1 00:00:00,620 --> 00:00:05,920 Hi folks, welcome to Lock Bypass Village and to my talk all about physical reconnaissance. 2 00:00:05,920 --> 00:00:08,480 So this is going to be a fairly low-tech talk. 3 00:00:08,480 --> 00:00:21,380 It's all about how we can use our human senses and our eyes to walk around and tell as much information as we can about a physical facility before we ever actually step inside. 4 00:00:21,580 --> 00:00:27,320 So I gave a different version of this talk at HOPE a few weeks ago. 5 00:00:27,420 --> 00:00:34,900 That one is a little bit more formal on sort of the architectural plans and inferences there. 6 00:00:34,900 --> 00:00:38,360 This one will be taking a more red team perspective. 7 00:00:39,020 --> 00:00:43,480 It's got a lot of new examples that weren't in the other one, as well as a lot of content that was cut. 8 00:00:43,480 --> 00:00:57,280 So I'm going to try to be a little bit faster with this one and take advantage of the more intimate environment that a DEFCON Village gives to make this talk all about the Q&A afterwards and having some interesting discussion. 9 00:00:57,320 --> 00:01:01,060 So to get started with the basic information. 10 00:01:01,540 --> 00:01:04,420 Intelligence follows a cycle. 11 00:01:04,420 --> 00:01:14,680 So we collect information, we analyze it into usable intelligence, and that's going to determine if we need to then collect more to decide ultimately what our course of action is. 12 00:01:14,680 --> 00:01:19,400 So that's the end goal that we need to keep in mind while we're collecting this information. 13 00:01:20,860 --> 00:01:29,700 Reconnaissance is something that we want to do of our physical facility, of course, but we're going to start with the area of influence, both physical and political. 14 00:01:29,860 --> 00:01:34,700 So looking at nearby streets, nearby shops, looking at nearby utilities, etc. 15 00:01:34,700 --> 00:01:40,880 As well as if the organization has multiple facilities, what are those facilities like? 16 00:01:40,880 --> 00:01:49,320 Do they have... well, they usually will have very similar layouts and usages and security situations there. 17 00:01:49,320 --> 00:02:00,380 And we want to observe at a range of times, day and night, week and weekend, and normal operation and during an anomaly to get a sense of how the organization handles that. 18 00:02:00,620 --> 00:02:04,000 We want to look at the people as well as the facility. 19 00:02:04,000 --> 00:02:05,740 So when are they entering? 20 00:02:05,740 --> 00:02:07,660 What the general demographic is? 21 00:02:07,660 --> 00:02:15,020 We can keep track of how many enter and leave at each time to get a sense of the occupancy of the building at a particular time. 22 00:02:15,020 --> 00:02:26,920 We want to look at what entrances and exits they use, as well as any security steps that they take inside, such as keys and credentials, and if they sign in or do anything else on entry. 23 00:02:27,780 --> 00:02:33,920 We can then go up to the main entrance and look at all the information we can get from that. 24 00:02:33,920 --> 00:02:36,260 So this particular picture is very telling. 25 00:02:36,340 --> 00:02:39,300 We can see the fire panel off to the side. 26 00:02:39,300 --> 00:02:45,400 You can get a very good sense of the occupancy and layout of the building from all the different fire zones that are going to exist. 27 00:02:45,400 --> 00:02:49,500 We have our fire safety plan blocks here telling us that this is the main entrance. 28 00:02:49,960 --> 00:02:54,340 We look at all the ways that are access controlled on this building. 29 00:02:54,340 --> 00:03:04,860 So there are a number of keypads, a credential reader, a doorbell, a video doorbell, and a different one used at night apparently. 30 00:03:04,920 --> 00:03:15,860 We can see the elevators through in this lobby, so we know exactly how to get to those, and we can infer that the hallway is going to go perpendicular to that, which makes sense given the layout of this building. 31 00:03:16,060 --> 00:03:26,820 We can notice these magnetic contact sensors there, so that gives us an indication that we're going to see more of those throughout the building, and there might be a networked alarm or intrusion detection system. 32 00:03:27,120 --> 00:03:31,800 So there's a lot that we can tell just by looking at the front doors. 33 00:03:31,800 --> 00:03:47,300 We can zoom in a little bit on the locks, so we can see something like Medeco or Schlage Primus lets us know that they take security a little bit more seriously, as well as an electronic strike plate lets us know that there is an electronic access control system involved. 