You're riding the subway to work,About or taking a smoke break outside the office, or simply strolling down the street. Someone with a backpack is standing nearby, but you think nothing of it.
Thirty seconds later that very same someone has a cloned hard copy of your work ID badge, ready to stroll right into your office.
SEE ALSO: Meet the cyborg bringing biohacking to the peopleThis is not only possible, but "very simple" according to security researcher Dennis Maldonado. Maldonado, the founder of Houston Area Hackers Anonymous and an Adversarial Engineer at pen-testing company Lares Consulting, was speaking to a packed house of hackers at the 25th annual DEF CON in Las Vegas on Thursday.
"In seconds you steal someone's badge, have a complete copy, and you walk into the building."
And they were very receptive.
"I'm going to assume everyone here is legit — is a pen tester, not a black hat," Maldonado said to laughs as he showed off a custom system he built to remotely copy and clone RFID tags.
While you may not know what an RFID tag is, chances are you've used one. You may even have one in your pocket right now. Put simply, radio-frequency identification (RFID) is a means of using electromagnetic waves to track and identify specific tags. The tags are frequently embedded in company ID cards, and employees — especially in the tech industry — have become accustomed to tapping those cards against readers to unlock office doors.
They're digital keys, albeit keys that are extremely easy to copy — even from a distance.
Original image has been replaced. Credit: Mashable Maldonado proceeded to demonstrate a rig that would allow an attacker to remotely scan a card, from a distance of approximately 2 feet, and then send that data to a cloning machine (up to 30 feet away) which would then automatically write the card.
He even made the setup user friendly, developing an Android app that syncs to a Pebble watch and notifies him via chime if his read on the target card was good. And, because standing two feet away from someone is a normal thing to do in elevators and subway cars, the victim would presumably never be the wiser.
"You don't have to go up to someone and touch their butt to get a card read," he noted — shortly before observing out loud that someone was trying to break into his network mid-talk (it's that kind of conference).
This Tweet is currently unavailable. It might be loading or has been removed.
The basic technology he used is readily available for purchase on eBay, and he told the crowd that he had already posted his code to GitHub. If you don't want to throw down the cash? Well, Maldonado pointed out that the remote RFID-scanning tech is all around us, like in parking garages, but he cautioned the hackers in attendance: "Don't go stealing those."
Which, well, that may have been the only part of his talk the crowd didn't seem too interested in hearing.
"In seconds you steal someone's badge, have a complete copy, and you walk into the building," he told those gathered. For the attendees of DEF CON, Maldonado's statement may have sounded like a challenge. For anyone who uses an RFID tag to badge into their office or home? They should take it as a warning.
Topics Cybersecurity
Previous：A worthless juicer and a Gipper-branded server
Next：Time to Unite
Best robot vacuum deal: Get the Roborock Q5 Max for 53% off at Amazon
NYT's The Mini crossword answers for November 26
Best early Cyber Monday AirPods deals: AirPods Pro at record
40 early Cyber Monday deals under $50 to shop in 2023
NYT mini crossword answers for May 12, 2025
The Melancholy of the Hedgehog
40 early Cyber Monday deals under $50 to shop in 2023
How to Write a Feminist “Dead Girl” Story
'Mario Kart World' Nintendo Direct: 3 takeaways
YouTuber accuses Casetify of stealing designs
The Best Gaming Concept Art of 2016
SmileDirectClub Australia: Everything you need to know
40 early Cyber Monday deals under $50 to shop in 2023
Cyber Monday streaming deals on Hulu, Peacock, Max, and more
Contingent No More
BeReal introduces new features to draw users back to the platform
Best early Cyber Monday laptop deals 2023 from Apple, Dell, so much more
Grilling with Homer by Valerie Stivers
WhatsApp launches 'Advanced Chat Privacy' to protect sensitive conversations
How Like the Mind It Is by Ellen O’Connell Whittet
A Dandy’s Guide to Decadent SelfRedux: In This Version of Our Lives by The Paris ReviewThe Paris Review Staff’s Favorite Books of 2020 by The Paris ReviewA Little Patch of Something by Imani PerryRedux: All of This Was Out of Season by The Paris ReviewVenus and the Devata by The Paris ReviewThe Art of Distance No. 35 by The Paris ReviewPainted Ladies by Camille DungyLost Libraries by Rosa LysterLiterary Paper Dolls: Clarissa by Julia Berick and Jenny KroikRedux: In This Version of Our Lives by The Paris ReviewTokyo Reeks of Gasoline by Yi SangInside the Order Is Always Something Wild by Elizabeth AlexanderWhat We Know of Sappho by Judith SchalanskyWhy Do We Keep Reading ‘The Great Gatsby’?Charm and How to Come By It by Dubravka UgresicRedux: It’s Almost Next Year by The Paris ReviewA Dandy’s Guide to Decadent SelfInside the Order Is Always Something Wild by Elizabeth AlexanderThe Cold Blood of Iceland by Roni Horn Twitter tests a way to minimize the voices of trolls A disappearing lake in Australia draws hikers after heavy rainfall Read an exclusive excerpt of Markus Zusak's new novel 'Bridge of Clay' 'Pennyworth' prequel show will be all about Batman's butler KFC creates special Meghan and Harry themed bucket for a kinda cute reason Nickelodeon's 'Slime Zone' lets kids meet Spongebob in virtual reality New Captain America meme wants to talk to you about your questionable life decisions LaCroix bathing suits are here just in time for summer That Prince Harry and Meghan Markle Lifetime movie has landed, people FCC traces 96 million spammy robocalls to one Florida man Elaine proposes to Jerry in genuinely good 'Seinfeld' parody Thandie Newton's dress takes Star Wars fandom to the next level Political nostalgia is always a lie, and a potent weapon Ravenous black hole eats up the mass of our sun every two days Rita Ora tweets apology for song criticised by LGBTQ community This tweet about the only 3 types of British crime show is spot on Activists respond to Russia's misappropriation of their causes Researchers find evidence that Europa's ocean erupts water into space Don't let new 'Efail' vulnerability put your encrypted mail at risk 23 GIFs that look just like masturbation, if you know what you're looking for