1
00:00:01,180 --> 00:00:02,640
Hello, everybody.

2
00:00:02,660 --> 00:00:04,340
Welcome to Lock Bypass Village.

3
00:00:04,340 --> 00:00:10,500
My name is Karen, and today I'm going to be taking you through Bypass 101, an introduction to basic bypass methods.

4
00:00:12,780 --> 00:00:15,960
So, before we get started, what is bypass?

5
00:00:16,340 --> 00:00:21,720
Very often, when people think about physical hacking, they think about show-your-methods, things like lockpicking.

6
00:00:21,960 --> 00:00:28,620
However, there are plenty of other methods that can allow people to access locked-out locations, and this is known collectively as lockbypass.

7
00:00:29,460 --> 00:00:34,900
So, to get things started, I have a fun video here, which is a really great example of lockbypass.

8
00:00:34,900 --> 00:00:41,720
It involves finding a security vulnerability, exploiting it, and then gaining access to areas that should otherwise be locked out.

9
00:00:45,700 --> 00:00:51,500
This next video shows what can happen if your security system is poorly designed or poorly thought out.

10
00:00:53,940 --> 00:00:56,720
My mom wanted to lock her door.

11
00:00:57,320 --> 00:00:59,240
She's got a sliding door.

12
00:01:00,560 --> 00:01:02,820
And this was her solution.

13
00:01:09,580 --> 00:01:11,560
So, why bypass?

14
00:01:11,820 --> 00:01:20,300
Lockbypass often involves ignoring the lock altogether and finding an alternative way to open the door, and sometimes even avoiding having to use the door altogether.

15
00:01:20,640 --> 00:01:28,820
Lockbypass methods are used often because they're much faster and more reliable than lockpicking, and they're used much more frequently in physical red teaming.

16
00:01:29,740 --> 00:01:35,100
So, as you can see here, we have our agenda for today, and there are a lot of different types of bypass here.

17
00:01:35,240 --> 00:01:43,640
In addition, the items that are in bold are available to play as games on our website, bypassvillage.org, so feel free to go check those out.

18
00:01:44,380 --> 00:01:47,580
So, let's get started with latch-targeted bypass.

19
00:01:48,200 --> 00:01:53,120
Latch-targeted bypass, or carding, targets the latches that hold the door closed.

20
00:01:53,180 --> 00:01:57,520
Depending on the orientation of the latch, you can either shove or pull the latch.

21
00:01:58,020 --> 00:02:00,660
There's a variety of tools that you can use for this.

22
00:02:00,660 --> 00:02:06,780
Most commonly, you'll see latch clips or traveler's hooks, plastic cards, or even a well-bent piece of wire.

23
00:02:07,900 --> 00:02:11,120
Circled here in red is what is known as a deadlatch.

24
00:02:11,120 --> 00:02:15,840
When the deadlatch is pushed in, it prevents the latch from being pushed in as well.

25
00:02:16,020 --> 00:02:18,840
This prevents you from being able to card a door.

26
00:02:21,060 --> 00:02:24,920
Here's a quick video demonstration of how a deadlatch works.

27
00:02:27,200 --> 00:02:33,620
So as you can see, when the deadlatch is pushed in, you can no longer get the latch into the door.

28
00:02:34,880 --> 00:02:42,500
Sometimes the door is installed in such a way that the deadlatch is already in a hole in the strike plate that is in the frame of the door.

29
00:02:42,540 --> 00:02:51,380
Other times, the deadlatch is installed almost properly, but you can get it to fall into the hole by shoving, pushing, maneuvering, or shaking the door.

30
00:02:52,520 --> 00:02:54,040
This is a deadbolt.

31
00:02:54,160 --> 00:02:58,380
They're different from deadlatches, and often you'll see them with a thumb turn on the other side.

32
00:02:58,640 --> 00:03:05,280
These prevent you from being able to use latch-targeted bypass techniques, and it also prevents you from using the under-the-door tool.

33
00:03:06,520 --> 00:03:08,900
So, the instructions for use for pulling.

34
00:03:09,160 --> 00:03:12,220
So first you want to make sure that the deadlatch isn't actuated.

35
00:03:12,560 --> 00:03:15,980
After that, you want to place the latch slip tool behind the latch.

36
00:03:16,260 --> 00:03:20,280
You then want to wiggle the latch slip to move the latch slowly into the door.

