Hope 2022: Just Enough RFID Cloning to be Dangerous

•

0 gostou•51 visualizações

These are the slides from my HOPE 2022 talk that presented just enough background and practical knowledge that a person could get started (or at least know where to start) cloning RFID tags, keys, and rings.

Tecnologia

Just enough RFID cloning
to be dangerous
Gabe Schuyler

@gabe_sky

HOPE 2022

Gabe Schuyler HOPE 2022 @gabe_sky
About me
• Austin, TX

• Long-time operations person

• Newly working in cybersecurity

• Tinkering, lock picking, and social change

@gabe_sky

Gabe Schuyler HOPE 2022 @gabe_sky
How I got here
• Motorcycle

• Garage access

• Gloved hands

• Clutch & Throttle

• Clumsy & Error-prone

Gabe Schuyler HOPE 2022 @gabe_sky
Also how I got here
• Hotel keys -- hundreds of them

• Date and duration

• Room number

• (And city, for funsies)

Gabe Schuyler HOPE 2022 @gabe_sky
Passive RFID
• A
fl
ashlight to send

• A mirror to reply

Gabe Schuyler HOPE 2022 @gabe_sky
Frequencies
• Low frequency

• 125 kHz

• Dumb

• High frequency

• 13.56 MHz

• Smarter

Gabe Schuyler HOPE 2022 @gabe_sky
Low frequency
• 125 kHz

• Just reply

• Readers just read

• Think barcode or magstripe

• Harder to block

Gabe Schuyler HOPE 2022 @gabe_sky
High frequency
• 13.56 MHz

• Do some math

• Readers can update

• Think system on a chip

• Easy to block

Gabe Schuyler HOPE 2022 @gabe_sky
Chips
• Low frequency

• EM41xx

• T55xx chips

• High frequency

• HID iClass

• MIFARE Classic

Gabe Schuyler HOPE 2022 @gabe_sky
Data formats
• ISO 14443

• HID

• Indala

Gabe Schuyler HOPE 2022 @gabe_sky
Form Factors
• Cards

• Fobs

• Stickers

• Injectable

• Rings

Gabe Schuyler HOPE 2022 @gabe_sky
Equipment
• Blue "cloner of doom"

• All-in-one ( iCopy-X and friends )

• Proxmark 3

• Rewritable low frequency

• Chinese "Magic" high frequency

Gabe Schuyler HOPE 2022 @gabe_sky
Copying a building
access tag
• Low frequency

• Dump facility code and card number

• Clone

Gabe Schuyler HOPE 2022 @gabe_sky
Copying a hotel
room key
• High frequency

• Get tag UID

• Dump binary data

• Break encryption

• Write

Gabe Schuyler HOPE 2022 @gabe_sky
RFID Blockers
• Low frequency or high frequency?

• Paper and fabric

• Active interference

• Random crap

Demo time!
Gabe Schuyler HOPE 2022 @gabe_sky

Gabe Schuyler HOPE 2022 @gabe_sky
Other junk to play with
• NFC

• EMV

• E-paper displays

• Java cards

• UHF

Gabe Schuyler HOPE 2022 @gabe_sky
More information
• Proxmark Discord and forums

• Tag data sheets

• Vendor explanations

• Adafruit, SparkFun, &c

• Dive in!

Gabe Schuyler HOPE 2022 @gabe_sky
By the way ...
• Motorcycle

• Garage access

• Gloved hands

• Clutch & Throttle

• Clumsy & Error-prone

Gabe Schuyler HOPE 2022 @gabe_sky
"Open"

Have fun!
Gabe Schuyler HOPE 2022 @gabe_sky
Gabe Schuyler

@gabe_sky

HOPE 2022

Mais conteúdo relacionado

Mais de Gabriel Schuyler

fwd:cloudsec 2022: Shifting right with policy-as-code

Gabriel Schuyler

So, you've finished your (rushed by lockdown) lift-and-shift to the cloud, and now your developers are adopting cloud-native workloads such as containers, serverless functions, storage buckets, and databases as a service. These new technologies introduce new attack vectors, and must be defended in unique ways. You're not "just running on someone else's servers" when workloads come and go in seconds. How do you secure a function when the communication layer is opaque to you? Can you govern container use well enough to protect it, but without slowing down developers and the business? Heck, do you even know what's out there? This session will provide you with enough knowledge to begin securing the your most important assets in the cloud. Sure, cloud-native workloads can seem mysterious, but once you know the differences (and hidden pitfalls) of cloud-native workloads, you'll be in good shape to start defending them.

