I'm attempting to do some RFID and NFC cloning and replaying research, as I'm hoping to be able to demo physical security as an attack vector to a few of out clients and prospects.
The downside (ironically) is that from what I can tell, RFID and NFC as a means of physical security (read: office / server room door locks) is relatively secure at this point.
The most recent relevant info I could find was BishopFox's Blackhat 2014 demo.
Yet, their hardware approach seemed more "heavy-duty" than I was planning to have to set up. I was hoping for something less overt.
I was also desperately hoping that the XDA-forums would have some obscure Android NFC exploit I could use, since that seemed "new" enough to be relevant in 2016, but I was shocked to read an overwhelming number of posts saying that current iterations of NFC ID cards aren't even susceptible to cloning.
Even Adam Laurie's most recent public exploit was apparently all the way back in 2010.
So, is RFID and NFC no longer a relevant threat to companies in terms of physical security (read: door locks, ID badges, etc.)?
- If so, what current tech has mitigated that risk?
- If not, what am I missing / am I living under a rock?