Tactics of Physical Pen Testers

Summary

The speaker, a physical security expert, debunks the myth that lock picking is the primary method used for covert entry. Instead, he shares practical and often overlooked techniques such as hinge pin removal, latch slipping, and exploiting poor door fitment. He also discusses electronic access control vulnerabilities, the use of common keys for access points, and the importance of being confident and appearing to belong when gaining unauthorized access. The talk is filled with real-world examples and advice on improving physical security measures.

Takeaways

• 🔓 The speaker emphasizes that lock picking is often the least common method used to gain unauthorized access to buildings, suggesting that other techniques are more frequently employed.
• 🛠️ The script highlights various physical security vulnerabilities, such as easily removable hinge pins and improperly installed latches, which can be exploited to bypass locked doors.
• 🔑 The importance of understanding the type of lock and security system in place is underscored, as knowing the common keys or methods to exploit them can be advantageous in physical penetration testing.
• 💡 The concept of 'social engineering' is implied through stories where confidence and appearing to belong can lead to successful unauthorized access, such as posing as an elevator repair technician.
• 🛡️ Simple and inexpensive solutions, like security hinges and jam pins, are suggested to improve physical security and prevent easy access through doors.
• 👮‍♂️ The role of security guards and their interaction with intruders is discussed, noting that their training and vigilance can vary significantly.
• 🚪 The script points out that electronic access control systems, such as HID proximity cards, can be vulnerable to cloning and sniffing attacks.
• 🔍 The use of everyday objects and tools, such as under-door tools and wire bridges, to gain access is demonstrated, showing that specialized lock-picking skills are not always necessary.
• 🏢 The speaker shares anecdotes from physical security testing jobs, illustrating the diverse methods used to infiltrate buildings and the human elements that can be manipulated.
• 🔗 The importance of cross-training in both physical and electronic security domains is suggested, as knowledge in both areas can enhance the effectiveness of a security professional.
• 📈 The script concludes with a call to action for security professionals to be aware of the physical side of security, implying that a comprehensive approach is necessary to ensure robust security measures.

Q & A

What is the common misconception about the job of a physical security expert as described in the script?

The common misconception is that physical security experts, often referred to as 'break-in guys', primarily use lock picking to gain access to secure spaces. However, the script clarifies that lock picking is actually a less common method and is far down on the list of techniques used.

What is the first method mentioned in the script that can be used to bypass door security without picking the lock?

The first method mentioned is knocking out hinge pins, which allows the door to be removed from its frame, bypassing any locks on it.

What is a security hinge and how does it prevent the hinge pin removal method?

A security hinge is a type of hinge that has a peg which goes into a hole when the door is closed. This prevents the door from being removed from the frame even if the hinge pins are knocked out, as the peg blocks the attack.

What is a jam pin and how does it help in making a conventional hinge more secure?

A jam pin is a security-enhancing replacement for the screws in a conventional hinge. It transforms the hinge into a security hinge by preventing the hinge pin from being knocked out without the need to rehang the door.

What is the importance of properly installed latches in door security as highlighted in the script?

Properly installed latches, specifically dead latches, are crucial for door security because they prevent the door from being opened by latch slipping tools. If the latch is not installed correctly, it can be easily manipulated, compromising the security of the door.

What is a crash bar and why is it vulnerable to certain attacks as described in the script?

A crash bar is a type of door mechanism often used for emergency exits. It is vulnerable to attacks because it can be triggered by inserting a rod or other object through a gap in the door and pressing the bar, allowing unauthorized access.

What is the purpose of the 'thumb turn flipper' tool mentioned in the script?

The 'thumb turn flipper' is a tool used to manipulate thumb turn locks or deadbolts from the outside. It is used to unlock doors that have a thumb turn on the inside, allowing access without the need for a key.

What is the significance of the 'under door tool' in the context of the script?

The 'under door tool' is significant because it demonstrates how attackers can exploit poorly secured doors with lever-style handles. By reaching under the door and manipulating the handle, an attacker can open the door without needing to pick the lock.

What is the role of the 'postal switch' in a Door King access control system as described in the script?

The 'postal switch' in a Door King system is a momentary switch that, when activated, can trigger the door's relays to fire, effectively unlocking the door. It can be used as a bypass method if an attacker can access the switch.

What is the 'CH-751' key mentioned in the script and why is it significant?

The 'CH-751' key is a very common key used for various locks, including filing cabinets. It is significant because it can often open many locks by default, making it a useful tool for physical security testers.

What is the '1284X' key and why is it noteworthy in the context of the script?

The '1284X' key is a key used by the Ford Motor Company for their fleet vehicles, such as Crown Victorias. It is noteworthy because it is not a restricted key and can open many police vehicles and even start their engines, highlighting a potential security vulnerability.

Outlines

00:00

🔓 The Misconception of Lock Picking in Physical Security

The speaker, a professional in physical security, dispels the common myth that his job primarily revolves around lock picking. Despite the excitement associated with being a 'break-in guy', he clarifies that lock manipulation is far down the list of techniques used to gain entry into secured spaces. He emphasizes that his role involves various other methods, including covert entry tactics, and that the romanticized idea of lock picking is not the central aspect of his work.

05:01

🚪 Exploiting Door Vulnerabilities in Physical Penetration Testing

This section delves into the reality of how physical penetration testers gain access to buildings, focusing on the weaknesses of doors and their components. The speaker discusses the ease of removing hinge pins as a method of entry, regardless of the number of locks on a door. He also introduces the concept of security hinges and jam pins as solutions to strengthen door security. Additionally, he touches on the ineffectiveness of certain latch installations and the importance of dead latches in preventing unauthorized access.

10:01

🛠️ Practical Solutions to Common Physical Security Flaws

The speaker provides practical and cost-effective solutions to address common physical security issues. He highlights the use of security hinges and jam pins to prevent hinge pin removal, and discusses the importance of proper door fitment to ensure dead latches function correctly. He also addresses the risks associated with electronic strike plates and the use of thumb turn flippers as potential security threats, suggesting that understanding these vulnerabilities is crucial for improving physical security measures.

15:02

🕵️‍♂️ Advanced Techniques for Bypassing Physical Security

This paragraph explores more sophisticated methods used by physical security professionals to bypass security systems. The speaker describes using tools to exploit gaps under doors, reach through to thumb turns, and even manipulate request to exit sensors using cold gas clouds. He also touches on the use of dual-technology sensors that combine passive infrared and microwave radar to prevent such bypasses, emphasizing the need for robust security measures.

