SlideShare a Scribd company logo
An Introduction to RFID Cloning
( for angry bikers )
Gabe Schuyler
@gabe_sky
ShmooCon 2022
The motivation
• Garage gate w/ RFID
• Gloves
• Two-handed vehicle
• "It's so easy ..."
Gabe Schuyler @gabe_sky
ShmooCon 2022
Passive RFID
• A flashlight and a mirror
• Flashlight: send binary in flashes
• Mirror: reflect binary response
Gabe Schuyler @gabe_sky
ShmooCon 2022
Frequencies & Chips
• 125 kHz (low frequency)
• HID ProxCard
• EM41xx
• T55xx chips
• 13.56 MHz (high frequency)
• HID iClass
• MIFARE Classic
Gabe Schuyler @gabe_sky
ShmooCon 2022
Ten bucks on eBay
• Cheap
• Works
• Quirky
• Get rewritable tags!
Gabe Schuyler @gabe_sky
ShmooCon 2022
A few bucks more
• Proxmark 3
• Does it all
• Open source
Gabe Schuyler @gabe_sky
ShmooCon 2022
Read
• Facility code
• Card number
Gabe Schuyler @gabe_sky
ShmooCon 2022
Write
• T55xx
Gabe Schuyler @gabe_sky
ShmooCon 2022
Form factors
• Fobs
• Cards
• Keys
• Injectable
• and Rings!
Gabe Schuyler @gabe_sky
ShmooCon 2022
"Open!"
Gabe Schuyler @gabe_sky
ShmooCon 2022
Go experiment!
Gabe Schuyler
@gabe_sky
ShmooCon 2022

More Related Content

What's hot

Succession in christians and parsis
Succession in christians and parsisSuccession in christians and parsis
Succession in christians and parsis
Shivani Sharma
 
Analytical school of Jurisprudence
Analytical school of JurisprudenceAnalytical school of Jurisprudence
Analytical school of Jurisprudence
G.D Goenka International School Surat
 
Construction of Ejusdem Generis
Construction of Ejusdem GenerisConstruction of Ejusdem Generis
Construction of Ejusdem Generis
Mohit Dua
 
transfer of cases
transfer of casestransfer of cases
transfer of cases
Diganth Raj Sehgal
 
evidence notes.pdf
evidence notes.pdfevidence notes.pdf
evidence notes.pdf
SouravVerma39
 
Crpc sec 158
Crpc sec 158Crpc sec 158
Crpc sec 158
ArundhatiBanerjee6
 
Will-Wasiyat under Islamic law
Will-Wasiyat under Islamic lawWill-Wasiyat under Islamic law
Will-Wasiyat under Islamic law
Shivani Sharma
 
Gifts under the transfer of property act.
Gifts under the transfer of property act.Gifts under the transfer of property act.
Gifts under the transfer of property act.
Muskan Sanghi
 
All India Muslim League
All India Muslim LeagueAll India Muslim League
All India Muslim League
Moavia Aslam
 
Political System of Pakistan
Political System of PakistanPolitical System of Pakistan
Political System of Pakistan
h9Abdurrahman
 
The basics of Islamic law of inheritance
The basics of Islamic law of inheritanceThe basics of Islamic law of inheritance
The basics of Islamic law of inheritance
JaMshed AhMed
 
Hudud laws, qisas & tazir by naseem akbar
Hudud laws, qisas & tazir by naseem akbarHudud laws, qisas & tazir by naseem akbar
Hudud laws, qisas & tazir by naseem akbar
zulfi799
 
Islamic juris lect 1 History and growth
Islamic juris lect 1 History and growth Islamic juris lect 1 History and growth
Islamic juris lect 1 History and growth
Aijaz Ahmed Jatoi
 
Qanun-e- Shahdath Order , {Documentary evidence}
Qanun-e- Shahdath Order , {Documentary evidence}Qanun-e- Shahdath Order , {Documentary evidence}
Qanun-e- Shahdath Order , {Documentary evidence}
ShahMuhammad55
 
Blasphemy laws in pakistan
Blasphemy laws in pakistanBlasphemy laws in pakistan
Blasphemy laws in pakistan
Fatima Tariq
 
