Red Team OTA: Physical Intrusion Systems
Three days on current attacks against the RFID, NFC, Bluetooth LE, nRF and sub-GHz systems met on pentests and red team engagements, to test access control and the radio links behind it.
- Identify and decode RFID and NFC access technologies
- Crack MIFARE Classic, Ultralight and DESFire
- Attack Bluetooth LE with MITM, injection and secured cases
- Turn nRF devices into bugs and sniff keystrokes
- Capture, replay and forge sub-GHz remotes and garage doors
- Apply Red Team tricks for stealth
- Red teamers and physical intrusion specialists
- Pentesters covering access control
- Security engineers on badge and building systems
Conferences where we have taught
Our courses have run at these conferences, and most of them can also run privately for your team.
Four parts, badge to garage door
RFID and NFC, then Bluetooth LE, then nRF, then sub-GHz remotes.
Part 1RFID/NFC
In this part, we discover the RFID/NFC systems currently in use and ways to analyze but also to attack them with the Proxmark3 device.
- Identify the technology manually & automatically
- Decoding manually and automatically
- Useful tools
- Cracking sectors with known and unknown keys
- Analysis
- Automatic attacks
- Snooping
- Cracking keys offline
- Recovering all blocks
- Hotel room cases
- Cracking pages
- The different versions
- Mitigations and bypasses
- Emulating ID
- Cracking weak keys
- Mitigations and some attacks
Part 2Bluetooth LE
During pentests or Red Team tests, we can face several physical intrusion systems using Bluetooth LE technology. In this part, we learn how to identify these systems, study the security level, and see our opportunities based on our previous analysis.
- Identifying targets
- Performing MITM on a basic device without security
- Analyzing the communication
- Manipulation of exchanged data
- Injecting traffic
- Cracking some secured communications
- Performing MITM
- Injecting data
- Rolling code hooking
- Scanning
- Challenges with BT5
Part 3nRF
Sometimes it is just overkill to enter a room, especially when you can turn a legit mouse or keyboard into a bug. Here we study the case of significant nRF devices and see how we can attack them.
- Scanning devices
- Capturing traffic
- Analyzing the traffic
- Sniffing & Injecting keystrokes
- Capturing exchanged AES keys to be reused
- Injecting traffic
- Further analysis
Part 4Garage door remotes
When doors are challenging to intrude during the day, some openings exist when attacking garage doors. Therefore, this final part shows how to deal with current systems and have permanent access to intrude on a building from the parking place or any other scenarios.
- Identifying an interesting signal
- Demodulating, decoding, and analyzing it
- Replaying unsecured commands
- Fuzzing button pushes
- Dealing with rolling code with various attacks
- Quick wins
- Intruding the garage door
- Weak implementations problems
In a private session
The content is arranged around your needs, and we can add:
- Fuzzing the RFID or Bluetooth LE protocol stacks
- In-depth hardware attacks on sub-GHz systems
- Building implants
What every attendee takes home
A complete RF kit with real targets, kept by the attendee.
- RF kit with targets
- Proxmark3 standard kit, Evil Crow RF, a garage door target with its remote, and RFID targets
- Slides and scripts
- Full deck and the tools used in class
- Captures
- Cleared for teaching
Prerequisites
A capable laptop
Linux recommended
Linux administration
Required
Programming basics
Python, C/C++ or Rust helps
Pentest or red team experience
A plus, not required
Your trainer
Wireless and hardware security specialist. Published research on 5G security, Open RAN, baseband fuzzing, interception and mapping, and power-line communication (HomePlug AV, domestic PLC, electric vehicles and charging stations). Practical work across Wi-Fi, RFID and other wireless systems.
PublicationsHow it runs and what to know
How it is taught
Hands-on from the start: you work on real radios and real hardware, with the same tools and signal captures we use on engagements. Live courses include a hardware kit you keep; on-demand courses run at your own pace, on this site.
How progress is assessed
Progress is checked through the practical exercises done during the course. A certificate of completion is issued to each participant.
How and when to enrol
Live and tailored sessions are scheduled with you after a short scoping call, usually within a few weeks. On-demand courses start as soon as your purchase is confirmed.
Accessibility
Penthertz is a registered French training organisation (no. 11788588278). If a participant has a disability or a specific need, tell us when scoping and we will adapt the setup where we can.
Run it privately for your team
Priced per group, with content adapted to your needs. Remotely, on your site or at our offices near Paris.