Escolar Documentos
Profissional Documentos
Cultura Documentos
Deviant Ollam
– Physical Penetration Tester
– Red Teamer
– Lockpicker
– Liquor of Choice: Lagavulin
Howard Payne
– Elevator Consultant & Inspector
– Non-Union
– Boardwalk Badass
– Liquor of Choice: American Adjunct Lager
http://enterthecore.net
Who Are We ?
Deviant Ollam
– Physical Penetration Tester
– Red Teamer
– Lockpicker
– Liquor of Choice: Lagavulin
Howard Payne
– Elevator Consultant & Inspector
– Non-Union
– Boardwalk Badass
– Liquor of Choice: American Adjunct Lager
http://enterthecore.net
WARNING!
If Used Properly Elevators are Incredibly Safe –
http://enterthecore.net
If Used Properly Elevators are Incredibly Safe –
http://enterthecore.net
If Used Properly Elevators are Incredibly Safe –
http://enterthecore.net
Warning – Dying is Not Good
http://enterthecore.net
Warning – Damage is Not Good
http://enterthecore.net
Warning – Damage is Not Good
http://enterthecore.net
Warning – Damage is Not Good
http://enterthecore.net
Warning – We’re Professionals
http://enterthecore.net
INTRODUCTION TO
ELEVATORS
Terms & Technology – Traction vs Hydro
http://enterthecore.net
Terms & Technology – The Elevator Cab
http://enterthecore.net
Terms & Technology – The Elevator Cab
http://enterthecore.net
Terms & Technology – Rails & Rollers
http://enterthecore.net
Terms & Technology – Rails & Rollers
http://enterthecore.net
Terms & Technology – Fixtures
Position Indicator
Hall Stations
http://enterthecore.net
Terms & Technology – Motor Room
http://enterthecore.net
Terms & Technology – Motor Room (Hydraulic)
http://enterthecore.net
Terms & Technology – No Motor Room
http://enterthecore.net
Terms & Technology – Controller
http://enterthecore.net
Terms & Technology – Controller
http://enterthecore.net
Limit Switches
http://enterthecore.net
Velocity Detection
http://enterthecore.net
Safety Mechanisms – Overspeed Brake
http://enterthecore.net
Safety Mechanisms – Governor (to Trigger Safeties)
http://enterthecore.net
Safety Mechanisms – Rail Gripper Safety
http://enterthecore.net
Safety Mechanisms – Modern Rail Gripper Safety
http://enterthecore.net
Safety Mechanisms – Modern Rail Gripper Safety
http://enterthecore.net
Safety Mechanisms – Modern Rail Gripper Safety
http://enterthecore.net
Safety Mechanisms – Modern Rail Gripper Safety
http://enterthecore.net
Safety Mechanisms – Modern Rail Gripper Safety
http://enterthecore.net
Safety Mechanisms – Modern Rail Gripper Safety
http://enterthecore.net
Safety Mechanisms – If All Else Fails… There’s the Buffer
http://enterthecore.net
Elevators Want To Keep You Alive
http://enterthecore.net
Elevators on Automatic Mode Do Their Job Well Everyday
http://enterthecore.net
…Unless You’re on the Car Top, Derpface
http://enterthecore.net
SPECIAL MODES OF
OPERATION
Independent Service
http://enterthecore.net
Independent Service
http://enterthecore.net
Independent Service
http://enterthecore.net
Attendant Service
http://enterthecore.net
Attendant Service
http://enterthecore.net
Attendant Service
http://enterthecore.net
Express / Executive / VIP service
http://enterthecore.net
Sabbath Mode
http://enterthecore.net
Sabbath Mode
http://enterthecore.net
Sabbath Mode
http://enterthecore.net
Sabbath Mode
http://enterthecore.net
Load Bypass
http://enterthecore.net
Load Bypass
http://enterthecore.net
Anti Nuisance / No Passenger
http://enterthecore.net
Anti Nuisance / No Passenger
http://enterthecore.net
Up Peak / Down Peak
http://enterthecore.net
Riot Mode
http://enterthecore.net
Seismic Mode
http://enterthecore.net
Code Blue
http://enterthecore.net
Code Blue
http://enterthecore.net
Code Blue
http://enterthecore.net
Code Pink
http://enterthecore.net
Code Pink
http://enterthecore.net
Security Recall
http://enterthecore.net
Security Recall
http://enterthecore.net
Security Service
http://enterthecore.net
Security Service
http://enterthecore.net
Fire Service
http://enterthecore.net
Hoistway Inspection
http://enterthecore.net
Hoistway Inspection
http://enterthecore.net
Hoistway Inspection
http://enterthecore.net
ELEVATOR SECURITY
(HOW IT’S ATTEMPTED)
Disabled Hall Call Buttons
http://enterthecore.net
No Hall Call Buttons
http://enterthecore.net
Keycard to Register Hall Call
http://enterthecore.net
Floor Cutouts
http://enterthecore.net
Floor Cutouts
http://enterthecore.net
Floor Cutouts
http://enterthecore.net
Floor Cutouts
not code
compliant!