34 00:03:47,300 --> 00:04:01,020 We can look around back and we might see what's happening in terms of things being disposed of, so if there's a dumpster back that tells you that the area is in flux, there's construction going on or something within it. 35 00:04:01,140 --> 00:04:13,680 You might see something like a specialized disposal bin, so in this case it's a cooking oil bin that tells us that there is a restaurant inside, and they fairly universally look like this, even if they're not so blatantly labeled. 36 00:04:13,900 --> 00:04:24,400 We can find the parking garages, so we know that this one is a full underground garage rather than just a number of vehicles because it starts to slope down. 37 00:04:24,400 --> 00:04:33,360 And we can find the ventilation grates near that and see how deep they actually go based on seeing, in this case, the light coming out from two levels down. 38 00:04:33,940 --> 00:04:49,000 We can look for the loading docks, and so that'll give us a sense of both where the service entrances and service corridors are going to be within the building, as well as what type of material they actually accept at this particular facility. 39 00:04:49,220 --> 00:04:57,520 And then looking around the back, this is a great sign of a site that does not have any alarm system installed on it. 40 00:04:58,580 --> 00:05:05,920 So that starts to give us a sense of what all the entrances around the perimeter of the site are going to look like. 41 00:05:05,940 --> 00:05:12,440 Now we can switch gears a bit and figure out what happens inside of that building envelope. 42 00:05:12,440 --> 00:05:24,000 To do that, we're trying to infer the floor plan of the site, which generally is going to include assignable space, so that's going to be our offices, residences, etc., what people are actually using. 43 00:05:24,120 --> 00:05:28,100 Circulation space, such as halls, stairwells, and elevators. 44 00:05:28,100 --> 00:05:33,500 And building support space, so washrooms, custodial closets, mechanical space, etc. 45 00:05:33,500 --> 00:05:43,700 And by identifying where all of these elements go, we can then help to improve our red team operation with this information before we even begin it. 46 00:05:44,500 --> 00:05:51,140 So with that, we can get the best plan for how to get from A to B, and we can then filter that into a timeline. 47 00:05:51,140 --> 00:06:04,000 So if, say, we need to go faster than the response is going to be coming in after we've set off an alarm or some other trigger for the response to come, we can use this information to determine if that's going to be feasible. 48 00:06:04,120 --> 00:06:14,760 We can figure out where it would make sense to put the cameras and work around that space, as well as we can do a bit of auditory analysis to see where we could be heard and where we can hear other people. 49 00:06:14,980 --> 00:06:21,360 And, of course, if we plan to do any social engineering in the space once we enter it, it really helps to know where we're going. 50 00:06:21,840 --> 00:06:29,220 So you can get floor plans often from the fire safety plan box, if that happens to be available to you. 51 00:06:29,580 --> 00:06:35,000 If not, you can usually do a search online and sometimes get good information there. 52 00:06:35,140 --> 00:06:50,680 So searching for a PDF and a number of keywords that I've outlined here that tend to be found in floor plan files online and not in a whole lot else is going to really help narrow down your search to get floor plans there. 53 00:06:50,680 --> 00:06:56,180 And if it's a public building, there's usually a tenders website that has loads of plans for it. 54 00:06:56,240 --> 00:07:07,120 When we infer floor plans, we're not going to get very detailed diagrams, but we'll get a topology that's good enough for all of these purposes for a red team engagement. 55 00:07:07,160 --> 00:07:11,800 The first thing we'll start with to infer floor plans is the massing of the building. 56 00:07:11,800 --> 00:07:13,840 So what is its overall shape? 57 00:07:13,840 --> 00:07:22,620 We have a primary mass, which is the main shape, anything smaller sticking out of it is called a secondary mass. 58 00:07:23,540 --> 00:07:29,880 This then has surrounding it as a skin is the building envelopes, which envelopes the massing. 59 00:07:29,880 --> 00:07:34,000 It has doors, such as the doors, loading docks, etc. 60 00:07:34,000 --> 00:07:35,440 that we looked at before. 61 00:07:35,620 --> 00:07:39,560 Windows, which we'll use the architectural term of fenestration. 62 00:07:39,640 --> 00:07:50,540 It would have mechanical equipment, so vents and louvres coming out of it, as well as potentially equipment on the roof and external structural members, all of which are clues to the internal layout. 63 00:07:50,640 --> 00:07:57,040 We can get this massing information from Google Maps, often has it for many cities. 64 00:07:57,040 --> 00:08:02,060 Many cities also often have their open data releasing this information. 65 00:08:02,060 --> 00:08:09,320 We can look at satellite views, as well as local government's open data, and of course taking pictures in person. 