1
00:00:01,057 --> 00:00:03,120
- Miana and Micsen.

2
00:00:03,120 --> 00:00:04,499
Let's give them a good DEFCON welcome.

3
00:00:04,499 --> 00:00:06,861
(audience applauds)

4
00:00:06,861 --> 00:00:10,444
Okay (mumbles and laughs).

5
00:00:14,640 --> 00:00:17,678
- Yes so my name's Micsen

6
00:00:17,678 --> 00:00:18,761
and I'm gonna

7
00:00:19,760 --> 00:00:23,220
or we are gonna present
digital skeleton keys.

8
00:00:23,220 --> 00:00:25,980
- Yep, my name's Miana.

9
00:00:25,980 --> 00:00:29,670
Essentially the talk is
about a vulnerability

10
00:00:29,670 --> 00:00:32,400
that we found in a RFID access

11
00:00:32,400 --> 00:00:34,440
control system called smarter.

12
00:00:34,440 --> 00:00:38,430
It's specifically what's known
as an update on card system.

13
00:00:38,430 --> 00:00:42,660
So the readers are
different from normal ones

14
00:00:42,660 --> 00:00:44,880
but I'll let Micsen
explain more about that.

15
00:00:44,880 --> 00:00:45,713
- Yeah.

16
00:00:45,713 --> 00:00:50,490
So in short terms, a traditional access

17
00:00:50,490 --> 00:00:53,729
control systems system is a online system

18
00:00:53,729 --> 00:00:58,470
where the credential just
stores an identifier.

19
00:00:58,470 --> 00:01:00,550
And then once you go to

20
00:01:01,708 --> 00:01:04,500
go up to any reader
within the installation

21
00:01:04,500 --> 00:01:08,070
it's gonna do a look at
on your credential number

22
00:01:08,070 --> 00:01:11,730
towards the databases
that are often distributed

23
00:01:11,730 --> 00:01:12,960
on the controllers,

24
00:01:12,960 --> 00:01:16,773
but essentially then on a database.

25
00:01:18,720 --> 00:01:22,500
Whereas in a offline
access control system or

26
00:01:22,500 --> 00:01:26,280
also referred to as a update on card

27
00:01:26,280 --> 00:01:29,740
you would then provision
a credential ahead of time

28
00:01:31,121 --> 00:01:34,140
with the access with a often a list

29
00:01:34,140 --> 00:01:37,680
of what doors you're
supposed to have access to.

30
00:01:37,680 --> 00:01:41,710
And this should be done in a secure way

31
00:01:42,618 --> 00:01:44,223
so you can't manipulate it,

32
00:01:45,152 --> 00:01:48,462
but as we will see that's
not always the case.

33
00:01:48,462 --> 00:01:50,940
(microphone creaks)

34
00:01:50,940 --> 00:01:51,773
Yeah.

35
00:01:51,773 --> 00:01:53,970
And there is also some nuances to this

36
00:01:53,970 --> 00:01:58,970
cuz you can get a mixture of offline

37
00:01:58,971 --> 00:02:00,960
and online readers within
the same installation

38
00:02:00,960 --> 00:02:03,660
where a online reader will then revalidate

39
00:02:03,660 --> 00:02:05,760
your credentials as you're going through.

40
00:02:05,760 --> 00:02:10,760
So you can have a online reader
on the main entrance store

41
00:02:10,830 --> 00:02:13,590
and then the rest of
the building is offline.

42
00:02:13,590 --> 00:02:15,555
The reason that you would use a

43
00:02:15,555 --> 00:02:18,720
off a update on card system

44
00:02:18,720 --> 00:02:21,630
is mainly associated

45
00:02:21,630 --> 00:02:24,960
with the cost of getting
the infrastructure there.

46
00:02:24,960 --> 00:02:29,190
So you get places that are remote

47
00:02:29,190 --> 00:02:32,370
or hotel rooms or stuff like that

48
00:02:32,370 --> 00:02:35,973
where you would have
those kind of systems.

