WEBVTT 00:01.180 --> 00:02.640 Hello, everybody. 00:02.660 --> 00:04.340 Welcome to Lock Bypass Village. 00:04.340 --> 00:10.500 My name is Karen, and today I'm going to be taking you through Bypass 101, an introduction to basic bypass methods. 00:12.780 --> 00:15.960 So, before we get started, what is bypass? 00:16.340 --> 00:21.720 Very often, when people think about physical hacking, they think about show-your-methods, things like lockpicking. 00:21.960 --> 00:28.620 However, there are plenty of other methods that can allow people to access locked-out locations, and this is known collectively as lockbypass. 00:29.460 --> 00:34.900 So, to get things started, I have a fun video here, which is a really great example of lockbypass. 00:34.900 --> 00:41.720 It involves finding a security vulnerability, exploiting it, and then gaining access to areas that should otherwise be locked out. 00:45.700 --> 00:51.500 This next video shows what can happen if your security system is poorly designed or poorly thought out. 00:53.940 --> 00:56.720 My mom wanted to lock her door. 00:57.320 --> 00:59.240 She's got a sliding door. 01:00.560 --> 01:02.820 And this was her solution. 01:09.580 --> 01:11.560 So, why bypass? 01:11.820 --> 01:20.300 Lockbypass often involves ignoring the lock altogether and finding an alternative way to open the door, and sometimes even avoiding having to use the door altogether. 01:20.640 --> 01:28.820 Lockbypass methods are used often because they're much faster and more reliable than lockpicking, and they're used much more frequently in physical red teaming. 01:29.740 --> 01:35.100 So, as you can see here, we have our agenda for today, and there are a lot of different types of bypass here. 01:35.240 --> 01:43.640 In addition, the items that are in bold are available to play as games on our website, bypassvillage.org, so feel free to go check those out. 01:44.380 --> 01:47.580 So, let's get started with latch-targeted bypass. 01:48.200 --> 01:53.120 Latch-targeted bypass, or carding, targets the latches that hold the door closed. 01:53.180 --> 01:57.520 Depending on the orientation of the latch, you can either shove or pull the latch. 01:58.020 --> 02:00.660 There's a variety of tools that you can use for this. 02:00.660 --> 02:06.780 Most commonly, you'll see latch clips or traveler's hooks, plastic cards, or even a well-bent piece of wire. 02:07.900 --> 02:11.120 Circled here in red is what is known as a deadlatch. 02:11.120 --> 02:15.840 When the deadlatch is pushed in, it prevents the latch from being pushed in as well. 02:16.020 --> 02:18.840 This prevents you from being able to card a door. 02:21.060 --> 02:24.920 Here's a quick video demonstration of how a deadlatch works. 02:27.200 --> 02:33.620 So as you can see, when the deadlatch is pushed in, you can no longer get the latch into the door. 02:34.880 --> 02:42.500 Sometimes the door is installed in such a way that the deadlatch is already in a hole in the strike plate that is in the frame of the door. 02:42.540 --> 02:51.380 Other times, the deadlatch is installed almost properly, but you can get it to fall into the hole by shoving, pushing, maneuvering, or shaking the door. 02:52.520 --> 02:54.040 This is a deadbolt. 02:54.160 --> 02:58.380 They're different from deadlatches, and often you'll see them with a thumb turn on the other side. 02:58.640 --> 03:05.280 These prevent you from being able to use latch-targeted bypass techniques, and it also prevents you from using the under-the-door tool. 03:06.520 --> 03:08.900 So, the instructions for use for pulling. 03:09.160 --> 03:12.220 So first you want to make sure that the deadlatch isn't actuated. 03:12.560 --> 03:15.980 After that, you want to place the latch slip tool behind the latch. 03:16.260 --> 03:20.280 You then want to wiggle the latch slip to move the latch slowly into the door. 03:20.280 --> 03:25.040 And then, without removing the tool from holding in the latch, you want to pull the door open. 03:25.640 --> 03:29.720 Here's a quick video demo of how to do it. 03:33.930 --> 03:48.830 So as you can see, the door is locked, and we take our bypass tool and we put it behind the latch, and then we slowly wiggle it back and forth, slowly moving the latch into the hole in the door. 03:48.930 --> 03:51.070 And thus, it can be pulled open. 03:53.390 --> 03:55.910 So what exactly is happening here? 03:56.130 --> 04:07.670 Pretty much what the tool does is it takes advantage of the fact that the latch is at an angle, and it follows that angle to slowly push the latch into the hole in the door. 04:10.130 --> 04:11.550 So, for shoving. 