2024-09-12 –, Main hall
The topic of attacks on access badges is widely discussed, but what can an adversary do when cloning someone’s card isn't an option? How else can one gain entry into high-security areas without direct access to the credentials?
In this talk, I will discuss techniques for compromising RFID readers to bypass organizational security mechanisms. We will cover:
- how to intercept the communication between the reader and the controller that are using the Wiegand protocol, along with the demo of this attack;
- how to use this entry point to leverage access through different attacks;
- how the OSDP protocol works and what are the security implications of using it;
- what are the other ways to bypass the access control security mechanisms.
I will also share real-world experiences and stories from Red Team engagements, demonstrating practical applications of these techniques in real-life scenarios – hopefully without getting caught ;)
Julia performs penetration tests and Red Team assessments for a wide range of IT Projects as an IT Security Specialist at SecuRing. Her main area of interest revolves around Red Teaming, specifically access control systems assessments, RFID hacking, social engineering, and other related topics. She has been selected as the best speaker at SEC-T 2023. She also presented at CONFidence in Poland, No Hat in Italy and Insomni'Hack in Switzerland.