Flipping Locks: Remote Badge Cloning with the Flipper Zero and More
Details custom hardware designs and social engineering tactics to remotely clone RFID access badges from a distance, including HID iClass SE downgrade attacks.
Summary
Limitations of Traditional RFID Badge Cloning
Standard RFID badge cloning typically requires close physical proximity (under three feet) to a target individual. In modern hybrid work environments with reduced office foot traffic, close-range cloning becomes logistically difficult for physical red teams.
Long-Range and Standalone Hardware Implants
Custom hardware implants—such as high-gain gooseneck readers, hidden wall devices, and modified clipboards—allow operators to capture RFID credential data at extended distances without direct physical interaction with targets.
HID iClass Downgrade and Legacy Attacks
Many physical access control systems configured for HID iClass SE or SEOS maintain backwards compatibility with legacy credential formats. Operators exploit these compatibility modes to execute downgrade attacks that capture cloneable legacy badge identifiers.
Countermeasures for Facility Defense
Hardening access control perimeters requires disabling legacy credential compatibility on badge readers, deploying encrypted OSDP wiring, and monitoring reader tamper alerts to detect unauthorized hardware implants.
Related talks
Creator Stage·37 min
Bobby Graydon · Ege Feyzioglu
Explains how elevator floor lockouts function and how improperly configured elevator controllers and hoistways can be bypassed to access restricted floors.
Creator Stage·22 min
Bill Graydon
Demonstrates physical entry bypass methods that defeat secured doors using egress and access control hardware flaws without picking locks.
Creator Stage·14 min
Terry Luan · Karen Ng
Covers advanced physical security bypass techniques that exploit door latch mechanisms, egress sensors, and access control hardware.