37
00:03:20,280 --> 00:03:25,040
And then, without removing the tool from holding in the latch, you want to pull the door open.

38
00:03:25,640 --> 00:03:29,720
Here's a quick video demo of how to do it.

39
00:03:33,930 --> 00:03:48,830
So as you can see, the door is locked, and we take our bypass tool and we put it behind the latch, and then we slowly wiggle it back and forth, slowly moving the latch into the hole in the door.

40
00:03:48,930 --> 00:03:51,070
And thus, it can be pulled open.

41
00:03:53,390 --> 00:03:55,910
So what exactly is happening here?

42
00:03:56,130 --> 00:04:07,670
Pretty much what the tool does is it takes advantage of the fact that the latch is at an angle, and it follows that angle to slowly push the latch into the hole in the door.

43
00:04:10,130 --> 00:04:11,550
So, for shoving.

44
00:04:11,550 --> 00:04:15,470
First, again, you want to ensure that the deadlatch is not actuated.

45
00:04:15,630 --> 00:04:19,970
Once you've done that, you want to shove the shoving tool between the latch and the strike plate.

46
00:04:20,030 --> 00:04:24,550
And then, without removing the tool from holding in the latch, you want to pull the door open.

47
00:04:25,070 --> 00:04:29,710
Again, here's a quick video demonstration of exactly how to do it.

48
00:04:30,430 --> 00:04:35,990
So you can see he has the thin plastic card here, and that the door is locked.

49
00:04:37,390 --> 00:04:44,850
You maneuver the card between the door latch and the strike plate, and you can push it open.

50
00:04:46,710 --> 00:04:49,730
So, again, how exactly does this work?

51
00:04:50,230 --> 00:04:57,670
Pretty much what you do is you take this latch, and, again, you're taking advantage of the angle of the latch.

52
00:04:57,670 --> 00:05:03,270
And this card slowly pushes the latch into the hole, allowing the door to be pulled open.

53
00:05:06,170 --> 00:05:10,610
So, again, here's a quick little visual demonstration for you guys.

54
00:05:11,490 --> 00:05:14,430
Have you been curious about wanting to try to make your own?

55
00:05:14,430 --> 00:05:22,210
We have several DIY Bypass Tools workshops over the DEF CON weekend, so here's the information there, so be sure to check that out.

56
00:05:22,210 --> 00:05:28,890
It'll be going over a variety of different physical Red Team tools, and how to make them using things you probably already have at home.

57
00:05:29,790 --> 00:05:31,690
In addition, there's also a game.

58
00:05:31,690 --> 00:05:34,770
We have a latch-slipping game at BypassVillage.org.

59
00:05:34,770 --> 00:05:39,390
So it's an interactive game where you can latch-slip doors, and there's varying levels of difficulty.

60
00:05:40,310 --> 00:05:43,130
Next, we'll be discussing handle-targeted bypass.

61
00:05:43,570 --> 00:05:47,930
Sometimes the dead latch is actuated, and the door absolutely cannot be carded.

62
00:05:47,930 --> 00:05:49,450
But there is still hope.

63
00:05:49,450 --> 00:05:54,030
There does exist lock-bypass methods that target the handle of the door instead of the latch.

64
00:05:54,030 --> 00:05:57,790
This method mimics a person exiting through the door from the other side.

65
00:05:59,070 --> 00:06:04,850
So, the under-the-door tool allows us to access areas that do have properly functioning dead latches.

66
00:06:04,850 --> 00:06:08,290
This bypass method targets doors that have lever-type handles.

67
00:06:08,990 --> 00:06:13,950
The tool itself is thick wire, about 5 feet long, with string tied to the end.

68
00:06:13,990 --> 00:06:17,990
The tool is measured against the door handle and bent into a hook shape at the top.

69
00:06:18,910 --> 00:06:24,250
As I mentioned before, this bypass method targets doors that have lever-type handles.

70
00:06:24,350 --> 00:06:28,890
In addition, you'll also need enough room under or beside the door to fit the tool.

71
00:06:29,030 --> 00:06:39,390
As you can see here with different types of levers, S-type levers and T-type levers are the easiest to use this bypass on, with U-type and Q-types being much more challenging.

72
00:06:40,150 --> 00:06:43,570
So, here's a quick video demonstration of how it's done.

73
00:07:22,020 --> 00:07:22,500
And...

