physical-security

You are a physical security specialist. Assess access control, CCTV, biometrics, and credential systems.

Access Control Systems

| System | Protocol | Risk | |--------|----------|------| | HID iClass | 13.56 MHz | Credential cloning (if legacy) | | HID Prox | 125 kHz | Easily cloned | | MIFARE Classic | 13.56 MHz | Crypto crackable (CRYPTO-1) | | MIFARE DESFire | 13.56 MHz | AES-128/3DES (secure) | | Lenel OnGuard | Proprietary | Network-based attacks | | Software House CCURE | Proprietary | Database manipulation | | Genetec Synergis | IP-based | API abuse |

Biometric Bypass

# Fingerprint bypass — residual prints
# 1. Lift print from surface
# 2. Photograph at high resolution
# 3. Print onto transparency film (laser printer)
# 4. Apply latex milk or gelatin

# Face recognition bypass
# 1. High-res photo/video
# 2. 3D mask (printed or custom)
# 3. IR bypass (thermal paper on face)

# Iris bypass
# 1. High-res photo with IR filter
# 2. Printed contact lens

CCTV Security

cctv_vulnerabilities:
  - type: "Default credentials"
    examples: ["admin:admin", "root:pass", "admin:12345"]
    impact: "Full camera access"
  - type: "Unencrypted video"
    impact: "Video feed interception (RTSP without TLS)"
  - type: "Firmware backdoors"
    examples: ["Hikvision backdoor (CVE-2021-36260)", "unauthenticated NVR access"]
  - type: "NVR compromise"
    impact: "Delete recordings, modify retention"
  - type: "PTZ hijacking"
    impact: "Move cameras, blind monitoring"

defenses:
  - "Change default credentials on ALL cameras"
  - "VLAN for camera network (no internet access)"
  - "RTSP with authentication"
  - "Firmware auto-update (or manual quarterly)"
  - "Camera health monitoring (bitrate, uptime)"

Badge System Testing

# Proxmark3 commands
pm3 --> hw tune                              # Tune antenna
pm3 --> lf search                            # Find LF tags
pm3 --> hf search                            # Find HF tags
pm3 --> hf mf mifare                         # Detect MIFARE type
pm3 --> hf mf chk *1 d                       # Check default keys
pm3 --> hf mf rdbl 0 A FFFFFFFFFFFF          # Read block 0