>>I'm Eric. This is Josh. Hi! Today we're talking about several attacks around RFID,
specifically RFID tag that we'll go into detail about that are used access facilities. Not so
much for cars or buses, amusements parks and stuff like that. So, a quick little
agenda. We will kinda go through a high level around red teaming. The kind of attacks that we do.
Traditional attacks and techniques you have heard about for years now, specifically RFID
attacks is what we're doing today. Then we'll talk about some advanced attacks we've been
able to develop ourselves, and then some mitigation and remediation and things you guys
can do to protect against some of these things we are showing. So about Juarez. Myself and my
partner Chris Nickerson started Juarez about 6 years ago. Since then we've been doing a lot of
big things in the industry but something we have been proud of now for a couple years is we put
together something called - - And with a lot of other people in the community put together
something called the penetration testing execution standards, so if you guys have any questions
around Penn testing, the process of it, how it works, details around it, check that out.
We've also done lots of other things that are boring to read, so I'll move on. Myself, I'm one
of the owners of Juarez and also principal consultant and also a co- owner of the company called
Layer 8 Labs that we just launched this week, so when you guys get a chance, check that
out as well. Do you have an important call? [Laughter]. >> Not anymore! Hi, my name is
Joshua Perrymon. I came on with Lars almost a year ago. I think we worked this out at DEFCON
last year. I'm also a senior partner with Layer8Lab.com. If you guys want to check it out,
we just released a new user attack framework. That's about it. So, a quick little funny
slide, it really says a lot of what we do. We have been lucky enough to build a company around
our hobbies and passions and then get paid for it. So that's why Lars was started, and that's
why everybody loves working there. Specifically today, we are talking about red team
testing. Red team testing has a huge definition that I don't care to read. The analogy behind
it that we always use is red team testing puts you in the ring, puts you in the fight. You
can't have an idea of how well you can defend the fight until you get in and fight. And so,
everybody does things in the labs, does things back in their own company itself, but until
you actually put yourself against an adversary, you don't know how you will stand up
against them. The things we are showing today are true adversarial modeling. The
reasons to conduct it, pretty straightforward, right? Show real impact to the business from
physical, social, electronic, whatever it might be, all the different ways it can be
compromised. Just a quick little summary of how red team testing works. Red team testing,
the idea behind is blended attacks, right? Where social, electronic and physical or all
three come together. That is what red team focuses. So, today we are showing one component of
that which will be direct physical attacks. Those can lead to things like physical
access to facilities, then that would lead to electronic access, or we're going to be sandwiching
things around blended attacks. So, we may compromise something electronically and get to a back
system, which is what we'll show here in a little bit. And once we have back system access, then
we can maybe get physical access after. So traditional attacks that we're not going to bore you
with. You have heard of lock picking and tailgating and shimming and impressioning and
bumping and all kinds of other cool things, what we are focusing on today is just RFID.
>> which in those attacks they work really well, right? But, they are traditionally kind
of loud in nature, so you can't always pull those attacks off, so what we're going to show is
hacking RFID where it beeps and you walk in, basically. >> Yeah, because what we have seen
throughout the years now doing this, is who is going to stop you if you beep in a door and
the door opens and you walk in? Chances are no one is going to question you. right? If you can
get yourself a badge, you can actually make a valid badge, maybe you are lucky enough and
can get a picture on it, or get a picture in the badge system through a blended attack, who is
going to stop you once you're in the building? >> All right, so we're not going to get real deep
into details, I'm sure a lot of people understand RFID by now. So what we're going to cover is
low- frequency and high- frequency. We don't get into the UHF stuff, so the low- frequency
of the prox card, the older first badges, a lot of times the card is actually a lot thicker.
And the other one or HF is high- frequency. So the I-class stuff, with encryption, that we're
really into, it's 1356 megahertz. >> next two pages. So who uses it? 80% or 70 to 80%
of people that have badges actually use the old unencrypted prox badges. Who is vulnerable?
Government facilities, medical facilities, financial institutions, nuclear, power and
water facilities, education. A lot of those are the old proxy stuff, right? They haven't even
gotten over to I-class encrypted stuff which we're going to own in a minute. So understanding
back systems. So here are the four main components of a badge system. Of course, this is a lot
smaller version, but this is applicable to all badge installations. You have the
cards which are powered by the reader, so think of it as shining a flashlight into a
mirror. The reader is actually putting the power out. That is sent. It powers the card. The
card then sends its information back over to the reader. That gets sent back to a controller.
