start	end	text
35110	36270	Can you hear me?
48710	51090	The slide looks a little bit like shit, but yeah.
51690	52690	It is what it is.
52690	55110	It is what it is, yes, unfortunately.
56570	60810	Now, do I need to see you on a webcam here, or should we turn off...
60810	63170	No, I have to do that, otherwise you can't stream me.
63170	64490	Alright, alright, alright.
67850	70110	Alright, so, and then we have...
72030	74030	This there, and yeah, ok.
74030	76750	Cool, ooh, look at the background, looks nice, brother.
77930	79370	Man, you've been busy.
79990	81670	And you've got a nice shirt on as well.
81670	84050	I just put on a fucking t-shirt.
84050	85610	You should have told me I could...
85610	90010	I would have swapped to an RRG t-shirt here.
90010	92170	Give me one second here.
96190	97730	It is in the end of the slideshow.
97730	100730	It's loads of crappy slides, but it shouldn't be there.
102890	106930	Well, anyway, we just said goodbye anyway, so that's how it is.
107090	108550	It's a part of life.
109350	112850	We pushed this one a little bit too close.
112850	113510	Dude.
114250	116490	Yeah, so just so you know, we are...
117170	121090	I'm streaming, but I don't think the event has started, so I don't think...
121090	123210	I don't see anything live yet.
123310	126730	Alright, because that's not live until 4 minutes 20 seconds, that's why.
126730	128130	Yeah, yeah, yeah.
137760	139820	Do-do-do-do.
140640	144540	Na-na-na-na-na-na-na-na-na-na.
152240	156740	Do-do-do-do-do-do-do-do-do-do.
157960	162620	So we got the Zero Day Initiative up and running.
162620	163480	Yep.
165060	166220	Yeah.
166220	169540	So basically after we new tools, it's demo time.
169540	174100	Or how did you say? I think that's where we're going to squeeze it in.
175700	178920	Because when we talked about everything, and then we just want to show it off.
178920	179840	Pretty much.
180220	184720	We show off standalone things first, I guess, and then we do Zero Day after that.
184720	186520	And then we do Q&A.
187180	189420	And if you want to have that in...
189420	193580	I'm going to have Discord up and stuff like that, so I can see if there are...
193580	197940	You know, if they keep track of any questions or stuff like that.
197940	198660	I don't think so.
198660	202100	What contact info do you want to use?
203200	207900	Make Iceman at iuses.sc or something like that.
208060	209700	iuseskill or something.
209860	211980	Usually this one goes well.
216300	218440	Yeah, that one works.
219020	220260	Keybase.
222760	223840	Bye.
224730	225820	See ya.
237330	239390	And I need to...
239390	240970	take that one.
241410	242070	Iceman.
242070	242830	Ha!
242830	244410	The Penguin, yay!
244890	247790	I think they are listening in to us already, that's why.
247950	249250	Oh, that's possible.
249390	250950	That's possible, okay.
251070	253690	Let's keep this one clean then.
254770	257730	I mean, I don't know.
257730	259310	I don't know if anyone can hear us.
259310	261590	No one has been saying anything else.
261590	262210	Yay!
262930	263890	Yay!
265970	268930	Turks, this should be...
284720	288000	Alright, I take away Keybase.
288000	290660	And I'm looking here on Turks.
297500	300180	Yeah, you're live and visible.
300180	301540	Alright, nice.
301540	303060	Oh, okay.
303080	303760	Cool.
303760	305660	I've been doing this the whole time.
307340	309060	I don't see it on YouTube.
309060	310300	Ah, right.
310300	311240	I don't either.
311240	312400	That's probably for the best.
312400	313580	I'll save the bandwidth.
315820	318400	No, I meant I'm on the YouTube channel.
318400	320180	I didn't see it there on that one.
320180	322000	Oh, you can or can't see it?
322000	322760	I can't see it.
322760	324900	It's just RFHS logo.
324900	325580	Okay.
325580	327160	But it's live?
327160	328400	Are we sure it's live?
328560	332000	Yes, Zerus just said it on Discord.
332000	333880	But we are both live and visible.
333880	335400	So, hello.
335980	337480	Hello, everyone.
337520	338140	Yeah.
338260	339220	Let's see.
339220	340720	Let's double check.
341120	344200	This is very odd now because now I'm confused.
344420	346680	I gotta say, I'm looking...
348400	350800	I'm looking at the YouTube link.
350800	352800	It doesn't look live.
353500	354280	Yeah, exactly.
354280	357780	I'm on YouTube link and it doesn't look live.
359160	360960	Let's check in with Zero.
360960	363720	I don't want to start until we're sure we're good to go.
364200	365040	We don't...
366340	372120	If anyone can see us and hear us, thank you for standing by as a result.
372120	374240	Potential technical difficulties.
376420	379180	Yeah, because we don't know how this stuff works.
382280	383960	All right.
385280	386400	Okay.
387400	388720	Maybe I should do that privately.
388720	389280	Okay.
392140	392540	So...
393240	395120	Am I on the wrong YouTube channel?
395120	396980	No, it can't be. It should be this one.
398120	400760	It says 27 is waiting.
401400	402740	Yeah, it does say waiting.
403140	403920	Yeah.
403940	405700	See, I don't think the stream has started.
405700	407660	I think we need to click something in YouTube.
408140	409420	Yeah, I think we need to...
409420	412120	You have to enable it in YouTube.
412120	416100	I think that's what Wasabi should do.
416100	417840	If you, Zero, hear this...
417840	419600	I wonder if the stream is still private.
419600	423680	Wasabi set the stream to private, so it needs to be set un-private if that's the case.
423940	425160	Yeah, yeah, yeah, yeah.
427540	429740	Well, if they see us, maybe...
429740	430660	I don't know.
431260	432520	I have no idea.
442970	443730	Boom.
444810	448810	All right, let's see in the chat if someone can tell us if you actually see us here.
448810	452290	And I mean in the YouTube chat, because we can't see ourselves on YouTube.
452290	453250	That's why.
455210	456010	I don't know.
458430	461710	How about now? It's marked public now. Okay, let's see.
461710	464270	All right, let's see if it kicks over.
465430	468010	I'm refreshing it, and it says, waiting for...
469270	471270	It might be on a delay.
472590	474030	Yeah, maybe.
474170	476130	So don't say anything stupid yet.
476510	478590	Because it might be buffered.
479030	479910	Oh.
482530	483870	Oh my.
485450	489170	So where's the live stream exactly? People are asking where it is.
489170	491470	Yeah, I am curious as well.
491470	492150	Yeah.
498080	498720	So...
498720	502880	It's marked private. You have to navigate straight to the live link.
502880	504000	All right.
505840	510340	Mine says, waiting for...
511940	512340	Rfhf...
513360	513760	Rfhacker...
513760	516520	So here's...
516520	518440	Oh, here's a different link. Ah, shit.
518600	519660	Oh, look at that.
519840	520240	Yeah.
520240	521400	They gave us the wrong link.
521400	523360	People have been watching this whole time.
525860	528720	So that means people have the wrong link.
528720	530400	We need to get the correct link.
530400	531220	Yeah, okay.
532360	535040	So I'm going to change back to the other one.
537500	538300	And then...
538300	539240	Oh man.
539240	540540	That sucks.
542840	543740	You can go...
543740	544720	It's public now.
544720	545860	Yeah, yeah, okay.
546060	548740	The new link works.
549820	552520	The one YouTube suggests.
560200	566040	All right, let's go into this chat here and just...
566040	567520	Here we go.
567780	568580	This one, yeah?
568580	571060	Let's go into this chat here and...
571060	572240	No, this one.
573080	574440	No, this one.
577080	579080	Can I delete this one? No, I can't.
579080	580580	Ah, well, the last one.
584030	585510	All right, I don't know.
586030	587770	So, Ferdy's waiting there.
588050	588930	And, yeah.
589410	590650	Eight is watching.
590650	592950	Those eight who's here, hi, it's public.
593430	593870	So...
593870	594670	Yeah.
594690	596770	But the problem is the talk description...
597490	598550	Oh, come on.
598550	599650	It's the other link.
599650	601670	The other link needs to be set live.
602130	603030	Yeah, but I will...
603030	605390	Or I was given the wrong key.
605390	607750	Or I was given the wrong stream key.
608170	608830	I have no idea.
608830	613870	But this one does not have a stream description or anything like that.
613870	615730	So it looks like you have a new link.
617030	617930	All right, yeah.
617930	619490	So, sorry about that.
619490	620670	It says Ferdy waiting.
620670	622270	No, we need to...
622270	624590	Yeah, those Ferdy there is going to be...
624590	625290	Yeah.
625290	626830	Because that's the correct link.
626830	630730	I was either given the wrong stream key or something needs to be adjusted.
633470	638550	For those who are watching this on the other stream, our apologies.
638550	641410	We're trying to figure out exactly what's going on.
641410	643130	Because we have people in two places.
644730	646590	Sorry about that, sirs.
649210	650590	And y'all.
655200	656460	DefconInfoBooth has that link.
656460	657520	We are working on it.
657520	658100	All right.
658100	659360	Here is Filip.
659600	660700	All right.
665220	666960	So he is there.
668620	669340	All right.
669920	671280	Yeah, all right.
675640	676600	Yeah.
676940	678420	All right, yeah.
680060	681660	All right, that's sad.
681660	683740	All right, see if we can get people in here.
684140	685340	Okay, 15 watching.
685340	687340	So everybody who is watching, say hi.
690100	698480	Well, Iceman, the problem at the moment is I'm seeing the waiting count for the actual talk link go up.
698480	699740	So people are still going to be...
699740	699760	Yeah, I agree.
699760	701260	So that needs to be resolved.
701260	702360	Like, I can't...
702360	703100	Yeah.
703100	707560	If we just switch, people are going to miss the information.
707820	709600	Yeah, a little bit upset about it as well.
709600	711940	It's 32 waiting now.
712300	712640	So...
712640	712960	Yeah.
712960	714820	I posted in the chat there.
717360	718940	We're so sorry for this.
720200	721500	Can you repost that link?
721500	722340	All right, let's go...
724360	725500	This one.
725840	726680	Here you go.
727880	729560	Can you post links?
730240	731920	Yeah, I just did.
731920	733120	No, they're being filtered.
733120	734680	They're filtered out of our freaking chat.
734680	735540	Thank you, YouTube.
736680	737200	All right.
737200	738400	You can't see it?
738400	739460	No, I can't.
739460	739960	I can't.
739960	741560	I tried to paste it as well.
742100	743160	Okay, okay.
743160	743860	Shit.
744400	745100	Okay.
747340	749100	All right, all right, all right.
749560	751340	So, if you go to my Twitter...
752160	752940	What?
754140	755940	I posted there.
756680	758660	So, I'm going to do this.
758960	760360	Is this something...
761840	763600	Are you talking to Zero?
763860	767880	Is this something they can resolve by giving us the correct stream key or something?
768040	770040	I have no idea right now.
770160	771500	Let's do this.
771500	774920	And I'm going to see if I have him on Discord.
775580	776380	All right.
776380	778100	Both links works for Zero.
778100	779640	He can see us on both.
780640	781800	What do you want me to solve?
781800	782620	Both links for me?
782620	782980	Okay.
782980	784860	Because only one link works for me.
784860	787860	It's the last link you gave to me is working for me.
787860	789640	The G-H-I.
789760	792820	And the previous one with the stream description doesn't work.
792820	797480	So, that one looks like it's private or...
797480	798680	Yeah, so I...
799820	800780	Okay.
801180	804360	Because you are probably allowed.
805500	806700	Yeah.
807120	808320	Yeah.
812440	814780	Okay, because we are chatting on the...
815440	817940	Yeah, he's posted there now.
822180	823380	Last link...
823380	824420	Works.
829710	830310	And...
834520	836240	All right.
836500	837640	How do I write the URL?
837640	839160	Ah, the deviant is here.
839160	840220	Mark is there.
840220	842480	And Rick is there.
847460	852220	And people to join the last link.
853960	854820	All right.
854820	858780	So, I don't know how they are able to resolve this anyway, so...
869800	871860	All right, we're working on it.
871860	873420	So, I texted Wasabi.
873420	876840	I texted Zero in Discord.
879820	883380	All right, it's like really far back lagging, so...
883380	886260	Oh, wow, I'm not going to listen to myself on that stream.
887080	887940	Oh, just mute it.
887940	889180	Yeah, don't listen to yourself.
889180	889440	Come on.
889440	891740	Yeah, I'm not going to listen to myself.
892380	893360	Oh, man.
893720	894360	Come on.
894360	896120	Okay, so the first link doesn't work.
896120	897380	I'm so sorry for that.
901880	903460	All right, so...
903460	905240	Now it's 30 waiting, so...
905240	908860	All right.
908860	909380	Yeah.
910300	912920	You want to have some girl from Ipanema?
916760	925480	A little bit of Las Vegas elevator music, but, you know, it gives that vibe.
925480	926920	Yeah, yeah.
928600	929120	So...
930400	932480	This seems silly.
933280	934120	All right, so here's...
934480	936400	I think here's going to be our plan.
936400	943620	I will instruct people to click on the RFHS account to move over.
943620	944100	Oh, yeah.
944520	945600	Yeah, do that.
945600	947600	I don't know if people are monitoring the chat.
947600	948840	This is the problem.
949660	950420	Yes.
950420	951380	This is really...
951380	955600	But I posted on Twitter and Discord, and so...
955600	956460	Yeah.
957560	958500	Yes.
958500	960440	And other people have done that as well, so...
962880	963720	Yeah.
963720	965680	All right, let me type out a message here.
965680	967120	Yeah, do it.
968560	970620	Do that, do that, do that, do that.
970620	971500	I'm going to do this.
971500	972400	I'm going to do that.
972640	974760	Oh, Zero says he just did something.
974760	976100	Let's see if something changes.
976680	977740	Fingers crossed.
983980	985560	Well, maybe not.
985560	987320	I'm going to keep typing instructions.
989340	991260	Well, I don't see anything on that stream anymore.
991260	991860	No, I don't either.
991920	993900	I reloaded that one, and so...
993900	994380	Yeah.
995780	998820	29 waiting, so now I don't know if people have sent us...
998820	1000360	It happened to me before.
1000360	1003140	You come in somewhere and don't get it.
1003300	1004520	We're wasting time.
1004520	1006220	It's 10 minutes into this.
1006220	1007080	Well, we got this.
1007080	1008060	It's fine.
1008360	1010780	All right, so we've got 35 watching, at least.
1017000	1017920	Ah.
1020400	1022160	Tuta Denan.
1022280	1024220	Carhackers Deluxe.
1027000	1027800	Okay.
1027800	1034160	I think if America's in them, it seems like those people, it works for them.
1034160	1037080	I'm in the US. I don't see it.
1037180	1038640	Ah, yeah, you're...
1044340	1046740	Yeah. All right.
1053010	1053930	All right.
1053930	1056090	All right. Right, right, right.
1063120	1064740	All right.
1064740	1071840	So I'm going to give it 30 more seconds for people to hopefully see that message.
1073700	1075140	Fingers crossed.
1078720	1080080	Yep, yep, yep.
1080360	1081580	Fingers crossed.
1082660	1083940	Fingers crossed.
1094460	1095840	Oh, yeah. Let's see.
1097940	1098900	All right.
1098920	1101300	So it's 30 still waiting on this one here.
1101300	1104060	Well, so Wasabi did not have the link...
1104060	1107900	Sorry, Xero did not have the link that Wasabi gave me, so I just forwarded him that.
1108480	1109160	All right.
1110660	1111460	Yay.
1112800	1114440	So people's coming here, yeah.
1114440	1116300	All right, so we're up in 44 here, so...
1118280	1121120	Yep. So at least some people are moving over.
1121520	1124440	Yeah, all right. So Olem is here. 25 is waiting there, so...
1126840	1128940	The links doesn't appear in the chat, no.
1129560	1131200	No, it's filtered.
1131200	1132600	So people aren't...
1133200	1134060	Yeah.
1134160	1136280	...sending malicious links to each other.
1136640	1139560	Yeah, exactly. Makes sense.
1144120	1148840	It's almost like an online gaming. It's like, yeah, so are we going live now?
1160680	1162400	Yeah, exactly.
1163320	1165380	So, success.