74
00:07:22,500 --> 00:07:24,700
one more time, here's how it's done.

75
00:07:24,700 --> 00:07:29,040
In this video, I'm going to show you how to use an under-the-door bypass tool.

76
00:07:29,080 --> 00:07:32,600
They allow us to gain entry through doors with locked door handles.

77
00:07:33,300 --> 00:07:37,040
First, the tool is slid through the gap between the door and the floor.

78
00:07:37,040 --> 00:07:44,180
It is then maneuvered onto the inside door handle and pulled downwards, replicating the motion of someone opening the door from the inside.

79
00:07:46,760 --> 00:07:48,360
There you go, nice and easy.

80
00:07:48,360 --> 00:07:56,740
So, step-by-step, what you want to do is you want to insert the tool under the door, and then maneuver the tool until the top hook rests behind the door handle.

81
00:07:56,760 --> 00:08:01,360
You then move the tool to the end of the handle and pull on the string, actuating the lever.

82
00:08:03,060 --> 00:08:06,620
Again, I'm going to plug our DIY bypass tools workshop.

83
00:08:06,900 --> 00:08:13,800
In the workshop, we will be covering how to make this tool, and again, this will be using materials that you probably already have at home.

84
00:08:14,720 --> 00:08:16,900
Alright, let's talk about doorknobs.

85
00:08:17,620 --> 00:08:19,780
Doorknobs are often very difficult to bypass.

86
00:08:20,160 --> 00:08:24,960
Thankfully, they're slowly being phased out of use, but you may still encounter some of them in the wild.

87
00:08:25,460 --> 00:08:31,160
The tool for this bypass is a bent piece of wire, which is used to deposit a piece of string onto the doorknob.

88
00:08:31,400 --> 00:08:35,880
Tape, rubber, or other materials can be added to the string to help increase friction on the doorknob.

89
00:08:35,880 --> 00:08:38,240
So, on this image, I have some tape.

90
00:08:39,200 --> 00:08:42,420
So here's the tool again, but from slightly different angles.

91
00:08:44,880 --> 00:08:50,800
And as you can see, the wire is meant to go around the frame and have access to the front of the door.

92
00:08:51,940 --> 00:08:56,120
So, the requirement for this bypass method is a doorknob, of course.

93
00:08:56,120 --> 00:09:01,580
And, similar to the under-the-door tool, you also need enough room under or beside the door to fit the tool.

94
00:09:02,720 --> 00:09:05,260
So, the instructions for use are very simple.

95
00:09:05,260 --> 00:09:16,520
The tool is used to deposit this piece of string onto the doorknob, at which point the wire piece is removed, and then the string is pulled back and forth, creating tension, which slowly turns the doorknob.

96
00:09:17,160 --> 00:09:20,060
So, here's a quick little video demo for you guys.

97
00:09:20,660 --> 00:09:29,540
So, as you can kind of see, the tool is slowly being moved up the side of the door, and the string has tape attached to it to increase the friction on the doorknob.

98
00:09:30,340 --> 00:09:36,700
Once the tool is high enough, the string is maneuvered so that it lands over the doorknob.

99
00:09:45,190 --> 00:09:51,630
And then, both sides of the string are pulled back and forth to create friction, which then unlocks the door.

100
00:09:55,180 --> 00:10:01,120
Again, a little closer, you can see the friction on the doorknob as it slowly turns.

101
00:10:03,360 --> 00:10:05,280
Next is crash bars.

102
00:10:06,680 --> 00:10:11,220
Crash bars, not to be confused with push bars, are relatively simple in concept.

103
00:10:11,220 --> 00:10:14,640
The bar across the crash bar pushes down and unlocks the door.

104
00:10:15,940 --> 00:10:19,060
The tool for this is very similar to the under-the-door tool.

105
00:10:19,060 --> 00:10:25,140
The wire is cleverly bent and with some string used to actuate the crash bar and unlock the door.

106
00:10:26,440 --> 00:10:32,440
The requirements for this is a crash bar on the other side of the door and, again, enough room beside the door to fit the tool.

107
00:10:33,920 --> 00:10:44,600
So, to use this tool, you want to insert the tool through the side of the door, or start at the bottom and move up depending on how much room you have on the side of the door, and then rotate the hook until the hook lands on the crash bar.

108
00:10:44,760 --> 00:10:50,440
Once it's on the crash bar, you can pull down the string, which pulls the crash bar towards the door and unlocks it from the inside.