Schools of Muslim Law.pptx
Schools of Muslim Law.pptxSchools of Muslim Law.pptx
Schools of Muslim Law.pptx
LILHOEGAMING
 
Final constitution
Final constitutionFinal constitution
Final constitution
FJWU
 
C. ravichandran iyerv. justice a.m. bhattacharjee (1995) 5 scc 457
C. ravichandran iyerv. justice a.m. bhattacharjee (1995) 5 scc 457C. ravichandran iyerv. justice a.m. bhattacharjee (1995) 5 scc 457
C. ravichandran iyerv. justice a.m. bhattacharjee (1995) 5 scc 457
Harsh Kumar
 
memorial of ipc sec 302 and 326 B
memorial of ipc sec 302 and 326 Bmemorial of ipc sec 302 and 326 B
memorial of ipc sec 302 and 326 B
gagan deep
 
Specific Relief Act, 1877 | Presentation
Specific Relief Act, 1877 | PresentationSpecific Relief Act, 1877 | Presentation
Specific Relief Act, 1877 | Presentation
A K DAS's | Law
 

What's hot (20)

Succession in christians and parsis
Succession in christians and parsisSuccession in christians and parsis
Succession in christians and parsis
 
Analytical school of Jurisprudence
Analytical school of JurisprudenceAnalytical school of Jurisprudence
Analytical school of Jurisprudence
 
Construction of Ejusdem Generis
Construction of Ejusdem GenerisConstruction of Ejusdem Generis
Construction of Ejusdem Generis
 
transfer of cases
transfer of casestransfer of cases
transfer of cases
 
evidence notes.pdf
evidence notes.pdfevidence notes.pdf
evidence notes.pdf
 
Crpc sec 158
Crpc sec 158Crpc sec 158
Crpc sec 158
 
Will-Wasiyat under Islamic law
Will-Wasiyat under Islamic lawWill-Wasiyat under Islamic law
Will-Wasiyat under Islamic law
 
Gifts under the transfer of property act.
Gifts under the transfer of property act.Gifts under the transfer of property act.
Gifts under the transfer of property act.
 
All India Muslim League
All India Muslim LeagueAll India Muslim League
All India Muslim League
 
Political System of Pakistan
Political System of PakistanPolitical System of Pakistan
Political System of Pakistan
 
The basics of Islamic law of inheritance
The basics of Islamic law of inheritanceThe basics of Islamic law of inheritance
The basics of Islamic law of inheritance
 
Hudud laws, qisas & tazir by naseem akbar
Hudud laws, qisas & tazir by naseem akbarHudud laws, qisas & tazir by naseem akbar
Hudud laws, qisas & tazir by naseem akbar
 
Islamic juris lect 1 History and growth
Islamic juris lect 1 History and growth Islamic juris lect 1 History and growth
Islamic juris lect 1 History and growth
 
Qanun-e- Shahdath Order , {Documentary evidence}
Qanun-e- Shahdath Order , {Documentary evidence}Qanun-e- Shahdath Order , {Documentary evidence}
Qanun-e- Shahdath Order , {Documentary evidence}
 
Blasphemy laws in pakistan
Blasphemy laws in pakistanBlasphemy laws in pakistan
Blasphemy laws in pakistan
 
Schools of Muslim Law.pptx
Schools of Muslim Law.pptxSchools of Muslim Law.pptx
Schools of Muslim Law.pptx
 
Final constitution
Final constitutionFinal constitution
Final constitution
 
C. ravichandran iyerv. justice a.m. bhattacharjee (1995) 5 scc 457
C. ravichandran iyerv. justice a.m. bhattacharjee (1995) 5 scc 457C. ravichandran iyerv. justice a.m. bhattacharjee (1995) 5 scc 457
C. ravichandran iyerv. justice a.m. bhattacharjee (1995) 5 scc 457
 
memorial of ipc sec 302 and 326 B
memorial of ipc sec 302 and 326 Bmemorial of ipc sec 302 and 326 B
memorial of ipc sec 302 and 326 B
 
Specific Relief Act, 1877 | Presentation
Specific Relief Act, 1877 | PresentationSpecific Relief Act, 1877 | Presentation
Specific Relief Act, 1877 | Presentation
 

