As stated in the title, I was wondering if the NExT is compatible with a Salto lock. My apartment has a Salto lock for both my apartment and personal room which uses an RFID card. I unfortunately do not have any specifications as to the lock (see image attached). It is a shared apartment and each person has their own card. Myself and roommates can access the lock for the apartment and only our individual rooms (along with readers to access areas of the community center). Would be possible to have my card added to my NExT and if so how I would go about doing so? I have a Proxmark3 Easy, however my knowledge on RFID and how to use it is lacking. Any information would be greatly appreciated!
This specific lock wasn’t tested yet, but they have others that work with xM1 flexM1 etc.
Try it with a test card, then maybe with an xFD to see if it has the power.
1 Like
There are two issues here:
1/ Does the Salto lock couple with glass implants, flex implants or both?
2/ Does it authenticate on UID alone or does it do something clever with only one type of transponder?
If I were you, I would find out 2/ first: grab a Magic Mifare card, clone your legit card’s UID onto it, see if the lock opens. If it does, then you can try your luck with a xM1 (and if it works, great!), try your luck less with a flexM1 (it’ll probably work. Note the keyword probably…) or be almost sure it’ll work with a flexMT.
If the device won’t open with a cloned Mifare, then figure out if your card is a NTAG or something else. If it’s an NTAG, then ask your landlord if he’ll enroll a hypothetical implant (if he won’t, end of story). Then you can try your luck with a xNT or NExT (and if it works, great!) or try your luck less with a flexNT (…probably… 
)
1 Like
Does it put data on the M1k, or does it only use the UID?
1 Like
Interesting… So it’s a bit more than a dumb lock for a change. That’s refreshing. Maybe that justifies Salto’s eye-watering prices…
Do you know if it’s static data or if it implements some kind of rolling encryption key like the Yale Doorman V2N does?
NthVoid: you might want to consider getting yourself a Proxmark3 to clone your Mifare exactly if you don’t already own one by the way…
1 Like
I dare not say whether it is something static, when reading for cloning to the FlexMT a brute force was used.
before cloning with the Proxmark I had to manually write back each line as autopwn gave a lot of write errors.
1 Like
If you want to find out, dump the content once, open the lock, dump the content once more and compare the two dumps: if they’re identical, the data is static. If it’s changed, the lock writes a rolling key at each operation.
1 Like
I did the dumping and cloning for him before shipping… I don’t think he has a proxmark?
1 Like
do you mean on me amal ? 
because I bought the proxmark from you and we made the dump together then
do the same with the ski pass and some other cards I made a small manual about this afterwards.
1 Like
A how to manual? or a results/info manual?
1 Like
a small guide to how and in what way I can read and clone the different types of cards.
If you want I will upload the manual here when I get home
3 Likes
Yes please, I think anything like that can be a great resourse for the whole community
2 Likes
Only if you have the keys in a separate key file. The MCT app can’t crack anything.
That’s right! Haha I forgot sorry
1 Like
Oh ok. I thought it did hardnesting.
1 Like
There is a forked version of MCT that can do brute forcing (useless) but that’s it. The timings etc required for those attacks is not possible (as far as I know) on Android due to lack of low level NFC radio access.
1 Like
Okay I see. Sorry I’m clueless with cellphones. I’m a simple minded guy, I only use phones to place phone calls
1 Like
How is your giant battery pack with cellular functionality going?
2 Likes