109
00:10:51,180 --> 00:10:54,880
So here's a quick demo video to demonstrate how this tool works.

110
00:11:00,840 --> 00:11:14,480
So, once I get it up the door frame, it hooks onto the bar of the crash bar, and then you can pull on the string, and it'll open the door.

111
00:11:16,000 --> 00:11:30,460
So, again, step by step, you want to get the tool into the side of the door and up, and then once it's high enough, you hook it onto the frame of the crash bar, and then you pull on the string, which pulls it towards the door.

112
00:11:31,340 --> 00:11:33,200
Now let's talk about push bars.

113
00:11:33,720 --> 00:11:39,020
Push bar-targeted bypasses tend to be more difficult due to there being less things for tools to hook onto.

114
00:11:39,320 --> 00:11:44,360
Often, the best bypass for a push bar is a latch-charging one, but this isn't always possible.

115
00:11:45,300 --> 00:11:48,580
So, the tool for this bypass is a piece of string.

116
00:11:48,940 --> 00:11:53,920
Optional is stiff wire or sticks for positioning the string, ideally in a hook or an L-shape.

117
00:11:54,920 --> 00:12:01,120
For this bypass method to work, the push bar must be either on a door with holes, or with room above and below the door.

118
00:12:02,220 --> 00:12:13,900
Pretty much how this bypass works is you feed the string through the top of the door or through a hole above the push bar, use the wire pieces to move the string over the push bar and through the bottom of the door, or through a hole below the push bar,

119
00:12:13,900 --> 00:12:16,540
and then you grab both pieces of the string and you pull.

120
00:12:16,540 --> 00:12:24,480
And this pulls the push bar towards the door, thus actuating it as if someone were exiting from inside, and unlocks the door.

121
00:12:25,500 --> 00:12:28,640
This next bypass is pulling really hard.

122
00:12:29,000 --> 00:12:37,300
So, pulling really hard is a long-standing tradition of physical hackers, and there are a lot of doors that are loose in the frame and can be pulled open with a strong enough arm.

123
00:12:37,820 --> 00:12:43,280
This is the easiest bypass method to pack for, all you need is a reasonably strong pair of arms.

124
00:12:44,340 --> 00:12:48,720
So, not all doors can be pulled open this way, but a surprising number of them can be.

125
00:12:48,720 --> 00:12:53,720
You want to look for springy, loose-in-the-frame kind of doors that have an amount of flex when you pull on them.

126
00:12:54,000 --> 00:12:57,580
Multibank doors often do have at least one door that is pullable.

127
00:12:58,600 --> 00:13:01,400
So, here's the instructions for use.

128
00:13:01,640 --> 00:13:06,680
Very complex, very difficult, so just feel free to take your time going over that.

129
00:13:07,360 --> 00:13:10,960
The next bypass I'm going to be talking about is removing the hinges.

130
00:13:11,520 --> 00:13:15,520
So, sometimes the easiest way to unlock a door is to not unlock it at all.

131
00:13:15,660 --> 00:13:21,060
Some doors are installed with the hinges backwards, which allow you to unscrew the door from the frame and take the door off the hinges.

132
00:13:21,540 --> 00:13:24,300
The tool for this is obviously a screwdriver.

133
00:13:24,720 --> 00:13:28,620
For this to work, the screws of the door hinges must be exposed and accessible.

134
00:13:29,400 --> 00:13:32,100
And it's pretty self-explanatory how to do this.

135
00:13:32,100 --> 00:13:36,420
You unscrew the hinges, and then you remove the door, and boom, you can enter.

136
00:13:36,620 --> 00:13:40,040
However, seeing hinges installed like that are not very common.

137
00:13:40,360 --> 00:13:45,100
However, doors that have the pin of the hinge exposed are very common.

138
00:13:45,100 --> 00:13:49,160
This pin can be removed and then allow the door to once again come off of the frame.

139
00:13:49,500 --> 00:13:55,680
The tool for this is a screwdriver or a nail, a hammer, and then optional but recommended vice grips.

140
00:13:56,360 --> 00:14:00,540
For this to work, the door must be an outward-swinging door with exposed hinges.

141
00:14:00,540 --> 00:14:05,300
And in addition, this will not work on security hinges, so things like set screws or stud hinges.