20:03

🛡️ Creative and Inexpensive Security Solutions for Doors

The speaker shares unconventional yet effective methods for enhancing door security. He discusses the use of door shrouds, clips, and other simple devices to prevent unauthorized access through under-door tools. These solutions are not only cost-effective but also easy to implement, demonstrating that creativity can play a significant role in improving physical security.

25:04

🔑 The Art of Key Stealing and Its Implications for Security

In this section, the speaker humorously discusses the ease of stealing keys from lock boxes and the surprising prevalence of universal keys across security systems. He highlights the lack of security in using common keys for access control boxes and the potential risks of not securing these keys properly. The speaker encourages security professionals to be aware of these vulnerabilities and to implement more robust key management practices.

30:05

🛠️ Leveraging Common Keys and Simple Tools in Security Breaches

The speaker shares anecdotes about using common keys and simple tools to breach security systems. He demonstrates how easily accessible keys, such as those for elevators, filing cabinets, and vehicles, can be used to gain unauthorized access. He also discusses the use of jigglers and wire bridges to manipulate locks and suggests that security professionals should be aware of these simple yet effective techniques used by intruders.

35:05

💼 The Importance of Confidence and Belonging in Physical Security Breaches

This paragraph emphasizes the power of confidence and the appearance of belonging when attempting to breach security. The speaker recounts stories of individuals who successfully gained access to facilities by acting as if they were authorized personnel, such as armed guards or service technicians. He suggests that security professionals should be trained to question and verify the credentials of anyone entering a secured area, regardless of their appearance or demeanor.

40:05

👮‍♂️ The Role of Armed Guards and the Potential for Security Breaches

The speaker discusses the challenges of interacting with armed guards and the potential for security breaches due to human error or lapses in judgment. He recounts a story of attempting to clone electronic credentials while posing as a police officer to gain the trust of the guards. The anecdote highlights the importance of vigilance and the need for guards to maintain a high level of suspicion and awareness to prevent unauthorized access.

🏢 Real-World Applications of Physical Security Breaching Techniques

In the final paragraph, the speaker wraps up his presentation by summarizing the various techniques and strategies discussed for breaching physical security. He encourages the audience to consider the physical aspects of security alongside digital measures and to test their own security systems for vulnerabilities. The speaker also hints at additional stories and insights that can be shared during a Q&A session, emphasizing the importance of continuous learning and adaptation in the field of security.

Keywords

💡Lock picking

Lock picking is the art of manipulating the components of a lock to open it without using the original key. In the context of the video, it is portrayed as a common yet not the primary method used by physical security experts to gain access to secured spaces. The speaker clarifies that while lock picking is often romanticized, it is actually quite low on the list of techniques they use.

💡Covert entry team

A covert entry team is a group of specialists who infiltrate secured areas discreetly, often for testing security measures. In the video, the speaker mentions running such a team with Robert Bobbik, emphasizing the variety of skills and tactics beyond lock picking that they employ.

💡Hinge pins

Hinge pins are the metal rods that connect the door to its hinges. The script describes a technique where these pins can be knocked out, allowing the door to be removed from its frame as an alternative to picking the lock, illustrating a physical security flaw that can be easily fixed.

💡Jam pins

Jam pins are a security enhancement for door hinges that prevent the door from being removed by removing the hinge pins. The speaker recommends jam pins as an inexpensive and effective solution to improve physical security against hinge pin removal attacks.

💡Latch slipping

Latch slipping is a technique used to open doors without a key, where a tool is used to manipulate the latch into the unlocked position. The video describes how improper installation of latches can make them vulnerable to this attack, and the importance of using dead latches to prevent it.

💡Dead latch

A dead latch is a type of door latch mechanism that cannot be opened from the outside without a key. The script explains that modern doors should have dead latches to prevent latch slipping, and that proper installation is crucial for security.

💡Electronic access control

Electronic access control systems are used to manage and monitor entry to a building or room using electronic credentials like keycards or fobs. The speaker discusses various ways these systems can be compromised, such as by credential cloning or sniffing.

💡Credential cloning

Credential cloning involves copying the information from an access control card or fob to create a duplicate. In the video, the technique is shown as a method to gain unauthorized access by capturing credentials from a distance using specialized equipment.

💡Door fitment

Door fitment refers to how well a door is installed and aligned within its frame. The script points out that poor door fitment can lead to security vulnerabilities, such as the ability to bypass locks using simple tools or techniques.

💡Crash bars

Crash bars, also known as panic bars, are mechanisms used on emergency exits that allow the door to be pushed open. The video describes how weather stripping or other barriers can be bypassed to activate the crash bar from the outside, demonstrating a security oversight.

💡Under door tools

Under door tools are devices used to manipulate the locking mechanism or handle of a door from underneath, allowing it to be opened without a key. The speaker mentions these tools as part of their arsenal for gaining access to rooms, highlighting the need for proper door handle protection.

Highlights

The speaker runs a covert entry team and discusses the misconception that their job primarily involves lock picking, which is actually a less common method.

Photo shoot for an article showcasing the team's work led to a demonstration of lock picking, though it's not the main technique used.

Lock manipulation is described as the ninth method tried to gain entry, emphasizing there are more common techniques.

The importance of understanding door hardware and installation, such as hinge pins and security hinges, is highlighted as a way to improve physical security.

Jam pins are recommended as an easy and cost-effective solution to enhance door security.

The use of latch slipping tools to bypass doors without picking locks is demonstrated, showing a common vulnerability in door installations.

The concept of dead latches is introduced, explaining how they prevent latch slipping attacks.

Proper door fitment, including the correct installation of strike plates and latches, is emphasized as crucial for security.

The exploitation of gaps in door installations, such as with crash bars and weather stripping, is shown as an easy entry method.

The use of tools to flip thumb turns on the other side of the door is demonstrated, bypassing the need for a physical key.

The vulnerability of frameless glass doors and the use of simple tools to reach and operate handles or locks from the outside.

The speaker discusses the use of under-door tools to manipulate lever-style door handles from underneath, bypassing the lock entirely.

The effectiveness of simple measures like clips or shrouds on door handles to prevent under-door tool attacks is mentioned.

