CAS-003 · Question #764
A penetration tester is trying to gain access to a building after hours as part of a physical assessment of an office complex. The tester notes that each employee touches a badge near a small black…
The correct answer is A. Generate a 125kHz tone. The stated answer A is incorrect. 125kHz is the carrier frequency used by legacy passive RFID credentials such as HID Prox and EM4100 cards. Simply broadcasting a 125kHz carrier tone provides no authentication data - the reader also requires the card's encoded unique identifier…
Question
A penetration tester is trying to gain access to a building after hours as part of a physical assessment of an office complex. The tester notes that each employee touches a badge near a small black box outside the side door, and the door unlocks. The tester uses a software-defined radio tool to determine a 125kHz signal is used during this process. Which of the following technical solutions would be BEST to help the penetration tester gain access to the building?
Options
- AGenerate a 125kHz tone.
- BCompromise the ICS/SCADA system
- CUtilize an RFID duplicator.
- DObtain a lock pick
How the community answered
(24 responses)- A75% (18)
- B13% (3)
- C4% (1)
- D8% (2)
Explanation
The stated answer A is incorrect. 125kHz is the carrier frequency used by legacy passive RFID credentials such as HID Prox and EM4100 cards. Simply broadcasting a 125kHz carrier tone provides no authentication data - the reader also requires the card's encoded unique identifier (UID) in the modulated signal. An RFID duplicator (C) reads the UID from a target card at close range and writes it to a blank writable card, creating a functional clone that the access control reader accepts. This is a well-known attack against 125kHz systems, which are vulnerable precisely because they lack mutual authentication or encryption.
Topics
Community Discussion
No community discussion yet for this question.