66 00:08:09,740 --> 00:08:15,040 So from the exterior massing and envelope, how do we determine the floor plan? 67 00:08:15,040 --> 00:08:18,860 So here's an example of a very large complicated facility. 68 00:08:18,860 --> 00:08:28,960 Looking at it from an aerial view, we can start to see that it is very well set out as a linear layout. 69 00:08:28,960 --> 00:08:37,740 So it's branched, but otherwise we can infer, well there's probably going to be a hallway in the center there, with rooms branching off to either side. 70 00:08:37,740 --> 00:08:42,540 The size of those rooms is going to be quantized by the positioning of these windows here. 71 00:08:42,560 --> 00:08:44,720 And so as it turns out, that's exactly what we see. 72 00:08:44,720 --> 00:08:50,660 Hallway in the middle, with rooms quantized by the windows, equal depth on either side. 73 00:08:50,660 --> 00:08:56,800 The stairwells, we can start to guess where they are based on where it makes sense, given fire and egress requirements. 74 00:08:57,340 --> 00:09:09,480 And the entire facility, we see that that holds true as well, with hallways in the middle, and it very closely follows what we could infer from looking at that external massing. 75 00:09:10,060 --> 00:09:14,980 So sometimes we can also get the hall location directly from fenestration or massing. 76 00:09:14,980 --> 00:09:21,060 So in this case, we have both windows and a very thin mass element that tells us that the hall must be in the middle here. 77 00:09:21,060 --> 00:09:23,300 It's usually in the middle, but not always. 78 00:09:23,300 --> 00:09:26,920 So in this case, this bridge tells us that this hall is on the edge. 79 00:09:27,460 --> 00:09:34,160 An interesting case study for these long massings, long thin massings, is prisons. 80 00:09:34,200 --> 00:09:36,980 So cell blocks tend to be laid out that way. 81 00:09:37,040 --> 00:09:40,120 In terms of the inside of them, once you've seen one, you've seen them all. 82 00:09:40,120 --> 00:09:41,900 They all pretty much look like this. 83 00:09:41,900 --> 00:09:54,860 But there's one interesting aside about prison escapes, and that is that every prison needs to have a lavatory in it, and every lavatory needs to have plumbing, and that plumbing has to get out somewhere. 84 00:09:55,020 --> 00:10:09,920 And so that will usually be in a crawlspace, and in older prisons it will often be in a fully-fledged service tunnel that already exists, and that must therefore be connected through a wall from the cells. 85 00:10:09,920 --> 00:10:14,760 So when you hear about people tunneling out of prisons, you think, well that's a very daunting task. 86 00:10:14,760 --> 00:10:24,160 They don't actually have to go very far, just a couple inches of brick or concrete or whatever it might be, to get to the crawlspace where the plumbing gets out. 87 00:10:24,800 --> 00:10:33,120 We can use this, when we're not trying to break out of a prison, to determine where washrooms are in a facility before we ever set foot in it. 88 00:10:33,120 --> 00:10:37,660 So washrooms need plumbing, and multi-story plumbing needs pipe riser shafts. 89 00:10:37,660 --> 00:10:45,360 So you tend to see the washrooms are in the same place on every floor, so that the plumbing can be collinear in that regard. 90 00:10:45,520 --> 00:10:59,980 Pipe riser shafts usually end in mechanical equipment at the top of the building, and so by seeing this mechanical penthouse jutting out on the roof, we can infer that the pipe riser shafts are under it, as likely are the washrooms. 91 00:11:00,260 --> 00:11:08,660 So in this particular example, we have this t-shaped building, and we can infer that there's going to be likely a t-shaped hallway in the middle. 92 00:11:08,680 --> 00:11:22,120 If we did a bit more research, we determined that this was a long-term care home, and so given the dimensions of this building, that would be abnormally large for the suites to extend right the way to the center. 93 00:11:22,120 --> 00:11:35,380 So we might infer that there's going to be two hallways per wing, and support space in the middle, as a building or a facility of this type would need a lot of support space. 94 00:11:35,380 --> 00:11:43,180 We can also see this large vertical window here, indicating some sort of large common room in this area on every floor. 95 00:11:43,220 --> 00:11:45,660 Looking at the floor plan, that is what we find. 96 00:11:45,660 --> 00:11:59,220 So we have this large common room where the window was, as well as suites around the edges, and a loop of hallways in each wing, and then support space in the center, including stairs on each of the three wings. 97 00:11:59,220 --> 00:12:04,040 It makes sense for egress purposes that they would be located there, and central elevators. 98 00:12:04,600 --> 00:12:15,340 High rises are a lot easier to determine what the layout is, because they're relatively small horizontally, and there's a number of things that are often stacked. 