1166600	1168560	All right, all right, all right, all right.
1170540	1174220	Haha, never took Babak as a standing desk student.
1175160	1176180	Hey.
1176720	1177820	Chris-man.
1178760	1180240	Deviant-man.
1184810	1186270	Yeah, Olem has the...
1187190	1190570	Deviant has the power to make everybody follow.
1192450	1194650	All right, so let's go ahead and kick it off.
1194650	1196230	We did the best we could.
1198530	1199050	And...
1209320	1211540	Yep, yep.
1224520	1225880	All right.
1229020	1231500	So that's fully live.
1235430	1246390	Okay, well, let's go ahead and get started. First of all, thank you everyone for your patience as we worked our way through these problems.
1246390	1254030	This is definitely my first YouTube live stream, so always fun to learn that way.
1254150	1261350	And apparently for the DEF CON Safe Mode Villages, we had some new learning experience as well, so no worries there.
1263010	1267790	And I'm just going to set up the final setting for the slideshow and we'll kick that off.
1274630	1286890	Yep, yeah. That would be an interesting conflict right now because the slides you're going to present is not going to be showing to me if I don't look at the live stream.
1286910	1289230	No, you can look at it in the Jitsi.
1289370	1293230	Ah, yeah, there it is. Perfect. You got the word there for it.
1293230	1295350	Yeah, I know, I know, I know.
1295770	1297050	Don't do that.
1297110	1297490	I know.
1297490	1299490	All right, all right.
1299490	1305130	Thank you again, everyone. We are going to do our best to see how this goes.
1305610	1308570	So we did a couple things.
1308570	1313530	So as you all know, the best thing that you can do if you're a DEF CON talk is have a live demo.
1314430	1319530	Because, you know, the demo gods always smile down upon you when you do stuff like that.
1319530	1324590	So I was talking to Iceman over the past couple weeks and I said, let's not just do one demo.
1324590	1326950	Let's do a crap ton of demos.
1326950	1336310	So I have a wide variety of demos that I've been working 18 hours a day, getting all prepped for the last couple days to fit all this in.
1336310	1339270	We're going to see how it goes. I'm not sure yet.
1339270	1342770	The slides are also acceptable, but not great.
1342770	1348570	So I want to appreciate everyone's, you know, understanding as we do a lot of firsts here.
1348570	1352170	So without further ado, this is Ghosting the Paxman.
1352170	1358990	And we're focusing on new tools and techniques for 2020 related to physical access control systems.
1359130	1363430	To bring everyone up to speed, I am going to start the talk off with a little bit of context.
1363430	1367490	So don't worry, it will get technical further towards the end.
1367490	1369970	But let's go ahead and get started.
1370230	1374110	So we have two people with us, including myself.
1374110	1383790	So I'm Bhavik Jivadi. I'm a professional penetration tester and, you know, log picker, hardware hacker.
1383790	1388210	Been instructing Cobra Methods of Entry for over 10 years.
1388350	1393210	I'm a founder and partner at the Core Group, a consulting and research firm.
1393210	1400370	Also a founding partner at the Red Team Alliance, a premier Red Team training firm as well.
1400370	1409110	And I spent a lot of years, especially my earlier years in the scene, developing and building up the lockpicking community with Tool.
1409170	1416530	So if any of you have ever visited the lockpicking village over the past years, you will have possibly seen me
1416530	1420670	or seen some of the projects that I've been working on in the past.
1420970	1426910	Deviant, big shout out to Deviant for all of his help, helping with some of the last minute slides.
1426910	1431310	I see his comment there in the chat.
1431970	1437410	Iceman is also here calling in remotely, just so everyone knows we're doing a really crazy thing
1437410	1443290	where I have a Jitsi video stream with Iceman that's coming to me from Sweden.
1443290	1448850	So we have Sweden to Phoenix, Arizona, and then we have from Phoenix out to YouTube again.
1448850	1452590	So we got some fun traffic bouncing going on here.
1452590	1455090	Iceman, do you want to talk a little bit about yourself?
1455090	1459590	Well, yeah, sure. First of all, yeah, most excited to be here.
1459590	1462530	And thank you for being able to do this today.
1462530	1468190	And the technical uphill was a little bit more than I expected, but yeah, that's how it is.
1468190	1471570	And it's a heatwave also in my country, in Europe right now.
1471570	1476950	So yeah, I'm sweating. If you see me pounding, it's not just me being normally talkative.
1476950	1479470	It's just, it's warm. It's really warm.
1479610	1484290	Anyway, I'm Iceman. And most of you know me and have seen my Iceman channel
1484290	1487990	and have seen me on Proxmog freely.
1488050	1495550	So I'm an administrator, maintainer, developer, and you can call me an evangelist of Proxmog nowadays.
1495550	1500790	I've been into that since 2013, and I've been lucky to learn this way
1500790	1509030	and being able to meet people and talk to people and learn even more and to become the person I am today.
1509030	1513290	But before that, and during that, and I'm not just spending all my time on this,
1513290	1517750	is that I'm actually a certified MCPD Enterprise Architect in .NET development.
1517770	1524510	And I've been running my own company since 2006, trying to do consultancy and stuff like that.
1524510	1528230	And I like Proxmog more. I have more fun with that.
1528870	1533530	And that led to something called ROG, where I co-founded it two and a half, three years ago,
1533530	1542870	where we ended up with actually making something what you all know as a Rv4, where you all can see my little name on it.
1542870	1547770	And that's me. I don't think you need any more introductions for me, because everybody knows who I am, usually.
1548390	1551010	When it comes to Proxmogs, everybody knows who I am.
1551010	1551890	That's true.
1552250	1556650	And everybody who's new, I'm kind of okay with Proxmogs. All right?
1557850	1565170	So, we have, like I said, we're going to provide everyone some brief overall context regarding access control.
1565170	1571270	We're not going to dive too deep into traditional topics like cloning cards and stuff like that.
1571270	1577610	But I do want to give everyone a nice holistic picture of what a physical access control actually looks like.
1577610	1582990	Because as I try to remind people, when we talk about RFID as it relates to access control,
1582990	1587550	RFID is just the very, very tip of the access control iceberg.
1588110	1589770	It's easy to forget about that.
1589770	1591110	Yes. Yes.
1592030	1597030	So, what we're talking about with access control is normally this.
1597110	1601110	So, this is what most people think of when they think of access control.
1601110	1605330	They think of a door with a reader next to it, and they present a card of some kind.
1605330	1609890	And I know the video is glitching. I apologize for that. We'll just move past it.
1610530	1614970	You present a card of some kind, and you just pull open the door. Right? Simple as that.
1616610	1622850	Oftentimes, there has to be a connector between the physical world and the electronic world.
1622850	1630550	And when it comes to access control, that's usually in the form of an electrified strike or a magnetic lock.
1630550	1634150	You might have seen a lot of mag locks around different doors in different facilities.
1634150	1646030	There are also built-in handsets that have integrated electromechanical components that work all in a self-contained unit.
1646030	1649390	So, you might not see an electric strike. You might not see a mag lock.
1649390	1653550	But it still might be an electronically controlled door.
1654270	1657790	What's happening here, and again, I want to emphasize this.
1657790	1663710	In a lot of the analogies and examples that I use, we are intentionally very, very general.
1663710	1667330	So, we're going to intentionally dumb it down considerably.
1667330	1669290	This is not to insult your intelligence.
1669370	1677430	It's to make sure that we're focusing on the actual concept and not let people get too lost in the finer details.
1677510	1683950	So, generally speaking, these magnetic locks, these electrified strikes, there's a power source of some kind.
1683950	1686670	So, there's a transformer of some kind powering it.
1686670	1689590	Or, if power is out, there's a backup battery.
1689610	1693150	But, of course, it's not just connected directly to a power source.
1693150	1695970	Ultimately, it's connected to a door controller.
1695970	1703010	The door controller is generally an embedded device of some kind, often runs on Linux, but not always,
1703010	1710910	that has a series of power supplies, relays, and other microcontrollers to take in multiple inputs
1710910	1716830	and make logical decisions based off of that, and then control certain outputs.
1717450	1721310	So, credentials come in, and then something happens on the output.
1721310	1726810	So, whether you have a prox card or a mag stripe or a weekend swipe card, which we'll talk about in a moment,
1726810	1731450	those are all different types of inputs as far as the credential data is concerned.
1731570	1739370	So, in terms of credentials, we are talking about a card, like something you have, or a pin, which is something you know.
1739370	1746150	Or, in the case of biometrics, like a fingerprint or iris scan, facial recognition, what have you, something you are.
1746210	1750850	But, ultimately, as we mentioned, it's just a panel making decisions based off of inputs.
1750850	1759610	So, here is an example of one of the most common types of inputs that people might see.
1759610	1764590	People have probably seen how to bypass doors using a can of air.
1764590	1767670	Well, here's another kind of input that that relates to.
1767670	1773710	So, here's our access control system, and we have a couple of players here.
1773710	1781030	And imagine that the bellman here is a door stripe, so an electrified stripe.
1781030	1786570	Then we have our manager, our door controller, and then we have, sorry, not our card reader.
1786570	1790570	We have a REX motion sensor, which we'll see a photo of shortly.
1790670	1795710	So, whenever that motion sensor activates, depending on how the door controller is configured,
1796310	1800770	that door controller is going to make a decision saying, hey, I should let that person out.
1800770	1802550	Let's go ahead and open up that door.
1802550	1805990	And this is something that, again, a lot of folks are going to be already familiar with,
1805990	1809350	because these REX sensors are very, very easy to fool.
1809410	1812530	So, here we have a double door.
1813390	1826430	Someone's on the locked side, and they're just going to use a burst of air to trick that REX sensor into seeing a motion
1826430	1828250	and then allowing you to open the door.
1828250	1831670	And I'm seeing that some of the videos are not playing correctly in PowerPoint.
1831670	1837750	I apologize for that, but we'll just kind of move past it and see if the next one does any better.
1837750	1839570	So, we'll try again.
1839670	1846670	So, here is a different lab, and we were showing one of my friends how this process works.
1846690	1851730	And so, what he's going to try to do is, oh man, jumping all over the place.
1851730	1858710	He's going to try to take that canned air, turn it upside down, insert it between the doors, and trip that motion sensor.
1858710	1863570	Oh man, okay. Videos are bad for live streaming. That's what I'm learning.
1863570	1867690	So, we are going to probably not play a whole lot more videos.
1868010	1870370	But we're not going to focus on that topic too much.
1870370	1878510	Suffice to say that there are different ways of manipulating different motion sensors as they relate to door controllers.
1878510	1880250	So, that's the most common method.
1880290	1882210	We're going to skip over a couple more videos.
1882370	1884410	These are the sensors that we're talking about, right?
1884410	1886490	So, these are normally mounted above doors.
1886490	1888510	And they can be used in one of two ways.
1888510	1897010	They can either be used for automatic egress, where simple motion will activate the electrified strike and allow you to exit.
1897110	1901450	Or, it might be used for detecting forced entry.
1901450	1906770	So, let me just see really quickly if those slides exist.
1906770	1908690	So, pardon me one moment.
1908690	1913230	I'm realizing that a couple of these slides might have been out of order.
1913230	1920250	So, we will switch cameras briefly while we check that.
1920810	1927590	Have you noticed the really sexy soldering station behind Babak?
1927590	1930190	You know, I'm getting jealous.
1932990	1941730	Okay, so yeah, I'll just explain it and talk through it since apparently I don't have the door contact slides in this deck.
1941730	1944470	So, my apologies for that.
1944590	1948570	One moment as we get the presentation spun back up.
1950780	1953240	And then switching back.
1953240	1954120	Alright.
1955680	1960120	So, a lot of doors can have little door position switches.
1960120	1964980	These are magnetic sensors built into the door and the door frame.
1964980	1968540	And that allows the door controller to monitor the state of the door.
1968540	1977940	So, basically there is some logic in the door controller that says if the door opens and it's not preceded by a valid card read,
1977940	1983520	or it's not preceded by someone approaching the door and tripping one of these motion sensors,
1983520	1988040	then it's going to assume a forced entry state and it's going to trigger an alarm.
1988040	1991880	So, those are the two use cases for rec sensors, for example.
1991880	1993640	There are other types of inputs.
1993640	1994900	They're not as common.
1994900	1997020	We're not going to talk about them in this talk.
1997020	2001420	But if you're curious about that, definitely find me online or offline later.
2001420	2004180	And I'm happy to go over extra stuff with you folks.
2004180	2006920	So, we'll just go ahead and skip past more videos.
2007000	2012420	But ultimately, enterprise access control systems contain a multitude of different components.
2012420	2014200	So, we have our credentials.
2014200	2017280	These are things that most folks are very familiar with.
2017280	2022860	We have the readers, which come in a lot of different technologies, shapes, colors, sizes.
2023100	2024580	We have the door hardware.
2024580	2027000	That's what's actually securing the door.
2027000	2031840	And then we have our motion sensors, our door position switches, etc.
2032020	2035900	Our door controller, which actually handles all of the decision making.
2035900	2045300	And then a server of some kind that actually contains the main primary user database that is synchronized across different door controllers.
2045340	2046780	And these are all connected, right?
2046780	2048000	They all play nice.
2048000	2057420	Except, this is not a system that is connected in the way that some folks think it is.
2057420	2064240	Each segment of an access control system operates independently of the other segments.
2064240	2071140	And we can take advantage of gaps that exist between these different segments to manipulate the behavior of the system.
2071980	2077040	So when we talk about RFID, when we talk about PROX, when we talk about MagStrike,
2077040	2085560	what we're only talking about is that very, very first link between the credential itself and the card reader.
2085560	2088820	It just has nothing to do with anything behind it.
2088820	2092200	RFID operates independently of everything else.
2092200	2098580	So when we talk about access control, we're not just talking about RFID, we're talking about everything.
2099360	2103810	So first, to really understand a little bit of the history of RFID,
2104100	2109120	I want to talk a little bit more about the history of credentials and cards in general.
2109120	2111820	So a lot of folks have heard the term WIEGAND.
2112000	2121800	WIEGAND is actually a man who moved and immigrated to the U.S. back in the early 1900s,
2121800	2124880	originally to study music at Juilliard.
2124880	2130180	And through his different experiences became very interested in audio amplifiers
2130180	2138140	and ultimately became a wonderfully innovative researcher
2138140	2143460	that came up with some really cool ideas and discoveries revolving around electromagnetics.
2144320	2147900	Most people know him for his invention of the WIEGAND wire.
2147900	2151120	And this is actually, even though it's very, very old technology,
2151120	2155400	it's something that still permeates access control as it exists today.
2155760	2160240	And understanding that this is where modern access control comes from is important
2160240	2165300	because it informs a lot of the different weaknesses, limitations, and vulnerabilities
2165300	2168420	that exist in access control still today.
2168860	2172080	So let's talk a little bit about these WIEGAND wires.
2172440	2174240	I'm going to skip a couple slides.
2174240	2180400	I'm actually just going to switch to a downward-facing camera here.
2180400	2186440	What I have here is an original WIEGAND swipe card.
2186440	2188560	Let's move our camera down here.
2188560	2195480	And I've actually also got an original WIEGAND reader.
2196300	2199480	And we'll get this powered on as well.
2202640	2204620	Adjust our camera.
2205200	2206900	There we go.
2206900	2213480	All right, so we have our display here that is connected to the card reader.
2213480	2216780	This is kind of pretending to be a door controller of sorts, if you will.
2216780	2219980	And I'm just going to swipe this card.
2219980	2222160	And let's see if I do it right. There we go.
2222160	2223640	So I got some data.
2223760	2229320	This says Facility Code 40, card number 2115.
2229320	2231020	Where did that data come from?
2231220	2232820	These wires on the back.
2232820	2237700	So I've actually taken a blade and I've removed a layer of the plastic from the card.
2237700	2239860	So we can see these wires.
2239860	2242220	These wires are very, very interesting.
2242220	2246500	Because they exhibit a very peculiar electromagnetic property.
2246500	2251920	As they pass over permanent magnets of a given polarity,
2252760	2259400	the outside shell of the wire magnetizes at a different rate than the inside shell.
2259400	2264100	And the reason that happens is because during manufacture, that wire is actually twisted.
2264180	2270160	And so the outside of it is work-hardened in a way that makes it more brittle and more hard than the inside.
