Bypassing HID iCLASS Security: From Legacy Clones to Firmware Exploitation

TLDR: This research demonstrates that many HID iCLASS installations remain vulnerable to cloning, downgrading, and direct firmware exploitation despite claims of secure authentication. By leveraging tools like the Proxmark3 and exploiting specific firmware bugs in Signo readers, attackers can bypass access controls without needing a valid credential. Security teams must move away from legacy iCLASS protocols and ensure reader firmware is patched to mitigate these risks.

Physical access control systems are often the most neglected part of a security assessment. While teams spend weeks hardening cloud infrastructure and patching web applications, the office front door is frequently protected by technology that was effectively broken over a decade ago. The recent research presented at DEF CON 2024 on HID iCLASS credentials serves as a stark reminder that "secure" often just means "security through obscurity."

The Anatomy of the Failure

The core issue with many iCLASS deployments is that they rely on the Wiegand protocol, a signaling standard developed in the 1970s that lacks any form of encryption or authentication. When a reader scans a card, it simply transmits the card's data as raw binary to the controller. The controller, which is often physically accessible or poorly secured, makes the final decision to unlock the door.

In the case of iCLASS Legacy credentials, the cryptography was famously broken in the Heart of Darkness paper. Because the authentication keys are static and widely known, cloning these cards is trivial. An attacker does not need to be a cryptographer; they only need a reader to capture the card's data and a writer to replicate it onto a blank card.

Downgrading and Emulation

Modern iCLASS SE and SR credentials were designed to address these flaws by introducing a Secure Identity Object (SIO). However, the implementation often prioritizes backward compatibility over security. Many readers are configured to support both modern, encrypted credentials and legacy, unencrypted ones. This allows for a "downgrade attack."

If a reader is configured to accept legacy credentials, an attacker can use a Proxmark3 to emulate a legacy card, even if the target is currently using an SE card. The reader, seeing the legacy signal, simply falls back to the insecure protocol. The command sequence for this is straightforward:

# Example of encoding a legacy credential on a Proxmark3
hf icl encode --bin 1011100100000000010111011011010 --ki 0

This command takes the binary payload and encodes it using the known legacy key. Once the reader receives this, it treats the emulator as a legitimate, authorized user.

Exploiting Signo Reader Firmware

The most concerning part of this research involves the newer HID Signo readers. These devices are supposed to be the gold standard, yet they contain firmware-level vulnerabilities that allow for credential emulation. Specifically, researchers discovered that certain firmware versions (R10.0.5.6 and older) can be manipulated to accept an emulated SIO.

By dumping the publicly accessible parts of an iCLASS SE card—the Card Serial Number (CSN), the E-purse, and the Application Instruction Area (AIA)—an attacker can construct a valid-looking SIO. When this is presented to a vulnerable Signo reader, the reader fails to properly validate the cryptographic binding between the SIO and the card's identity. This effectively turns the reader into a passive participant in its own compromise.

For a pentester, this changes the engagement model. You no longer need to physically steal a card from an employee's desk. You can use a Flipper Zero or a Proxmark3 to sniff the necessary data from a distance, or even use a reader manager tool to inspect the reader's configuration remotely if it is networked. If the reader is running outdated firmware, the path to the server room is wide open.

The Defensive Reality

Defending against these attacks requires a shift in mindset. First, stop relying on legacy iCLASS protocols. If your hardware supports it, disable legacy support entirely. This is the single most effective step you can take. Second, treat your access control readers as network-connected devices. They have firmware, they have configurations, and they have vulnerabilities. If you are not auditing the firmware versions of your readers, you are operating in the dark.

Finally, move toward mobile credentials or more modern standards like DESFire EV3, which offer significantly better protection against the cloning and emulation techniques described here. These technologies use mutual authentication, meaning the reader and the card must prove their identity to each other before any data is exchanged. This prevents the simple replay and emulation attacks that plague the iCLASS ecosystem.

The era of trusting a piece of plastic to secure a facility is over. If you are still using legacy HID iCLASS, you are not just behind the curve; you are effectively leaving the door unlocked. Start by auditing your reader configurations and identifying which devices are still accepting legacy signals. The tools to break these systems are cheap, portable, and widely available. It is only a matter of time before they are used against your infrastructure.