99 00:12:15,340 --> 00:12:18,060 So they're the same place, floor to floor to floor. 100 00:12:18,100 --> 00:12:22,000 Obviously elevators, structural columns, and stairwells, that makes sense. 101 00:12:22,040 --> 00:12:29,160 Washrooms need their pipe space behind toilets, so in this case the pipe space is here, but it's nearby to it. 102 00:12:29,280 --> 00:12:39,260 Telecom closets, electrical closets, pipe shafts, mechanical rooms, and vents, all of which have vertical risers that ensure that they tend to be vertically stacked. 103 00:12:39,260 --> 00:12:46,240 What this gives rise to is generally you have a central core that's going to contain all of these building support elements. 104 00:12:46,240 --> 00:12:51,100 So your mechanical room, washrooms, stairs, elevators. 105 00:12:51,100 --> 00:12:58,400 Here we can see in this diagram that pipe space behind the toilets there, and that's the reason that's stacked. 106 00:12:58,400 --> 00:13:09,560 And that also makes sense to use this space that's very far from the windows where people like to occupy for these central core elements, and then let people occupy the outside. 107 00:13:09,580 --> 00:13:21,160 This indicates the column grid here, so this might be partitioned by the final user of the space, and those partitions are generally going to follow the column grid some way or another. 108 00:13:21,400 --> 00:13:30,800 It also makes sense for egress purposes to have the stairwells and elevators in the central core, because it's about equidistant from everything in that floor. 109 00:13:31,360 --> 00:13:41,380 Most high rises have entire floors dedicated to mechanical equipment, and we can locate them by noticing very clear differences in the fenestration. 110 00:13:41,380 --> 00:13:45,140 So instead of windows it's mechanical vent louvres. 111 00:13:45,140 --> 00:13:58,080 If we see the top level of fenestration is well below the roof level, that indicates that there's a mechanical penthouse at the top, and there's also often mechanical basements or partial basements that are going to house that equipment. 112 00:13:58,600 --> 00:14:12,400 So in this particular case we see a number of mechanical penthouses well concealed within the architecture of the building, and in this case we see loads where the fenestration doesn't extend all the way up to the roof, and that indicates that that's what's going on there. 113 00:14:12,760 --> 00:14:25,860 We can also do a bit of math, so we can get the height of the building either by public records, as many of them are, or we can measure it fairly simply with simple trigonometry and angle measurements. 114 00:14:26,000 --> 00:14:38,620 With the height of the building, counting the floors, we can then determine what the average floor height is, and that gives us a sense of both what the occupancy is, what the usage is, as well as where the mechanical equipment will go. 115 00:14:38,620 --> 00:14:51,560 So very very tall floors will likely have false ceilings or false floors, and that does affect our ability to bypass in certain ways, since we know we can get into places through the ceiling or the floor if that exists. 116 00:14:52,060 --> 00:15:02,940 And then shorter ones are then going to have mechanical corridors instead, and they'll tend to be smaller with a central core housing that mechanical equipment. 117 00:15:03,280 --> 00:15:07,940 In terms of high-rise residential, it's not nearly as open as an office floor plan. 118 00:15:07,940 --> 00:15:19,920 It's going to be set up into separate suites, but they're going to follow a central core as well, housing the stairs, elevators, and building support systems. 119 00:15:20,280 --> 00:15:29,100 And it will tend to have a ring-shaped or u-shaped corridor for circulation space to give access to all of those units. 120 00:15:29,440 --> 00:15:41,660 And so in this particular case, we see a slightly abnormally shaped building, but stairs, elevators, support space in the center with a ring-shaped corridor following that general outer perimeter. 121 00:15:42,020 --> 00:15:53,520 In terms of identifying where in the core each things are positioned relative to one another, and in a larger building where these elements are in general, we can sometimes look at the parking garage. 122 00:15:53,620 --> 00:15:58,540 So right away we can see where the structural columns are, and that's going to extend all the way up the building. 123 00:15:58,540 --> 00:16:01,220 We can find where the elevator banks are. 124 00:16:01,300 --> 00:16:11,280 We can find where the telecom riser shafts and pipe riser shafts are by the location of mechanical rooms in the basement. 125 00:16:11,280 --> 00:16:21,480 So in this case, security system room is very likely going to be located very close to the telecom riser shaft. 