The topic of attacks on access badges is widely discussed, but what can an adversary do when cloning someone’s card isn't an option? How else can one gain entry into high-security areas without direct access to the credentials?
In this talk, I will discuss techniques for compromising RFID readers to bypass organizational security mechanisms. We will cover:
- how to intercept the communication between the reader and the controller that are using the Wiegand protocol, along with the demo of this attack;
- how to use this entry point to leverage access through different attacks;
- how the OSDP protocol works and what are the security implications of using it;
- what are the other ways to bypass the access control security mechanisms.
I will also share real-world experiences and stories from Red Team engagements, demonstrating practical applications of these techniques in real-life scenarios – hopefully without getting caught ;)