Kernel Con 2022: Securing Cloud Native Workloads

Gabriel Schuyler

My building requires an RFID key in order to access the garage. But I ride. Fishing out the only copy of my key, with gloved hands, on a vehicle that requires both hands to operate? Not so simple. We all know that it’s easy to duplicate these things, but actually doing it? The devil is in the details, and those details are strewn across the internet in blog posts, readme files, and members-only forums. Where do you start? * So, how does RFID work, anyway? * What’s the frequency? (Spoiler: Kenneth does not know.) * What’s a chipset and which am I using? * How far can ten bucks on ebay get me? * How far can a couple hundred get me? * And to solve my problem, what clever form factors are available to get around the gloved motorcycle situation? (No, I did not inject a chip in myself.) If you’ve ever boasted, “those things are so insecure,” but want to be able to back it up, ten minutes is all you need, to get the basics.

ShmooCon 2022: RFID Key Cloning for Angry Bikers

Gabriel Schuyler

Every company, government agency, and individual depends increasingly on the computers, computing devices like smartphones, and the networks that connect them, presenting opportunities for cybercriminals. As Covid pandemic measures have pushed people and businesses increasingly online and remote, attackers have pivoted as well, exploiting weaknesses in these technologies. Always a present threat, today's exploits are now automated, pushing us to automate our defense as well. Many threats--even if larger in scale--remain the same. Phishing, credential re-use, known vulnerable components, the traditional attacks continue to provide criminals with a steady stream of access to private networks and personal data. It seems that nobody, and no company or agency, is safe from cyber theft—from individual hackers who steal identities and personal financial information, to more organized, even international, efforts that attempt to capture an organization's data and hold it for ransom. Is it going to get worse? What can we do? Fortunately, lessons learned from watching adversaries can also be applied to improve our defenses. Proactively looking for indicators of compromise, adding two-factor authentication, and thwarting credential re-use are easier today than ever before. Join us as Gabe Schuyler, a cybersecurity expert now with WizIO, explains the types of computer and network vulnerabilities and how they are exploited, examples of a variety of attack types and threats, and explains why they are possible, why they happen, and what can/should be done to prevent them, or at least recover from them. Gabe will close with some very practical advice on what your companies/organizations, and you individually, can to do be more secure against cyberthreats.

Cybersecurity in 2022

Gabriel Schuyler

Lately, as a Professional Services Engineer at Puppet, I've been helping customers migrate from Puppet 3 to 4. The official documentation lists all sorts of breaking changes. Abd there's an enormous page on preparing for the migration. But it's actually not all that tricky. In this informal "notes from the field" session, I present the half dozen things that most people need to pay attention to, and offer a sampling of a dozen or so others that rarely -- but occasionally enough to mention -- crop up.

Migrating Puppet 3 to 4 -- Code Changes

Gabriel Schuyler

IC3 -- Configuration Management 101

Gabriel Schuyler

Mais de Gabriel Schuyler (6)

fwd:cloudsec 2022: Shifting right with policy-as-code

Kernel Con 2022: Securing Cloud Native Workloads

ShmooCon 2022: RFID Key Cloning for Angry Bikers

Cybersecurity in 2022

Migrating Puppet 3 to 4 -- Code Changes

IC3 -- Configuration Management 101

Último

Dubai, often portrayed as a shimmering oasis in the desert, faces its own set of challenges, including the occasional threat of flooding. Despite its reputation for opulence and modernity, the emirate is not immune to the forces of nature. In recent years, Dubai has experienced sporadic but significant floods, testing the resilience of its infrastructure and communities. Among the critical lifelines in this bustling metropolis is the Dubai International Airport, a bustling hub that connects the city to the world. This article explores the intersection of Dubai flood events and the resilience demonstrated by the Dubai International Airport in the face of such challenges.

