Proxmark3: Cloning Hotel Keys, Office Badges, and Transit Cards in Under 30 Seconds

The Proxmark3 is an open-source RFID research platform originally designed by Jonathan Westhues in 2007. The RDV4 variant - the current community standard built by RRG/Iceman - adds a 256MB integrated flash, a Bluetooth module, and a rechargeable LiPo battery, turning what was originally a tethered research tool into something that fits in a jacket pocket.

It operates across both LF (125 kHz) and HF (13.56 MHz) frequency bands and supports the full attack surface of physical access control: reading, writing, emulating, and sniffing RFID and NFC tags. That four-verb capability - read, write, emulate, sniff - is what separates it from simple cloners and makes it a complete research platform.

Most enterprise buildings, hotels, transit systems, and parking garages in use today rely on one of four credential technologies. Every one of them has known, publicly documented vulnerabilities.

//HID Proximity - The Standard That Refused to Die

HID Global's Proximity card system operates at 125 kHz and uses the H10301 26-bit format as its most common encoding. That format encodes exactly two values in plain, unencrypted transmission: an 8-bit facility code and a 16-bit card number.

There is no encryption. No mutual authentication. No challenge-response protocol. The card broadcasts its credential continuously to any compatible reader - or Proxmark3 - that comes within range and energizes the tag with an RF field. Reading takes under two seconds. Writing the captured data to a blank T5577 card takes another two seconds. The clone is indistinguishable from the original at the reader.

This is not an exploit in the software vulnerability sense. HID designed Prox for convenience and cost-effectiveness, in an era when a practical RFID field cloner was not a realistic threat model. The product is now two decades old and remains the dominant access control credential in enterprise environments globally.

Proxmark3 Command Reference - HID

The core workflow on Proxmark3 for HID Proximity targets:

lf hid read - Scan for and decode a nearby HID card, extracting facility code and card number.

lf hid clone --r [raw-data] - Write the captured credential data to a blank T5577 card.

lf hid sim --r [raw-data] - Emulate the card directly from the Proxmark3 without a physical clone.

//EM4100 - Even Simpler

EM Microelectronic's EM4100 predates HID Prox and is a 64-bit read-only tag with zero authentication. The entire 64-bit payload is transmitted on power-up. Proxmark3 reads it with lf em 410x read, clones it to a T5577 with lf em 410x clone.

EM4100 is widely deployed in budget access control installations, particularly in Eastern Europe, Southeast Asia, and smaller commercial buildings in Western markets that installed systems in the 1990s and early 2000s and never upgraded. The attack is identical to HID Prox in practice.

//MIFARE Classic - Broken by Design

NXP's MIFARE Classic operates at 13.56 MHz and uses the proprietary CRYPTO1 stream cipher for sector authentication. Unlike HID Prox, MIFARE Classic at least attempts cryptographic access control. Unfortunately, CRYPTO1 was reverse-engineered by academic researchers at Radboud University in 2008 and found to have fundamental weaknesses that make it unsuitable for any security-sensitive application.

The primary attack is the "nested authentication" attack. After authenticating to any one sector with a known key (often a default key that was never changed), MIFARE's weak pseudo-random number generator becomes predictable enough to allow recovery of keys for all remaining sectors. The process uses a small number of encrypted authentication messages to derive the PRNG state and then mathematically recover the 48-bit sector keys.

The Hardnested Attack

Some MIFARE Classic deployments use non-default keys for all sectors, which removes the initial authentication step required for the nested attack. The "hardnested" attack, developed by Carlo Meijer and Roel Verdult, addresses this by using multiple encrypted authentication sessions to probabilistically reconstruct the internal PRNG state without any known key. It takes longer - typically several minutes - but recovers keys from even hardened deployments.

The realistic population of MIFARE Classic deployments includes hotel room key systems (the most commonly cited use case), European transit systems, building access control, vending machine credit systems, and library card systems. All are exploitable with publicly available tools.

Cloning and Emulation

Once all sector keys are recovered, Proxmark3 dumps the full card content to a binary file: hf mf dump. The binary contains all 16 sectors including the UID, configuration blocks, and application data. Writing this to a compatible blank card with hf mf restore produces a functional clone. Emulation via hf mf sim allows the Proxmark3 itself to present as the card without a physical clone.

//iCLASS - The Master Key Problem

HID iCLASS (13.56 MHz, ISO 15693) was designed as a more secure successor to Prox, using DES-based authentication. Legacy iCLASS (non-SE, non-Elite) derives site-specific cryptographic keys from a single master diversification key using a key derivation function that HID treats as a trade secret.

In 2012, researchers at Riscure discovered that the HID master diversification key could be recovered from a standard iCLASS reader's firmware via a side-channel attack requiring physical access to the reader. Once the master key is known, any iCLASS card can be read and credential-forged without ever possessing the card - the site key for any deployment can be derived from the card's publicly readable CSN (chip serial number).

HID's iCLASS SE and Elite product lines use AES-128 with customer-managed keys and are not subject to this attack. The complication is legacy infrastructure: many installed reader plates accept both SE and classic iCLASS cards for backward compatibility, creating a cryptographic downgrade path.

//Emulation Mode - The Clean Path

Physical cloning to a blank card is the high-effort path that requires carrying a second card. Proxmark3's emulation mode is more elegant: the device draws power from the reader's RF field and transmits the captured credential data directly from its firmware. For LF targets, this is lf hid sim. For HF, hf mf sim handles the full MIFARE Classic authentication protocol including generating valid CRYPTO1 responses.

The RDV4's Bluetooth module allows triggering emulation from a phone application while the device remains concealed. An operator can walk a badge reader, trigger from a phone, and the Proxmark3 in their jacket presents the credential.

//Defensive Considerations

The RFID vulnerability landscape has been publicly documented for over fifteen years. The slow migration to cryptographically sound credentials is a legacy infrastructure and budget problem, not a knowledge gap. Practical controls that actually move the needle:

Credential upgrade is the only real fix for LF and MIFARE Classic systems. MIFARE DESFire EV3 (AES-128, mutual authentication, no known practical attacks), HID iCLASS SE/Elite, or SEOS credentials are the migration targets. Budget-constrained sites can migrate readers first - SEOS readers accept both SEOS and legacy cards, allowing phased rollout.

RF-blocking credential holders prevent passive scanning of cards being carried. Useful against opportunistic attacks where an attacker stands near someone in an elevator or waiting area.

Reader log auditing catches cloned card usage: if a card is used at two physical locations within an impossible timeframe, or used at a door during hours inconsistent with the cardholder's access pattern, the clone is detectable. This requires alerting configuration that most installations don't have set up.

PIN-plus-card (two-factor physical) is the most practical near-term defense for high-security doors, particularly server rooms and executive floors. A cloned card without the PIN is useless.