Badge of Shame: Breaking into Secure Facilities with OSDP
summary
Demonstrates concrete attacks on OSDP: a Melon man‑in‑the‑middle and ESPKey‑style recorder that captures badges, a downgrade via capability bit that forces unencrypted traffic, recovery of session keys when install mode persists, and practical decryption from weak library key derivations plus a 32‑bit truncated HMAC that enables replay and birthday collisions. Shows stealing keyset commands from the bus, cloning badges or replaying card numbers, and recommends forcing SC encryption, disabling install mode, and out‑of‑band key setup.
AI-written summary · about
chapters (27)
- 0:00OSDP vulnerabilities intro
- 1:07Badge reader/controller basics
- 3:13Wiegand vs OSDP protocols
- 4:36ESPKey replay attacks
- 5:18OSDP encryption claims
- 6:24OSDP encryption optional
- 7:06OSDP multi-drop explained
- 8:31OSDP client-server limits
- 9:12Protocol WTF number one sequence numbers
- 11:20OSDP HMAC/IV flaws
- 13:47Brute-forcing OSDP encryption
- 15:10OSDP downgrade attacks
- 16:13OSDP handshake flaws
- 17:16Null ciphers in OSDP
- 18:21Install mode attack demo
- 19:04OSDP install mode risks
- 20:50Where vulnerabilities lie
- 22:36Protocol WTF number three encryption modes
- 23:39OSDP library flaws
- 24:23OSDP weak key derivation
- 25:28Encryption not magic
- 26:11OSDP key exchange flaws
- 27:19Key set capture attack
- 28:43Physical OSDP attacks
- 30:28Securing OSDP best practices
- 32:12OSDP verification/cert
- 32:56Q&A
related talks
36mWhen The Front Door Becomes a Backdoor: The Security Paradox of OSDP
21mSecurity is Everyone's Responsibility
42mBreak Crypto like a Pro!
24mSecurity through Transparency: Tales from the RP2350 Hacking Challenge
41mSimulation Hacking, the Good, Bad and the Ugly
22mSecurity Showdown: The Overconfident Operator Vs the Nefarious...
48mEverybody be Cool, This is a Robbery!
36mOpen Sesame - Or How Secure Is Your Stuff In Electronic Lockers