126 00:16:21,760 --> 00:16:27,580 And that we'll notice is right beside the elevator lobby, which makes sense in the high rise that's going to be above this. 127 00:16:27,580 --> 00:16:37,960 The elevator and the riser shafts and all this other building support space is going to be in the central core, so it will be close to one another in the parking garage. 128 00:16:37,960 --> 00:16:41,580 Of course, we can identify stairs as well. 129 00:16:42,160 --> 00:16:48,720 In older buildings, the stairs tend to be located on the outside of the building, and so we can identify those using a number of tricks. 130 00:16:48,720 --> 00:16:51,980 Sometimes you can just see the stairs very clearly. 131 00:16:53,060 --> 00:16:59,880 Stairs tend to have egress doors at the bottom of them, since they are provided for egress purposes as well. 132 00:16:59,920 --> 00:17:09,960 And when you look at the building at night, if there's one column of windows that's entirely lit up, that is usually a stairwell, because it needs to be lit for egress purposes. 133 00:17:10,180 --> 00:17:13,820 Here's an example of the stairwell being unfenestrated. 134 00:17:13,860 --> 00:17:18,200 It's this secondary mass that runs along the side of the building. 135 00:17:18,480 --> 00:17:25,060 A cue that it's a stairwell... well, one is its general dimensions. 136 00:17:25,060 --> 00:17:30,360 This makes sense for being a stairwell, as well as extends up onto the roof level of the building. 137 00:17:30,360 --> 00:17:36,360 So this is likely a stairwell that goes up and opens up onto the roof, indicating that that is likely what that is. 138 00:17:36,360 --> 00:17:39,600 And then we also have some cell towers on this building. 139 00:17:40,940 --> 00:17:44,480 Stairwells that are fenestrated, we can tell what they are from the fenestration. 140 00:17:44,480 --> 00:17:52,060 So if we see windows that are halfway between the regular floor heights, it's a very good indication that that's a landing on a stairwell. 141 00:17:52,060 --> 00:18:01,200 In this case, we have windows zigzagging up the building, and that's likely going to be following stairs that are zigzagging up, landing to landing. 142 00:18:01,200 --> 00:18:10,280 We also see that this is a secondary mass sticking out of the building, and it sticks up at the top, creating a little exit onto the roof from the top of that stairwell. 143 00:18:10,280 --> 00:18:15,900 And it makes perfect sense that that's located where it is, relative to how these windows are laid out. 144 00:18:15,980 --> 00:18:21,740 In this particular case, we have windows that are not aligned with the rest of the windows in the building. 145 00:18:21,800 --> 00:18:23,140 This is a residential building. 146 00:18:23,140 --> 00:18:28,300 You can tell based on the litness, or how lit the windows are, what that pattern is. 147 00:18:28,300 --> 00:18:33,420 And on this column of everything lit with the exact same intensity, that's got to be a stairwell . 148 00:18:34,260 --> 00:18:43,220 And here's another example of these half-height windows, indicating this is a stairwell terminating in a door at the bottom, and it's a column of lit windows. 149 00:18:43,220 --> 00:18:46,280 So that's very clearly what that is in this case. 150 00:18:46,420 --> 00:18:50,680 Where there's a fire escape, we can tell that there's likely no stairwell near it . 151 00:18:50,680 --> 00:18:53,980 That's about all we can tell, because they are retrofits. 152 00:18:54,380 --> 00:19:01,360 If there's multiple exit doors, and the exit doors are only cued as to where the stairwell is, it might also be to a hallway. 153 00:19:01,360 --> 00:19:05,380 We can tell which one's the primary exit door by looking at some safety features. 154 00:19:05,440 --> 00:19:22,120 So this light up here, to provide illumination to people exiting, as well as we have a parking lot there, so we have some vehicle ballers to protect pedestrians exiting from being rammed into by vehicles parking, indicates that this is the primary door. 155 00:19:22,120 --> 00:19:24,340 And these are likely mechanical doors. 156 00:19:24,660 --> 00:19:29,580 That's helped along by the fact that this vent loop exists there. 157 00:19:29,920 --> 00:19:34,760 So in this case, looking at this building, can we tell if it's an office building or residential? 158 00:19:34,760 --> 00:19:48,420 Based on the pattern of lighting in the windows, we can tell that it is almost certainly an office building, with the lower floors lit, the upper floors likely on timers, and not lit up. 159 00:19:49,620 --> 00:19:55,790 We can tell where the elevators are by looking for the associated machinery that goes with them. 160 00:19:56,070 --> 00:20:09,290 A hydraulic elevator, they tend to be shorter because there's a hydraulic ram that goes as deep into the ground as the elevator is tall, and so they can't go very high. 161 00:20:09,290 --> 00:20:14,350 And as well, they don't tend to show up in very old buildings because they're a newer technology. 