Navigating the Deluge_ Dubai Floods and the Resilience of Dubai International...

Orbitshub

Understanding the FAA Part 107 License ..

Christopher Logan Kennedy

FWD Group - Insurer Innovation Award 2024

The Digital Insurer

Tracing the root cause of a performance issue requires a lot of patience, experience, and focus. It’s so hard that we sometimes attempt to guess by trying out tentative fixes, but that usually results in frustration, messy code, and a considerable waste of time and money. This talk explains how to correctly zoom in on a performance bottleneck using three levels of profiling: distributed tracing, metrics, and method profiling. After we learn to read the JVM profiler output as a flame graph, we explore a series of bottlenecks typical for backend systems, like connection/thread pool starvation, invisible aspects, blocking code, hot CPU methods, lock contention, and Virtual Thread pinning, and we learn to trace them even if they occur in library code you are not familiar with. Attend this talk and prepare for the performance issues that will eventually hit any successful system. About authorWith two decades of experience, Victor is a Java Champion working as a trainer for top companies in Europe. Five thousands developers in 120 companies attended his workshops, so he gets to debate every week the challenges that various projects struggle with. In return, Victor summarizes key points from these workshops in conference talks and online meetups for the European Software Crafters, the world’s largest developer community around architecture, refactoring, and testing. Discover how Victor can help you on victorrentea.ro : company training catalog, consultancy and YouTube playlists.

Finding Java's Hidden Performance Traps @ DevoxxUK 2024

Victor Rentea

Boost Fertility New Invention Ups Success Rates.pdf

sudhanshuwaghmare1

ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke

Product Anonymous

💉💊+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHABI}}+971581248768 +971581248768 Mtp-Kit (500MG) Prices » Dubai [(+971581248768**)] Abortion Pills For Sale In Dubai, UAE, Mifepristone and Misoprostol Tablets Available In Dubai, UAE CONTACT DR.Maya Whatsapp +971581248768 We Have Abortion Pills / Cytotec Tablets /Mifegest Kit Available in Dubai, Sharjah, Abudhabi, Ajman, Alain, Fujairah, Ras Al Khaimah, Umm Al Quwain, UAE, Buy cytotec in Dubai +971581248768''''Abortion Pills near me DUBAI | ABU DHABI|UAE. Price of Misoprostol, Cytotec” +971581248768' Dr.DEEM ''BUY ABORTION PILLS MIFEGEST KIT, MISOPROTONE, CYTOTEC PILLS IN DUBAI, ABU DHABI,UAE'' Contact me now via What's App…… abortion Pills Cytotec also available Oman Qatar Doha Saudi Arabia Bahrain Above all, Cytotec Abortion Pills are Available In Dubai / UAE, you will be very happy to do abortion in Dubai we are providing cytotec 200mg abortion pill in Dubai, UAE. Medication abortion offers an alternative to Surgical Abortion for women in the early weeks of pregnancy. We only offer abortion pills from 1 week-6 Months. We then advise you to use surgery if its beyond 6 months. Our Abu Dhabi, Ajman, Al Ain, Dubai, Fujairah, Ras Al Khaimah (RAK), Sharjah, Umm Al Quwain (UAQ) United Arab Emirates Abortion Clinic provides the safest and most advanced techniques for providing non-surgical, medical and surgical abortion methods for early through late second trimester, including the Abortion By Pill Procedure (RU 486, Mifeprex, Mifepristone, early options French Abortion Pill), Tamoxifen, Methotrexate and Cytotec (Misoprostol). The Abu Dhabi, United Arab Emirates Abortion Clinic performs Same Day Abortion Procedure using medications that are taken on the first day of the office visit and will cause the abortion to occur generally within 4 to 6 hours (as early as 30 minutes) for patients who are 3 to 12 weeks pregnant. When Mifepristone and Misoprostol are used, 50% of patients complete in 4 to 6 hours; 75% to 80% in 12 hours; and 90% in 24 hours. We use a regimen that allows for completion without the need for surgery 99% of the time. All advanced second trimester and late term pregnancies at our Tampa clinic (17 to 24 weeks or greater) can be completed within 24 hours or less 99% of the time without the need surgery. The procedure is completed with minimal to no complications. Our Women's Health Center located in Abu Dhabi, United Arab Emirates, uses the latest medications for medical abortions (RU-486, Mifeprex, Mifegyne, Mifepristone, early options French abortion pill), Methotrexate and Cytotec (Misoprostol). The safety standards of our Abu Dhabi, United Arab Emirates Abortion Doctors remain unparalleled. They consistently maintain the lowest complication rates throughout the nation. Our Physicians and staff are always available to answer questions and care for women in one of the most difficult times in their lives. The decision to have an abortion at the Abortion Cl

