Badge of Shame: Breaking into Secure Facilities with OSDP
Dan Petro and David Vargas disclose over a dozen cryptographic and implementation flaws in the Open Supervised Device Protocol (OSDP) securing physical access control.
Summary
The Migration from Wiegand to Encrypted OSDP
Physical access control systems are rapidly replacing unencrypted legacy Wiegand wiring with the Open Supervised Device Protocol (OSDP) to encrypt communications between badge readers and controllers.
Cryptographic Pitfalls and Implementation Blunders in OSDP
Dan Petro and David Vargas uncover systemic design oversights, including flawed AES key exchange routines, plaintext fallback modes, and predictable keystreams.
Constructing In-Line Hardware MITM Interceptors
The authors present a low-cost physical pentesting tool that can be spliced behind wall-mounted RFID badge readers to passively sniff master keys and inject door-unlock commands.
Hardening Physical Access Control Networks
Remediating OSDP deployments requires disabling insecure installation modes, enforcing strict cryptographic pairing profiles, and monitoring serial bus impedance.
Related talks
Main Stage·17 min
Xavier Zhang
Flaws and mutual authentication bypasses in commercial physical access control readers, controllers, and communication protocols.
Main Stage·1 hr 17 min
Reza Javadi · Simon Levy · Aaron Draffe
Full reverse engineering of HID's iCLASS SE chain of trust and extracting master cryptographic keys from CC EAL 5+ secure elements.
Main Stage·20 min
Miana E. Windall · Micsen
Miana Windall and Micsen investigate offline RFID access control systems, demonstrating how to forge cryptographic card data to create universal digital skeleton keys.