2270740	2274880	When you do that to wire, something very interesting happens.
2275200	2277980	So here we have a sense coil.
2278100	2281880	And we have two permanent magnets oriented in opposite directions.
2281880	2289080	As these weekend wires pass the first wire, and both the outside shell and the inner core of the wire are magnetized,
2289080	2292500	and then you move that wire towards the second one,
2292500	2300060	the center of the wire flips polarity faster and before the outside of the wire.
2300060	2308200	And that results in a very interesting behavior that results in a field that can be picked up by this sense coil in the middle.
2308200	2317160	So inside this reader here that you see on my small screen, there are actually multiple sense coils and multiple magnets.
2317160	2324600	And what it's doing is as these wires are passing over it, those wires are briefly getting magnetized and demagnetized.
2324600	2329200	And that sense coil is picking up these pulses coming back off of the wire.
2329320	2332060	Now this was used in a lot of different applications.
2332060	2339460	It was used in everything from anti-lock braking systems to machine automation in factories and such.
2339460	2343840	It's in fact still used today in a lot of different mechanical applications.
2343840	2350500	There are even casino chips that use weekend wires inside the chip to identify that the chip is authentic.
2350500	2355180	Because weekend wires are historically very difficult to manufacture on your own.
2355180	2361360	In fact, there's only one machine that I know of in the United States that still produces this type of wire.
2361360	2364940	And it's not in operation very much.
2364960	2371680	HID, which used to make weekend cards, some time ago sold their only machine to a company in Germany.
2371680	2375340	So this is not something that is easy to do on your own.
2375340	2383120	In fact, the only way that I can get my own weekend wire is dissolving it or harvesting it out of other weekend swipe cards.
2385960	2389600	So, let me keep going here.
2390320	2394200	And apologies if anyone's asking questions that I'm not seeing yet.
2394200	2396600	I'm going to focus on questions during the Q&A.
2396600	2400660	We have a lot of content, a lot of demos to get through, so I want to focus on getting through that.
2400660	2403460	So I appreciate everyone's understanding with that.
2403500	2414340	So weekend wires, as they're used in swipe card systems, they literally represent the 0 bits and the 1 bits of the credential data.
2414340	2415780	What do I mean by that?
2415780	2420000	Well, let's take a look at an example.
2420540	2426400	I'm going to open up a notepad window here and walk people through.
2429560	2432860	It is ultra cred for this old tech.
2432960	2436160	It's the basics, it's the beginning of things.
2436160	2439420	You see the red thread pretty soon.
2445070	2451470	Alright, so what we're going to do is we're going to together decode...
2452550	2455490	Well actually, for the sake of time, we won't do that.
2455490	2457210	I'm just going to tell you how it all works.
2457210	2464290	So here I have a real weekend card and here I have a fake one.
2464610	2469450	So what I've done is I've just... I'm just going to switch this back here.
2473900	2475720	Nope, not that one, that one.
2475720	2481700	So what I've done here is I've just printed where the weekend wires would be on a card.
2481700	2484820	To give you a little example here.
2484820	2488860	So we're going to pretend that these are real wires on a card.
2488860	2493300	And these top wires are the 0 bits, these bottom wires are the 1 bits.
2493360	2496580	And the swipe direction is like this.
2496580	2503920	So what that means is if we're flipping this over, these bits are at the beginning of the credential and these bits are at the end.
2503920	2513790	Now, what I have here, and I'm going to switch windows here, is Notepad.
2514010	2522070	And I'm going to copy this.
2523670	2525890	And we're going to move Iceman down.
2525890	2527090	Whoops, not that.
2527910	2529250	Are you moving me down?
2529250	2530470	Yeah, right?
2531950	2533310	Alright.
2534190	2541610	So, if you can see, I'm going to move this camera even closer.
2542830	2547890	So, compare this binary string up here.
2547890	2553170	If we compare it to this card from right to left, you'll see that it matches.
2553170	2554610	So here's our 1.
2554750	2561750	And then we have, I'm going to use a pencil as a pointer here to make my life a little bit easier.
2561750	2563870	So we have a 1 and we have two 0s.
2563870	2570130	We have 1, 0, 0, 1, 0, 1, 0, 1, 0, 0, 0, etc.
2570130	2572250	And we have 26 of those wires.
2572250	2582250	And that corresponds, in this particular example, with 26 bits that are read from the card by the reader and then sent onward to the door controller.
2582250	2590970	So those original systems, developed in the early and mid 80s, just took that raw data and sent it to the door controller.
2590970	2596550	And thus began the Wiegand communication protocol as a standard.
2596610	2601050	Then there's this also here as a Wiegand bit format.
2601050	2604430	So here we have the open 26-bit format.
2604490	2609250	And if we take a look at this next slide here.
2609250	2614270	This is just one example of a Wiegand bit format.
2614270	2618130	Now, there are many. We're not going to talk about all of them. This is just one.
2618170	2632170	The phrase Wiegand bit format refers to how you can decode a group of binary bits into something that we're going to arbitrarily call facility code and card number.
2632170	2639670	So with the 26-bit format, for example, we have 26 bits. The first and last bits are parity.
2639830	2644370	And then we have 8 bits used for the facility code and 16 for the card number.
2644370	2647790	Again, that's just the open 26-bit format.
2647790	2657510	So if we come back over here and pull up a little calculator here.
2679230	2681150	There we go. Alright.
2681630	2684510	Oh, Iceman is on top of my calculator.
2686730	2688230	Crunching numbers, am I?
2688310	2692830	Yeah, yeah, yeah. We're just going to move the calculator itself.
2693390	2694430	There we go.
2695150	2697750	Alright, so what do I mean by that?
2697750	2699850	Here's those first 8 bits.
2699850	2706850	If I copy that and convert from binary to hex, there's our decimal 42 value.
2707010	2716130	And if I take this and I copy that and I convert it from binary to hex, or sorry, to decimal, there's our 16180 value.
2716130	2722330	So the phrase facility code and card number really only refers to these little arbitrary values
2722330	2729450	that we define as part of the whole PACS data stream that gets sent from the card reader to the door controller.
2729450	2732590	If that doesn't fully make sense yet, that's okay.
2732590	2735390	We can talk about it more in depth during Q&A.
2735390	2739270	But just understanding that this is what the credential data itself is.
2739270	2742250	This is your token that is actually granting you access.
2742250	2746030	This is the important thing. Understanding that concept is important.
2746710	2751010	So we have our WGAN data stream, and that's what's stored on the card.
2751270	2754750	As technology progressed, we're going to switch back here.
2755630	2760230	As technology progressed, oh, this is actually a cool link.
2760230	2762390	I just forgot this slide was in this order.
2762390	2768610	If you want to learn about more WGAN data formats, this is a great site that has some really wonderful tools.
2768610	2776810	So if you go to cardinfo.barkweb.com.au, you'll actually see a bunch of different WGAN formats,
2777190	2778990	some more popular ones.
2778990	2783250	There are technically hundreds, if not thousands, of proprietary WGAN formats,
2783250	2784210	and these are just some of them.
2784210	2789650	But if you want to learn more about them, check out 0xFFFF's website there,
2789650	2794790	and you'll see quite a few variety of formats.
2795770	2801910	So inside a modern credential, when we're talking about prox cards, when we're talking about RFID,
2801910	2805870	and I have actually an example here.
2805950	2812950	So here we have a low-frequency card that is made of clear PVC rather than white plastic,
2812950	2814790	so you can see what's inside.
2815650	2822070	These are just containers that are different ways of holding that same WGAN data.
2822070	2830050	What I mean by that is even when you present these different kinds of cards and credentials to the reader,
2830050	2833570	the reader is just looking for that PAX data that it recognizes,
2833570	2840130	and it's still converting that into that kind of somewhat ancient format that the door controller was expecting,
2840130	2846050	because that's kind of the system that everyone agreed upon and everyone used for the sake of PAX compatibility.
2848970	2854310	So when we talk about credential-to-reader communication, when we talk about RFID,
2854310	2860830	when we talk about the signal between cards and readers, whether it's prox or I-class, what have you,
2860830	2862910	these are all just different containers.
2863170	2866550	So I'm going to give you another analogy to kind of get this point across.
2866550	2872650	So we have, again, our RFID credential, we have our RFID reader, we have our door controller,
2872650	2874830	and then we have our door hardware, right?
2874830	2880610	So we're going to look at the access control system as if it's all people having a conversation.
2882710	2887770	So that card reader is always looking for a credential, it's always interrogating, right?
2887770	2891770	So here's our card reader saying, hello, hello, hello.
2891930	2899730	Eventually, a credential comes along and it says, hello, I am 43-1048.
2899950	2904490	The card reader says, oh yes, 43-1048, I will send that on.
2904490	2910850	Door controller gets that information, they recognize the user, they go ahead and activate the electrified strike.
2912570	2917910	Another user comes along. Maybe this is a different credential.
2917910	2921910	It doesn't matter. Its conversation might be simpler.
2921910	2929870	It might not have all of this extra syntax and structure or preamble, but the data is still formatted the same way.
2929870	2941790	So that older, dumber credential, if you will, will still provide information the reader translates into a standard format that the door controller is expecting.
2943470	2946390	So the syntax and preamble can vary.
2946390	2955370	So for example, here is a different user and they might say the information in a different way.
2955370	2960170	It might use a different communication language, so to speak.
2960170	2971130	But that card reader, again, is still going to convert that into a sanitized standard format and send that to the door controller, which the door controller sees and does its thing.
2971130	2981570	Notice that in all of these examples that we have discussed so far, the door controller doesn't have any idea about the rest of the conversation that is happening between the card and the reader.
2981570	2989610	It doesn't matter if the card is prox or andala. It doesn't matter if it's a high security card or a low security card.
2989610	2996350	Because when the data goes from the card reader to the door controller, it's still going to be formatted in that same standard way.
2997570	3002970	So apologies for the sake of time. You're going to see me skipping over a couple of slides. That's okay.
3003130	3006430	Some credentials, we're going to say, speak other languages.
3006430	3012790	What I mean by that is that they might present the data in a way that initially doesn't make sense.
3013030	3019030	So there's, you know, instead of prox, maybe that's like an EM card.
3019590	3023770	I'll give you an example of what I think an andala conversation will look like.
3023770	3031710	So andala is notorious for scrambling the order of how the bits are sent from the card to the reader.
3031710	3039750	Iceman is laughing because we spent way too many hours debugging andala encoding and decoding problems a few months ago.
3040630	3046250	So here's an example of a conversation between a card reader and, say, an andala credential.
3046250	3052470	So instead of providing everything in a nice, easy-to-understand format, that andala credential might say,
3052470	3059090	Oh, yes, here's a bunch of numbers. And if you understand the correct way to parse my sentence,
3059090	3066110	then you will also know that this is the format that it actually wants and it sends that to the door controller.
3066210	3072470	Again, this is really, really dumbed down. That is intentional because this is not the thing that we're learning about.
3072470	3079770	What we're learning about right now is the foundation of the card reader is going to send sanitized data to the door controller.
3079770	3084270	And that's important for understanding all the other demos and stuff that we're going to end up showing you.
3087150	3094170	Then there's the difference between low frequency and high frequency. That's a very commonly misunderstood difference.
3094170	3098130	So we're going to, again, use really, really simple analogies.
3098190	3102970	So remember that that credential reader is looking to talk.
3104130	3105850	So here is.
3107550	3115590	Here is a example of a contactless smart card, right? So instead of just providing the information without any authentication,
3115590	3119810	there is something that takes place between the card and the reader called mutual authentication.
3119850	3129030	There is a secret handshake that takes place between the card and the reader that has to be mutually authenticated by both sides
3129030	3134590	before that card data can be read from the card and then transmitted to the door controller.
3134670	3141010	So if you are trying to, say, get this card's data and you don't understand that handshake protocol,
3141010	3143870	you won't be able to actually get that credential information.
3147530	3150350	So how many languages does your reader speak?
3150350	3155730	I'm going to be showing you a couple of demos today using what are called migration or transition readers.
3155730	3162390	Some readers will only work with one type of credential, meaning they only speak one language.
3162390	3165330	Some readers will read multiple credential technologies.
3165330	3172210	They might read Prox and Mandala and also some high-frequency stuff like MyFair or iClass or Desfire.
3172210	3181570	So your card reader might speak multiple different languages and have the ability to read multiple credential technologies,
3181570	3184410	but again, door controller does not care.
3184410	3189170	Door controller is still, again, getting sanitized data from the card reader.
3189630	3191570	We're going to skip ahead a little bit.
3193130	3198570	So when you are cloning, you need to know the same language that the reader is speaking, right?
3198570	3208270	So here's our attacker. Our attacker knows how to talk to the card and it records that information.
3208270	3215970	And then when we approach the reader, we're going to speak the same language as the original card, right?
3217770	3220330	What if you don't know the language?
3220330	3225810	And what I mean by this, and we're going to do demos about all this, so I apologize if I'm going a little bit fast.
3225810	3228170	I want to make sure that we have time to cover everything.
3228630	3230390	What if you don't know the language?
3230390	3238310	What if you have an encrypted credential or contactless smart card that you don't know the key or the password to?
3238310	3241370	Or you don't know the protocol. How do you deal with that?
3241370	3248430	Well, remember, the thing that we actually care about is the credential data itself, not necessarily the card.
3248430	3250330	The card is just a container.
3250770	3261360	So here, as an attacker, we're looking at a credential in a reader and we're like, man, they have a secret handshake.
3261360	3266140	I don't know how to replicate that secret handshake.
3266180	3271080	So instead, what we're going to do is we're going to take that reader off the wall.
3274310	3276190	We're going to borrow him, right?
3276190	3280170	So we're going to borrow the reader. We're not even going to connect it to a real door controller.
3280170	3282850	We're just going to connect it to our own data logger.
3283330	3286390	And we're going to give it some power and we're going to read a credential.
3286390	3290010	So that card reader knows the secret handshake.
3290010	3293890	It's able to talk to that credential and get that PAX data.
3293890	3295610	And now we have it as well.
3296210	3302970	If we can find another way of getting that PAX data to the door controller, then that's all we need.
3302970	3304230	The game is over.
3309260	3314100	So in this example where the card reader can speak multiple languages, so to speak,
3314100	3318880	we can just provide that card information in a format that the reader understands
3318880	3323980	and then the system will operate as if it was the original card.
3326920	3332220	I'm going to give you one more analogy just to really kind of seal in the flavor, so to speak.
3332220	3337040	Think of low frequency credentials like PROXX, Andala, IO, EM, and others.
3337040	3343240	Think of them as just a file folder that all you have to do is open it and there's your WGAN data.
3343240	3348280	It's just right there. You don't necessarily have to understand what all the ones and zeros mean,
3348280	3352600	but you can just take that piece of paper, stick it in a copy machine, and now you have a duplicate.
3354160	3360300	With smart cards, with high frequency credentials, what we're talking about is taking that credential information,
3361020	3368300	locking it in a bag, and then putting that bag in a safe with a unique combination that only the reader knows.
3368920	3373180	That's what we're talking about when we talk about MyFair, when we talk about iClass.
3373340	3377380	Again, we're not going to get too deep into technical details because we don't have time for that.
3377380	3381700	We have a lot of demos we want to show you, so we'll skip over these slides here.
3382840	3389560	So, now that you understand that, you understand the building blocks of what I call a technology downgrade attack.
3389680	3397640	This is a slide that anyone who has seen any of our trainings that we've done over the past 10 years or so may have seen.
3397640	3402140	It shows an iClass SEOS card next to a Prox card.
3402400	3409100	And what I explain is that as far as the door controller is concerned, these two cards are equal.
3409100	3410600	Well, how can that be?
3410600	3416880	What we're talking about is a situation where the card reader can read multiple credential technologies,
3416880	3419900	but the PAX data on both cards is the same.
3419900	3423160	That will make more sense once I start doing the demo.
3427430	3434810	So, just to give you an example of readers that can speak multiple languages, so to speak,
3435350	3442370	I have here an example of what we call a migration or transition reader.
3442430	3447950	I'm going to try to get this to focus.
3452460	3455080	All right, it's focused-ish.
3455560	3456620	Let's see.
3459290	3461850	Come on, camera, you can do it.