http://enterthecore.net
Floor Cutouts
http://enterthecore.net
Floor Cutouts
http://enterthecore.net
Badge Systems
http://enterthecore.net
Physically Securing the Elevator Area
http://enterthecore.net
Physically Securing the Elevator Area
http://enterthecore.net
Think of Elevators like Stairwells… but Sometimes Even Worse
http://enterthecore.net
ELEVATOR SECURITY
(HOW IT’S SUBVERTED)
When There Are No Hall Call Buttons
http://enterthecore.net
When There Are No Hall Call Buttons
http://enterthecore.net
When There Are No Hall Call Buttons
http://enterthecore.net
Key Switches
http://enterthecore.net
Key Switches
http://enterthecore.net
Key Switches
http://enterthecore.net
Key Switches
http://enterthecore.net
Key Switches
http://enterthecore.net
Welcome To the Kingdom of Keys!
Welcome To the Kingdom of Keys!
Keys & Fixtures
Brands of Elevator Brands of Fixtures
• Otis • G.A.L.
• Cemco • EPCO
• ThyssenKrupp • Innovation
• Dover
• US Elevator • Adams
• KONE • Monitor / Janus
• Montgomery • CJ Anderson
• Armor • P.T.L.
• Schindler • MAD
• Westinghouse
• O. Thompson
• Payne
http://enterthecore.net
Keys & Fixtures
http://enterthecore.net
Keys & Fixtures
http://enterthecore.net
Keys & Fixtures
http://enterthecore.net
Keys & Fixtures
http://enterthecore.net
Keys & Fixtures
http://enterthecore.net
Keys & Fixtures
http://enterthecore.net
Keys & Fixtures
http://enterthecore.net
Keys & Fixtures
http://enterthecore.net
Keys & Fixtures
http://enterthecore.net
Keys & Fixtures
http://enterthecore.net
Keys & Fixtures
http://enterthecore.net
Key Suppliers
http://enterthecore.net
Key Suppliers
http://enterthecore.net
Key Suppliers
http://enterthecore.net
Key Suppliers
http://enterthecore.net
Key Suppliers
http://enterthecore.net
Key Suppliers
http://enterthecore.net
Key Suppliers
VS.
http://enterthecore.net
Key Suppliers
VS.
http://enterthecore.net
The Industry is WAY Behind the Times on Security
http://enterthecore.net
The Industry is WAY Behind the Times on Security
http://enterthecore.net
The Industry is WAY Behind the Times on Security
http://enterthecore.net
The Industry is WAY Behind the Times on Security
http://enterthecore.net
The Industry is WAY Behind the Times on Security
http://enterthecore.net
The Industry is WAY Behind the Times on Security
http://enterthecore.net
The Industry is WAY Behind the Times on Security
http://enterthecore.net
The Industry is WAY Behind the Times on Security
http://enterthecore.net
The Industry is WAY Behind the Times on Security
http://enterthecore.net
The Industry is WAY Behind the Times on Security
http://enterthecore.net
The Industry is WAY Behind the Times on Security
http://enterthecore.net
The Industry is WAY Behind the Times on Security
http://enterthecore.net
The Industry is WAY Behind the Times on Security
http://enterthecore.net
The Industry is WAY Behind the Times on Security
http://enterthecore.net
The Industry is WAY Behind the Times on Security
The key switches required by 2.27.2 through 2.27.5 for all elevators in a building shall be operable by the
same key. The keys shall be Group 3 Security (see 8.1). There shall be a key for each switch provided. These
keys shall be kept on the premises in a location readily accessible to firefighters and emergency
personnel, but not where they are available to the public.
This key shall be of a tubular, 7 pin, style 137 construction and shall have a bitting code of 6143521. The key
shall be coded "FEO-K1.“
The possession of the "FEO-K1“ key shall be limited to elevator personnel, emergency personnel, and elevator
equipment manufacturers. Where provided, a lock box, including its lock and other components, shall conform
to the requirements of UL 1037 (see Part 9).
