EM410x (LF)

The EM410x family of RFID tags are fairly common choices for low frequency access control systems. However, they are inherently insecure due to a multitude of factors.

Not unlike other low frequency RFID tags, EM410x tags use a static, unencrypted pre-programmed UID for authentication. This UID is easily readable and copied to other tags for the purposes of cloning. Not only is the UID readable by a proxmark or any other RFID reader, it is common practice for UIDs to be printed on the back of the tag. You might not even need to interface with the tag to clone it!

EM410x Format

Below is an example of the back of a typical EM4100 card - you can see that there are characters printed.


The UID stored on the tag's memory is in hexadecimal format. So if we convert the first set of numbers, "0004523835", it becomes "45073B":

In the possible de-scramble patterns, you can see "069.01851" - this matches the second set of decimal numbers printed on the tag. This is a set of vendor-specific patterns that can be used to represent the same card data. In this case you can see that DEZ 3.5C is a match, and so the proxmark will use this format for further interactions.

Taking a look at the EM 410x ID discovered, we can see it matches the UID we derived before minus the 0200 prefix. When transmitting, the UID prefix is actually truncated or even ignored by the reader - this is due to bit length limitations within the wiegand protocol.

Cloning

Since we know the UID of the tag now, it is as simple as writing the UID to another card. Because EM410x tags are read-only, we will use a chipset called the T5577 which can emulate many different 125kHz RFID tags - including the EM410x family.