More from Gabriel Schuyler

2024 Kernelcon Attack and Defense of AI.pdf
2024 Kernelcon Attack and Defense of AI.pdf2024 Kernelcon Attack and Defense of AI.pdf
2024 Kernelcon Attack and Defense of AI.pdf
Gabriel Schuyler
 
2023 BSides ATX Trending Attack and Defense.pdf
2023 BSides ATX Trending Attack and Defense.pdf2023 BSides ATX Trending Attack and Defense.pdf
2023 BSides ATX Trending Attack and Defense.pdf
Gabriel Schuyler
 
Trends in Cloud Security Attack & Defense
Trends in Cloud Security Attack & DefenseTrends in Cloud Security Attack & Defense
Trends in Cloud Security Attack & Defense
Gabriel Schuyler
 
Pancakes Con 4 Trends in Cloud Security & Fun Facts about Real Clouds
Pancakes Con 4 Trends in Cloud Security & Fun Facts about Real CloudsPancakes Con 4 Trends in Cloud Security & Fun Facts about Real Clouds
Pancakes Con 4 Trends in Cloud Security & Fun Facts about Real Clouds
Gabriel Schuyler
 
Automating Security Tests in Development with Docker
Automating Security Tests in Development with DockerAutomating Security Tests in Development with Docker
Automating Security Tests in Development with Docker
Gabriel Schuyler
 
2022 GrrCON Shifting Right with Policy as Code.pdf
2022 GrrCON Shifting Right with Policy as Code.pdf2022 GrrCON Shifting Right with Policy as Code.pdf
2022 GrrCON Shifting Right with Policy as Code.pdf
Gabriel Schuyler
 
Texas Cyber Summit 2022: Challenges Securing Cloud-Native.pdf
Texas Cyber Summit 2022: Challenges Securing Cloud-Native.pdfTexas Cyber Summit 2022: Challenges Securing Cloud-Native.pdf
Texas Cyber Summit 2022: Challenges Securing Cloud-Native.pdf
Gabriel Schuyler
 
Dog Days of Devops 2022: Policy as Code
Dog Days of Devops 2022: Policy as CodeDog Days of Devops 2022: Policy as Code
Dog Days of Devops 2022: Policy as Code
Gabriel Schuyler
 
fwd:cloudsec 2022: Shifting right with policy-as-code
fwd:cloudsec 2022: Shifting right with policy-as-codefwd:cloudsec 2022: Shifting right with policy-as-code
fwd:cloudsec 2022: Shifting right with policy-as-code
Gabriel Schuyler
 
Hope 2022: Just Enough RFID Cloning to be Dangerous
Hope 2022: Just Enough RFID Cloning to be DangerousHope 2022: Just Enough RFID Cloning to be Dangerous
Hope 2022: Just Enough RFID Cloning to be Dangerous
Gabriel Schuyler
 
Kernel Con 2022: Securing Cloud Native Workloads
Kernel Con 2022: Securing Cloud Native WorkloadsKernel Con 2022: Securing Cloud Native Workloads
Kernel Con 2022: Securing Cloud Native Workloads
Gabriel Schuyler
 
Cybersecurity in 2022
Cybersecurity in 2022Cybersecurity in 2022
Cybersecurity in 2022
Gabriel Schuyler
 
Migrating Puppet 3 to 4 -- Code Changes
Migrating Puppet 3 to 4 -- Code ChangesMigrating Puppet 3 to 4 -- Code Changes
Migrating Puppet 3 to 4 -- Code Changes
Gabriel Schuyler
 
IC3 -- Configuration Management 101
IC3 -- Configuration Management 101IC3 -- Configuration Management 101
IC3 -- Configuration Management 101
Gabriel Schuyler
 

More from Gabriel Schuyler (14)

2024 Kernelcon Attack and Defense of AI.pdf
2024 Kernelcon Attack and Defense of AI.pdf2024 Kernelcon Attack and Defense of AI.pdf
2024 Kernelcon Attack and Defense of AI.pdf
 
2023 BSides ATX Trending Attack and Defense.pdf
2023 BSides ATX Trending Attack and Defense.pdf2023 BSides ATX Trending Attack and Defense.pdf
2023 BSides ATX Trending Attack and Defense.pdf
 