162 00:20:14,850 --> 00:20:21,110 Every other type of elevator, and most of them are this second type, which is a traction elevator. 163 00:20:21,110 --> 00:20:24,710 So they're the typical ones that are hanging off of a cable. 164 00:20:24,730 --> 00:20:30,450 And they require a machine room at the top, with some exceptions, but they're rare. 165 00:20:30,450 --> 00:20:36,630 That machine room needs to be sticking out above the top level that the elevator serves. 166 00:20:36,630 --> 00:20:51,290 So if the windows go all the way up to the top level, all the way up to the roof, we can see that if the elevator is going to serve that top level, it's going to need an elevator penthouse extending out, excuse me, onto the roof. 167 00:20:51,290 --> 00:20:52,710 And that's what we see here. 168 00:20:52,710 --> 00:20:58,050 We see three elements, three secondary masses extending onto the roof. 169 00:20:58,050 --> 00:21:08,850 This central one makes sense to be the elevator, both based on the size, if we compare it to these vehicles down here, as well as the positioning relative to the main entrance to this building. 170 00:21:08,890 --> 00:21:15,330 And these secondary masses on the side are likely where the stairwells are coming out, exiting onto the roof. 171 00:21:16,630 --> 00:21:22,690 Another couple examples, we can see an elevator penthouse up here, indicating that's likely where the elevator is. 172 00:21:22,690 --> 00:21:27,050 In a building of this age and height, it's unlikely to be a hydraulic elevator. 173 00:21:27,050 --> 00:21:33,010 And here we can see the elevator directly exiting out the back, and this very likely is a hydraulic elevator. 174 00:21:33,630 --> 00:21:39,010 In this case, we can point out the stairwell very quickly by this column of lit windows. 175 00:21:39,010 --> 00:21:42,390 There's likely going to be one on the other side of the building as well. 176 00:21:42,390 --> 00:21:47,170 And we can infer the rest of the floor plan by noting that there are two balconies per side. 177 00:21:47,170 --> 00:21:52,890 Each balcony is partitioned into two, so eight units per side, or four units per side, eight per floor. 178 00:21:52,890 --> 00:21:55,030 So there's going to be four more on the other side. 179 00:21:55,190 --> 00:22:04,710 We can see this mechanical penthouse only covers part of the building's roof, so the elevator's got to be in the central core, which makes sense for circulation purposes. 180 00:22:05,470 --> 00:22:10,490 And we can tell that this building is likely symmetrical all around. 181 00:22:11,230 --> 00:22:20,730 Utilities are also very helpful for us to determine what a building's used for, what its occupancy is, and where things are within it. 182 00:22:20,730 --> 00:22:21,870 So here's an example. 183 00:22:21,870 --> 00:22:26,170 We can see this particular box coming out is a remote meter reader. 184 00:22:26,990 --> 00:22:34,010 It's for water, so the water meter reader can go and tap an electronic device onto this to read the meter. 185 00:22:34,150 --> 00:22:37,890 And that tells us that this is a mechanical room down here that it goes into. 186 00:22:37,890 --> 00:22:44,090 Here's another example where we have both that box as well as the gas meter leading into that. 187 00:22:44,150 --> 00:22:51,810 And looking into this grate, it's a bit hard to see in this picture, but there is a vent louvre there, further indicating that that is a mechanical room down there. 188 00:22:52,010 --> 00:22:58,530 In this case, we can spot the mech rooms by looking at what we can see, pipes directly in this room. 189 00:22:58,530 --> 00:23:04,230 We can see the fire stand pipe coming out of it, so it tells us something about the size of that mechanical room. 190 00:23:04,410 --> 00:23:08,750 On the second floor, we can tell that there is none here, because we can see in the windows. 191 00:23:08,750 --> 00:23:14,150 And on the third floor, there likely is a mechanical room up here, based on this louvre and the lack of windows. 192 00:23:14,470 --> 00:23:24,350 And of course, there's likely going to be some pipe shaft connecting this first and third floor mechanical room, recessed somewhat into the building, because we know it's on the edge. 193 00:23:24,750 --> 00:23:29,970 We can look at incoming telephone utilities to determine the occupancy of the building. 194 00:23:30,150 --> 00:23:38,450 So a cable coming up from an underground conduit, in this case, we can look at it and see that it, by its diameter, is about a 50 pair copper cable. 195 00:23:38,570 --> 00:23:44,590 So this building had a design maximum of 50 phone lines in the building, and that's going to estimate the occupancy. 196 00:23:45,070 --> 00:23:51,270 We can also look at where the phone lines split up to, if they split up into separate units, to identify what the units are. 197 00:23:51,270 --> 00:23:55,750 So we can see a phone line coming along here, entering the building at this point. 