142
00:14:06,580 --> 00:14:17,840
So, how this works is if there is a decorative bottom cap, you can remove it with a screwdriver and hammer, and then once you've done that, you place the screwdriver under the hinge with the point touching the bottom of the hinge pin.

143
00:14:17,980 --> 00:14:22,240
Then you can use your hammer to gently tap the screwdriver until the pin can be pulled out.

144
00:14:22,520 --> 00:14:26,660
After you've finished that, you want to repeat that with the other hinge, and then you can remove the door.

145
00:14:27,440 --> 00:14:29,680
Here's a quick little demo video for you guys.

146
00:14:33,440 --> 00:14:39,400
So we gently tap it to have the hinge pin come out of the hinge.

147
00:14:40,700 --> 00:14:46,240
And once it's out enough, you can use the vice grips to pull it out the rest of the way.

148
00:14:46,560 --> 00:14:49,860
And then again, you want to repeat this with the other hinge pin.

149
00:14:53,420 --> 00:14:58,740
And once it's out enough, you want to take your vice grips and you can pull it out.

150
00:14:59,520 --> 00:15:07,200
And now that both hinges have their hinge pins removed, you can gently move the door out of the door frame.

151
00:15:08,940 --> 00:15:10,920
And boom, you have entry.

152
00:15:14,420 --> 00:15:16,640
Next, let's talk about padlock shims.

153
00:15:16,920 --> 00:15:21,320
So, these are padlock shims, and they can be bought online in plastic or metal versions.

154
00:15:21,360 --> 00:15:24,700
You can also make your own at home using aluminum cans.

155
00:15:25,820 --> 00:15:31,120
So, this is how a padlock works in normal operation, when you have a key and you're unlocking it.

156
00:15:32,080 --> 00:15:40,560
Padlock shims take advantage of the mechanisms inside of padlocks and force the mechanisms together that hold the shackle down, allowing you to pull it open.

157
00:15:40,600 --> 00:15:52,700
Of course, this doesn't work on all padlocks, and there are padlocks now that are designed to specifically prevent them from being used, but you would be surprised at the number of padlocks that are still in use that this can be used on.

158
00:15:53,380 --> 00:16:02,520
Again, I'm going to plug our DIY Bypass Tools Workshop, and they'll be going over how to make these and a lot of other tools as well, so drop by if you can.

159
00:16:03,960 --> 00:16:07,620
Now, let's talk about bypassing button-push combination boxes.

160
00:16:08,180 --> 00:16:12,780
So, button-push combination boxes allow access without needing to have a physical key.

161
00:16:12,960 --> 00:16:15,620
There are also boxes that can contain keys inside of them.

162
00:16:15,620 --> 00:16:19,360
I'm sure you've seen these before in communal spaces, apartments, things like that.

163
00:16:19,360 --> 00:16:23,660
And I'm sure you've seen boxes like this outside of areas that have a lot of storefronts.

164
00:16:23,660 --> 00:16:37,660
So these are used because when a company, an employer, needs to provide access to a store for a whole bunch of people, but doesn't want to create a key for every single person, what they'll do is they'll have one key, and they'll put it inside of this box,

165
00:16:37,660 --> 00:16:40,280
and then give each opening employee the combination.

166
00:16:40,560 --> 00:16:45,240
Then, they can use the key to unlock the door, put it back, and leave it for the next person to use.

167
00:16:46,380 --> 00:16:52,500
So, you can use UV ink or powder, and you can use that to figure out which buttons are being used to unlock the door.

168
00:16:52,760 --> 00:16:58,680
Using a UV light and a little bit of patience, you can reduce the number of possible combinations enough that you can brute force it.

169
00:16:59,300 --> 00:17:06,200
So, how you do this is you apply UV ink or powder to all of the buttons on the box, and then you wait for the lock to be used a few times.

170
00:17:06,200 --> 00:17:08,860
As people use it, the ink will rub off of the buttons.

171
00:17:09,600 --> 00:17:12,040
After a while, you can return with a UV light.

172
00:17:12,040 --> 00:17:15,860
The buttons used to unlock the box will have less ink on them than the others.

173
00:17:16,200 --> 00:17:19,760
Then, you can try all of the possible combinations with the inkless buttons.

174
00:17:21,040 --> 00:17:29,540
In addition to that, depending on the UV ink or powder that you use, it's possible for pigment to transfer from one button to another when someone's unlocking the box.

