MIFARE DESFire EV2/EV3
Configure NXP DESFire EV2/EV3 cards with AES-128 mutual authentication, encrypted application keys, and per-site diversification — resistant to the prox-style cloning attacks that target legacy 125 kHz credentials.
Anti-Clone Smart Card · Abu Dhabi
Anti-Clone Smart Card Mitigation — Abu Dhabi
Migrate from clonable 125 kHz proximity credentials to cryptographic smart card technologies across Abu Dhabi and Al Ain. We install, configure and stage the transition — honestly, within ADMCC-regulated scope.
Get a free site survey Talk to a specialist
ADMCC Approved
Control4 installer
Since 2018
Honest Scope
In short: This page covers “Anti-Clone Smart Card Mitigation”. Emirtech's own engineers carry out the work, as an independent integrator serving Abu Dhabi and Al Ain. A site survey or assessment comes first, then a written itemised quotation.
Anti-Clone Smart Card Mitigation: key facts
| Who provides it? | Emirtech Technology, based at M44, Mussafah Industrial Area, Abu Dhabi, in operation since 2018. The work is carried out by Emirtech's own engineers. |
|---|---|
| Where? | Abu Dhabi and Al Ain, served from Emirtech's Mussafah, Abu Dhabi base; there is no Al Ain office. In Dubai: IT AMC and time attendance by scheduled on-site visits, gate barriers, ANPR, video intercoms and turnstiles by Emirtech itself; CCTV, alarm and access control through SIRA-approved partners, with Emirtech coordinating. |
| What is covered | Anti-Clone Smart Card Mitigation. |
| Survey and quotation | Emirtech publishes no price list: it surveys or assesses first and then gives a written, itemised quotation. |
| Credentials | Emirtech is an independent systems integrator. It holds no manufacturer-level credential of its own, and its ADMCC approval covers security systems only, not IT services. |
| Last reviewed | 21 October 2026 |
What is anti-clone smart card mitigation and why does it matter in Abu Dhabi?
Anti-clone smart card mitigation is the migration of access control credentials from legacy 125 kHz proximity technologies (HID Prox, EM4100) and unencrypted RFID UHF tokens to cryptographic smart card platforms that resist cloning. Legacy prox cards can be copied with a cheap handheld duplicator in under ten seconds, creating a material risk for any site relying on them for door entry, parking access, lift control, or time-and-attendance. Emirtech Technology, founded in 2018 and operating from M44, Mussafah Industrial Area, Abu Dhabi, is an ADMCC-approved electronic security contractor delivering credential migration projects across Abu Dhabi and Al Ain only. We install and configure cryptographic credentials sourced via authorised UAE distribution channels: MIFARE DESFire EV2/EV3 with AES-128 mutual authentication, HID iCLASS Seos multi-application encrypted credentials, HID Crescendo PIV-compatible smart cards with PKI, and MIFARE Plus AES as a transitional option. We also configure mobile credentials — HID Mobile Access, Apple Wallet and Google Wallet passes — which are cryptographic by design. Reader hardware must match: HID Signo for Seos, ZKTeco D-series for DESFire, or equivalent firmware-current readers. Our migration approach uses a dual-reader transition period so existing prox credentials continue to work while new encrypted credentials are issued in stages, avoiding disruption to daily operations. To be transparent: Emirtech is an Control4 installer, but is not a Channel Partner or Authorised Distributor of HID Global (ASSA ABLOY) or NXP Semiconductors; we install and integrate those brands commercially via authorised UAE channels. We are not a cryptanalysis firm and do not perform credential reverse-engineering. To plan a credential audit and staged migration, call +971 55 651 7843 or email [email protected].
Core mitigation capabilities
Credential platforms we install and configure
HID iCLASS Seos
Install HID iCLASS Seos credentials as a multi-application encrypted platform, configured with site-specific keys and matched HID Signo or compatible reader firmware for end-to-end cryptographic authentication.
HID Crescendo (PIV-Compatible)
Configure HID Crescendo smart cards for sites requiring PIV-compatible PKI credentials — supporting certificate-based authentication for both physical access and aligned logical-access use cases via authorised UAE channels.
Mobile Credentials (HID, Apple, Google Wallet)
Configure HID Mobile Access, Apple Wallet and Google Wallet passes as cryptographic-by-design credentials on Bluetooth / NFC readers — reducing reliance on physical cards and removing the physical-card cloning vector.
Anti-clone migration checklist
Each migration starts with a credential audit identifying every 125 kHz prox, EM4100, or unencrypted UHF token in circulation, followed by a staged dual-reader transition so daily operations are not disrupted. To request a free anti-clone consultation for your site, call +971 55 651 7843.
- Credential audit identifying every 125 kHz prox, EM4100, HID Prox, and unencrypted UHF card in active use
- Reader inventory and firmware-version check across all controlled doors, lifts, and parking points
- Selection of replacement credential platform — DESFire EV2/EV3, iCLASS Seos, Crescendo, or mobile
- Site-specific cryptographic key configuration with per-application diversification where supported
- Dual-reader transition installation so old prox and new encrypted credentials coexist during cutover
- Staged credential issuance plan grouped by department, floor, or building zone to limit operational risk
- Replacement of legacy 125 kHz-only readers with HID Signo, ZKTeco D-series, or equivalent firmware-current units
- Mobile credential enrolment via HID Mobile Access, Apple Wallet or Google Wallet where applicable
- Decommissioning schedule for retired prox credentials with removal from the access control database
- Updated visitor / contractor credential policy reflecting the new cryptographic platform
- Operator handover, training pack, and credential-issuance standard operating procedure
- Documented as-built record of reader firmware versions, credential platform, and migration date
Supporting migration services
How we plan and stage the transition
Credential & Reader Audit
On-site survey cataloguing every credential type and reader model in use, identifying clonable 125 kHz endpoints, and producing a prioritised migration plan based on door criticality and user volume.
