xNT w/HID iCLASS SE

My office users HID iCLASS SE readers for door access, they list compatibility with MIFARE / DESFire but can’t seem to read my xNT chip, not even to show an error state. My chip works fine on our samsung door locks, and can be read by my iphone and android phone just fine.

Is there some setup I’m missing to get it read by the HID units? is there a different chip that would be read by them. Our security folks are happy to clone my badge to my chip or allow me a second “badge” via my chip.

https://www.hidglobal.com/sites/default/files/resource_files/iclass-se-readers-ds-en.pdf

Do you have another NTAG216 type tag in card format that you can test with to see if it will produce any results?

Card readers that expect card format tags can have trouble reading x-series tags so position as well as orientation of the tag is super critical to get proper coupling. An HF xLED would help you greatly to determine the best way to present the xNT

I don’t have either, but it seems like the card is pretty easy and inexpensive to get. http://www.id-enhancements.com/nfc-pvc-card-ntag216/

Can the xNT “spoof” card format or store a piece of information (e.g. my existing employee ID) in card format? or is this more of a physical thing than a information format issue?

What is an HF xLED?

The xNT’s UUID cannot be changed. It is unlikely that the reader will use data from the user memory of the xNT (that can be changed) to authenticate.

Have you scanned your existing card with an android app like TagInfo? This will tell you all you need to know if there is an implant you can use.

xLED
https://dangerousthings.com/shop/xled/

ok, so with TagInfo i confirmed I could ready my xNT, but it could not read anything from work card/badge

This is the secondary type of reader we use at the office RF IDeas WAVE ID Plus SDK non-housed Reader - RF proximity reader - USB - RDR-805N2AK0-C06 - Proximity Cards & Readers - CDW.com!

It will read our badges, but not my xNT as well.

It could be a LF (125khz) HID card that you might be able to clone to an xEM.

Thanks I guess I’m going to need another implant… has anyone made a placement guide for multiple chips in one hand?

has some data…

1 Like

Just picking this back up, if I can’t read my work badge with taginfo on my android phone how do I know what chip would work to clone it?

if you updated to Android Pie, it could be difficult to read an implant.

I have also the xIC implanted and it took with TagInfo about a minute to read it - with the older system it was quick.

The best stuff is, ask at your company. You can’t clone HF Cards (only mifare classic yould work, but at the moment there isn’t a xM1+ avaible

The first thing you need to do is identify the card. Does it have any markings in the corner next to a small blue HID logo?

If you can’t read the badge with your phone, then in all likeliness, the reader you said it is is not correct.

You can’t ID HID readers from the outside. They all look the same and the can be radically different inside. It does little to identify the card.

You want answers but it requires other information and tools to gather that information. Invest in these tools and it will be a lot easier to answer your questions…

At the very least you should have an xLED HF and xLED LF. I would get the RFID Diagnostic Card. All available on the DT website.

I agree. Get the diagnostic card and hold it up to the reader. That’ll give a pretty definitive statement as to whether or not it’s 125k or 13.56. I’ve personally seen and installed HID multiClass readers that do both the old 125k style and newer 13.56. It’s very possible your installer just put them in for forwards compatibility - although they look like iClass they bear a different nameplate. Could be a weird fluke or not, who knows. Most likely the reader is just getting what it thinks as garbled data and refusing to read - like when you scan an EM card on an HID reader, nothing happens. There’s also a small possibility that the reader is programmed to not even make any outwards signs that it read an invalid card although that’s unlikely unless you’re in some crazy secure facility with 3-letter agencies.

Bottom line, get a diagnostic card. They’re cheap and work for way more than just this.

Unfortunately our badges are very custom and do not have any markings that would explain anything about its technology or standards. I’m 100% sure that the USB reader i linked to is the correct one (as its the one that we can request from our internal hardware store) but I do know that our physical security does flash/configure the device with some sort of custom setup before they’re usable.

I’ll order the diagnostic card and see if I can learn anything from that. Physical Security isn’t willing to give me any details about the badges or readers only to allow me to clone my existing badge if I can provide a compatible proxy for our badge.

If you can read your work badge with your android phone it is almost 100% likely to be 13.56Mhz.

Does TagInfo give you any details about the type of chip it is seeing when you scan it with your phone? I’m wondering it the HID iClass reader just reads the UUID or if it does anything else (such as read/interact with the card)

This sounds like your work badge is a 125khz card then. If your phone isn’t getting anything from it, then it very likely is an RFID badge not NFC. I personally have an xEM and xNT, and use my xEM for scanning in at work. For me I cloned my work badge using one of those “10 Frequency RFID Cloner” machines, though people have had success with the cheap blue HID Cloners you can get on Amazon. Getting one of the DT RFID diagnostic cards which will tell you 100% whether the readers you have at work are 13.56mhz or 125khz is what I would do as a first step before investing in another implant.

Got my card, The readers on the doors did read as HF 125

You’re going to need an xEM. Depending on the reader’s config you’re looking at (most likely) HID Proxcard, or (less likely but possible) Indala or EM. All can be done with the xEM (not xNT). Due to the unknown nature of what you’re working with I’d suggest a Proxmark just to make your life a bit easier when it comes down to cloning it. If I were you I’d just go and have security program a new “badge” using the chip instead of cloning as this gives better security. Just generate a random facility code and card code and securely give those to security.

Hmm… HF is 13.56MHz … LF is 125kHz … which did you mean to say?

I second that suggestion.

1 Like

Just to confirm. We use an iClass reader at work.

Scanned my xNT to get an authentication fail in the logs. Added the serial number as appeared in the logs (had trouble working it out from my phone) and worked excellent.

1 Like