3461850	3464190	A little bit up.
3464770	3472730	Yeah, it really doesn't want to be focused.
3473610	3475270	All right, it's close enough.
3475270	3477250	We can see that that word says secured.
3477390	3479930	So, this is an example of a migration reader.
3480070	3485490	This is a reader that is used for customers that are upgrading from an older technology to a newer one.
3485490	3489790	So, let's say you have a facility that is still using Prox or still using Andala,
3489790	3493530	and you're like, man, we've got to upgrade, but we've got thousands of doors.
3493530	3495170	We can't do all that in one weekend.
3495170	3498250	That's unrealistic and sounds very expensive.
3498370	3501290	So, instead, what you do is you use a migration reader.
3501290	3506310	The migration reader can read both older credential technologies and new ones.
3506370	3512710	So, at your own pace, your integrator can go out and upgrade readers in the building,
3512710	3519350	and when an entire site has all the readers changed, then you can start upgrading credentials.
3519350	3524130	So, while you're doing the upgrade, everyone who still has old cards, their cards still work,
3524130	3527970	because those new readers speak multiple languages, right?
3528090	3532210	Once all the readers have been replaced, then we can take people's old cards away
3532210	3537230	and show them newer, secure credentials, which the readers also understand.
3537310	3541890	However, what is not always done, a step that is often missed,
3541890	3549250	is disabling that older credential technology in the reader and preventing those old cards from working.
3549330	3555790	That's important, because if you don't do that, then you're susceptible to what's called a format downgrade attack.
3556030	3558970	Not format, technology downgrade attack.
3558970	3561970	This slide had a typo there.
3561990	3569690	So, I'm going to show you multiple cards that are going to show up as the same credential,
3569690	3571530	but they are different technologies.
3571770	3575810	So, we have here a prox card.
3575810	3579710	So, we're going to present that prox card, and that gives us access granted.
3579710	3588410	Our WGAN data represented in hex, for the sake of simplicity, is 2547EC068.
3588570	3591950	Here's a different card. This is an Indala card, right?
3591950	3597190	Different card technology, but it's encoded with the same PAX data.
3597190	3602830	When I present that credential, we can see the same data, 2547EC068.
3602870	3608170	Again, for those of you who might have gotten lost, when I switched from binary to hex, it's the same data.
3608170	3611370	We're just representing it in a different base.
3611370	3614970	So, it's base 16, instead of base 2 or base 10.
3615410	3620810	So, as far as the door controller is concerned, these two cards are the same.
3620810	3625690	It's seeing the same data, because this reader speaks multiple languages.
3625690	3630850	Here's a different example. Here is a I-class credential, right?
3630850	3634310	And again, the same data is on the card.
3634390	3642350	So, now you're beginning to understand that the card technology itself doesn't matter, because the card is just a container.
3642350	3647650	It's what's inside that card that matters to both the reader and to the door controller.
3650920	3656600	So, let's see here. Let me see if the live demos are coming up now or next.
3657420	3660780	We're going to do all the live demos at once, so I'm going to get through all of this content.
3660780	3664640	Iceman, what do you think? Should we get through all the slides and just do all the live demos at once?
3665140	3668480	Let's go all the slides and then we'll take the live demos afterwards.
3668480	3669740	Yeah, I like that idea.
3669920	3672000	I like that concept.
3672680	3675540	So, remember, technology downgrade attack.
3677980	3682840	So, now we talked about cards to reader communication.
3682940	3687400	Let's talk briefly about reader to panel communication.
3687400	3690820	What does it look like after the reader has read the credential?
3690960	3697000	Well, here is that visual representation of WGAN data on the wire, but I can do you one better.
3697000	3698660	I can actually show you.
3699780	3704720	What I'm going to do is I'm actually just going to remove this reader.
3704720	3717900	So, here's that reader that we were just using, and I am going to connect it to a logic analyzer.
3721360	3723160	So, there's our card.
3745000	3751600	Alright, so, again, we have our reader, which is currently covered up by Iceman's beautiful face.
3751600	3754880	So, I'm just going to move this down here.
3755260	3756560	So, here's our reader.
3756740	3758440	Good, our video is still working.
3758740	3763200	And what I'm going to do is I already have my channels set up.
3763200	3770540	So, this channel 0, channel 1 is actually directly connected to those WGAN data lines coming out of the reader.
3770540	3774840	So, this is the electrical signals that the door controller would be seeing.
3775460	3778540	And I'm going to take that same I-class credential.
3779420	3781920	So, here's an I-class credential, right?
3781920	3785660	And I'm going to start recording, and I'm going to present it to the reader.
3785660	3787580	And you just saw a blip go by really fast.
3787580	3790660	Let's go ahead and zoom out and zoom back in.
3791660	3794940	And we have the data represented in two different ways here, actually.
3794940	3797440	So, we have, here's the digital representation up here.
3797440	3800660	So, we have the line pulled high, the line pulled low.
3800660	3804240	And here we can see what that actually looks like from an analog perspective.
3804240	3810660	So, normally those data lines are held at 5 volts, and then they're pulsed briefly to 0 volts, and then released again.
3810780	3818860	Now, what I really love about this particular example, and I'm going to try to zoom this so it all fits on the screen.
3818860	3819560	Perfect.
3819560	3823180	Alright, remember this fake Wigan card that we made?
3823180	3824760	Let's take another look.
3825000	3827850	I told you that all those cards have the same data.
3829800	3843670	If you look at the data represented in the logic analyzer, you'll notice that all the ones and zeros line right up.
3843670	3853050	So, here we have 1, 0, 0, 1, 0, 1, and here we have 1, 0, 0, 1, 0, 1, and so on and so forth.
3853050	3854670	It's literally that simple.
3854670	3864690	As the data comes out of the reader, it's being converted into these very, very basic electrical signals that the door controller interprets as logical ones and zeros.
3864810	3870310	So, there's no extra layers on top of it beyond that.
3870310	3884550	We just scanned an I-class credential, but we can see by connecting to the wires that we're still just seeing the same data as if it was still a Wigan credential from the 1980s.
3884690	3891350	And that is a really important piece of context that I think is important to be aware of.
3891610	3904980	So, we'll go ahead and move that back out of the way, and we'll switch here.
3905700	3912000	So, again, no matter what you're talking about as it relates to the credential, that's just talking about the first link.
3912000	3916660	It has nothing to do with that second piece of the communication.
3916660	3919880	That is usually Wigan. Not always.
3919880	3924260	There are a couple of data protocols and communication protocols that exist.
3924280	3926260	Most of them are unencrypted.
3926260	3934900	OSDP version 2 has something called secure channel protocol, which can encrypt the data between the card reader and the door controller.
3934900	3941480	It does have to be set up correctly for it to work reliably, but that is the only way that that credential information is encrypted.
3941480	3950120	And it's one of the mitigations that we will discuss at the end for ways that you can defend your access control system against malicious manipulation.
3951540	3961100	That Wigan communication, that signal that you all just saw on the logic analyzer, is something that we can intercept, and we can take advantage of how simple it is.
3961100	3963680	There have been a number of tools over the years that do this.
3963820	3970400	Years and years ago, Zach Franken and Adam Lloyd built a beautiful tool called the Gecko, and then later on the Chameleon.
3970400	3976720	And its only job was to sit on those Wigan wires, intercept that data, and then allow you to come back and replay it.
3976720	3980760	In recent years, there have been a number of open source projects that do the same thing.
3980760	3986100	A few years ago, Mark Visaggio and Eric Evinchik released the BLE key,
3986100	3993540	which is a little battery-powered tool that you punch down behind the reader and it just monitors those Wigan data lines and records credential information.
3993920	4001760	And then a little bit more recently, also still a few years ago, one of our other friends, Kenny McElroy,
4001760	4008800	he developed the ESP key, which was powered off the bus rather than the battery, and used Wi-Fi instead of Bluetooth.
4008800	4013400	But the concept was the same. This is something that you can install behind the reader,
4013400	4018540	and intercept that credential information, and then just come back and replay it.
4018540	4024300	If we have time, after all of our other cooler demos, in my opinion, we can do a demo of that as well.
4024300	4032220	But I just wanted to cover this as something that is a completely valid attack still today on any systems that are running Wigan.
4034930	4039150	So what we're doing with an ESP key is, again, if we think about our analogy,
4039710	4044030	when that credential data is read from the card and transmitted from the reader to the door controller,
4044030	4049630	the ESP key or the Gecko or the BLE key, it's listening and it's able to record that information.
4049730	4054970	Then when we as an attacker approach the door, we don't actually deal with the card reader at all.
4054970	4061250	We don't have a card even, necessarily. What we do is we interact directly with the ESP key,
4061250	4065490	check to see if there's any credentials recorded, and then tell the ESP key to replay it.
4065490	4069650	The door controller, not knowing that there's another device connected to the line,
4069650	4073150	will see the same data and process the transaction the same way.
4076160	4080000	Just a couple of photos of the install. We'll skip over the video.
4080000	4083900	The last piece, panel to server communication.
4084040	4088680	And we have a special surprise demo with this one as well that hopefully we have time for.
4090300	4096180	Remember, these door controllers often do run on Ethernet, especially today.
4096180	4104040	And remember how I said they are basically embedded Linux devices that maybe aren't always super protected?
4104040	4113000	So both the software and the door controllers themselves have to be protected properly on a segmented network.
4113000	4115480	Otherwise, interesting things can happen.
4115520	4120920	Because these door controllers are usually Linux devices or other embedded hardware
4120920	4126460	that are not part of the normal IT infrastructure, they're not part of the normal patch cycle.
4126460	4130760	In fact, a lot of vendors specifically call out in the instructions
4131640	4141020	that you don't have to tell IT about this because this is just a physical security appliance.
4141020	4144540	This is not a computer, even though it actually is a computer.
4144660	4151380	And so you often times run into situations where libraries, open source libraries used by Linux hardware
4151380	4158460	are criminally out of date or they have security holes or other bugs or whatnot in the system, in the firmware
4158460	4165080	that can be exploited. And door controllers are also not something that most users update
4165080	4167380	because they don't want their system to go down.
4167420	4172920	So the only time that you update your firmware on a door controller in practice is when there is a problem.
4173220	4178900	I don't know of any of my clients, actually, that routinely update the software, rather the firmware,
4178900	4183860	on their door controllers. And you'll see why that can be a problem here in a moment.
4183860	4190100	And actually, there was a few years ago, there was a really great toolkit called Concierge.
4190100	4195480	If people have trouble finding it on GitHub, I'll post the link during the Q&A.
4195580	4202540	Concierge was a collection of exploits that were patched, but then released,
4202540	4209280	that allows you to directly scan for and then compromise different brands and models of door controllers.
4209280	4214780	So instead of attacking the card or attacking the reader, you can attack the door controller itself
4215080	4221540	and either tell it to open a door or add new users to the local database, etc. Stuff like that.
4222960	4226020	How can you target it? Well, you've got to be on the same network.
4226100	4228960	And initially, you're like, OK, well, that's a little hard, right?
4228960	4232800	I've got to either break their Wi-Fi or find a port to plug into.
4232800	4239040	Not necessarily. You can actually find a lot of door controllers directly connected to the Internet
4239040	4245400	using Google or using Shodan, and you will find different door controllers
4245400	4251020	that, again, are running outdated software that are directly connected to the Internet.
4251380	4255840	How outdated? Well, the couple that we found, when we tried to connect to it,
4255840	4261920	the version of SSL was so old, all the modern browsers we used wouldn't let us try to talk to it.
4263560	4270120	Instead, we had to manually turn off SSL and connect to it over HTTP.
4270440	4275720	And then, of course, you have default credentials, admin, admin, used to log in.
4275720	4279000	Again, that's an example of what not to do with your door controller
4279000	4284380	and why it's so important to be mindful of how integrators are deploying and installing hardware.
4286540	4289420	This is where the slides go a little bit sideways.
4289420	4292740	And I appreciate everyone being very forgiving here.
4292740	4295720	We have a lot of topics that we were trying to cram into this,
4295720	4301340	and we have now just about 55 minutes left for demos, so we're just going to get through a couple more slides.
4302060	4308100	I mentioned that different card readers can have different configurations.
4308580	4310660	They can read different technologies.
4310660	4315280	And I mentioned that a best practice is to turn off those older technologies
4315280	4319700	in order to protect the system from being manipulated.
4319760	4323560	How do you do that? If weekend is one way, how do you do that?
4323560	4325360	There's no Ethernet port on it.
4325360	4328840	Well, there are things called configuration cards.
4328840	4331720	Configuration cards are not unique to one vendor.
4331780	4335120	Many vendors support different types of configuration cards
4335120	4339800	that are special cards that the reader will only read during its boot-up cycle,
4339800	4342980	and it will reconfigure how that reader operates.
4342980	4346560	That can change things like the key that's stored on the reader,
4346560	4351920	so if the customer wants a special or a custom or a unique key, they can do that.
4351920	4355580	They can also change which card technologies are supported by the reader,
4355580	4358900	so you can turn different technologies on and off.
4359980	4362240	There's a lot of other behaviors you can change as well.
4362240	4364940	You can change the LED color, you can change whether or not it beeps,
4364940	4367380	how long it beeps for, all that stuff.
4367380	4371040	All that can be changed through the use of configuration cards.
4371040	4374220	That's important to keep in mind once we get to our demos.
4375800	4380300	So using configuration cards, you can do a couple of interesting things,
4380300	4382860	and we're going to show you demos of all this stuff.
4383900	4391020	A new exploit, a topic that is not completely brand new,
4391020	4394720	but no one has really talked about, is a method of doing a denial-of-service attack
4395840	4400820	against certain older readers that prevent valid users from using the facility.
4400920	4404340	We're also going to do a live demo of a tech downgrade attack that I mentioned.
4404340	4408260	We're going to take secure, high-security credentials that,
4408260	4410640	as far as we know, there's no public thing on Defeat.
4410640	4414340	People don't know how to break DESFire, EV1, EV2.
4414580	4417620	People don't really know how to break CEOS currently.
4417700	4420420	But depending on how the rest of the system is configured,
4420420	4422540	we'll see how we don't even need to do that
4422540	4424940	to necessarily create a working clone.
4425200	4427560	And then we're also going to do an example of key recovery.
4427560	4431160	This is related to the low-class attack, or leak key extraction,
4431160	4432980	that was released many years ago.
4433180	4437060	But Iceman has written some new tools for the Proxmark 3
4437060	4439820	to make that even easier and even faster.
4440160	4442740	And we spent a lot of time testing it and debugging it
4442740	4445920	over the past couple of weeks, and it's so freaking awesome.
4445920	4447760	I'm really excited to share it with you all.
4451410	4454930	So, before we get to demos, Iceman, you want to talk a little bit
4454930	4456670	about some of the new tools that have come out
4456670	4459730	within the past six months regarding RFID?
4460730	4462250	Yes, I do, actually.
4462250	4466710	And that was an amazing crunching of the old PAX background.
4467110	4469270	Defeating the PAX man ghost.
4469670	4475190	And yes, you got a lot of info about what's the setup now.
4475190	4477650	So what is the tools that we use?
4478010	4481130	What are we using today when we do this stuff?
4481210	4484010	I need to just move a little bit here on the slideshow.
4484010	4484630	Sure.
4486110	4489710	And let's see, I'm on almost the same part of you.
4490830	4491990	And there we go.
4492490	4496450	It's because the screens I get from Parvac is very blurry,
4496450	4497970	so I can't see what it says on it.
4498450	4500050	Even if I know it by heart.
4500450	4502470	So, the new tools of 2020.
4502470	4505630	We talked about the BLE key and ASP key,
4505630	4507950	and of course, everybody knows the Proxmark.
4508350	4511270	There was... Adam Lorre is a famous name,
4511270	4513010	he's also called as RFIDidiot,
4513010	4518110	and he's an amazing RFID researcher, slash hacker,
4518110	4522630	and DEFCON quarter manager, quarter major?
4522630	4523290	Quarter master.
4523530	4525930	Quarter master, okay, right, sorry.
4526570	4528450	Got to get the titles correct.
4529410	4535990	And he has just recently released and made something for NFC tools,
4535990	4538330	the LibNFC-based version.