04:11.550 --> 04:15.470 First, again, you want to ensure that the deadlatch is not actuated. 04:15.630 --> 04:19.970 Once you've done that, you want to shove the shoving tool between the latch and the strike plate. 04:20.030 --> 04:24.550 And then, without removing the tool from holding in the latch, you want to pull the door open. 04:25.070 --> 04:29.710 Again, here's a quick video demonstration of exactly how to do it. 04:30.430 --> 04:35.990 So you can see he has the thin plastic card here, and that the door is locked. 04:37.390 --> 04:44.850 You maneuver the card between the door latch and the strike plate, and you can push it open. 04:46.710 --> 04:49.730 So, again, how exactly does this work? 04:50.230 --> 04:57.670 Pretty much what you do is you take this latch, and, again, you're taking advantage of the angle of the latch. 04:57.670 --> 05:03.270 And this card slowly pushes the latch into the hole, allowing the door to be pulled open. 05:06.170 --> 05:10.610 So, again, here's a quick little visual demonstration for you guys. 05:11.490 --> 05:14.430 Have you been curious about wanting to try to make your own? 05:14.430 --> 05:22.210 We have several DIY Bypass Tools workshops over the DEF CON weekend, so here's the information there, so be sure to check that out. 05:22.210 --> 05:28.890 It'll be going over a variety of different physical Red Team tools, and how to make them using things you probably already have at home. 05:29.790 --> 05:31.690 In addition, there's also a game. 05:31.690 --> 05:34.770 We have a latch-slipping game at BypassVillage.org. 05:34.770 --> 05:39.390 So it's an interactive game where you can latch-slip doors, and there's varying levels of difficulty. 05:40.310 --> 05:43.130 Next, we'll be discussing handle-targeted bypass. 05:43.570 --> 05:47.930 Sometimes the dead latch is actuated, and the door absolutely cannot be carded. 05:47.930 --> 05:49.450 But there is still hope. 05:49.450 --> 05:54.030 There does exist lock-bypass methods that target the handle of the door instead of the latch. 05:54.030 --> 05:57.790 This method mimics a person exiting through the door from the other side. 05:59.070 --> 06:04.850 So, the under-the-door tool allows us to access areas that do have properly functioning dead latches. 06:04.850 --> 06:08.290 This bypass method targets doors that have lever-type handles. 06:08.990 --> 06:13.950 The tool itself is thick wire, about 5 feet long, with string tied to the end. 06:13.990 --> 06:17.990 The tool is measured against the door handle and bent into a hook shape at the top. 06:18.910 --> 06:24.250 As I mentioned before, this bypass method targets doors that have lever-type handles. 06:24.350 --> 06:28.890 In addition, you'll also need enough room under or beside the door to fit the tool. 06:29.030 --> 06:39.390 As you can see here with different types of levers, S-type levers and T-type levers are the easiest to use this bypass on, with U-type and Q-types being much more challenging. 06:40.150 --> 06:43.570 So, here's a quick video demonstration of how it's done. 07:22.020 --> 07:22.500 And... 07:22.500 --> 07:24.700 one more time, here's how it's done. 07:24.700 --> 07:29.040 In this video, I'm going to show you how to use an under-the-door bypass tool. 07:29.080 --> 07:32.600 They allow us to gain entry through doors with locked door handles. 07:33.300 --> 07:37.040 First, the tool is slid through the gap between the door and the floor. 07:37.040 --> 07:44.180 It is then maneuvered onto the inside door handle and pulled downwards, replicating the motion of someone opening the door from the inside. 07:46.760 --> 07:48.360 There you go, nice and easy. 07:48.360 --> 07:56.740 So, step-by-step, what you want to do is you want to insert the tool under the door, and then maneuver the tool until the top hook rests behind the door handle. 07:56.760 --> 08:01.360 You then move the tool to the end of the handle and pull on the string, actuating the lever. 08:03.060 --> 08:06.620 Again, I'm going to plug our DIY bypass tools workshop. 08:06.900 --> 08:13.800 In the workshop, we will be covering how to make this tool, and again, this will be using materials that you probably already have at home. 08:14.720 --> 08:16.900 Alright, let's talk about doorknobs. 08:17.620 --> 08:19.780 Doorknobs are often very difficult to bypass. 08:20.160 --> 08:24.960 Thankfully, they're slowly being phased out of use, but you may still encounter some of them in the wild. 08:25.460 --> 08:31.160 The tool for this bypass is a bent piece of wire, which is used to deposit a piece of string onto the doorknob. 08:31.400 --> 08:35.880 Tape, rubber, or other materials can be added to the string to help increase friction on the doorknob. 