In this lesson,
we're going to cover access badge cloning.
Now in our modern electronic access control systems,
we often use radio frequency identification
or near-field communication-based access control badges
to gain access to our offices and other secure spaces.
Radio frequency identification known as RFID
and near-field communication known as NFC
are popular technologies
that are used for contactless authentication
in various applications
including access control systems, payment systems,
and identification systems.
While these systems offer convenience,
they aren't immune to attack.
One of the most prevalent vulnerabilities
you need to be aware of
in terms of RFID and NFC technologies
is the ability to easily conduct access badge cloning
to bypass your authentication systems.
So let's take a look at what access badge cloning is,
how it's conducted,
and the ways to mitigate this type of attack.
First, what is access badge cloning?
Well, access badge cloning
refers to copying the data from an RFID
or NFC card or badge onto another card or device.
The clone card or device then behaves
as if it was the original access badge
which can be used to trick the system integrating access
or completing a transaction for the attacker.
Now at its core access badge cloning
involves making an unauthorized copy
of an authorized person's access badge
so the threat actor can bypass security measures
without ever possessing the original badge.
So how does an attacker clone that access badge?
Well, there's four basic steps:
scanning, data extraction,
writing to a new card or device,
and using a cloned access badge.
The first step in access badge cloning is going to be scanning
or reading the targeted individual's access badge.
An attacker can use a handheld RFID or NFC reader
to capture the data from a victim's card
and store it for further processing.
This type of scanning can be done discreetly
and often occurs without the access badge owner's knowledge.
For example, an attacker might hide an access badge scanner
in their backpack,
and as they walk by an authorized individual
while holding this concealed reader in their bag,
they can then read the RFID or NFC data
without needing physical contact
with the authorized person's access badge.
An attacker still will need to be relatively close
to the access badge to clone it,
such as within one to two inches for an NFC access badge
and two to 10 inches for an RFID access badge.
But with a stronger antenna,
you may be able to double those ranges
but that's still going to make the attacker
have to get pretty close to their victim
in order to clone that badge.
Second, we have data extraction.
Once the data is captured, the attacker extracts
the relevant authentication credentials from the card,
such as a unique identifier or a set of encrypted data.
This process can be done at any time
after the initial scan is conducted.
Third, we have writing to a new card or device.
Using specialized writing tools,
the attacker will then transfer the extracted data
onto a blank RFID or NFC card
or other compatible device.
For example, when I conduct penetration testing,
I like to use the Flipper Zero for my RFID
and NFC cloning activities.
This type of device is really simple to use.
It's compact and it can store a lot of different codes
that you've already scanned during your penetration test
as opposed to having a physically cloned access badge
that only contains one user identity or code.
Fourth, we have using the cloned access badge.
Now that the attacker has cloned that access badge
and they have a duplicate of it
or they have a device that has copied it in their hand,
they can now gain unauthorized access to your building,
computer systems or even make payments
using a cloned NFC enabled credit card.
Now let me show you how this works in the real world.
First, let me show you how this door is designed to work.
Notice here there is a badge reader on the left
and we're using an RFID tag
which we're going to have as a small key chain attachment.
As I touch this to the door,
the door will unlock authorizing us to enter the building.
This is what it should look like for an authorized employee.
Now that we see what it's supposed to look like,
let me show you how we can clone that key tag.
Notice here I've been able to get ahold of that key tag
and I have my Flipper Zero.
So first I'm going to take my Flipper Zero.
I'm going to select that I want to use the 125 kilohertz RFID,
which is the type of tag, and I'm going to select Read.
Once I select Read, I'll then hold my Flipper Zero over it
and it will then ask and read the pre shared key from that,
and you can see it here on the screen
which I am blurring out for safety reasons.
Now that I've done that,
I can then save that to my Flipper device, give it a name.
In this case, I'll use the default
and now it's saved inside of this device.
Now if I want to open that door using my Flipper device,
I can simply use the emulate option
or I can write this code back to a blank RFID tag
and then use that to be able to access the door.