4538330	4540390	It is called NFC iClass,
4540390	4547470	and that's a software that gives the possibility to use your old other readers,
4549110	4551710	PM53532 or 5333,
4551710	4554590	and you can now communicate with iClass.
4554590	4556670	It wasn't possible before.
4556670	4562670	You have to see, iClass has been like a little bit of a separate world,
4562670	4564330	because it's been a little bit special,
4564330	4566110	and the crypto involved with it,
4566110	4569490	it wasn't adapted to different tools,
4569490	4571810	and also about keys, of course,
4571810	4575190	and HRD being known as a little bit hard hands.
4576150	4581050	So, this is a major step that he did with this software,
4581050	4583290	because it enables us to do things.
4583490	4585550	And the other one is the Proxmark,
4585550	4587610	which you all know that I know about,
4587610	4590010	and you know that everybody else knows about,
4590010	4593110	which is the Swiss armor knife of RFID hacking.
4593630	4598730	And now what happened here is some really intensive changes
4598730	4601570	to the firmware and client used,
4601570	4604030	which includes what I would call FPGA changes,
4604030	4605930	and a new iClass standalone mode,
4605930	4608950	which involves some separate modes I will talk more about,
4608950	4611850	because it comes related to the surreptitious attacks
4611850	4613890	that we want to demo for you.
4613890	4617230	So, without further ado, next slide.
4617750	4619290	Oh, yeah, my apologies.
4619490	4623870	Yeah, my assistant Babak has to do this.
4624430	4626010	And for you, Rick, I'm going to do this.
4626010	4628450	Because it's DEF CON, you're going to get this one.
4628450	4629570	It's for you, Rick.
4632010	4633330	I'm Iceman.
4633610	4634730	And that's it.
4635870	4641770	So, yes, NFC tools, iClass by Adam Lorry.
4641770	4644950	It uses the LibNFC behind it,
4644950	4647510	and you see Filip Tøven and DotJocks,
4647510	4649910	you know, the little puppet there,
4649910	4651590	and they make it great.
4651590	4654910	It tricks, and it uses a trick,
4654910	4660470	because the LibNFC is not very good on ISO 15693 protocol,
4660470	4662470	so it uses a trick where it actually,
4662470	4664350	because iClass can talk to different tech,
4664350	4667930	is ISO 443B or 15693.
4667930	4670190	So, on this version,
4670190	4673270	it tricks the reader to use that to talk to an iClass.
4673270	4675750	The thingy, thingy, thingy,
4675750	4677670	the fine, fine thing here is, of course,
4677670	4681970	that what we are interested in is that this tool,
4681970	4683690	Adam was so gracious,
4683690	4686670	he made us config cards,
4686670	4689810	possibilities to generate simply by open source.
4690150	4692590	Other people, like Babak and other people, of course,
4692590	4696410	have had the possibility to generate config cards at will,
4696410	4698250	like many of us.
4698250	4701850	But it hasn't been publicly released in the way that it has done now,
4701850	4706910	so this is a good stepping stone for what is to come,
4706910	4708190	of what we want to see.
4708410	4710950	You can skip to the next slide.
4713450	4715830	I'm not going to talk so much about the config card.
4716370	4721090	It's the concept of having a config card that's interesting,
4721090	4722930	not what the config card is,
4722930	4724070	and how it's done, or whatever.
4724070	4725310	You can look at that software.
4725310	4726970	So, the next one is...
4727570	4729990	We're not supporting I-Class timeline.
4730190	4731350	Yes, yes.
4731370	4734990	So, given the support for I-Class in Proxmox,
4734990	4738270	I don't know how it is, but Proxmox is an open source tool,
4738270	4740410	and it's as good as the firmware is,
4740410	4744590	and it has had a story of two different repos,
4744590	4746950	mainly mine and the official repo.
4746990	4752930	And the thing is how this happened to be able to speak I-Class.
4752930	4757050	And it started 2010-2013, where Ruelle researchers,
4757050	4760750	cryptological researchers called Ruelle and Milosh and all those others,
4760750	4764770	did some amazing attacks and research about the I-Class system,
4764770	4767290	the encrypto, the hashes used,
4767290	4770110	and released tools and attacks about it.
4770110	4775050	And they also released some Malgos into the Proxmox repo,
4775450	4777350	but that was it.
4777650	4781450	And skipping a little bit forward, 2014-2015,
4781770	4784050	a user called Hollyman, he did some improvements,
4784050	4789050	where he actually implemented the crypto, the I-Class crypto use,
4789050	4790910	which was a major thing,
4790910	4795570	because before that Proxmox couldn't really talk I-Class.
4795670	4800430	It's a deviant of ISO 15693,
4800430	4802590	so I-Class is a little bit different,
4802590	4804730	and you need the crypto part as well.
4804730	4806830	So he did that, which is an amazing feature,
4806830	4811210	and he also implemented, from that research made before,
4811210	4812490	from Ruelle and everybody,
4812490	4815990	he also made that elite key recovery attack,
4815990	4818470	which we all call low-class nowadays,
4818470	4819770	which has been, since then,
4819770	4823010	has been a state-of-the-art attack to recover elite keys,
4823350	4825690	based on Carl and Babax and all other people
4825690	4828570	who helped to get the readers and all that.
4828570	4830070	It's amazing. It's a shout-out.
4830070	4832430	I'm just doing a shout-out to people who have done this,
4832430	4835290	and I want to show appreciation for them,
4835290	4836990	because that's what it is.
4837790	4840290	Skipping forward again, 2008 and 2019,
4841050	4843570	until then, nothing much happened with I-Class.
4843670	4845550	The support worked.
4845550	4847130	It was bad modulation.
4847130	4848650	You had to find the right spot.
4848650	4850910	If you ever used a Proxmog, you always were like,
4850910	4852310	do you have the right antenna?
4852310	4853770	Do you have the right distance?
4853770	4858710	It's fidgety, and you might have been able to do the sniffing, snooping, and reading.
4858710	4860330	It's a painful experience.
4860330	4863450	If you've been as long as I've been into the Proxmog world,
4863450	4865710	where it's come from, you know,
4865710	4867730	crashing and bugging and everything like that,
4867730	4869470	it's been painful.
4869730	4872330	2018-2019, another user,
4872330	4875170	who actually is another amazing contributor,
4875170	4876330	is Peavey.
4876330	4878970	And he did some historic use improvements on this
4879730	4883450	code and form interface class.
4883450	4886750	We majorly improved this.
4886750	4889190	I talk majorly.
4889190	4893570	And that really made the official repo,
4893570	4895130	he works in the official repo,
4895130	4897110	it makes it super, super stable.
4897410	4900090	So all of a sudden, we have a good communication.
4900210	4901790	We have all the pieces in place.
4901790	4905570	Remember now, we have a public config card-generated software.
4905690	4908450	We have good stability in Proxmog,
4908450	4909370	reading of the cryptos,
4909370	4911730	and we now have a very good way of doing it.
4911730	4914250	I can talk more about how it's actually done,
4914250	4915090	how it changes,
4915090	4917030	and why it's kind of awesome the way he did it,
4917030	4918890	because he went kind of deep.
4918890	4920490	I will talk a little more about it.
4920510	4923650	And 2020 is what I call Merge Hell start.
4923930	4926250	And I will... yeah.
4926610	4927850	Merge Hell is something...
4928450	4929930	It's a little my fault.
4930390	4930750	So...
4931730	4933150	Yeah, you want to talk about that?
4933150	4933790	Yeah, yeah, yeah.
4933790	4936430	So I met Iceman for the first time in person last year,
4936430	4938490	at DEF CON last year.
4938790	4940450	And I pulled him aside at some point,
4940450	4942170	and I'm like, hey, first of all,
4942170	4943570	thank you for all the hard work.
4943570	4945110	Like, I can't write code.
4945190	4946570	Like, I wish I could contribute more.
4946570	4947950	I can contribute in testing,
4947950	4949310	I can contribute hardware,
4949310	4951050	I can do a lot of other stuff.
4951050	4952430	I'm not a great coder.
4952430	4954050	I can do a lot of other things.
4955270	4957290	Why is iClass so unstable?
4957290	4957910	He's like, what do you mean?
4957910	4958810	It works fine for me.
4958810	4961330	I'm like, no, it's really bad.
4961330	4963570	I don't know if you really appreciate how bad it is.
4964250	4965730	It's unusable bad.
4966730	4968730	And at some point,
4968730	4972270	PeeWee made all these changes in the official repo,
4972270	4973930	and all of a sudden it was rock solid,
4973930	4976070	but, like, RRG was, like, still behind.
4976070	4977990	And I'm like, oh, man, like,
4977990	4980210	surely at some point it's going to be merged,
4980210	4983210	but I didn't really appreciate how much work it was.
4983230	4986570	So what I did is I tricked Iceman a little bit.
4986590	4990230	I invited Iceman to participate in some of our trainings
4990230	4993850	that we were doing for our professional pen testers.
4993990	4995890	We were in classes.
4996250	4997730	And just to watch.
4997730	5002810	And he saw, he saw how bad the performance was.
5002890	5004990	Again, not his fault.
5004990	5006530	This is a community project.
5006530	5008210	Everyone is doing their best.
5008810	5010790	But that was, that was the thing,
5010790	5012510	like a month and a half ago, right?
5012510	5013930	That was in June.
5014150	5015970	Where you're like...
5015970	5016970	It was bad.
5017630	5019430	Anyone who was in that June class,
5019430	5020550	it was a solid class.
5020550	5021870	But once we got to I-class,
5021870	5023350	we hit a freaking brick wall
5023350	5025070	because we just had a lot of trouble
5025510	5026970	communicating with cards.
5027330	5028950	You've been having that for years.
5028950	5031810	The thing is, I use it at home.
5031810	5032970	I have some credentials.
5032970	5034870	It works. That's it.
5034870	5036410	You don't do very much more with it.
5036410	5037550	You don't need to.
5037710	5039430	You dump some cards and look at it.
5039430	5041530	It works.
5041670	5043910	But for a class, for teaching,
5043910	5045130	for using it on field,
5045130	5047550	oh man, that sucks.
5048390	5050090	So yeah, two months ago,
5050090	5051250	let's say two months ago,
5051250	5053010	because it started a little bit earlier
5053010	5055350	and I came up to this.
5055350	5056830	I decided finally...
5056830	5058570	I didn't want to do it because I was actually
5058570	5060770	supposed to do a high tech 2 code
5060770	5062390	and then we made a release of this
5062390	5064750	stable thing. Once that was in place,
5064750	5066550	I could do other things
5066550	5068550	and that would become merge hell.
5068550	5070470	Meaning that the total changes
5070470	5071750	that we've done for two years
5072490	5075850	to be merged into the RG Iceman repo.
5075890	5077330	Which is... yeah.
5077330	5078530	The thing is, what I want to say,
5078530	5079570	the most important part is that
5079570	5081930	the I-class support that we made
5081930	5083590	is rock solid.
5083590	5084610	It's so good.
5085750	5087870	Even if you use LibNFC now,
5087870	5089670	you're going to go like, oh that's ugly.
5089990	5092170	Bad compared to this.
5092170	5093130	Next slide.
5093590	5095550	Oops, sorry.
5096290	5098110	And in true Proxmark form,
5098110	5099910	by the way, fixing one thing broke
5099910	5102090	another. So I-class
5102090	5104690	support, rock solid.
5104770	5106710	ISO 14b support,
5106710	5108190	completely broken.
5108290	5109930	Thankfully, not as many people
5109930	5112110	use ISO 14b. I think I-class
5112110	5113750	is more useful myself, but
5114190	5116210	it's just whack-a-mole, right?
5116610	5118370	Yeah, it's
5120270	5120710	what's...
5121170	5122050	God.
5122530	5123730	I don't know what to say.
5123730	5124510	Anyway.
5126850	5127990	I know.
5127990	5129490	We're on a timeline. I know, I know.
5129490	5130230	Sorry.
5132650	5134330	I'm trying to do this seriously.
5134330	5135490	I know, I know.
5135490	5136810	It's so hard.
5137470	5138970	Okay, you made me lose my
5138970	5139810	mind here.
5141090	5142430	Two repos, yes.
5142430	5143910	Two very different repos.
5147370	5148650	Yes, two repos.
5148650	5150630	Official repo and Iceman repo.
5150890	5152570	It's separate a couple of years ago
5152570	5154570	because we wanted to build the
5154570	5156310	support for RG4 a little bit better
5156310	5158550	and put some effort in. So it's a different way of
5158550	5160390	using and thinking and using. Once you use
5160390	5162510	RG, Iceman repo, you will see the
5162510	5164910	difference and you feel the difference in it.
5164910	5166430	It is what it is.
5166630	5168930	Basically, the FPGA changes. This is an amazing
5168930	5170890	thing because it's a huge feature that's coming
5170890	5173010	out. The FPGA changes.
5173110	5174970	You have a system here,
5174970	5176910	you have a client on a PC, you have an ARM device
5176910	5178830	and on it you have also an FPGA that
5178830	5180150	talks to the ADC
5180690	5182510	and do things. It's all
5182510	5184890	programmable. It all had to change
5184890	5186750	and PV made things and move
5186750	5188830	IQ handling and stuff into the FPGA
5188830	5191190	code. Since he did that,
5191190	5192850	the thing is, the FPGA before
5192850	5195150	did the ADC signal,
5195150	5196930	send it to the ARM, ARM demodulated,
5196930	5199030	sent it off to the client, the client did all the hard lifting.
5199030	5200930	It did all the select the card, it did all the
5200930	5202830	calculation of cryptos, calculation of MAC
5202830	5205450	values when writing and everything like that.
5205490	5206850	However, afterwards,
5207590	5208030	FPGA
5208590	5210970	took the signals, made IQ pairs of it
5210970	5212570	and sent those to the ARM.
5212710	5215050	ARM decoded that one much better because IQ's
5215050	5216890	demodulation is super much better
5216890	5219470	and stable. That's where that comes from.
5219750	5221050	And then sent it all off
5221050	5223010	to the client again, who still did the
5223010	5225490	hard lifting. Next queue.
5228170	5229250	And here
5229250	5231850	is when things become funny.
5232770	5233370	You did that
5233370	5234510	and I didn't do that.
5235390	5237110	And so,
5237110	5239210	you talk with people, you talk
5239210	5240870	with yourself and you talk with
5240870	5243390	Bambach and you go like, hmm...
5243390	5244970	So, we have rock solid
5244970	5246970	demodulation of IQ class. What
5246970	5248430	can we do now?
5249370	5250770	And you know, it's a
5250770	5252510	bouncing thing. I don't want to say who brought that
5252510	5255150	in first because people have been saying these ideas for years.
5255150	5256650	But, you know, with
5256650	5258510	all this stuff, I'm like sitting here and I'm like
5259170	5260430	thinking... We were talking about it at
5260430	5263290	DEF CON last year. Yeah.
5263290	5265070	Yeah. Yeah. Yeah. How about
5265070	5266610	moving this crypto?
5266610	5268510	How about, you know, do that to ARM, you know?
5268510	5270370	And people are... I know I've even kept meeting
5270370	5273130	and asked, why can't you get a nice class
5273130	5275190	standalone mode? And I'm like,
5275190	5275990	yeah, you know.
5275990	5277750	It's not solid for demodulation
5277750	5280510	and the crypto parts is also better.
5280510	5282390	You know, I don't want to do that work.
5282690	5283990	So, we do that stuff.
5283990	5285670	So, we're like,
5285670	5287770	how about we move it? Now,
5287770	5289710	one part that Peavey did, he actually optimized
5289710	5292250	the crypto so it went even faster.
5292250	5294010	And that's needed when you simulate
5294010	5295770	things on the device. You need
5295770	5297830	speed. So, he did that.
5297830	5299670	You know, shaving off milliseconds
5299670	5302150	or microseconds, you know.
5302610	5303510	So,
5303510	5305370	I had to refactor the whole code
5305370	5307330	because since before
5307330	5308990	everything was in the client,
5309270	5310670	move it all into the device
5311650	5313550	and by doing that,
5313550	5315190	you can call it achievement unlocked,
5315190	5317150	we have full crypto and MAC generation
5317150	5318670	on the device.
5319170	5321610	Which is an amazing feature.
5321870	5323250	It enables us
5323250	5325070	to do more things. It took a whole
5325070	5327170	remake because the whole flow of work is
5327170	5328390	just different.
