Tactics of Physical Pen Testers
Summary
TLDRThe speaker, a physical security expert, debunks the myth that lock picking is the primary method used for covert entry. Instead, he shares practical and often overlooked techniques such as hinge pin removal, latch slipping, and exploiting poor door fitment. He also discusses electronic access control vulnerabilities, the use of common keys for access points, and the importance of being confident and appearing to belong when gaining unauthorized access. The talk is filled with real-world examples and advice on improving physical security measures.
Takeaways
- 🔓 The speaker emphasizes that lock picking is often the least common method used to gain unauthorized access to buildings, suggesting that other techniques are more frequently employed.
- 🛠️ The script highlights various physical security vulnerabilities, such as easily removable hinge pins and improperly installed latches, which can be exploited to bypass locked doors.
- 🔑 The importance of understanding the type of lock and security system in place is underscored, as knowing the common keys or methods to exploit them can be advantageous in physical penetration testing.
- 💡 The concept of 'social engineering' is implied through stories where confidence and appearing to belong can lead to successful unauthorized access, such as posing as an elevator repair technician.
- 🛡️ Simple and inexpensive solutions, like security hinges and jam pins, are suggested to improve physical security and prevent easy access through doors.
- 👮♂️ The role of security guards and their interaction with intruders is discussed, noting that their training and vigilance can vary significantly.
- 🚪 The script points out that electronic access control systems, such as HID proximity cards, can be vulnerable to cloning and sniffing attacks.
- 🔍 The use of everyday objects and tools, such as under-door tools and wire bridges, to gain access is demonstrated, showing that specialized lock-picking skills are not always necessary.
- 🏢 The speaker shares anecdotes from physical security testing jobs, illustrating the diverse methods used to infiltrate buildings and the human elements that can be manipulated.
- 🔗 The importance of cross-training in both physical and electronic security domains is suggested, as knowledge in both areas can enhance the effectiveness of a security professional.
- 📈 The script concludes with a call to action for security professionals to be aware of the physical side of security, implying that a comprehensive approach is necessary to ensure robust security measures.
Q & A
What is the common misconception about the job of a physical security expert as described in the script?
-The common misconception is that physical security experts, often referred to as 'break-in guys', primarily use lock picking to gain access to secure spaces. However, the script clarifies that lock picking is actually a less common method and is far down on the list of techniques used.
What is the first method mentioned in the script that can be used to bypass door security without picking the lock?
-The first method mentioned is knocking out hinge pins, which allows the door to be removed from its frame, bypassing any locks on it.
What is a security hinge and how does it prevent the hinge pin removal method?
-A security hinge is a type of hinge that has a peg which goes into a hole when the door is closed. This prevents the door from being removed from the frame even if the hinge pins are knocked out, as the peg blocks the attack.
What is a jam pin and how does it help in making a conventional hinge more secure?
-A jam pin is a security-enhancing replacement for the screws in a conventional hinge. It transforms the hinge into a security hinge by preventing the hinge pin from being knocked out without the need to rehang the door.
What is the importance of properly installed latches in door security as highlighted in the script?
-Properly installed latches, specifically dead latches, are crucial for door security because they prevent the door from being opened by latch slipping tools. If the latch is not installed correctly, it can be easily manipulated, compromising the security of the door.
What is a crash bar and why is it vulnerable to certain attacks as described in the script?
-A crash bar is a type of door mechanism often used for emergency exits. It is vulnerable to attacks because it can be triggered by inserting a rod or other object through a gap in the door and pressing the bar, allowing unauthorized access.
What is the purpose of the 'thumb turn flipper' tool mentioned in the script?
-The 'thumb turn flipper' is a tool used to manipulate thumb turn locks or deadbolts from the outside. It is used to unlock doors that have a thumb turn on the inside, allowing access without the need for a key.
What is the significance of the 'under door tool' in the context of the script?
-The 'under door tool' is significant because it demonstrates how attackers can exploit poorly secured doors with lever-style handles. By reaching under the door and manipulating the handle, an attacker can open the door without needing to pick the lock.
What is the role of the 'postal switch' in a Door King access control system as described in the script?
-The 'postal switch' in a Door King system is a momentary switch that, when activated, can trigger the door's relays to fire, effectively unlocking the door. It can be used as a bypass method if an attacker can access the switch.
What is the 'CH-751' key mentioned in the script and why is it significant?
-The 'CH-751' key is a very common key used for various locks, including filing cabinets. It is significant because it can often open many locks by default, making it a useful tool for physical security testers.
What is the '1284X' key and why is it noteworthy in the context of the script?
-The '1284X' key is a key used by the Ford Motor Company for their fleet vehicles, such as Crown Victorias. It is noteworthy because it is not a restricted key and can open many police vehicles and even start their engines, highlighting a potential security vulnerability.
Outlines
🔓 The Misconception of Lock Picking in Physical Security
The speaker, a professional in physical security, dispels the common myth that his job primarily revolves around lock picking. Despite the excitement associated with being a 'break-in guy', he clarifies that lock manipulation is far down the list of techniques used to gain entry into secured spaces. He emphasizes that his role involves various other methods, including covert entry tactics, and that the romanticized idea of lock picking is not the central aspect of his work.
🚪 Exploiting Door Vulnerabilities in Physical Penetration Testing
This section delves into the reality of how physical penetration testers gain access to buildings, focusing on the weaknesses of doors and their components. The speaker discusses the ease of removing hinge pins as a method of entry, regardless of the number of locks on a door. He also introduces the concept of security hinges and jam pins as solutions to strengthen door security. Additionally, he touches on the ineffectiveness of certain latch installations and the importance of dead latches in preventing unauthorized access.
🛠️ Practical Solutions to Common Physical Security Flaws
The speaker provides practical and cost-effective solutions to address common physical security issues. He highlights the use of security hinges and jam pins to prevent hinge pin removal, and discusses the importance of proper door fitment to ensure dead latches function correctly. He also addresses the risks associated with electronic strike plates and the use of thumb turn flippers as potential security threats, suggesting that understanding these vulnerabilities is crucial for improving physical security measures.