NOTE (2.27.8): Local authorities may specify additional requirements for a uniform keyed lock box and its
location to contain the necessary keys.
http://enterthecore.net
It’s All Naked on the Inside
http://enterthecore.net
Unsecured Car Panels
http://enterthecore.net
What About Keycard Systems?
http://enterthecore.net
What About Keycard Systems?
http://enterthecore.net
Exploiting Keycards
http://enterthecore.net
So What Do Pen Testers Do?
Independent Service
http://enterthecore.net
And Sometimes Fire Service
http://enterthecore.net
Fire Service
http://enterthecore.net
Fire Service
http://enterthecore.net
Fire Service
“The Post published pictures of the fire service keys only after checking with locksmiths who said duplicates
could not be made without the originals in hand.” http://nypost.com/2012/10/01/lock-away-these-nyc-keys
http://enterthecore.net
Fire Service
Brad Bowers – How To Own A Building: Exploiting the Physical World With BACnet (ShmooCon 2013)
http://www.youtube.com/watch?v=d3jtmv6Y9uk
http://enterthecore.net
Hoistway Access
http://enterthecore.net
Hoistway Access
http://enterthecore.net
Escutcheon Holes
http://enterthecore.net
Door Releases
http://enterthecore.net
Escutcheon Holes
http://enterthecore.net
“It’s in that place where I put that thing that time.”
http://enterthecore.net
Escutcheon Locks
http://enterthecore.net
Escutcheon Locks
http://enterthecore.net
Escutcheon Locks
http://enterthecore.net
Escutcheon Locks
http://enterthecore.net
Escutcheon Locks
http://enterthecore.net
Escutcheon Locks
http://enterthecore.net
Escutcheon Locks
http://enterthecore.net
Escutcheon Locks
http://enterthecore.net
Escutcheon Locks
http://enterthecore.net
Escutcheon Locks
http://enterthecore.net
Escutcheon Locks
http://enterthecore.net
Machine Room Access
http://enterthecore.net
Machine Room
A Fair Analogy
http://enterthecore.net
Machine Room – Direct Operation via the Controller
http://enterthecore.net
Machine Room – Direct Operation via the Controller
http://enterthecore.net
Machine Room – Hacking & Manipulating the Controller
http://enterthecore.net
Machine Room – Hacking & Manipulating the Controller
http://enterthecore.net
Machine Room – Hacking & Manipulating (5-Year Test)
http://enterthecore.net
Machine Room – Hacking & Manipulating is Dangerous!
http://enterthecore.net
How POTUS Rolls
http://enterthecore.net
ELEVATOR PHREAKING
Emergency Phones in Elevators
http://enterthecore.net
Emergency Phones in Elevators
http://enterthecore.net
Emergency Phones in Elevators
http://enterthecore.net
Emergency Phones in Elevators
http://enterthecore.net
Emergency Phones in Elevators
http://enterthecore.net
Emergency Phones in Elevators
http://enterthecore.net
Emergency Phones in Elevators
http://enterthecore.net
Emergency Phones in Elevators
http://enterthecore.net
Emergency Phones in Elevators
http://enterthecore.net
Emergency Phones in Elevators
http://enterthecore.net
Emergency Phones in Elevators
http://enterthecore.net
Emergency Phones in Elevators
http://enterthecore.net
Emergency Phones in Elevators
http://enterthecore.net
Emergency Phones in Elevators
http://enterthecore.net
Emergency Phones in Elevators
http://enterthecore.net
Emergency Phones in Elevators
http://enterthecore.net
Emergency Phones in Elevators
http://enterthecore.net
Emergency Phones in Elevators
http://enterthecore.net
Emergency Phones in Elevators
http://enterthecore.net
COMMON VIOLATIONS,
ISSUES, & GUIDANCE
Entrapments
http://enterthecore.net
Code Violations
http://enterthecore.net
Code Violations
http://enterthecore.net
Phone Violations
http://enterthecore.net
Alarm Bell
http://enterthecore.net
“Assault” Switch
http://enterthecore.net
“Assault” Switch
http://enterthecore.net
Unsecured Motor Rooms and Hoistways
http://enterthecore.net
Unsecured Motor Rooms and Hoistways
http://enterthecore.net
Unsecured Motor Rooms and Hoistways
http://enterthecore.net
Unsecured Motor Rooms and Hoistways
http://enterthecore.net
Improperly Secured Motor Rooms and Hoistways
http://enterthecore.net
Improperly Secured Motor Rooms and Hoistways
http://enterthecore.net
Improperly Secured Motor Rooms and Hoistways
http://enterthecore.net
Improperly Secured Motor Rooms and Hoistways
http://enterthecore.net
Know Who Your Contractor Is!
http://enterthecore.net
Know Who Your Contractor Is!
