1
00:00:01,360 --> 00:00:02,320
Hello, everyone.

2
00:00:02,320 --> 00:00:08,800
Welcome to keeping your distance, pwning RFID physical access controls from six feet and beyond.

3
00:00:09,240 --> 00:00:21,320
Today we're going to discuss two methods that we used over the pandemic to conduct our red team assessments and cloning an RFID badge beyond that six foot barrier.

4
00:00:22,400 --> 00:00:24,820
My name is Langston Clement.

5
00:00:24,820 --> 00:00:41,240
I am a principal pen tester here at Core BTS, and I've been in the industry for about 15 years now, focusing primarily on RFID, hacking, wireless, and physical pen tests.

6
00:00:41,640 --> 00:00:43,060
I'm Dan Goga.

7
00:00:43,060 --> 00:00:45,740
I'm a penetration tester at Core BTS.

8
00:00:45,740 --> 00:00:52,080
I've been in the industry for over five years now, and I focus on penetration tests and red team engagements.

9
00:00:53,100 --> 00:00:59,300
So the question here is, how do you conduct a physical red team engagement during a pandemic?

10
00:00:59,300 --> 00:01:11,960
Now, if you're familiar with doing red team engagements and physical pen tests, you know that a huge portion of that pen test is going to rely on social engineering people, right?

11
00:01:11,960 --> 00:01:21,220
At the end of the day, your client still wants you to social engineer their employees to see if you can get in in a certain way, right?

12
00:01:21,220 --> 00:01:39,500
So it's made it a little bit difficult because, you know, with the restrictions in place of having that six feet, you know, social distance policy that, you know, we are abiding by to make sure that we conducted this safely and that we could go through and actually,

13
00:01:39,500 --> 00:01:56,790
you know, perform the pen test during this time period, you know, it made it a little bit more difficult because if you're familiar with RFID cloning, you know that you have to stay within, you know, a lot less than six feet to actually get close enough to clone someone's badge.

14
00:01:56,790 --> 00:02:09,670
So that is, you know, the issue that we came across and, you know, came up with some fun creative ways that we want to share with you and for anybody to use on their red team engagements moving forward.

15
00:02:09,950 --> 00:02:19,410
So Dan's going to talk about some of the, you know, what RFID cloning is in the first place, if you're unfamiliar with it, and then talk about the differences between the two.

16
00:02:20,430 --> 00:02:21,110
Great.

17
00:02:21,110 --> 00:02:25,230
So we'll briefly go through RFID cloning.

18
00:02:25,230 --> 00:02:32,470
The purpose of this talk is not to go into the ins and outs of how RFID works and how to clone it.

19
00:02:32,470 --> 00:02:36,650
However, it's essential we touch on this briefly.

20
00:02:36,650 --> 00:02:44,830
So radio frequency identification technology or RFID is common in a lot of physical access control systems.

21
00:02:44,830 --> 00:02:55,130
And it's become a very convenient way for building managers and managing organizations to provision access and revoke access with ease.

22
00:02:55,130 --> 00:03:06,970
However, this convenience presents some vulnerabilities as RFID technology and credentials can be cloned under the right circumstances.

23
00:03:07,290 --> 00:03:19,710
Now, when discussing RFID technology, it's important to note that there's typically two distinctions made, that being between low frequency and high frequency RFID.

24
00:03:19,750 --> 00:03:30,330
So low frequency tends to be less secure and works over longer range, while high frequency RFID tends to be more secure and works over a shorter range.

25
00:03:30,330 --> 00:03:41,690
Now, it's important to note that under the right circumstances and with the right tools, both low frequency and high frequency credentials can be cloned to gain access to a building.

26
00:03:42,010 --> 00:03:53,890
So there are some traditional cloning methods that Dan's going to explain, and then we'll show you sort of how we adapted those for our Red Team engagements during this time.

27
00:03:55,430 --> 00:04:06,550
So there are a few well-documented ways of cloning a badge on a Red Team engagement, two of them being the brush pass method and the clipboard cloner method.

28
00:04:06,550 --> 00:04:16,350
With the brush pass method, you insert a rogue badge reader into a messenger bag and you approach someone, bump into them, or get close enough that you can get a badge read.