49
00:02:38,880 --> 00:02:42,000
We've used something
called the Proxmark tree

50
00:02:42,000 --> 00:02:44,640
to do most of the research on this.

51
00:02:44,640 --> 00:02:49,640
In general the credentials
that are being deployed

52
00:02:50,640 --> 00:02:54,750
on these systems normally are
the micro classic credentials

53
00:02:54,750 --> 00:02:56,970
which has so many vulnerabilities

54
00:02:56,970 --> 00:03:00,720
these days that the Proxmark
client has a command

55
00:03:00,720 --> 00:03:05,720
called Autopwn to just
read off the credential

56
00:03:06,300 --> 00:03:09,150
and then be able to get the keys necessary

57
00:03:09,150 --> 00:03:10,593
to do changes to it.

58
00:03:12,840 --> 00:03:17,460
So how it all started with
me dumping one credential,

59
00:03:17,460 --> 00:03:21,605
but then I saw a pattern in it

60
00:03:21,605 --> 00:03:24,030
and wanted to investigate it further.

61
00:03:24,030 --> 00:03:26,370
Turns out that if you Google view is good

62
00:03:26,370 --> 00:03:28,383
you can find the software online.

63
00:03:29,550 --> 00:03:30,780
And if you go on eBay

64
00:03:30,780 --> 00:03:33,240
you'll find readers
that are geek missioned.

65
00:03:33,240 --> 00:03:38,240
And before I knew it, I had a
working installation at home.

66
00:03:40,050 --> 00:03:40,883
Oh.

67
00:03:41,940 --> 00:03:44,250
So the first thing I did was

68
00:03:44,250 --> 00:03:48,540
I dumped a credential
with access to one door

69
00:03:48,540 --> 00:03:50,301
and saw what I got.

70
00:03:50,301 --> 00:03:53,850
And a MIFARE Classic credential
has multiple sectors.

71
00:03:53,850 --> 00:03:56,655
To make it simpler I've
taken out one sector

72
00:03:56,655 --> 00:04:00,870
(indistinct) just to illustrate this.

73
00:04:00,870 --> 00:04:04,953
So we can see that, well
we're using four bites.

74
00:04:05,790 --> 00:04:08,430
And then I made another
credential with access

75
00:04:08,430 --> 00:04:10,110
to another two doors

76
00:04:10,110 --> 00:04:12,325
and we're adding eight bites.

77
00:04:12,325 --> 00:04:16,860
Well, four bites per door
looks kind of repeating

78
00:04:16,860 --> 00:04:21,860
and kind of matches the situation
I had with my four doors.

79
00:04:24,810 --> 00:04:28,230
What would happen if I just complete the

80
00:04:28,230 --> 00:04:30,210
or continue the pattern

81
00:04:30,210 --> 00:04:34,920
of adding another four
bites at the end of it?

82
00:04:34,920 --> 00:04:37,260
Well, turns out that's all you need to

83
00:04:37,260 --> 00:04:39,660
do a privileged escalation
attack in the system.

84
00:04:41,056 --> 00:04:42,420
(laughs)

85
00:04:42,420 --> 00:04:45,390
So at this point I was like

86
00:04:45,390 --> 00:04:47,520
okay, this is cool.

87
00:04:47,520 --> 00:04:52,167
And I was talking with Miana

88
00:04:52,167 --> 00:04:54,100
and a few others in a group

89
00:04:56,340 --> 00:05:01,080
in a group of people
that does a lot of RFID

90
00:05:01,080 --> 00:05:03,840
and it's gonna get much worse

91
00:05:03,840 --> 00:05:06,513
as Miana is going to
(laughs) talk about now.

92
00:05:07,530 --> 00:05:11,160
- So basically the part
that really interested me

93
00:05:11,160 --> 00:05:14,130
was now we've worked out
some of the data structure

94
00:05:14,130 --> 00:05:15,900
involved in the card

95
00:05:15,900 --> 00:05:19,143
and can take a credential and escalator.

