Your Smartcard Is Dumb: A Brief History of Hacking Access Control Systems
Examines how physical access control systems and smartcard readers operate, detailing high-profile flaws and fundamental design vulnerabilities.
Summary
Physical Access Control Architecture
Physical access control systems rely on card readers, controllers, and electronic locking mechanisms to secure physical spaces. When a credential card is tapped against a reader, specific identifying data is transmitted, processed, and evaluated to trigger door unlock mechanisms.
Mechanisms and Reader Interactions
Card readers interrogate RFID and smartcard credentials to extract badge IDs and access codes. The communication between the card, the reader interface, and the backend controller introduces distinct points of exposure across the physical infrastructure.
High Profile Access Control Exploits
Numerous high-profile vulnerabilities afflict widely deployed access control systems. Architectural weaknesses in legacy credential formatting and transmission protocols allow attackers to bypass door controllers and compromise physical entry points.
Design Flaws and Mitigation Strategies
Fundamental design assumptions in popular access systems frequently fail to provide adequate tamper resistance or cryptographic verification. Upgrading to modern authenticated credentials and supervised reader wiring mitigates common badge cloning and replay attacks.
Related talks
Creator Stage·27 min
Joshua Herman
Demonstrates how smartphone apps can easily reprogram unprotected e-ink RFID badges to alter both the visual display and embedded credentials.
Creator Stage·21 min
Ege Feyzioglu · Andrew M
Explains RFID badge and reader communications, demonstrating cloning and brute-force techniques using Proxmark, Flipper Zero, and Keysy.
Main Stage·17 min
Xavier Zhang
Flaws and mutual authentication bypasses in commercial physical access control readers, controllers, and communication protocols.