RFID 101
Explains RFID badge and reader communications, demonstrating cloning and brute-force techniques using Proxmark, Flipper Zero, and Keysy.
Summary
Principles of RFID Access Systems
Radio Frequency Identification (RFID) systems operate across low-frequency (125 kHz) and high-frequency (13.56 MHz) bands to exchange identification tokens between access badges and fixed wall readers.
Reader and Badge Communication Dynamics
Interrogator coils energize passive RFID transponders via electromagnetic induction, prompting the transponder to transmit its encoded facility code and credential ID.
Tooling for Badge Cloning and Emulation
Security researchers utilize hardware tools including Proxmark3, Flipper Zero, and Keysy to sniff transmissions, clone legacy access cards, and emulate credentials in real time.
Brute Force Attacks and Access Mitigations
Unencrypted legacy formats allow attackers to brute-force valid badge numbers against readers. Transitioning to cryptographically signed credentials and mutual authentication prevents unauthorized badge duplication.
Related talks
Creator Stage·53 min
Chad Shortman
Examines how physical access control systems and smartcard readers operate, detailing high-profile flaws and fundamental design vulnerabilities.
Creator Stage·27 min
Joshua Herman
Demonstrates how smartphone apps can easily reprogram unprotected e-ink RFID badges to alter both the visual display and embedded credentials.
Main Stage·17 min
Xavier Zhang
Flaws and mutual authentication bypasses in commercial physical access control readers, controllers, and communication protocols.