DEF CON 32 -Your Smartcard is Dumb A Brief History of Hacking Access Control Systems - Chad Shortman

Have you ever wondered how those little boxes that you tap your card to open doors work? What are they reading on the card? How do they ultimately unlock the door? And, are they even secure? In this talk, we will answer all of those questions and more. We will walk through how access-control systems, in general, work, and dig into the details of the most popular systems. Fortunately for the entertainment value of this talk, there be dragons in our doors. We will walk through some of the most high-profile attacks in detail and then dive into some more fundamental flaws with how the systems are designed. All of these discussions will be accompanied with live demos and first hand experience. After this talk, you will look at the world, especially doors, differently -- weaknesses everywhere! My hope is that we can all learn from past mistakes and create a more secure and less frustrating tomorrow together

[FrankBarrett]

This is one of the coolest videos I've ever seen. What a teardown and that's crazy how many security systems have vulnerabilities. This is impressive.

[iwuvu]

I always love listening to defcon talks, I know nothing about computers but it’s always good to learn anything

[spambot]

oh. so, not an overview of the history of smart card hacking, actually just an ad for a startup. excellent stuff there

[pseudo_goose]

29:07 - Yubikey literally did all three of these correctly (through FIDO/U2F/passkeys).

* One physical token, many credentials, and all secure and isolated from each other because each credential is just a data slot in the same simple protocol - not separate apps.

* No extra hardware - the protocol works over USB and NFC

* User interface - Built-in PIN/passphrase (with a separate one for administration), and touch-to-confirm. Credential storage and other settings are managed through an app on your phone or PC, which is fine, I don't need a built-in interface for that.

I love my Yubikey, and I would trust it over my phone any day. (But of course, it is not my only authentication factor)

[michaelstevenson]

literally was trying to figure out smart cards today and this showed up after I did my searching

[douro]

Did they make brownout detection a mandatory function?

If I remember right with iCLASS SE and ELITE you have to buy the cards directly from HID and they are horribly expensive.

[bijavix]

Saying "Smartcards are dumb", because every card with an IC capable of doing authentication falls under the category of a Smartcard, is dumb.

[capability-snob]

Oh I love this, definitely going to check out his product.
While I generally approve of a move toward using portable computers for access control, there are a few areas where we aren't so clearly ready for the move yet. Firstly, NFC is subject to spoofing and MITM. While QR codes do have some drawbacks that require careful thought around the protocol built on them due to shoulder surfing, it's really easy to tell when someone is tampering with or intercepting your QR code. Secondly, the problem with endpoint security is serious and I don't think TEE is the full answer. ARM Morello will help us understand user intention a lot more clearly when it arrives. Finally, modern phone security UI varies wildly on how closely the designer read Ka-Ping Yee's Secure Interaction Principles. "Fingerprint to approve" is a good example that fails to appreciate a wide range of common attacks covered in the SIP. If we can address these, maybe we can finally get that utopia of the world securely in our pocket.

[randomblogger]

Weigand is a "return to zero" code, the pulses on the wire are much narrower than the bit time, not as drawn.

[dgwdgw]

The video description boasts of high-profile attack analysis and live demos that don't exist.

[timb]

HID doesn’t install/deploy the readers. Integrators aren’t savvy enough to do any of this right and flashing readers is labor intensive, and expensive for the end user who is mostly just looking for security theater to keep insurance companies and legal teams happy

[TheRealSasquatch]

When the power goes out - how do you open the doors? Having fail open is a security issue in itself, Doors closed is a health and safety issue. Keys, whilst insecure in themselves may be more secure? Lockpicking is easy when you have a lock in a vice, very different when trying a genuine lock in a door.

[Handy-Handy]

Ouww yeah! - When the door unlook, incredible! - I love my 'Flipper' :D - Awesome Talk, man Awesome Talk!

[adsan]

So it's possible in theory to run Doom on a credit card?

[ThomasBeeson]

This is certainly one of the best DEFCON talks I've seen. Very light on the jargon for once!

[sgtstens]

now I want to see if my CAC can run Doom

[mentalmadness]

If I lose my gym card, that’s fine—I report it as lost, they block it, and I get a new one, I will still have my drivers license, credit card and what else I might have. But if I lose my smartphone with this proposed "solution" I lose everything, even my ID card in the future. How will I then prove to authorities that I am who I say I am? It's like putting all your investments in the same one basket, you just don't do it. You spread the risk.

[-r-]

Top-notch systems require an Apple device with FaceID and a PIN.
Touch phone to reader, enter PIN.
App on phone notifies, you unlock your phone and unlock the zone with FaceID in an app.

This is what I‘ve seen installed in major companies in Europe.

[Spint]

So out phones have a chip like our credit card but with a memory...
Knowing nothing, I see a future where that can be used to hack phones.

[SgtStarSlayer]

My flipper zero just crapped on this video.