96
00:05:20,160 --> 00:05:22,380
Is there a way to get that information

97
00:05:22,380 --> 00:05:26,010
from the reader without
ever needing a card?

98
00:05:26,010 --> 00:05:27,333
Well, we'll see.

99
00:05:28,620 --> 00:05:30,870
Going back to things that are vulnerable

100
00:05:30,870 --> 00:05:34,380
about the MIFARE Classic
credentials that they were using

101
00:05:34,380 --> 00:05:37,060
and with the Proxmark 3 tooling

102
00:05:38,190 --> 00:05:41,130
we could use an existing attack

103
00:05:41,130 --> 00:05:44,760
to extract the encryption keys

104
00:05:44,760 --> 00:05:46,650
for the card from the reader

105
00:05:46,650 --> 00:05:48,820
based on simulating a set of

106
00:05:50,640 --> 00:05:52,800
specifically crafted cards.

107
00:05:52,800 --> 00:05:55,830
And the Proxmark does that all by itself

108
00:05:55,830 --> 00:05:58,383
thanks to many other people's research.

109
00:05:59,790 --> 00:06:00,960
The interesting thing

110
00:06:00,960 --> 00:06:04,110
about that encryption
key is it happened to

111
00:06:04,110 --> 00:06:06,990
have the installation ID,

112
00:06:06,990 --> 00:06:11,990
which is one of the fields
inside the cards data

113
00:06:12,000 --> 00:06:14,520
as the last four bites of that key.

114
00:06:14,520 --> 00:06:18,690
So there's one piece of
information that we need.

115
00:06:18,690 --> 00:06:22,110
And you'll see that
highlighted on here in green

116
00:06:22,110 --> 00:06:23,553
and the keys at the bottom.

117
00:06:25,170 --> 00:06:28,260
But that's not all we needed.

118
00:06:28,260 --> 00:06:29,700
It turns out from looking

119
00:06:29,700 --> 00:06:34,080
through the software that
the cards can be configured

120
00:06:34,080 --> 00:06:38,910
with different sectors
assigned for different purposes

121
00:06:38,910 --> 00:06:40,890
and you then have to go and flash all

122
00:06:40,890 --> 00:06:45,890
of your readers to have them
read the credentials like that.

123
00:06:47,130 --> 00:06:49,770
So the next step was to try and work

124
00:06:49,770 --> 00:06:54,770
out the card structure
that a reader was expecting

125
00:06:56,070 --> 00:06:58,353
without ever having seen that card.

126
00:07:00,570 --> 00:07:04,080
So, made a little script
that worked on for a while.

127
00:07:04,080 --> 00:07:07,710
And the first attempt was running

128
00:07:07,710 --> 00:07:09,750
that MIFARE key extraction and working

129
00:07:09,750 --> 00:07:11,790
out where the user data sector was

130
00:07:11,790 --> 00:07:13,350
as well as the key

131
00:07:13,350 --> 00:07:15,573
which gives us the installation ID.

132
00:07:17,160 --> 00:07:20,590
And then I would create a

133
00:07:23,160 --> 00:07:25,110
card that the Proxmark

134
00:07:25,110 --> 00:07:30,110
would simulate that had a fake
generated user data sector

135
00:07:32,580 --> 00:07:35,730
in the location that the
reader was expecting.

136
00:07:35,730 --> 00:07:37,110
And then it would fill the rest

137
00:07:37,110 --> 00:07:42,110
of it with a generated
update on card sector.

138
00:07:43,170 --> 00:07:45,570
The reason why I filled the
rest of the card with that

139
00:07:45,570 --> 00:07:47,430
even though it only needs one

140
00:07:47,430 --> 00:07:50,640
is so that it could read
that and using the Proxmark

141
00:07:50,640 --> 00:07:54,090
we could see exactly what
sector it was trying to read.