And the host PC or the badge system, for instance, it's hooked into the controller and
that data is sent to the badge system and it makes its logic decisions based on the facility
code and card data sent to it. >> So some of the things we brought today to demo some of
the cloning we're going to be doing, a company out of Lithuania, Lithuania Midpoint
Security, actually builds badge demo systems. Whatever components you want to include
in it, you can buy, put together, have a rig set up in your lab, you can do your own
testing with it. Here we have one of the new edge readers from HID. We also have a multi class
so we can do both the frequencies Josh was talking about, and then you can simulate
things like push to exit, break an alarm if you actually bypass a door, shim a lock, under-door
hook it, whatever it might be to simulate an alarm as well as push to exit with a mag release.
So just for demonstration purposes, we have a full badge system and software running to
demonstrate the things we're going to be doing. >> Yes. And this is the newer edge
system as Eric said. So, it is -- The one we've just shown is more of the older traditional
style. This is what HID is moving to. Power over Ethernet, it has a lot of services, a lot
of web app stuff listening. So a big attack surface with this new system as well. So, again, what
we mentioned, we're really not interested in ski passes or anything like that. We're just
focused on the badges that get you into physical facilities. So this slide shows the most common
badges used. So, again, the 70 to 80% of the badges are prox, the old unencrypted stuff. So
then there's company that, you know, newer facilities that are buying new stuff. Because that's
the thing, right, with badge systems, a lot of that is tied into the facility. So if you
have an old building, it's typically going to be the older stuff. Unless somebody goes
in and redoes it. Because it's a real pain in the ass to come in and run all new readers and hook
all new stuff up. So anyways, this shows is the layout of how the antennas are, and you see on
the prox stuff, the antenna is a lot bigger than the I-class, but that's all built inside the card
and the integrated circuit. So read ranges, so here are the limitations if you are using off
the shelf hardware. So the prox stuff and even I- class, 12 inches. >> About 3 inches
usually. >> Yeah, it's typically 3 inches if you use - - . >> Like this reader right
here. >> Yeah. >> You have to get pretty close before it reads it. >> You almost have to touch
it. So what we have here, this is a parking deck reader and they sell these for both prox
and I- class, so it's a lot bigger footprint, but again if you are using off the shelf
stuff, you are limited to that. And Owen did a bad ass talk about making this long- range.
So what we wanna say, is don't think about you are just limited to what hardware is on eBay. You
get with some guys, do some research and we're talking 10 to 25 feet and maybe more. >>
Yeah. >> So - - . >> and just with a garage reader that you buy off eBay or buy from
HID, it's anywhere from one and a half to two feet. Which if you think about it, that's me
walking up to Josh and asking for a smoke or asking for a light. I'm that close to him. I
can get a read on his card. So that in your backpack, clipboard, whatever it might be,
a satchel If you are European, you can walk up and read somebody's card if you are a
couple of inches away. >> so. And all this is built around the Wigan protocol, so if you go
back thinking to the slide earlier, we present the reader with the card. Once the card
does its translation, it's all Wigan clear text from the reader itself back to the back end
system. So what that looks like is, this shows you the layout. Wigan is a faulting signal, so
the signal will be flat lined and then when it actually receives the bit, it drops down.
So falling edge is how we identify those signals in the aldrino. And the last thing we
want to leave you with on this slide, there's three things that you need to get into a facility.
You've got to know the bit link, the type of card it is, so 35 bit, corporate 1,000, or 26 bit
or custom 46 bit. >> Or low- frequency, high- frequency, whatever kind of card it may be.
And you can identify these things through various ways, and we'll talk about some of that.
>> yeah. This shows the layout of the cards. There's the start bit, a parody bit at the front
of the card and then you have the facility code and then the user code. It depends on what
card type it is about how long those can be. So obviously a custom 46 bit is going to
provide you with a lot longer facility code and a lot longer user code. >> So three major
components, those things should be sensitive and private, right? Well, one of the things we found
through a lot of the research we were doing, and development around these things is that
information is not so private. Because of the way HID structures their ordering
process and reseller process, you can actually go on eBay and buy extra cards companies are
selling. And the sad part about this is, I don't know if you can see it, but printed on the box
which is displayed in high quality pictures on eBay is the facility code and the card
numbers in range for what they bought probably in excess. So right there alone, we have a
facility code for a particular person on eBay. So everybody knows through O-cent that you
can typically find somebody through social media or whatever it might be. So the chances of
us finding who that card belongs to and what company we can get access to, pretty probable,
right? Also go back one more. The way HID sells their cards is in a series in sequence numbers.
So, say you run out of cards, you're hiring more people. You call HID up or your reseller up
and they send you another 500 cards, 1,000 cards, whatever it might be. Then all of a sudden
you have budget cuts and you need to sell some cards, whatever it might be, like this
guy. And you decide to go sell a hundred of your cards. What we will show later is . . . If we
have a valid card number, we can also do brooding and we can display say, access card 6,000.