Trends in Cloud Security Attack & Defense
Trends in Cloud Security Attack & DefenseTrends in Cloud Security Attack & Defense
Trends in Cloud Security Attack & Defense
 
Pancakes Con 4 Trends in Cloud Security & Fun Facts about Real Clouds
Pancakes Con 4 Trends in Cloud Security & Fun Facts about Real CloudsPancakes Con 4 Trends in Cloud Security & Fun Facts about Real Clouds
Pancakes Con 4 Trends in Cloud Security & Fun Facts about Real Clouds
 
Automating Security Tests in Development with Docker
Automating Security Tests in Development with DockerAutomating Security Tests in Development with Docker
Automating Security Tests in Development with Docker
 
2022 GrrCON Shifting Right with Policy as Code.pdf
2022 GrrCON Shifting Right with Policy as Code.pdf2022 GrrCON Shifting Right with Policy as Code.pdf
2022 GrrCON Shifting Right with Policy as Code.pdf
 
Texas Cyber Summit 2022: Challenges Securing Cloud-Native.pdf
Texas Cyber Summit 2022: Challenges Securing Cloud-Native.pdfTexas Cyber Summit 2022: Challenges Securing Cloud-Native.pdf
Texas Cyber Summit 2022: Challenges Securing Cloud-Native.pdf
 
Dog Days of Devops 2022: Policy as Code
Dog Days of Devops 2022: Policy as CodeDog Days of Devops 2022: Policy as Code
Dog Days of Devops 2022: Policy as Code
 
fwd:cloudsec 2022: Shifting right with policy-as-code
fwd:cloudsec 2022: Shifting right with policy-as-codefwd:cloudsec 2022: Shifting right with policy-as-code
fwd:cloudsec 2022: Shifting right with policy-as-code
 
Hope 2022: Just Enough RFID Cloning to be Dangerous
Hope 2022: Just Enough RFID Cloning to be DangerousHope 2022: Just Enough RFID Cloning to be Dangerous
Hope 2022: Just Enough RFID Cloning to be Dangerous
 
Kernel Con 2022: Securing Cloud Native Workloads
Kernel Con 2022: Securing Cloud Native WorkloadsKernel Con 2022: Securing Cloud Native Workloads
Kernel Con 2022: Securing Cloud Native Workloads
 
Cybersecurity in 2022
Cybersecurity in 2022Cybersecurity in 2022
Cybersecurity in 2022
 
Migrating Puppet 3 to 4 -- Code Changes
Migrating Puppet 3 to 4 -- Code ChangesMigrating Puppet 3 to 4 -- Code Changes
Migrating Puppet 3 to 4 -- Code Changes
 
IC3 -- Configuration Management 101
IC3 -- Configuration Management 101IC3 -- Configuration Management 101
IC3 -- Configuration Management 101
 

Recently uploaded

"NATO Hackathon Winner: AI-Powered Drug Search", Taras Kloba
"NATO Hackathon Winner: AI-Powered Drug Search",  Taras Kloba"NATO Hackathon Winner: AI-Powered Drug Search",  Taras Kloba
"NATO Hackathon Winner: AI-Powered Drug Search", Taras Kloba
Fwdays
 
Y-Combinator seed pitch deck template PP
Y-Combinator seed pitch deck template PPY-Combinator seed pitch deck template PP
Y-Combinator seed pitch deck template PP
c5vrf27qcz
 
Freshworks Rethinks NoSQL for Rapid Scaling & Cost-Efficiency
Freshworks Rethinks NoSQL for Rapid Scaling & Cost-EfficiencyFreshworks Rethinks NoSQL for Rapid Scaling & Cost-Efficiency
Freshworks Rethinks NoSQL for Rapid Scaling & Cost-Efficiency
ScyllaDB
 
A Deep Dive into ScyllaDB's Architecture
A Deep Dive into ScyllaDB's ArchitectureA Deep Dive into ScyllaDB's Architecture
A Deep Dive into ScyllaDB's Architecture
ScyllaDB
 
