Your Smartcard is Dumb A Brief History of Hacking Access Control Systems

Your Smartcard is Dumb A Brief History of Hacking Access Control Systems

Speakers: Chad Shortman

Conference: DEF CON 32

YouTube: https://www.youtube.com/watch?v=zBP2deuPQTg

Overview

In his DEF CON 32 talk, "Your Smartcard is Dumb: A Brief History of Hacking Access Control Systems," Chad Shortman takes the audience on a journey through decades of vulnerabilities in physical access control. Shortman, a seasoned hacker with a background in CTFs and binary exploitation, expresses a profound fascination with exploits that bridge the digital and physical worlds, stating that "seeing a pound sign pop up on your screen versus seeing a door unlock is a very different adrenaline hit." This talk aims to demystify how building access systems operate and expose their inherent weaknesses, from rudimentary mechanical bypasses to sophisticated digital cloning techniques.

The presentation provides a comprehensive look at the evolution of access control, starting with basic system architectures and progressing through various "smart card" technologies. Shortman meticulously details the vulnerabilities associated with each generation of technology, emphasizing that many widely deployed systems still rely on outdated and insecure methods. For security professionals, facility managers, and anyone responsible for physical security, this talk serves as a critical wake-up call, illustrating how easily many modern buildings can be breached using surprisingly simple, and sometimes even archaic, methods.

Background

▶ Watch: Introduction: Hacking buildings with laptops (0:00)

To understand the vulnerabilities in access control systems, it's essential to first grasp their fundamental components. Shortman describes a typical system as deceptively simple, likening it to an "Arduino project that any high school or middle school student could build." The core architecture consists of a door reader (the external device where a card is tapped), a controller board (located on the secure side, making access decisions), and an electromagnetic lock (maglock) or electric strike that physically secures the door.

Maglocks are powerful electromagnets that hold a door shut, often with forces exceeding 1,500 kg for even a cheap model. However, their design poses a significant safety risk: in a power outage or emergency, they remain locked, potentially trapping occupants. This critical flaw led to fire marshal regulations mandating egress mechanisms, such as an exit button and a motion sensor, which must unlock the door with a single action. These egress components, along with the primary lock, are typically controlled by relays – simple electronic switches. If any of these relays are tripped, the door unlocks. The communication between the door reader and the controller board often occurs over the Wiegand protocol, an unencrypted, two-wire standard that transmits a simple numerical identifier from the card to the controller.

The term "smart card" itself is often a misnomer, as Shortman explains, encompassing a wide array of technologies with vastly different security postures. Historically, these systems evolved from basic magnetic strips to more complex radio-frequency identification (RFID) solutions:

1. Magstripe Cards: The earliest form, akin to the magnetic strips on credit cards. These cards store data as plain ASCII text – essentially the same information printed on the card's face. They offer no security or encryption whatsoever and are trivial to clone using widely available tools. Shortman notes that these were "never intended as a high security thing."

1. Prox Cards (Low Frequency - LF): Operating typically at 125 kHz, these contactless cards are passively powered by the radio waves emitted by the reader. They respond by transmitting a simple numerical identifier. While more convenient than magstripes, they lack encryption and cryptographic features. The data encoding uses basic modulation techniques like Amplitude Shift Keying (ASK) or Phase Shift Keying (PSK). The card number is often printed directly on the card, further undermining any pretense of security. Despite their known vulnerabilities, Shortman laments that many enterprises, including his wife's and his own company's high-rise in downtown Houston, still rely on these outdated prox cards.

1. NFC/High Frequency Cards (HF): Operating at 13.56 MHz, these cards represent a step up in security. They incorporate more sophisticated embedded systems, often featuring a microcontroller, flash memory, and EPROM. These cards do employ cryptography, typically using a symmetric key stored on the card. If an attacker possesses this key, they can read from and write to the card, effectively cloning it. Shortman contrasts this with asymmetric encryption, which offers superior scalability and security by ensuring that the compromise of one card's private key does not lead to a systemic failure. NFC cards communicate using Application Protocol Data Units (APDUs), which can include commands for querying information or even administrative functions. The speaker also highlights that modern phones utilize Secure Elements and Trust Execution Environments (TEEs) to enhance the security of mobile-based NFC access.