198 00:23:55,850 --> 00:24:00,250 It's a little hard to see, but there is a line swinging up there and entering at this point. 199 00:24:00,250 --> 00:24:04,810 And then there's one along the side here, entering at that point. 200 00:24:04,810 --> 00:24:10,670 So from where these phone lines are entering the building, we can identify where the units are. 201 00:24:10,670 --> 00:24:17,690 That, combined with the fenestration, will give us a very good sense of what the internal partitioning of the walls is going to look like. 202 00:24:17,690 --> 00:24:21,450 Here's an interesting case that gives us a sense of the history of the building. 203 00:24:21,450 --> 00:24:26,830 We see a whole rat's nest of phone lines all going to the same place. 204 00:24:26,830 --> 00:24:35,170 What likely happened there is this is a rental building, and it changed hands many times throughout its life. 205 00:24:35,170 --> 00:24:42,790 And every time it did, a new phone line was installed, and the techs were lazy and just added a new one without removing the old one. 206 00:24:42,790 --> 00:24:45,850 So that's likely why we see this pattern here. 207 00:24:45,850 --> 00:24:48,970 And so that tells us something about what happens within the building. 208 00:24:49,270 --> 00:24:52,490 We can also look at heating, ventilation, and air conditioning. 209 00:24:52,650 --> 00:25:01,890 So in older buildings, these tend to be external units, visible, and we can look at what their capacity is to get a sense of what the internal capacity of the building is. 210 00:25:02,090 --> 00:25:18,570 In newer buildings, we have cooling towers on the roof, and those are going to have a certain capacity, feeding chillers on the inside that are going to then cool a water ethylene glycol mixture down to what it needs to cool the rest of the building and operate the HVAC systems. 211 00:25:18,570 --> 00:25:21,730 We can also look for specialty HVAC equipment. 212 00:25:21,730 --> 00:25:35,530 So if you see something like this, kind of looking like jet engines on the top, that's for creating an extreme negative pressure, generally to drive fume hoods or other chemical exhaust disposal systems. 213 00:25:35,790 --> 00:25:39,110 And so if you see those, that indicates that that's going on in the building. 214 00:25:39,110 --> 00:25:48,430 If you see fans like this, which operate on a similar principle but lower pressure, these are highly associated with cooking spaces. 215 00:25:48,490 --> 00:25:50,470 So here we have an axial fan. 216 00:25:50,470 --> 00:25:53,790 This is common to see over restaurant spaces. 217 00:25:53,870 --> 00:26:02,070 And here we have a centrifugal fan that pulls up from a vent here, indicating that there is likely a restaurant in this location as well. 218 00:26:02,530 --> 00:26:14,070 And in this particular case, we have a large industrial dust collector system, indicating that there's a machine shop or some sort of industrial fabrication system going on in this building. 219 00:26:14,150 --> 00:26:16,290 We can look at the incoming power. 220 00:26:16,290 --> 00:26:25,430 If we have pad mount transformers on the outside, we can look up the capacity of those transformers to figure out what the power requirements are inside that building. 221 00:26:25,610 --> 00:26:35,090 And if it's a volt transformer, we can see if it's a double or a single, giving us a sense again of the capacity to a bit less granularity. 222 00:26:35,310 --> 00:26:38,550 Kind of an interesting aside about how those are actually maintained. 223 00:26:38,850 --> 00:26:48,330 These concrete slabs at the top of them are crane lifted up, and then we can crane lift in and out new transformers to maintain those. 224 00:26:48,330 --> 00:26:50,550 So that's kind of interesting how that works. 225 00:26:50,550 --> 00:27:02,490 These all look similar to this, with an access hatch and a vent, since transformers do need to be vented or cooled in some way, as well as these crane liftable concrete slabs. 226 00:27:02,490 --> 00:27:07,730 So now that you know what these look like, you will start seeing them everywhere in urban settings. 227 00:27:08,070 --> 00:27:18,070 Inside of them we have power coming from the underground duct bank, and it then goes in a separate conduit to the basement of the customer's building. 228 00:27:18,210 --> 00:27:27,850 And so that gives us a sense, based on the positioning of the hydrovolts, where that customer's basement mechanical room is going to be positioned. 229 00:27:28,070 --> 00:27:31,910 If they have a standby generator, they look something like this. 230 00:27:31,910 --> 00:27:44,670 Of course we can't see that from the outside, but that does indicate, if it's present, that it's a highly critical facility that's doing something with high importance, if it doesn't get interrupted. 231 00:27:44,830 --> 00:27:50,090 We can tell the presence of that by looking for these diesel fuel refilling stations. 