Here you can see I'm back at that door,
I'm taking my Flipper Zero,
I'm going to select the 125 Kilohertz RFID,
I'm going to then go into my saved area
which has the clone tag that we've saved before
to this device, and I'll select it.
Once I have that, I can select Emulate
and hold this up to the door, and it'll operate
just as if it was that RFID tag,
and I can enter the building
as if I was that authorized employee.
As you can probably guess,
access badge cloning is a security concern for us
because of the ease of its execution,
its ability to be stealthy when conducting the attack,
and its potential large use
inside of compromising physical security.
Now every day, the tools required for access badge cloning
become more readily available online
and continue to get less expensive over time.
This makes it easy even for unskilled attackers
to attempt access badge cloning.
Access badge cloning is also considered
to be a stealthy way to conduct a physical security attack
since you don't need to maintain possession
of the original access badge or card,
and instead you can simply copy
and reuse the data from the card without raising suspicion.
Also, it's important to think about the fact
that cloned access badges
can be used to compromise physical security
that has large widespread implications.
Using these cloned access badges,
the attacker can gain access to your building,
defeat your physical security controls
that you're trying to protect
your organization's security data,
and it can be used to conduct financial crimes
like credit card or payment fraud
when used against NFC-based payment systems.
So how can you stop access badge cloning?
Well, first, you should implement advanced encryption
in your card-based authentication systems.
Many basic RFID or NFC systems use simple identifiers
without any form of robust encryption.
By ensuring data on your organization's access badges
is encrypted using advanced algorithms,
it becomes much more difficult for an attacker
to clone your organization's access badges.
Second, you should implement multifactor authentication
known as MFA.
Instead of solely relying on an RFID
or NFC badge for access,
you should combine them with a second form of authentication
like a pin, a password, or some kind of biometric input.
This way, even if the badge is cloned,
the attacker still cannot use it
because they need that secondary form of authentication
to gain access to your secure facilities.
For example, many of the organizations
I work for over the years
have implemented RFID access badges
as the first authentication factor
and an eight-digit security pin
as the second authentication factor.
This way, even if the attacker has my access badge,
they still can't get into the building as me
because they don't know my secret eight-digit pin
and they can't enter it after scanning my access badge
or their clone version of my access badge.
Third, you should regularly update your security protocols.
By periodically updating the encryption keys
and authentication mechanisms being used,
your organization can prevent cloned access badges
from being usable for extended periods of time.
Fourth, you should educate your users.
It is important to inform your users about the risk
of badge cloning and to encourage them to be cautious
and report any suspicious activities
or unauthorized access attempts
that are being levied against their badge.
Your users should also be aware
of where they store their cards
to ensure the attacker doesn't get access to them
to be able to clone them in the first place.
Fifth, your users should implement
the use of shielded wallets or sleeves
with your RFID access badges.
RFID shielding wallets or sleeves can prevent scanners
from being able to read the card
while it's inside one of those,
and this offers us extra layers of protection.
Sixth and finally,
you should monitor and audit your access logs.
By regularly reviewing access logs,
your organization can help identify
any unauthorized or suspicious access attempts.
If a cloned access badge is going to be used,
you may be able to identify patterns or anomalies
that indicate the access badge is a cloned badge
and not actually the original.
For example, if you clone my access badge
and then try to enter our offices
while I'm supposed to be at a conference
on the other side of the country,
that should trigger an alert
because the cloned access badge
would appear to be a legitimate,
simply because I wasn't even in the same state
as the building you're trying to gain access to
using my cloned access badge.
So remember, access badge cloning
refers to the copying of data from an RFID
or NFC card or badge onto another card or device.
This is one of the biggest vulnerabilities
involved with using RFID and NFC technologies
when you're dealing with access control systems.
To prevent access badge cloning,
you really need to understand the threat
and implement the appropriate measures,
like user education and awareness training,
using shielded wallets or sleeves,
and monitoring and auditing your access logs
to detect improper or impossible access badge usage
within your organization.