+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...

?#DUbAI#??##{{(☎️+971_581248768%)**%*]'#abortion pills for sale in dubai@

Elevate Developer Efficiency & build GenAI Application with Amazon Q

Bhuvaneswari Subramani

Effective data discovery is crucial for maintaining compliance and mitigating risks in today's rapidly evolving privacy landscape. However, traditional manual approaches often struggle to keep pace with the growing volume and complexity of data. Join us for an insightful webinar where industry leaders from TrustArc and Privya will share their expertise on leveraging AI-powered solutions to revolutionize data discovery. You'll learn how to: - Effortlessly maintain a comprehensive, up-to-date data inventory - Harness code scanning insights to gain complete visibility into data flows leveraging the advantages of code scanning over DB scanning - Simplify compliance by leveraging Privya's integration with TrustArc - Implement proven strategies to mitigate third-party risks Our panel of experts will discuss real-world case studies and share practical strategies for overcoming common data discovery challenges. They'll also explore the latest trends and innovations in AI-driven data management, and how these technologies can help organizations stay ahead of the curve in an ever-changing privacy landscape.

TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery

TrustArc

Accelerating FinTech Innovation: Unleashing API Economy and GenAI Vasa Krishnan, Chief Technology Officer - FinResults Apidays New York 2024: The API Economy in the AI Era (April 30 & May 1, 2024) ------ Check out our conferences at https://www.apidays.global/ Do you want to sponsor or talk at one of our conferences? https://apidays.typeform.com/to/ILJeAaV8 Learn more on APIscene, the global media made by the community for the community: https://www.apiscene.io Explore the API ecosystem with the API Landscape: https://apilandscape.apiscene.io/

Apidays New York 2024 - Accelerating FinTech Innovation by Vasa Krishnan, Fin...

apidays

Webinar Recording: https://www.panagenda.com/webinars/why-teams-call-analytics-is-critical-to-your-entire-business Nothing is as frustrating and noticeable as being in an important call and being unable to see or hear the other person. Not surprising then, that issues with Teams calls are among the most common problems users call their helpdesk for. Having in depth insight into everything relevant going on at the user’s device, local network, ISP and Microsoft itself during the call is crucial for good Microsoft Teams Call quality support. To ensure a quick and adequate solution and to ensure your users get the most out of their Microsoft 365. But did you know that ‘bad calls’ are also an excellent indicator of other problems arising? Precisely because it is so noticeable!? Like the canary in the mine, bad calls can be early indicators of problems. Problems that might otherwise not have been noticed for a while but can have a big impact on productivity and satisfaction. Join this session by Christoph Adler to learn how true Microsoft Teams call quality analytics helped other organizations troubleshoot bad calls and identify and fix problems that impacted Teams calls or the use of Microsoft365 in general. See what it can do to keep your users happy and productive! In this session we will cover - Why CQD data alone is not enough to troubleshoot call problems - The importance of attributing call problems to the right call participant - What call quality analytics can do to help you quickly find, fix-, and prevent problems - Why having retrospective detailed insights matters - Real life examples of how others have used Microsoft Teams call quality monitoring to problem shoot problems with their ISP, network, device health and more.