29
00:04:16,350 --> 00:04:26,090
Now, it's a bit difficult to confirm you get a good read on the fly, and of course, this does not abide by COVID-19 policies.

30
00:04:26,670 --> 00:04:31,050
Clipboard cloner method presents a better chance of getting a good read.

31
00:04:31,050 --> 00:04:37,870
As you approach someone, you hover the badge directly over a concealed rogue badge reader and give it back to the user.

32
00:04:37,970 --> 00:04:42,430
But of course, this also requires you to get within six feet of somebody.

33
00:04:42,430 --> 00:04:51,770
So that led us to a point where we had to develop a way to get that badge credential, get that read on a credential, while staying six feet apart.

34
00:04:53,730 --> 00:05:01,610
So what we did, you know, is sort of come up with two different ways of doing this.

35
00:05:01,610 --> 00:05:07,970
So Dan's going to explain the first one that we started going around the idea that was pretty successful.

36
00:05:09,370 --> 00:05:20,730
So this led us to a point where we developed a way where we put a rogue badge on the next to a legitimate badge reader at the entrance point to the target location.

37
00:05:20,790 --> 00:05:37,270
So we get a rogue badge reader, tape it on with some 3M tape, and accompany it with a message from presumably the building management with an organization's logo saying, hey, everybody, use this badge reader and not the legitimate one.

38
00:05:37,270 --> 00:05:57,590
And the idea here is that as people approach the they see this sign and they present their badge to the rogue badge reader, see the door doesn't open, and then they just present it to a legitimate one and they get access to the building and we get their credential and they don't think twice about it.

39
00:06:00,530 --> 00:06:27,110
So the great thing is, is that with a few modifications, this rogue badge reader can be modified with a Wi-Fi module known as the ESP RFID tool, where remotely from the parking lot with a long range antenna, you can connect to this Wi-Fi interface's web interface and remotely collect the information you need to clone the RFID credential.

40
00:06:27,170 --> 00:06:38,310
So again, we are able to maintain social distance and we tend to get a much better and more reliable read when someone comes up directly and puts their badge right over the rogue badge reader.

41
00:06:40,010 --> 00:07:02,070
So as you can see here, and as you'll see when you go through the process of setting this up on your own, the ESP RFID tool has a great web interface where it lists the exfiltrated data and with that all from the car, you take that hex value and you put it into your Proxmark and you clone a new badge.

42
00:07:04,550 --> 00:07:12,130
So once you get that data, like Dan mentioned, you'll just see these collecting onto that sort of payload.

43
00:07:12,130 --> 00:07:17,590
And that method, we actually used that pretty recently, a few months ago on a client.

44
00:07:17,590 --> 00:07:30,630
And when we deployed it onto the side of the building, we were able to get around 17 badge reads onto that actual device before anybody figured out that something odd was going on.

45
00:07:30,630 --> 00:07:36,230
At that point, we had already collected all the hex data that we needed to create as many badges as we wanted.

46
00:07:36,230 --> 00:07:46,130
So if they actually figured out that somebody had touched their badge to the reader and they tried to reset that badge, we still had more that we could use.

47
00:07:46,650 --> 00:07:50,370
So the wall reader build is very easy to do.

48
00:07:50,370 --> 00:07:54,530
It's very entry level and it's a fun project to do over a weekend.

49
00:07:54,650 --> 00:07:59,230
All you're going to need is an HID Prox Pro 5355A.

50
00:07:59,230 --> 00:08:08,990
This older model works really well because you can access the screw-in terminals that you're going to need so that you don't need to do any soldering at all during this entire process.

51
00:08:09,270 --> 00:08:24,210
So what you'll need to do is go ahead and grab one of those, get some LiPo batteries, a T-Tap connector, some wire to wire connections, and then some jumper board wires as well.

52
00:08:24,210 --> 00:08:26,910
And then you should be good to go.

53
00:08:26,910 --> 00:08:30,950
So all you need to do is take your ESP RFID tool.

54
00:08:30,950 --> 00:08:39,510
You're going to screw in those wires into the one side of the terminal and take it over to your actual reader, which is the WeGand interface.