Key Findings

▶ Watch: Wiegand protocol and relay vulnerabilities (2:20)

Shortman's talk reveals several critical findings about the pervasive vulnerabilities in contemporary physical access control systems, challenging the perception of their robustness:

• Fundamental Simplicity and Analog Weaknesses: Many "smart" access control systems are, at their core, surprisingly simple, often relying on basic electronic relays for critical functions. This simplicity means that physical manipulation of these relays, or components connected to them, can directly bypass electronic security measures.
• Widespread Use of Insecure Legacy Technologies: Despite decades of known vulnerabilities, older card technologies like Magstripe and Prox cards are still extensively used in corporate and commercial environments. These cards offer absolutely no encryption or cryptographic protection, making them trivial to read, copy, and emulate.
• Vulnerability of Symmetric Key Cryptography: While newer NFC cards incorporate cryptography, many rely on symmetric keys. The compromise of a single symmetric key can grant an attacker the ability to clone numerous cards within an organization, leading to widespread security breaches. This highlights a critical scalability issue in their security model.
• Poor Installation Practices Exacerbate Vulnerabilities: The physical placement of critical components, such as exit button relays or keypad mechanisms, often exposes them to direct manipulation from the outside. This oversight transforms easily preventable physical security flaws into significant attack vectors.
• Unencrypted Communication Protocols: The Wiegand protocol, a foundational communication standard between readers and controllers, transmits card identifiers in plain text. This lack of encryption means that any attacker capable of tapping into these wires can intercept and replay valid access credentials.
• Misconceptions of "Smart" Security: The talk underscores a dangerous misconception that simply having a card-based access system equates to robust security. Shortman forcefully demonstrates that without proper cryptographic implementation, secure protocols, and mindful physical installation, these systems are anything but "smart."

Technical Deep Dive

▶ Watch: Hook key: bypassing the exit button relay (3:15)

The technical core of access control hacking, as detailed by Shortman, begins with understanding the system's fundamental building blocks and their inherent design flaws. The most basic and pervasive vulnerability lies in the use of relays. These electromechanical switches are the ultimate decision-makers in many systems: if a relay is tripped (i.e., its contacts are connected), a circuit is completed, and the door unlocks. The speaker emphasizes that the entire system, from the reader to the lock, can often be conceptualized as an "Arduino project" with three main relays: one for the primary lock, one for the exit button, and one for the motion sensor. Any successful bypass aims to trip one of these relays.

Communication between the door reader and the controller is frequently handled by the Wiegand protocol. This is a rudimentary, unencrypted two-wire protocol where one wire transmits a 'data zero' signal and the other a 'data one' signal. When a card is presented, the reader decodes its identifier and sends this raw number in binary form over the Wiegand lines to the controller. Because this data is transmitted in plain text, it is highly susceptible to interception and replay attacks; an attacker can easily tap into these wires, capture a valid card number, and then replay it to gain access.

Looking at the evolution of card technologies, the technical deficiencies become more apparent:

• Magstripe Cards: These cards are the antithesis of "smart." They store data magnetically, encoding simple ASCII text – often just the cardholder's ID number, identical to what's printed on the card. There is no encryption, no challenge-response mechanism, and no cryptographic integrity. The technology relies purely on magnetic physics, making it straightforward for an attacker to read the magnetic data and write it onto a blank magstripe card, effectively cloning it.