Christine's Supplier Sourcing Presentaion.pptx
Christine's Supplier Sourcing Presentaion.pptxChristine's Supplier Sourcing Presentaion.pptx
Christine's Supplier Sourcing Presentaion.pptx
christinelarrosa
 
What is an RPA CoE? Session 1 – CoE Vision
What is an RPA CoE?  Session 1 – CoE VisionWhat is an RPA CoE?  Session 1 – CoE Vision
What is an RPA CoE? Session 1 – CoE Vision
DianaGray10
 
How to Interpret Trends in the Kalyan Rajdhani Mix Chart.pdf
How to Interpret Trends in the Kalyan Rajdhani Mix Chart.pdfHow to Interpret Trends in the Kalyan Rajdhani Mix Chart.pdf
How to Interpret Trends in the Kalyan Rajdhani Mix Chart.pdf
Chart Kalyan
 
Mutation Testing for Task-Oriented Chatbots
Mutation Testing for Task-Oriented ChatbotsMutation Testing for Task-Oriented Chatbots
Mutation Testing for Task-Oriented Chatbots
Pablo Gómez Abajo
 
LF Energy Webinar: Carbon Data Specifications: Mechanisms to Improve Data Acc...
LF Energy Webinar: Carbon Data Specifications: Mechanisms to Improve Data Acc...LF Energy Webinar: Carbon Data Specifications: Mechanisms to Improve Data Acc...
LF Energy Webinar: Carbon Data Specifications: Mechanisms to Improve Data Acc...
DanBrown980551
 
"What does it really mean for your system to be available, or how to define w...
"What does it really mean for your system to be available, or how to define w..."What does it really mean for your system to be available, or how to define w...
"What does it really mean for your system to be available, or how to define w...
Fwdays
 
Introduction of Cybersecurity with OSS at Code Europe 2024
Introduction of Cybersecurity with OSS  at Code Europe 2024Introduction of Cybersecurity with OSS  at Code Europe 2024
Introduction of Cybersecurity with OSS at Code Europe 2024
Hiroshi SHIBATA
 
zkStudyClub - LatticeFold: A Lattice-based Folding Scheme and its Application...
zkStudyClub - LatticeFold: A Lattice-based Folding Scheme and its Application...zkStudyClub - LatticeFold: A Lattice-based Folding Scheme and its Application...
zkStudyClub - LatticeFold: A Lattice-based Folding Scheme and its Application...
Alex Pruden
 
"Scaling RAG Applications to serve millions of users", Kevin Goedecke
"Scaling RAG Applications to serve millions of users",  Kevin Goedecke"Scaling RAG Applications to serve millions of users",  Kevin Goedecke
"Scaling RAG Applications to serve millions of users", Kevin Goedecke
Fwdays
 
Apps Break Data
Apps Break DataApps Break Data
Apps Break Data
Ivo Velitchkov
 
ScyllaDB Tablets: Rethinking Replication
ScyllaDB Tablets: Rethinking ReplicationScyllaDB Tablets: Rethinking Replication
ScyllaDB Tablets: Rethinking Replication
ScyllaDB
 
The Microsoft 365 Migration Tutorial For Beginner.pptx
The Microsoft 365 Migration Tutorial For Beginner.pptxThe Microsoft 365 Migration Tutorial For Beginner.pptx
The Microsoft 365 Migration Tutorial For Beginner.pptx
operationspcvita
 
"$10 thousand per minute of downtime: architecture, queues, streaming and fin...
"$10 thousand per minute of downtime: architecture, queues, streaming and fin..."$10 thousand per minute of downtime: architecture, queues, streaming and fin...
"$10 thousand per minute of downtime: architecture, queues, streaming and fin...
Fwdays
 
"Frontline Battles with DDoS: Best practices and Lessons Learned", Igor Ivaniuk
"Frontline Battles with DDoS: Best practices and Lessons Learned",  Igor Ivaniuk"Frontline Battles with DDoS: Best practices and Lessons Learned",  Igor Ivaniuk
"Frontline Battles with DDoS: Best practices and Lessons Learned", Igor Ivaniuk
Fwdays
 
