Physical Security is not sexy which is bad for organizations and good for red teams

The talk opens with the argument that organizations neglect physical security and tend to hand the job to security integrators, whose business incentives often favor cheap, fast installs over careful configuration. The speaker, who has installed, serviced and sold access control systems for over a decade, describes weak spots he has encountered in the field. These include door contacts that a magnet can defeat, alarm keypads left on the installer's default code, legacy Wiegand wiring and 125 kHz cards that can be copied, and Bluetooth readers that broadcast credentials and can be located with ordinary phone apps.

The middle section moves to demonstrations using the stock Flipper Zero firmware and an RFID reader. These show how card technology can be identified, how facility codes and card numbers can be read and guessed within a site's range, and how badges can be emulated. The speaker also covers card serial numbers that are stored in plain text, and request-to-exit buttons and motion sensors that can be triggered from outside with simple tools when they are not on a schedule.

The closing advice is aimed at blue teams, facilities staff, IT, business owners and customers. Organizations should take ownership of their access control systems and passwords, move to encrypted credentials such as DESFire, turn off Bluetooth where it is not needed, schedule request-to-exit sensors to business hours, link sensitive doors to cameras, and audit card access regularly.