Tactics of Physical Pen Testers

so yeah many of us have fun gigs though many of us have really fun jobs people come up to me a lot and they say oh my gosh deviant you know physical security and break it in that's your job is so cool i like it and yes i get it right like being the break-in guy is fun if you've never met me that i run a covert entry team robert bobbik and our crew of hooligans in places we shouldn't be but the funny thing people kind of romanticize this notion like yes our ops division does very dynamic door kicker stuff but for this one scene here this was a photo shoot when an article came out about what we do they were like oh yeah get some pics and get some pics in your hands right and so like i'm here picking a door now everyone has said to me i'm known as this lock picker and like maybe i've taught some of you about lock picking if you've ever seen like any of these animations that tool has on all of our slides like if you've ever learned how a lock works you saw the little pins and they they bind but they push up with a key and if i don't have a key like how do i get in the lock like i've taught about lock picking forever and everyone thinks of me as this lock picker and they say oh yes so like i'd love to have that job man like that's you know you at a door at two in the morning with those picks out i wish i could do that and get paid which again like sure that's fun and i have picked locks to get into secured spaces but this here manipulating the pins with like pick tools it's something like the ninth thing on the list of stuff we try to get into buildings and this whole talk is not this is like the last lock-picking slide in the talk because this is not a lock-picking talk i am i know hooray is what i say because i'm so tired hey you made it i'm so tired of talking about lock picking i love like i love when someone new is learning it right and if someone's never done this and they get it and it's this whoa moment that's fun but i gotta stop this illusion that we are picking lock like how many times do you pick a door you don't johnny like yeah vince and you like you don't really pick doors this this is great that's not what we do so let's talk about how physical pen testers actually get into buildings how real covert entry tends to work and how you fix almost all of it dumb right like right off the bat i have not i've legit knocked hinge pins out of doors you just bang a hinge pin out walk the door i don't care how many locks are on the door if you can walk that door away from the frame walk in this is a thing that you can do with like a nail or a nice little orange tool so you don't bust up your fingers but again like all these locks in the door what you don't see are hinges hinges are on the outside of this door this is an absolute method that gets you into places and stupid easy to fix i'm giving you like easy ones off the bat here this is a security hinge the door swings shut little peg goes in a little hole doesn't matter if you bang the hinge pins out you can't wrench that away from the door frame because the peg is in the hole like literally it puts it it puts a block from that attack if you don't want to buy new hinges and re-hang all your doors i'm huge into recommending what are called jam pins i don't sell any of this stuff like i know some of the firms that make it but like brilliant idea what are jam pins you have a conventional hinge take out these two screws replace them with jam pins take out these two screws replace them with all you just made a security hinge and you didn't rehang your door like two dollars i think brilliant kind of solutions easy easy stuff slipping latches and such like people see me like oh he's taking a tool out of his pocket he's going to open that door what's he doing i'm not taking pics out of my pocket most of the time i am doing sound by the way oh no sound we're gonna need sound who's my sound guy back there let's see anybody you hear it all right oh well well i don't know why we're not getting sound but yell the guy in the back he's not doing anything so yeah like this is a completely locked door this is a water treatment facility this is like the room where they chlorinate and prep the water for the supply and i'm not picking the lock i'm just attacking it with a little latch slipping tool you should not be able to do this on most systems right here's a door there we go is there some sound can anyone in the back turn the sound the up please there's a remote oh wow this is like dad's living room way too many buttons is that a thing is that happening i don't know whatever all right i don't care i'm gonna keep going but yeah like this little tool this little stupid hook that we've been selling in our student kits we give them to you you give them to students it's like a five dollar part and it gets through so many doors what we're doing here it's not that you can like reach the latch here's a latch you can't reach with a hook because it's got that big plate over it right get yourself a big piece of wire oops the problem is not that you can touch or can't touch the latch the problem in all these bits of footage here is that the latch is not installed properly latches in a modern environment should be what are called dead latches in fact this is a picture of a dead latch well let's talk about what is a dead latch what is not well this is the latch right this is what goes into the strike plate holds the door shut if you lean on the door the door does not pop open you might remember doors that only ever had this this is what a door used to look like long time ago and then all of a sudden you started getting this extra little button sometimes called a guard bolt sometimes called the dead latch plunger has a lot of names but that extra button that i will highlight