All your badge are belong to me

The talk looks at radio-frequency identification badges used in building access control, a technology whose weaknesses have been documented for years yet still appear in new installations. The speaker, a penetration tester, explains how readers, controllers and management servers fit together, and why a compromise of one badge or of the management software can expose the whole system.

The core of the talk is a set of field findings. Older MIFARE Classic cards were protected by factory-default keys that were reused across many customers, so one key list could dump cards from unrelated buildings. Some systems rely only on the card's unique ID, which is easy to read and copy. Guest and PIN handling was often weak, management interfaces were found exposed to the internet with default credentials, and the link between reader and controller was shown to be open to replay. Physical tests included a temporary office where found badges were cloned, and a master card kept in a simple key box that anyone could open.

The closing sections turn to why insecure systems keep being bought. Procurement that focuses on price, and installers who lack protocol knowledge, both play a part, and upgrading often means replacing readers, controllers and servers. The practical takeaways are to never use default keys, avoid ID-only credentials, write security requirements into tenders, and prefer newer encrypted card types.