Why Teams call analytics are critical to your entire business

panagenda

Scaling API-first – The story of a global engineering organization Ian Reasor, Senior Computer Scientist - Adobe Radu Cotescu, Senior Computer Scientist - Adobe Apidays New York 2024: The API Economy in the AI Era (April 30 & May 1, 2024) ------ Check out our conferences at https://www.apidays.global/ Do you want to sponsor or talk at one of our conferences? https://apidays.typeform.com/to/ILJeAaV8 Learn more on APIscene, the global media made by the community for the community: https://www.apiscene.io Explore the API ecosystem with the API Landscape: https://apilandscape.apiscene.io/

Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe

apidays

Strategies for Landing an Oracle DBA Job as a Fresher

Remote DBA Services

Angeliki Cooney has spent over twenty years at the forefront of the life sciences industry, working out of Wynantskill, NY. She is highly regarded for her dedication to advancing the development and accessibility of innovative treatments for chronic diseases, rare disorders, and cancer. Her professional journey has centered on strategic consulting for biopharmaceutical companies, facilitating digital transformation, enhancing omnichannel engagement, and refining strategic commercial practices. Angeliki's innovative contributions include pioneering several software-as-a-service (SaaS) products for the life sciences sector, earning her three patents. As the Senior Vice President of Life Sciences at Avenga, Angeliki orchestrated the firm's strategic entry into the U.S. market. Avenga, a renowned digital engineering and consulting firm, partners with significant entities in the pharmaceutical and biotechnology fields. Her leadership was instrumental in expanding Avenga's client base and establishing its presence in the competitive U.S. market.

Biography Of Angeliki Cooney | Senior Vice President Life Sciences | Albany, ...

Angeliki Cooney

Corporate and higher education. Two industries that, in the past, have had a clear divide with very little crossover. The difference in goals, learning styles and objectives paved the way for differing learning technologies platforms to evolve. Now, those stark lines are blurring as both sides are discovering they have content that’s relevant to the other. Join Tammy Rutherford as she walks through the pros and cons of corporate and higher ed collaborating. And the challenges of these different technology platforms working together for a brighter future.

Corporate and higher education May webinar.pptx

Rustici Software

EMPOWERMENT TECHNOLOGY GRADE 11 QUARTER 2 REVIEWER

MadyBayot

The Good, the Bad and the Governed - Why is governance a dirty word? David O'Neill, Chief Operating Officer - APIContext Apidays New York 2024: The API Economy in the AI Era (April 30 & May 1, 2024) ------ Check out our conferences at https://www.apidays.global/ Do you want to sponsor or talk at one of our conferences? https://apidays.typeform.com/to/ILJeAaV8 Learn more on APIscene, the global media made by the community for the community: https://www.apiscene.io Explore the API ecosystem with the API Landscape: https://apilandscape.apiscene.io/

Apidays New York 2024 - The Good, the Bad and the Governed by David O'Neill, ...

apidays

Sidekick Solutions uses Bonterra Impact Management (fka Social Solutions Apricot) and automation solutions to integrate data for business workflows. We believe integration and automation are essential to user experience and the promise of efficient work through technology. Automation is the critical ingredient to realizing that full vision. We develop integration products and services for Bonterra Case Management software to support the deployment of automations for a variety of use cases. This video focuses on the deployment of external web forms using Jotform for Bonterra Impact Management. This solution can be customized to your organization’s needs and deployed to support the common use cases below: - Intake and consent - Assessments - Surveys - Applications - Program registration Interested in deploying web form automations for Bonterra Impact Management? Contact us at sales@sidekicksolutionsllc.com to discuss next steps.

