Schlage NDE

[Tyler J. Thomas]

Doing a write up, or write ups, on this soon. Figured I'd share some pictures until I finish it up. By no means am I an expert, but if you have any questions I know enough to be dangerous. Enjoy.

[Squelchtone]

Heh, I thought you were doing Non Destructive Entry, its interesting they chose that as a product line / model number.

[Tyler J. Thomas]

Heh, I thought you were doing Non Destructive Entry, its interesting they chose that as a product line / model number.

Ha, didn't consider that. I do believe it stands for ND series with Engage technology, NDE. Rather unfortunate name. If MWT finds an exploit I'm sure he will point that out though haha.

[Jacob Morgan]

Apparently it is supposed to work with prox cards, smart cards, or with mobile devices. I am curious as to why the upper part of the locks are plastic (the dark plastic is not covering IR sensors). Presumably there are some colored LEDs for status, but LED's could be used without so much plastic (e.g., as on the Trilogy Alarm Locks). It just seems that having that much plastic invites someone with a blunt object to bust it open and play with the wires inside. Do the wires from the protected side only power some LEDs or do they connect a prox card reader to the circuit board on the protected side? If so we'll be seeing someone on YouTube from the next DefCon showing how to brute force codes into the ribbon cable using a pocket sized Rasperry Pi. One place I know of that uses prox cards uses the employee ID number, a fairly short integer, for the code. A brute force attack would make short work of that. Maybe the unit locks out after repeated tries and such?

[Tyler J. Thomas]

Apparently it is supposed to work with prox cards, smart cards, or with mobile devices. I am curious as to why the upper part of the locks are plastic (the dark plastic is not covering IR sensors). Presumably there are some colored LEDs for status, but LED's could be used without so much plastic (e.g., as on the Trilogy Alarm Locks). It just seems that having that much plastic invites someone with a blunt object to bust it open and play with the wires inside.

Prox, smart card, Bluetooth, NFC, Wi-Fi, and I might be missing one or more. If I had to guess, the readers and antennas and all that good stuff are stored in that area. I'll disssect it tomorrow.

Do the wires from the protected side only power some LEDs or do they connect a prox card reader to the circuit board on the protected side?

The circuit board is on the protected side. It can be seen in pictures 3, 4, and 5. Two wires connect on the unprotected side and are routed through the crossbore to the protected side. If I had to guess, 2 wires are for the clutch motor (power) and the rest are for data. Since these locks are weatherized it would not surprise me if the readers/antennas are encased in epoxy or a similar resin (which makes trying to spoof or brute a cylindrical leverset pretty overkill). I'll check tomorrow.

If so we'll be seeing someone on YouTube from the next DefCon showing how to brute force codes into the ribbon cable using a pocket sized Rasperry Pi. One place I know of that uses prox cards uses the employee ID number, a fairly short integer, for the code. A brute force attack would make short work of that. Maybe the unit locks out after repeated tries and such?

Good question. I don't see time delays or lock out timers as a configuration option on the Engage app I have for this lock BUT these locks really shine when used with one of Allegion's alliance partners' hardware (CDVI, IDenticard). Their softwarez might have that option. I'll check.

I'll be at Allegion tomorrow and Wednesday and will ask. If anyone else has any other questions post them and I'll get you the answers.

[cledry]

I've installed a few of these. So far they are doing well. Installation is very nice because it fits a standard 161DT prep. The door can easily be returned to a cylindrical lever.

[cledry]

So did your Allegion rep install the lock on your display or did you do it? I was super busy as usual when he dropped in to the shop, so he said he would install it. About an hour and a half later and two locks later he had it installed. It was quite humourous to watch a sales rep actually try to use a screwdriver and install their own product.

[Tyler J. Thomas]

So did your Allegion rep install the lock on your display or did you do it? I was super busy as usual when he dropped in to the shop, so he said he would install it. About an hour and a half later and two locks later he had it installed. It was quite humourous to watch a sales rep actually try to use a screwdriver and install their own product.

Our rep walked us through the installation on the mount. I took it home and disassembled and reassembled it a few dozen times like I do with any display I get my hands on .

I did get plenty of good info and a few more pictures today. Will post tonight while trying to avoid election coverage.

[cledry]

So did your Allegion rep install the lock on your display or did you do it? I was super busy as usual when he dropped in to the shop, so he said he would install it. About an hour and a half later and two locks later he had it installed. It was quite humourous to watch a sales rep actually try to use a screwdriver and install their own product.

Our rep walked us through the installation on the mount. I took it home and disassembled and reassembled it a few dozen times like I do with any display I get my hands on .

I did get plenty of good info and a few more pictures today. Will post tonight while trying to avoid election coverage.

Working on integrating with RS2 now. This should be fun.

[Tyler J. Thomas]

So did your Allegion rep install the lock on your display or did you do it? I was super busy as usual when he dropped in to the shop, so he said he would install it. About an hour and a half later and two locks later he had it installed. It was quite humourous to watch a sales rep actually try to use a screwdriver and install their own product.

Our rep walked us through the installation on the mount. I took it home and disassembled and reassembled it a few dozen times like I do with any display I get my hands on .

I did get plenty of good info and a few more pictures today. Will post tonight while trying to avoid election coverage.

Working on integrating with RS2 now. This should be fun.

Aye. I didn't realize how many alliance partners they had for this lock. I didn't get an exact count or a full list of names but there were literally 2 dozen manufacturers on the list. Our first system is going to be using CDVI but we're debating a second option for larger systems. Possibly IDenticard.

[Tyler J. Thomas]

Ok so here are a few pictures of the circuit board in the outside assembly (unsecured side).





I was kind of right, I guess? It's covered by a low-pressure molding. The receiver for credentials is pictured in the center of the PCB in the second picture.

As far as chassis goes, 2 wires (red and black) are dedicated to the motor itself and the other 2 (yellow and green) are actually for the REX monitor (triggered by turning the inside lever). In fact, this REX monitor is vital to the programming and resetting at the lock itself. The lock uses the number of lever turns in conjunction with other actions, such as presenting a new credential or pressing the reset button, to accomplish a few tasks.

I'm loving these locks more and more as I learn more about them.

[cledry]

Ask why with RS2 you need to turn of internal wifi. Seems kind of pointless to use this in a RS2 system.

[Tyler J. Thomas]

Ask why with RS2 you need to turn of internal wifi. Seems kind of pointless to use this in a RS2 system.

Does R2 use their own communication standard like Salto? Might be an interference issue? I'll ask tomorrow.

[cledry]

Ask why with RS2 you need to turn of internal wifi. Seems kind of pointless to use this in a RS2 system.

Does R2 use their own communication standard like Salto? Might be an interference issue? I'll ask tomorrow.

It does, nut other Schlage products work without disabling wifi.

[Tyler J. Thomas]

Ask why with RS2 you need to turn of internal wifi. Seems kind of pointless to use this in a RS2 system.

Does R2 use their own communication standard like Salto? Might be an interference issue? I'll ask tomorrow.

It does, nut other Schlage products work without disabling wifi.

Could be that the Schlage AD operates at 900 MHz. NDE operates with Bluetooth low energy which is 2.4 GHz, the same as some routers. My guess. I don't know if that's what causes the interference.