55
00:08:39,510 --> 00:08:44,010
So this works directly and it's built for WeGand interfaces.

56
00:08:44,010 --> 00:08:49,290
So you can use a various different types of companies out there.

57
00:08:49,290 --> 00:08:53,330
If you get a used badge reader that has a WeGand interface, this works very well.

58
00:08:53,350 --> 00:08:58,070
And then what you want to do is take your LiPo batteries and you're going to make a series connection.

59
00:08:58,070 --> 00:09:09,130
The series connection is important because you're going to need enough juice to power both your ESP RFID tool and the Wi-Fi that it provides to you and to your actual badge reader.

60
00:09:09,130 --> 00:09:26,970
Now for this implant reader, this one smaller one with these LiPo batteries, it lasts maybe a few hours, but you're only going to need really the morning time or you're going to need, you know, when people are actually coming into the office and then when people are actually going into the,

61
00:09:26,970 --> 00:09:30,230
you know, like lunchtime or something like that.

62
00:09:30,230 --> 00:09:35,070
So when there's actual foot traffic with the few people that are actually coming in and out of the office.

63
00:09:35,250 --> 00:09:41,090
And so if you take a look at this, this is exactly what the wall reader should look like when you're complete.

64
00:09:41,250 --> 00:09:46,770
I had run out of some white wire there, so I just used the blue wire, but the example is right there.

65
00:09:46,770 --> 00:09:57,410
This is without the batteries plugged in, but it's nice because once the batteries are plugged in, it makes a nice little compact unit that you can throw 3M strips on the back.

66
00:09:57,410 --> 00:10:01,030
Everything's enclosed and it's water protected as well.

67
00:10:01,070 --> 00:10:07,250
And then you just slap that on the side of the building with a social engineering sign and you're good to go.

68
00:10:07,450 --> 00:10:15,050
So one thing that happened when we actually deployed this the first time is that it was very odd.

69
00:10:15,050 --> 00:10:17,610
We didn't understand what was going on.

70
00:10:17,610 --> 00:10:25,410
And Dan's going to explain, you know, this sort of misdirection opportunity that we were provided with after we found out what it did.

71
00:10:26,870 --> 00:10:44,750
So we discovered that when you place a rogue badge reader within about six inches to a legitimate badge reader, it presents a denial of service attack where the legitimate reader cannot read or authenticate any RFID credentials presented to it.

72
00:10:44,750 --> 00:10:52,690
So we planted this rogue badge reader early in the morning before everyone got to the office and we put it within six inches.

73
00:10:52,810 --> 00:11:05,790
And we observed as people presented their badges to a legitimate reader, they couldn't get access to the building and the security guard had to come open the door for them and they were granted access to the building.

74
00:11:05,850 --> 00:11:09,550
So this presents a unique opportunity for us to tailgate.

75
00:11:09,550 --> 00:11:16,050
Either A, we go in behind the person that can't get in and we say, oh, well, my badge doesn't work either.

76
00:11:16,050 --> 00:11:18,470
Well, we don't even have a legitimate badge.

77
00:11:18,490 --> 00:11:31,730
Or it directs people to a different entry point of the building where you can tailgate there too, of course, using the pretext of, oh, my badge reader didn't work at the front entrance and I have to use the back entrance like you.

78
00:11:32,530 --> 00:11:42,730
So the second one that we toyed around with and thought was pretty interesting and worked really well is the gooseneck reader.

79
00:11:42,730 --> 00:11:55,210
So if you take a look at this picture of this pedestal, the steel pedestal, what you'll see is that, you know, typically you'll see these at a parking garage, let's say, right?

80
00:11:55,210 --> 00:12:06,710
Or restricted entrance of an area where they attach a long range reader to it so that someone can drive up with their car, wave their card, and it will let them in.

81
00:12:06,710 --> 00:12:12,950
Now, typically these are cemented and there's drilled into the concrete.

82
00:12:13,430 --> 00:12:20,050
So it'd be really hard for you to be stealthy to deploy one of these at one of the sites with a rogue reader.

83
00:12:20,050 --> 00:12:27,410
So I thought it'd be really neat, what if we just take this pedestal and just attach it to a piece of wood and make it mobile?