The potential for stealing keys or key information from lock boxes or access control panels is highlighted.

The use of common keys for certain access control systems, like the Door King and Linear keys, to gain unauthorized access is demonstrated.

The speaker shares stories of successful physical penetrations using confidence and the appearance of belonging, such as posing as service technicians.

The importance of cross-training in both physical and electronic security to better understand and exploit vulnerabilities.

The use of long-range readers and other electronic devices to capture credentials for cloning purposes.

The speaker concludes by encouraging the audience to consider physical security methods beyond lock picking and to utilize simple yet effective techniques.

Transcripts

so yeah many of us have fun gigs though

many of us have really fun jobs people

come up to me a lot

and they say oh my gosh deviant you know

physical security and break it in that's

your job is so cool i like it and yes i

get it right like

being the break-in guy is fun if you've

never met me that i run a covert entry

team

robert bobbik and our crew of hooligans

in places we shouldn't be

but the funny thing people kind of

romanticize this notion like yes

our ops division does very dynamic door

kicker stuff

but for this one scene here this was a

photo shoot when an article came out

about what we do

they were like oh yeah get some pics and

get some pics in your hands right

and so like i'm here picking a door

now everyone has said to me i'm known as

this lock picker and like maybe i've

taught some of you about lock picking if

you've ever seen like any of these

animations that tool has on all of our

slides like

if you've ever learned how a lock works

you saw the little pins and they

they bind but they push up with a key

and if i don't have a key like how do i

get in the lock like

i've taught about lock picking forever

and everyone thinks of me as this lock

picker and they say oh yes so like i'd

love to have that job man

like that's you know you at a door at

two in the morning with those picks out

i wish i could do that and get paid

which again like sure that's fun and i

have

picked locks to get into secured spaces

but this [ __ ] here manipulating the pins

with like pick tools

it's something like the ninth thing on

the list of stuff we try

to get into buildings and this whole

talk is not this is like the last

lock-picking slide in the talk

because this is not a lock-picking talk

i am i know hooray is what i say because

i'm so

tired hey you made it i'm so tired of

talking about lock picking

i love like i love when someone new is

learning it right and if someone's never

done this and they get it

and it's this whoa moment that's fun but

i gotta

stop this illusion that we are picking

lock like how many times do you pick a

door

you don't johnny like [ __ ] yeah vince

and you like you don't really pick

doors this this [ __ ] is great that's not

what we do

so let's talk about how physical pen

testers actually get into buildings

how real covert entry tends to work and

how you fix almost all of it

dumb [ __ ] right like right off the bat i

have not i've legit

knocked hinge pins out of doors you just

bang a hinge pin out walk the door i

don't care how many locks are on the

door

if you can walk that door away from the

frame walk in

this is a thing that you can do with

like a nail or a nice little orange tool

so you don't bust up your fingers

but again like all these locks in the

door what you don't see are hinges

hinges are on the outside of this door

this is an absolute method that gets you

into places

and stupid easy to fix i'm giving you

like easy ones off the bat here

this is a security hinge the door swings

shut

little peg goes in a little hole doesn't

matter if you bang the hinge pins out

you can't wrench that away from the door

frame

because the peg is in the hole like

literally it puts it it puts a block

from that attack

if you don't want to buy new hinges and

re-hang all your doors i'm huge into

recommending what are called jam pins

i don't sell any of this stuff like i

know some of the firms that make it but

like

brilliant idea what are jam pins you

have a conventional hinge

take out these two screws replace them

with jam pins

take out these two screws replace them

with [ __ ] all

you just made a security hinge and you

didn't rehang your door

like two dollars i think brilliant kind

of solutions

easy easy stuff slipping latches and

such

like people see me like oh he's taking a

tool out of his pocket he's going to

open that door what's he doing

i'm not taking pics out of my pocket

most of the time

i am doing sound by the way oh no sound

we're gonna need sound

who's my sound guy back there let's see

anybody you hear it all right oh well

well i don't know why we're not getting

sound but yell the guy in the back he's

not doing anything

so yeah like this is a completely locked

door this is a water treatment facility

this is like the room where they

chlorinate and prep the water for the

supply and i'm not picking the lock i'm

just attacking it with a little

latch slipping tool you should not be

able to do this

on most systems right

here's a door

there we go is there some sound can

anyone in the back turn the sound the

[ __ ] up please

there's a remote oh wow this is like

dad's living room

way too many buttons is that a thing

is that happening i don't know whatever

all right i don't care i'm gonna keep

going

but yeah like this little tool this

little stupid hook that we've been

selling in our student kits we give them

to you you give them to students

it's like a five dollar part and it gets

through so many doors what we're doing

here

it's not that you can like reach the

latch here's a latch you can't reach

with a hook because it's got that big

plate over it right

get yourself a big piece of wire

oops the problem is not that you can

touch or can't touch the latch the

problem in all these bits of footage

here

is that the latch is not installed

properly latches

in a modern environment should be what

are called dead latches

in fact this is a picture of a dead

latch well let's talk about

what is a dead latch what is not well

this is the latch

right this is what goes into the strike

plate holds the door shut

if you lean on the door the door does

not pop open

you might remember doors that only ever

had this this is what a door used to

look like

long time ago and then all of a sudden

you started getting this extra little

button

sometimes called a guard bolt sometimes

called the dead latch

plunger has a lot of names but that

extra button that i will highlight in

red here

that indicates that you have a dead

latch mechanism

the dead latch plunger or the guard bolt

many people only see it when the door is

open

and you know it's not always in this

configuration sometimes it's next to the

latch it's

there's a lot of styles no matter what

style you have

you might not know when the door shuts

that's supposed to be held back

it's supposed to be pressed back into

the door by the strike plate

it's not supposed to pop out into the

hole if that is pressed back

that latch is now dead you can't hook it

slip it shim it anything like that

that's how this is supposed to work but

the problem is door fitment

if you don't have the right hardware

mounting and you don't have the door

hung

properly we see this all the time on

doors man

this we've got a nice door properly

locked okay this is a piece of trash

literally a piece of plastic garbage

shoved in

boom server room look at the size of

that strike plate hole

you could drive a truck into that why is

it so huge is this the strike plate that

came with this

handle set what do you think this is

yes i heard it say it louder electronic

strike plate this is a card reader

access door

so they retrofit the additional like the

original plate of strike plate they put

like a

separate unit a solenoid powered strike

and there's all different configurations

of this kind of hardware

we literally know integrators and