in red here that indicates that you have a dead latch mechanism the dead latch plunger or the guard bolt many people only see it when the door is open and you know it's not always in this configuration sometimes it's next to the latch it's there's a lot of styles no matter what style you have you might not know when the door shuts that's supposed to be held back it's supposed to be pressed back into the door by the strike plate it's not supposed to pop out into the hole if that is pressed back that latch is now dead you can't hook it slip it shim it anything like that that's how this is supposed to work but the problem is door fitment if you don't have the right hardware mounting and you don't have the door hung properly we see this all the time on doors man this we've got a nice door properly locked okay this is a piece of trash literally a piece of plastic garbage shoved in boom server room look at the size of that strike plate hole you could drive a truck into that why is it so huge is this the strike plate that came with this handle set what do you think this is yes i heard it say it louder electronic strike plate this is a card reader access door so they retrofit the additional like the original plate of strike plate they put like a separate unit a solenoid powered strike and there's all different configurations of this kind of hardware we literally know integrators and installers who are like oh make sure you always get like the jp 41 that's the one with the big hole it always works no matter what door the client has it's no problem no that is not how this is supposed to work you are really undermining your security another door another water facility right nice lock i mean i'm i'm a decent enough picker i'm not going to try to pick this why not because boom bad door fitment over and over and over and like you know you don't want me in there i don't belong in this room five dollar hook gets me in when a nice lock could have prevented me if they had properly set the door up let's talk about this kind of door fitment problem you got crash bars let's just reach through you've told stories like this forever what happened there i was like talking to point of johnny right let's watch that again crash bar let's get a bent rod and just slip it through and bam hit the door right absolutely works why because weather stripping is not a security device weather stripping is not the same thing as a plate or even a movable astragal of metal if that is just rubber or that little brush material if i can slip something through and smack on that crash bar they make specially designed tools just for this here's robert one our guys on our team reaching through with a reinforced tool hitting the crash bar bam exit paddles smaller target how many times do you see glass doors glass doors are wonderful because you can see exactly what you're hitting or not hitting but going back you can barely see it's a really dark photo you can't see it here easily you can see it in the video though sometimes is this daytime or night time this what is it it's not it's like three in the morning i know it's a little bit white out here but it's it's very dark out this is a low occupancy structure at night what could they have done and not violated code they could have set the deadbolt it's right there right well this tool is there's a tool that exists for this the idea of a deadbolt again for code many of these attacks as you all know like fire code and actually egress like restrictions and allowances you have to set up doors certain ways if you have a deadbolt it probably has a thumb turn on the inside this tool exists i have it in my room this is a thumb turn flipper you stick it through the door and you go boop absolutely that like these tools are out there man they are not expensive and again like here we have a nice this is a classic california office building why because it has frameless glass doors oh my god california where the weather is so nice you don't care about insulation frameless glass doors everywhere so yes reach through with the tool the hardest part was just getting it to stop slipping off the knob was so tiny but eventually sure enough you get it on there you twit it's just like a braided cable attached to a it's not a sophisticated tool right but eventually bam well that's open post office near where i live you can see like right on the other side of the door i'm not gonna go steal a bunch of mail or anything but the gap is huge you could get through there tesla dealership of course it's california why because frameless glass doors that's why middle of the night no one around i'm not saying i wanted to uh duplicate tiger team like steal a car but absolutely like frameless glass doors boom thumb turns that's the only thing preventing anyone from getting in here and the gap is like a half inch wide talk about another gap problem here's a locked door there's some noise and then dr tran comes through like ninja in a cloud of smoke what happened there many of you know this one already i hope this is a lab where we do a lot of prototyping and we just show like bobbik in the hat just showed ross and ross is like hey building owner evan come here i want to show you this thing i just learned so you'll see he's trying to do something with a tool up in the time bobbit says no reposition it a little bit out here and look through the glass you'll see the same thing you'll see this sort of cloud of vapor and all of a sudden this locked door is no longer locked yay well who knows what government there's a very restricted government tool that they're using i don't know if you can get it like talk to someone you know who's kind of spooky you can find out how to order this it comes with a one-page idiot proof government instruction manual that says hold