That's really neat, but on another level it's a shame that this is possible with so many keycards still.
At least for magnetic stripe keycards, you'd need actual physical access to the card for a second; with many contactless ones, a tap on somebody's wallet/pocket is enough.
Actually secure keycards only cost fractionally more; even classic Mifare (which has been thoroughly hacked) would offer better security than this.
Sounds like something based on NXP Mifare Classic. You first try a dictionary attack against the fob (most readers use whatever default keys the vendor set), if that fails, you collect nonces by touching the flipper to a reader, calculate keys in the companion app on your phone, then add keys to the flipper's dictionary. The attacks are called darkside and nested.
most keycards/fobs are pretty secure and near impossible to copy (e.g. NXP Desfire based systems), others are easy to copy but copies can be detected (e.g. NXP Mifare Classic), it's mostly legacy RFID stuff that's trivial.
I don't know what it's like globally, but around these parts it is way more common to encounter one of these "legacy" systems than any of the modern stuff. Many large campuses were early adopters of fob-based access and upgrades are prohibitively expensive.
One of my favourite attacks against the existing HID-card based systems is... once you scan a card, the 24-bit identifier is split between an 8-bit facility ID and a 16-bit card ID. If you encounter a door that won't open with the card you have, start decrementing the card ID; many of these places assigned card IDs sequentially and by trying smaller IDs you're trying cards for employees who have had longer tenure at the company.
Yeah, but so many hotels seem to use the legacy stuff.
Most keycards I've tested don't even register on my phone, meaning that they're using something pre-ISO-14443 (which very likely does not support any real cryptographic authentication).
At least for magnetic stripe keycards, you'd need actual physical access to the card for a second; with many contactless ones, a tap on somebody's wallet/pocket is enough.
Actually secure keycards only cost fractionally more; even classic Mifare (which has been thoroughly hacked) would offer better security than this.