Clone to Pwn - Remote Badge Cloning with the Flipper Zero

The presenters, both physical red team consultants, open with a problem they see on engagements: traditional badge cloning needs the tester to stand close to an employee, which is hard when fewer people come into offices. Their answer is to rely on low-frequency 125 kHz proximity cards, which they say remain common and are still copied in seconds. They frame badge cloning as the first step of a larger physical test.

The middle of the talk covers hardware. They describe a wall-mounted implant built from a used reader, a small ESP-based RFID logger and battery packs, with no soldering needed. A longer-range gooseneck-style version sits near a building entrance or a bin and captures credentials as people walk past. The logger exposes captured data over Wi-Fi, so the operator can wait in a car and retrieve it. They also note that two low-frequency readers placed close together block each other, which can be used to redirect people to a different door. Next they walk through turning captured binary into a facility code and card number, and they introduce a Python helper that converts Proxmark hex into the format a Flipper Zero accepts. The credential can then be emulated or written to a blank card.

The closing section shares field stories, including a reader that was removed and later handed to police, a keylogging attempt at a front desk, and pretexts built on branded clothing. The takeaway is that low-frequency badges offer little protection, and that physical controls should be tested alongside the badges themselves.