tool like this so all you're doing if you invert one of these spray dusters you're boiling off that r134a essentially is what's in there and you're creating this cold gas cloud what's actually tripping many doors have sensors on the inside especially electronic lock doors they are called request to exit sensor if you have a system where you badge in but you don't have to badge out you just walk to the door and just open it you might not realize you have a request to exit sensor you have most of the time a simple passive thermal sensor it's not the only technology out there it's far and away the most common one and if you can get that sensor to trip in this case just by blowing a cloud of gas through the door the door unlocks these are old tricks you should know them dave if you saw his keynote this morning dave did he's a big you know vape guy he's a big ecig guy oh yes so he and ben 10 recorded this is one of the best videos ever of it so like i don't know if you sub ohm your coils or something because he makes this amazing cloud through there but he's just listening to hear that solenoid he's listening to hear it trigger and when he knows that electromagnet is done bam door's unlocked boom now unlocked yeah chris up here i think is the he was like hey dave you should try this on that door this is totally at we don't where we eat right yeah this was this this was the dirty derby class yeah yeah and like i think eventually people other people kept trying it until the point where there was staff in that because it's like a staff area and staff was like what's the smoke coming through the door are they like freaking out i don't smoke uh i do drink too much my wife caught this video once we're walking home from like a bar this was late at night this is a bank the bank is closed but i'm like well there is a wreck sensor up there and i had just kind of walked out of a bar with a drink so i just spit that through the door and like that works so yeah man passive infrared doesn't understand hot cold it just says different oh different must be a human this one up top here the honeywell passive infrared sensor i guarantee you've seen it or you've seen it rebranded and re-badged as somebody else's almost always white sometimes you see them in black or beige you will see that everywhere all over the place and why are they calibrated this way well you don't want someone with a bunch of boxes to like bang into the door and fall over these are tuned and the installers mount them in a way to get the most wide spectrum hit because they don't want to be called out repeatedly hey the rec sensor's not working it's not picking us up it's causing you know mary just fell down with her cane and her walker the installer doesn't want that installers and integrators want to always have these things trip so you're going to see that on a lot of doors because it's got really good coverage and you're going to always see it open the door what is this on the bottom though that's your solution ge is the only one i've ever seen that reasonably brings to market a dual technology rec sensor yes it does passive infrared it also does microwave radar so it has to see some temperature change and it also has to see something vaguely human-sized coming vaguely toward the door we knew like um tr a hacktrust hector zo9val val actually she'll put balloons through doors and blow them up and let them go because the old trick with the pirs you usually just put them further away from the door you just put them down the hall and you know if i'm trying to gas the dog i'm not hitting it so her solution for that was like like send balloons like blowing down the hall to try to trip them ge's product will stop that i don't work for ge i'm not here shilling for like mubics and his buddies moving still with ge i don't know no all right but yeah it's the only dual technology sensor that i've ever seen that's good for this also code let's talk about door handles when's the last time you've seen a door knob like in an office you don't because if someone like has reduced grip and tactile function or what if someone doesn't have a hand they need to be able to get in and out of the building especially in emergencies lever style door handles are are the norm now well inside i mean you see the front one facing me that's locked and has a you know shitty little hid prox reader on the inside there's also a lever handle which many times that's going to be the case there are tools like this that exist this is an under door tool i'm doing a little show with a guy named tyler gray he's like well show me this tool and his cameraman is like how would you get in here and they expected me to do something at the door they didn't realize i just knelt down and kind of banged the door open and actually it's one of the cameraman was like can you do that like again like slower that was way too fast i didn't understand what was happening well these are actual tools that we use on jobs what we're doing with this tool it's called an under door tool we're reaching a rod under the door and because modern doors have those lever style handles they're really really trivial to grab that handle and hit it on the inside i'll show you a picture from flipped around in a second this is robert middle of the night getting into a server room you know people see this video and they thought they see him crouched down like oh he's going to unscrew like with a multi-tool to get through that crawl through the grate no he's not he's going to lean his head into the door and just push it open because on the inside we're just swinging a rod pulling down on a line and yanking this handle absolutely works because when's the last time you've been in the server room and had to badge out some some real secure facilities maybe most of the