Unlocking RFID Security: A Deep Dive into Flipper Zero and the Vulnerabilities of Multiclass

The talk examines HID's iClass family of RFID access control, which moved from basic low-frequency cards through iClass Elite to iClass SE. The speakers walk through how each generation handles keys and authentication, and how weaknesses in the older designs, including research published in the "Heart of Darkness" paper, carried into systems still in use. Many installations also keep older card formats active for compatibility, which matters later in the talk.

The core demonstration is a downgrade attack. Multiclass readers authenticate every card type in much the same way, so a card can be presented in its weakest format. Using Unleashed firmware on a Flipper Zero, the serial number and facility code can be captured and the credential recast as a 26-bit low-frequency card, where the facility code can be brute forced. For Elite readers, responses captured from the reader can be used to recover the site's high-security key. For SE cards, the secure access module keeps the keys out of reach, but a key set that has leaked can still decrypt the identity object and reissue the access payload as a standard Pico Pass card. The speakers stress that tooling now makes these steps simple enough that the deep hardware knowledge once required is no longer needed.

The takeaways are that the access control payload is the main thing readers verify, that facility codes and card numbers offer little protection on their own, and that mixed-mode deployments drag the whole system down to its weakest format. Suggested mitigations include using only readers that run the standard key set two, checking the vendor spreadsheet to confirm which key set each reader uses, layering controls such as guards or multi-factor checks, training staff to watch for suspicious scanning, and using RFID-blocking sleeves.