Dual-Reader Transition
Install transitional dual-technology readers so existing prox credentials continue to work alongside newly issued DESFire or Seos credentials — supporting a controlled, low-disruption staged cutover.
Reader Firmware & Configuration
Configure HID Signo, ZKTeco D-series, or equivalent readers with site-specific keys and current firmware so the cryptographic credential is actually verified rather than read as plain ID number.
Credential Issuance & Decommissioning
Stage credential issuance by department or zone, update the access control database, and decommission legacy prox cards on a fixed schedule so clonable credentials do not remain valid after cutover.
Scope — what we deliver and explicitly do not
Anti-clone smart card mitigation is a credential and reader engineering project, not a cryptography research engagement. We work within ADMCC-approved electronic security scope and are transparent about the brands and disciplines we do and do not represent.
- We deliver: migration from 125 kHz prox / EM4100 / unencrypted UHF to MIFARE DESFire EV2/EV3, HID iCLASS Seos, HID Crescendo, MIFARE Plus AES, and mobile credentials; matched reader installation and firmware configuration; staged dual-reader cutover; credential issuance and decommissioning across Abu Dhabi and Al Ain.
- We do not deliver: cryptanalysis, credential reverse-engineering, custom card chip development, key-recovery services, penetration testing of credential cryptography, SIRA-regulated work in Dubai (delivered through SIRA-approved partners, with Emirtech coordinating) or work in Sharjah or the Northern Emirates.
- We are not: a Channel Partner or Authorised Distributor of HID Global (ASSA ABLOY), NXP Semiconductors, Apple or Google; we hold no manufacturer-level credential of our own. We install and integrate smart card brands commercially via authorised UAE channels.
- We are not affiliated with: HID Global (ASSA ABLOY), NXP Semiconductors, authorised smart card distributors in UAE, Apple, or Google. We do not hold SIRA (Dubai), ISO 27001, NESA, ADHICS, or PDPL certification.
- Geographic scope is Abu Dhabi and Al Ain only for ADMCC-regulated electronic security work. We do not operate a 24/7 SOC or perform managed security services off-site.
- All credential and reader hardware is supplied through authorised UAE distribution channels with manufacturer warranty intact.
A successful anti-clone project is judged by what is no longer in circulation. We document every retired prox credential, every replaced reader, and every new encrypted credential so the site has a defensible audit trail of the migration.
Common questions
FAQs
Why are 125 kHz proximity cards considered clonable?
Legacy 125 kHz technologies — HID Prox, EM4100, and similar — transmit a fixed identifier with no cryptographic challenge-response. A handheld copier costing under a few hundred dirhams can read and write that identifier to a blank card in under ten seconds, producing a functional duplicate. Migrating to MIFARE DESFire EV2/EV3 or HID iCLASS Seos replaces that fixed-ID model with AES-128 mutual authentication.
Do we have to replace every reader at the same time?
No. We use a staged dual-reader transition. Where appropriate, transitional readers accept both legacy prox and the new encrypted credential, so existing cardholders keep working access while new credentials are issued by department or zone. Once issuance is complete, legacy prox is decommissioned in the access control database and any remaining prox-only readers are replaced with firmware-current units such as HID Signo or ZKTeco D-series.
Is Emirtech a Channel Partner or Authorised Distributor of HID Global or NXP?
No. Emirtech is an ADMCC-approved electronic security contractor and a Control4 installer working with a third-party authorised dealer. We are not a Channel Partner or Authorised Distributor of HID Global (ASSA ABLOY), NXP Semiconductors, Apple, or Google. We install and configure DESFire, iCLASS Seos, Crescendo, MIFARE Plus, and mobile credentials commercially via authorised UAE distribution channels with manufacturer warranty intact.
Are mobile credentials more secure than physical smart cards?
Mobile credentials on HID Mobile Access, Apple Wallet, or Google Wallet are cryptographic by design and benefit from the device secure element, making the cloning vector that targets 125 kHz prox effectively irrelevant. They are not automatically more secure than a correctly configured DESFire EV3 or Seos card, but they remove the physical-card duplication risk and let credentials be revoked instantly through the management platform.
Do you perform credential cryptanalysis or penetration testing of card security?
No. Emirtech is not a cryptanalysis firm. Our role is to install, configure, and stage migration of credential platforms supplied through authorised UAE channels. We do not reverse-engineer credentials, recover keys, or perform offensive security testing against card cryptography. Sites requiring formal cryptographic assurance should engage a specialist security testing firm in addition to the installation work we deliver.
How do we request a quote for an anti-clone migration?
Call +971 55 651 7843, email [email protected], or request a free anti-clone consultation via our online form. We will arrange a site credential audit at M44, Mussafah Industrial Area, Abu Dhabi or at your premises across Abu Dhabi and Al Ain, then issue a written proposal with platform selection, staged cutover plan, and pricing.
Anti-Clone Smart Card · Abu Dhabi
Talk to an Abu Dhabi specialist
Free site survey · transparent scope · honest costs · ADMCC-approved for security systems · Mussafah M44 home base since 2018.
Need a free Abu Dhabi site visit? Call +971 55 651 7843 or email [email protected] — we reply the same working day across Abu Dhabi and Al Ain.