🕵️♂️ Advanced Techniques for Bypassing Physical Security
This paragraph explores more sophisticated methods used by physical security professionals to bypass security systems. The speaker describes using tools to exploit gaps under doors, reach through to thumb turns, and even manipulate request to exit sensors using cold gas clouds. He also touches on the use of dual-technology sensors that combine passive infrared and microwave radar to prevent such bypasses, emphasizing the need for robust security measures.
🛡️ Creative and Inexpensive Security Solutions for Doors
The speaker shares unconventional yet effective methods for enhancing door security. He discusses the use of door shrouds, clips, and other simple devices to prevent unauthorized access through under-door tools. These solutions are not only cost-effective but also easy to implement, demonstrating that creativity can play a significant role in improving physical security.
🔑 The Art of Key Stealing and Its Implications for Security
In this section, the speaker humorously discusses the ease of stealing keys from lock boxes and the surprising prevalence of universal keys across security systems. He highlights the lack of security in using common keys for access control boxes and the potential risks of not securing these keys properly. The speaker encourages security professionals to be aware of these vulnerabilities and to implement more robust key management practices.
🛠️ Leveraging Common Keys and Simple Tools in Security Breaches
The speaker shares anecdotes about using common keys and simple tools to breach security systems. He demonstrates how easily accessible keys, such as those for elevators, filing cabinets, and vehicles, can be used to gain unauthorized access. He also discusses the use of jigglers and wire bridges to manipulate locks and suggests that security professionals should be aware of these simple yet effective techniques used by intruders.
💼 The Importance of Confidence and Belonging in Physical Security Breaches
This paragraph emphasizes the power of confidence and the appearance of belonging when attempting to breach security. The speaker recounts stories of individuals who successfully gained access to facilities by acting as if they were authorized personnel, such as armed guards or service technicians. He suggests that security professionals should be trained to question and verify the credentials of anyone entering a secured area, regardless of their appearance or demeanor.
👮♂️ The Role of Armed Guards and the Potential for Security Breaches
The speaker discusses the challenges of interacting with armed guards and the potential for security breaches due to human error or lapses in judgment. He recounts a story of attempting to clone electronic credentials while posing as a police officer to gain the trust of the guards. The anecdote highlights the importance of vigilance and the need for guards to maintain a high level of suspicion and awareness to prevent unauthorized access.
🏢 Real-World Applications of Physical Security Breaching Techniques
In the final paragraph, the speaker wraps up his presentation by summarizing the various techniques and strategies discussed for breaching physical security. He encourages the audience to consider the physical aspects of security alongside digital measures and to test their own security systems for vulnerabilities. The speaker also hints at additional stories and insights that can be shared during a Q&A session, emphasizing the importance of continuous learning and adaptation in the field of security.
Mindmap
Keywords
💡Lock picking
💡Covert entry team
💡Hinge pins
💡Jam pins
💡Latch slipping
💡Dead latch
💡Electronic access control
💡Credential cloning
💡Door fitment
💡Crash bars
💡Under door tools
Highlights
The speaker runs a covert entry team and discusses the misconception that their job primarily involves lock picking, which is actually a less common method.
Photo shoot for an article showcasing the team's work led to a demonstration of lock picking, though it's not the main technique used.
Lock manipulation is described as the ninth method tried to gain entry, emphasizing there are more common techniques.
The importance of understanding door hardware and installation, such as hinge pins and security hinges, is highlighted as a way to improve physical security.
Jam pins are recommended as an easy and cost-effective solution to enhance door security.
The use of latch slipping tools to bypass doors without picking locks is demonstrated, showing a common vulnerability in door installations.
The concept of dead latches is introduced, explaining how they prevent latch slipping attacks.
Proper door fitment, including the correct installation of strike plates and latches, is emphasized as crucial for security.
The exploitation of gaps in door installations, such as with crash bars and weather stripping, is shown as an easy entry method.
The use of tools to flip thumb turns on the other side of the door is demonstrated, bypassing the need for a physical key.
The vulnerability of frameless glass doors and the use of simple tools to reach and operate handles or locks from the outside.
The speaker discusses the use of under-door tools to manipulate lever-style door handles from underneath, bypassing the lock entirely.
The effectiveness of simple measures like clips or shrouds on door handles to prevent under-door tool attacks is mentioned.
The potential for stealing keys or key information from lock boxes or access control panels is highlighted.
The use of common keys for certain access control systems, like the Door King and Linear keys, to gain unauthorized access is demonstrated.
The speaker shares stories of successful physical penetrations using confidence and the appearance of belonging, such as posing as service technicians.
The importance of cross-training in both physical and electronic security to better understand and exploit vulnerabilities.
The use of long-range readers and other electronic devices to capture credentials for cloning purposes.
The speaker concludes by encouraging the audience to consider physical security methods beyond lock picking and to utilize simple yet effective techniques.
