SecTor 2025 | Behind Closed Doors - Bypassing RFID Readers & Physical Access Controls

Why It Matters

By exposing simple yet effective bypass techniques, the talk warns enterprises that weak physical controls can nullify sophisticated digital security investments, prompting a holistic reassessment of access‑control defenses.

Key Takeaways

• Under‑door tools can bypass RFID readers faster than cloning cards.
• Default PINs on RFID readers often remain unchanged, enabling easy access.
• All‑F hex ID cards may act as universal back‑doors in some locks.
• Unencrypted Wiegand communication lets attackers sniff or replay credentials.
• EMP generators can force lock resets but risk hardware destruction.

Summary

The SecTor 2025 presentation demonstrates practical methods for breaching physical access controls, emphasizing that RFID readers are only one layer of a broader security ecosystem. Julius Dunuk, a red‑team specialist, showcases low‑tech tactics—such as using an under‑door tool to catch a handle on the opposite side—alongside more technical exploits targeting RFID systems. Key insights include the prevalence of default administrative PINs on readers, the existence of universal back‑door cards (e.g., all‑FF IDs) that persist after deletion, and the vulnerability of the Wiegand protocol, which transmits card IDs in clear text between the reader and controller. The speaker also demonstrates an EMP generator that can reset or fry lock hardware, though its reliability is limited. Notable examples feature a live demo of an all‑FF card opening a lock despite deletion attempts, and a Raspberry Pi‑based controller setup where the presenter removes the reader, disarms an alarm, and intercepts Wiegand traffic using a custom ESP‑based device. These demonstrations underline how physical manipulation and protocol sniffing can bypass even encrypted card technologies. The implications are clear: organizations must treat physical access control as a multi‑layered problem, hardening not only the credential medium but also the reader firmware, default configurations, wiring, and surrounding hardware. Regular audits, PIN changes, encrypted communication, and tamper‑evident installations are essential to mitigate the highlighted attack vectors.

Original Description

Join me to watch attacks on physical access control systems, showcased during multiple live demos alongside interesting stories from real-life physical Red Team assessments.

As a Red Teamer, I did a lot of engagements requiring me to break into buildings protected by RFID-based Access Control Systems. Normally, I would start with access card cloning... but what if it's not an option? What are the other ways in which one could bypass these systems to bypass the security mechanisms of physical ACS?

We will see:

- How to intercept the communication between the reader and the controller that are using the Wiegand protocol, along with a demo of this attack;

- How the reader can be weaponized to perform a downgrade attack, allowing for making a malicious clone of a card that otherwise would be hard to forge;

- How the OSDP protocol works and what the security implications of using it are

- What are the other ways to bypass the access control security mechanisms?

I will also share some experience and stories from Red Team engagements to demonstrate how to try and use this knowledge in real life – possibly without getting caught.

By:

Julia Zduńczyk | IT Security Specialist, SecuRing

Presentation Materials Available at:

https://blackhat.com/sector/2025/briefings/schedule/index.html#behind-closed-doors---bypassing-rfid-readers--physical-access-controls-47252