• Prox Cards (125 kHz): These Low Frequency (LF) RFID cards are slightly more advanced but still fundamentally insecure. They are passively powered by the electromagnetic field emitted by the reader. Once powered, they transmit their unique identifier number back to the reader. The encoding of this data can involve techniques like Amplitude Shift Keying (ASK) or Phase Shift Keying (PSK), but critically, the transmitted number is not encrypted. Shortman highlights that these cards can be "hacked... with AM radios," indicating the simplicity of intercepting and decoding their signals. Once captured, the number can be easily replayed or cloned onto another prox card. The fact that the unique identifier is often printed on the card itself further simplifies the attacker's task.

• NFC/High Frequency Cards (13.56 MHz): These cards represent a significant leap, operating at 13.56 MHz. Unlike their predecessors, NFC cards contain an actual embedded system with a microcontroller, flash memory (e.g., 1Kbit), and an EPROM (e.g., 64Kbit). They support various protocols like ISO/IEC 7816 and SPI. More importantly, they incorporate cryptography, typically using a symmetric key stored on the card. This key controls read and write access to the card's memory. If an attacker can compromise this symmetric key (e.g., through side-channel attacks, brute-force, or social engineering to obtain a master key), they gain full control over the card's data, enabling cloning and manipulation.

Shortman also touches upon the physical characteristics of contact cards, noting they have pads for power, ground, an externally driven clock, and a single I/O pin. The external clock is particularly interesting from a glitching perspective, where manipulating the clock signal or voltage can induce errors in the chip's operation, potentially bypassing security mechanisms or extracting keys. The interaction with these cards involves Application Protocol Data Units (APDUs), which are command-response pairs. These APDUs can range from simple data queries to "admin commands" that can "install Java applets and manipulate the operating system" of the card, underscoring their complexity and potential for deeper exploitation if the underlying cryptographic protections are breached.

Demo / Proof of Concept

▶ Watch: Magnet key: exploiting exposed physical relays (4:00)

Chad Shortman's talk, while not featuring live, on-stage demonstrations, effectively communicates various proof-of-concept attacks through vivid descriptions and references to video evidence. These demonstrations highlight both the unsophisticated physical bypasses and the more technically involved card cloning methods.

The speaker first illustrates several "un-sophisticated" but highly effective physical bypasses targeting the vulnerable relays of access control systems:

• The Hook Key: This technique involves using a "nice steady piece of metal" (like a coat hanger or similar tool) to physically manipulate the exit button relay through the small crack in a door. By simply pushing the button from the outside, the relay is tripped, and the door unlocks. Shortman mentions a video showing this in action, underscoring its practicality.
• The Magnet Key: For certain systems, such as the Lockheed-1000 keypad, the internal relay is sometimes positioned close enough to the outside surface to be affected by a strong magnet. An attacker can simply "take a magnet, touch it to where the relay is and it just clicks the relay," granting access. This particular vulnerability points to severe installation flaws where critical components are not adequately shielded.
• Vape/Smoke Attack: Exploiting the common motion sensor for egress, this method involves blowing dense vapor (e.g., from a vape pen) through a door crack. For "most of these motion sensors," the smoke is "thick enough that it will actually trip the motion sensor," causing the door to unlock. This demonstrates how even environmental factors can be weaponized against poorly designed or installed systems.

Beyond these physical exploits, Shortman alludes to more advanced, albeit still straightforward, card cloning techniques:

• Magstripe Card Cloning: He explicitly states that if attendees "want to clone some Magstripe cards, we have them over in the physical security village." This confirms that the tools and methods for copying the unencrypted ASCII data from these cards are readily available and simple enough for hands-on demonstration.
• Prox Card Hacking with AM Radios: Shortman recounts a personal anecdote from his childhood, where he used "a little kit" with his sister to "elicit these kind of smart cards" using AM radios. This highlights the fundamental lack of encryption in prox cards and the ease with which their radio signals, encoding a simple number, can be intercepted and replayed.
• NFC Card Cloning (Implied): While not explicitly detailed as a demo, the discussion of NFC cards relying on a symmetric key implies that if this key is compromised, cloning becomes a direct consequence. The ability to read and write to the card's memory with the correct key forms the basis of such an attack.

