About Physical Security Atlas
Physical Security Atlas addresses a long-standing gap in security by documenting systemic Radio Frequency Identification (RFID) weaknesses. Physical Security Atlas will provide the first-ever global RFID risk visibility platform through community participation, dark web data, and deep web data. Our public database will consolidate and catalog these vulnerabilities to promote awareness and adoption of more secure standards which will lead to a safer world and secure tomorrow.
This project was created out of a graduate school cybersecurity capstone project that sought to address a ubiquitous security problem concerning technology that many businesses and institutions rely on while not having a reasonable understanding of the security flaws that RFID credentials can introduce.
FAQ
What is Physical Security Atlas trying to do?
Insecure RFID protocols currently persist in many environments. However, many do not realize they are using outdated security standards and protocols. Therefore, critical infrastructure gets exposed in almost every industry, leaving people and assets at risk. Currently, there is no one-stop solution for identifying and visualizing these risks worldwide.
Our public database will consolidate and catalog these vulnerabilities to promote awareness and adoption of more secure standards which will lead to a safer world and secure tomorrow.
How does Physical Security Atlas get its credential data?
We rely on crowdsourced data from security researchers, ethical hackers, students, etc. using tools such as a Proxmark3 RVD4, Flipper Zero, or ESPKey. They upload the RFID data, which includes metadata, location data, and bit format length. All data submissions are subject to moderation and community validation to ensure accuracy and consistency. If an uploader’s reputation gets down-voted enough times, their upload privileges will be revoked.
How can I use Physical Security Atlas?
- Individuals: Look up buildings or businesses you have an interest in, such as places you may rent from or use services at.
- Security Professionals: Keep apprised of any compromised credentials that affect your employer or clients.
- Commercial and Government: Periodically check if a building your entity manages or leases has compromised credentials.
How trustworthy is the data hosted on Physical Security Atlas?
All credential uploads are subject to input validation to ensure accuracy and consistency. The bit format of the credentials is validated against the standard for the submitted RFID format and will not be accepted if that validation fails. Data submitted is subject to moderation and community reputation voting; users with a sufficiently low reputation will have their upload privileges revoked.
Why care about RFID?
Many companies and organizations rely on RFID credentials as part of their access-control solutions. A single physical security incident can range from a few thousand dollars to millions, depending on severity and scope — through loss of assets, property damage, legal fees, investigation costs, business interruption, reputation damage, and personnel turnover. Any organization using RFID credentials can benefit from Physical Security Atlas by using the database to promptly revoke any compromised credential identified here.