time you hit the handle and you leave there are solutions for this there are what are called dynamic door bottoms this little animation shows you a black plunger if this black plunger gets pushed in what happens you'll see this bottom bar drops down so when the door shuts that bar drops down now this is not a security product this is like a heating and cooling insulation product but the same principle applies to much more robust models so a company called pemco p-e-m-k-o pemco makes the door bottom now they're sold by assa abloy big contoured floor plate interlocks in this metal bar and unless that plunger is relieved of its pressure that door bottom is dropped down you're not getting a tool underneath the door now you might get something over the door this is a video from utah a buddy of ours named the infosec pope he loves demoing this all he uses is 35 millimeter film for the young kids of the room film is what we used to take photographs with but he literally just feeds a bow of film over the door walks it over to the handle and then pulls and you might not do this as a user but if you pull up on a handle it's usually going to open the door so pull bam that door is open and i i mean pemko makes the door bottom i've never seen anyone sell the door topper so like what do you actually do to prevent this problem well consider a shroud i was one time working an underdoor tool in this one job and i'm like god damn it i've like radioed to robert like robert get in here can you and robert's trying he's like son of a bobbitt comes around from another building and he throws a boar scope under the door and we're like oh crap what is that and eventually like with the borescope we could kind of see and shove the wiggle the tool we got it open and i asked the client i was like man that one door gave us freaking hell where did you get these things that you installed in the server room and they're like ah they were like on the building when we got here i don't know what that this used to be like a storeroom or something these are like ingrainger catalogs these are so carts don't crash into door handles when you they're just shrouds for like protecting the door handle not for like security they're just so you don't bang into it with stuff brilliant no money solution if you've ever been in a hotel and you've seen the door handle mounted like down who's seen this before hotels know about this man hotels have had break-ins with under door tools they mount these handles down for a reason this is one of my favorite pictures render man sent me this and i've started to see hotels and other doors with these like little clips i was like i stayed in a hotel once for like a week in san francisco on this job and you know talking to the staff late at night hanging out and i'm like hey so i got i got to ask you the freaking clip thing that looks very out of place on the doors is that like un under door tools and the guy was like oh yeah we have people breaking into rooms and stuff we i was like i gotta know where you get these my clients could rip because i could that would be a nightmare trying to get an underdoor over door attack he's like well you know the closet in your bedroom with the the sliding doors yeah these are just those little feet that like you put in the carpet on slide like literally at home depot four dollars if you don't care that it looks a little weird put these on your server room door man it will completely frustrate the hell out of me so i love this kind of thinking i love weird and hilarious ways of getting in and i've got just i just i'm guessing this crowd i added some funny right like stealing keys you think we're above steel just outright stealing stuff this was the security cart on a facility once we just found it and i was on a job with a guy i was actually subbed in on a job had every f and key like everything all over the building and of course like yes we still i'm not gonna i guess we're allowed to say jay wouldn't mind i'm not gonna say who it was but like eventually we just stole the cart and just drove it around because if you get to that point i mean you don't want jobs where you're like you've gotten everything and there's still time and you call the client and you're like so we're in every they haven't stopped us do you want to start doing stupid and the client's like yeah just push it so yeah we literally took this little golf carty thing and drove it around the parking lot until it ran out of juice and we're like puttering back at like no miles per hour just to try to get it back to where we left it so it looked really and we're not in uniform no one stopped us but i love that like all the keys were there lock boxes oh my god talk about stealing keys stealing keys from a lock box these show up on a ton of buildings possibly your buildings if you have con if you have infrastructure like cell towers and stuff on high buildings and other contractors are coming in to service that gear i bet you there's lock boxes somewhere that you might not even know about tunnelers one two three four five six seven different people have to get into this building i can't even think of that many cable and wireless providers i don't know what's going on here these kind of boxes oh my god telephony boxes right this i just throw in because mostly you know chris knows this guy in this slide you guys dennis like dennis is a good cat right dennis is standing next to a lanier access control box i am standing next to another brand called door king let's talk about these two big players in the industry just because this is stuff that's not usually in my slide deck i just had to throw you some fun right most of the stuff that cracks me up when it comes to stealing the key like i don't even think it counts as stealing in the instance of like