142
00:07:54,090 --> 00:07:56,400
And then the next sector it tried to read

143
00:07:56,400 --> 00:08:00,060
would be where the reader was
expecting the doors to be.

144
00:08:00,060 --> 00:08:03,480
So from that card simulation

145
00:08:03,480 --> 00:08:07,530
we get the next two important
pieces of information.

146
00:08:07,530 --> 00:08:11,940
And the third step is just
brute forcing the doors.

147
00:08:11,940 --> 00:08:16,470
It turns out that the doors
are sequentially ID'd.

148
00:08:16,470 --> 00:08:19,350
So the very first door in the installation

149
00:08:19,350 --> 00:08:21,150
ID one,

150
00:08:21,150 --> 00:08:23,400
number two, ID two.

151
00:08:23,400 --> 00:08:27,690
So depending on the size
of the card and exactly

152
00:08:27,690 --> 00:08:31,090
how far back they had
configured the door sector

153
00:08:31,950 --> 00:08:33,900
we would just have to fill it

154
00:08:33,900 --> 00:08:38,070
with as many access
control sectors as we could

155
00:08:38,070 --> 00:08:41,490
and keep on generating new credentials

156
00:08:41,490 --> 00:08:43,620
until one of them opened.

157
00:08:43,620 --> 00:08:46,810
What happens when the reader

158
00:08:48,060 --> 00:08:50,430
finds the record for its door?

159
00:08:50,430 --> 00:08:52,710
Is it actually updates the data structure

160
00:08:52,710 --> 00:08:55,290
in there, saying it's been updated

161
00:08:55,290 --> 00:08:59,970
and it stores the user ID
in its internal storage,

162
00:08:59,970 --> 00:09:03,660
so it doesn't need to search
through so many pages of data.

163
00:09:03,660 --> 00:09:06,180
And that's how we can
detect what door ID it is

164
00:09:06,180 --> 00:09:08,463
because that's the one that it writes to.

165
00:09:11,700 --> 00:09:14,460
Now, an interesting thing we discovered

166
00:09:14,460 --> 00:09:18,300
from this is I sent this proof
of concept script to Micsen

167
00:09:18,300 --> 00:09:22,980
to try with the readers that he had.

168
00:09:22,980 --> 00:09:25,960
And those were configured with a different

169
00:09:28,620 --> 00:09:30,630
a different card structure from the one

170
00:09:30,630 --> 00:09:33,060
that I had wrote the exploit on.

171
00:09:33,060 --> 00:09:38,060
And yet my script was still working,

172
00:09:39,090 --> 00:09:42,330
but the Proxmark was saying
it was reading the sectors

173
00:09:42,330 --> 00:09:44,280
in a different order.

174
00:09:44,280 --> 00:09:47,010
Turns out that despite the
instructions saying you need

175
00:09:47,010 --> 00:09:48,570
reflash all the readers,

176
00:09:48,570 --> 00:09:49,770
that's not the case.

177
00:09:49,770 --> 00:09:51,330
the full configures on the card

178
00:09:51,330 --> 00:09:53,700
as long as you get the first block right

179
00:09:53,700 --> 00:09:56,640
which is almost always
in sector two anyway.

180
00:09:56,640 --> 00:10:01,640
But now that we could
identify where this update

181
00:10:02,100 --> 00:10:04,980
on card block was specified in memory

182
00:10:04,980 --> 00:10:06,993
which is that purple spot,

183
00:10:08,160 --> 00:10:11,010
we could completely get
rid of that middle step.

184
00:10:11,010 --> 00:10:12,750
This also had the advantage

185
00:10:12,750 --> 00:10:17,580
of allowing us to define a much
more compact data structure

186
00:10:17,580 --> 00:10:21,750
on the card that doesn't use any

187
00:10:21,750 --> 00:10:23,250
of the sectors that we didn't care

188
00:10:23,250 --> 00:10:27,210
about increasing the number
of doors that we could fit

189
00:10:27,210 --> 00:10:30,150
on each one of the brute force attempts.

