Introduction to RFID

The talk starts with everyday RFID, from key fobs for apartments and offices to transit cards and tap-to-pay. A tag has no battery. It is powered by the reader's field through tightly wound coils that work like a transformer, and it answers with data sent as small magnetic pulses. Because that exchange is unencrypted, a homemade coil and breadboard setup is enough to sniff it.

The speaker then explains challenge-response authentication, where reader and tag prove they hold the same key without sending it. The cautionary example is a published weakness in HID iClass readers that used shared keys across deployments. Once those keys leaked online, cloning became easy. The lesson is that strong cryptography fails when vendors take shortcuts and owners never change default keys. A long-range reader at the village collected and displayed the IDs of passing fobs to show how exposed plain identifiers are.

The demonstration covered the tools: a Proxmark 3 for research across low and high frequency, and a Flipper Zero for portable 125 kHz work, with Keysy-style devices mentioned as alternatives. Live, the speaker read a 125 kHz fob, emulated it to open a reader, and tried copying an ID to a rewritable tag. A write to a protected tag failed, and a fuzzer then cycled through common default values against a reader. Practitioners should check for default credentials, enable lockouts on repeated failures, and keep credentials and firmware current.