DEF CON 22 - Deviant Ollam & Howard Payne - Elevator Hacking - From the Pit to the Penthouse
797,160
Published 2015-01-06
Deviant Ollam The CORE Group
Howard Payne The CORE Group
Throughout the history of hacker culture, elevators have played a key role. From the mystique of students at MIT taking late-night rides upon car tops (don't do that, please!) to the work of modern pen testers who use elevators to bypass building security systems (it's easier than you think!) these devices are often misunderstood and their full range of features and abilities go unexplored. This talk will be an in-depth explanation of how elevators work... allowing for greater understanding, system optimizing, and the subversion of security in many facilities. Those who attend will learn why an elevator is virtually no different than an unlocked staircase as far as building security is concerned!
While paying the bills as a security auditor and penetration testing consultant with his company, The CORE Group, Deviant Ollam is also member of the Board of Directors of the US division of TOOOL, The Open Organisation Of Lockpickers. Deviant runs the Lockpicking Village with TOOOL at HOPE, DEFCON, ShmooCon, etc, and he has conducted physical security training sessions for Black Hat, DeepSec, ToorCon, HackCon, ShakaCon, HackInTheBox, ekoparty, AusCERT, GovCERT, CONFidence, the United States Military Academy at West Point, and the United States Naval Academy at Annapolis. His favorite Amendments to the US Constitution are, in no particular order, the 1st, 2nd, 9th, & 10th.
Twitter: @deviantollam, @TCGsec
Howard Payne is an elevator consultant from New York specializing in code compliance and accident investigations. He has logged over 9,000 hours examining car-tops, motor rooms, and hoistways in cases ranging from minor injuries to highly-publicized fatalities, and has contributed to forensic investigations that have been recognized by local, State, and Federal courts. Howard has appeared on national broadcast television making elevators do things they never should. When he's not riding up and down high-rise hoistways, he moonlights as a drum and bass DJ and semi-professional gambler. His favorite direction is Up and his favorite elevator feature is riot mode.
Twitter: @SgtHowardPayne
All Comments (21)
-
This is the only tech talk I've ever seen where multiple presenters shared the floor and it wasnt an awkward, hokey, stilted mess. Well done to these guys, and for the excellent content
-
"we have seven minutes, and we're going to use all seven minutes"
-
There was a case last year in California. A murderer on life sentence escaped by making a copy of the wardens master key. He got a really close look because the wardens key was in a photo on a pamphlet given to prisoners on their way into lock up.
-
The big thing I learned from this talk is that only professionals should work the shaft.
-
The Defcon guys really need to stop interrupting talks in the middle of them. Also lmao "I hope I didn't get you off time" when they didn't care anyway and then comes 7 minutes early to get them off the stage early.
-
As an elevator mechanic: very good talk! Also: follow their advice on not entering the shaft if you don't know what you're doing, you will die.
-
this talk was fascinating. I found the interruptions to be a bit annoying though.
-
I spent an hour learning about elevators and was entertained the entire time. I think my 'tism is flaring up
-
90% of "elevator based security" relies on Joe Public looking at the keyswitches on the COP or a slightly-ajar push panel and thinking to themselves... "that looks important... better not touch it or I might get in trouble". The number of times I've opened emergency phone panels and found priority/maintenance/fire service keys just right there in the switches, waiting to be turned...
-
Back when I was in high school, any time me and my friends wanted to skip class, we would go to the elevator (it had a lock but one of us figured out that we could stick some paper in and make it open) and my buddy had some knowledge about all this, and we would get it in independent service mode and just hide in the elevator until the period ended. I've got fond memories playing smash with my friends in the elevator.
-
I work in a hospital and have been in the elevator when med flight landed and holy crap that thing moves fast when they hit the ER Call button.
-
Anti nuisance mode works a little differently in quite a few lifts in Australia. If you press all the floor buttons, they will be registered, and the lift will make two stops. If it detects that no one has entered or exited for two stops, it deletes the rest of the calls and becomes idle/ready again, because the controller can reasonably assume that there is no one in it. I thought that implementation was quite clever, because it is possible that many legitimate calls may be punched in at the same time, for example a ton of people get on at one floor, you're standing next to the panel and you're kind enough to ask, "what floor do you guys need?" 4, 6, 8, 9, 10, 14, etc etc.
-
About 13 minutes into this talk, i understood why this had to be the last talk at the last day of DEFCON. ... Rule #1: Don't trust people to know what they're doing, people are idiots. You can invent better idiot proofing for anything, but the world will just invent a better idiot.
-
Great job soldiering on through the interruptions!
-
I was working Security in a Building and whilst travelling in the elevator with the Security Manager asked how often Security Tested the Emergency Phones. His response was that that was covered by the Lift Maintenance Contract. Yes the Circuits were Tested by Lift Maintenance for Operability, but not for Destination of Call. A Week late a Man got trapped in an Elevator for 12 Hours. His Emergency Phone although working was routed to an Answering Service in an Unattended Department. Four Hours after the Man had been rescued from the Elevator, the Security Centre got a Panic Phone Call from the Head of a Department who had just listened to 6 Phone Call from a panicked individual trapped in an Elevator. Next day, Security Personnel were Instructed to Test Emergency Phones Regularly (Daily).
-
These DEFCON talks are rediculously fascinating! Stop killing my productivity!
-
A family member whom has passed away leaving me with all of their stuff was an elevator repair and installer for a very long time. This was really fascinating to see... and now I know what some of the special tools are that I have. Much appreciated! I have no idea what to do with them but for now I will keep them.
-
Pressing the buttons for all the floors in a 34 storey freight elevator will tie it up for 45 minutes. A work mate thought this would be a good idea and nearly got canned. (Said building only has one freight elevator)
-
Love the very sensible, mature & emphasised safety part at the end. Felt like I could trust these guys a lot more with how much they drilled safety into your head the whole way through.
-
I can confirm that holding the door closed button on an elevator did work on one specific location for me, for at least a year. It was at the library at the university I studied at, and I rarely abused my newfound powers...rarely...But I have never seen it work since. And I don't know how people think it works, but it was clearly a bug in the operating software, that has since been patched (I mean, I DID graduate 16 years ago). The elevator would stop as normal, which was your signal to hit the button, and you'd hear the actuators rapidly cycle to open and then closed, and the elevator would continue on its journey. I can only imagine how crazy this would drive the people on the other side, especially since I assume it would register that the call had been answered and would reset the call flag.