1. Facilities / Operations
2. Elevator Contractor
- Constructor
- Maintenance Contractor / Mechanic
• parts, oil, grease -or- regular maintenance
• basic troubleshooting
- Adjuster / Troubleshooter
3. Consultants
- Performance
- Monitoring
- Safety / Post-accidents
4. Inspection
- AHJ (Authority Having Jurisdiction… Municipal / State Inspectors)
- Third Party (QEI – Qualified Elevator Inspector)
- Second Party (Contractor inspects and certifies self)
http://enterthecore.net
Oversight of Your Maintenance Control Program
http://enterthecore.net
Oversight of Your Maintenance Control Program
http://enterthecore.net
Oversight of Your Maintenance Control Program
http://enterthecore.net
Oversight of Your Maintenance Control Program
http://enterthecore.net
Conflicts of Interest
http://enterthecore.net
Be Wary of Bullshit Service
http://enterthecore.net
Be Wary of Bullshit Service
http://enterthecore.net
Tests Are Important!
http://enterthecore.net
Follow All of Your Building Procedures
http://enterthecore.net
SO WHAT NOW?
So What Now ?
APT elevator
attacks ??
Impossibru !!
http://enterthecore.net
There are Elevator Techs
http://enterthecore.net
And There are Elevator Techs who are Security Consultants
http://enterthecore.net
“I Don’t Want My Elevator on the Internet but I Want Monitoring”
http://enterthecore.net
FINAL TIPS
PREVENTING & CORRECTING PROBLEMS
If Someone (Including You) Is Stuck in an Elevator
http://enterthecore.net
Follow These Simple Steps…
1. Don’t Panic
http://enterthecore.net
Follow These Simple Steps…
http://enterthecore.net
Follow These Simple Steps…
1. Don’t Panic
• Main lights off? You don’t have many options (emerg. call)
• Main lights on? Try the following…
http://enterthecore.net
Follow These Simple Steps…
1. Don’t Panic
2. Press Door Open (exit safely if doors open)
http://enterthecore.net
Follow These Simple Steps…
1. Don’t Panic
2. Press Door Open
3. Press Door Close, Then Press Door Open Again
http://enterthecore.net
Follow These Simple Steps…
1. Don’t Panic
2. Press Door Open
3. Press Door Close, Then Press Door Open Again
4. Try Placing Calls to Other Floors, Including Lobby
http://enterthecore.net
Follow These Simple Steps…
1. Don’t Panic
2. Press Door Open
3. Press Door Close, Then Press Door Open Again
4. Try Placing Calls to Other Floors, Including Lobby
5. Make Sure You’re Badged In, Try Floor Calls Again
http://enterthecore.net
Follow These Simple Steps…
1. Don’t Panic
2. Press Door Open
3. Press Door Close, Then Press Door Open Again
4. Try Placing Calls to Other Floors, Including Lobby
5. Make Sure You’re Badged In, Try Floor Calls Again
6. If Authorized, Try Using Keyswitches (IND Mode)
http://enterthecore.net
Follow These Simple Steps…
1. Don’t Panic
2. Press Door Open
3. Press Door Close, Then Press Door Open Again
4. Try Placing Calls to Other Floors, Including Lobby
5. Make Sure You’re Badged In, Try Floor Calls Again
6. If Authorized, Try Using Keyswitches (IND Mode)
7. Verify the Cab Doors Are Closed
(Unless you heard something loudly fail)
http://enterthecore.net
Follow These Simple Steps…
1. Don’t Panic
2. Press Door Open
3. Press Door Close, Then Press Door Open Again
4. Try Placing Calls to Other Floors, Including Lobby
5. Make Sure You’re Badged In, Try Floor Calls Again
6. If Authorized, Try Using Keyswitches (IND Mode)
7. Verify the Cab Doors Are Closed
8. If Nothing Worked, Call For Help
(Emergency Phone or Mobile Phone or Radio)
http://enterthecore.net
Things To NEVER Try When Stuck…
http://enterthecore.net
Things To NEVER Try When Stuck…
http://enterthecore.net
Things To NEVER Try When Stuck…
http://enterthecore.net
Thank You Very Much!
delta@enterthecore.net howard@payneelevator.com
@deviantollam http://enterthecore.net
@sgthowardpayne