🛡️ Sherlocked Security – Badge & Access Control Assessment
Your Card May Open Doors… Even for the Wrong People
📄 1. Statement of Work (SOW)
Service Name: Badge Cloning & Electronic Access Control System (EACS) Assessment
Client Type: Corporate Offices, Secure Labs, Data Centers, Critical Infrastructure Sites
Service Model: Access Card Technology Testing + Badge Spoofing + Control Panel Security Audit
Compliance Coverage: ISO/IEC 27001 Annex A.9, PCI-DSS v4.0 (Requirement 9), NIST SP 800-116, FICAM, TIA-5017
Testing Types:
- RFID/NFC Badge Cloning & Skimming
- HID Prox/Smartcard Spoofing
- Card Reader Tamper Testing
- Door Controller Network Security Audit
- Brute-Force & Replay Attack Simulation
- Tailgating & Entry Policy Review
- Access Logging & Alerting Mechanism Testing
🧠 2. Our Approach (with Visual)
🪪 Clone. Bypass. Audit. Secure.
AI Visual Flow:
[Recon Card Types] → [Clone or Skim Badges] → [Test Reader Hardening] → [Audit Access Logs] → [Bypass Simulation] → [Fix & Harden Controls]
Color Code:
- RFID/NFC Layer: #1a237e
- Physical Access Points: #4e342e
- Controller/Log Systems: #00695c
🧪 3. Methodology (with Visual)
[Identify Access Card Tech] → [Clone & Tamper Tests] → [Reader/Controller Penetration] → [Access Logging Review] → [Simulate Entry Scenarios] → [Provide Mitigation Steps]
Visual Flow Phases:
- 🪪 Badge Layer (RFID/NFC card security)
- 🧰 Reader & Controller (Tamper, spoof, sniff)
- 📈 Logging & Alerting (Monitoring & failovers)
📦 4. Deliverables to the Client
- 🗂️ Badge Technology & Attack Surface Report
- 🪪 Cloneable Badge Evidence & Methodology
- 🛠️ Reader/Controller Tamper Test Results
- 📈 Access Control Log Audit & Alert Gaps
- 🔓 Physical Entry Bypass Simulations
- 📹 Footage/Documentation of Test Scenarios
- 🧠 Remediation Strategy & Access Policy Fixes
- 🏆 Badge & EACS Security Certificate (optional)
🤝 5. What We Need from You (Client Requirements)
- ✅ Access to badge types in use (blank/test cards)
- ✅ Building layout with access zones
- ✅ Card reader and controller model information
- ✅ Access logs from test period (if stored)
- ✅ Point of contact for facility access
- ✅ Authorization to test non-production areas
🧰 6. Tools & Technology Stack
- 🪪 Badge Cloning: Proxmark3, Flipper Zero, RFIDler
- 🔓 Reader Tampering: Logic Analyzers, Bus Pirates
- 📡 Skimming & Sniffing: ChameleonMini, BLEAH
- 🧠 Logging/Access Review: VMS log extractors, Syslog analyzers
- 📷 Visual Evidence: Bodycams, timestamped logs
- 📁 Policy Audit: ISO/NIST badge usage checklists
🚀 7. Engagement Lifecycle (Lead → Closure)
1. Scoping Badge Tech & Zones → 2. Clone & Tamper Tests → 3. Reader & Controller Evaluation → 4. Log & Alert Review → 5. Simulation & Evidence → 6. Fix Plan → 7. Report Delivery & Closure
🌟 8. Why Sherlocked Security? (Our USP)
| Feature | Sherlocked Advantage |
|---|---|
| 🪪 Badge Attack Toolkit | Tested across HID, MiFare, NFC, iCLASS |
| 📡 Skimming Expertise | Proxmark & Flipper trained red teamers |
| 🛠️ Hardware & Software Audit | From card to controller to cloud |
| 📹 Full Documentation | Photo, video, and packet captures included |
| 🔁 Post-Fix Retesting | Verify defenses after remediation deployment |
📚 9. Real-World Case Studies
🧪 HID Cloning Attack
Test: Cloned HID Prox card from receptionist
Attack: Unauthorized access to restricted lab
Impact: Bypassed mantrap via cloned badge
Fixes: Upgraded to iCLASS SE with dynamic keys
🚪 Controller Tamper Bypass
Test: Opened controller panel via exterior wall
Attack: Injected signal directly to unlock door
Impact: Full access bypassed all badge logic
Fixes: Installed tamper detection + shielded cabling
🛡️ 10. SOP – Standard Operating Procedure
- Identify badge technologies and access zones
- Clone and test badge spoofing methods
- Test reader resilience to physical tampering
- Evaluate controller network and physical access
- Review access logs, alert generation, and retention
- Simulate unauthorized entries via cloned badges
- Record visual and digital evidence
- Recommend fixes and revalidate if requested
📋 11. Sample Badge Access Security Checklist (Preview)
- Identify and document badge tech types (LF/HF/NFC)
- Attempt cloning or replay of badge signals
- Inspect reader physical hardening (tamper, shield)
- Evaluate controller access and location security
- Capture and analyze access logs for anomalies
- Test logging accuracy during spoofing attempts
- Map badge permissions and test zone boundaries
- Review guest badge issuance and return policy
- Validate emergency unlock or fail-open settings
- Ensure alerts for failed access attempts are active