Transcripts
so yeah many of us have fun gigs though
many of us have really fun jobs people
come up to me a lot
and they say oh my gosh deviant you know
physical security and break it in that's
your job is so cool i like it and yes i
get it right like
being the break-in guy is fun if you've
never met me that i run a covert entry
team
robert bobbik and our crew of hooligans
in places we shouldn't be
but the funny thing people kind of
romanticize this notion like yes
our ops division does very dynamic door
kicker stuff
but for this one scene here this was a
photo shoot when an article came out
about what we do
they were like oh yeah get some pics and
get some pics in your hands right
and so like i'm here picking a door
now everyone has said to me i'm known as
this lock picker and like maybe i've
taught some of you about lock picking if
you've ever seen like any of these
animations that tool has on all of our
slides like
if you've ever learned how a lock works
you saw the little pins and they
they bind but they push up with a key
and if i don't have a key like how do i
get in the lock like
i've taught about lock picking forever
and everyone thinks of me as this lock
picker and they say oh yes so like i'd
love to have that job man
like that's you know you at a door at
two in the morning with those picks out
i wish i could do that and get paid
which again like sure that's fun and i
have
picked locks to get into secured spaces
but this [ __ ] here manipulating the pins
with like pick tools
it's something like the ninth thing on
the list of stuff we try
to get into buildings and this whole
talk is not this is like the last
lock-picking slide in the talk
because this is not a lock-picking talk
i am i know hooray is what i say because
i'm so
tired hey you made it i'm so tired of
talking about lock picking
i love like i love when someone new is
learning it right and if someone's never
done this and they get it
and it's this whoa moment that's fun but
i gotta
stop this illusion that we are picking
lock like how many times do you pick a
door
you don't johnny like [ __ ] yeah vince
and you like you don't really pick
doors this this [ __ ] is great that's not
what we do
so let's talk about how physical pen
testers actually get into buildings
how real covert entry tends to work and
how you fix almost all of it
dumb [ __ ] right like right off the bat i
have not i've legit
knocked hinge pins out of doors you just
bang a hinge pin out walk the door i
don't care how many locks are on the
door
if you can walk that door away from the
frame walk in
this is a thing that you can do with
like a nail or a nice little orange tool
so you don't bust up your fingers
but again like all these locks in the
door what you don't see are hinges
hinges are on the outside of this door
this is an absolute method that gets you
into places
and stupid easy to fix i'm giving you
like easy ones off the bat here
this is a security hinge the door swings
shut
little peg goes in a little hole doesn't
matter if you bang the hinge pins out
you can't wrench that away from the door
frame
because the peg is in the hole like
literally it puts it it puts a block
from that attack
if you don't want to buy new hinges and
re-hang all your doors i'm huge into
recommending what are called jam pins
i don't sell any of this stuff like i
know some of the firms that make it but
like
brilliant idea what are jam pins you
have a conventional hinge
take out these two screws replace them
with jam pins
take out these two screws replace them
with [ __ ] all
you just made a security hinge and you
didn't rehang your door
like two dollars i think brilliant kind
of solutions
easy easy stuff slipping latches and
such
like people see me like oh he's taking a
tool out of his pocket he's going to
open that door what's he doing
i'm not taking pics out of my pocket
most of the time
i am doing sound by the way oh no sound
we're gonna need sound
who's my sound guy back there let's see
anybody you hear it all right oh well
well i don't know why we're not getting
sound but yell the guy in the back he's
not doing anything
so yeah like this is a completely locked
door this is a water treatment facility
this is like the room where they
chlorinate and prep the water for the
supply and i'm not picking the lock i'm
just attacking it with a little
latch slipping tool you should not be
able to do this
on most systems right
here's a door
there we go is there some sound can
anyone in the back turn the sound the
[ __ ] up please
there's a remote oh wow this is like
dad's living room
way too many buttons is that a thing
is that happening i don't know whatever
all right i don't care i'm gonna keep
going
but yeah like this little tool this
little stupid hook that we've been
selling in our student kits we give them
to you you give them to students
it's like a five dollar part and it gets
through so many doors what we're doing
here
it's not that you can like reach the
latch here's a latch you can't reach
with a hook because it's got that big
plate over it right
get yourself a big piece of wire
oops the problem is not that you can
touch or can't touch the latch the
problem in all these bits of footage
here
is that the latch is not installed
properly latches
in a modern environment should be what
are called dead latches
in fact this is a picture of a dead
latch well let's talk about
what is a dead latch what is not well
this is the latch
right this is what goes into the strike
plate holds the door shut
if you lean on the door the door does
not pop open
you might remember doors that only ever
had this this is what a door used to
look like
long time ago and then all of a sudden
you started getting this extra little
button
sometimes called a guard bolt sometimes
called the dead latch
plunger has a lot of names but that
extra button that i will highlight in
red here
that indicates that you have a dead
latch mechanism
the dead latch plunger or the guard bolt
many people only see it when the door is
open
and you know it's not always in this
configuration sometimes it's next to the
latch it's
there's a lot of styles no matter what
style you have
you might not know when the door shuts
that's supposed to be held back
it's supposed to be pressed back into
the door by the strike plate
it's not supposed to pop out into the
hole if that is pressed back
that latch is now dead you can't hook it
slip it shim it anything like that
that's how this is supposed to work but
the problem is door fitment
if you don't have the right hardware
mounting and you don't have the door
hung
properly we see this all the time on
doors man
this we've got a nice door properly
locked okay this is a piece of trash
literally a piece of plastic garbage
shoved in
boom server room look at the size of
that strike plate hole
you could drive a truck into that why is
it so huge is this the strike plate that
came with this
handle set what do you think this is
yes i heard it say it louder electronic
strike plate this is a card reader
access door
so they retrofit the additional like the
original plate of strike plate they put
like a
separate unit a solenoid powered strike
and there's all different configurations
of this kind of hardware
we literally know integrators and
installers who are like oh make sure you
always get like the jp 41 that's the one
with the big hole
it always works no matter what door the
client has it's no problem
no that is not how this is supposed to
work you are
really undermining your security another
door
another water facility right nice lock i
mean
i'm i'm a decent enough picker i'm not
going to try to pick this
why not because boom bad door fitment
over and over and over
and like you know you don't want me in
there i don't belong in this room
five dollar hook gets me in when a nice
