Re: Sniffing RFID ID's ( Physical Security )

[Adam Laurie <adam.laurie () thebunker net>]

Josh L. Perrymon wrote:
> To summarize the thread...
>
> My question is:
> Is it possible to sniff the data from RFID access control cards and 
> write the contents to a generic RFID card? Then use the copied RFID card 
> to gain access inside the target building?
>
> This is more just theory at this point.
>
> I have read about encryption used for credit cards and the more recent 
> uses for RFID.. but is any of this security built into your standard 
> RFID access cards implementations?
>
> Out of a couple hundred companies I have visited I only remember a 
> handful that required an additional PIN to be entered. So if this is 
> possible then companies may want to look at their current installation.

I've been playing with this stuff for a while now (see 
http://rfidiot.org) and can tell you the following:

1. Most RFID controlled entry systems that I've seen operate entirely on 
the 'Unique ID' and so cloning would be effective (this is even true of 
*some* systems that are actually capable of performing encryption etc.).

2. There are standard devices that already have the capability to 
generate IDs on the fly (e.g. the new UK passport), and since most of 
these things are designed to work with internationally recognised 
standards, building your own would not be rocket science.

3. The defence of carrying multiple RFID devices and causing a 
'collision' on the reader doesn't work on newer devices such as MIFARE 
as collision avoidance is part of the spec.

4. 13.56MHz devices can be read up to about 1 meter away, and 125KHz 
devices up to about 21 meters away.

5. Antennae are available off the shelf that will give you about 200 
centimetres for 13.56MHz (see most department store gateways), and 
wire-wrapping a doorframe will more or less guarantee to get everything 
that walks through it.

6. This is the tip of the iceberg. :)

cheers,
Adam
--
Adam Laurie                         Tel: +44 (0) 1304 814800
The Bunker Secure Hosting Ltd.      Fax: +44 (0) 1304 814899
Ash Radar Station                   http://www.thebunker.net
Marshborough Road
Sandwich                            mailto:adam () thebunker net
Kent
CT13 0PL
UNITED KINGDOM                      PGP key on keyservers

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/