Physical access and badge checks

Physical tests answer whether someone without a badge can get inside and plug into the network. Our physical access research explains why most network plans wrongly assume they cannot; this page is our on-site checklist.

Physical testing carries legal and personal risk that network testing does not. Nothing on this page happens without a signed authorization letter that the tester carries, a client contact who answers the phone at any hour, and a check of local law.

What to check first

• The authorization letter: signed by someone with authority over the building, naming the sites, dates and testers, with a 24 hour contact.
• Who owns the building. A landlord or shared lobby may need its own permission.
• The badge technology, read from a sample badge the client provides for the test.
• Whether every reader at every entrance uses the same technology.
• Doors, gaps and sensors on the outside of each controlled entrance.
• What an intruder finds inside: live network ports, unlocked screens, unattended printers.

Badge cloning: identify the card technology

With the sample badge on the Proxmark3 antenna:

pm3 --> lf search
pm3 --> hf search

A hit on the low frequency search, most often a 125 kHz HID Prox or EM4100 card, means the card broadcasts a fixed number with no cryptography. Anyone within reading range can copy it to a blank card the reader cannot tell apart. A high frequency card with mutual authentication and diversified keys, such as MIFARE DESFire EV2 or EV3, or HID SEOS, does not have that weakness. High frequency alone is not the safe answer: MIFARE Classic and legacy iCLASS have broken cryptography, and a DESFire card that the reader checks only by its serial number (UID) is no better than a proximity card, because the UID is read without any key.

pm3 --> lf hid reader
pm3 --> lf hid clone -w <format from reader output> --fc <facility code from reader output> --cn <card number from reader output>

The clone values come only from the lf hid reader output for the sample badge, onto a blank we label and return or destroy after the test.

Fix. Move to 13.56 MHz credentials with mutual authentication and keys diversified per card, such as DESFire EV2 or EV3 or SEOS, and configure readers to authenticate the card rather than read its UID. Replace MIFARE Classic and legacy iCLASS along with the proximity cards. During migration, set a date after which readers stop accepting the old low frequency cards, and keep it.

Check the reader, not just the card

Multi-technology readers accept both the old and the new card to ease migration. If nobody switches the old technology off, the building keeps the old weakness. We test each reader with a low frequency copy of the sample badge, with the client's permission, to see which ones still open.

The cable from the reader to the door controller matters too. Many installations use Wiegand, an unencrypted, unauthenticated protocol, on wiring that runs on the outside of the door.

Fix. Disable the legacy technology in reader configuration once the cards are replaced, and confirm it per reader rather than per building. Use OSDP with Secure Channel between reader and controller, and keep reader wiring inside the secured side.

Door hardware: latches and exit sensors

We walk every controlled entrance and record what we see: gaps around the latch, request-to-exit sensors that can be reached from outside, doors that do not close fully on their own, propped fire exits, and doors held open for deliveries. We report them by location and photo, and we never damage locks or force doors.

Fix. Fit latch guards on outward opening doors, adjust request-to-exit sensors so they see only the inside, maintain door closers, and alarm any controlled door held open longer than a set time.

Tailgating and social engineering

Following an employee through a door, carrying boxes, wearing a contractor's vest or claiming a forgotten badge all test the same thing: whether anyone challenges a stranger. We count attempts and challenges and never name or photograph the employees involved; the report is about the process.

Fix. Turnstiles or a staffed lobby for the main entrance, escorts for visitors, and a culture where challenging a stranger is expected and easy, with a number on the back of every badge to call security.

Network ports once inside

sudo dhclient -v eth0
ip addr show eth0

A live network port in a meeting room that hands an unknown laptop an address on the user network turns a physical finding into a network one. From there the internal network first hour applies.

Fix. Use 802.1X on wired ports, disable ports that are not in use, and put unknown devices on an isolated network with internet access only.

Evidence

Photos are time stamped and show doors, readers and screens, never faces. Every action is logged with time and place, so the client can match it against their camera footage and access logs.

What the defender sees

A cloned badge produces an ordinary access log entry under the real cardholder's name, which is why we hand the client our log of times and doors to compare. Tailgating leaves no access entry at all, only camera footage. A propped or forced door should raise a held-open or forced-door alarm at the security desk. The report says whether those alarms fired, whether anyone watched the cameras live, and whether anyone challenged us. A test where the cameras saw us and nobody responded is a finding in its own right.