Talk by Stephen Heath (@dilisnya) from the DerbyCon2012 Wireless Village. I make no claims on copyright on the images contained within.

1. Prox Cards 101
Stephen Heath (@dilisnya)
DerbyCon 2012

2. About me…
Stephen Heath
Director of Security Services
Intrinium Networks / IT Security
Twitter: @dilisnya

3. 30,000 foot view…
• The Basics of Access Control
• Legacy
• 125 kHz Proximity
• Demo Proxmark3
• 13.56 MHz (iClass, MiFARE)
• Attacks elsewhere…
Courtesy of Google maps

5. Whoa!

12. Wiegand Cards
Data Zero
Data One

13. 0-255 0-65535

15. 125kHz Proximity Cards

17. 125kHz Proximity Cards

20. Swiping Proximity Cards…
James Bond © MGM

21. Location, location, location…

22. Hiding the antenna…

23. Choosing a target…

25. 4%
10%
11%
42%
33%

27. 7%
11%
82%

28. The moral?
Sniff a dude’s ass…

30. 13.56 MHz Smart Cards
Challenge
Response
Encrypted data

32. Wire attacks
• Gecko
• Zac Franken
• DefCon 15 (2007)
• Arduino-based Wiegand attacks
• Brad Antoniewicz
• ShmooCon 2012

33. Still card flaws…
• MIFARE Classic 1K
• Crypto-1 broken
• HID iClass “Standard Security Mode”
• Shared crypto key

36. Easy stuff…

37. Easier stuff …

38. Acknowledgements…
• Brad Antoniewicz of Foundstone
• “Attacking Proximity Access Card Systems”
(ShmooCon 2012)
• ProxBrute
• http://nosedookie.blogspot.com
• OpenPCD.org
• HID iClass Demystified
• Zac Franken
• Physical Access Control Systems: Are you
protected by two screws and a plastic
cover?
• N00bz and the rest of the wireless
village team!

39. Stephen Heath (@dilisnya)