190
00:10:30,150 --> 00:10:31,830
In fact, because everything

191
00:10:31,830 --> 00:10:35,880
about the card is
configured via this system,

192
00:10:35,880 --> 00:10:38,640
we went from being able
to fit on the demo system.

193
00:10:38,640 --> 00:10:40,770
I was developing this

194
00:10:40,770 --> 00:10:45,770
on, around 120 doors per card to like 850

195
00:10:47,070 --> 00:10:51,134
which doesn't take long to
get through most facilities'

196
00:10:51,134 --> 00:10:54,333
(laughs) entire access
control system with that.

197
00:10:55,530 --> 00:10:57,813
So after the script runs,

198
00:10:58,920 --> 00:11:00,420
the door will open

199
00:11:00,420 --> 00:11:03,420
but also you can then
write the generated data

200
00:11:03,420 --> 00:11:06,540
to credentials of your own that will open

201
00:11:06,540 --> 00:11:08,520
any door in the system.

202
00:11:08,520 --> 00:11:11,940
And this is what one of them looks like.

203
00:11:11,940 --> 00:11:16,140
So this is the sector for the user data.

204
00:11:16,140 --> 00:11:19,650
We put the extracted installation ID in,

205
00:11:19,650 --> 00:11:21,540
come up with a random U ID

206
00:11:21,540 --> 00:11:23,967
or less random in this
case, full (laughs).

207
00:11:25,320 --> 00:11:26,910
Disable any pin code

208
00:11:26,910 --> 00:11:29,220
cuz don't wanna have to type that in

209
00:11:29,220 --> 00:11:33,660
and specify where we want
the update on card block.

210
00:11:33,660 --> 00:11:34,563
Next sector.

211
00:11:35,736 --> 00:11:37,383
(mumbles) next page.

212
00:11:38,430 --> 00:11:39,870
This is what that looks like.

213
00:11:39,870 --> 00:11:42,570
We've got some further
research to do to work

214
00:11:42,570 --> 00:11:46,140
out what all of the other
values in this sector mean.

215
00:11:46,140 --> 00:11:50,970
But all we really needed was
this door block in orange

216
00:11:50,970 --> 00:11:52,980
and the number of doors.

217
00:11:52,980 --> 00:11:56,853
So we put that the next
sector and 840 doors.

218
00:11:59,040 --> 00:12:02,700
And then every sector
following that looks like this

219
00:12:02,700 --> 00:12:04,263
where we have the door number,

220
00:12:05,400 --> 00:12:07,710
the schedule of when it can be accessed,

221
00:12:07,710 --> 00:12:10,650
which zero F means all the time.

222
00:12:10,650 --> 00:12:13,680
And then the zero one means

223
00:12:13,680 --> 00:12:15,180
that the door hasn't read it yet

224
00:12:15,180 --> 00:12:16,380
and it hasn't updated it

225
00:12:16,380 --> 00:12:21,380
so that user ID full is always
allowed in through this door.

226
00:12:21,570 --> 00:12:26,010
And yeah, that's what the cards look like.

227
00:12:26,010 --> 00:12:27,720
The problem that we have

228
00:12:27,720 --> 00:12:32,100
with this now is that anyone
who can run this script

229
00:12:32,100 --> 00:12:35,888
which requires a $30 tool

230
00:12:35,888 --> 00:12:40,485
can open any installations
within this system.

231
00:12:40,485 --> 00:12:42,850
And I'll let Micsen talk about some of the

232
00:12:44,430 --> 00:12:46,290
blast radius of that.

233
00:12:46,290 --> 00:12:47,123
- Yeah.

234
00:12:47,123 --> 00:12:49,710
So I started doing disclosure on this

235
00:12:49,710 --> 00:12:52,260
around one and a half years ago

236
00:12:52,260 --> 00:12:54,723
with the manufacturer of this.

