No Entry - Badge Access Denial on Demand

The talk starts from the premise that badge readers are often treated as an infallible second factor for physical entry. The speaker, a former Army radio operator, frames the problem as one of distance and timing: standard NFC readers work only within a few centimeters and expect fast, tightly timed exchanges. He gives a short primer on electromagnetic induction, the ISO 14443 and 15693 standards, and the Wiegand and OSDP links between readers and access controllers, then explains why range is the weak point.

The middle section walks through a homemade long-range rig assembled from inexpensive parts: a small FPGA board for carrier generation, an ESP32 to form frames, a hand-wound single-turn copper antenna, and a improvised amplifier. The speaker claims the setup reaches roughly six feet and says the reader's timing can be sidestepped by sending responses ahead of time. He describes two effects: flooding the field so legitimate cards fail, and presenting many card identifiers at once to overwhelm readers and the staff watching them.

For defenders, the takeaways are practical. A failed reader should not silently fall back to a weaker check that a guard can wave people through. Suggested measures include a second reader or antenna that flags out-of-place activation, RF noise monitoring, a secondary entry verification method, and periodic red-team tests of the facility.