Julia Zduńczyk: Hacking Access Control Systems | CONFidence 2023

### Overview In this talk presented at CONFidence 2023, Julia Zduńczyk, a penetration tester and red teamer at SecuRing, explains how physical RFID access control systems are targeted and compromised during red team engagements. While highlighting that basic physical bypasses (such as door shimming with plastic cards or coat hangers) should be addressed first, the core focus of the session is examining RFID vulnerabilities, demonstrating cloning techniques using tools like Proxmark, and detailing an end-to-end physical kill chain from low-privilege badge theft to server room compromise.

### Key Topics - **Physical vs. RFID Access**: Emphasizing that basic door integrity checks should precede investments in expensive RFID security solutions. - **RFID Fundamentals**: Differentiation between low-frequency (LF) and high-frequency (HF) systems, how passive tags draw power from the reader's electromagnetic field, and identifying frequencies with detector devices. - **UID-Only Access Systems**: The risks associated with systems that validate access purely via static Factory UIDs, decimal numbers printed directly on cards, or predictable sequential UIDs issued to employees. - **MIFARE Classic & Cryptographic Failures**: Vulnerabilities inherent in MIFARE Classic cards, including standard/default sector keys (e.g., `FFFFFFFFFFFF`) and broken proprietary ciphers (Crypto-1). - **The Red Team Lifecycle**: Practical methodologies divided into observation, preparation (selecting antennas, concealing equipment), and execution (social engineering, surreptitious badge scanning).

### Technical Details - **Card Scanning and Cloning Tools**: The speaker demonstrates the Proxmark device connected via USB and operated in standalone mode with an external power bank and custom concealed antennas hidden inside paper document folders. - **MIFARE Exploitation**: Demonstrating automated multi-attack tooling that executes default dictionary checks followed by cryptographic attacks such as the Nested attack and Darkside attack to recover non-default keys and dump sector data. - **Case Study Kill Chain**: 1. *Observation*: Identified an HID MiniProx LF reader, noticed employees leaving cards unattended in an accessible dining area, and observed staff carrying badges on neck lanyards. 2. *Scanning*: Used a concealed Proxmark inside a document folder to scan an unattended card and a cleaning worker's badge via pretexting ("lost umbrella"). 3. *UID Analysis & Brute Forcing*: Identified sequential UIDs (~500 apart). Found a staircase reader out of camera range to brute-force valid UIDs, discovering 20 active card numbers in roughly 30 minutes. 4. *Reconnaissance & OSINT*: Tested discovered UIDs at a badge-authenticated office printer that displayed the user's full name upon login. Cross-referenced the names via OSINT to locate a network administrator's badge number. 5. *Access*: Cloned the administrator's UID onto a writable badge to open the server room door.

### Takeaways Securing physical access requires defense-in-depth across technology and personnel: - **Proper System Architecture & Hardening**: Avoid UID-only access; implement modern cards supporting strong encryption (such as MIFARE DESFire with AES), ensuring the system is actively configured to enforce encryption rather than falling back to unauthenticated modes. - **Multifactor Authentication (MFA)**: Require two-factor authentication (PIN pads or biometrics) for sensitive zones like server rooms. - **Auditing & Monitoring**: Log badge activity and set alerts for anomalous access attempts, sequential scanning bursts, or abnormal access hours (time-based policies). - **Human & Physical Factors**: Employee security awareness to prevent leaving cards unattended on tables or in locks, and distributing anti-RFID protective card holders.