RFID cloning attacks duplicate the data from legitimate Radio Frequency Identification cards or tags to create unauthorized copies that bypass physical access control systems. These attacks target the widespread deployment of RFID technology in building access, asset tracking, and identity verification systems.
RFID cloning varies by card technology. Low-frequency cards (125 kHz) like HID Prox and EM4100 store unencrypted card numbers that are trivially read and written to blank cards using devices like the Proxmark3 or handheld cloners. An attacker positions a reader near a target's badge (in a crowded elevator, for example) and captures the card data in seconds. High-frequency cards (13.56 MHz) like MIFARE Classic use encryption but have known vulnerabilities: the Crypto-1 cipher was broken in 2008, enabling key recovery and full card cloning. Even modern cards may be vulnerable if default encryption keys are unchanged. The cloned data is written to blank cards or emulator devices that present identical credentials to the access control system.
RFID access cards are the primary physical access control mechanism for most organizations. Many still use legacy low-frequency cards that offer no cryptographic protection. Even organizations that have upgraded to high-frequency cards may have misconfigured encryption or rely solely on card UID, which is always readable. A cloned access card provides the attacker with persistent, auditable-appearing physical access that is difficult to distinguish from legitimate use.
CDA addresses RFID cloning within the IAT and SPH domains. Theater missions include physical access assessment where operators evaluate the organization's RFID card security. Our approach emphasizes that physical access control technology must be assessed with the same rigor as digital authentication systems.