Hitchhacker's Guide to RSA clones conference badge with a towel

Flannel rag again shown to be essential kit for freeloaders

RSA 2016 Security analyst Jerry Gamblin has turned a hotel towel into a pass for RSA's San Francisco conference.

Gamblin says hotel towels often include RFID chips for inventory control and that hitchhackers can use a Proxmark to easily copy and paste the unique identification number stored in their RSA entry pass' NFC chip and embed it in another device.

It means anyone can clone a US$2000 pass to the sold-out conference to enter sessions and the exhibition floor.

"Near field communication wasn't written in general to be used in this manner - it was meant to be used in scanners in supermarkets or whatever," Gamblin (@jgamblin) told Vulture South

"I could put my RSA tag onto a blank MiFare card that I have here with me and could scan it such that I can access everywhere.

Jerry Gamblin.

"Never leave home without your towel."

Gamblin says he is not attempting to 'show up' RSA and won't be scanning in with his towel even though it is possible.

But other conference hitchhackers could easily do so.

There is no vulnerability within the MIFARE Ultralight C and Gamblin says it is the choice of technology that leaves it open to abuse.

He will update his guide to cloning cards at the conclusion of the conference.

Image: Jerry Gamblin.

®