lock could have prevented me
if they had properly set the door up
let's talk about this kind of door
fitment problem you got crash bars let's
just reach through
you've told stories like this forever
what
happened there i was like talking to
point of johnny right let's watch that
again crash bar
let's get a bent rod and just slip it
through and bam
hit the door right absolutely works
why because weather stripping is not a
security device
weather stripping is not the same thing
as a plate or even a movable astragal of
metal
if that is just rubber or that little
brush material
if i can slip something through and
smack on that crash bar they make
specially designed tools
just for this here's robert one our guys
on our team reaching through with a
reinforced tool
hitting the crash bar bam
exit paddles smaller target how many
times do you see glass doors glass doors
are wonderful because you can see
exactly what you're hitting or not
hitting
but going back you can barely see it's a
really dark photo you can't see it here
easily you can see it in the video
though sometimes
is this daytime or night time
this what is it it's not it's like three
in the morning i know it's a little bit
white out here but it's it's very dark
out this is a low occupancy structure at
night what could they have done and not
violated code
they could have set the deadbolt it's
right [ __ ] there right
well this tool is there's a tool that
exists for this the idea of a deadbolt
again for code many of these attacks as
you all know like
fire code and actually egress like
restrictions and allowances
you have to set up doors certain ways if
you have a deadbolt it probably has a
thumb turn on the inside
this tool exists i have it in my room
this is a thumb turn flipper
you stick it through the door and you go
boop
absolutely that like these tools are out
there man they are not expensive
and again like here we have a nice
this is a classic california office
building why because it has
frameless glass doors oh my god
california where the weather is so nice
you don't care about insulation
frameless glass doors everywhere
so yes reach through with the tool the
hardest part was just getting it to stop
slipping off the knob was so tiny but
eventually
sure enough you get it on there you twit
it's just like a braided cable
attached to a it's not a sophisticated
tool right
but eventually bam well that's open
post office near where i live you can
see like right on the other side of the
door i'm not gonna go steal a bunch of
mail or anything but the gap is huge you
could get through there
tesla dealership of course it's
california why because frameless glass
doors that's why
middle of the night no one around i'm
not saying i wanted to uh duplicate
tiger team
like steal a car but absolutely like
frameless glass doors boom
thumb turns that's the only thing
preventing anyone from getting in here
and the gap is like a half inch wide
talk about another gap problem here's a
locked door
there's some noise and then dr tran
comes through like ninja in a cloud of
smoke
what happened there many of you know
this one already i hope
this is a lab where we do a lot of
prototyping and we just show like bobbik
in the hat just showed ross
and ross is like hey building owner evan
come here i want to show you this thing
i just learned so you'll see he's trying
to do something with a tool up in the
time
bobbit says no reposition it a little
bit out here and look through the glass
you'll see the same thing you'll see
this sort of
cloud of vapor and all of a sudden this
locked door
is no longer locked yay
well who knows what government there's a
very restricted government tool that
they're using
i don't know if you can get it like talk
to someone you know who's kind of spooky
you can find out how to order this it
comes with a one-page
idiot proof government instruction
manual that says hold tool like this
so all you're doing if you invert one of
these spray dusters
you're boiling off that r134a
essentially is what's in there
and you're creating this cold gas cloud
what's actually tripping
many doors have sensors on the inside
especially electronic lock doors
they are called request to exit sensor
if you have a system where you badge in
but you don't have to badge out you just
walk to the door and just open it
you might not realize you have a request
to exit sensor you have
most of the time a simple passive
thermal sensor
it's not the only technology out there
it's far and away the most common one
and if you can get that sensor to trip
in this case just by blowing a cloud of
gas through the door
the door unlocks these are old tricks
you should know them
dave if you saw his keynote this morning
dave did he's a big
you know vape guy he's a big ecig guy oh
yes so he and ben 10 recorded this is
one of the best videos ever of it
so like i don't know if you sub ohm your
coils or something because he makes this
amazing cloud through there
but he's just listening to hear that
solenoid he's listening to hear it
trigger
and when he knows that electromagnet is
done bam
door's unlocked boom
now unlocked yeah chris up here i think
is the he was like hey dave you should
try this on that door this is totally at
we don't [ __ ] where we eat right yeah
this was this this was the dirty derby
class yeah
yeah and like i think eventually people
other people kept trying it until the
point where there was staff
in that because it's like a staff area
and staff was like what's the smoke
coming through the door are they like
freaking out
i don't smoke uh i do drink too much my
wife caught this video once
we're walking home from like a bar this
was late at night this is a bank the
bank is closed
but i'm like well there is a wreck
sensor up there and i had just kind of
walked out of a bar with a drink
so i just spit that through the door and
like that works
so yeah man passive infrared doesn't
understand hot cold it just says
different oh different must be a human
this one up top here the honeywell
passive infrared sensor
i guarantee you've seen it or you've
seen it rebranded and re-badged as
somebody else's
almost always white sometimes you see
them in black or beige you will see that
everywhere all over the place and why
are they calibrated this way well you
don't want someone with a bunch of boxes
to like bang into the door and fall over
these are tuned
and the installers mount them in a way
to get the most wide spectrum hit
because they don't want to be called out
repeatedly hey the rec sensor's not
working it's not picking us up it's
causing you know mary just fell down
with her cane and her walker
the installer doesn't want that
installers and integrators want to
always have these things trip so you're
going to see that on a lot of doors
because it's got really good coverage
and you're going to always see it open
the door what is this on the bottom
though
that's your solution ge is the only one
i've ever seen that
reasonably brings to market a dual
technology rec sensor
yes it does passive infrared it also
does microwave radar
so it has to see some temperature change
and it also has to see something
vaguely human-sized coming vaguely
toward the door
we knew like um tr a hacktrust hector
zo9val
val actually she'll put balloons through
doors and blow them up
and let them go because the old trick
with the pirs you usually just put them
further away from the door you just put
them down the hall
and you know if i'm trying to gas the
dog i'm not hitting it so her solution
for that was like
like send balloons like blowing down the
hall to try to trip them
ge's product will stop that i don't work
for ge i'm not here shilling for like
mubics and his buddies moving still with
ge i don't know
no all right but yeah it's the only