linear you got this nice lit up keypad you got the little w grill linear boxes all have the same key it used to be called the a126 key it's not really it's the 222343 key but if you google like linear key or linear two two two three four three or linear a126 you'll get this key it's the same key on all the freaking panels it's not a restricted key or an expensive key but it lets you do crap like this so here we have a locked door now my wife is going to enter through a different technique beep whoops this is actually the apartment where we stuck marcus hutchins while he was waiting for trial so we only got one key fob we cloned it to her hand so she could come and go and have an extra key but now i don't have a you know the key fob the door is locked so what can i do well linear boxes are all key to like a126 key there's a little momentary switch and just boom flip the relay so that works same key on all these boxes man absolutely so yeah door king the one i'm standing next to here i personally think door king has even more market penetration do they have the same key yes they do the 16 120 key it's been the door king key i think since 1992 and it's never like i go to trade shows i go to like the trade shows with all this gear and the door king booth is huge and i take i just walk around like use my key just open stuff and just walk away every few hours just walk by the boot this was like a giant parking gate arm like a huge crash barrier thing and it's again 16 120 key they're all the same key door king systems let's let's dive into this for a moment here we got a lot going on here all right you can always always always tell a door king system boom boom boom a-z call those three huge buttons you'll spot them a mile away now there's not just that we have a we clearly have hid procs going on here we'll talk about electronic credentials but let's get right into it all right let's use our 16 120 key look at all these electronicals well there's a lot of stuff going on in there we got a big bank of connections here what's going on in this terminal block well punch in doorking manual.pete file type pdf in google you get a big manual with this on one of the pages what's the most giant writing you see on this page relay one relay two those are the door relays right there they're just dry contacts on the freaking panel so if you have like door relay one either normally open or normally closed you can just bridge that circuit and like boom fire the relay open the door fire relay 2 open that door so in this case do you see how this is wired by the way you can see one common and you can see what normally open so that tells you this is probably a solenoid powered door lock so normally there's no power put power just literally by bridging that with a piece of wire the door suddenly is open there's another useful feature however if you don't want to like carry around wire and i'll show you what i carry around way up top let's look at this psw function what is psw it's postal switch a closure between these terminals and the common will cause whatever relays are set up however they're set up to fire how does this normally work in fact is the postal switch wired up yes it is it's right there a little white and a little blue a little white and blue that come down you've got these two beam connectors and they come somewhere else let's look all the way down in the front amazingly low tech this is the postal switch right here it's literally just a momentary and on the front of the panel you'll see they they have these knockouts that you can just bang out a piece of metal and install your own lock and the tail piece of that lock just comes around and hits the momentary switch many many door kings are installed this way so we got a locked door now of course you know we could clone the hid prox we could install a sniffer or whatever we want we don't really care what lock they're using for the postal switch because it could be a good lock it could be a bad lock i don't give a damn because i have the 16 120 key oh no oh laptop don't do things that laptops sometimes do you're killing me who's phoning my laptop so ultimately here hopefully we can get it to play because it's really hilarious this is outside of like romer's apartment i think we're in town for band practice and you know we called him up he wasn't answering like try shaggy he wasn't answering and i was like do you want me to just let us in so you know we walked inside so you know we have this postal switch let's see if my 16 120 key works if our video plays nice here we go momentary switch fires doors unlocked how many buildings have these on them and people don't realize many times it's not like your office right it might just be the front vestibule but if i can get in if i can leverage this access in and find a way then i get the next step i get the next step i ride the elevator etc if you're keeping keys like on you oh my god there's a whole talk i did with howard payne the ch-751 is like the everything key it's the most common key in this country for all kind of dumb dumb stuff every little wafer lock everything like steel toilet paper i don't know what you're doing if you're you know you live in a trailer you need toilet paper i'll steal it from this hotel whatever like the ch-751 my favorite story was we were on a job we got into an office like a room in this office building and there were all these filing cabinets on the wall and we're like i don't want to pick every one of these open to see which one has the valuable but let's try a ch751 totally worked and it turns out every one of them had valuable it was like their hr archives going back years the great part and i just added this story because kjoe gave his talk and he talked about finding the exploit from the last job you were