Digital Skeleton Keys - We’ve got a bone to pick with offline Access Control Systems

Presented at DEF CON 30 (2022), Aug. 13, 2022, 6:30 p.m. (20 minutes).

Offline RFID systems rely on data stored within the key to control access and configuration. But what if a key lies? What if we can make the system trust those lies? Well then we can do some real spooky things… This is the story of how a strange repeating data pattern turned into a skeleton key that can open an entire range of RFID access control products in seconds.

Presenters:

• Miana Ella Windall - Software Development Engineer   as Miana E Windall
  Miana is a lifelong tinkerer who likes breaking things almost as much as she likes building them.
• Micsen - Software developer, Installer, And much more!
  Micsen: At 5 years old Micsen began his career of dismantling things. He had just gotten his first RC car and wanted to fix it since it didn’t drive straight. Luckily the skills have evolved significantly from that time as the car never drove again! When a company is affected by ransomware he will happily use his hacking skills to trade for booze.

Links:

• https://forum.defcon.org/node/241997
• https://infocon.org/cons/DEF CON/DEF CON 30/DEF CON 30 video and slides/DEF CON 30 - Miana E Windall, Micsen - Digital Skeleton Keys.mp4
• https://infocon.org/cons/DEF CON/DEF CON 30/DEF CON 30 video and slides/DEF CON 30 - Miana E Windall, Micsen - Digital Skeleton Keys.srt (subtitles)
• https://www.youtube.com/watch?v=G2EE_yA7OyI

Similar Presentations:

• DEF CON 23 (2015) / Are We Really Safe? - Bypassing Access Control Systems
• Black Hat USA 2015 / Breaking Access Controls with BLEKey
• Black Hat Europe 2015 / Breaking Access Controls with BLEKey