If I know 6,000 is a valid card . . . Chances are 6100 or maybe back a hundred, those are valid
cards as well. So if they are selling excess off of eBay, and they have an extra 500 cards,
chances are 500 back or 400 back, you're probably going to get a valid hit. So through
intelligence gathering, just by looking at what's available, you can probably connect the dots
and find out where those cards belong and what they might have access to. So, data's not so
private. So if you have the opportunity to actually get a picture of somebody's card, if
you can get it in your hands or you have a nice lens on your camera, you get a picture of
somebody's card, there are printed on the bottom of the card a lot of times, they
actually say some kind of an order number. Well, there are third party sites out there that
are resellers of HID products and you can give them the order number and they will look up the
number for you and say this is facility code and this is card number and they will ship you
more cards. Well now if I've used the reseller to ship me cards that have a valid facility
code just by a picture I took. So use someone else to do your identification. >> All right,
so now we're going to get into the actual hands- on stuff is, which is the cool part. So the
first thing we're going to talk about is cloning and replaying low- frequency cards. So, again,
these are unencrypted used by 70 to 80% of the facilities globally - - or in the United
States. Again, a lot of those are critical infrastructures that still use this old
technology. >> and you guys have probably heard about this in previous talks. Fox 2 has
been around for years, it's been vulnerable for years, it's all unencrypted, you can sniff the
authentication to the reader. You can do cloning, replay, so I wanted to give you a little
primer of what we are leading up to which is the encrypted stuff. Anybody ever heard of
Proxmark3? Pretty common tools to use for RFID hacking. They have the ability to do both low-
frequency and high- frequency based on the antenna you hook up to. Not too expensive, you can
buy the knockoff versions out of China. Or you can spend a little more money and get them from the
vendor. These will work really nice. So here we have a valid proxy 2 that works on the bad
system. You'll see a successful authentication, mag lock opens up. So what we are going to do,
we're going to take standard stock firmware on a prox mark 3, do an actual read on the card.
>> Possibly. >> I think it read. >> Put it in replay mode. Or not. First fail. >> Demo,
demo, demo. [Laughter.] >> Does that open the door? >> No, this card does. >> Yeah, it does.
>> Nice. >> All right. Put it in record mode. >> This is awesome. >> So what should be
happening is a Proxmark3 out of the box, no custom software or anything on it, you can put it
into record mode so it gets - - if you get within the distance of the badge you can record it
and then it turns around and replays it to the badge reader. >> [Laughter]. >> Hold on.
This bitch is working. Record. Really? >> Eric, Eric. >> We just spend two hours testing
everything in the back. >> Well that is the way it works. Every time you try to give a live
demo, it never works right. >> Oh, we got this time. Yeah, it's awesome. >> [Laughter]. >>
Next. What we were getting to was when that does work, we've been able to conceal it, right?
You can't walk up to a building with a Proxmark3 and an antenna and try to badge in, somebody
will probably question you. Put them inside of things that don't block the RFID signals, plastic
clipboards work great, we found through years of red team testing that if you have a
clipboard in your hand and a pen, put a collared shirt on and nobody is going to stop you
anyway. Put a badge inside of it with that thing in replay mode, walk up, badge in. So. That was
the point of that demo that just worked awesome. >> Anyway, the next thing you can do with that
is you can take a custom firmware and upload it to the Proxmark and have Proxbrew
works. Now, what Proxbrew does, again like Eric mentioned, so say there's 3 pieces of data we
need to have, the card type, the facility code, and the user ID. So for this attack, we
configured the card type, configured the facility code and then we brute forced the user
space. So essentially what this does, if we know that, say, I have data center access, but
Eric doesn't have data center access, so if you have his card space and know that the user ID
is 100, then you start there and what - - essentially what this does is every so many seconds it
goes through and presents a facility code and user ID just like the badge for him. And
eventually it will get hit or get caught. >> Usually you'll get a hit. >> Yeah. Hopefully.
>> And the one thing to note when you are doing Proxbrew, it is a custom version of firmware
to put on the Proxmark 3, so re-flash your custom firmware has Proxbrew built in. Once you
have it on there, you need to adjust the timing. By default, it's really noisy really fast.