175
00:17:29,580 --> 00:17:33,440
You can use this to figure out the combination order without brute forcing the combination.

176
00:17:34,680 --> 00:17:43,240
And then, sometimes you don't even need to use a UV light to figure out the combination if anybody out there could guess how to unlock this lock.

177
00:17:44,180 --> 00:17:53,180
In addition to that, these are simplex locks, and when they come from the factory, their default code is pressing 2 and 4 at the same time and then 3.

178
00:17:53,280 --> 00:18:01,520
Very frequently, people will not bother to set a new combination and so there's a lot of simplex locks out there that still use that default code.

179
00:18:03,120 --> 00:18:04,540
And there's a game for it!

180
00:18:04,540 --> 00:18:14,980
So we've made a really, really cool button push combination lock game and they have several different button push combination locks to try out, and it's a really fun interactive game.

181
00:18:14,980 --> 00:18:21,760
You get UV ink and UV light, and it's a really good time, so head over to bypassvillage.org and go and try that out!

182
00:18:22,520 --> 00:18:24,900
Next, let's talk about hacking EnterPhones.

183
00:18:24,900 --> 00:18:33,500
So I'm sure you've seen these around before, but EnterPhones are devices that are used to let people into buildings, most commonly apartments, condos, and high-rises of that sort.

184
00:18:33,560 --> 00:18:38,740
They allow visitors to contact someone that lives in the building, who can then remotely unlock the door to let them in.

185
00:18:39,260 --> 00:18:47,620
There's a few major companies that make EnterPhones, and they're often key-to-like, meaning that one key can open all the EnterPhones made by the same company.

186
00:18:49,280 --> 00:18:56,000
So, what you want to do is you want to open the EnterPhone panel using the corresponding key, and you want to find the unlocking mechanism.

187
00:18:56,320 --> 00:19:00,580
Once you've found the unlocking mechanism, you want to use something conductive to jump through the mechanism.

188
00:19:00,820 --> 00:19:04,460
At that point, the door should unlock as if someone from inside buzzed you in.

189
00:19:05,000 --> 00:19:08,300
So, here's a quick little video on an EnterPhone bypass.

190
00:19:08,300 --> 00:19:08,800
...

191
00:19:22,120 --> 00:19:27,540
And, similar to the combination boxes, there is a game for this as well.

192
00:19:27,540 --> 00:19:32,840
So, if you've always wanted to try your hand at EnterPhone hacking, now's a really great opportunity to do so.

193
00:19:34,140 --> 00:19:39,440
The next bypass method I'm going to be talking about is wheelchair buttons and request exit sensors.

194
00:19:39,860 --> 00:19:44,200
So, wheelchair buttons allow the door to automatically open when the button's pressed.

195
00:19:44,400 --> 00:19:50,760
Sometimes, the button is installed so that it'll unlock and open the door, regardless of if the door should be locked otherwise.

196
00:19:51,320 --> 00:19:54,000
So, I have this great little clip here for you guys.

197
00:19:54,900 --> 00:20:00,880
So, as you see, the door is locked, but with a push of the wheelchair button, it's open.

198
00:20:02,380 --> 00:20:06,760
In addition to wheelchair buttons, there also exist request exit sensors.

199
00:20:06,780 --> 00:20:10,820
So, these are installed for the convenience of people that are inside exiting the building.

200
00:20:10,980 --> 00:20:18,860
Some are set up so that they automatically open as you approach them from the inside, but some just unlock and allow the person that's inside to exit the building.

201
00:20:18,860 --> 00:20:25,220
If you can trick the sensor into thinking that there's someone inside that wants to exit, then it'll unlock itself, allowing you access.

202
00:20:25,560 --> 00:20:33,060
So, here's a great clip from the YouTube channel WeHackPeople where they pass the sensor using canned air.

203
00:20:34,060 --> 00:20:34,500
...

204
00:20:41,350 --> 00:20:41,790
...

205
00:20:45,310 --> 00:20:48,130
Next, I'm going to be talking about elevators.

206
00:20:48,590 --> 00:21:02,810
So, elevators are pretty much everywhere nowadays, and very often in buildings and high-rises and things like that, there will be floors that are locked out and require a keycard or a fob or something to get into, whether that's through the stairway or through the elevator.

207
00:21:03,170 --> 00:21:07,930
Luckily, there are a lot of ways to bypass these, and you can get to lockout floors through elevator hacking.