dual technology sensor that i've ever
seen that's good for this
also code let's talk about door handles
when's the last time you've seen a door
knob like in an office
you don't because if someone like has
reduced grip and tactile function or
what if someone doesn't have a hand
they need to be able to get in and out
of the building especially in
emergencies
lever style door handles are are the
norm now
well inside i mean you see the front one
facing me that's locked and has a
you know shitty little hid prox reader
on the inside there's also
a lever handle which many times that's
going to be the case
there are tools like this that exist
this is an under door tool
i'm doing a little show with a guy named
tyler gray he's like well show me this
tool and his cameraman is like how would
you get in here
and they expected me to do something at
the door they didn't realize i just
knelt down
and kind of banged the door open and
actually it's one of the cameraman was
like
can you do that like again like slower
that was way too fast i didn't
understand what was happening
well these are actual tools that we use
on jobs
what we're doing with this tool it's
called an under door tool
we're reaching a rod under the door and
because
modern doors have those lever style
handles
they're really really trivial to grab
that handle
and hit it on the inside i'll show you a
picture from flipped around in a second
this is robert
middle of the night getting into a
server room you know people see this
video and they thought they see him
crouched down like oh he's going to
unscrew like with a multi-tool to get
through that crawl through the grate no
he's not
he's going to lean his head into the
door and just push it open because on
the inside
we're just swinging a rod pulling down
on a line
and yanking this handle absolutely works
because when's the last time you've been
in the server room and had to badge out
some some real secure facilities maybe
most of the time you hit the handle and
you leave
there are solutions for this there are
what are called dynamic
door bottoms this little animation
shows you a black plunger if this black
plunger gets pushed in
what happens you'll see this bottom bar
drops down
so when the door shuts that bar drops
down now this is not a security product
this is like a heating and cooling
insulation product but the same
principle applies
to much more robust models so a company
called pemco p-e-m-k-o pemco makes the
door bottom now they're sold by assa
abloy big contoured floor plate
interlocks in this metal bar and unless
that plunger is
relieved of its pressure that door
bottom is dropped down you're not
getting a tool
underneath the door now you might get
something
over the door this is a video from utah
a buddy of ours named the infosec pope
he loves demoing this
all he uses is 35 millimeter film for
the young kids of the room film
is what we used to take photographs with
but he literally just feeds a bow of
film over the door
walks it over to the handle and then
pulls and
you might not do this as a user but if
you pull up on a handle it's usually
going to open the door
so pull bam that door is open and i i
mean pemko makes the door bottom i've
never seen anyone sell the door topper
so like what do you actually do to
prevent this problem well
consider a shroud i was one time
working an underdoor tool in this one
job and i'm like
[ __ ] [ __ ] god damn it [ __ ] i've like
radioed to robert like robert get in
here can you and robert's trying he's
like son of a [ __ ]
bobbitt comes around from another
building and he throws a boar scope
under the door
and we're like oh crap what is that and
eventually like with the borescope we
could kind of see
and shove the wiggle the tool we got it
open and i asked the client i was like
man that one door gave us freaking hell
where did you get these things that you
installed in the server room
and they're like ah they were like on
the building when we got here i don't
know what that this
used to be like a storeroom or something
these are like ingrainger catalogs these
are so
carts don't crash into door handles when
you they're just shrouds for like
protecting the door handle
not for like security they're just so
you don't bang into it with stuff
brilliant no money solution if you've
ever been in a hotel
and you've seen the door handle mounted
like down who's seen this before
hotels know about this man hotels have
had break-ins with under door tools
they mount these handles down for a
reason this is one of my favorite
pictures render man sent me this
and i've started to see hotels and other
doors with these like little clips
i was like i stayed in a hotel once for
like a week in san francisco on this job
and
you know talking to the staff late at
night hanging out [ __ ] and i'm like
hey so i got i got to ask you
the freaking clip thing that looks very
out of place on the doors
is that like un under door tools and the
guy was like oh yeah
we have people breaking into rooms and
stuff we i was like i
gotta know where you get these my
clients could rip because i could that
would be a [ __ ] nightmare trying to
get an underdoor over door attack
he's like well you know the closet in
your bedroom with the the sliding doors
yeah these are just those little feet
that like you put in the carpet on slide
like
literally at home depot four dollars if
you don't care that it looks a little
weird
put these on your server room door man
it will completely frustrate the hell
out of me
so i love this kind of thinking i love
weird and hilarious ways of getting in
and i've got just i just i'm guessing
this crowd i added some funny [ __ ] right
like
stealing keys you think we're above
steel just outright stealing stuff
this was the security cart on a facility
once
we just found it and i was on a job with
a guy i was actually subbed in on a job
had every
f and key like everything all over the
building
and of course like yes we still i'm not
gonna i guess we're allowed to say jay
wouldn't mind i'm not gonna say who it
was but like eventually we just stole
the cart and just drove it around
because if you get to that point i mean
you don't want jobs where you're like
you've gotten everything
and there's still time and you call the
client and you're like so we're
in every they haven't stopped us do you
want to start doing stupid [ __ ]
and the client's like yeah just push it
so yeah we literally took this little
golf carty thing and drove it around the
parking lot until it ran out of juice
and we're like puttering back at like no
miles per hour just to try to get it
back to where we left it
so it looked really and we're not in
uniform no one stopped us
but i love that like all the keys were
there
lock boxes oh my god talk about stealing
keys stealing keys from a lock box
these show up on a ton of buildings
possibly your buildings
if you have con if you have
infrastructure like cell towers and
stuff on high buildings
and other contractors are coming in to
service that gear
i bet you there's lock boxes somewhere
that you might not even know about
tunnelers one two three four five six
seven
different people have to get into this
building i can't even think of that many
cable and wireless providers
i don't know what's going on here
these kind of boxes oh my god telephony
boxes right
this i just throw in because mostly you
know
chris knows this guy in this slide you
guys dennis like dennis is a good cat
right dennis is standing next to
a lanier access control box i am
standing next to another brand called
door king
let's talk about these two big players
in the industry just because this is
stuff that's not usually in my slide
deck
i just had to throw you some fun [ __ ]
right most of the stuff that cracks me
up when it comes to stealing the key