5328950	5331510	Next thing that comes up,
5331510	5333470	how about a stand-alone mode?
5333470	5335530	Now that we can do these things here,
5335530	5336970	how about that?
5337070	5339890	Well, you know, how are we going to do the dumps?
5339950	5341590	We have a flash
5341590	5343630	memory on Rdb4, so let's do
5343630	5345510	it like that. So, let's
5345510	5347310	create a stand-alone mode which can
5347310	5349790	talk iClass.
5350990	5351650	Doable.
5351650	5353290	Have to rework all the code again
5353290	5355470	because make it work. And we actually
5355470	5357390	achieved the very first iClass
5357390	5359070	legacy simulation stand-alone mode
5359070	5361730	one and a half month ago.
5362690	5363190	Next
5363190	5364990	question when you do this,
5364990	5367210	just the bouncing ideas and you go like,
5367210	5369410	what more can we do? Because we implemented
5369410	5371170	all of this stuff in the client before.
5371170	5372990	Can we push the limit?
5372990	5375130	What more can we do? That would be cool.
5375590	5377190	So, how about we
5377190	5378950	do two more modes
5378950	5380630	of the stand-alone modes
5380630	5382930	where we now do
5382930	5385370	reading and
5385370	5387210	dumping. Read a tag,
5387850	5389190	proxmark act as a reader
5389190	5391510	and store the credential.
5391770	5393330	And the next one is
5394490	5395550	elite reader.
5395550	5397670	Do the sim2 attack.
5397770	5399570	It's a simple one in that sense.
5400130	5400650	And
5401210	5403650	achieve that as well. Too much is amazing.
5403650	5404870	We have three in one.
5405610	5407470	We were not quite done
5407470	5409210	yet. And here's the next talk
5409210	5411090	with Babak. We said this
5411090	5413210	and he goes like, hey,
5413210	5415450	do you
5415450	5417270	remember my
5417270	5418750	config card glitch attack?
5418750	5421330	I want to clarify. This is not my
5421330	5422650	attack. This was
5423210	5424210	true.
5424970	5427390	You showed it to me and you demonstrated it in your trainings
5427390	5429290	and all that stuff. So, I called
5429290	5430950	you in the context of
5430950	5432890	where we were.
5433010	5435090	But you had it.
5435090	5436490	It's your baby.
5436610	5438250	So, I'm like, yeah.
5438770	5441730	We have a config card glitch attack.
5441730	5443590	Okay, so what is that
5443590	5445630	then? How does that work?
5446250	5447870	Yeah, basically you simulate
5447870	5449710	one, you present one card and then you
5449710	5451870	present another card and Babak will demonstrate
5451870	5453730	all this stuff pretty soon.
5453750	5455770	So, I have to refactor all things again
5455770	5457290	and do that. And then do that to
5457290	5459670	standalone mode. We achieve
5459670	5461930	another thing unlocked and we now have a
5461930	5464750	first ever implementation of a glitching config attack
5464910	5465790	in a standalone mode
5465790	5467730	for Poxbox. And we call this
5467730	5469390	standalone mode HF Ice Class
5469390	5471670	because we really love the way
5471670	5473610	naming things. Instead of
5473610	5475470	I-Class, we call it Ice Class.
5475470	5476550	Because of me.
5477570	5479490	However, this little mode only
5479490	5481290	works on Proxmox AutoV4.
5481290	5483030	It saves files to
5485250	5485750	the
5486930	5487690	on-board
5487690	5489610	store memory, which will look like this.
5489610	5491370	I will explain the four
5491370	5493450	different modes. Basically, you
5493450	5495510	upload, you have a dump of your credential before.
5495510	5497190	You talked about secure storage. You dump it
5497190	5499250	with Proxmox. You read it off.
5499490	5500990	You send it up to the
5500990	5503170	flash memory and then you just start
5503170	5505770	the standalone mode and it simulates it.
5505770	5507270	It keeps on simulating just before
5507270	5508710	but it's a complete standalone.
5508850	5511330	You press the button to exit and then
5511330	5513290	it saves a copy of that emulated
5513290	5515250	memory. So you have, as you see,
5515250	5517310	you have the original bin that you were simulating
5517310	5518930	the dump and then you have a modified
5518930	5521090	so you can see what the reader
5521090	5523230	did to update it or if it did any
5523230	5525290	updates to it. Usually the EPRS of course
5525290	5527330	but it could have changed the PACS data.
5527670	5529510	So it's a good thing to have.
5530130	5531070	Next.
5532790	5533350	The
5533350	5535330	reader attack is based on
5535330	5537610	the elite recovery attack.
5537610	5539450	It's a two-phase attack which you need
5539450	5541350	the online part where you send
5541350	5543310	and emulate some CSM and you
5543310	5545370	recover that data,
5545370	5546650	store it to a file.
5547370	5549510	And it's a very simple one.
5550010	5551230	Since you have the simulation
5551230	5553210	in place, it's very simple to do.
5553210	5554790	So as you say that
5554790	5557070	you want to do this attack, you put
5557070	5558790	the CSM on there and you
5559350	5561190	present this to an elite configured
5561190	5563030	reader and it collects the data
5563030	5564970	very fast and it quits the
5564970	5566690	standalone mode and you can go to the next
5567230	5568970	reader and do the same thing. Start
5568970	5570810	the standalone mode and collect this data from those
5570810	5572890	and do that over and over again. Then
5572890	5575090	you go home and you download it from the memory
5575090	5576950	of the Proxmox and
5576950	5578830	you run the low-class attack and we collect the data
5578830	5580230	and recover the key.
5580230	5582230	Super simple, all of a sudden
5582230	5584310	very much more useful for pen tests
5584310	5586570	and all that other stuff. Fun attacks!
5588450	5590590	The third one is a read and dump.
5590670	5592330	It's just a plain simple one
5592330	5593510	for people you want to see
5593510	5595910	go on snooping things credentialed
5595910	5598330	secretly on the toilet, what I've seen someone do
5598330	5600210	with these major antennas. Now you
5600210	5602170	can do it with your large HF antenna
5602170	5604270	or battery and you just present
5604270	5605230	it and it just
5605730	5608150	you start it and it starts reading and it starts dumping
5608150	5609530	and you press the button to quit it
5609530	5611590	and it saves all the dumps it finds
5611590	5613990	it saves it to the flash
5613990	5616150	memory. As you see here, it has two cards
5616150	5618150	I presented to it. It goes kind of fast, it takes
5618870	5620610	a quarter of a second to do it.
5620730	5621930	And the glitch and config
5622350	5624110	card... We'll just do a live demo.
5624810	5625850	Yeah, yeah, yeah.
5625990	5627250	We'll do a live demo, yeah.
5627530	5629690	So for glitch and config, what I was
5630670	5632030	explaining before I really cut
5632030	5634210	him off, is that
5634210	5636150	the short version behind the
5636150	5637950	glitch is that there
5637950	5640230	was in two of the most
5640230	5641590	popular versions of firmware
5642150	5644250	of legacy iClass
5644250	5646230	readers, there was a bug in the
5646230	5648110	firmware that if the
5648110	5650150	card was programmed a certain way
5650150	5652310	the card misbehaved, the reader
5652310	5653950	would lock up, get
5653950	5655990	confused, and then a watchdog
5655990	5658410	timer would kick in and reboot the reader.
5658410	5659950	Normally it's not a big deal.
5659950	5662050	Reader reboots still works, no problem.
5662050	5663990	However, once you remember that
5663990	5666110	configuration cards can only be used
5666110	5668190	right after the reader boots up,
5668190	5669930	now you have an
5669930	5671830	attack chain that you can use to
5671830	5673950	reconfigure the reader without ever actually
5673950	5675690	taking the reader off the wall.
5675690	5678090	And we're going to do a demo of some of the things that you can do
5678090	5679870	with that. So now we have
5679870	5682230	30 minutes for live demos. We're going to go
5684090	5684710	very,
5684710	5686090	very, very fast.
5686090	5687930	As fast as I reasonably can.
5688350	5689950	We worked hard to make this happen
5689950	5692190	for them. You have to understand
5692830	5695050	it's been two long months.
5695050	5696330	So, I'm going to go fast
5696330	5697150	because
5698190	5700350	RF Hacker Sanctuary
5700350	5701790	is going to kick us off
5701790	5704390	in half an hour sharp.
5704870	5706410	So, we can talk about
5706410	5708410	this more later in the Discord channel
5708410	5710150	or elsewhere. So,
5710150	5712130	first thing we're going to do, we're going to talk about that
5712130	5714230	tech downgrade attack that I
5714230	5716310	was talking about. So, for example
5716930	5718350	we're going to take
5718350	5718870	this reader
5719430	5721190	we had before.
5727810	5728850	It's been
5728850	5730910	an intensive month for us to
5730910	5732830	do this and we're really psyched to show you off
5732830	5734810	all of this stuff actually. I did not get
5734810	5737290	much sleep. Alright.
5737650	5738970	So, we have this reader
5738970	5741250	and if you recall,
5741250	5742990	that reader reads
5742990	5745610	multiple credential technologies.
5745610	5746650	So, it reads
5746650	5748110	Prox.
5748490	5750810	It reads Indala.
5751730	5752810	This one
5752810	5754290	also, you know, it reads
5754290	5756570	I-Class.
5756570	5758530	And it also reads
5758530	5761010	SEOS. I have a
5761010	5762790	SEOS card here.
5762790	5766530	He's actually a Desfire card.
5766530	5767310	Right.
5767310	5768850	And here is a
5769970	5772210	SEOS card here.
5772210	5773270	For you who don't
5773270	5774530	understand this, this is a very
5774530	5776050	amazing reader.
5777470	5778630	So, what we're
5778630	5780870	going to do is show you
5780870	5782710	how to take a
5783150	5785050	secure credential that we don't know how to talk to
5785050	5786930	and copy it to a weaker
5786930	5788770	credential technology. So,
5788770	5790990	we're going to start with, right now this is
5790990	5792990	blank, so it does nothing. We'll set that right
5792990	5795490	next to the reader. And
5795490	5796870	by way of example, what we're
5796870	5798530	going to do is we're going to grab
5799410	5801310	we're going to start with, we're going to pick
5801310	5802570	on Desfire. Actually,
5802570	5804450	yeah. So, we have two cards
5804450	5806510	here. We have Desfire Evolution
5806510	5808570	1 and an example of a SEOS card.
5808570	5810390	There's nothing special about these cards. They were
5810390	5811750	ordered through a regular
5812330	5814450	supplier. This is a regular, you know, customer
5814450	5816490	card. And
5816490	5818510	they work with the system.
5819890	5820570	So, that's
5820570	5822910	one card. That's the other card.
5822950	5824370	And so, if you are an
5824370	5826550	attacker, you might think, okay, the first thing I'm
5826550	5828490	going to do is I'm going to go to my Proxmark
5829470	5830450	and I'm going to switch
5830450	5832310	here. There we go. So, I'm going to go to my
5832310	5834090	Proxmark. I'm going to type in
5834090	5836630	hfsearch and oh,
5836630	5838250	crap. It's, you know,
5838250	5839230	some sort of
5840590	5841830	oh, that's right. This is
5841830	5844730	this card emulates multiple technologies.
5844850	5846250	So, okay. This is a 14a
5846250	5848110	card that
5848110	5850350	rather, it's a Java card that
5850350	5852290	uses 14a commands to communicate.
5852290	5854470	Short version, we don't know how to talk to
5854470	5856630	it. Here's a
5856630	5857550	Desfire credential.
5861720	5862680	There's a Desfire
5862680	5864560	card. Again, we don't
5864560	5866620	know the keys. We don't know how to
5866620	5868900	read the data off of these cards.
5868900	5870940	But the reader does, right?
5870940	5872480	So, what I can do
5872480	5874600	is I can take this reader, and
5874600	5876120	remember, this special reader
5876120	5878680	is showing me, because
5878680	5880620	of this little add-on here, it's showing
5880620	5882560	me the WeGand data that's on that
5882560	5884820	reader. So, what I can do
5884820	5886420	is I can say,
5886420	5888780	take this CEOS card.
5889480	5890740	I can read it,
5890740	5892740	and I can see, oh, that WeGand
5892740	5894320	data is 2547
5895220	5896340	E76.
5898400	5899140	So,
5899140	5900280	we're going to come back here
5901120	5902800	to DopePad.
5909660	5910700	So, I'm
5910700	5912920	going to type it again. Pardon me.
5913520	5914400	So, this is
5914400	5915420	2547
5917520	5918080	Echo
5918480	5919320	76.
5922780	5924520	And I'm going to convert that
5925320	5925820	to
5927460	5928460	binary.
5928540	5929040	Whoops.
5930820	5932260	There we go.
5936450	5936950	And
5936950	5939150	let me just make sure that we have
5940110	5941530	26 bits.
5941530	5942810	We do. Good.
5942890	5944730	The next thing that I'm going to kind of gloss over
5944730	5946690	here, those of you who are
5946690	5949110	familiar with the Proxmark and know Prox,
5949110	5951230	Prox credentials have a
5951890	5953670	preamble that is necessary
5953670	5955290	to use when programming it with the Proxmark.
5955290	5957330	So, that's what I'm doing here. What I've done is
5957330	5959010	I've just added this preamble
5959010	5960990	that the Proxmark client requires
5960990	5963430	in order to encode Prox credentials.
5963730	5965170	And I'm going to take this string
5966270	5967190	and I'm going
5967190	5969130	to encode it back into
5969130	5971210	hex. So, the
5971210	5972930	hex value that we're going to write in our
5972930	5974750	Proxmark client is this, this
5976550	5977070	2006547
5977070	5979090	Echo 76. So,
5979090	5981170	now, we're going to pop back over to our
5981170	5983190	Proxmark client, and we're going
5983190	5985030	to take this low frequency
5985770	5986350	T5577
5988170	5988750	and
5988750	5991230	there we go, fit on camera there
5991230	5992930	and we'll run LF
5992930	5993830	HID clone
5995030	5996650	and then this new value
5998430	5999190	and then
5999190	6001270	I'll double check my work to make sure
6001270	6002810	it's there.
6003190	6005530	Yep, that's there. So,
6005530	6007370	if I did this correctly,
6007370	6009270	now, these two cards
6009270	6011350	should be the same. So, let's switch
6011350	6013410	back to our BigView camera
6017550	6018030	and
6018030	6019970	I'm going to... I know you can't see the top
6019970	6021690	of the reader, but that's okay. So, here's our
6021690	6024130	original credential.
6024490	6025710	There's our WGAN data,
6025710	6027910	2547 Echo 76. Let's
6027910	6029590	go ahead and try our
6029590	6030730	Prox card.
6032150	6034230	Same data, 2547
6034230	6036070	Echo 76.
6036270	6037870	This is the data that the door
6037870	6039790	controller is seeing. So, what that
6039790	6041790	means is that right now, as far as the
6041790	6043770	door controller is concerned,
6043770	6045750	this very, very secure and
6045750	6047070	much more expensive credential
6047590	6049510	is equivalent in security
6049510	6051650	access in all things to this
6051650	6053870	one. And it's only because
6054730	6055670	this reader
6055670	6057550	was left in transition mode.
6057550	6059710	It was left in the mode that allows it to
6059710	6061490	read other, more secure
6061490	6063650	credential types that we do know
6063650	6065630	how to talk to. So, even when we're
6065630	6067570	dealing with secure credentials,
6067570	6069950	as it relates to access control,
6069950	6071790	sometimes we can find other ways
6071790	6073810	of re-encoding that credential data
6073810	6076010	onto something else and making it work
6076010	6077330	with the reader.
6078810	6080170	So,
6080170	6082730	same demo, super fast,
6082730	6084330	with DESFire.
6084330	6086170	So, here is...
6086170	6088450	here's our DESFire credential.
6088970	6089810	This has
6089810	6092070	different WGAN data. This one is
6092070	6093750	1 Bravo 5 Delta
6093750	6095490	Bravo 6 Delta.
6095650	6097950	And we're going to switch back to
6097950	6100030	our notepad here.
6101450	6102010	And
6102010	6104370	we're going to run through this super quick.
6104430	6106570	So, we'll just delete all this.
6106570	6108090	So, now we're going to do this credential.
