All your badge are belong to me

PasswordsCon, Wed, Aug 7, 20:00 - Wed, Aug 7, 20:45 CDT It has been known for many years that a large number of access control systems based on RFID have vulnerabilities that make them susceptible to eavesdropping, cloning and manipulation. Even tho...

PasswordsCon, Wed, Aug 7, 20:00 - Wed, Aug 7, 20:45 CDT

It has been known for many years that a large number of access control systems based on RFID have vulnerabilities that make them susceptible to eavesdropping, cloning and manipulation. Even though this is considered common knowledge among most security professionals, the installation of new systems with fundamental security flaws still persists. This presentation aims to shed light on these basic vulnerabilities and to show how these vulnerabilities can be exploited by adversaries. Through warstories from real life physical penetration tests it will be demonstrated that these vulnerabilities are not theoretical concerns but present severe security risks in practice. The talk will also try to explain why outdated and insecure access control systems continue to be used, and why companies still buy it.
The audience will get an understanding of the most common vulnerabilities in RFID-based access control systems, insight into consequences of these flaws, and what to consider when purchasing a new solution.

People
John-André Bjørkhaug