237
00:12:55,980 --> 00:12:57,510
The manufacturer is Teza

238
00:12:57,510 --> 00:12:59,730
which has been bought by Assa Abloy.

239
00:12:59,730 --> 00:13:03,270
And these days it's then being rebranded

240
00:13:03,270 --> 00:13:08,220
and resold under different
brands in different areas.

241
00:13:08,220 --> 00:13:13,220
So in the US it's sold
under the Mul-T-Lock brand

242
00:13:14,280 --> 00:13:19,280
and we've seen some
fairly secure buildings

243
00:13:19,630 --> 00:13:23,490
or buildings that should
have been secure that are

244
00:13:23,490 --> 00:13:27,030
using this system in an offline capacity.

245
00:13:27,030 --> 00:13:28,260
And there is for instance

246
00:13:28,260 --> 00:13:30,840
a airport in Norway that uses this

247
00:13:30,840 --> 00:13:35,840
to in areas between white
and red zone, which is two

248
00:13:36,750 --> 00:13:41,040
which is unclean and
clean zones at an airport,

249
00:13:41,040 --> 00:13:43,260
which is a big issue.

250
00:13:43,260 --> 00:13:48,260
They have from what I've
disclosed this to them as well.

251
00:13:48,780 --> 00:13:53,780
They have done things to be
able to mitigate for this.

252
00:13:54,870 --> 00:13:56,850
There's also...

253
00:13:56,850 --> 00:13:59,430
So while we don't know exactly how many

254
00:13:59,430 --> 00:14:01,484
of these systems there are,

255
00:14:01,484 --> 00:14:05,140
and they do advertise
that they're using this

256
00:14:06,330 --> 00:14:10,683
in at least these places
with their case studies.

257
00:14:11,910 --> 00:14:16,620
So and it's a wide variety of everything

258
00:14:16,620 --> 00:14:19,740
from corporate to healthcare

259
00:14:19,740 --> 00:14:24,210
to industrial applications
where this is being used.

260
00:14:24,210 --> 00:14:26,970
So one of the places it was being used is

261
00:14:26,970 --> 00:14:31,230
at a power distribution or
a company that has a lot

262
00:14:31,230 --> 00:14:34,140
of remote sites with power distribution.

263
00:14:34,140 --> 00:14:36,690
And that's a problem

264
00:14:36,690 --> 00:14:39,300
cuz you're not gonna get any updates

265
00:14:39,300 --> 00:14:42,360
from these stores if they are opened.

266
00:14:42,360 --> 00:14:44,940
Another thing that Miana didn't mention is

267
00:14:44,940 --> 00:14:49,110
that they do not keep a log

268
00:14:49,110 --> 00:14:50,580
if you're opening the door

269
00:14:50,580 --> 00:14:53,340
with the user ID that doesn't exist.

270
00:14:53,340 --> 00:14:56,100
The log is being kept in the lock,

271
00:14:56,100 --> 00:15:00,720
but as soon as it's being
written into the database of the

272
00:15:00,720 --> 00:15:02,850
if you pull the log off the door

273
00:15:02,850 --> 00:15:05,190
and then go back to your server

274
00:15:05,190 --> 00:15:08,820
to then be able to read
off what has happened,

275
00:15:08,820 --> 00:15:10,380
nothing shows up.

276
00:15:10,380 --> 00:15:13,440
So as long as there is no user ID

277
00:15:13,440 --> 00:15:15,450
which is valid associated with it,

278
00:15:15,450 --> 00:15:18,630
they just ignore that entry.

279
00:15:18,630 --> 00:15:23,630
And that seems to be a big
oversight from what we've seen.

280
00:15:26,610 --> 00:15:29,100
Another thing that they're doing is so to

281
00:15:29,100 --> 00:15:31,500
be able to patch this

282
00:15:31,500 --> 00:15:35,850
you now have to contact Teza

283
00:15:35,850 --> 00:15:37,870
and ask for a licensing upgrade

284
00:15:39,000 --> 00:15:42,243
because apparently
security needs a license.