installers who are like oh make sure you

always get like the jp 41 that's the one

with the big hole

it always works no matter what door the

client has it's no problem

no that is not how this is supposed to

work you are

really undermining your security another

door

another water facility right nice lock i

mean

i'm i'm a decent enough picker i'm not

going to try to pick this

why not because boom bad door fitment

over and over and over

and like you know you don't want me in

there i don't belong in this room

five dollar hook gets me in when a nice

lock could have prevented me

if they had properly set the door up

let's talk about this kind of door

fitment problem you got crash bars let's

just reach through

you've told stories like this forever

what

happened there i was like talking to

point of johnny right let's watch that

again crash bar

let's get a bent rod and just slip it

through and bam

hit the door right absolutely works

why because weather stripping is not a

security device

weather stripping is not the same thing

as a plate or even a movable astragal of

metal

if that is just rubber or that little

brush material

if i can slip something through and

smack on that crash bar they make

specially designed tools

just for this here's robert one our guys

on our team reaching through with a

reinforced tool

hitting the crash bar bam

exit paddles smaller target how many

times do you see glass doors glass doors

are wonderful because you can see

exactly what you're hitting or not

hitting

but going back you can barely see it's a

really dark photo you can't see it here

easily you can see it in the video

though sometimes

is this daytime or night time

this what is it it's not it's like three

in the morning i know it's a little bit

white out here but it's it's very dark

out this is a low occupancy structure at

night what could they have done and not

violated code

they could have set the deadbolt it's

right [ __ ] there right

well this tool is there's a tool that

exists for this the idea of a deadbolt

again for code many of these attacks as

you all know like

fire code and actually egress like

restrictions and allowances

you have to set up doors certain ways if

you have a deadbolt it probably has a

thumb turn on the inside

this tool exists i have it in my room

this is a thumb turn flipper

you stick it through the door and you go

boop

absolutely that like these tools are out

there man they are not expensive

and again like here we have a nice

this is a classic california office

building why because it has

frameless glass doors oh my god

california where the weather is so nice

you don't care about insulation

frameless glass doors everywhere

so yes reach through with the tool the

hardest part was just getting it to stop

slipping off the knob was so tiny but

eventually

sure enough you get it on there you twit

it's just like a braided cable

attached to a it's not a sophisticated

tool right

but eventually bam well that's open

post office near where i live you can

see like right on the other side of the

door i'm not gonna go steal a bunch of

mail or anything but the gap is huge you

could get through there

tesla dealership of course it's

california why because frameless glass

doors that's why

middle of the night no one around i'm

not saying i wanted to uh duplicate

tiger team

like steal a car but absolutely like

frameless glass doors boom

thumb turns that's the only thing

preventing anyone from getting in here

and the gap is like a half inch wide

talk about another gap problem here's a

locked door

there's some noise and then dr tran

comes through like ninja in a cloud of

smoke

what happened there many of you know

this one already i hope

this is a lab where we do a lot of

prototyping and we just show like bobbik

in the hat just showed ross

and ross is like hey building owner evan

come here i want to show you this thing

i just learned so you'll see he's trying

to do something with a tool up in the

time

bobbit says no reposition it a little

bit out here and look through the glass

you'll see the same thing you'll see

this sort of

cloud of vapor and all of a sudden this

locked door

is no longer locked yay

well who knows what government there's a

very restricted government tool that

they're using

i don't know if you can get it like talk

to someone you know who's kind of spooky

you can find out how to order this it

comes with a one-page

idiot proof government instruction

manual that says hold tool like this

so all you're doing if you invert one of

these spray dusters

you're boiling off that r134a

essentially is what's in there

and you're creating this cold gas cloud

what's actually tripping

many doors have sensors on the inside

especially electronic lock doors

they are called request to exit sensor

if you have a system where you badge in

but you don't have to badge out you just

walk to the door and just open it

you might not realize you have a request

to exit sensor you have

most of the time a simple passive

thermal sensor

it's not the only technology out there

it's far and away the most common one

and if you can get that sensor to trip

in this case just by blowing a cloud of

gas through the door

the door unlocks these are old tricks

you should know them

dave if you saw his keynote this morning

dave did he's a big

you know vape guy he's a big ecig guy oh

yes so he and ben 10 recorded this is

one of the best videos ever of it

so like i don't know if you sub ohm your

coils or something because he makes this

amazing cloud through there

but he's just listening to hear that

solenoid he's listening to hear it

trigger

and when he knows that electromagnet is

done bam

door's unlocked boom

now unlocked yeah chris up here i think

is the he was like hey dave you should

try this on that door this is totally at

we don't [ __ ] where we eat right yeah

this was this this was the dirty derby

class yeah

yeah and like i think eventually people

other people kept trying it until the

point where there was staff

in that because it's like a staff area

and staff was like what's the smoke

coming through the door are they like

freaking out

i don't smoke uh i do drink too much my

wife caught this video once

we're walking home from like a bar this

was late at night this is a bank the

bank is closed

but i'm like well there is a wreck

sensor up there and i had just kind of

walked out of a bar with a drink

so i just spit that through the door and

like that works

so yeah man passive infrared doesn't

understand hot cold it just says

different oh different must be a human

this one up top here the honeywell

passive infrared sensor

i guarantee you've seen it or you've

seen it rebranded and re-badged as

somebody else's

almost always white sometimes you see

them in black or beige you will see that

everywhere all over the place and why

are they calibrated this way well you

don't want someone with a bunch of boxes

to like bang into the door and fall over

these are tuned

and the installers mount them in a way

to get the most wide spectrum hit

because they don't want to be called out

repeatedly hey the rec sensor's not

working it's not picking us up it's

causing you know mary just fell down

with her cane and her walker

the installer doesn't want that

installers and integrators want to

always have these things trip so you're

going to see that on a lot of doors

because it's got really good coverage

and you're going to always see it open

the door what is this on the bottom

though

that's your solution ge is the only one

i've ever seen that

reasonably brings to market a dual

technology rec sensor

yes it does passive infrared it also

does microwave radar

so it has to see some temperature change

and it also has to see something

vaguely human-sized coming vaguely

toward the door

we knew like um tr a hacktrust hector

zo9val

val actually she'll put balloons through

doors and blow them up

and let them go because the old trick

with the pirs you usually just put them

further away from the door you just put

them down the hall

and you know if i'm trying to gas the