The readers either can't successfully or fail on authentication. Lower your
timing a bit and you won't get as many false negatives. So. This is Josh's baby. We pulled
some influence from a lot of different places. Again, a lot of things we are showing here
today aren't necessarily OD and HID, they are things that have been out for a long time, but
they are also things that people have talked about and talked about in small aspects of
attacking some kind of company. Today we're talking about how to combine all of the things we're
going to put into a blinded attack and a full scope test. >> exactly. Our saying is from
the lab to the street, so everything we show you has been tested real world, live, for
clients, and we know it works. >> Other than that. >> Other than the proxy. >> Yes, I'll
just tell somebody to open the door and they'll open it. >> Yeah. >> So giving credit where
credit is due, Bishop Fox did a talk I believe last year at Black Hat, on a tacit reader he
put together, a simple parking garage type reader hooked up to his own version of an ardrena
with his own code, and he was doing low signal reads or low- frequency reads from about one
and a half to two feet away. Limitation over distance is obviously voltage and the type
of reader that you have. What we have here that we're going to demo, we have the encrypto
version. But credit to Bishop Fox and the research previously before him. He was able to put
together the first long-range reader for low frequency. >> Absolutely. >> So we're going
to step it up a little bit, talk about advancing these attacks beyond the unencrypted clear,
what people have been talking about for years. >> Yeah, because anybody can buy a
Proxmark and attack those 80% of companies in the US. So we want to show you how to get after the
other percentage. So this is where we started. We had a need for this. One of the first ever
the jobs we really wanted to get into a secure facility, they were not using Prox. So, we took
the Proxmark and threw it away, just like that. So they were using I- class, so we're
thinking oh, I- class, this is kinda interesting. They have encryption, the reader and the
card share this private key. >> Private key. >> So one of the attacks that we did is to take
this big reader and put it into a backpack. All this is off the shelf, nothing fancy, in this
version we're showing. It's just an Ardreno Uno, and off the shelf I- class long- range
reader that they use in parking decks. And if you get one, when it warms up, it's supposed to
make this noise. I don't know why. >> HID, they never answered us when we called them.
Go to the next slide. >>So, again, off the shelf stuff. As you can see, this is the first
layout that we made. This is kind of like the lab unit that we set up. So just an Uno, it
has a contrast switch on it and it's got some connecters so you can connect the wiring and
things in. Because what we found out is, as you can see in this demo here, the wires are
just plugged into the Uno, so if you're walking around you have that one chance, you know,
creepy smoker guy, if you have to get into somebody's bubble, get a cigarette from them, then
you don't want that read to fail. So we noticed there's so many wires, you can see here,
that we got in, used fritzy and we designed this board using this setup. >> Whatever. Good
enough. >> Yeah. And how it works is, you power it with a battery and it always, with all
these readers, there's two wires that typically go to them, the green and white wire, that's the
Wigan, data 1 and data 0. So the trailing falling edge is what we look for in the Adrena. I'm
going to attempt to demo it. >> And the thing to note when you're building this, at the end
of the talk I'll give you the URL off of GetHub to pull down the code that Josh has been
putting together so you guys can go out and buy an Ardreno, put the code on it, buy a reader.
You've got the full setup. >> Yeah, I mean $200, $300. Probably. >> Yeah, the reader
is the biggest expense. >> Yeah. And we'll put up all the fritzing stuff to so you can
make your own PCPs. That way you don't have all these wires because, again, it's really hard
to keep those wires in it. So what we want to show is with the long- range reader, before you
were within an inch, two inches rubbing somebody's ass. With the long- range reader, you can get
within someone's bubble. >> That's this close. Can I bum a light? >> Sure, you can bro.
Smoke with me, man. >> It works. >> So something Josh added, that was the demo, that
was necessary for us in the field is, you are walking through a crowd of people, will
get multiple reads and need some kind of offline storage. So LCD having access to what was read
just now, if you have it out in the open, also having the ability to hook up an SG card to
it, writes it all to a flat file. Go back to the van, pars through it, find out what card
you need, make your card with some of the stuff we're going to show you, walk back into the
building 5 minutes later. >> We heard there were new speakers here. >> Yeah. Over here. Long-
term listener, first time caller. Yay! >> [Applause]. >> This is going to piss Rob off.
Where are you at, Rob? Stand up. >> So we actually - - so we have another special edition of
shot the new because in addition to having two new speakers, we also have a new speaker, Dune
Scout. So if you could welcome Scout. We have not destroyed her yet, but there's always time.
All right. Some love for our new speakers, please. >> [Applause]. >> Just one more.