285
00:15:44,040 --> 00:15:46,890
So I haven't spoken to them

286
00:15:46,890 --> 00:15:50,370
after I did my initial disclosure.

287
00:15:50,370 --> 00:15:53,280
So I don't know the
details of how that works

288
00:15:53,280 --> 00:15:55,150
but I know that it's quite assured

289
00:15:56,175 --> 00:16:01,175
to be able to get your installation
back to a secure state.

290
00:16:01,710 --> 00:16:05,040
- One of the other bigger
issues with these systems is

291
00:16:05,040 --> 00:16:08,160
literally by design they
are for remote locations

292
00:16:08,160 --> 00:16:13,160
or locations where it's
not feasible to network

293
00:16:14,220 --> 00:16:17,340
all of the readers, which
means to update them,

294
00:16:17,340 --> 00:16:19,800
you have to go and flash the firmware

295
00:16:19,800 --> 00:16:22,110
manually by plugging a device

296
00:16:22,110 --> 00:16:25,020
into every single one of these readers.

297
00:16:25,020 --> 00:16:26,280
Not once but twice,

298
00:16:26,280 --> 00:16:27,630
because you need to do it.

299
00:16:27,630 --> 00:16:30,630
Then you need to reissue
every single credential

300
00:16:30,630 --> 00:16:31,770
in the system.

301
00:16:31,770 --> 00:16:34,350
And you need to go back out
to all these remote stations

302
00:16:34,350 --> 00:16:36,900
and reflash the firmware.

303
00:16:36,900 --> 00:16:41,900
So yeah, this could be in the wild for a

304
00:16:42,390 --> 00:16:43,710
unknown period of time,

305
00:16:43,710 --> 00:16:45,930
and we are hoping that
it gets patched quickly.

306
00:16:45,930 --> 00:16:47,460
But yeah.

307
00:16:47,460 --> 00:16:49,590
I'm not sure if that's
the case, if you have to

308
00:16:49,590 --> 00:16:54,150
reach out for license upgrades
and do all that work, so.

309
00:16:54,150 --> 00:16:54,983
Yeah.

310
00:16:55,890 --> 00:16:57,540
Do you have anything else to add on that?

311
00:16:57,540 --> 00:16:59,553
- No, I think I'm good on that.

312
00:17:01,800 --> 00:17:03,510
- Well, just in general

313
00:17:03,510 --> 00:17:07,050
we wanted to thank the
RFID hacking community.

314
00:17:07,050 --> 00:17:08,820
We got a lot of encouragement

315
00:17:08,820 --> 00:17:13,353
and like advice and bouncing
ideas off of people,

316
00:17:14,310 --> 00:17:16,380
as well as all of the contributions made

317
00:17:16,380 --> 00:17:18,177
towards tools like the Proxmark

318
00:17:18,177 --> 00:17:19,710
and the previous work done

319
00:17:19,710 --> 00:17:23,430
on the MIFARE Classic hacking.

320
00:17:23,430 --> 00:17:26,190
Without any of that this exploit

321
00:17:26,190 --> 00:17:29,310
would've never been discovered,
let alone get this far.

322
00:17:29,310 --> 00:17:31,050
Also want to thank all the goons

323
00:17:31,050 --> 00:17:33,750
and the whole DEFCON community

324
00:17:33,750 --> 00:17:36,090
because I've wanted to talk here

325
00:17:36,090 --> 00:17:37,380
since I was like 12.

326
00:17:37,380 --> 00:17:39,063
And yeah.

327
00:17:40,170 --> 00:17:42,030
This community inspires people to look

328
00:17:42,030 --> 00:17:43,050
into this sort of stuff.

329
00:17:43,050 --> 00:17:44,613
So thanks.

