TODAY’S TOPIC — Red Team IDs / MIFARE Polyglot Cards !
To request: send name + image; if you sent it in time, printed IDs are ready for pickup.
Last year: printed on inkjet labels before we had a card printer.. improvements made!
Background Info…
For the RedTeam IDs → using proxmark for writing data to cards.
Two main chip vendors: HID and NXP (high-freq vs low-freq).
Our Husky cards use NFC / MIFARE Classic
Security Stuff…
MIFARE Classic is insecure. VERY Poor encryption.
Uses the proprietary Crypto1 cypher (widely analyzed/pwned since ~2008). Very bad.
Still commonly used in access control despite vulnerabilities.
Each card has a factory UID/serial number; this is readable and supposed to be changed.. but they don’t
Cards use sectors and keys (Key A / Key B) and contain access bits and manufacturer data.
Readers often convert UID to an upstream value (e.g., a Wiegand code) that the door controller uses to grant access.
IMPORTANT TO NOTE…
We disclosed findings to IT; they were not concerned, but do not hand out cards or impersonate others.
Stay within Tech/IT policy boundaries and avoid actions that would get the club in trouble. (Covering our asses.)
Polyglot / Multi-format Cards
A polyglot (2-in-1) card can present multiple formats (e.g., our Husky format + another).
Some readers (e.g., Schlage/Allegion) support multi-card types — nice for the organization - also nice for us… we can do a downgrade attack (we don’t need to, we already have the worst type).
Equipment is available to check out through RedTeam (return like library items).
Audience Time!!
Take out your husky cards and flip it! (back numbers → facility code & card number are printed/readable).
Our card numbers are straight up printed , if you read someones’ card number you could hypothetically make a copy of their card (don’t do this)
Other Topics / Events
Car Hackathon (Yu Cai): embedded car hackathon using Raspberry Pis → ~2 days, team auto-balancing, $500/$400/$300 rewards for 1st/2nd/3rd places! sign-up using the QR in presentation.