>> No, no. >> Didn't you hear, I'm giving the rest of your talk? >> Sweet! I'll drop the
mic. >> All right. >> As you were. >> Thank you, guys. Thank you. >> [Applause]. >> Do you
want to hook up and show? So all of these things we're talking about today, we get
serious now, intimate, all of the things we're talking about today around I- class it's
pretty sad, hence the slide. It came out in 2010 and this is the part where we're probably going
to piss them off, but HID has known about the vulnerability with I- class and the encryption
of I- class for four years. And the current technologies that Josh was showing in the previous
slides with the multi card formats, the higher bit links, the longer facility codes, the
longer range of user codes, all of those have been built upon the foundation that has been
flawed since 2010. In 2010, what started all this was a paper that came out called Heart
of Darkness. These guys put in heavy research on how I- class and how the protocol works. What
they found was the first revision of readers that came out had the serial interface
still enabled. By finding that, they then find out how to dump the firmware. Once they found
the firmware, then they found the encryption keys and so the encryption keys were indirectly
leaked out since 2010. The process to obtain them is nothing more than going to read
the paper, get the right hardware and cable we searched all over for. Once we had that,
we were then able to hook up to the revision a reader, dump the firmware and get an encryption
key. At that point we had the encryption key to write our own codes, so now we're HID pretty
much. >> There's a couple different ways to do this, a couple different ways you can go
about it. There are two to three papers on how to do it. Here's the thing, if you're going to do
it, you have to have a revision, a reader that you can plug into the ICSP interface with an FTDI
cable. And it uses a bit bang method, so there is copy protection on the firmware. So
the way that a couple guys got around that is they were basically taking two readers and
putting jumps and stuff in the first one and getting part of it, and then getting part of the
second one. It's going to trash both readers. We have got a stack of hardware that we burned
down, that are no good anymore. >> One was burned by accident. I got grounded to the wrong one.
>> You have to be careful planning this stuff, they have sensitive electronics. If you
are messing around and you plug into the wrong hole or the wrong wire, it's going to brick. So
what we want to show here is, so, you know, you can spend your three months like we did, you
know, in the lab, staying up all night, reversing this stuff trying to figure it out, or, you
can go online and buy one from China for 300 bucks. Already got the key in it. >> [Laughter].
>> With the China hardware that you buy, you actually buy a stock on the key 5321. Pretty
cheap. 40, 50 bucks I think. Standard reader from HID. It also has the ability to write.
But, it requires a custom driver. You are paying China for the custom driver. And you're
also paying China to use the stolen key that's been out there since 2010. >> If you wanted to
do this yourself, you could get the reader and VC contact list demo, HID has pretty much yanked
it off the Internet, so if you need a copy, just ask for it. Somebody I know. So if you
already have the key, you put it in that software and it's doing the same thing we're doing here.
>> so. Pretty straightforward interface other than it's in Chinese that I can't understand
sometimes. We have a valid badge, it's an I- class badge. It just got stolen. The badge
opens a mag lock. Good to go. So if you can acquire one of these cards through various
techniques, either steal it, read it, show up through some kind of social engineer attack
and get a visitor badge, all you need is what kind of card type they have and the facility code
and a valid access number. From then you can do whatever you want and we'll show you to
modify the characteristics of the card. We have acquired a card somehow, whatever the
particular attack vector may be. We have a card. At that point Chinese software works pretty
straightforward. We read - - I can't see the screen. Fucking demos. >> [Laughter]. >> So we
get a full read on the card. >> Yeah. >> You want to go and clone the card at that point. It
works pretty simple. Take a card that doesn't work. Doesn't work. >> Wa, wa, wa. >> Stuck it on
there. And we're essentially going to take. I need my glasses. Oh, my gosh, don't do
that. >> I like how that worked out. >> [Laughter] >> Yeah. We've got a fix for that. >>
[Laughter]. >> You know what the fix is? It's the little nipple on the damn thing. It's
that little nipple right there. >> Yeah. Any problems, you can probably e- mail them real fast.
>> Yeah. >> So get a read on the card. >> Eric, Eric. >> And all we're associated with -
- do you want to explain the blocks? 5678? >> Yeah, we're not really interested in all the
blocks on the card, we were just really interested in the blocks, like 2 through 9 that contain
the facility code, the user ID, your thumb print and the keypad number that you're putting in
there. That's the ones that we like. So we're essentially just reading and taking those and
making a pure copy of this one. Probably add another demo. >> [Laughter]. >> Wow! Awesome!
>> How are you guys doing? >> [Laughter]. >> Where did you go last night? >> How are you
doing? I like that bee thing you have going. >> The fucking mouse is going crazy. what the
fuck! This is stupid. >> [Laughter]. >> Whatever, trash it. >> Whatever. >> Whatever.
