This week, Zac sits down with his longtime friend Brett DeWall. Brett is a Staff Specialist at White Oak Security (CyberAdvisors). He is a pentester, red teamer, bug bounty hunter, and security researcher. Zac and Brett do a deep dive on the RFID hacking research Brett has conducted, as well as go over his RFID skimming solution (SkimJob). They also tell the story of starting their careers together as interns, and reminisce about physical security engagements together the did together.
Brett's GitHub: https://github.com/badbiddy
SkimJob on White Oak Security Github: https://github.com/WhiteOakSecurity/SkimJob
Episode Summary
In Episode 18 of War Stories, host Zac Davis sits down with longtime friend Brett DeWall, a Staff Specialist at White Oak Security (CyberAdvisors) who works as a penetration tester, red teamer, bug bounty hunter, and security researcher. They dig into Brett's RFID hacking research, the custom badge skimmer he built, and a credit union physical test the two of them ran together.
Brett grew up on a farm with dial-up internet and started out tinkering with computers and wireless networks, including attacking the WPS PIN feature on home routers with Reaver. Burp Suite is his everyday favorite, but the tool he wanted to talk about is SkimJob, a long-range RFID skimmer he built for physical penetration testing. It creates its own wireless network so a tester can sit in the car, watch badge data come in, clone a badge, and walk in. Housed in a generic black case with an RFID sticker, it has worked on every engagement where he has used it, and he solved interference with the real door reader by adding a way to cut power remotely.
His war story is a credit union physical penetration test in the Midwest. Brett piggybacked an employee inside, waited in the bathroom, and propped open a conference room door with a door stop. Later he unhooked a computer from under the audio-visual setup and walked out the back door, with an employee chasing him all the way to the parking lot.
In This Episode
- Brett DeWall's path from farm-town dial-up to penetration tester and security researcher
- WPS PIN attacks with Reaver and early wireless hacking
- RFID hacking research and building the SkimJob long-range badge skimmer
- Disguising cloning hardware and avoiding interference with real badge readers
- A credit union physical penetration test that ended in a parking lot chase
Can Someone Clone Your Badges From the Parking Lot?
Older proximity badge systems can often be cloned from a distance. SEVN-X runs physical security assessments and penetration tests for credit unions, banks, and other organizations that rely on badge access. Talk with our team about scoping a test for your organization.
