2019 - Kaydan/Pips

### Overview In this presentation delivered at SaintCON, security engineer and former access control architect Pips (also known as Caden / Kaydan) examines how enterprise Radio Frequency Identification (RFID) access control systems operate, their common architectural weaknesses, and practical exploitation methods. Drawing on professional experience retrofitting and auditing physical security systems, the speaker demonstrates how unencrypted low-frequency card data and sequential issuance patterns expose facilities to badge cloning, proximity skimming, and brute-force attacks, while concluding with defensive measures.

### Key Topics - **RFID Fundamentals & Form Factors:** RFID functions as short-range, typically powerless one-way communication where an energized reader coil powers a passive card's chip and antenna. Common implementations span low-frequency HID clamshell cards, thin printable badges, medallions, wristbands, zip ties, laundry fabric tags, tracking nails, vehicle tags, and subdermal glass implants. - **Access Control Data Structure:** Typical low-frequency credentials (e.g., standard HID) transmit minimal plain data to a controller: format length, facility code, and card/serial number. Systems often issue cards sequentially from factory boxes, meaning all authorized cards share a single facility code and adjacent serial IDs. - **Cloning and Emulation:** Devices such as the Proxmark3 can read existing badges, write credential payloads to blank rewritable cards, or directly emulate valid credentials at a reader without needing physical cards. - **Brute-Force Exploitation:** Because facility codes remain static across an organization and card numbers increment sequentially, obtaining an inactive or low-privilege credential (or buying a terminated employee's card) allows an attacker to discover the facility code. An automated tool like the Proxmark3 can then cycle through neighboring card numbers until a valid match triggers the physical door latch.

### Technical Details - **Targeting and Reconnaissance:** In a red teaming scenario, attackers perform open-source intelligence (OSINT) on social media platforms (such as Twitter or Instagram geotag searches for terms like "new badge") to identify badge artwork, layouts, employee names, and security features (e.g., magnetic stripes, holograms). Physical targeting takes place in high-density or close-quarters areas like public transit, elevators, smoking areas, and cafes. - **Skimming Mechanisms:** Concealed antennas or long-range readers hidden in satchels, messenger bags, or gloves allow attackers to skim badge data unnoticed during casual bumps or close passes. - **Brute-Force Trade-offs:** While access control controllers typically lack rate-limiting or anti-brute-force controls, brute-forcing at a reader is noisy (audible beeps, mechanical clicking) and can be spotted on centralized monitoring dashboards. Furthermore, an attacker operating blindly may trigger access alarms by guessing the ID of an already badged-in employee (violating passback/stage-badging rules) or an alarmed terminated employee.

### Takeaways - **Layered Authentication:** Organizations should not rely on simple low-frequency RFID cards as a sole authentication factor. PIN pads, two-factor authentication, physical keys, or guard-assisted verification should supplement electronic access. - **Operational & Physical Defenses:** Employees should use RFID-blocking sleeves or wallets during non-use hours (as badges are only needed for seconds each day). Organizations should institute strict in-sight badge policies that prohibit wearing credentials off-premises. - **Visual & Human Verification:** Access control management software should display registered badgeholder photos to front-desk guards upon badging to prevent impersonation, and staff should be trained in friendly verification to question unbadged visitors.