Web Form Automation for Bonterra Impact Management (fka Social Solutions Apri...

Jeffrey Haguewood

How to Troubleshoot Apps for the Modern Connected Worker

ThousandEyes

Artificial Intelligence Chap.5 : Uncertainty

Khushali Kathiriya

Hope 2022: Just Enough RFID Cloning to be Dangerous

1. Just enough RFID cloning to be dangerous Gabe Schuyler @gabe_sky HOPE 2022

2. Gabe Schuyler HOPE 2022 @gabe_sky About me • Austin, TX • Long-time operations person • Newly working in cybersecurity • Tinkering, lock picking, and social change @gabe_sky

3. Gabe Schuyler HOPE 2022 @gabe_sky How I got here • Motorcycle • Garage access • Gloved hands • Clutch & Throttle • Clumsy & Error-prone

4. Gabe Schuyler HOPE 2022 @gabe_sky Also how I got here • Hotel keys -- hundreds of them • Date and duration • Room number • (And city, for funsies)

5. Gabe Schuyler HOPE 2022 @gabe_sky Passive RFID • A fl ashlight to send • A mirror to reply

6. Gabe Schuyler HOPE 2022 @gabe_sky Frequencies • Low frequency • 125 kHz • Dumb • High frequency • 13.56 MHz • Smarter

7. Gabe Schuyler HOPE 2022 @gabe_sky Low frequency • 125 kHz • Just reply • Readers just read • Think barcode or magstripe • Harder to block

8. Gabe Schuyler HOPE 2022 @gabe_sky High frequency • 13.56 MHz • Do some math • Readers can update • Think system on a chip • Easy to block

9. Gabe Schuyler HOPE 2022 @gabe_sky Chips • Low frequency • EM41xx • T55xx chips • High frequency • HID iClass • MIFARE Classic

10. Gabe Schuyler HOPE 2022 @gabe_sky Data formats • ISO 14443 • HID • Indala

11. Gabe Schuyler HOPE 2022 @gabe_sky Form Factors • Cards • Fobs • Stickers • Injectable • Rings

12. Gabe Schuyler HOPE 2022 @gabe_sky Equipment • Blue "cloner of doom" • All-in-one ( iCopy-X and friends ) • Proxmark 3 • Rewritable low frequency • Chinese "Magic" high frequency

13. Gabe Schuyler HOPE 2022 @gabe_sky Copying a building access tag • Low frequency • Dump facility code and card number • Clone

14. Gabe Schuyler HOPE 2022 @gabe_sky Copying a hotel room key • High frequency • Get tag UID • Dump binary data • Break encryption • Write

15. Gabe Schuyler HOPE 2022 @gabe_sky RFID Blockers • Low frequency or high frequency? • Paper and fabric • Active interference • Random crap

16. Demo time! Gabe Schuyler HOPE 2022 @gabe_sky

17. Gabe Schuyler HOPE 2022 @gabe_sky Other junk to play with • NFC • EMV • E-paper displays • Java cards • UHF

18. Gabe Schuyler HOPE 2022 @gabe_sky More information • Proxmark Discord and forums • Tag data sheets • Vendor explanations • Adafruit, SparkFun, &c • Dive in!

19. Gabe Schuyler HOPE 2022 @gabe_sky By the way ... • Motorcycle • Garage access • Gloved hands • Clutch & Throttle • Clumsy & Error-prone

20. Gabe Schuyler HOPE 2022 @gabe_sky "Open"

21. Have fun! Gabe Schuyler HOPE 2022 @gabe_sky Gabe Schuyler @gabe_sky HOPE 2022

Hope 2022: Just Enough RFID Cloning to be Dangerous

Recomendados

Recomendados

Mais conteúdo relacionado

Mais de Gabriel Schuyler

Mais de Gabriel Schuyler (6)

Último

Último (20)

Hope 2022: Just Enough RFID Cloning to be Dangerous