Breaking Access Controls with Blekey
summary
Blekey is a coin‑cell powered implant (18×30 mm) built on an nRF51822 module that hides behind a reader and attaches to the Wiegand lines with a punchdown connector. It records and Bluetooth‑exfiltrates raw 26‑/44‑bit Wiegand streams, replays or clones cards, performs a skimmer from a MaxiPro backpack, and can DoS by pulling both data lines low; firmware stores lists and supports a 0xDEADBEEF control card. BOM cost ≈ $10, battery life 2–3 days unoptimized, hardware and code are open source on GitHub.
AI-written summary · about
chapters (40)
- 0:00Introduction
- 0:38Overview
- 1:05About us
- 1:41Why this talk
- 2:20Why Blekey
- 3:17How Access Control Works
- 4:05The Reader
- 4:37The whole system
- 4:49Different reader technologies
- 7:39HID Class
- 9:11HID Class SE
- 11:34ICLASS RW300
- 12:13Wiegand Cards
- 14:52Wiegand Screenshot
- 15:57Dual Technology Card
- 17:05HID Card
- 17:45Moral of the Story
- 19:38Hardware
- 23:30Assembly
- 24:39Mistake
- 25:35Optive
- 26:05procs
- 26:39speedrun
- 28:14demonstration
- 28:29recording card data
- 29:07debug output
- 31:42Bluetooth
- 32:16Wiegand
- 33:54Battery Life
- 34:39Skimmer
- 36:21People are surprised
- 36:52Enable tamper detection
- 37:33Watch the logs
- 40:00Closing
- 40:43Safety Regulations
- 41:51Other Companies
- 43:50Door Controller Power
- 45:22Passback
- 46:21Brute Force
- 49:35Soldering
related talks
40mBiohacking: The Invisible Threat
46mRFID: Flippers and Access Control
26mMerging Passwordless and Physical Access Control
36mOpen Sesame - Or How Secure Is Your Stuff In Electronic Lockers
51mBluetooth Hacking: Tools And Techniques
01h 03mHack To Discover Weaknesses In A Series Of Smartcards
44mBreaking the Security of Physical Devices
18mNo Key, No Problem: Vulnerabilities in Master Lock Smart Locks