PHL-T-001

Category: rfid-nfc
Severity: 7.5 / 10
Physical access: proximity
Time to execute: 5 s
Skill level: 1 / 5
Hardware: Flipper ZeroProxmark3
MITRE ATT&CK: T1556T1078
MITRE D3FEND: D3-HBPI

Observable indicators

Badge reader logs with duplicate UID within short timeframe
Failed reads on retired card numbers

HID Prox 125 kHz cloning

Legacy HID Prox 125 kHz badges transmit a static, unauthenticated ID. A Flipper Zero in LF mode reads and replays the credential in seconds.

Attack chain

Attacker approaches badge within ~10 cm (pocket-level distance with antenna boost).
Flipper Zero reads the UID and stores it.
Replay against any compatible reader grants access.

Why it matters

Still deployed widely in office buildings, gyms, parking garages. Migration to iCLASS SE / Seos or DESFire EV3 with mutual authentication is the only durable fix.

Defensive layers

See phlipped-rules/PHL-D-001 (detection) and the hardening playbook for migration guidance.