on like still on the server we found this we showed the client we're like boy these are really terrible filing cabinets and you're leaving this around in a room that we just waltzed in so the client was like oh my god we'll get on that we were hired seven months later to a different office and we got into like another room and we're like whoa look at all these falling cabinets and we open them we're like are these the same well these are the same filing cabinets they had moved them from one office to another office but didn't actually change them so we had the same finding just in a different state ch 751 all day long for maximum low larity in the key to like space stick 1284x into your google engine right look some look at some image searches you're seeing a lot of the same vehicle here the 1284x is the ford motor company's fleet key the number of crown vics and excursions and explorers in this country that are keyed alike to 1284x tons of police departments in this country will all and not even knowing it that all of their cruisers are the same key and what's the most common use of a crown vic after it's got enough use hours and they have to kick it out of the force taxis they auction them off and maybe become taxis there are cities in this country where the entire taxi fleet is key to like and it's key to like to the entire police fleet 1284x is not a restricted key it's not a special like this is the paper still attached to it from home depot you get a 1284x take it to home depot cut as many as you like yes it will open the doors yes it will open the glove box yes it will open the trunk nothing interesting in a cop's trunk right and it's not a chipped key it's not a key lock it's nothing like that yes it'll start the freaking car so if you have cop friends and we have plenty show them the 1284x if you get your hands on one it might pop their eyes out if you're curious my like everyday keyring that sometimes people will see me with they say what do you actually have in your pocket all the time well i have an elevator key the most common elevator key on me at all times i have the two most common filing cabinet keys the c47 c41 c415a ch751 i definitely carry that 1284x because it's funny right i have a couple jigglers because why not little tiny jigglers that we make if i can't get through a simple shitty lock this is my wire bridge when i'm attacking door king in other boxes it's just a paper clip that i burned the insulation off the tips and looped it around door king key if you didn't get it earlier is the 16 120 linear the 222343 which is sometimes called a126 and a cuff key that is that that's my smash right there that's like deviant's devious key ring giving you pearls here i don't think i've ever shown the slide before outside of our training so woohoo there you go because i love you john strand and everyone else who invited me here if you are not an electronic person in fact you know we were talking about this earlier about where i hire people from our team we either have people that came from the electronic digital world and we sort of train them up on physical or we've pulled people who are door kickers they're just cops and other people that were like hey want to make a better salary and not be evil come come work for us and like we have to train those people on electronic learn some things about electronic access controls learn a little bit about badge systems it's not that hard to get you spun up we can get you spun up in a day or two on basic cloning and sniffing and a lot of credential stuff the the fact that we take long-range readers and weaponize them bobbik our electronics dude changes the guts packages up a self-contained power supply power on this reader let it sit in a bag you know the the idea of like very mr robotish kind of stuff right if you've seen that credential grabbing scene this is real this is about 18 inches away credential grab out of someone's pocket because with a nice antenna and a good power supply inside that backpack that reader is going to grab that card and it's going to work we can talk about that later if you want we can talk about how if you get the reader off the wall you can install a sniffer on the backside of the reader and you can sniff replay get credentials that way there's a whole world out there and it's not hard if you've never done any kind of digital electronic work like this if you are just a door buster this is within your grasp and i encourage you to get kind of cross-trained like that a little story time for you now new stuff i promised as i tweeted earlier it's not i've given versions of this talk in the past this is all this is all new because war stories are great and we've heard about them from other speakers so let me give you a few good ones most of which if you had to distill this down the lesson is just be confident and look like you belong if you've never seen this footage here this is a robbery of a walmart where a guy came in and said oh i'm here from loomis i'm here for the the pickup you know i'm the armed guard he's not he's not the armed car guy he's wearing a runner's vest with like you know weights and the tactical pants and his hats down i think they found out later he had an airsoft pistol and he took 75 he's i'm here from loomis no he got into chevy lumina and drove away this dude another guy keep your hat down and don't bother anybody look i'm just here from you know your beverage services i'm stocking your shelves no you're not this guy hit seven stores in one weekend in alabama he's just stealing beer he just went in with a cart loaded the thing up and just freaking left look like you know what you're doing and people will tend to believe that so the elevator repair story all right we got into a building it was an interconnect we we gassed