dog i'm not hitting it so her solution

for that was like

like send balloons like blowing down the

hall to try to trip them

ge's product will stop that i don't work

for ge i'm not here shilling for like

mubics and his buddies moving still with

ge i don't know

no all right but yeah it's the only

dual technology sensor that i've ever

seen that's good for this

also code let's talk about door handles

when's the last time you've seen a door

knob like in an office

you don't because if someone like has

reduced grip and tactile function or

what if someone doesn't have a hand

they need to be able to get in and out

of the building especially in

emergencies

lever style door handles are are the

norm now

well inside i mean you see the front one

facing me that's locked and has a

you know shitty little hid prox reader

on the inside there's also

a lever handle which many times that's

going to be the case

there are tools like this that exist

this is an under door tool

i'm doing a little show with a guy named

tyler gray he's like well show me this

tool and his cameraman is like how would

you get in here

and they expected me to do something at

the door they didn't realize i just

knelt down

and kind of banged the door open and

actually it's one of the cameraman was

like

can you do that like again like slower

that was way too fast i didn't

understand what was happening

well these are actual tools that we use

on jobs

what we're doing with this tool it's

called an under door tool

we're reaching a rod under the door and

because

modern doors have those lever style

handles

they're really really trivial to grab

that handle

and hit it on the inside i'll show you a

picture from flipped around in a second

this is robert

middle of the night getting into a

server room you know people see this

video and they thought they see him

crouched down like oh he's going to

unscrew like with a multi-tool to get

through that crawl through the grate no

he's not

he's going to lean his head into the

door and just push it open because on

the inside

we're just swinging a rod pulling down

on a line

and yanking this handle absolutely works

because when's the last time you've been

in the server room and had to badge out

some some real secure facilities maybe

most of the time you hit the handle and

you leave

there are solutions for this there are

what are called dynamic

door bottoms this little animation

shows you a black plunger if this black

plunger gets pushed in

what happens you'll see this bottom bar

drops down

so when the door shuts that bar drops

down now this is not a security product

this is like a heating and cooling

insulation product but the same

principle applies

to much more robust models so a company

called pemco p-e-m-k-o pemco makes the

door bottom now they're sold by assa

abloy big contoured floor plate

interlocks in this metal bar and unless

that plunger is

relieved of its pressure that door

bottom is dropped down you're not

getting a tool

underneath the door now you might get

something

over the door this is a video from utah

a buddy of ours named the infosec pope

he loves demoing this

all he uses is 35 millimeter film for

the young kids of the room film

is what we used to take photographs with

but he literally just feeds a bow of

film over the door

walks it over to the handle and then

pulls and

you might not do this as a user but if

you pull up on a handle it's usually

going to open the door

so pull bam that door is open and i i

mean pemko makes the door bottom i've

never seen anyone sell the door topper

so like what do you actually do to

prevent this problem well

consider a shroud i was one time

working an underdoor tool in this one

job and i'm like

[ __ ] [ __ ] god damn it [ __ ] i've like

radioed to robert like robert get in

here can you and robert's trying he's

like son of a [ __ ]

bobbitt comes around from another

building and he throws a boar scope

under the door

and we're like oh crap what is that and

eventually like with the borescope we

could kind of see

and shove the wiggle the tool we got it

open and i asked the client i was like

man that one door gave us freaking hell

where did you get these things that you

installed in the server room

and they're like ah they were like on

the building when we got here i don't

know what that this

used to be like a storeroom or something

these are like ingrainger catalogs these

are so

carts don't crash into door handles when

you they're just shrouds for like

protecting the door handle

not for like security they're just so

you don't bang into it with stuff

brilliant no money solution if you've

ever been in a hotel

and you've seen the door handle mounted

like down who's seen this before

hotels know about this man hotels have

had break-ins with under door tools

they mount these handles down for a

reason this is one of my favorite

pictures render man sent me this

and i've started to see hotels and other

doors with these like little clips

i was like i stayed in a hotel once for

like a week in san francisco on this job

and

you know talking to the staff late at

night hanging out [ __ ] and i'm like

hey so i got i got to ask you

the freaking clip thing that looks very

out of place on the doors

is that like un under door tools and the

guy was like oh yeah

we have people breaking into rooms and

stuff we i was like i

gotta know where you get these my

clients could rip because i could that

would be a [ __ ] nightmare trying to

get an underdoor over door attack

he's like well you know the closet in

your bedroom with the the sliding doors

yeah these are just those little feet

that like you put in the carpet on slide

like

literally at home depot four dollars if

you don't care that it looks a little

weird

put these on your server room door man

it will completely frustrate the hell

out of me

so i love this kind of thinking i love

weird and hilarious ways of getting in

and i've got just i just i'm guessing

this crowd i added some funny [ __ ] right

like

stealing keys you think we're above

steel just outright stealing stuff

this was the security cart on a facility

once

we just found it and i was on a job with

a guy i was actually subbed in on a job

had every

f and key like everything all over the

building

and of course like yes we still i'm not

gonna i guess we're allowed to say jay

wouldn't mind i'm not gonna say who it

was but like eventually we just stole

the cart and just drove it around

because if you get to that point i mean

you don't want jobs where you're like

you've gotten everything

and there's still time and you call the

client and you're like so we're

in every they haven't stopped us do you

want to start doing stupid [ __ ]

and the client's like yeah just push it

so yeah we literally took this little

golf carty thing and drove it around the

parking lot until it ran out of juice

and we're like puttering back at like no

miles per hour just to try to get it

back to where we left it

so it looked really and we're not in

uniform no one stopped us

but i love that like all the keys were

there

lock boxes oh my god talk about stealing

keys stealing keys from a lock box

these show up on a ton of buildings

possibly your buildings

if you have con if you have

infrastructure like cell towers and

stuff on high buildings

and other contractors are coming in to

service that gear

i bet you there's lock boxes somewhere

that you might not even know about

tunnelers one two three four five six

seven

different people have to get into this

building i can't even think of that many

cable and wireless providers

i don't know what's going on here

these kind of boxes oh my god telephony

boxes right

this i just throw in because mostly you

know

chris knows this guy in this slide you

guys dennis like dennis is a good cat

right dennis is standing next to

a lanier access control box i am

standing next to another brand called

door king

let's talk about these two big players

in the industry just because this is

stuff that's not usually in my slide

deck

i just had to throw you some fun [ __ ]

