Unlocking Doors from Half a Continent Away
Demonstrates long-distance relay attacks against ISO 14443A and HID SEOS contactless credentials, unlocking a physical door in Ottawa from a stage in Las Vegas.
Summary
Weaknesses in Contactless RFID Timing Windows
Contactless smartcard protocols rely on proximity assumptions, but protocol timing tolerances often allow communications to be relayed over long-distance network connections.
Deconstructing ISO 14443A and HID SEOS Relays
Trevor Stevado and Sam Haskins analyze timing parameters in the ISO 14443A standard that permit packet forwarding across moderate-latency internet links without triggering reader timeouts.
Live Long-Distance Door Unlock Demonstration
Using custom Proxmark firmware and network bridging software, the presenters execute a live relay attack, presenting a badge in Las Vegas to unlock an HID SEOS door lock located in Ottawa.
Defensive Architecture and Reader Mitigations
Mitigating contactless relay attacks requires configuring strict protocol timeout thresholds, implementing multi-factor authentication, and adopting location-aware mobile credentials.
Related talks
Main Stage·36 min
Christopher Wade
Demonstrates NFC tag-side attacks that manipulate reader-side applications via malformed tag responses and relay injection.
Main Stage·32 min
Christopher Wade
Christopher Wade examines this talk covers tag-side attacks against NFC communication protocols, including cracking of Mifare encryption keys and performing targeted attacks against NFC readers.
Main Stage·20 min
Bughardy · Eagle1753
Bughardy and Eagle1753 reveal how to exploit the lockbyte sector on unencrypted MIFARE Ultralight RFID transit cards to bypass one-time programmable (OTP) decrement counters.