Abusing RFID Access Controls for Fun and Profit
Part 2: Spoofing LF RFID Tags
Continuing from Part 1
So now the equipment is setup, it’s time to play with LF. This post looks at reading/replaying low frequency RFID tags to simulate the common low frequency proximity badge access cards (proxcards). Pentesters will likely find a badge/reader system, and require a methodology to identify it, sniff and replay communications. The assumption is made that you can access a badge access card, either directly or within close proximity.
Low frequency proximity badge access cards, like the Proxcard II, will require the LF antenna to be connected to the Proxmark3. Ensure the antenna is connected and measuring correct voltage with the ‘hw tune’ command’. Since the Proxcard II is a HID type card, we’ll focus on that.
1. Issue the command ‘lf hid fskdemod’ and hit enter. This command will conduct real time FSK (Frequency Shift Keying) demodulation on low frequency HID RFID tags.
2. Pass the proxcard in front of the antenna, and watch the proxmark client interface for RFID tag ID output. Once the Proxmark3 detects the RFID tag, LED lights on the card will start blinking, and the Proxmark client will display the identified tags. The client will continue to output the identified tag so long as the card is within field of range until the button on the Proxmark3 device is pushed.
 |
| Identified LF RFID Tags |
The above picture shows the captured tags (default test card from Proxmark3 used): 2006e2316b. Now with the captured LF tag, we can replay this to the RFID badge reader.
Using the command ‘lf’ again with ‘sim’, we can simulate the tag as follows: ‘lf sim 2006e2316b’. This command will send the specified RFID tags out from the Proxmark3 until the button on top of the Proxmark3 is pressed (a yellow LED will be visible on the device while the tags are being replayed).
This ability to read and replay tags would be of value to a pentester looking to illustrate how easy it is to bypass some RFID access control implementations.
An Alternative Setup: Stand-alone Mode
It is important to note that this is showing how to use the software and equipment in a standard configuration. For a penetration tester, lurking around badge readers with an obnoxious PC is probably not the stealthy technique. Enter ‘stand-alone mode’. By using an external portable USB charger, the Proxmark3 can operate in a stand-alone mode operating a little stealthier without requiring a PC.
Proxmark3 has a user guide (
http://proxmark3.com/dl/PM3-UserGuide-r486.pdf) with some information on stand-alone mode. The user forums (and of course your favorite search engine) will provide more info. Essentially the steps are as follows:
- Disconnect the Proxmark from the PC, and plug in an external power source (battery).
- Identify the target proxcard to clone tags from.
- Hold the button on the Proxmark3 for a couple of seconds until a red LED lights up.
- Releasing the button, repeat the process until a second red LED lights up.
- Hold the antenna close to the target proxcard until the 2nd red LED turns off (indicating the RFID tag was captured)
- Hold the button down until a green LED lights up (there should be one red, one green), pass the antenna in front of the badge reader to authenticate
