How Hackers Extracted the ‘Keys to the Kingdom’ to Clone HID Keycards

Researchers demonstrated a technique to extract HID Global authentication keys from encoders' Secure Application Modules and to clone access cards, particularly impacting customers using shared-key (standard) deployments where one key can serve many sites. The write-up explains the extraction method, practical card-copying tactics used by testers, the potential to convert readers into encoders for targeted attacks, and HID's public advisory plus recent and upcoming patches and mitigation recommendations.