These are the slides from my HOPE 2022 talk that presented just enough background and practical knowledge that a person could get started (or at least know where to start) cloning RFID tags, keys, and rings.

1. Just enough RFID cloning
to be dangerous
Gabe Schuyler
@gabe_sky
HOPE 2022

2. Gabe Schuyler HOPE 2022 @gabe_sky
About me
• Austin, TX
• Long-time operations person
• Newly working in cybersecurity
• Tinkering, lock picking, and social change
@gabe_sky

3. Gabe Schuyler HOPE 2022 @gabe_sky
How I got here
• Motorcycle
• Garage access
• Gloved hands
• Clutch & Throttle
• Clumsy & Error-prone

4. Gabe Schuyler HOPE 2022 @gabe_sky
Also how I got here
• Hotel keys -- hundreds of them
• Date and duration
• Room number
• (And city, for funsies)

5. Gabe Schuyler HOPE 2022 @gabe_sky
Passive RFID
• A
fl
ashlight to send
• A mirror to reply

6. Gabe Schuyler HOPE 2022 @gabe_sky
Frequencies
• Low frequency
• 125 kHz
• Dumb
• High frequency
• 13.56 MHz
• Smarter

7. Gabe Schuyler HOPE 2022 @gabe_sky
Low frequency
• 125 kHz
• Just reply
• Readers just read
• Think barcode or magstripe
• Harder to block

8. Gabe Schuyler HOPE 2022 @gabe_sky
High frequency
• 13.56 MHz
• Do some math
• Readers can update
• Think system on a chip
• Easy to block

9. Gabe Schuyler HOPE 2022 @gabe_sky
Chips
• Low frequency
• EM41xx
• T55xx chips
• High frequency
• HID iClass
• MIFARE Classic

10. Gabe Schuyler HOPE 2022 @gabe_sky
Data formats
• ISO 14443
• HID
• Indala

11. Gabe Schuyler HOPE 2022 @gabe_sky
Form Factors
• Cards
• Fobs
• Stickers
• Injectable
• Rings

12. Gabe Schuyler HOPE 2022 @gabe_sky
Equipment
• Blue "cloner of doom"
• All-in-one ( iCopy-X and friends )
• Proxmark 3
• Rewritable low frequency
• Chinese "Magic" high frequency

13. Gabe Schuyler HOPE 2022 @gabe_sky
Copying a building
access tag
• Low frequency
• Dump facility code and card number
• Clone

14. Gabe Schuyler HOPE 2022 @gabe_sky
Copying a hotel
room key
• High frequency
• Get tag UID
• Dump binary data
• Break encryption
• Write

15. Gabe Schuyler HOPE 2022 @gabe_sky
RFID Blockers
• Low frequency or high frequency?
• Paper and fabric
• Active interference
• Random crap

16. Demo time!
Gabe Schuyler HOPE 2022 @gabe_sky

17. Gabe Schuyler HOPE 2022 @gabe_sky
Other junk to play with
• NFC
• EMV
• E-paper displays
• Java cards
• UHF

18. Gabe Schuyler HOPE 2022 @gabe_sky
More information
• Proxmark Discord and forums
• Tag data sheets
• Vendor explanations
• Adafruit, SparkFun, &c
• Dive in!

19. Gabe Schuyler HOPE 2022 @gabe_sky
By the way ...
• Motorcycle
• Garage access
• Gloved hands
• Clutch & Throttle
• Clumsy & Error-prone

20. Gabe Schuyler HOPE 2022 @gabe_sky
"Open"

21. Have fun!
Gabe Schuyler HOPE 2022 @gabe_sky
Gabe Schuyler
@gabe_sky
HOPE 2022