08:35.880 --> 08:38.240 So, on this image, I have some tape. 08:39.200 --> 08:42.420 So here's the tool again, but from slightly different angles. 08:44.880 --> 08:50.800 And as you can see, the wire is meant to go around the frame and have access to the front of the door. 08:51.940 --> 08:56.120 So, the requirement for this bypass method is a doorknob, of course. 08:56.120 --> 09:01.580 And, similar to the under-the-door tool, you also need enough room under or beside the door to fit the tool. 09:02.720 --> 09:05.260 So, the instructions for use are very simple. 09:05.260 --> 09:16.520 The tool is used to deposit this piece of string onto the doorknob, at which point the wire piece is removed, and then the string is pulled back and forth, creating tension, which slowly turns the doorknob. 09:17.160 --> 09:20.060 So, here's a quick little video demo for you guys. 09:20.660 --> 09:29.540 So, as you can kind of see, the tool is slowly being moved up the side of the door, and the string has tape attached to it to increase the friction on the doorknob. 09:30.340 --> 09:36.700 Once the tool is high enough, the string is maneuvered so that it lands over the doorknob. 09:45.190 --> 09:51.630 And then, both sides of the string are pulled back and forth to create friction, which then unlocks the door. 09:55.180 --> 10:01.120 Again, a little closer, you can see the friction on the doorknob as it slowly turns. 10:03.360 --> 10:05.280 Next is crash bars. 10:06.680 --> 10:11.220 Crash bars, not to be confused with push bars, are relatively simple in concept. 10:11.220 --> 10:14.640 The bar across the crash bar pushes down and unlocks the door. 10:15.940 --> 10:19.060 The tool for this is very similar to the under-the-door tool. 10:19.060 --> 10:25.140 The wire is cleverly bent and with some string used to actuate the crash bar and unlock the door. 10:26.440 --> 10:32.440 The requirements for this is a crash bar on the other side of the door and, again, enough room beside the door to fit the tool. 10:33.920 --> 10:44.600 So, to use this tool, you want to insert the tool through the side of the door, or start at the bottom and move up depending on how much room you have on the side of the door, and then rotate the hook until the hook lands on the crash bar. 10:44.760 --> 10:50.440 Once it's on the crash bar, you can pull down the string, which pulls the crash bar towards the door and unlocks it from the inside. 10:51.180 --> 10:54.880 So here's a quick demo video to demonstrate how this tool works. 11:00.840 --> 11:14.480 So, once I get it up the door frame, it hooks onto the bar of the crash bar, and then you can pull on the string, and it'll open the door. 11:16.000 --> 11:30.460 So, again, step by step, you want to get the tool into the side of the door and up, and then once it's high enough, you hook it onto the frame of the crash bar, and then you pull on the string, which pulls it towards the door. 11:31.340 --> 11:33.200 Now let's talk about push bars. 11:33.720 --> 11:39.020 Push bar-targeted bypasses tend to be more difficult due to there being less things for tools to hook onto. 11:39.320 --> 11:44.360 Often, the best bypass for a push bar is a latch-charging one, but this isn't always possible. 11:45.300 --> 11:48.580 So, the tool for this bypass is a piece of string. 11:48.940 --> 11:53.920 Optional is stiff wire or sticks for positioning the string, ideally in a hook or an L-shape. 11:54.920 --> 12:01.120 For this bypass method to work, the push bar must be either on a door with holes, or with room above and below the door. 12:02.220 --> 12:13.900 Pretty much how this bypass works is you feed the string through the top of the door or through a hole above the push bar, use the wire pieces to move the string over the push bar and through the bottom of the door, or through a hole below the push bar, 12:13.900 --> 12:16.540 and then you grab both pieces of the string and you pull. 12:16.540 --> 12:24.480 And this pulls the push bar towards the door, thus actuating it as if someone were exiting from inside, and unlocks the door. 12:25.500 --> 12:28.640 This next bypass is pulling really hard. 12:29.000 --> 12:37.300 So, pulling really hard is a long-standing tradition of physical hackers, and there are a lot of doors that are loose in the frame and can be pulled open with a strong enough arm. 12:37.820 --> 12:43.280 This is the easiest bypass method to pack for, all you need is a reasonably strong pair of arms. 12:44.340 --> 12:48.720 So, not all doors can be pulled open this way, but a surprising number of them can be. 12:48.720 --> 12:53.720 You want to look for springy, loose-in-the-frame kind of doors that have an amount of flex when you pull on them. 12:54.000 --> 12:57.580 Multibank doors often do have at least one door that is pullable. 