208
00:21:08,530 --> 00:21:14,270
So, this is our elevator panel, and pretty much this is where we're going to be spending a large part of our time.

209
00:21:14,730 --> 00:21:16,090
So, common keys.

210
00:21:16,090 --> 00:21:22,250
A lot of elevator keys for various service modes are standardized, so here's a list of some of the more common ones.

211
00:21:22,250 --> 00:21:24,870
I recommend you look into these at your leisure.

212
00:21:25,450 --> 00:21:38,670
And these elevator keys can allow you to use special service modes, so things such as independent service mode, inspection service mode, attendant service mode, and fire service mode, which give you a lot more access privileges than you would when it's running in normal service mode.

213
00:21:39,170 --> 00:21:43,570
In addition to using common keys, you can also jumper and short the elevator panel.

214
00:21:43,710 --> 00:21:55,390
So, electronics runoff of signals representing open and shorted, and if we can trick this elevator into thinking that an open signal is being sent when it's not, or the other way around, then we can get it to behave the way that we want it to.

215
00:21:55,410 --> 00:21:59,170
So, we accomplish this by jumpering or shorting connections that are in the elevator panel.

216
00:21:59,690 --> 00:22:06,790
So, to do this, you want to disconnect the panel, whether that's unscrewing it, coaxing it open, etc., and then you want to find the thing that you want to bypass.

217
00:22:07,390 --> 00:22:10,410
At this point, it makes sense to identify the state of the mechanism.

218
00:22:10,410 --> 00:22:13,630
So, if the mechanism is open, then you want to short it, and vice versa.

219
00:22:13,830 --> 00:22:20,590
So, to short it, you want to use something conductive, whether that's wire, keys, alligator clips, anything of that sort, to connect both terminals.

220
00:22:21,030 --> 00:22:24,810
If you want to open the circuit, then you want to disconnect the leads or snip the wires.

221
00:22:25,050 --> 00:22:29,790
If you're unable to determine the state of the mechanism, then it is safe to attempt both methods.

222
00:22:30,890 --> 00:22:39,210
So, again, you want to take a look at it, and if your mechanism is shorted, then you want to disconnect the leads or snip the wires.

223
00:22:39,690 --> 00:22:45,350
And then if the mechanism is open, you want to short the mechanism by using something conductive to connect both of the terminals.

224
00:22:46,490 --> 00:22:48,030
So, there's a game!

225
00:22:48,090 --> 00:22:58,070
So, if you head over to bypassvillage.org, we have a nice little elevator hacking game that you can try out, and you can learn a bit more about elevator hacking in a safe environment.

226
00:22:59,370 --> 00:23:03,970
Another method of bypass through elevators is hoistway access.

227
00:23:04,010 --> 00:23:11,150
So, hoistway access, or getting on top of an elevator car and controlling it from there, is another way that you can access locked out floors using an elevator.

228
00:23:11,170 --> 00:23:20,970
I'm not going to be going more in depth for this today, because this talk is being recorded and put on the internet, but if you come out to our elevator hacking talk next year at Bypass Village, it will be covered.

229
00:23:22,650 --> 00:23:26,070
Next, let's talk about unlocked or improperly locked doors.

230
00:23:26,370 --> 00:23:31,910
Now, this sounds like it'd be very obvious, but you'd be surprised at the number of doors that are left unlocked or completely open.

231
00:23:31,950 --> 00:23:40,710
There's plenty of times that you can access an area just by pulling on some doors and seeing which ones are unlocked, especially in larger buildings, ones that have a lot of doors and a lot of entrances.

232
00:23:41,570 --> 00:23:53,990
So, there's a lot of reasons why a door won't be locked, whether it's human error, so something like a worker propping it open and forgetting to unprop it, or someone leaving clutter at the door and that holds it open, or environmental, so whether there's a warped door frame,

233
00:23:53,990 --> 00:24:00,350
or the lock is broken, or there's simply no lock there at all, all of these can cause the door to not be locked.

234
00:24:00,590 --> 00:24:11,350
So, here's a really great example of what appears to be a lab, perhaps, of some sort, and someone seems to have propped the door open with a stool, despite the sign saying, keep this door closed.

235
00:24:12,850 --> 00:24:14,790
Here's another great example.

236
00:24:14,790 --> 00:24:27,790
So, this door seems to have some sort of concrete at the base, and so this prevents the door from closing at all, so this door is just permanently open and permanently unlocked for anyone to stroll in.

