Abusing RFID Access Controls for Fun and Profit – Below the Attack Surface: Security Research for Fun and Profit

April 15, 2016

Physical Security: Abusing RFID Access Controls for Fun and Profit (1/3)

Part 1 – An Approach to Testing RFID Controls One of the fun things to test during a physical pentest is RFID access controls. RFID badge/reader systems are all over, controlling access to parking lots/structures, office buildings and other restricted… Continue reading

April 18, 2016

Physical Security: Abusing RFID Access Controls for Fun and Profit (2/3)

Part 2: Spoofing LF RFID Tags Continuing from Part 1So now the equipment is setup, it’s time to play with LF. This post looks at reading/replaying low frequency RFID tags to simulate the common low frequency proximity badge access cards… Continue reading

May 17, 2016

Physical Security: Abusing RFID Access Controls for Fun and Profit (3/3)

Part 3 – Brute-Forcing LF RFID Systems Next up, privilege escalation via a brute-force key attack: In a situation where you have captured an RFID tag, it may be possible to leverage that tag to escalate privileges and gain… Continue reading