like i don't even think it counts as
stealing in the instance of like linear
you got this nice lit up keypad you got
the little w grill
linear boxes all have the same key it
used to be called the a126 key it's not
really it's the 222343 key but
if you google like linear key or linear
two two two three four three or linear
a126
you'll get this key it's the same key on
all the freaking panels
it's not a restricted key or an
expensive key
but it lets you do crap like this so
here we have a locked door
now my wife is going to enter through a
different technique
beep whoops this is actually the
apartment where we stuck marcus hutchins
while he was waiting for trial so we
only got one key fob we cloned it to her
hand so she could come and go and have
an extra key
but now i don't have a you know the key
fob the door is locked
so what can i do well linear boxes are
all key to like
a126 key there's a little momentary
switch and just boom flip the relay
so that works same key on all these
boxes man
absolutely so yeah door king the one i'm
standing next to here
i personally think door king has even
more market penetration
do they have the same key yes they do
the 16 120 key it's been the door king
key i think since 1992
and it's never like i go to trade shows
i go to like the trade shows with all
this gear and the door king booth is
huge
and i take i just walk around like use
my key just open stuff and just walk
away
every few hours just walk by the boot
this was like a giant parking gate
arm like a huge crash barrier thing and
it's again
16 120 key they're all the same key
door king systems let's let's dive into
this for a moment here we got a lot
going on here
all right you can always always always
tell a door king system
boom boom boom a-z call those three huge
buttons
you'll spot them a mile away now there's
not just that
we have a we clearly have hid procs
going on here we'll talk about
electronic credentials
but let's get right into it all right
let's use our 16 120 key
look at all these electronicals well
there's a lot of stuff going on in there
we got a big bank of connections here
what's going on in this terminal block
well punch in doorking manual.pete file
type pdf
in google you get a big manual with this
on one of the pages
what's the most giant writing you see on
this page relay one relay two those are
the door relays right there
they're just dry contacts on the
freaking panel
so if you have like door relay one
either normally open or normally closed
you can just bridge that circuit and
like boom
fire the relay open the door fire relay
2 open that door
so in this case do you see how this is
wired by the way you can see one common
and you can see what normally open so
that tells you this is probably a
solenoid powered door lock so
normally there's no power put power just
literally by bridging that with a piece
of wire
the door suddenly is open there's
another
useful feature however if you don't want
to like carry around wire and i'll show
you what i carry around
way up top let's look at this psw
function what is psw
it's postal switch a closure between
these terminals and the common
will cause whatever relays are set up
however they're set up
to fire how does this normally work in
fact is the postal switch wired up
yes it is it's right there a little
white and a little blue a little white
and blue that come down you've got these
two beam connectors and they come
somewhere else let's look all the way
down in the front
amazingly low tech this is the postal
switch right here
it's literally just a momentary and on
the front of the panel you'll see they
they have these knockouts that you can
just bang out a piece of metal and
install your own lock
and the tail piece of that lock just
comes around and hits the momentary
switch many
many door kings are installed this way
so we got a locked door now of course
you know we could clone the hid prox we
could install a sniffer or whatever we
want
we don't really care what lock they're
using for the postal switch
because it could be a good lock it could
be a bad lock i don't give a damn
because i have the 16 120 key oh no
oh laptop don't do things that laptops
sometimes do
you're killing me who's phoning my
laptop
so ultimately here hopefully we can get
it to play because it's really hilarious
this is outside of like
romer's apartment i think we're in town
for band practice and
you know we called him up he wasn't
answering like try shaggy he wasn't
answering
and i was like do you want me to just
let us in so you know we walked inside
so
you know we have this postal switch
let's see if my 16 120 key works if
our video plays nice here we go
momentary switch
fires doors unlocked how many buildings
have these on them
and people don't realize many times it's
not like your office right it might just
be the front
vestibule but if i can get in if i can
leverage this access in
and find a way then i get the next step
i get the next step i ride the elevator
etc if you're keeping keys like on you
oh my god
there's a whole talk i did with howard
payne the ch-751 is like the everything
key
it's the most common key in this country
for
all kind of dumb dumb stuff every little
wafer lock
everything like steel toilet paper i
don't know what you're doing if you're
you know you
live in a trailer you need toilet paper
i'll steal it from this hotel whatever
like the ch-751 my favorite story was we
were on a job
we got into an office like a room in
this office building and there were all
these filing cabinets on the wall
and we're like i don't want to pick
every one of these open
to see which one has the valuable [ __ ]
but let's try a ch751
totally worked and it turns out every
one of them had valuable
[ __ ] it was like their hr archives going
back
years the great part and i just added
this story because kjoe gave his talk
and he talked about finding the exploit
from the last job you were on like still
on the server
we found this we showed the client we're
like boy these are really terrible
filing cabinets and you're leaving this
around in a room that we just waltzed in
so the client was like oh my god we'll
get on that we were hired seven months
later to a different office
and we got into like another room and
we're like whoa look at all these
falling cabinets
and we open them we're like are these
the same [ __ ]
well these are the same filing cabinets
they had moved them from one office
to another office but didn't actually
change them so we had the same finding
just in a different state
ch 751 all day long for maximum low
larity in the key to like
space stick 1284x
into your google engine right look some
look at some image searches you're
seeing a lot of the same
vehicle here the 1284x is the ford motor
company's fleet key
the number of crown vics and excursions
and explorers in this country
that are keyed alike to 1284x tons of
police departments in this country
will all and not even knowing it that
all of their cruisers
are the same key and what's the most
common use of a
crown vic after it's got enough use
hours and they have to kick it out of
the force
taxis they auction them off and maybe
become taxis there are cities in this
country
where the entire taxi fleet is key to
like and it's key to like to the entire
police fleet
1284x is not a restricted key it's not a
special like
this is the paper still attached to it
from home depot you get a 1284x take it
to home depot cut as many as you like
yes it will open the doors yes it will
open the glove box
yes it will open the trunk nothing
interesting in a cop's trunk right
and it's not a chipped key it's not a
key lock it's nothing like that yes
it'll start the freaking car
so if you have cop friends and we have
plenty
show them the 1284x if you get your