Fuck that demo. We're going to show you the one that's much better. >> [Laughter]. >>
Yeah, fuck that demo. >> So you can clone the card, which is good, right? >> That's what
they said. >> Supposedly this worked in the lab. >> Got it. >> You can take Eric's card and
clone it, but what if you need the modified card, Eric? What would you do then? >> I have
the right answer. China works great, whatever. Laptop sucks. Time for the black box. Hell
with that laptop. So what we decided to do was go one step further and we did all this
bullshit that took a lot more time. >> Yeah, you can see half that shit don't work. >> The
fact that I run that Chinese software on an XP software and it never gets connected to the
internet. That laptop is busted and as you can see the mouse is busted, too apparently. >> It's
busted now. >> Definitely busted now. >> So what we decided to do was go one step
further and we get into several situations with I-class, we can either read long- range, we can
also obtain certain pieces information from a direct attack against a badge system, we can
also take a picture, we can use the reseller to look up the information for us, whatever it
takes to get certain pieces of data that we need to make a card. >> If you happen to just
- - so corporate 1,000, let me explain one thing about that, while he's setting up, so
corporate 1,000 what that is HID's way of having the facility code be unique. It's a 35 bit
card, I- class, the facility code is unique for those 1,000 companies that sign up for this.
So their ideas was the biggest 1,000 companies will be assigned a unique facility code and we'll
track those in the database. So what happens if you get a hold of that database? >> Sell it.
>> Exactly. >> So you have all the 1,000, you know, biggest organizations, private and
Government, you would have their facility code. So out of that, you would have two out of the
three things we need, the 35 bit card type and the facility code. And then all you would need is
user ID. >> So we said the hell with the Chinese device and we put together another device that
is essentially a reader with custom software and custom driver. The honey badger. We
call it the honey badger because it takes what it wants. >> A valid card opens the door. This
bitch will work. >> This demo will work, guaranteed. >> Guaranteed. I'm putting that out
there, guaranteed. So we take the card - - >> Guarantees it works. You gotta connect to it.
Damn it. >> Bam, I've got green! >> Yeah, I should have bet on that. >> It gets a read
on the card. We now have all the properties on that card, the facility code is 898 and the
card number is 8435. We've read every memory block off that card. As Josh was saying before,
only certain blocks on that card are really important to us. Block 7 being a primary block we
really care about, and block 7 contains access card number - - or facility code and access card
number. So when we get to the next step of modifying those things, we'll see how that
works. Right now we're going to do a raw dump of the card and a raw clone. So we've already read
the card. We then take one that does not work, that was supposed to work for China. >> Does not
work, China sucks. >> Take that, stick that on there. There's the one that works
still. We get the CSM number off that card which is just a unique serial number for that
particular card. Put it in write mode and write each block which is better than copy and paste
with the China card. >> Yeah, who needs quantum physics when you can push buttons? >>
[Laughter]. >> The new card clones. >> Bam! >> [Applause]. >> Yeah, shit worked! >> So
we've essentially just done a pure clone. Well, maybe that card only gets me into the
building, doesn't give me data center access, but through other means of acquiring information
about a particular person, whether you directly attack them and do some kind of sphere phish
or you pop the badge system, or you potentially pull a badge report that had John Doe has
access to the data center or access to human resources or whatever business or facility
you are going after. Once you know your target and know that particular data, maybe you only
need to modify just the card number. So what we're going to do here is take the same
facility code but through some kind of facility code, fucking projector, but through some kind
of intelligence gathering we know the particular user also has 89835, which we just clones.