12:58.600 --> 13:01.400 So, here's the instructions for use. 13:01.640 --> 13:06.680 Very complex, very difficult, so just feel free to take your time going over that. 13:07.360 --> 13:10.960 The next bypass I'm going to be talking about is removing the hinges. 13:11.520 --> 13:15.520 So, sometimes the easiest way to unlock a door is to not unlock it at all. 13:15.660 --> 13:21.060 Some doors are installed with the hinges backwards, which allow you to unscrew the door from the frame and take the door off the hinges. 13:21.540 --> 13:24.300 The tool for this is obviously a screwdriver. 13:24.720 --> 13:28.620 For this to work, the screws of the door hinges must be exposed and accessible. 13:29.400 --> 13:32.100 And it's pretty self-explanatory how to do this. 13:32.100 --> 13:36.420 You unscrew the hinges, and then you remove the door, and boom, you can enter. 13:36.620 --> 13:40.040 However, seeing hinges installed like that are not very common. 13:40.360 --> 13:45.100 However, doors that have the pin of the hinge exposed are very common. 13:45.100 --> 13:49.160 This pin can be removed and then allow the door to once again come off of the frame. 13:49.500 --> 13:55.680 The tool for this is a screwdriver or a nail, a hammer, and then optional but recommended vice grips. 13:56.360 --> 14:00.540 For this to work, the door must be an outward-swinging door with exposed hinges. 14:00.540 --> 14:05.300 And in addition, this will not work on security hinges, so things like set screws or stud hinges. 14:06.580 --> 14:17.840 So, how this works is if there is a decorative bottom cap, you can remove it with a screwdriver and hammer, and then once you've done that, you place the screwdriver under the hinge with the point touching the bottom of the hinge pin. 14:17.980 --> 14:22.240 Then you can use your hammer to gently tap the screwdriver until the pin can be pulled out. 14:22.520 --> 14:26.660 After you've finished that, you want to repeat that with the other hinge, and then you can remove the door. 14:27.440 --> 14:29.680 Here's a quick little demo video for you guys. 14:33.440 --> 14:39.400 So we gently tap it to have the hinge pin come out of the hinge. 14:40.700 --> 14:46.240 And once it's out enough, you can use the vice grips to pull it out the rest of the way. 14:46.560 --> 14:49.860 And then again, you want to repeat this with the other hinge pin. 14:53.420 --> 14:58.740 And once it's out enough, you want to take your vice grips and you can pull it out. 14:59.520 --> 15:07.200 And now that both hinges have their hinge pins removed, you can gently move the door out of the door frame. 15:08.940 --> 15:10.920 And boom, you have entry. 15:14.420 --> 15:16.640 Next, let's talk about padlock shims. 15:16.920 --> 15:21.320 So, these are padlock shims, and they can be bought online in plastic or metal versions. 15:21.360 --> 15:24.700 You can also make your own at home using aluminum cans. 15:25.820 --> 15:31.120 So, this is how a padlock works in normal operation, when you have a key and you're unlocking it. 15:32.080 --> 15:40.560 Padlock shims take advantage of the mechanisms inside of padlocks and force the mechanisms together that hold the shackle down, allowing you to pull it open. 15:40.600 --> 15:52.700 Of course, this doesn't work on all padlocks, and there are padlocks now that are designed to specifically prevent them from being used, but you would be surprised at the number of padlocks that are still in use that this can be used on. 15:53.380 --> 16:02.520 Again, I'm going to plug our DIY Bypass Tools Workshop, and they'll be going over how to make these and a lot of other tools as well, so drop by if you can. 16:03.960 --> 16:07.620 Now, let's talk about bypassing button-push combination boxes. 16:08.180 --> 16:12.780 So, button-push combination boxes allow access without needing to have a physical key. 16:12.960 --> 16:15.620 There are also boxes that can contain keys inside of them. 16:15.620 --> 16:19.360 I'm sure you've seen these before in communal spaces, apartments, things like that. 16:19.360 --> 16:23.660 And I'm sure you've seen boxes like this outside of areas that have a lot of storefronts. 16:23.660 --> 16:37.660 So these are used because when a company, an employer, needs to provide access to a store for a whole bunch of people, but doesn't want to create a key for every single person, what they'll do is they'll have one key, and they'll put it inside of this box, 16:37.660 --> 16:40.280 and then give each opening employee the combination. 