Northern Engraving | Nameplate Manufacturing Process - 2024
Northern Engraving | Nameplate Manufacturing Process - 2024Northern Engraving | Nameplate Manufacturing Process - 2024
Northern Engraving | Nameplate Manufacturing Process - 2024
Northern Engraving
 
What is an RPA CoE? Session 2 – CoE Roles
What is an RPA CoE?  Session 2 – CoE RolesWhat is an RPA CoE?  Session 2 – CoE Roles
What is an RPA CoE? Session 2 – CoE Roles
DianaGray10
 

Recently uploaded (20)

"NATO Hackathon Winner: AI-Powered Drug Search", Taras Kloba
"NATO Hackathon Winner: AI-Powered Drug Search",  Taras Kloba"NATO Hackathon Winner: AI-Powered Drug Search",  Taras Kloba
"NATO Hackathon Winner: AI-Powered Drug Search", Taras Kloba
 
Y-Combinator seed pitch deck template PP
Y-Combinator seed pitch deck template PPY-Combinator seed pitch deck template PP
Y-Combinator seed pitch deck template PP
 
Freshworks Rethinks NoSQL for Rapid Scaling & Cost-Efficiency
Freshworks Rethinks NoSQL for Rapid Scaling & Cost-EfficiencyFreshworks Rethinks NoSQL for Rapid Scaling & Cost-Efficiency
Freshworks Rethinks NoSQL for Rapid Scaling & Cost-Efficiency
 
A Deep Dive into ScyllaDB's Architecture
A Deep Dive into ScyllaDB's ArchitectureA Deep Dive into ScyllaDB's Architecture
A Deep Dive into ScyllaDB's Architecture
 
Christine's Supplier Sourcing Presentaion.pptx
Christine's Supplier Sourcing Presentaion.pptxChristine's Supplier Sourcing Presentaion.pptx
Christine's Supplier Sourcing Presentaion.pptx
 
What is an RPA CoE? Session 1 – CoE Vision
What is an RPA CoE?  Session 1 – CoE VisionWhat is an RPA CoE?  Session 1 – CoE Vision
What is an RPA CoE? Session 1 – CoE Vision
 
How to Interpret Trends in the Kalyan Rajdhani Mix Chart.pdf
How to Interpret Trends in the Kalyan Rajdhani Mix Chart.pdfHow to Interpret Trends in the Kalyan Rajdhani Mix Chart.pdf
How to Interpret Trends in the Kalyan Rajdhani Mix Chart.pdf
 
Mutation Testing for Task-Oriented Chatbots
Mutation Testing for Task-Oriented ChatbotsMutation Testing for Task-Oriented Chatbots
Mutation Testing for Task-Oriented Chatbots
 
LF Energy Webinar: Carbon Data Specifications: Mechanisms to Improve Data Acc...
LF Energy Webinar: Carbon Data Specifications: Mechanisms to Improve Data Acc...LF Energy Webinar: Carbon Data Specifications: Mechanisms to Improve Data Acc...
LF Energy Webinar: Carbon Data Specifications: Mechanisms to Improve Data Acc...
 
"What does it really mean for your system to be available, or how to define w...
"What does it really mean for your system to be available, or how to define w..."What does it really mean for your system to be available, or how to define w...
"What does it really mean for your system to be available, or how to define w...
 
Introduction of Cybersecurity with OSS at Code Europe 2024
Introduction of Cybersecurity with OSS  at Code Europe 2024Introduction of Cybersecurity with OSS  at Code Europe 2024
Introduction of Cybersecurity with OSS at Code Europe 2024
 
zkStudyClub - LatticeFold: A Lattice-based Folding Scheme and its Application...
zkStudyClub - LatticeFold: A Lattice-based Folding Scheme and its Application...zkStudyClub - LatticeFold: A Lattice-based Folding Scheme and its Application...
zkStudyClub - LatticeFold: A Lattice-based Folding Scheme and its Application...
 
