demonstrates this ably with a tidy jukebox project.

The build is based on a Raspberry Pi Zero, secreted away underneath a table with a USB RFID reader attached. Atop the table are a series of RFID cards upon which [hoveeman] printed the artwork from his favorite albums using a special caddy in an inkjet printer. Through some Python code and shell scripts, when scanning a card, the Pi Zero is able to trigger all the Google Home compatible devices in the house to play the album selected at the same time.

It’s a visually enjoyable way to cue up some music, and likely more reliable than most voice assistants, too. We can see this being particularly useful for Weezer fans; with the band’s many self-titled releases, Siri and the Google Assistant typically fail to play the right album on request. We’ve seen other beautiful RFID jukeboxes before, but one player that really sticks out ditched the RF and just uses computer vision with vinyl albums as the ID.

Continue reading “RFID Music Player Gets The Whole House Pumping” →