right most of the stuff that cracks me

up when it comes to stealing the key

like i don't even think it counts as

stealing in the instance of like linear

you got this nice lit up keypad you got

the little w grill

linear boxes all have the same key it

used to be called the a126 key it's not

really it's the 222343 key but

if you google like linear key or linear

two two two three four three or linear

a126

you'll get this key it's the same key on

all the freaking panels

it's not a restricted key or an

expensive key

but it lets you do crap like this so

here we have a locked door

now my wife is going to enter through a

different technique

beep whoops this is actually the

apartment where we stuck marcus hutchins

while he was waiting for trial so we

only got one key fob we cloned it to her

hand so she could come and go and have

an extra key

but now i don't have a you know the key

fob the door is locked

so what can i do well linear boxes are

all key to like

a126 key there's a little momentary

switch and just boom flip the relay

so that works same key on all these

boxes man

absolutely so yeah door king the one i'm

standing next to here

i personally think door king has even

more market penetration

do they have the same key yes they do

the 16 120 key it's been the door king

key i think since 1992

and it's never like i go to trade shows

i go to like the trade shows with all

this gear and the door king booth is

huge

and i take i just walk around like use

my key just open stuff and just walk

away

every few hours just walk by the boot

this was like a giant parking gate

arm like a huge crash barrier thing and

it's again

16 120 key they're all the same key

door king systems let's let's dive into

this for a moment here we got a lot

going on here

all right you can always always always

tell a door king system

boom boom boom a-z call those three huge

buttons

you'll spot them a mile away now there's

not just that

we have a we clearly have hid procs

going on here we'll talk about

electronic credentials

but let's get right into it all right

let's use our 16 120 key

look at all these electronicals well

there's a lot of stuff going on in there

we got a big bank of connections here

what's going on in this terminal block

well punch in doorking manual.pete file

type pdf

in google you get a big manual with this

on one of the pages

what's the most giant writing you see on

this page relay one relay two those are

the door relays right there

they're just dry contacts on the

freaking panel

so if you have like door relay one

either normally open or normally closed

you can just bridge that circuit and

like boom

fire the relay open the door fire relay

2 open that door

so in this case do you see how this is

wired by the way you can see one common

and you can see what normally open so

that tells you this is probably a

solenoid powered door lock so

normally there's no power put power just

literally by bridging that with a piece

of wire

the door suddenly is open there's

another

useful feature however if you don't want

to like carry around wire and i'll show

you what i carry around

way up top let's look at this psw

function what is psw

it's postal switch a closure between

these terminals and the common

will cause whatever relays are set up

however they're set up

to fire how does this normally work in

fact is the postal switch wired up

yes it is it's right there a little

white and a little blue a little white

and blue that come down you've got these

two beam connectors and they come

somewhere else let's look all the way

down in the front

amazingly low tech this is the postal

switch right here

it's literally just a momentary and on

the front of the panel you'll see they

they have these knockouts that you can

just bang out a piece of metal and

install your own lock

and the tail piece of that lock just

comes around and hits the momentary

switch many

many door kings are installed this way

so we got a locked door now of course

you know we could clone the hid prox we

could install a sniffer or whatever we

want

we don't really care what lock they're

using for the postal switch

because it could be a good lock it could

be a bad lock i don't give a damn

because i have the 16 120 key oh no

oh laptop don't do things that laptops

sometimes do

you're killing me who's phoning my

laptop

so ultimately here hopefully we can get

it to play because it's really hilarious

this is outside of like

romer's apartment i think we're in town

for band practice and

you know we called him up he wasn't

answering like try shaggy he wasn't

answering

and i was like do you want me to just

let us in so you know we walked inside

so

you know we have this postal switch

let's see if my 16 120 key works if

our video plays nice here we go

momentary switch

fires doors unlocked how many buildings

have these on them

and people don't realize many times it's

not like your office right it might just

be the front

vestibule but if i can get in if i can

leverage this access in

and find a way then i get the next step

i get the next step i ride the elevator

etc if you're keeping keys like on you

oh my god

there's a whole talk i did with howard

payne the ch-751 is like the everything

key

it's the most common key in this country

for

all kind of dumb dumb stuff every little

wafer lock

everything like steel toilet paper i

don't know what you're doing if you're

you know you

live in a trailer you need toilet paper

i'll steal it from this hotel whatever

like the ch-751 my favorite story was we

were on a job

we got into an office like a room in

this office building and there were all

these filing cabinets on the wall

and we're like i don't want to pick

every one of these open

to see which one has the valuable [ __ ]

but let's try a ch751

totally worked and it turns out every

one of them had valuable

[ __ ] it was like their hr archives going

back

years the great part and i just added

this story because kjoe gave his talk

and he talked about finding the exploit

from the last job you were on like still

on the server

we found this we showed the client we're

like boy these are really terrible

filing cabinets and you're leaving this

around in a room that we just waltzed in

so the client was like oh my god we'll

get on that we were hired seven months

later to a different office

and we got into like another room and

we're like whoa look at all these

falling cabinets

and we open them we're like are these

the same [ __ ]