330
00:17:45,768 --> 00:17:48,768
(audience applauds)

331
00:17:57,720 --> 00:17:59,760
So these are our contact details

332
00:17:59,760 --> 00:18:01,110
if anyone wants to get in touch

333
00:18:01,110 --> 00:18:03,630
and it looks like we've
got two and a half minutes

334
00:18:03,630 --> 00:18:06,210
if anyone has any questions.

335
00:18:06,210 --> 00:18:07,354
But.

336
00:18:07,354 --> 00:18:08,666
- Yes.

337
00:18:08,666 --> 00:18:11,472
- [Crowd Member One] Is the
code available (mumbles)?

338
00:18:11,472 --> 00:18:14,160
- That we are gonna
release the code shortly

339
00:18:14,160 --> 00:18:15,030
after they've gone.

340
00:18:15,030 --> 00:18:17,047
So follow us on Twitter

341
00:18:17,047 --> 00:18:19,830
and we'll make that available.

342
00:18:19,830 --> 00:18:21,540
- I wanted to have it available

343
00:18:21,540 --> 00:18:23,250
but I'm a bit of a perfectionist

344
00:18:23,250 --> 00:18:24,590
and I ran out of time.

345
00:18:24,590 --> 00:18:25,980
(Micsen and Miana laugh)

346
00:18:25,980 --> 00:18:27,723
I will get it up I promise.

347
00:18:29,670 --> 00:18:30,543
Any others?

348
00:18:33,599 --> 00:18:34,432
Oh.

349
00:18:34,432 --> 00:18:35,265
- Oh.

350
00:18:35,265 --> 00:18:36,098
- Yeah.

351
00:18:37,543 --> 00:18:41,793
- [Crowd Member Two] (indistinct).

352
00:18:43,110 --> 00:18:46,320
- So the card itself,

353
00:18:46,320 --> 00:18:48,630
we don't need to attack the card itself,

354
00:18:48,630 --> 00:18:50,460
we can go directly to the reader

355
00:18:50,460 --> 00:18:52,680
and get the keys off that.

356
00:18:52,680 --> 00:18:55,140
And that's not affected
by the hardened RNG

357
00:18:55,140 --> 00:18:57,003
that you would have on the card.

358
00:18:58,754 --> 00:18:59,587
Yeah.

359
00:18:59,587 --> 00:19:03,120
- Yeah, this attack needs
absolutely no knowledge

360
00:19:03,120 --> 00:19:04,650
of the system walking up to it

361
00:19:04,650 --> 00:19:07,710
as long as it's a smart air system

362
00:19:07,710 --> 00:19:10,080
that uses these credentials.

363
00:19:10,080 --> 00:19:12,990
You walk up with a
Proxmark running this code

364
00:19:12,990 --> 00:19:15,600
and the door opens.

365
00:19:15,600 --> 00:19:17,130
There are also some further things

366
00:19:17,130 --> 00:19:18,570
we've been researching with that.

367
00:19:18,570 --> 00:19:19,860
It turns out you can configure

368
00:19:19,860 --> 00:19:21,450
a fair bit more about the locks

369
00:19:21,450 --> 00:19:23,940
but we didn't have enough
time to fully dig into that.

370
00:19:23,940 --> 00:19:27,360
But pretty certain you can
lock out all existing users

371
00:19:27,360 --> 00:19:28,893
and stuff like that as well.

372
00:19:29,970 --> 00:19:33,043
So yeah, some fun things. (laughs)

373
00:19:35,730 --> 00:19:37,233
Time for one more question.

374
00:19:38,332 --> 00:19:39,870
(mumbles).

375
00:19:39,870 --> 00:19:40,703
Sure.

376
00:19:41,700 --> 00:19:43,000
Okay maybe it wasn't then.

377
00:19:44,190 --> 00:19:46,363
Oh well thank you then.

378
00:19:46,363 --> 00:19:48,949
(audience applauds)

379
00:19:48,949 --> 00:19:51,287
- Okay (mumbles).

380
00:19:51,287 --> 00:19:53,163
- Huh?