Abusing RFID Access Controls for Fun and Profit
Part 1 – An Approach to Testing RFID Controls
One of the fun things to test during a physical pentest is RFID access controls. RFID badge/reader systems are all over, controlling access to parking lots/structures, office buildings and other restricted areas. Two popular methods of gaining unauthorized access are
- Spoofing RFID tags
- Brute forcing RFID tages
RFID Basics
A quick refresher on RFID. RFID technology has existed since the early 1970’s and has gained widespread adoption in inventory tracking and access control mechanisms as well as other applications. RFID is an Automatic Identification and Data Capture (AIDC) technology that can operate without the need to have line of sight, like older barcode systems. And by design RFID tags can hold more data and thus be more valuable to its user base, than typical barcode systems.
As with other wireless technologies, RFID tags consist of an integrated circuit and an antenna and can be either active or passive. Active RFID tags usually have some type of battery and are used to track significant subjects, such as patients in hospitals, or used to be tracked from a further distance. Passive RFID tags on the other hand are more popular, used for tracking and access control and typically do not contain batteries, relying instead on receiving power transmitted by the RFID reader’s signal. Additionally there are different frequency ranges these systems use; low, high, and ultra-high frequency RFID systems can be found in use all over. The more common ones we’ll look at are the more popular RFID tags used with older, low frequency technologies, as well as ones using newer high frequency technologies.
|
Common Badge Frequency/Ranges
|
|
Low Frequency (LF) 120–150 kHz
|
|
High Frequency (HF) 13.56 MHz (ISO/IEC 14443)
|
Badge Basics
There are a variety of badges out there today used for access control such as:
- Magnetic
- Wiegand
- LF Prox
- MIFARE
- HF iClass
Our focus in this article will be on the following cards:
- Low frequency Proxcard II
- High frequency Mifare
 |
| Proxcard II Low Frequency RFID card. |
The HID Proxcard II is a low frequency near-proximity card that uses frequency-shift keying modulation at 125kHz. It is a hard, clamshell style card that can fit easily in a wallet, pocket, or attached to a badge holder for visible identification.
 |
| Mifare Classic High Frequency RFID Card |
Mifare is an example of a high frequency (ISO/IEC 14443 A/B) card that operates at 13.56MHz, with either 1kB or 4kB memory. These cards are quite common and seen in use with public transportation (train passes, highway tolls, etc.) in addition to access control badges.
The card is, as it sounds, the device identifying a user to an access control system. The card contains some binary code identifying itself as an authority to access restricted resources.
The reader facilitates communication between the user (card) and access controller, and can only authenticate specific card types (a Proxcard will require a Proxcard reader) since the technologies behind each are different.
The access control panel (controller) will grant access to a card read by a reader based on data that would legitimize the transaction. This data would include data length, format structure, facility & site codes, card #, and access date/time info. The controller is the single point at which data is encoded/decoded for access control, and where access is granted or denied.
The user interface/host is an administrative function where cardholders are added/removed, privileges assigned, where devices and access control to areas are setup. Reporting, auditing etc. of these functions also reside here.
Required Equipment
We’ll need a few tools to emulate an RFID client (badge) and capture data between the client and associated reader. For the purposes of this case, we’ll need:
- RFID Tag Reader
- Antenna
- Client Software
RFID Tag Reader
The first thing we’ll need is an RFID reader to allow us to sniff/replay RFID to simulate a legitimate RFID tagged client. There are many readers on the market to choose from, we’ll focus on the Proxmark 3, due to its popularity and community based development. The Proxmark3 also supports the popular 125kHz, 134kHz, & 13.56MHz frequencies we’ll be looking at.
 |
| Proxmark3 with enclosure |
The Proxmark3 is a small RFID/NFC device that can sniff and replay RFID (and by doing so, we can read and clone RFID tags).
There is a mini 5-pin USB port that provides power to the device via USB (computer or external battery), and another USB port to connect an antenna.
Antenna
There are two types of antennas that will be required, depending on the badge type being analyzed:
- Low Frequency (LF)
- High Frequency (HF)
The low frequency PCB antenna used in this article, available from the Proxmark3 site (http://www.proxmark3.com) was designed for use with the Proxmark3 device and will operate on both 125kHz and 134kHz. It will read RFID tags at a distance of up to 4cm.
 |
| Low Frequency Antenna |
The high frequency PCB antenna, also from Proxmark3, will read RFID tags at 13.56mHz and according to the site “… is capable of snooping the UID of a Mifare 1k classic card at a distance of 3cm”. There is a switch on top of the antenna that can be changed from 100pF to 47pF, depending on the capacitor. Running commands from the client will display the voltage and let the user know if the switch needs to be changed.
 |
| High Frequency Antenna |
Client Software
The client software provided for use with the Proxmark3, and therefore used in this post is version r651 (this article uses Windows for the client computer). The compressed file downloaded from the website contains the software and necessary drivers required.
Connect the Proxmark3 to your computer and watch the LEDs on the device light up. From the command line, launch ‘proxmark3.exe’, and let the client recognize the device. You should see ‘Connected units:’ with the device listed below.
The client utility has a wide variety of commands that can be used, but two of the first ones we’ll look at are ‘hw version’ and ‘hw tune’. The ‘hw’ command, as probably guessed, is used for all hardware related issues. The ‘version’ command addition will output the firmware version, which is useful when troubleshooting. The ‘tune’ command will check the voltage of the attached antenna to ensure it is recognized and ready for use. So long as the voltage is 12V or higher for 125kHz and 7V or higher for 13.56mHz, it should be ready to read RFID tags.
The Proxmark III will display a green LED while the device checks the voltage of the antenna. The client will also show the antenna that is not attached as ‘unusable’.
At this point we are ready to begin RFID tag sniffing.