16:40.560 --> 16:45.240 Then, they can use the key to unlock the door, put it back, and leave it for the next person to use. 16:46.380 --> 16:52.500 So, you can use UV ink or powder, and you can use that to figure out which buttons are being used to unlock the door. 16:52.760 --> 16:58.680 Using a UV light and a little bit of patience, you can reduce the number of possible combinations enough that you can brute force it. 16:59.300 --> 17:06.200 So, how you do this is you apply UV ink or powder to all of the buttons on the box, and then you wait for the lock to be used a few times. 17:06.200 --> 17:08.860 As people use it, the ink will rub off of the buttons. 17:09.600 --> 17:12.040 After a while, you can return with a UV light. 17:12.040 --> 17:15.860 The buttons used to unlock the box will have less ink on them than the others. 17:16.200 --> 17:19.760 Then, you can try all of the possible combinations with the inkless buttons. 17:21.040 --> 17:29.540 In addition to that, depending on the UV ink or powder that you use, it's possible for pigment to transfer from one button to another when someone's unlocking the box. 17:29.580 --> 17:33.440 You can use this to figure out the combination order without brute forcing the combination. 17:34.680 --> 17:43.240 And then, sometimes you don't even need to use a UV light to figure out the combination if anybody out there could guess how to unlock this lock. 17:44.180 --> 17:53.180 In addition to that, these are simplex locks, and when they come from the factory, their default code is pressing 2 and 4 at the same time and then 3. 17:53.280 --> 18:01.520 Very frequently, people will not bother to set a new combination and so there's a lot of simplex locks out there that still use that default code. 18:03.120 --> 18:04.540 And there's a game for it! 18:04.540 --> 18:14.980 So we've made a really, really cool button push combination lock game and they have several different button push combination locks to try out, and it's a really fun interactive game. 18:14.980 --> 18:21.760 You get UV ink and UV light, and it's a really good time, so head over to bypassvillage.org and go and try that out! 18:22.520 --> 18:24.900 Next, let's talk about hacking EnterPhones. 18:24.900 --> 18:33.500 So I'm sure you've seen these around before, but EnterPhones are devices that are used to let people into buildings, most commonly apartments, condos, and high-rises of that sort. 18:33.560 --> 18:38.740 They allow visitors to contact someone that lives in the building, who can then remotely unlock the door to let them in. 18:39.260 --> 18:47.620 There's a few major companies that make EnterPhones, and they're often key-to-like, meaning that one key can open all the EnterPhones made by the same company. 18:49.280 --> 18:56.000 So, what you want to do is you want to open the EnterPhone panel using the corresponding key, and you want to find the unlocking mechanism. 18:56.320 --> 19:00.580 Once you've found the unlocking mechanism, you want to use something conductive to jump through the mechanism. 19:00.820 --> 19:04.460 At that point, the door should unlock as if someone from inside buzzed you in. 19:05.000 --> 19:08.300 So, here's a quick little video on an EnterPhone bypass. 19:08.300 --> 19:08.800 ... 19:22.120 --> 19:27.540 And, similar to the combination boxes, there is a game for this as well. 19:27.540 --> 19:32.840 So, if you've always wanted to try your hand at EnterPhone hacking, now's a really great opportunity to do so. 19:34.140 --> 19:39.440 The next bypass method I'm going to be talking about is wheelchair buttons and request exit sensors. 19:39.860 --> 19:44.200 So, wheelchair buttons allow the door to automatically open when the button's pressed. 19:44.400 --> 19:50.760 Sometimes, the button is installed so that it'll unlock and open the door, regardless of if the door should be locked otherwise. 19:51.320 --> 19:54.000 So, I have this great little clip here for you guys. 19:54.900 --> 20:00.880 So, as you see, the door is locked, but with a push of the wheelchair button, it's open. 20:02.380 --> 20:06.760 In addition to wheelchair buttons, there also exist request exit sensors. 20:06.780 --> 20:10.820 So, these are installed for the convenience of people that are inside exiting the building. 20:10.980 --> 20:18.860 Some are set up so that they automatically open as you approach them from the inside, but some just unlock and allow the person that's inside to exit the building. 20:18.860 --> 20:25.220 If you can trick the sensor into thinking that there's someone inside that wants to exit, then it'll unlock itself, allowing you access. 