"Scaling RAG Applications to serve millions of users", Kevin Goedecke
"Scaling RAG Applications to serve millions of users",  Kevin Goedecke"Scaling RAG Applications to serve millions of users",  Kevin Goedecke
"Scaling RAG Applications to serve millions of users", Kevin Goedecke
 
Apps Break Data
Apps Break DataApps Break Data
Apps Break Data
 
ScyllaDB Tablets: Rethinking Replication
ScyllaDB Tablets: Rethinking ReplicationScyllaDB Tablets: Rethinking Replication
ScyllaDB Tablets: Rethinking Replication
 
The Microsoft 365 Migration Tutorial For Beginner.pptx
The Microsoft 365 Migration Tutorial For Beginner.pptxThe Microsoft 365 Migration Tutorial For Beginner.pptx
The Microsoft 365 Migration Tutorial For Beginner.pptx
 
"$10 thousand per minute of downtime: architecture, queues, streaming and fin...
"$10 thousand per minute of downtime: architecture, queues, streaming and fin..."$10 thousand per minute of downtime: architecture, queues, streaming and fin...
"$10 thousand per minute of downtime: architecture, queues, streaming and fin...
 
"Frontline Battles with DDoS: Best practices and Lessons Learned", Igor Ivaniuk
"Frontline Battles with DDoS: Best practices and Lessons Learned",  Igor Ivaniuk"Frontline Battles with DDoS: Best practices and Lessons Learned",  Igor Ivaniuk
"Frontline Battles with DDoS: Best practices and Lessons Learned", Igor Ivaniuk
 
Northern Engraving | Nameplate Manufacturing Process - 2024
Northern Engraving | Nameplate Manufacturing Process - 2024Northern Engraving | Nameplate Manufacturing Process - 2024
Northern Engraving | Nameplate Manufacturing Process - 2024
 
What is an RPA CoE? Session 2 – CoE Roles
What is an RPA CoE?  Session 2 – CoE RolesWhat is an RPA CoE?  Session 2 – CoE Roles
What is an RPA CoE? Session 2 – CoE Roles
 

ShmooCon 2022: RFID Key Cloning for Angry Bikers

Editor's Notes

  1. Hey I'm Gabe. I don't speak for my employer; in fact, the bio is dated, so I couldn't if I wanted to.
  2. Here's my mother of invention. My building's garage requires an RFID key, to open it. But I ride a motorcycle, which takes two hands to operate. So I found myself stopping at the corner, stuffing my key into my glove, and trying to ride like that. I've always heard people say "it's so easy" to clone these, so I decided to see if it's true. (Spoiler: yes.)
  3. Passive means no battery. To completely and vastly oversimplify, imagine I have a flashlight, and want to communicate with you. What if I gave you a mirror? I can beam binary at you. And if I just send a steady beam, you can use the mirror to reflect in a binary pattern, to beam your reply.
  4. Every tag has a chip in it, and an antenna. (You'll need to do research.) There are two main frequencies in use for access keys. My experience suggests simple keys are usually on 125 kHz. And the fancier ones are high frequency. But in reality the frequency doesn't necessarily correlate with complexity.
  5. So if all you want to do is copy a low frequency tag (like mine), you can get a handheld cloner for ten bucks. But some do weird stuff. Among these things are setting the read-only bit, or adding a password. (The password is most likely 51243648.) Also, make sure to buy rewritable tags. Some are just a serial number burned in with no ability to change it.
  6. If you want to experiment more deeply, you'll need to get a proxmark 3. It has antennas to work with both low-frequency and high-frequency tags. (It even does NFC.) It's compatible with tons of chipsets. And it's open source, so you can add/fix things yourself!
  7. Step one, read. My tag lacks encryption, so it's easy to read. (Likely yours is unencrypted, as well.) What I need is the HID "facility code" (FC) (i.e. building number) and my "card number" (CN) (think: key pinning).
  8. And then I write to my rewritable tag. Again, not encrypted, so it's super simple. And that's it, I have a copy!
  9. But let's keep the original purpose in mind, which is to not have to fumble to get out my key. There are tons of form-factors out there, after all, all you need is a coil of antenna and a chip. And guess what, you can get a ceramic ring with those components embedded in it. Now I can just wave my gloved hand at the reader and ride on in.
  10. Here's the proof.
  11. And that's it ... if you've got ten bucks, something from China can copy it. Or pick up a Proxmark and go down the rabbit hole. But it really is "so easy to copy those." I have my tools and a bunch of blanks so please grab me if you want to try it!