Psychic Paper: Making E-Ink Access Badges Accessible for Anyone
Demonstrates how smartphone apps can easily reprogram unprotected e-ink RFID badges to alter both the visual display and embedded credentials.
Summary
E-Ink Access Badge Architecture
Modern electronic access badges incorporating e-ink displays allow users to update printed credentials digitally. These badges combine low-power e-ink screens with integrated RFID chips for physical access authentication.
Smartphone Reprogramming Vulnerabilities
Vendors supply smartphone applications to update the e-ink graphic display and configure badge credentials. However, many commercial e-ink badges implement zero cryptographic authentication or access restrictions.
Cloning and Credential Modification
Using publicly available smartphone applications, an attacker can overwrite the display graphics and reprogram RFID payload data, effectively transforming the badge into arbitrary credentials for unauthorized facility access.
Security Considerations for Visual and RFID Badges
Deploying smart access badges securely requires enforcing mutual authentication and cryptographic signing on all wireless programming interfaces to prevent unauthorized visual and digital tampering.
Related talks
Creator Stage·53 min
Chad Shortman
Examines how physical access control systems and smartcard readers operate, detailing high-profile flaws and fundamental design vulnerabilities.
Creator Stage·21 min
Ege Feyzioglu · Andrew M
Explains RFID badge and reader communications, demonstrating cloning and brute-force techniques using Proxmark, Flipper Zero, and Keysy.
Main Stage·17 min
Xavier Zhang
Flaws and mutual authentication bypasses in commercial physical access control readers, controllers, and communication protocols.