The university I study at has a special elevators for masters, and masters have somthing like a coin that they can use the elevator. As I know it's an rfid tag and it is a 125khz one. and have a 100 turn coil.

My masters know that I want to do that, and there is no problem with doing this. Its something like a university project. I know that the tags have a special serial, and I can find one of that tags serial by using a RFID reader. However the current tags are not writable. Can I do this project by using a microcontroller? If so how? Also one of my friends is a specialist can he help me?

Won't help - RFID tags all have a unique number on them. And when I say unique I mean 64 bits unique, maybe more. This is 'more atoms than the universe has' unique. They keep a list of the people who are allowed to use the elevator and know what numbers they have. So if your tag hasn't been entered into the system you can't use it. Unless you could get your hands on one of the 'masters' tags and copy the number. But if you can do that just use that tag. Theft, sure, but you're already asking how to elegantly trespass so I'd assume you're okay with theft?

  • 3
    'more atoms than the universe has' - not even close. Observable universe has at least 10^78 atoms = 2^259. – stevenvh May 6 '11 at 8:09
  • @Stevenvh, I thought about making the same comment, but it does make the point it would not be easy to pick. – Kortuk May 6 '11 at 10:09
  • Ah, I must have been thinking of cryptography instead. My bad. – AngryEE May 6 '11 at 13:27
  • While its true that they all have some kind of unique number, some tags only have 4 or 7 byte ids instead of 8. – Rev1.0 Nov 23 '13 at 22:21

RFID tags work with "near-field" radio signalling. The elevator (RFID master) emits a low-power radio signal which is only strong enough to extend a small distance away before being lost to noise.

When an RRFID tag is placed within range of the low-power master signal, it powers up (using power from the transmitted signal, which is cool) and transmits a unique identification number. In the case of the elevator, this ID number will be checked against a list of approved IDs before granting or denying access to the elevator controls.

To gain access without a tag, you would have to record the radio signal sent from a valid tag to the elevator, and then reproduce the same signal. If that proves difficult, you could make or modify an RFID master with a directional gain antenna. The trick would then be to aim that antenna at a valid RFID tag from farther away, and record its ID number.

Important Note: If you get caught pointing a directional antenna at a masters student, be prepared to answer a lot of questions. Security is a serious matter these days.

125kHz tags have about 32 bits of data, in practice less because all tags used at a certainl location will share the same prefix, see this link.

You will never guess the ID, but you could easily clone it using something like this: http://www.youtube.com/watch?v=fDimlEdeGjM

You can buy cloners, but it's much more educational to build one yourself, so have at it!

  • Those EM tokens are 40 bits with 8 bits, as you say, reserved as a "customer ID". But EM's customers are generally resellers so anyone who buys from those resellers ends up with the same prefix! I guess EM have more than 256 customers anyway :) – MikeJ-UK May 6 '11 at 14:45

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.