Babak Javadi - Basics of Hacking Physical Access Control Systems - DEF CON 27 Wireless Village
HTML-код
- Опубликовано: 18 ноя 2019
- Do you fear the PACS-man? Do Physical Access Control Systems seem equal parts simple and confounding? Do you lie awake at night atop your nest of ethernet cables, pondering grand questions of access control? Is Wiegand a phsyical card type, a data format, or a communications protocol? What is an ""encrypted"" credential and is it actually any more secure? How does one tell good access control apart from bad access control? Fear not, fellow hacker. Come discuss your woes with a professional ghost of access control learn how to keep the PACS-man at bay. This 80 minute intensive is designed to serve as a crash course of Physical Access Control Systems. From credentials, to readers, to door controllers and beyond, Babak will share a practical and holistic understanding of what PACS looks like in the field, and intercept, clone, replay, and bypass your way through the system.
Наука
I thought this guy and his credentials sounded familiar, then I saw the slides and realized "oh, he works with Deviant Ollam!"
Super instructional, thanks for the awesome presentation
You did that demo at around 32:00 with Modern Rogue if I'm not mistaken. I remember the pretty lights.
Shame it got cut short
Awesome presentation, thanks for sharing online (as usual) :)
Super interesting talk!
So how do the motion/magnet sensors talk to the controller? That same protocol? Could you make an RFID card that sends the "motion detected" signal when read?
nope, just a logic 5V signal. Most door controllers will have an "RTE" (request to exit) input for each door, they give absolutely 0 fucks what you connect to it. A button, an actual REX sensor, a remote control for a key chain fob or nothing at all, it's just a 5V level on or off.
@Drew Sebastian we don't, maybe if you hacked something actually interesting.
One thing I'm wondering: Do you _need_ special hardware for the simple replay attacks, or could you just as well do that with any better Android phone these days?
Samsung phones that support Samsung pay should be able to produce electromagnetic pulses to simulate a credit card swipe. Chances are you could load in some custom bits to make it simulate any mag card, not just a credit card
I learned stuff
i had not planned of breaking anywhere , but i have to admit im tempted now
"Get him tf off the stage! We just finished re issuing damn HF cards!" "2 minuit warning!!!"
15:00
exit sensor work with sliding a paper under the door? on fire maybe? lil smoke should not turn on most fire systems.
There is a talk about just that from a few years ago (different conference maybe) where they just trigger the exit sensor by spraying "canned air" through the door with the can upside down which is essentially liquid gas (== cold) which will trigger the infrared sensor into believing there is a temperature-change (== person moving) and grant access
Here you go: ruclips.net/video/rnmcRTnTNC8/видео.html .... 45mins of low-tech "bypass anything"
This is about covert entry not overt entry so fire is out. Also paper isnt a differnt temp rext sesor isnt so much a motion sensor its more like a thermal sensor
@@alockworkorange7296 well i was talking about like 1 sheet of toilet paper or a lil sheet of that magicians flash paper.
unless the door is connected to a router and you can rig up a button you cant be totally covert, always a chance someones on the other side of the door quietly checking their emails before they exit to lunch er whatever.
id say best way would be too accidentally spill a cup of hot coffee while you pretend to swipe a card er whatever for the cameras.
they will know someone spilt coffee, long as no one sees you your in.
Very professional, "someone" in the audience told me I had 80 minutes, still a good talk and I learned a few things.
thiese things wee alredy saw on other decfon... the lsat part was the most interestting
4:00 this seems fail-deadly
The inside handle still works to exit.
The method of information delivery that I'm sick of is what?
Unwatchable because of the feedback. Please, Babak, point the microphone at your mouth, not the ceiling.
Sound guy gets it under control at about 25 minutes in. Worth the watch if you skipped this one due to the audio!