It also has one more. 8981337. So that's the one we want to modify. So we change our card
number to 1337. >> And it stays the same? >> No you can change it. Just to be a badass. >> So
898 we already acquired from the clone, a read, a picture, a look up through a reseller, whatever
it might be, with know the facility code. Now we know we need to make a badge to match a
certain number, access card number. We know 1337 is supposed to get us into the system. We
modify that particular block. Using the stolen encryption keys, we calculate Wigan, we
also update block 7 and then we take a new blank card, this fucking thing, take our new card
offline, back into the mysterious white van in the parking lot. >> Free candy. >>
[Laughter]. >> Free candy is always good. We're writing the same blocks in the previous card
we already read. And then we write block 7. We'll talk about 8 and 9 in a few minutes. So we
have written a new block 7 with a different access card number, modified that with the
calculations you can get from the Heart of Darkness paper. It talks about how Wigan works and
the encryption key works. Once we've updated block 7, which it's supposed to match what the
new card number is, now that guy gets in and has a different badge number. That worked. >>
Yeah! >> [Applause]. >> Eric, Eric, Eric! >> So privileged escalation. Various ways to get
into the facility, acquire the information, make the card offline, walk back in. You can
also use it when you are on- site, potentially you have gotten into the building but now
you can't get past bio, two- pin, 2 factor integrational pin, whatever it might be, we'll talk
about some of that too. But you have obtained enough information to make a modified card. Do that
offline and you have something that has been buffed, has additional rights, whatever that
might be. One thing we're working on right now to note is the ability to - - the problem
with I- class versus low- frequency prox 2, when McAfee or Foundstone came out with
Proxbrute, it was easy to do, because it's all unencrypted. You don't have to calculate that
block 7 each time for each authentication attempt. The problem with doing I-class
brooding, is you have to calculate that block ahead of time and then have that in some
kind of list that is going to present that card type each time you try to brute through the
reader. A lot of calculations are done offline, have that data ready to go, then present that
through a device and you can walk up to a reader and do the same thing the Proxbrute does
but now you're doing encrypted authentication. We're working on that now, it's something that
looks like it's going to happen, but we're still working out the kinks. We just did privilege
escalation, got out of order a little bit - - do you want to talk about vulnerability? >>
Yep. As we mentioned earlier from the controller to the reader, that is all unencrypted,
clear text. So all you have to do is tie into that and you are able to identify whatever comes
over the line, so the facility code and the user ID. So any way you can get into the facility
and find those lines, which typically go back to small closet somewhere that nobody
every goes into, if you can get into there and tap - - you just need two wires, yellow and green
wires, those are the two wires you need. You tap those two and you can pull back and exfiltrate
the user ID and the facility code. >> And essentially all you are doing is getting between
the reader and the controller. And typically, like Josh said, they are buried in the wall.
they're buried in a closet, wherever that controller might be. If you have the luxury of
getting access to that back end when the authentication stops, at that point it's all clear
text Wigan and you can allocate a clip into the wires, pull the data. >> If there's not a
camera, you can take the reader right off and do it right there. >> Never done that before. >>
Not happening. >> So we talked a little bit about some of these already. We have plenty of time,
so we're good. The goal here is to stress how blended attacks work and the value you get out
of those types of things showing those to your clients or the company you work for. We showed
how leakage on eBay and leakage through resellers and possible. compromise of that database can
lead to data access and data leakage. Using that data you can then modify certain aspects of
card types. Also, like Josh said before, if they are rolling from an older infrastructure to a
newer infrastructure, you can take those things, and modify certain properties of the cards
to match what they are rolling to that might be at a new facility you are trying to go
after. So using things that you may acquire through electronic access could turn into physical
access. So keep those things in mind when are you looking at badge systems, it doesn't stop
at just a clone. Clones and reads and brooding and modification and privilege
escalation has come from other aspects which may be physical or social or electronic and how
they blend together and that's how they come to materialize. >> One real quick story, one
time old bad ass here, he ended up, we were doing a red team test for a really good client.
We ended up popping them remotely, getting in, getting DA in like 7 minutes. So then Eric
gets on the bad system and we pull out their facility codes, their card types, and their user
ranges before ever going on- site. So we took that back to our lab. We wrote everybody a
card, not only wrote a card, we took their badge template picture and took our faces and
put on it so we had their real badge layout. >> We modified the picture on the badge system
you'd see, so when you are running a badge system and they have a picture that pops up, a
lot of you probably work for companies that have that picture that pops up at the front desk
whenever you are walking in, if you compromise a badge system and modify that pop up the
picture, when you walk in with a badge you made, your picture matches and no one is going to
stop you. >> So all five of us show up with pre-made badges in a really tight facility and
badged in and out all week, never got caught. >> Yeah, we were there for an internal pin
and had our own badges for the whole week. >>It makes things a lot easier to show up with your
own badge. >> So some of the things to focus on here that we want to stress here a bit is
around activity monitoring for badge systems. This is something we have seen as a big gap in
this space. Badge systems are limited in the amount of information they make readily
available by default, like anything, but there are certain things you can look for if you
are managing these types of system to identify an attack before it materializes. If you
are doing things like Proxbrute and you roll up to a reader and you present 1,000 attempts. That
should trigger something, right? There's really no IPS type of solution out for badge systems.