off you know a wreck sensor because again you could see it on the ceiling honeywell pir boom gas the rec sensor get through okay we're in the building now we've got to go if you like where come in we're the first time you get in you get that like adrenaline rush and i'm with somebody on this other job another company we're partnered with and this guy's like man what do we where do we go what do we do i was like calm down i got an idea let's come walk find the nearest elevator we just got in an elevator okay why because i mocked myself up i'm here from i've got my little otis badge i've got my clipboard i'm an elevator repair technician why not you want another like great tip from me to you this is your cover story for being any elevator repair guy ever have a stupid clipboard and learn these three steps you press that e phone somebody picks up it's many times it's a computer if it's a human hello this is a test of the emergency phone in this elevator step two can you hear me clearly right now step three where am i calling from and that last one flummoxes the hell out of people a lot of the time because they should be able to know where you are in event of emergency you will sound like a legit elevator tech if you do that you're not really breaking any laws you're not causing any harm to the elevator you can just sit there and just try elevator you know like try elevator phones and just to get this dude to calm down i was like hey just relax let's try some e-phones man so we're just being the elevator tax and it turns out the third question really flummoxed somebody because it wasn't like a service that went out to otis line it was the the front desk and we wound up consistently hitting the front desk and like oh is this another one of those elevator tests yeah i i don't know where you are though it just says extension 39 and i'm like so you can't tell me where i'm calling from like i mean you're in an elevator i'm like okay sir i'm gonna have to write down that you uh don't know where i'm calling from and it got them all panicked right turns out the security guard was so flummoxed by not knowing where the elevator emergency was i'm like don't worry so there's just a test you're not at fault here we just we just have to put this in the notes that came into play later so while we're in the elevator the guy says to me he's like okay so all we got to do is get the pwn plug and deploy it and oh oh man i didn't grab it i'm like oh you didn't grab the phone plug well you know the hotel's like 10 minutes away just drive back and get it i'll stay in the building and i'll let you back in he's like uh okay that sounds good you're gonna look okay i'm like dude i got my metal clipboard like come on who's going to mess up metal clipboard is great because you can hide a bunch of tulle and gear in it and like all your stuff's in there but the better thing about the elevator story is if you actually watch the elevator hacking talk we have a lot of keys that do things well my partner was back at the hotel which was not going well he was like hey man i got some delays here i'm like all right i'll just hang out in an elevator so i just disabled an elevator with my keys i'm just in the elevator just hanging out nothing i'm like reading twitter and stuff occasionally asking like hey how's that going at the hotel it turns out what happened is his usb keyboard wasn't playing nice with the phone plug he was hooked up to the hotel tv and he couldn't get the so he had to use on-screen keyboard to like set up all the scripts and it was taking forever and i'm like dude that's fine i got twitter i'm fine i'm just sitting in an elevator until i almost had a heart attack because i thought i heard someone banging on the elevator door because it's like you're camping in the woods like everything sounds loud in the woods when you're asleep in the i thought someone was pounding on the elevator i was like oh my god there's is there like a camera i didn't see is there a security trying to kick their way in i'm like no calm down it's it's 5 5 15. the cleaners are here they're probably like windexing the fingerprints off of the hoistway doors like all right calm down eventually the guy comes back and he's like all right let me in like okay i go to let it it turns out it wasn't the cleaners turns out security had come by the elevator not because they thought i was in there i had been in there so long that they had stuck a sign on the elevator that said elevator out of order do not use this elevator use other side of building which was great because when we came back in my buddy and i now we're the only people in the damn building security came down a hall of sauce saw my otis badge and went wow you got here fast and i was like oh yeah i got that uh you got that otis elite care service so like they dispatched us out here i'm you know doing things with keys that because clearly the elevator's working now that i turned it back on but he was so thrilled he's like were you guys doing that elevator test earlier i was like no that was the other team but i heard you had some problems but you know what the elevator dispatcher is in this room can you let me in this room and sir sure enough the guard just like led us everywhere we wanted to go because you know who wouldn't want their elevators to run right right i'm the i'm the helpful elevator guy i'm getting the light on time i'll give you i'll give you one more story i got a couple more stories here but how much time do you actually have five or ten minutes five we can do another story and a half and five so the armed guard story is it's a good story most guards a crap shoot a lot of guards are under trained a lot of guards are third party this was a guard desk that literally had no one at it and one time i just sat there i