These examples collectively demonstrate that access control systems are vulnerable at multiple layers – from basic mechanical weaknesses to the fundamental lack of security in their digital credentials.

Defensive Implications

▶ Watch: Vape key: triggering motion sensors with smoke (4:50)

Shortman’s talk provides crucial insights for defenders aiming to secure physical access control systems, urging a shift from outdated practices to more robust security postures. The defensive implications span physical installation, technology choices, and a re-evaluation of security paradigms:

• Secure Physical Relay Placement: The most immediate and critical recommendation is to ensure that all relays controlling door locks, especially those associated with exit buttons or external keypads like the Lockheed-1000, are installed on the secure side of the building. They should never be accessible or manipulable from the exterior. This prevents simple "hook key" or "magnet key" attacks.
• Prioritize Electric Strikes Over Electromagnets: When installing or upgrading door locking mechanisms, electric strikes are significantly superior to electromagnets (maglocks). Electric strikes are inherently safer for egress, as they default to an unlocked state in a power failure (or can be easily configured to do so), preventing occupants from being trapped. They are also generally "a little harder to trip" with physical bypasses compared to the large, easily manipulated maglocks.
• Upgrade from Legacy Card Technologies: Organizations must urgently migrate away from insecure legacy technologies like Magstripe and Prox cards. These cards offer no encryption, transmit data in plain text, and are trivially cloned using inexpensive tools. Continuing to use them for sensitive access is a critical security oversight.
• Adopt Robust NFC/High-Frequency Card Solutions: When moving to modern contactless cards, prioritize NFC/HF cards that implement strong cryptography. Ideally, systems should utilize asymmetric encryption, where the compromise of a single private key only affects one card, rather than a symmetric key system where a single key compromise could grant an attacker access to clone every card in an organization. This architectural choice is vital for scalability and resilience.
• Beware of Unencrypted Protocols: While the talk doesn't offer a direct fix for the Wiegand protocol itself, the implication is that modern access control systems should move towards encrypted communication channels between readers and controllers to prevent interception and replay attacks.
• Comprehensive Physical Security Audits: Regular audits of physical access points are essential to identify and rectify poor installation practices. This includes examining door gaps, reader placement, and the accessibility of internal components. Defenders should think like an attacker, looking for any physical avenue that could lead to a bypass.
• Educate Stakeholders: Facility managers, IT security teams, and even employees need to understand that physical access control is not merely a convenience but a critical security layer. Dispelling the myth that "smart cards" inherently mean "secure cards" is a vital first step.

By addressing these points, organizations can significantly enhance the security posture of their physical perimeters, moving beyond the "Arduino project" level of protection to genuinely secure access control.

Key Takeaways

• Many widely deployed physical access control systems are remarkably simple, relying on basic electronic relays and unencrypted communication, making them highly vulnerable.
• Simple physical manipulation, such as using a "hook key" to trip an exit button relay or a magnet to activate a keypad's internal relay, can easily bypass electronic security.
• Legacy card technologies like Magstripe and Prox cards offer no encryption, transmit data in plain text, and are trivial to clone, posing significant security risks.
• Even modern NFC cards, while using cryptography, often rely on symmetric keys, meaning a single key compromise can lead to widespread card cloning across an organization.
• Defenders should prioritize electric strikes over electromagnets for door locks and ensure all critical relays are physically secured on the inside of buildings.
• Organizations must upgrade from insecure card technologies to solutions employing robust, preferably asymmetric encryption, and conduct thorough physical security audits.

About the Speaker(s)

Chad Shortman is a security researcher and hacker with a passion for exploits that bridge the gap between the digital and physical worlds. With a background in competitive Capture The Flag (CTF) events and binary exploitation, Shortman has dedicated a significant part of his career to understanding and dissecting the security of smart cards and physical access control systems. His work is driven by the unique "adrenaline hit" of seeing a computer exploit manifest in the real world, such as unlocking a physical door.