84
00:12:27,410 --> 00:12:47,150
And so it's a really simple yet effective way of creating a long range mobile reader that all you need is a piece of plywood, some rubber feet, spray paint, and this pedestal with your long range reader, and you instantly have a nice mobile reader.

85
00:12:47,150 --> 00:12:56,190
Now, as you see in this picture, it, you know, sort of in the way it looks, it will sometimes just blend into the environment, right?

86
00:12:56,190 --> 00:13:01,210
A lot of people just don't notice that there's something odd, some piece of equipment, right?

87
00:13:01,210 --> 00:13:02,650
They don't even know what that is.

88
00:13:02,650 --> 00:13:08,710
So sometimes they don't even alert, you know, someone about it, and they just think that's very strange.

89
00:13:09,030 --> 00:13:24,370
The way it's sort of angled and it's, you know, right as soon as you walk out of the door, a lot of people that are, you know, next to that trash can, going for a smoke, leaving for lunch, it sort of sandwiches them, you know, as soon as they walk out that door,

90
00:13:24,370 --> 00:13:27,490
they're going to make that angle so that they come right across.

91
00:13:27,750 --> 00:13:31,190
And it makes it a nice, easy thing for you to do.

92
00:13:31,270 --> 00:13:37,010
And this battery that's attached to it, it's like a 12-hour battery, so it's going to last all day long.

93
00:13:37,010 --> 00:13:41,710
It's a very stable thing that you can just set it and forget it, and then remote in.

94
00:13:41,710 --> 00:13:45,430
So yep, that's the Gooseneck Reader, R.I.P.

95
00:13:45,430 --> 00:13:46,310
Goose.

96
00:13:46,310 --> 00:13:47,530
Thanks, man.

97
00:13:47,810 --> 00:13:53,010
So as you see, there are different heights of the Gooseneck Reader.

98
00:13:53,410 --> 00:14:06,770
Typically, you know, the 36-inch height works the best because it will give you a different variance between someone wearing a badge on their hip and then someone wearing a badge around their neck.

99
00:14:06,770 --> 00:14:22,270
And so what you'll, you know, sort of see as people walk past is that you'll be able to either get that within the range, or as they reach their badge up to hit their legitimate badge reader, it will, you know, brush past it automatically.

100
00:14:22,270 --> 00:14:28,290
And again, you know, something that you just deploy in the field, you leave it there, and it does all the work for you.

101
00:14:28,610 --> 00:14:32,230
So with the Gooseneck build, no soldering needed.

102
00:14:32,230 --> 00:14:39,450
Again, it's going to be a very simple process to put this together, and you're going to need all these components.

103
00:14:39,450 --> 00:14:46,790
Now, we're not going to talk about the step-by-step guide about building the actual base and attaching it all.

104
00:14:46,790 --> 00:14:54,130
If you'd like to go see that, check out this link right here, github.com slash shocksec, and that's with a zero.

105
00:14:54,130 --> 00:14:59,370
You'll be able to get there and look at all of the, you know, step-by-step guides.

106
00:14:59,370 --> 00:15:09,650
You'll also see that there are templates so that if you want to, you know, you know, cut it out yourself or you need a reference guide, it is right there for you to download.

107
00:15:10,130 --> 00:15:15,910
So once you get all that stuff together, you will do the same thing just like the wall reader.

108
00:15:15,910 --> 00:15:23,850
You are going to set up a white and green wire for your data, and that's always going to be the case for any WGAN interface.

109
00:15:24,050 --> 00:15:36,230
You're going to have a positive and a negative connection, and then you're also going to connect that pigtail, DC pigtail, directly to the WGAN interface.

110
00:15:36,270 --> 00:15:46,730
And so as you plug those two in, it's going to power your large long-range reader and your, you know, ESP RFID tool so you can get Wi-Fi access and collect data.

111
00:15:46,730 --> 00:15:56,090
So with the HID iClass SER90, as you see here in the picture, again, on the right-hand side, if you look at it, it's a very simple process.

112
00:15:56,530 --> 00:16:02,370
Everything's labeled inside, so all you need to do is, you know, find your data wires.