237
00:24:28,210 --> 00:24:30,090
Here's another example.

238
00:24:30,470 --> 00:24:37,090
There is simply no lock, and, again, anyone can just pull open the door and just walk in.

239
00:24:38,410 --> 00:24:42,110
Finally, let's talk about ceilings, windows, and going around.

240
00:24:43,030 --> 00:24:45,650
So, here's a clip from a while ago.

241
00:24:45,650 --> 00:24:54,590
We encounter this very large fence with barbed wire on top and everything, but it really didn't provide too much trouble.

242
00:24:55,250 --> 00:25:01,790
Like I mentioned before, it's very easy to gain access to areas through windows, especially if they're low to the ground.

243
00:25:02,350 --> 00:25:05,470
Here's a great example of a bypass.

244
00:25:05,470 --> 00:25:16,650
This is a ladder with a ladder cage around it, and if you look at the photo on the right, there is a ladder grate at the bottom, and what this does is it prevents people from being able to climb the ladder.

245
00:25:17,350 --> 00:25:31,430
Unfortunately, if you go around to the other side of the ladder, there's plenty of space between the ladder and the wall, and you can easily climb up it and get to wherever it is you want to go without ever having to interact with the ladder cage or the grate.

246
00:25:32,570 --> 00:25:35,910
In addition to that, you can always go through the ceiling.

247
00:25:36,390 --> 00:25:52,490
So, a lot of places nowadays have false ceilings, and very often the walls will not rise up past these false ceilings, meaning that it's very easy to go from room to room or hallway to room over the walls without ever having to interact with the door.

248
00:25:52,770 --> 00:25:55,890
So here's a really great clip from a while back.

249
00:25:56,690 --> 00:26:08,270
In this case, we were very fortunate that there was a ladder that led up to a upper hatch, but we were able to take advantage of this to gain access into a room next door.

250
00:26:10,010 --> 00:26:20,550
So as you can see, he's very, very carefully undoing the ceiling tile, the holds that keep it there, moving it to the side, and there he is.

251
00:26:21,810 --> 00:26:29,290
Now he has access to an area that he otherwise shouldn't simply by going into the ceiling and over the wall.

252
00:26:31,810 --> 00:26:35,650
So the thing to keep in mind with this, though, is you want to be very, very careful.

253
00:26:35,650 --> 00:26:47,150
There's a lot of places that you can't step or can't hold your weight, and when you're up in a fragile area like that, one wrong move can prove to be very dangerous.

254
00:27:10,450 --> 00:27:13,130
So again, you have to be very, very careful.

255
00:27:13,130 --> 00:27:20,030
You need to know where you can and can't step and which areas can and can't support your weight.

256
00:27:20,050 --> 00:27:22,350
So here's another great example.

257
00:27:34,790 --> 00:27:45,490
So you just want to always be careful whenever you're trying this kind of bypass method, or really any other type of bypass method, or this could happen.

258
00:27:46,470 --> 00:27:49,430
So that wraps up my presentation for today.

259
00:27:49,450 --> 00:27:51,670
At this point, I'll be able to take some questions.

260
00:27:52,110 --> 00:27:56,510
Some big takeaways, come try out some of our games at bypassvillage.org.

261
00:27:56,510 --> 00:28:04,270
We worked really, really hard on them to make sure that they were available and ready for you guys to try out and get that hands-on experience learning about physical bypass.

262
00:28:04,490 --> 00:28:07,250
And also come to the DIY Bypass Tools Workshop.

263
00:28:07,470 --> 00:28:15,290
So we'll have a lot of tools being made, it'll be a really fun time, it'll be using materials you probably already have at home, so you might as well.

264
00:28:15,290 --> 00:28:17,870
And then you can also try these things out at home.

265
00:28:18,110 --> 00:28:23,470
If you guys have any questions for me, we'll now be going into a Q&A session, a live Q&A session.

266
00:28:23,730 --> 00:28:33,570
And if you missed that and still have questions, feel free to send me an email or send me tweets at Quineb or at Bypass Village.

267
00:28:33,730 --> 00:28:44,910
Special thanks to Sunny, Ege, Bobby, Bill, and Paul for all of your help with getting footage, putting together photos, getting everything ready for this presentation.

268
00:28:44,990 --> 00:28:46,170
Thank you so much guys!