well these are the same filing cabinets

they had moved them from one office

to another office but didn't actually

change them so we had the same finding

just in a different state

ch 751 all day long for maximum low

larity in the key to like

space stick 1284x

into your google engine right look some

look at some image searches you're

seeing a lot of the same

vehicle here the 1284x is the ford motor

company's fleet key

the number of crown vics and excursions

and explorers in this country

that are keyed alike to 1284x tons of

police departments in this country

will all and not even knowing it that

all of their cruisers

are the same key and what's the most

common use of a

crown vic after it's got enough use

hours and they have to kick it out of

the force

taxis they auction them off and maybe

become taxis there are cities in this

country

where the entire taxi fleet is key to

like and it's key to like to the entire

police fleet

1284x is not a restricted key it's not a

special like

this is the paper still attached to it

from home depot you get a 1284x take it

to home depot cut as many as you like

yes it will open the doors yes it will

open the glove box

yes it will open the trunk nothing

interesting in a cop's trunk right

and it's not a chipped key it's not a

key lock it's nothing like that yes

it'll start the freaking car

so if you have cop friends and we have

plenty

show them the 1284x if you get your

hands on one it might pop their eyes out

if you're curious my like everyday

keyring that sometimes people will see

me with

they say what do you actually have in

your pocket all the time well i have an

elevator key the most common elevator

key on me at all times i have the two

most common filing cabinet keys the c47

c41

c415a ch751 i definitely carry that

1284x because it's funny

right i have a couple jigglers because

why not little

tiny jigglers that we make if i can't

get through a simple shitty lock

this is my wire bridge when i'm

attacking door king in other boxes it's

just a paper clip

that i burned the insulation off the

tips and looped it around

door king key if you didn't get it

earlier is the 16 120

linear the 222343 which is sometimes

called a126

and a cuff key that is that that's my

smash right there that's like deviant's

devious key ring

giving you pearls here i don't think

i've ever shown the slide before outside

of our training so woohoo

there you go because i love you john

strand and everyone else who invited me

here

if you are not an electronic person in

fact you know

we were talking about this earlier about

where i hire people from our team

we either have people that came from the

electronic digital world

and we sort of train them up on physical

or we've pulled people who are door

kickers they're just cops and other

people

that were like hey want to make a better

salary and not be evil come come work

for us and like

we have to train those people on

electronic learn some

things about electronic access controls

learn a little bit about badge systems

it's not that hard to get you spun up we

can get you spun up in a day or two

on basic cloning and sniffing and a lot

of credential stuff

the the fact that we take long-range

readers and weaponize them bobbik our

electronics dude

changes the guts packages up a

self-contained power supply

power on this reader let it sit in a bag

you know the the idea of like very mr

robotish kind of stuff right if you've

seen that

credential grabbing scene this is real

this is about 18 inches away

credential grab out of someone's pocket

because with a nice antenna and a good

power supply

inside that backpack that reader is

going to grab that card and it's going

to work

we can talk about that later if you want

we can talk about how if you get the

reader off the wall

you can install a sniffer on the

backside of the reader

and you can sniff replay get credentials

that way there's a whole world out there

and it's not

hard if you've never done any kind of

digital electronic work like this if you

are just a door buster

this is within your grasp and i

encourage you to get kind of

cross-trained like that

a little story time for you now new

stuff i promised as i tweeted earlier

it's not i've given

versions of this talk in the past this

is all this is all new

because war stories are great and we've

heard about them from other speakers

so let me give you a few good ones most

of which if you had to distill this down

the lesson is just be confident and look

like you belong

if you've never seen this footage here

this is a robbery of a walmart

where a guy came in and said oh i'm here

from loomis i'm here for the the pickup

you know i'm the armed guard he's not

he's not the armed car guy he's wearing

a runner's vest

with like you know weights and the

tactical pants and his hats down i think

they found out later he had an airsoft

pistol

and he took 75 he's i'm here from loomis

no he got into chevy lumina

and drove away this dude another guy

keep your hat down and don't bother

anybody look i'm just here from you know

your beverage services i'm stocking your

shelves

no you're not this guy hit seven stores

in one weekend in alabama

he's just stealing beer he just went in

with a cart

loaded the thing up and just freaking

left

look like you know what you're doing and

people will tend to believe that [ __ ]