actually took the binder of keys and key cards and just kind of like spun around in the chair just waiting for a guard to come up to see i wanted to like know what the hell they would say and it took so long that i just got up and left like the guard literally never showed arm guards are a different story they're a little more mastered they're a little better with interaction and they're going to be more cautious now this was an instance where we needed electronic credentials we really wanted to get in using a badge and all the employees like we couldn't get close to the employees at all they were using a separate entrance so like the vestibule was the only place we could get in and during the day the only people in the vestibule were the armed guards this was a private development space well we know how to do credential cloning right we have our gear we have our long range reader that you saw earlier right shove that in a backpack once you power it on shove that oh we already saw this video shove that in a backpack get somebody to go in just try to get close enough you saw 18 inches or so so when we said who's going to go in right well what does every guard especially armed guards kind of wish they want to be or maybe they're trying to be they're trying to be cops right sending a cop like rob's on our team rob used to be a cop we're like just get in there and cop it up man just talk about cop stuff so he goes in bobik is in the back seat of a rental car in the parking lot like remote onto the reader he's like trying to check the status of it and goes out of range because robert goes in all the way to the vestibule so bobbix like man i really hope i really hope that reader is getting some credentials and robert's trying everything robert's like getting close but they're armed guards so they keep blading off every time he gets near them at one point he put it like his bag on a counter and he was like asking the guard he's like hey is this a good restaurant i started on yelp trying to get the guard to like lean over the counter wouldn't do it so he keeps trying he keeps trying he keeps trying getting nothing finally at the end of the interview he's telling cop stories right so he's friendly with him he's like all right well i gotta if he stays any longer he's like this is just weird it's like all right fellas i gotta i gotta go all right take it easy man it's nice meeting you and the last guard he just surprise hugs him and like very very kennedy he's like make it a little weird make a little weird all right brother all right and gets out of there in the car bobik is in the back seat like what did you do i was dying back here it's like well here check check the logs man bobby check dumps the creds he's like you were in there 47 minutes and you got one read and that was it but then who are we we're the armed guard at that point so getting you never know exactly what's going to work out for you in terms of getting in i had one other story about you know find me in the bar i'll tell you about uh about some other stuff what i really wanted to get to i'm going to quiz you at the end here we got a little we got a little q a and i promise i'm wrapping it up right so this is i hope you're paying attention right what kind of unit is this here door king why'd you know that three huge buttons who remembers the door king key 16 120 key buy it buy it online what kind of unit is this it's one of the ones we talked about has a little recess lit keypad linear linear absolutely what's the linear key a126 or technically 222343 blurry dark picture but who is it door king exactly three buttons you can do this on google street view we got a building here let's zoom on in you can't see it clearly but you see a recessed lit keypad what do you got you got a linear a126 key absolutely let's look at this john over here all right can't see it from here but let's zoom in and google what do you see three giant freaking buttons door king absolutely door king we got a lot going on here let's let's talk about this all right first of all we clearly got a door king system we're using what key is the door king key 16 120 go buy one they're also using hit old school prehistoric hid procs so prox card two you know they're using cloneable credentials you know you could sniff the back end of this because you could pop that circuit board open easily they've got a ton of key boxes this was for deliveries i don't know if that was a ch-751 but i'm sure i tried it in there little freaking you know kitty access point in here what is what is this one turns out it's also a key box it's just a different key box so we have multiple key boxes we have a lock that we know the key for we have a clone a clonable cred there's one more thing that you can also see in this picture can anyone tell what i what i would look for through the windows maybe you could tell what elevator fixtures they have so i know what elevator keys i'm gonna need so i can prep my story and i can bomb in there all equipped and ready to rock so keep these kind of attacks in mind keep physical side in mind try it out if you think it's all about lock picking you're not exactly right most of the time we're just doing dumb stuff to bypass our way in but i love sharing this and i love trying to give a little hope you got a couple of pearls in this one to make your jobs easier and your life better and my job harder because that's in the end that's a win for me like i like being the guy in the server room but i also like telling people what they did right and a lot of it's not hard to do so thank you very much for listening and i hope you enjoyed this you

Channel: freeCodeCamp Talks

Views: 17,972

Rating: 4.968051 out of 5

Keywords:

Id: VJ4FDOw9NcI

Length: 44min 16sec (2656 seconds)

Published: Tue Sep 22 2020