01 August 2013 - Black Hat USA 2013
Fran Brown - Bishop Fox
www.bishopfox.com/resources/to...
www.blackhat.com/us-13/briefin...
Have you ever attended an RFID hacking presentation and walked away with more questions than answers? This talk will finally provide practical guidance on how RFID proximity badge systems work. We'll cover what you'll need to build out your own RFID physical penetration toolkit, and how to easily use an Arduino microcontroller to weaponize commercial RFID badge readers -- turning them into custom, long range RFID hacking tools.
This presentation will NOT weigh you down with theoretical details, discussions of radio frequencies and modulation schemes, or talk of inductive coupling. It WILL serve as a practical guide for penetration testers to understand the attack tools and techniques available to them for stealing and using RFID proximity badge information to gain unauthorized access to buildings and other secure areas. Schematics and Arduino code will be released, and 100 lucky audience members will receive a custom PCB they can insert into almost any commercial RFID reader to steal badge info and conveniently save it to a text file on a microSD card for later use (such as badge cloning). This solution will allow you to read cards from up to 3 feet away, a significant improvement over the few centimeter range of common RFID hacking tools.
Some of the topics we will explore are:
* Overview of best RFID hacking tools available to get for your toolkit
* Stealing RFID proximity badge info from unsuspecting passers-by
* Replaying RFID badge info and creating fake cloned cards
* Brute-forcing higher privileged badge numbers to gain data center access
* Attacking badge readers and controllers directly
* Planting PwnPlugs, Raspberry Pis, and similar devices as physical backdoors to maintain internal network access
* Creating custom RFID hacking tools using the Arduino
* Defending yourself from RFID hacking threats
This DEMO-rich presentation will benefit both newcomers and seasoned professionals of the physical penetration testing field.