CAS-003 · Question #967
A penetration tester is trying to 9am access to a bulking after hours as part of a physical assessment of an office complex. The tester notes that each employee touches a badge near a small black…
The correct answer is C. Utilize an RFlD duplicator. A 125 kHz signal identifies the access control system as a classic HID Proximity (Prox) card reader. These legacy RFID cards transmit their card number in plaintext with no encryption or challenge-response mechanism, making them trivially cloneable. An RFID duplicator can…
Question
A penetration tester is trying to 9am access to a bulking after hours as part of a physical assessment of an office complex. The tester notes that each employee touches a badge near a small black box outside the side door and the door unlocks. The tester uses a software-defined radio tool to determine a 125kHz signal is used during this process. Which of the following technical solutions would be BEST to help the penetration tester gain access to the building?
Options
- AGenerate a 125kHz tone
- BCompromise the ICS SCADA system
- CUtilize an RFlD duplicator
- DObtain a lock pick set
How the community answered
(50 responses)- A4% (2)
- B6% (3)
- C88% (44)
- D2% (1)
Explanation
A 125 kHz signal identifies the access control system as a classic HID Proximity (Prox) card reader. These legacy RFID cards transmit their card number in plaintext with no encryption or challenge-response mechanism, making them trivially cloneable. An RFID duplicator can passively read a legitimate badge (e.g., by getting close to an authorized employee) and write an exact copy to a blank card, which will then open the door. Simply generating a 125 kHz tone (A) without the encoded card data accomplishes nothing. Compromising an ICS/SCADA system (B) is unrelated to physical door access. A lock pick set (D) is a purely mechanical technique, not a technical solution to an electronic access control problem.
Topics
Community Discussion
No community discussion yet for this question.