Part of being in offensive security is coming up with ways to attack a system. Always looking for vulnerabilities, loopholes, guards who are asleep, and where the cameras are pointed. Sometimes you forget to turn it off. Within 2 minutes of being given the guidelines of our new Medical Flexible Spending Account at work, I discovered I could potentially get away with $5000/year tax-free by reselling walking canes and condoms. Similarly, when I discovered these time-fade badges at a client site, I was intrigued.

The badges are pre-printed ink (usually red) that when a sticker is put on top of it, will bleed through the sticker over the course of the day, resulting in a red badge (and presumabily denied access if you try using it). Here's a vendor and here's a patent. But, the bleed through reminded me of glue, and heat and cold do interesting things to glue.

Here are my and my boss' badge after Day 1. Until about 2PM, his badge had been in his laptop bag, away from his body; and mine in my pocket. I took his badge at 2, and pressed it against an exterior window keeping it cold. I left mine in my pocket. When I got home, I took a photo, and put his badge in my freezer and left mine out.

---

Day 2, I kept my new badge against the window (far left in green). My boss' badge is near-white, and mine, the control is VOID. I put the two white badges into the freezer.

---

Day 4. The frozen badges are staying white. I am going to leave the green badge out for a day.

---

Day 5. The green badge is almost as dark as mine. I want to see if I can reverse it, so I put it back in the freezer.

---

Day 12. The photo is blurry, but the far left badge is still perfectly white, the green badge has not reversed, and the badge left outer is the same.

---

Clearly you can't only rely on the bleed-through for security, and you can see the client doesn't, having different color badges for different days. I wasn't on-site for long enough to watch for a pattern however. And while any facility's badges are likely to have the date stamped on them, it's usually easy enough to walk in without any bags and a cup of coffee at 10:30 or 2:00 and wave yourself through.

posted with permission

if 1 * 2 < 3:
    print "hello, world!"