So the vendors leave it up to operators of the applications, to make their own signatures,
their own monitoring, their own alerting to say, why did this thing suddenly receive 500
failed attempts and then the door opened? Or why did Josh badge in the U.S. and an hour
later he badged in in China? There are certain things that should raise red flags in these
badge systems and that's one of the limitations we're seeing right now, what we're testing,
you know, all the commercial badges that we have seen that don't have that built in
natively. Big gap there. Monitoring, like anything, is always important. >> When we
showed up to that facility, all five of us used the same user. >> Yep. And the other thing
we're pretty adamant about doing when we do acquire badges. Josh decided to break into a building
one time on an engagement with me and came in the front door as the bug man. And once he
acquired a visitor badge at the front desk, he left, came back to the truck, used the visitor
badge to get a read, we knew the facility code at that point and we already knew the access card
number we wanted to try, based on a previous attack we did or we pulled it, however we got it,
and we made the card and went back in. So we had two ways to get in. We had one, we took a
visitor badge that had basic access to the facility, we cloned that and made our own
visitor badge, then we used the badge system to elevate rights for the badge. We went and added
data center access, we added other facilities because we had the badge system. So there are
things we'll talk about in a minute about protecting the badge system itself, but those
types of things should identify a red flag, too. Someone that's had basic level access for,
three months, all the sudden has data center access? Why isn't that tripping an alarm? Just
like in many of your environments, you probably have an alarm if someone gets added
to the new admin group? Or new users created and added to that group. Those things trigger,
whatever technology you are using for monitoring, that type of activity monitoring should be
included in badge systems, too. >> Yeah, so this is one thing that we're working on right now.
And, again, this talk was supposed to be, you know, just around stuff that we know that
works. Stuff that's real world, stuff that we've used, stuff that gets you into a building.
So the next area that we're working on right now is the bios stuff. So the biometric, your
finger print and the keypad. So the issue typically with this is, when you go to the set up
your finger print, you have a reader just like this, you put your finger on it and you will
enroll yourself. So that gets written to the card. >> And that block 8 and 9, that we
showed earlier, that is all F's right now, 8 and 9 that would be where bios is stored, biometric
pin, whatever the second factor is, those are stored in the blocks. >> Yeah, and we can't
say every badge system is configured that way, but the majority of systems, it's going
to authenticate - - it's going to verify your thumb print on that card, just a thumb print
tiplet, or the key code that you put in on the card. Not going back across the wire, not
looking at the database. Some of them will go look at the actual keys you put in, but the
majority that we've looked at so far just verifies that the key and the thumb print matches the
card that you just presented with. If it does, then it send Wigan back to the back unit. >>
So. Stress that again, the pin and finger print is an electronic signature that's
written to a block on the card. So if I clone Josh's badge and I then write my own pin or my own
electronic signature of my finger print to my card, when I authenticate to the badge
system, it's validating on client side. Not server side. So I'm telling the badge system who
I am, even though I am lying. So there are issues we have seen on this factor right now. >> So
this is - - we're going to wrap up here, but the other thing that we're working on is so we
go and we clone a badge or we go and read a badge in the parking lot, right? How do we get that
back to the van, back to the team? So what we are working on is taking Zigby and basically if
it's in with the incomly we will take and as soon as it gets a read it will transmit back or
transmit it to another team member and then write the card on the spot. So you know when
you get a buzz in your pocket, you have already received a code, user ID, and you pull that
out of your pocket and badge in. >> So if someone is in the field walking around with a
mysterious clipboard, or a long range reader in a satchel, they can send that back over 3G, Wi-
Fi, Zigby, whatever it might be. >> The other thing is back door reader, so if you have access to
a reader, you can get in, super easy, all you need are those two wires, red and green Wigan
wires, you can backdoor it and have it talk wirelessly, Zigby or whatever, back to the cloud.
>> Mitigation we will go through quickly because there's not a lot. Obviously the little
35 cents shield around your badge is important. Protecting physical access to the badge is
important. Protecting visible access to the badge is also important because of the
reseller issues we've seen. Being able to identify what kind of badge it is and the
information on it just from an order number on the bottom that's printed. But the big one,
we want to stress here, protect the badge system. This thing is the Holy grail of how the hell
people come in and out of your building, and if this thing is not air gapped, if it's not
two-factor authenticated, if it's not part of your domain, if too many people have access to
it, if no one is monitoring it, if it's not segmented properly with VLANS and things like that,
it's going to get attacked and if we're doing a job, we're going after the badge system.
>> And with the badge system . . . Say we're internal, or external, don't matter, you get
into the badge system, there are other things that you can do without having a card, you can
pop doors, you can clean logs, you can set up a new user and elevate your own privileges that
way. >> And the last one I wanted to stress here real quick and then we're done is the
training the staff. The big issue we always see is the isolation between who manages
the facility and who manages corporate security. Facilities are always a third party
facility company in charge of watching the front desk and the visitor log. Things like that.
They don't communicate well with who runs corporate security. And we make tend to make the joke,
that we always play therapist, but having communication between these two groups is key because
protecting this type of stuff is in their hands, not corporate security all the time, and
there's a big gap between those two clients, or two groups. And last but not least, there's a
URL on the bottom and we can pull the Adrena, for doing the long range reads. It's got our
company name at the end. so gethub.com/larsconsulting. That's it. [Applause.]