20:25.560 --> 20:33.060 So, here's a great clip from the YouTube channel WeHackPeople where they pass the sensor using canned air. 20:34.060 --> 20:34.500 ... 20:41.350 --> 20:41.790 ... 20:45.310 --> 20:48.130 Next, I'm going to be talking about elevators. 20:48.590 --> 21:02.810 So, elevators are pretty much everywhere nowadays, and very often in buildings and high-rises and things like that, there will be floors that are locked out and require a keycard or a fob or something to get into, whether that's through the stairway or through the elevator. 21:03.170 --> 21:07.930 Luckily, there are a lot of ways to bypass these, and you can get to lockout floors through elevator hacking. 21:08.530 --> 21:14.270 So, this is our elevator panel, and pretty much this is where we're going to be spending a large part of our time. 21:14.730 --> 21:16.090 So, common keys. 21:16.090 --> 21:22.250 A lot of elevator keys for various service modes are standardized, so here's a list of some of the more common ones. 21:22.250 --> 21:24.870 I recommend you look into these at your leisure. 21:25.450 --> 21:38.670 And these elevator keys can allow you to use special service modes, so things such as independent service mode, inspection service mode, attendant service mode, and fire service mode, which give you a lot more access privileges than you would when it's running in normal service mode. 21:39.170 --> 21:43.570 In addition to using common keys, you can also jumper and short the elevator panel. 21:43.710 --> 21:55.390 So, electronics runoff of signals representing open and shorted, and if we can trick this elevator into thinking that an open signal is being sent when it's not, or the other way around, then we can get it to behave the way that we want it to. 21:55.410 --> 21:59.170 So, we accomplish this by jumpering or shorting connections that are in the elevator panel. 21:59.690 --> 22:06.790 So, to do this, you want to disconnect the panel, whether that's unscrewing it, coaxing it open, etc., and then you want to find the thing that you want to bypass. 22:07.390 --> 22:10.410 At this point, it makes sense to identify the state of the mechanism. 22:10.410 --> 22:13.630 So, if the mechanism is open, then you want to short it, and vice versa. 22:13.830 --> 22:20.590 So, to short it, you want to use something conductive, whether that's wire, keys, alligator clips, anything of that sort, to connect both terminals. 22:21.030 --> 22:24.810 If you want to open the circuit, then you want to disconnect the leads or snip the wires. 22:25.050 --> 22:29.790 If you're unable to determine the state of the mechanism, then it is safe to attempt both methods. 22:30.890 --> 22:39.210 So, again, you want to take a look at it, and if your mechanism is shorted, then you want to disconnect the leads or snip the wires. 22:39.690 --> 22:45.350 And then if the mechanism is open, you want to short the mechanism by using something conductive to connect both of the terminals. 22:46.490 --> 22:48.030 So, there's a game! 22:48.090 --> 22:58.070 So, if you head over to bypassvillage.org, we have a nice little elevator hacking game that you can try out, and you can learn a bit more about elevator hacking in a safe environment. 22:59.370 --> 23:03.970 Another method of bypass through elevators is hoistway access. 23:04.010 --> 23:11.150 So, hoistway access, or getting on top of an elevator car and controlling it from there, is another way that you can access locked out floors using an elevator. 23:11.170 --> 23:20.970 I'm not going to be going more in depth for this today, because this talk is being recorded and put on the internet, but if you come out to our elevator hacking talk next year at Bypass Village, it will be covered. 23:22.650 --> 23:26.070 Next, let's talk about unlocked or improperly locked doors. 23:26.370 --> 23:31.910 Now, this sounds like it'd be very obvious, but you'd be surprised at the number of doors that are left unlocked or completely open. 23:31.950 --> 23:40.710 There's plenty of times that you can access an area just by pulling on some doors and seeing which ones are unlocked, especially in larger buildings, ones that have a lot of doors and a lot of entrances. 23:41.570 --> 23:53.990 So, there's a lot of reasons why a door won't be locked, whether it's human error, so something like a worker propping it open and forgetting to unprop it, or someone leaving clutter at the door and that holds it open, or environmental, so whether there's a warped door frame, 23:53.990 --> 24:00.350 or the lock is broken, or there's simply no lock there at all, all of these can cause the door to not be locked. 