hands on one it might pop their eyes out
if you're curious my like everyday
keyring that sometimes people will see
me with
they say what do you actually have in
your pocket all the time well i have an
elevator key the most common elevator
key on me at all times i have the two
most common filing cabinet keys the c47
c41
c415a ch751 i definitely carry that
1284x because it's funny
right i have a couple jigglers because
why not little
tiny jigglers that we make if i can't
get through a simple shitty lock
this is my wire bridge when i'm
attacking door king in other boxes it's
just a paper clip
that i burned the insulation off the
tips and looped it around
door king key if you didn't get it
earlier is the 16 120
linear the 222343 which is sometimes
called a126
and a cuff key that is that that's my
smash right there that's like deviant's
devious key ring
giving you pearls here i don't think
i've ever shown the slide before outside
of our training so woohoo
there you go because i love you john
strand and everyone else who invited me
here
if you are not an electronic person in
fact you know
we were talking about this earlier about
where i hire people from our team
we either have people that came from the
electronic digital world
and we sort of train them up on physical
or we've pulled people who are door
kickers they're just cops and other
people
that were like hey want to make a better
salary and not be evil come come work
for us and like
we have to train those people on
electronic learn some
things about electronic access controls
learn a little bit about badge systems
it's not that hard to get you spun up we
can get you spun up in a day or two
on basic cloning and sniffing and a lot
of credential stuff
the the fact that we take long-range
readers and weaponize them bobbik our
electronics dude
changes the guts packages up a
self-contained power supply
power on this reader let it sit in a bag
you know the the idea of like very mr
robotish kind of stuff right if you've
seen that
credential grabbing scene this is real
this is about 18 inches away
credential grab out of someone's pocket
because with a nice antenna and a good
power supply
inside that backpack that reader is
going to grab that card and it's going
to work
we can talk about that later if you want
we can talk about how if you get the
reader off the wall
you can install a sniffer on the
backside of the reader
and you can sniff replay get credentials
that way there's a whole world out there
and it's not
hard if you've never done any kind of
digital electronic work like this if you
are just a door buster
this is within your grasp and i
encourage you to get kind of
cross-trained like that
a little story time for you now new
stuff i promised as i tweeted earlier
it's not i've given
versions of this talk in the past this
is all this is all new
because war stories are great and we've
heard about them from other speakers
so let me give you a few good ones most
of which if you had to distill this down
the lesson is just be confident and look
like you belong
if you've never seen this footage here
this is a robbery of a walmart
where a guy came in and said oh i'm here
from loomis i'm here for the the pickup
you know i'm the armed guard he's not
he's not the armed car guy he's wearing
a runner's vest
with like you know weights and the
tactical pants and his hats down i think
they found out later he had an airsoft
pistol
and he took 75 he's i'm here from loomis
no he got into chevy lumina
and drove away this dude another guy
keep your hat down and don't bother
anybody look i'm just here from you know
your beverage services i'm stocking your
shelves
no you're not this guy hit seven stores
in one weekend in alabama
he's just stealing beer he just went in
with a cart
loaded the thing up and just freaking
left
look like you know what you're doing and
people will tend to believe that [ __ ]
so the elevator repair story all right
we got into a building it was an
interconnect we we gassed off you know a
wreck sensor because again
you could see it on the ceiling
honeywell pir boom
gas the rec sensor get through okay
we're in the building
now we've got to go if you like where
come in we're the first time you get in
you get that like adrenaline rush
and i'm with somebody on this other job
another company we're partnered with
and this guy's like man what do we where
do we go what do we do i was like calm
down i got an idea let's come walk
find the nearest elevator we just got in
an elevator
okay why because i mocked myself up i'm
here from i've got my little otis badge
i've got my clipboard i'm an elevator
repair technician why not
you want another like great tip from me
to you this is your cover story for
being any elevator repair guy ever
have a stupid clipboard and learn these
three steps
you press that e phone somebody picks up
it's many times it's a computer if it's
a human
hello this is a test of the emergency
phone in this elevator
step two can you hear me clearly right
now
step three where am i calling from
and that last one flummoxes the hell out
of people a lot of the time because they
should be able to know where you are in
event of emergency
you will sound like a legit elevator
tech if you do that you're not really
breaking any laws you're not causing any
harm to the elevator
you can just sit there and just try
elevator you know like try elevator
phones and
just to get this dude to calm down i was
like hey just relax let's try some
e-phones man
so we're just being the elevator tax and
it turns out
the third question really flummoxed
somebody because it wasn't like a
service that went out to otis line
it was the the front desk and we wound
up consistently hitting the front desk
and like
oh is this another one of those elevator
tests yeah i i don't know where you are
though it just says extension 39
and i'm like so you can't tell me where
i'm calling from
like i mean you're in an elevator i'm
like
okay sir i'm gonna have to write down
that you uh don't know where i'm calling
from and it got them all panicked right
turns out the security guard was so
flummoxed by not knowing where the
elevator emergency was i'm like don't
worry so there's just
a test you're not at fault here we just
we just have to put this in the notes
that came into play later so while we're
in the elevator
the guy says to me he's like okay so all
we got to do is get the pwn plug and
deploy it
and oh [ __ ] oh man i didn't grab it i'm
like oh you didn't grab the phone plug
well you know the hotel's like 10
minutes away just drive back and get it
i'll stay in the building and i'll let
you back in he's like
uh okay that sounds good you're gonna
look okay i'm like dude i got my metal
clipboard like come on
who's going to mess up metal clipboard
is great because you can hide a bunch of
tulle and gear in it and like
all your stuff's in there but the better
thing about the elevator story is if you
actually watch the elevator hacking talk
we have a lot of keys that do things
well my partner was back at the hotel
which was not going well
he was like hey man i got some delays
here i'm like all right i'll just hang
out in an elevator so i just disabled an
elevator with my keys
i'm just in the elevator just hanging
out nothing i'm like reading twitter and
stuff
occasionally asking like hey how's that
going at the hotel it turns out what
happened is his usb keyboard wasn't
playing nice
with the phone plug he was hooked up to
the hotel tv
and he couldn't get the so he had to use
on-screen keyboard to like
set up all the scripts and it was taking
forever
and i'm like dude that's fine i got
twitter i'm fine i'm just sitting in an
elevator
until i almost had a heart attack
because i thought i heard someone
banging
on the elevator door because it's like
