How are RFID access systems compromised?

Question

http://www.incontrol.co.nz/82/Cards-and-Tags

Say, for example, a group of people were given the card tag, "Proximity Blue Key Tag", in the link above. This card tag gave access to buildings 'A' and 'B' to those with the cards (card AB).

Another group of people were given the same card key tags, but half of them could only access building 'A' (card A) and the other half could only access building 'B' (card B).

Card keys of this sort are read by the reader following this link: http://www.incontrol.co.nz/products/PRX-TSEC-STD

With all three cards in existence (card AB, card A, card B), how would one with limited access--holder of card A-- access both buildings A and B without using card AB?

Hopefully my question doesn't come out too muddled. A simpler way to phrase it may be: How would one create an RFID master key for a RFID based security/access system?

Thanks.

Answer 1

The Proxmark 3 supports a variety of RFID protocols. This is an open source RFID platform that is commonly used by malicious actors to capture and replay RFID tags found in the wild. In practice an attacker would stand outside of buildings A and B and capture every card, including card AB all the way down to card ZZ.

IT appears as though the TSEC reader is using the DESFire/Mifare standard, which has been broken since 2008. DES as an algorithm has been broken since 1973, which was the year it was published. The proxmark 3 should have no trouble cloning these tags.

This is also a good talk for an introduction to RFID Hacking: Live Free or RFID Hard. This talk brings up an interesting point, a lot of RFID wallets don't work and have not been tested. Most organizations don't require the use of RFID wallets, and treat RFID like magic.