113
00:16:02,370 --> 00:16:07,410
You're going to connect that to your ESP key with the screw-in terminals using the screwdriver.

114
00:16:07,410 --> 00:16:09,830
Same thing on the long-range reader.

115
00:16:09,830 --> 00:16:23,030
And then you're going to attach that pigtail right there, and then you'll drill a little hole out the back of the reader and attach that nice large battery for you to collect all of your loot.

116
00:16:24,390 --> 00:16:27,590
So the gooseneck base itself is very simple.

117
00:16:27,590 --> 00:16:37,670
It's only a 16 by 16-inch piece of wood, and then you're going to throw some rubber feet on the bottom of it and use some carriage bolts to attach it.

118
00:16:37,850 --> 00:17:02,350
And when you do this and you actually sit it on top of your piece of wood, you want to make sure that when you're tracing the mounting holes that you're at least one inch and a quarter away from the edge of the piece of wood because it's going to counterbalance itself and it's going to make a nice weight distribution so that when you actually mount your reader,

119
00:17:02,350 --> 00:17:03,730
it's going to lean forward.

120
00:17:03,730 --> 00:17:05,150
Everything is perfect.

121
00:17:05,250 --> 00:17:07,010
I've tested this a lot.

122
00:17:07,010 --> 00:17:12,030
It's very stable, and you're not going to have to worry about it falling on a client or anything like that.

123
00:17:12,030 --> 00:17:13,970
It just works really well.

124
00:17:13,970 --> 00:17:17,670
So trace out those holes, drill your holes, spray paint it.

125
00:17:17,670 --> 00:17:18,490
It's very simple.

126
00:17:18,490 --> 00:17:23,290
Throw some rubber feet on the bottom and then attach your carriage bolts underneath.

127
00:17:23,910 --> 00:17:29,130
And as you see there, you can put a piece of Velcro on the back of the battery and you can stick it on the back.

128
00:17:29,130 --> 00:17:31,350
It makes it look nice and clean.

129
00:17:31,630 --> 00:17:35,170
And then as you see on the right, it's going to be your final product.

130
00:17:35,690 --> 00:17:44,830
And to the point of stability, you see in this picture, we actually sat this on a pile of rocks and nothing happened to it.

131
00:17:44,830 --> 00:17:45,950
It stayed there.

132
00:17:45,950 --> 00:17:54,110
But again, you're able to deploy it near a smoking station or something where people are going to come in and out of the building.

133
00:17:54,110 --> 00:18:05,310
And as they brush past their key fob or their actual badge, it's going to go through and it's going to collect that data.

134
00:18:07,370 --> 00:18:16,930
So again, the use case for the Gooseneck is applied similarly to the Rogue badge reader strapped directly to the building.

135
00:18:16,930 --> 00:18:27,530
We implant it early in the morning and then with a long range antenna reader, we're able to access the data similarly through the ESP RFID tool and clone it in the car.

136
00:18:28,910 --> 00:18:29,610
All right.

137
00:18:29,610 --> 00:18:39,970
So the best way of going about this that I found while we're out in sight, you don't really want to have your laptop out with your Proxmark and wires going from it.

138
00:18:39,970 --> 00:18:44,510
It's a much more stealthy approach if you actually can clone it with a mobile phone.

139
00:18:44,510 --> 00:18:51,310
So I'm going to show you the quick and easy way to do this and the cheapest way to do this while you're on site.

140
00:18:51,310 --> 00:19:01,670
So what you'll need is to grab your favorite Android phone or tablet, grab a Proxmark 3 Easy, which is around $60 to $70.

141
00:19:01,670 --> 00:19:02,710
That's the cheaper option.

142
00:19:02,710 --> 00:19:08,570
The Proxmark 3 RDP4, highly recommend, amazing tool by Iceman.

143
00:19:08,570 --> 00:19:09,650
Go ahead and grab that.

144
00:19:09,650 --> 00:19:12,750
It's a lot more expensive, but it's worth it.

145
00:19:12,950 --> 00:19:17,610
Get a on-the-go cable and then download the Nprox mobile app.

146
00:19:17,610 --> 00:19:18,610
It's on GitHub.