6108090	6108610	We're going to do
6110350	6112430	1 Bravo 5
6113370	6113930	Delta
6113930	6115870	Bravo 6 Delta.
6116990	6117950	And we're going to
6117950	6119890	copy that. We're going to
6119890	6120630	convert that
6122330	6123650	to WGAN.
6125250	6126090	And it looks
6126090	6127970	like it dropped a leading zero, so we're going to
6127970	6129790	add that back in. I only saw
6129790	6131230	25 bits.
6132030	6134330	And we're also going to add our
6135050	6136090	prox preamble
6138650	6139570	here.
6140710	6142110	And then we're going to convert
6142110	6142550	that
6143970	6145410	back to weekend.
6145730	6147750	Sorry, back to the format that the
6147750	6150050	proxmark3 is going to expect.
6150590	6152050	And, again,
6152050	6153750	we're going to do the same thing.
6153750	6154610	We're going to take
6157490	6159570	our proxmark,
6161900	6163400	run
6163400	6165340	lf.hid.clone
6165860	6167680	and then this value.
6167680	6169540	Make sure it wrote.
6169820	6172240	Looks good. Let's try it.
6173780	6176280	So, switching back here.
6177900	6180480	Here's our DESFire credential.
6180520	6181160	We have
6181160	6183560	1 Bravo 5 Delta Bravo 6 Delta
6183560	6185420	access granted. Here's our prox
6185420	6186460	credential.
6187120	6189320	Same credential. 1 Bravo 5
6189320	6191640	Delta Bravo 6 Delta. So, again,
6191640	6193540	two different examples, different
6193540	6195500	card technologies completely, right? We did
6195500	6197460	not crack DESFire. We did not crack
6197460	6199380	CEOS. What we did is we took
6199380	6201420	advantage of a configuration in
6201420	6203400	the system that was not changed
6203400	6205160	after the transition or the migration
6205160	6207360	was complete. So, that's the
6207360	6209240	entire concept behind a technology
6209240	6211280	downgrade attack. It's something that
6211280	6213200	not everyone really thinks about very often
6213200	6215300	and it's crucial to be aware of as
6215300	6217520	customers, as integrators, as installers
6217520	6219300	in defending the system because
6219300	6221220	it really undermines the security
6221220	6222720	of the system otherwise.
6223760	6224780	All right.
6224960	6227280	So, now we're going to move on to...
6232440	6233480	Let's do...
6233480	6235620	Let me just show config cards, actually,
6235620	6237620	because it's related. So, let's say...
6237620	6239300	Let's say, like, okay,
6239300	6240920	well, you know what? We disabled
6240920	6243380	those old credentials. So, we're fine.
6243380	6245360	So, we're secure, right? So, actually,
6245360	6246160	I'm going to take
6247040	6248620	this reader off.
6248820	6250520	I have a different reader.
6253760	6255600	And I pre-baked a
6255600	6268200	cake already. Yes, correct.
6268200	6269700	All right.
6269700	6271300	So, here we have a different
6271300	6273040	reader. And right off the bat, what we're going to
6273040	6275120	notice is it says multi-class.
6275120	6277240	It says that it's a migration or a transition
6277240	6278740	reader, but it doesn't read
6278740	6280880	prox. It
6280880	6283400	doesn't read, if I present it, a
6284380	6285340	regular iClass
6285340	6287500	card. Let's see here. I forgot.
6287500	6289520	So, here's my regular iClass card.
6289520	6291320	It doesn't read that either.
6291320	6294600	It will, however,
6294600	6296320	read CEOS.
6296320	6297420	Okay? So, right
6297420	6299220	now, we're like, great. This is a secure
6299220	6301420	reader, right? We're set. However,
6301420	6303340	remember, configuration cards can
6303340	6305220	change the behavior of the reader.
6305220	6307400	So, now we have a reader that only supports
6307400	6308600	CEOS, but
6309920	6311340	what we can do is
6311340	6312220	we can use
6315000	6315280	a different
6315280	6316340	configuration card
6317260	6319080	to re-enable those legacy
6319080	6321700	credentials. So, I'm going to power cycle the reader.
6323340	6324900	I'm going to present the configuration
6325200	6327600	card to re-enable legacy credentials.
6328260	6329420	It's going to take a
6329420	6331260	couple of seconds as it reads that data off
6331260	6333260	the card. And these are standard
6333260	6335200	parts, to be clear. This is not
6335200	6337120	an exploit. This is using
6337120	6339080	design-intended functionality
6339080	6341260	that is available to any customer, right? So, these
6341260	6343640	are cards that can be ordered by customers,
6344000	6345280	by integrators.
6345540	6347140	And now, if that card worked
6347140	6349240	correctly, what we're going to see is
6349240	6351040	there's my PROX,
6351040	6353020	right? There's my
6353020	6354960	iClass. It all comes back.
6355500	6356980	So, that is
6356980	6359040	something to be mindful of.
6359040	6361160	Being able to take the reader off the wall
6361160	6363100	and power cycle it, if you're not monitoring
6363100	6364560	for that, that can
6365220	6367240	be a huge gap in the
6367240	6368920	system's security. Because
6368920	6370360	older, more secure
6370980	6372120	credential technologies
6373020	6375480	might be re-enabled in the reader.
6375480	6376820	And then, someone can just
6376820	6379100	take one of those readers that can read your
6379100	6381180	secure credentials and then convert
6381180	6383540	that weekend data to work off of a
6383540	6385140	card that you can easily
6385140	6387060	read and write with a PROXmark or any
6387060	6387980	other tool.
6388900	6391420	So, that attack, again,
6392520	6393040	is...
6393040	6395140	I don't consider it an exploit.
6395140	6397060	I consider it taking advantage of
6397060	6398940	misconfiguration, taking advantage
6398940	6401220	of how the system was designed.
6401220	6402980	In fact, this issue is not
6402980	6404840	unique to HID.
6405660	6406860	Multiple brands,
6406860	6409140	many brands, have this problem.
6409140	6410620	So, what I have here
6412740	6413260	is...
6413260	6414880	And I'm not going to do a full demo
6414880	6416220	on this other one.
6416840	6418500	I'm just going to move our camera.
6421580	6422420	So, we have...
6422420	6424840	Oh, there we go. It's a little jittery.
6424840	6426920	My apologies. So, we have a
6426920	6428660	different branded reader. This is just
6428660	6430600	an example. Again, I want
6430600	6432720	to be clear. We're not picking on any one
6432720	6434520	brand. This is just something to be aware of
6434520	6436720	as far as systems can be designed.
6436720	6438560	So, right now, this
6438560	6440620	card reader will read and
6440620	6441840	beep on both
6441840	6443380	high frequency
6444620	6445860	contactless smart cards
6445860	6447920	and low frequency
6449560	6450300	cards.
6450300	6451720	So, it's reading both this
6451720	6453860	Mindfair card and this Prox
6453860	6454740	card.
6455590	6457160	So, there we go.
6458860	6459820	I can't
6459820	6461460	fit everything. Hold on.
6462620	6464260	Yeah, you can do it.
6464860	6466340	There we go.
6466840	6467780	So,
6467780	6469860	again, I can power cycle the reader
6469860	6472440	and I can
6472440	6474420	use a different configuration card
6475880	6476500	to
6476500	6478420	disable proximity. Now,
6478420	6481040	when that reader reboots,
6481040	6482460	it reads Mindfair
6482460	6484480	as expected, and that's
6484480	6486440	fine, but it's not going to read
6486440	6488480	this Prox card.
6489420	6490460	So, let's say
6490620	6492900	a customer has that in a secure configuration.
6492900	6494260	Again, if you're not
6494260	6496940	monitoring your tamper sensors,
6496940	6497980	someone can come back
6498780	6499980	and re-enable
6499980	6502040	proximity, and now
6502040	6504140	they're able to use Prox credentials
6504140	6505840	again. So, monitoring
6505840	6507700	those tamper sensors on the back of the reader
6507700	6509980	is very, very important, because
6509980	6512120	it's the only way to defend against
6512120	6514360	knowing when these types of manipulations
6514360	6515880	take place.
6516560	6518080	Yep, very true.
6518080	6519940	Alright, our next demo.
6519940	6521940	So many demos, all the demos. Okay,
6521940	6524360	we have 15 minutes. Holy crap.
6524360	6525860	This is going to be interesting.
6525860	6527960	Alright,
6527960	6529820	let me grab the
6529820	6531740	camera again. It's going to be the
6531740	6534600	best 15 minutes ever. Yep.
6538930	6539350	In the
6539350	6541170	RFID hacking.
6541290	6542950	Alright, so we have
6542950	6545270	our different readers
6545270	6547330	already set up.
6547870	6548770	So we have
6550570	6551290	our
6551290	6553710	stand-alone reader mode,
6553710	6555210	our stand-alone full
6555210	6557490	simulator mode, our stand-alone
6557490	6559350	low-class attack mode, and our
6559350	6561190	stand-alone config card mode.
6562470	6563570	Iceman, we're not going to
6563570	6565390	be able to finish all of our demos.
6565390	6567490	No, yes, take the config card
6567490	6569290	first. You wanted the config card
6569290	6571190	one first, okay. Yeah, yeah, yeah.
6571190	6573490	Okay, so you have...
6574530	6575670	That's a cool one.
6575670	6577210	I mean...
6578810	6579590	The rest is
6579590	6581730	what we could do with a client before.
6581730	6583550	Alright, so I'm just going to
6583550	6585130	explain what's happening.
6585130	6587070	Put some of these aside.
6587490	6589430	And we're going to power these readers on.
6591720	6592560	Alright.
6592560	6594360	So this is a fun attack.
6595240	6596640	The reason this is a fun
6596640	6597040	attack
6598240	6600120	is because this is a very interesting
6600120	6602840	model of service attack. So right now,
6602840	6603600	we have
6604340	6606480	two I-class readers. These are older
6607280	6608340	legacy readers.
6608340	6610500	These are not modern readers.
6610500	6612080	These are revision C.
6612080	6614600	So anything produced before 2012.
6614600	6616580	And it reads standard
6616580	6618620	I-class cards. So users
6618620	6620020	can use that normally.
6620500	6622440	What we're going to do is we're going to do an
6622440	6624500	attack where we're going to
6624500	6625960	glitch one reader.
6626040	6628600	We're going to automatically reboot it
6628600	6630440	using the glitch. And then use
6630440	6632620	the configuration card to put
6632620	6634440	the reader in something called key
6634440	6636500	rolling mode. Key rolling mode
6636500	6638120	is supposed to help you transition
6638120	6641280	from a standard key to a high security key.
6641680	6642600	And when you do
6642600	6644500	that, the reader talks to both old
6644500	6646600	cards, and then if it finds an old
6646600	6648480	key, it updates it to the new one.
6649260	6650540	The issue is, if
6650540	6652440	all the readers aren't in that mode,
6652440	6654540	then the key on the card gets changed
6654540	6656400	to one of the second reader that doesn't necessarily
6656400	6658620	understand. So what I'm going to do
6659040	6660260	is I'm going to present my
6660260	6663000	proxmark. It's going to glitch the reader.
6663440	6664620	Oh, I have to. Hold on.
6664620	6666040	I have to put it in the standard mode.
6666380	6667420	There we go.
6668240	6670300	So I'm going to present this here. It's going to
6670300	6672200	glitch the reader. The reader is going to
6672200	6674260	reboot. There's the first reboot. Now
6674260	6675660	the proxmark is going to emulate
6676360	6678080	a key roll configuration card.
6678140	6680180	That's complete. And
6680180	6682080	here's... let's pretend this is the exterior
6682080	6684740	door. This is the door on the inside.
6684740	6685980	So here's the same
6686600	6687640	card.
6688060	6690060	It works on the first reader.
6690060	6692000	And now at this point,
6692000	6694680	the key in this card has been changed.
6695140	6696200	And it will not
6696200	6698360	work on the second reader. It will only
6698360	6700000	work on that first reader.
6703240	6704680	It's such a
6704680	6707340	meme.
6707340	6708480	Alright.
6708480	6710720	What's the next stupid thing that we can
6710720	6713120	move to here?
6713120	6714480	So yeah, full simulation. We're not
6714480	6716740	going to go into it right now because we are
6716740	6718700	so gosh darn short on time.
6718700	6720800	Low class. Low class.
6720800	6722360	Yeah, yeah, yeah.
6723060	6724320	So actually we have an
6724320	6724800	elite reader.
6730810	6732190	Actually, I'm realizing
6732190	6734410	that the camera doesn't like to be far
6734410	6736350	away from the computer.
6736350	6738250	So I'm just going to move this all
6738250	6740750	really, really close.
6741070	6742490	There we go. Much
6742490	6743930	better. So
6744910	6746210	this is an example
6746210	6748330	of an elite reader.
6751210	6751850	And
6751850	6754070	as it stands right now,
6755530	6756170	it
6756170	6757310	does not read
6758290	6760310	standard I-class cards.
6760310	6762290	So here's an example of a standard I-class
6762290	6763870	card. It won't read because
6763870	6766150	it's not using the high security
6766150	6768410	key. Here's an elite key designed
6768410	6769150	for that system
6770070	6771490	that reads.
6773290	6774330	What we're going to
6774330	6776290	do is switch
6776290	6778590	here so we can see the debug data.
6780790	6782390	And we're going to hold down
6783050	6784150	our button to enter
6784150	6786350	standalone mode. And so
6786350	6788370	right now, all I have to do is just wave
6788370	6789650	this over the reader.
6790370	6792310	And that's it. So now it's
6792310	6793970	saved that
6793970	6795790	Mac attack file.
6796390	6798510	And I can grab that.
6814650	6816650	What did I do wrong?
6817590	6819810	There sure is.
6823170	6825230	Alright. And now we just operate
6825230	6827410	the low class attack normally. So we'll do
6827410	6830430	HFI class, low class,
6830430	6832110	and then the file name.
6834920	6837120	Oh, you're running that version.
6837140	6838860	I'm running FPGA, yes.
6842110	6844490	So it's not going to take very long. It's only going to
6844490	6846370	take us about 30 seconds or so.
6846370	6848130	And that's going to crack the key.
6848130	6850330	So now we have the high security key
6850330	6851970	that was in that reader.
6852030	6853970	And now if I wanted to,
6853970	6856310	I could take this elite card
6856310	6858350	that worked on that
6858350	6860450	and I can do HFI
6860450	6862030	class dump.
6863330	6864650	Specify the elite key
6864650	6866370	without spaces.
6869400	6870360	Make sure to tell
6870360	6871380	it it's elite.
6872160	6874280	And there is our data for the card.
6877420	6878460	So,
6878460	6880460	that's your standalone low class attack.
6881160	6881880	Yeah.
6881880	6884240	With a battery, just walk around with it and
6884240	6886260	collect from different readers.
6886380	6888060	What can we fit in 10 minutes?
6888940	6891020	We did an out of service,
6891020	6892160	we did a check downgrade,
6892160	6893440	we did key recovery.
6893780	6895940	Should we show the special door controller
6895940	6897780	zero day that was sent to us?
6897920	6898620	Yes!
6900180	6901520	It's really cool.
6901520	6903360	So first of all,
6903360	6906220	I want to make sure the link gets out there.
6906680	6907740	This repository
6907740	6909940	contains an
6910860	6911940	unpatched vulnerability
6911940	6914140	in a
6914140	6915860	semi-common, not super common,
6915860	6917760	semi-common single door
6917760	6918740	controller.
6919580	6921480	And I'm going to show you how that works.
6921480	6924000	So this exploit has been reported to the vendor
6924000	6925880	that was about nine months ago.
6925880	6927920	And then the person who discovered the exploit
6927920	6929560	reached out and said,
6929560	6931660	hey, I'm kind of done with this.
6931660	6933740	I want it to be public, but I don't
6933740	6935260	really feel like doing a talk.
6935260	6937280	Which is totally fine and reasonable.
6937280	6938620	So, we got
6939700	6941720	their demo board, their demo kit
6942340	6943990	here to show you,
6943990	6945690	to show everyone how this works.