232 00:27:50,130 --> 00:28:01,930 They look like this on the inside, it's just a pipe that you dump the diesel fuel into, but if you see that, it indicates not only where the diesel standby generator is, but also that one exists in that facility. 233 00:28:02,350 --> 00:28:08,210 Looking at the meters gives you a sense of how many separate units are being metered in that particular site. 234 00:28:08,210 --> 00:28:17,030 So in this case, we have a tack of the gas meters here, and we can count these, and that's exactly how many separate metered units exist within this building. 235 00:28:17,430 --> 00:28:32,750 If we see something like this on the ground, it's a groundwater test well, and so they're going to dig down and essentially leave a pipe, a well, and they can test whenever they need to how deep that groundwater actually is. 236 00:28:32,770 --> 00:28:41,990 That could be used for flood prevention, but you also see this happening anytime there is new construction planned that's going to involve excavation. 237 00:28:42,010 --> 00:28:49,190 So if you see this and it's not in a floodplain, that likely indicates deep construction is being planned. 238 00:28:49,190 --> 00:28:55,970 We can also get a sense from the security features what might be happening inside of a building. 239 00:28:55,970 --> 00:29:06,110 So in this particular case, we have vehicle ram bollards here, fairly beefy, as well as very bright glare lighting. 240 00:29:06,110 --> 00:29:12,530 These vehicle bollards are to protect from vehicle impact attacks, as well as truck-mounted bombs. 241 00:29:12,530 --> 00:29:20,110 If this particular facility has that in its threat model, it gives you a good sense that whatever's going on in there must be fairly serious. 242 00:29:20,110 --> 00:29:35,130 As a bonus here, we have these half-height windows indicating a stairwell, and this lack of fenestration here indicates that there's very likely an elevator shaft there, possibly with a little window vent in the penthouse at the top here. 243 00:29:37,670 --> 00:29:43,350 So looking at the fenestration in this particular case study, we see a weird pattern. 244 00:29:43,350 --> 00:29:53,830 We can tell immediately that there's going to be a basement suite there, so likely from this entrance door there's going to be some stairs up to a fairly tall first floor. 245 00:29:53,830 --> 00:30:05,930 When we have a tall floor, the rooms tend not to be partitioned very small, so it's likely either a large open event space or a number of larger rooms within that. 246 00:30:05,930 --> 00:30:19,210 Anytime we see a strange looking fenestration pattern, like in this case, we can infer that that's certainly because of whatever requirements the inside of this building has for its layout. 247 00:30:19,430 --> 00:30:21,650 Here's a really great example. 248 00:30:21,650 --> 00:30:28,470 So we have this L-shaped building, immediately gives us a sense of the circulation layout within it. 249 00:30:28,510 --> 00:30:36,850 We can see the elevator penthouse here, as well as a chimney stack indicating that the boiler house is going to be below that. 250 00:30:36,850 --> 00:30:56,150 We can see that the boiler house is indeed spanning floors three and four here, and the entire central core supporting this building's utilities is going to be located near there as well by looking at the roof and what exists on the roof. 251 00:30:56,150 --> 00:31:00,410 We can also see this framing here that used to support some heavy HVAC unit. 252 00:31:00,410 --> 00:31:09,790 It's going to be anchored on the columns of the building, and those columns line up with the breaks in the fenestration alongside of this building. 253 00:31:09,790 --> 00:31:17,210 So from this and from the fenestration, we can actually infer the entire structural diagram of this particular building. 254 00:31:17,670 --> 00:31:20,510 So that was sort of a whirlwind tour. 255 00:31:20,510 --> 00:31:31,630 If you're interested in this sort of thing and would like to see a little bit more of the details of how these things are are done, I encourage you to check out my Hope Talk as well. 256 00:31:31,830 --> 00:31:44,730 But this now gives us a great opportunity to have some Q&A, chat about this, chat about some interesting cases that you've seen in your life, and see what else we can infer from these types of tricks. 257 00:31:44,750 --> 00:31:55,390 So I'm hoping that this will make you more situationally aware in your everyday life, look at your built infrastructure differently, and when you're going to an unfamiliar building, know where you're going. 258 00:31:55,390 --> 00:32:05,710 I'd like to extend a huge thank you to Kara and Bobby, Josh, and Eric for their help in preparing this talk, and I'd be happy to take any questions and start the discussion on this. 259 00:32:05,710 --> 00:32:06,850 Thank you very much folks.