Lab401 Workshop: Hacking and Securing BLE and RFID devices

Introduction

Over three days clients will receive theoretical and practical training on all aspects of BLE and RFID penetration testing.

Clients will learn BLE basics, sniffing, dumping, spoofing, MITM, jamming, replaying and relaying techniques, and how to apply them a variety of real-world BLE devices: smart locks, beacons, mobile Point-of-Sale devices, banking tokens and more.

RFID training comprehensively covers introductory to advanced subjects; Basic theory, hardware & tools used to detect, manipulate, sniff, crack, emulate and clone various RFID systems.

Bluetooth Low Energy is one of the most exploding IoT technologies. BLE devices surround us more and more – not only as wearables, toothbrushes and sex toys, but also smart locks, medical devices and banking tokens. Alarming vulnerabilities of these devices have been exposed multiple times recently. And yet, the knowledge on how to comprehesively assess their security seems very uncommon. This is probably the most exhaustive and up to date training regarding BLE security – for both pentesters and developers. Based on hands-on exercises with real devices (including multiple smart locks), dedicated personal device flashed to a BLE devkit, and a deliberately vulnerable, training hackmelock.

RFID/NFC, on the other hand, has been around us for quite long. However, the vulnerabilities pointed out years ago, probably won’t be resolved in a near future. It is still surprisingly easy to clone most access control cards used today. Among other practical exercises performed on real installations, the attendees will reverse-engineer an example hotel access system, and as a result will be able to open all the doors in facility. A list of several hundred affected hotels included.

With prevalence of NFC smartphones, a new implementation of this technology is recently gaining attention: mobile contactless payments/access control, on Android known as Host Card Emulation. Using combination of cloud services and mobile security, it is now possible to embed not only credit card, but also NFC key to a lock in your phone. Is the technology as robust as advertised? How to check its security, and how to implement it correctly? Find out during practical exercises!

Slawomir Jasek

RFID/BLE Security Expert

Speaker, trainer and IT security consultant with over 15 years of experience. Slawomir Jasek has participated in countless assessments of systems’ and applications’ security for leading financial companies, public institutions and cutting edge tech startups.

Currently leads research on various topics in Polish software security company SecuRing and provides trainings regarding security of contemporary locks and access control systems (www.smartlockpicking.com).

Beside research and training, he focuses on consulting and designing of secure solutions for various software and hardware projects, during all phases - starting from a scratch. Previously gave talks, workshops or trainings at HackInParis, BlackHat USA, multiple Appsec EU, HackInTheBox Amsterdam, Deepsec, BruCON, Confidence, Devoxx and many other events.