so the elevator repair story all right

we got into a building it was an

interconnect we we gassed off you know a

wreck sensor because again

you could see it on the ceiling

honeywell pir boom

gas the rec sensor get through okay

we're in the building

now we've got to go if you like where

come in we're the first time you get in

you get that like adrenaline rush

and i'm with somebody on this other job

another company we're partnered with

and this guy's like man what do we where

do we go what do we do i was like calm

down i got an idea let's come walk

find the nearest elevator we just got in

an elevator

okay why because i mocked myself up i'm

here from i've got my little otis badge

i've got my clipboard i'm an elevator

repair technician why not

you want another like great tip from me

to you this is your cover story for

being any elevator repair guy ever

have a stupid clipboard and learn these

three steps

you press that e phone somebody picks up

it's many times it's a computer if it's

a human

hello this is a test of the emergency

phone in this elevator

step two can you hear me clearly right

now

step three where am i calling from

and that last one flummoxes the hell out

of people a lot of the time because they

should be able to know where you are in

event of emergency

you will sound like a legit elevator

tech if you do that you're not really

breaking any laws you're not causing any

harm to the elevator

you can just sit there and just try

elevator you know like try elevator

phones and

just to get this dude to calm down i was

like hey just relax let's try some

e-phones man

so we're just being the elevator tax and

it turns out

the third question really flummoxed

somebody because it wasn't like a

service that went out to otis line

it was the the front desk and we wound

up consistently hitting the front desk

and like

oh is this another one of those elevator

tests yeah i i don't know where you are

though it just says extension 39

and i'm like so you can't tell me where

i'm calling from

like i mean you're in an elevator i'm

like

okay sir i'm gonna have to write down

that you uh don't know where i'm calling

from and it got them all panicked right

turns out the security guard was so

flummoxed by not knowing where the

elevator emergency was i'm like don't

worry so there's just

a test you're not at fault here we just

we just have to put this in the notes

that came into play later so while we're

in the elevator

the guy says to me he's like okay so all

we got to do is get the pwn plug and

deploy it

and oh [ __ ] oh man i didn't grab it i'm

like oh you didn't grab the phone plug

well you know the hotel's like 10

minutes away just drive back and get it

i'll stay in the building and i'll let

you back in he's like

uh okay that sounds good you're gonna

look okay i'm like dude i got my metal

clipboard like come on

who's going to mess up metal clipboard

is great because you can hide a bunch of

tulle and gear in it and like

all your stuff's in there but the better

thing about the elevator story is if you

actually watch the elevator hacking talk

we have a lot of keys that do things

well my partner was back at the hotel

which was not going well

he was like hey man i got some delays

here i'm like all right i'll just hang

out in an elevator so i just disabled an

elevator with my keys

i'm just in the elevator just hanging

out nothing i'm like reading twitter and

stuff

occasionally asking like hey how's that

going at the hotel it turns out what

happened is his usb keyboard wasn't

playing nice

with the phone plug he was hooked up to

the hotel tv

and he couldn't get the so he had to use

on-screen keyboard to like

set up all the scripts and it was taking

forever

and i'm like dude that's fine i got

twitter i'm fine i'm just sitting in an

elevator

until i almost had a heart attack

because i thought i heard someone

banging

on the elevator door because it's like

you're camping in the woods like

everything sounds loud in the woods when

you're asleep

in the i thought someone was pounding on

the elevator i was like oh my god

there's is there like a camera i didn't

see

is there a security trying to kick their

way in i'm like no calm down

it's it's 5 5 15. the cleaners are here

they're probably like

windexing the fingerprints off of the

hoistway doors like

all right calm down eventually the guy

comes back

and he's like all right let me in like

okay i go to let it it turns out it

wasn't the cleaners

turns out security had come by the

elevator not because they thought i was

in there

i had been in there so long that they

had stuck

a sign on the elevator that said

elevator out of order

do not use this elevator use other side

of building which was great because when

we came back in my buddy and i now we're

the only people in the damn building

security came down a hall of sauce saw

my otis badge

and went wow you got here fast

and i was like oh yeah i got that uh you

got that otis elite care service so like

they dispatched us out here

i'm you know doing things with keys that

because clearly the elevator's working

now that i turned it back on

but he was so thrilled he's like were

you guys doing that elevator test

earlier i was like

no that was the other team but i heard

you had some problems but

you know what the elevator dispatcher is

in this room can you let me in this room

and sir sure enough the guard just like

led us everywhere we wanted to go

because you know who wouldn't want their

elevators to run right right i'm the i'm

the helpful elevator guy

i'm getting the light on time i'll give

you i'll give you one more story i got a

couple more stories here

but how much time do you actually have

five or ten minutes five

we can do another story and a half and

five so the armed guard story is it's a

good story

most guards a crap shoot a lot of guards

are under trained a lot of guards are

third party

this was a guard desk that literally had

no one at it and one time i just sat

there i actually took the binder of keys

and key cards and just kind of like spun

around in the chair

just waiting for a guard to come up to

see i wanted to like know what the hell

they would say

and it took so long that i just got up

and left like the guard literally never

showed

arm guards are a different story they're

a little more mastered

they're a little better with interaction

and they're going to be more cautious

now this was an instance where we needed

electronic credentials

we really wanted to get in using a badge

and all the employees like we couldn't

get close to the employees at all they

were using a separate entrance so like

the vestibule was the only place we

could get in

and during the day the only people in

the vestibule were the armed guards this

was a private development space

well we know how to do credential

cloning right we have our gear we have

our long range reader

that you saw earlier right shove that in

a backpack once you power it on

shove that oh we already saw this video

shove that in a backpack

get somebody to go in just try to get

close enough you saw 18 inches or so

so when we said who's going to go in

right well what does every guard

especially armed guards kind of wish

they want to be or maybe they're trying

to be

they're trying to be cops right sending

a cop like rob's on our team rob used to

be a cop we're like just get in there

and cop it up man just talk about cop

stuff

so he goes in bobik is in the back seat

of a rental car

in the parking lot like remote onto the

reader he's like trying to check the

status of it and goes out of range

because robert goes in all the way to

the vestibule so bobbix like man i

really hope

i really hope that reader is getting

some credentials and robert's trying

everything robert's like getting close

but they're armed guards

so they keep blading off every time he

gets near them

at one point he put it like his bag on a

counter and he was like asking the guard

he's like hey is this a good restaurant

i started on yelp trying to get the

guard to like lean over the counter

wouldn't do it

so he keeps trying he keeps trying he

keeps trying getting nothing

finally at the end of the interview he's

telling cop stories right so he's

friendly with him

he's like all right well i gotta if he

stays any longer he's like this is just

weird

it's like all right fellas i gotta i

gotta go all right take it easy man it's

nice meeting you

and the last guard he just [ __ ]

surprise hugs

him and like very very kennedy he's like

make it a little weird make a little

weird all right brother all right

and gets out of there in the car

bobik is in the back seat like what did

you do i was

dying back here it's like well here

check check the logs man

bobby check dumps the creds he's like

you were in there

47 minutes and you got one read

and that was it but then who are we

we're the armed guard at that point

so getting you never know exactly what's

going to work out for you

in terms of getting in i had one other

story about you know find me in the bar

i'll tell you about uh

about some other stuff what i really

wanted to get to i'm going to quiz you

at the end here we got a little we got a

little q

a and i promise i'm wrapping it up right

so this is i hope you're paying

attention right

what kind of unit is this here door king

why'd you know that

three [ __ ] huge buttons who remembers

the door king key

16 120 key buy it buy it online

what kind of unit is this it's one of

the ones we talked about has a little

recess

lit keypad linear linear absolutely

what's the linear key

a126 or technically 222343

blurry dark picture but who is it door

king exactly three buttons

you can do this [ __ ] on google street

view

we got a building here let's zoom on in

you can't see it clearly but you see a

recessed lit keypad what do you got

you got a linear a126 key absolutely

let's look at this john over here all

right

can't see it from here but let's zoom in

and google what do you see three giant

freaking buttons door king

absolutely door king we got a lot going

on here let's let's talk about this all

right first of all we clearly got a door

king system

we're using what key is the door king

key

16 120 go buy one they're also using hit

old school [ __ ] prehistoric hid procs

so prox card two

you know they're using cloneable

credentials you know you could sniff the

back end of this

because you could pop that circuit board

open easily they've got a ton of key

boxes this was for deliveries

i don't know if that was a ch-751 but

i'm sure i tried it in there

little freaking you know kitty access

point in here what is what is this one

turns out it's also a key box it's just

a different key box so we have multiple

key boxes

we have a lock that we know the key for

we have a clone a clonable cred

there's one more thing that you can also

see in this picture

can anyone tell what i what i would look

for through the windows maybe

you could tell what elevator fixtures

they have so i know what elevator keys

i'm gonna need

so i can prep my story and i can bomb in

there

all equipped and ready to rock so keep

these kind of attacks in mind

keep physical side in mind try it out if

you think it's all about lock picking

you're not exactly right

most of the time we're just doing dumb

stuff to bypass our way in

but i love sharing this and i love

trying to give a little hope you got a

couple of pearls in this one

to make your jobs easier and your life

better and my job harder

because that's in the end that's a win

for me like i like being the guy in the

server room

but i also like telling people what they

did right and a lot of it's not hard to

do

so thank you very much for listening and

i hope you enjoyed this

you