Digital Skeleton Keys: Spoofing Offline RFID Access Control Systems
Miana Windall and Micsen investigate offline RFID access control systems, demonstrating how to forge cryptographic card data to create universal digital skeleton keys.
Summary
The Trust Architecture of Offline RFID Locks
Offline electronic locks do not maintain real-time network connectivity, relying entirely on the cryptographic data stored inside RFID keycards to make access decisions.
Reverse Engineering Offline Card Formats
Miana Windall and Micsen dissect proprietary card data structures, discovering replay weaknesses, weak cryptographic keys, and unauthenticated sector data.
Forging Master Key Credentials and Time Stamps
The speakers demonstrate modifying expiration timestamps, room permissions, and site codes to forge functioning master digital skeleton keys on blank Mifare cards.
Remediation for Facility Managers and Manufacturers
The authors recommend modern cryptographic lock architectures, rolling dynamic challenge-response protocols, and regular key blacklist updates.
Related talks
Main Stage·17 min
Xavier Zhang
Flaws and mutual authentication bypasses in commercial physical access control readers, controllers, and communication protocols.
Creator Stage·53 min
Chad Shortman
Examines how physical access control systems and smartcard readers operate, detailing high-profile flaws and fundamental design vulnerabilities.
Creator Stage·27 min
Joshua Herman
Demonstrates how smartphone apps can easily reprogram unprotected e-ink RFID badges to alter both the visual display and embedded credentials.