you're camping in the woods like
everything sounds loud in the woods when
you're asleep
in the i thought someone was pounding on
the elevator i was like oh my god
there's is there like a camera i didn't
see
is there a security trying to kick their
way in i'm like no calm down
it's it's 5 5 15. the cleaners are here
they're probably like
windexing the fingerprints off of the
hoistway doors like
all right calm down eventually the guy
comes back
and he's like all right let me in like
okay i go to let it it turns out it
wasn't the cleaners
turns out security had come by the
elevator not because they thought i was
in there
i had been in there so long that they
had stuck
a sign on the elevator that said
elevator out of order
do not use this elevator use other side
of building which was great because when
we came back in my buddy and i now we're
the only people in the damn building
security came down a hall of sauce saw
my otis badge
and went wow you got here fast
and i was like oh yeah i got that uh you
got that otis elite care service so like
they dispatched us out here
i'm you know doing things with keys that
because clearly the elevator's working
now that i turned it back on
but he was so thrilled he's like were
you guys doing that elevator test
earlier i was like
no that was the other team but i heard
you had some problems but
you know what the elevator dispatcher is
in this room can you let me in this room
and sir sure enough the guard just like
led us everywhere we wanted to go
because you know who wouldn't want their
elevators to run right right i'm the i'm
the helpful elevator guy
i'm getting the light on time i'll give
you i'll give you one more story i got a
couple more stories here
but how much time do you actually have
five or ten minutes five
we can do another story and a half and
five so the armed guard story is it's a
good story
most guards a crap shoot a lot of guards
are under trained a lot of guards are
third party
this was a guard desk that literally had
no one at it and one time i just sat
there i actually took the binder of keys
and key cards and just kind of like spun
around in the chair
just waiting for a guard to come up to
see i wanted to like know what the hell
they would say
and it took so long that i just got up
and left like the guard literally never
showed
arm guards are a different story they're
a little more mastered
they're a little better with interaction
and they're going to be more cautious
now this was an instance where we needed
electronic credentials
we really wanted to get in using a badge
and all the employees like we couldn't
get close to the employees at all they
were using a separate entrance so like
the vestibule was the only place we
could get in
and during the day the only people in
the vestibule were the armed guards this
was a private development space
well we know how to do credential
cloning right we have our gear we have
our long range reader
that you saw earlier right shove that in
a backpack once you power it on
shove that oh we already saw this video
shove that in a backpack
get somebody to go in just try to get
close enough you saw 18 inches or so
so when we said who's going to go in
right well what does every guard
especially armed guards kind of wish
they want to be or maybe they're trying
to be
they're trying to be cops right sending
a cop like rob's on our team rob used to
be a cop we're like just get in there
and cop it up man just talk about cop
stuff
so he goes in bobik is in the back seat
of a rental car
in the parking lot like remote onto the
reader he's like trying to check the
status of it and goes out of range
because robert goes in all the way to
the vestibule so bobbix like man i
really hope
i really hope that reader is getting
some credentials and robert's trying
everything robert's like getting close
but they're armed guards
so they keep blading off every time he
gets near them
at one point he put it like his bag on a
counter and he was like asking the guard
he's like hey is this a good restaurant
i started on yelp trying to get the
guard to like lean over the counter
wouldn't do it
so he keeps trying he keeps trying he
keeps trying getting nothing
finally at the end of the interview he's
telling cop stories right so he's
friendly with him
he's like all right well i gotta if he
stays any longer he's like this is just
weird
it's like all right fellas i gotta i
gotta go all right take it easy man it's
nice meeting you
and the last guard he just [ __ ]
surprise hugs
him and like very very kennedy he's like
make it a little weird make a little
weird all right brother all right
and gets out of there in the car
bobik is in the back seat like what did
you do i was
dying back here it's like well here
check check the logs man
bobby check dumps the creds he's like
you were in there
47 minutes and you got one read
and that was it but then who are we
we're the armed guard at that point
so getting you never know exactly what's
going to work out for you
in terms of getting in i had one other
story about you know find me in the bar
i'll tell you about uh
about some other stuff what i really
wanted to get to i'm going to quiz you
at the end here we got a little we got a
little q
a and i promise i'm wrapping it up right
so this is i hope you're paying
attention right
what kind of unit is this here door king
why'd you know that
three [ __ ] huge buttons who remembers
the door king key
16 120 key buy it buy it online
what kind of unit is this it's one of
the ones we talked about has a little
recess
lit keypad linear linear absolutely
what's the linear key
a126 or technically 222343
blurry dark picture but who is it door
king exactly three buttons
you can do this [ __ ] on google street
view
we got a building here let's zoom on in
you can't see it clearly but you see a
recessed lit keypad what do you got
you got a linear a126 key absolutely
let's look at this john over here all
right
can't see it from here but let's zoom in
and google what do you see three giant
freaking buttons door king
absolutely door king we got a lot going
on here let's let's talk about this all
right first of all we clearly got a door
king system
we're using what key is the door king
key
16 120 go buy one they're also using hit
old school [ __ ] prehistoric hid procs
so prox card two
you know they're using cloneable
credentials you know you could sniff the
back end of this
because you could pop that circuit board
open easily they've got a ton of key
boxes this was for deliveries
i don't know if that was a ch-751 but
i'm sure i tried it in there
little freaking you know kitty access
point in here what is what is this one
turns out it's also a key box it's just
a different key box so we have multiple
key boxes
we have a lock that we know the key for
we have a clone a clonable cred
there's one more thing that you can also
see in this picture
can anyone tell what i what i would look
for through the windows maybe
you could tell what elevator fixtures
they have so i know what elevator keys
i'm gonna need
so i can prep my story and i can bomb in
there
all equipped and ready to rock so keep
these kind of attacks in mind
keep physical side in mind try it out if
you think it's all about lock picking
you're not exactly right
most of the time we're just doing dumb
stuff to bypass our way in
but i love sharing this and i love
trying to give a little hope you got a
couple of pearls in this one
to make your jobs easier and your life
better and my job harder
because that's in the end that's a win
for me like i like being the guy in the
server room
but i also like telling people what they
did right and a lot of it's not hard to
do
so thank you very much for listening and
i hope you enjoyed this
you
Browse More Related Video
5.0 / 5 (0 votes)