6945930	6948130	What's important to mention here is
6948130	6950090	I'm really big on not picking
6950090	6952050	on individual vendors because this is
6952050	6954170	an industry problem. The type
6954170	6956170	and category of exploit that you're going to see
6956170	6957930	on this demo is
6957930	6959830	common, actually. It's not
6959830	6961710	unique to this situation. I've seen
6961710	6964930	variations of this, both published and unpublished,
6964930	6966090	for at
6966090	6967890	least five or six different
6967890	6970050	vendors of door controllers,
6970050	6971710	of software.
6971710	6973250	And you're just going to see
6973250	6975510	what can happen when these
6975510	6978670	systems aren't properly protected and patched.
6978750	6979550	So,
6979550	6981810	let's go ahead and
6981810	6983210	again switch
6983870	6986390	all this stuff out of the way.
6991310	6992990	We'll see if the camera
6992990	6994690	can keep up.
6994750	6996790	I don't know if it will.
7002870	7004130	It's really,
7004130	7006950	really jittery. My apologies to folks.
7006950	7010070	Well, we've got
7010070	7011850	less than ten minutes, so
7012470	7014050	they get jitter and
7014050	7015370	hoard nothing.
7034950	7036590	Before we end up,
7036590	7039570	some questions about the Q&A.
7039770	7041210	Did you get
7041210	7043290	something from Wireless Village,
7043290	7045170	the Ricks of Wasabi,
7045170	7047010	about where Q&A is
7047010	7048730	possible to do? Was that in Discord?
7048730	7051110	No, but we can do it in our Discord.
7051110	7051990	I don't know.
7052010	7053550	Yeah, we can do Discord, yeah.
7057210	7059090	Alright, I will do that soon.
7059090	7061010	I can let you guys
7061010	7062710	know if you see that I'm not
7062710	7064290	paying attention.
7064870	7067030	Alright, so what we're looking at here
7067030	7068570	is two Proxcard readers
7068570	7070510	connected to a single door
7070510	7072210	controller, and
7072210	7075170	here's our user Alice.
7075410	7076050	And Alice
7076570	7078790	can badge in, and
7078790	7080570	this green
7081230	7082550	LED represents
7082550	7083850	the door strike.
7085550	7086530	I'm realizing
7086530	7088530	that people can't see me, but that's okay.
7088530	7090350	So this green LED here represents
7090350	7092310	the door strike. So here we go.
7092350	7094590	That's fine. And in fact,
7094590	7096330	our log...
7096330	7097490	This is
7098230	7100110	so tricky. My apologies.
7100350	7101290	So our log...
7102350	7104210	I'm just going to explain what's happening,
7104210	7106210	because we're tight on time. I realize the camera
7106210	7108210	won't be able to show the screen, unfortunately.
7108210	7110470	So my sincere apologies to folks there.
7110570	7112170	But some mics say
7112170	7114270	Alice can get in, Alice can get
7114270	7116110	out. Bob
7116110	7117870	wasn't doing so great on their
7117870	7120130	employee performance, so they've been
7120130	7122130	fired. Their badge no longer
7122130	7123010	works.
7125390	7126430	Mallory,
7127470	7128330	our malicious
7128330	7130190	attacker, is really
7130190	7132310	interested in what App Incorporation is working
7132310	7134310	on, but unfortunately
7134310	7136130	they can't get in either.
7136890	7138090	So what we're going to do
7138090	7139510	is we're going to plug in
7139510	7141670	this exploit stick.
7143710	7144230	And
7144230	7145810	this is actually just a unified
7145810	7148070	cloud key that's been repurposed.
7148070	7149970	It's just a little Debian box with a POE
7149970	7152490	port on it. It's been repurposed to execute
7153050	7154630	a very fun exploit.
7154630	7156330	So this is going to do an
7156330	7158330	ArcCache poisoning attack
7158330	7160810	automatically when it boots up.
7160810	7162310	It's going to look for
7162310	7164390	this type of door controller.
7164650	7166990	It's going to poison the ArcCache.
7166990	7168810	It's going to force the door controller
7168810	7170770	to connect to it.
7171370	7172550	And then this
7172550	7174570	will then connect to the
7174570	7177210	system monitoring software,
7177210	7177850	which is actually
7179230	7180750	here in the background.
7180750	7182610	Unfortunately, I don't have
7182710	7184490	a great setup to show the data
7184490	7185930	that's happening on this
7186770	7188070	laptop here, so
7188750	7191430	my sincere apologies there as well.
7192490	7194190	But we're just going to wait another
7194190	7196230	10 or 15 more seconds.
7196250	7198570	And what I'm waiting for is a
7198570	7201170	light here to start flashing.
7201170	7202670	So during this time,
7202670	7204990	what will happen in the log
7206930	7207530	is
7207530	7208430	in the event log,
7208430	7210950	I'm going to try. I know I said it's not going to work well,
7210950	7212070	but we're going to try.
7212670	7214510	Alright, so in the event log,
7214510	7216550	we're going to see that the door controller
7216550	7218450	briefly went offline and then came
7218450	7220730	back online. And that was
7220730	7222630	the attack tool running.
7223710	7224510	Temporarily taking
7224510	7225790	the door controller offline
7226310	7228310	and then bringing it back online.
7228990	7230470	So here we can see the light
7230470	7232250	flashing. There's only one
7232250	7234370	flash, which tells us it only found one door
7234370	7235770	controller to take over.
7235770	7237870	And everything continues working
7237870	7239830	normally. So the door controller still
7239830	7241650	has credentials cached.
7241650	7243470	Alice can still get in
7243470	7244950	normally.
7245930	7247810	Bob is still fired.
7247810	7250070	Bob, they can't get in.
7250070	7251770	But something interesting happens
7251770	7253730	now when Mallory scans
7253730	7255690	their credential. When Mallory
7255690	7257470	scans their credential,
7257470	7259770	that invalid access
7259770	7261450	attempt is going to go out
7261450	7263750	over the network to this exploit
7263750	7265770	device. It's going to see that
7265770	7267850	it's Mallory's card, and it's going to
7267850	7269570	manually tell
7269570	7271710	that door controller to unlock
7271710	7274350	the door for several seconds.
7274390	7275710	In the meantime,
7275710	7277350	it is not going to forward
7277350	7279270	Mallory's attempt to get in
7279270	7281930	to the system software, to the server.
7281930	7283850	So there will be no log entry of any
7283850	7285790	kind for any of Mallory's
7285790	7287730	attempts. So here is Mallory's
7287730	7288530	card.
7289710	7291750	And they have access down
7291750	7293170	here to the door strike.
7294210	7295350	And, of course, they can get out
7295350	7296750	as well.
7299650	7301410	And, again,
7301410	7302630	remember, Alice's credential
7302950	7304250	still works.
7304970	7307030	And what we'll notice is that
7307030	7308810	the only log
7309730	7311090	information that we see
7311090	7313250	here is related to the real
7313250	7314710	system credentials,
7314710	7317030	that the exploit tool is not filtering
7317030	7319050	out. It's just
7319050	7320910	the Alice and Bob credentials.
7320910	7322890	So it is actively
7322890	7324590	filtering everything related
7324590	7326370	to Mallory.
7327170	7329130	And you might be curious,
7329130	7331770	well, what happens when you unplug this?
7331770	7332990	After a few minutes,
7332990	7334770	the door controller reconnects back to
7334770	7336990	the original server, and everything
7336990	7339130	continues working as
7339130	7340830	expected. So this is
7340830	7342470	this specific exploit
7342470	7344590	is in that GitHub link
7344590	7347390	that we mentioned here.
7347710	7348910	If you're interested in it...
7349790	7350690	We got
7351710	7352910	lenient, so we
7352910	7354830	have... it's not a hard
7354830	7357010	stop, so we can make
7357190	7358370	a nice exit.
7358470	7360170	Good enough.
7361410	7362970	So, if you want to read
7362970	7364770	more about it, the code is published
7364770	7367390	here in this GitHub repository.
7368470	7368890	It's
7368890	7370870	something that I really want to
7370870	7373010	stress. This category
7373010	7375030	of exploit is not unique to this vendor.
7375030	7376830	It's something that we've seen time and time
7376830	7378910	again over the years, but it's such
7379110	7380390	a great, beautiful example
7380390	7382890	of what happens when we
7382890	7384770	treat network-enabled
7384770	7387130	devices as if they're not network-enabled
7387130	7388250	devices.
7388970	7390930	So, definitely, if you are
7390930	7392830	in this section
7392830	7394970	here, I'm going to talk about mitigations.
7394970	7396790	So, we'll just... yeah, there we go.
7396790	7399570	So, overall defenses and mitigations.
7399710	7401030	I see I didn't add here
7401030	7403150	my biggest mitigation for door controllers,
7403150	7404670	which is assume
7404670	7406590	that your door controller is
7406590	7408810	super insecure, and that if anyone
7408810	7410510	is able to talk to it, they're able to
7410510	7412630	compromise it. That may not actually be the
7412630	7414490	case, but if you assume that
7414490	7416510	when you're designing the system, whether
7416510	7418710	you're a customer or you're an integrator,
7418710	7420270	that will minimize
7420270	7422630	the risk related to these types
7422630	7424530	of exploits, these types of attacks.
7424630	7426290	If you want to prevent
7426290	7428310	credential interception by
7428310	7431110	things like the ESP key or the BLE key,
7431110	7432430	what you want to use is
7432430	7434650	OSDP version 2 with secure channel
7434650	7436230	to encrypt the communications
7436230	7439070	between the reader and the door controller.
7439290	7440570	If you want to resist
7440570	7442330	cloning, you want to use secure
7442330	7444730	credential with secure objects.
7444730	7446610	We don't have time to get into it,
7446610	7448910	but short description,
7448910	7450510	secure objects are basically
7450510	7452750	ways of cryptographically encrypting
7452750	7454510	and signing that PACS
7454510	7456610	payload and tying it to the serial
7456610	7458490	number of that card, which makes it
7458490	7460590	harder to duplicate or compromise
7460590	7462910	later. If you
7462910	7464670	want to resist tech downgrade
7464670	7466710	attacks, if you want to just know if people
7466710	7468830	are messing with your readers, those tamper
7468830	7471350	switches are super important to monitor.
7471630	7472730	There are a couple of different
7472730	7474590	solutions that you can employ to actually
7474590	7476930	stop attacks cold when they happen.
7476930	7479350	If you have good tamper switches,
7479350	7481950	and not all of them are,
7481950	7482370	some
7482370	7484250	access control software packages
7484250	7486690	will allow you to configure an action
7486690	7488790	that takes place where if a reader is
7488790	7490930	tampered, then that door gets shut off
7490930	7492770	until someone goes out and inspects
7492770	7494450	the reader. There is also
7494450	7496010	an additional product
7499000	7500140	that was released
7500140	7501540	sometime last year
7502160	7504020	called the spider
7504020	7506300	blocker. Super weird name,
7506300	7508320	but interesting tool
7508320	7509720	all the same.
7510120	7512040	I don't recommend this for most people,
7512040	7514040	if I'm being frank. So the spider blocker
7514040	7516100	is an add-on board. You need one
7516100	7517980	per reader, and it lives
7517980	7519960	next to your door controller, and
7519960	7521520	it is a man in the middle
7521520	7523860	between the reader and the door controller
7523860	7526520	that monitors the tamper line.
7526520	7528100	And if tamper is detected,
7528100	7529780	it physically disconnects the reader
7529780	7531980	from the system. And then someone has
7531980	7534060	to walk back into the wiring
7534060	7536040	closet and press this red
7536040	7538540	reset button. It's an interesting thought,
7538540	7540000	and for some applications, it
7540000	7541980	might be useful, but it is
7541980	7544520	probably not really great for wide scale deployment.
7544520	7546040	If you're really worried about people
7546040	7547840	messing with your readers, the biggest
7547840	7550180	things that you can do are having a
7550180	7552240	good tamper monitoring solution,
7552480	7554000	having a good plan of action
7554000	7556200	for what happens if a tamper gets
7556200	7557980	triggered, and depending
7557980	7560000	on the vendor, if you are able
7560000	7562040	to use custom keys,
7562040	7564160	custom encryption keys for your
7564160	7566200	credentials and readers, in many
7566200	7568440	cases, that can offer an additional
7568440	7570440	layer of protection.
7570440	7572260	Specifically, with
7572260	7573740	multiple vendors, if you are
7573740	7575700	using custom keys,
7575700	7577920	HID calls them elite, other vendors
7577920	7579940	might call them different terminology.
7579940	7582160	If you are using custom keys,
7582160	7583680	then those configuration
7583680	7585720	cards that we talked about also
7585720	7587800	have to have those custom keys loaded,
7587800	7589640	which is much harder
7589640	7591500	to do, because there is a special
7591500	7593760	restricted ordering process for
7593760	7595340	ordering readers and credentials
7595340	7597740	with custom keying data.
7598200	7599420	So the only reason
7599420	7601520	that this worked is because
7601520	7603240	our reader was using a standard
7603240	7605820	global key, and we were using a
7605820	7607940	standard global configuration card
7607940	7609800	that was available to all
7609800	7612940	integrators and all customers.
7612940	7613700	So, yeah, there are
7613700	7616840	a couple of things to do there as well.
7616840	7617700	Now, I don't know if
7617700	7619860	we have any time left. Iceman,
7619860	7621560	how much flexibility did they give us
7621560	7623660	for Q&A?
7624380	7626000	They made a very small one.
7626000	7627880	Very small.
7627880	7629120	I said that we are going to have a Q&A
7629120	7632400	over at Wireless Village RFID channel.
7632400	7633020	And how do people
7633020	7634880	get there if they want to do that?
7635000	7637000	I sent you a link, so I thought
7637000	7638340	you could post it there.
7638340	7640920	I posted on Twitter and I posted
7640920	7641780	on Discord.
7642840	7645200	Sure, sure. Give me a second. Let me grab that.
7645300	7647120	Feel free to follow both me and Babak
7647120	7649120	on Twitter, and shout
7649120	7651040	out to YouTubes and all that
7651040	7651800	stuff.
7653220	7655180	So, give me one moment
7655180	7657000	here, and I
7657000	7658980	will add this link
7658980	7660680	so everyone has it.
7661200	7661640	Yeah.
7664180	7665140	We have a text
7665140	7667020	channel there. If you want to have a video channel,
7667020	7669420	we can make it as well also later on.
7669820	7671060	But the Wireless
7671060	7673040	Village people, we are going to make a little talk
7673040	7674840	now as well, so we don't want to.
7674840	7676240	Of course, absolutely.
7676960	7678300	Wade's talk is soon also.
7678600	7681120	This link here, this Discord channel,
7681120	7683120	we will be doing a little bit of Q&A for a few
7683120	7683840	minutes.
7683840	7686360	And if you have any questions,
7686360	7688240	reach out, email us.
7688660	7689940	We are happy to
7689940	7691860	point you in the right direction. If you are a pen
7691860	7693780	tester and you are interested in
7693780	7695760	training, this is the point
7695760	7697760	where I just plug for 10 seconds.
7697760	7699460	Go to redteamalliance.com.
7699460	7701720	Iceman and I have a new 5-day hands-on
7701720	7703700	training where we are going to work hands-on with
7703700	7705580	everything from door controllers to weaponized
7705580	7707520	readers to some more advanced
7707520	7709780	techniques for manipulating credentials.
7709780	7711560	That's going to be coming out in
7711560	7713640	end of September. So we have dates announced
7713640	7715920	for it. And it is a hands-on
7715920	7717820	course. So every student will receive
7717820	7719720	hardware like the reader that you
7719720	7721740	saw here. And test
7721740	7723800	credentials and tools to
7723800	7725720	weaponize things. So
7725720	7727760	if you are curious about that, you can ask us about
7727760	7729800	that as well. So that's it.
7729800	7731700	Thank you everyone so much for being so
7731700	7733760	patient with our first DEF CON
7733760	7735540	livestream attempt.
7735700	7737660	And for the back and forth that we
7737660	7739800	had with the slides, all things considered, it went
7739800	7741660	better than I expected somehow.
7742360	7743880	So, thank you again.
7743880	7745320	Hope you guys enjoyed it.
7745760	7747800	Yes, yes one shipping. Thank you so
7747800	7749860	much. It's been a delight. Pleasure
7749860	7751580	as always to talk with you, Babak, and
7751580	7753740	meet all you guys. And I'm looking forward
7753740	7755640	to have you over at the Q&A and
7755640	7757440	have some chats with you there.
7757960	7758720	Stay cool.