John-André Bjørkhaug
John-André Bjørkhaug is a seasoned penetration tester with over 15 years experience doing penetration testing, currently working as a Principle Penetration Tester for the Norwegian security company Netsecurity. He has a bachelor's degree in electronic engineering, but prefers to break stuff instead of building stuff. John specializes in penetration testing of internal infrastructure, physical security, Social Engineering, and full blown Red Teaming. He is also doing penetration testing of IoT, OT, and embedded systems.
John is an active participant in the Norwegian security community and has presented at conferences like HackCon and Securithon. He is also running the lockpick village at HackCon, where he is devoted to teaching others about lock picking and bypass techniques.
Session
It has been known for many years that a large number of access control systems based on RFID have vulnerabilities that make them susceptible to eavesdropping, cloning and manipulation. Even though this is considered common knowledge among most security professionals, the installation of new systems with fundamental security flaws still persists. This presentation aims to shed light on these basic vulnerabilities and to show how these vulnerabilities can be exploited by adversaries. Through warstories from real life physical penetration tests it will be demonstrated that these vulnerabilities are not theoretical concerns but present severe security risks in practice. The talk will also try to explain why outdated and insecure access control systems continue to be used, and why companies still buy it.
The audience will get an understanding of the most common vulnerabilities in RFID-based access control systems, insight into consequences of these flaws, and what to consider when purchasing a new solution.