147
00:19:18,730 --> 00:19:23,930
There's no root required, so you don't need to know anything about reading an Android phone.

148
00:19:23,950 --> 00:19:31,790
And then all you need to do is, as a bonus, if you'd like, grab this 3D file and 3D print your own case.

149
00:19:31,890 --> 00:19:38,050
Because as you see in the right-hand corner, that, you know, Proxmark 3 Easy, it's got all the wires exposed.

150
00:19:38,150 --> 00:19:42,930
It looks a little odd, so if you stick this on the back of your phone, people, you know, might draw attention to you.

151
00:19:42,950 --> 00:19:45,190
Probably don't want to do that, right?

152
00:19:45,230 --> 00:19:54,490
So if you put all that stuff together... Dan, you want to explain how you even remind people how you get that hex code in the first place?

153
00:19:54,490 --> 00:19:55,630
Definitely.

154
00:19:55,630 --> 00:20:11,290
So with this arrangement, we again access the ESP RFID tool and we refresh it, get that new hex value, and with Nprox, instead of just the Proxmark, we're able to clone the badge.

155
00:20:11,650 --> 00:20:29,630
And through this Easy interface, and then of course in the lower left, you can see that that cell phone with the Proxmark Easy is a lot more easy to carry and less conspicuous than a laptop and a Proxmark RD4.

156
00:20:30,670 --> 00:20:40,610
Yeah, so once you do that and you set up your nice little, you know, Nprox app, you plug in the antenna, you're going to run a simple command.

157
00:20:40,610 --> 00:20:45,310
In this case, we're going to clone an HID badge, low frequency.

158
00:20:45,530 --> 00:20:54,190
And so you just type lf hid clone and insert your hex code that you got from that ESP RFID loop page.

159
00:20:54,230 --> 00:20:57,570
So once you copy that over, you just type it in there.

160
00:20:57,570 --> 00:21:04,710
So in this case, we're going to type lf hid clone, we enter our hex code, and then it's just going to say done on the screen.

161
00:21:04,710 --> 00:21:06,730
It's very quick and easy.

162
00:21:06,730 --> 00:21:11,290
And then you type lf search, and then it's going to verify your card data.

163
00:21:11,290 --> 00:21:22,810
So once you see it, it'll tell you that, you know, this is the HID Prox tag ID, give you that hex code back, it'll give you the facility code and the card number, and it says it's found.

164
00:21:22,810 --> 00:21:26,250
So once you're done with that, you're good to go.

165
00:21:26,250 --> 00:21:29,330
Just walk up to that door and let yourself into the building.

166
00:21:29,330 --> 00:21:38,410
So those are the two methods that we've used over the pandemic that have been very successful for us, you know, cloning badges from a distance.

167
00:21:38,410 --> 00:21:53,050
And it's been a lot of fun sort of just sitting back, letting those devices do all the work for us, and then, you know, showing the client later that, you know, either somebody noticed that these devices are, you know, deployed in the field, or that no one even noticed them in the first place.

168
00:21:53,070 --> 00:21:57,370
So we encourage you all to build these and have a lot of fun with them.

169
00:21:59,150 --> 00:22:13,710
So we just want to give shout outs to everybody that's listed here in our references, because a lot of these people, you know, inspired and helped actually build, you know, some of these tools.

170
00:22:13,850 --> 00:22:18,970
Corey Harding with the actual ESP RFID tool, and there's some really great guides.

171
00:22:18,970 --> 00:22:27,510
So if you're very interested in this and you want to get a little bit deeper dive, highly recommend checking out all of these references here.

172
00:22:27,670 --> 00:22:30,970
This is also listed in the GitHub tutorial.

173
00:22:30,970 --> 00:22:38,790
So if you need to go to the links, go over to GitHub slash shock stack, and you'll be able to get all of that information there.

174
00:22:38,990 --> 00:22:42,810
So we appreciate everybody watching this video.

175
00:22:42,810 --> 00:22:49,070
And, you know, we just want everybody to say, you know, have a happy DEF CON and enjoy.

176
00:22:49,850 --> 00:22:50,730
Thanks.

177
00:22:50,730 --> 00:22:51,830
Thanks so much.