Useful tool to easily display an encoded hex value of the Wiegand data transmitted over the wire from an Access Control reader. Aimed as a visual aid for confirming effective credential clones, and technology downgrade attacks. Also capable of easily retrieving PACS data from "secure" credentials making use of default encryptions keys, such as HID SEOS.
- Wiegand Based reader
- HID RP40 or RPK40 Multiclass SE is the best as it has the ability to read both low frequency as well as high frequency cards
- Arduino Nano
- Arduino OLED screen
- USB-C PD board
- Fun fact. HID RPK40s boot on 5v, so no need to buy a big USB-C PD compatible power supply if you dont want.
The pinout is from the perspective of all components to avoid mistakes and aid in troubleshooting.
- Wiegand Data 1 - D3 (Arduino)
- Wiegand Data 0 - D2 (Arduino)
- +12v - +12v (USB PD Board)
- Gnd - Gnd (USB PD Board)
- VIN - +12v (USB PD Board)
- GND - Gnd (USB PD Board)
- D2 - Wiegand Data 0 (Reader)
- D3 - Wiegand Data 1 (Reader)
- A4 - SDA (OLED)
- A5 - SCL (OLED)
- 5v - VCC (OLED)
- GND - Gnd (OLED)
- SDA - A4 (Arduino)
- SCL - A5 (Arduino)
- VCC - 5v (Arduino)
- Gnd - GND (Arduino)
If you have access to a 3D printer, this STL prints quickly and doesnt require any supports. It also has slots for each peice of hardware. Case secured making use of M3 bolts, which thread into the PLA plastic to avoid the need for brass thread inserts. Reader fixed to case using M3 bolts as well.
Added functionality can be had with an RFID-Tool installed into the same case to add the ability to retrieve the data read via Wi-Fi. This tool connects in-line with the reader, and doesn't interfere with the arduino.
As simple as it gets: turn it on and scan any card that the connected reader is capable of reading. PACS data and bit length will be displayed on the screen. This data can be written to another card using a Proxmark or similar device, decoded to retrieve the facility code and card number.
This serves as a visual aid for effective card cloning and tech downgrade attacks to confirm that PACS data is transmitted identically.
- Craig S. Blackie and Warren Houghton