RFID: Flippers and Access Control
summary
Flipper Zero reads and emulates common badges (demo shows EM4100: facility 194, card 14292 at 125 kHz), clones tags, and automates complex attacks (MIFARE Classic RNG crack shows a progress bar). Facility code space is just 256 so attackers can brute force 256 codes in seconds. Low-cost tools differ: Flipper Zero ~$180, Proxmark3 ~$80; Flipper also records/replays 433 MHz remotes, IR, and simplifies NFC/MIFARE exploits. Cars use rolling nonces, but keyless relay repeaters still work; defenses listed: strong encrypted tokens, revoke/rotate fobs, shield keys, and anomaly/audit monitoring.
AI-written summary · about
chapters (12)
- 0:00Introduction and setup
- 1:57RFID basics and concepts
- 4:05Technical mechanics of RFID
- 8:06Emulation and cloning tools
- 11:47Badge physical vulnerabilities
- 15:09Tools for privilege escalation
- 18:32Advanced frequency capabilities
- 21:18Myths and realities of car theft
- 25:55NFC and encrypted protocols
- 30:27Defense and risk mitigation
- 37:04Red team takeaways
- 39:16Q&A session
related talks
40mBiohacking: The Invisible Threat
50mBreaking Access Controls with Blekey
47mMIFARE Classic: Exposing The Static Encrypted Nonce Variant
20mFun with Proxmark3
01h 03mHack To Discover Weaknesses In A Series Of Smartcards
41mGrand Theft House: RF Lock Pick Tool to Unlock Smart Door Lock
41mExploiting Keyspace Reduction And Relay Attacks In 3Des And Aes Protected NFC Tags
44mBreaking the Security of Physical Devices