24:00.590 --> 24:11.350 So, here's a really great example of what appears to be a lab, perhaps, of some sort, and someone seems to have propped the door open with a stool, despite the sign saying, keep this door closed. 24:12.850 --> 24:14.790 Here's another great example. 24:14.790 --> 24:27.790 So, this door seems to have some sort of concrete at the base, and so this prevents the door from closing at all, so this door is just permanently open and permanently unlocked for anyone to stroll in. 24:28.210 --> 24:30.090 Here's another example. 24:30.470 --> 24:37.090 There is simply no lock, and, again, anyone can just pull open the door and just walk in. 24:38.410 --> 24:42.110 Finally, let's talk about ceilings, windows, and going around. 24:43.030 --> 24:45.650 So, here's a clip from a while ago. 24:45.650 --> 24:54.590 We encounter this very large fence with barbed wire on top and everything, but it really didn't provide too much trouble. 24:55.250 --> 25:01.790 Like I mentioned before, it's very easy to gain access to areas through windows, especially if they're low to the ground. 25:02.350 --> 25:05.470 Here's a great example of a bypass. 25:05.470 --> 25:16.650 This is a ladder with a ladder cage around it, and if you look at the photo on the right, there is a ladder grate at the bottom, and what this does is it prevents people from being able to climb the ladder. 25:17.350 --> 25:31.430 Unfortunately, if you go around to the other side of the ladder, there's plenty of space between the ladder and the wall, and you can easily climb up it and get to wherever it is you want to go without ever having to interact with the ladder cage or the grate. 25:32.570 --> 25:35.910 In addition to that, you can always go through the ceiling. 25:36.390 --> 25:52.490 So, a lot of places nowadays have false ceilings, and very often the walls will not rise up past these false ceilings, meaning that it's very easy to go from room to room or hallway to room over the walls without ever having to interact with the door. 25:52.770 --> 25:55.890 So here's a really great clip from a while back. 25:56.690 --> 26:08.270 In this case, we were very fortunate that there was a ladder that led up to a upper hatch, but we were able to take advantage of this to gain access into a room next door. 26:10.010 --> 26:20.550 So as you can see, he's very, very carefully undoing the ceiling tile, the holds that keep it there, moving it to the side, and there he is. 26:21.810 --> 26:29.290 Now he has access to an area that he otherwise shouldn't simply by going into the ceiling and over the wall. 26:31.810 --> 26:35.650 So the thing to keep in mind with this, though, is you want to be very, very careful. 26:35.650 --> 26:47.150 There's a lot of places that you can't step or can't hold your weight, and when you're up in a fragile area like that, one wrong move can prove to be very dangerous. 27:10.450 --> 27:13.130 So again, you have to be very, very careful. 27:13.130 --> 27:20.030 You need to know where you can and can't step and which areas can and can't support your weight. 27:20.050 --> 27:22.350 So here's another great example. 27:34.790 --> 27:45.490 So you just want to always be careful whenever you're trying this kind of bypass method, or really any other type of bypass method, or this could happen. 27:46.470 --> 27:49.430 So that wraps up my presentation for today. 27:49.450 --> 27:51.670 At this point, I'll be able to take some questions. 27:52.110 --> 27:56.510 Some big takeaways, come try out some of our games at bypassvillage.org. 27:56.510 --> 28:04.270 We worked really, really hard on them to make sure that they were available and ready for you guys to try out and get that hands-on experience learning about physical bypass. 28:04.490 --> 28:07.250 And also come to the DIY Bypass Tools Workshop. 28:07.470 --> 28:15.290 So we'll have a lot of tools being made, it'll be a really fun time, it'll be using materials you probably already have at home, so you might as well. 28:15.290 --> 28:17.870 And then you can also try these things out at home. 28:18.110 --> 28:23.470 If you guys have any questions for me, we'll now be going into a Q&A session, a live Q&A session. 28:23.730 --> 28:33.570 And if you missed that and still have questions, feel free to send me an email or send me tweets at Quineb or at Bypass Village. 28:33.730 --> 28:44.910 Special thanks to Sunny, Ege, Bobby, Bill, and Paul for all of your help with getting footage, putting together photos, getting everything ready for this presentation. 28:44.990 --> 28:46.170 Thank you so much guys!