DEFCONConference
5 HN recommenders · recommended in 9 months, 2016–2026
1:00:17 · 877K views · Jan 7, 2015
Deviant Ollam and Howard Payne give an in-depth DEF CON 22 explanation of how elevators work, from the pit to the penthouse. It covers their control modes and how pen testers use elevators to bypass building security.
HN brings it up in any thread about elevators or physical security as a fascinating, entertaining deep dive.
9 comments from Hacker News
If you like elevator hacking don’t forget the seminal DEF CON talk by Deviant Ollam and Howard Payne: this video I watch it like once a year because it always tickles some part of me. Like all the different modes you can get an elevator into. The most fancy one people might encounter is when moving into or out of a building. The front office can give you a key to give exclusive control over an elevator so your movers aren’t waiting around on elevators. Put it in that mode and it will stop responding to calls from other floors. Only the person with the key can control the elevator. You get on, select the floor, door closes elevator goes, and then just chills there with the door open waiting for you. Annoying for the rest if the building (the building is down an elevator when in that mode) but is amazing for the person using it! But there are way, way more depending on the installation and function. Fun fact: most elevator shafts are sealed at the top as tight as possible to prevent them from becoming a giant chimney in a fire. It never even occurred to me until I was in a mechanical room wondering “where is the hatch to look down the shaft?” The answer is “there is none, and it’s a feature not a bug.” You want to block all airflow so fire doesn’t chase up the shaft into neighboring floors. Who knew!
If you liked the original post, you will probably LOVE this DEFCON talk about elevator hacking: this video It also gives a lot of fascinating information about elevators in general and specific operation modes. e.g. there is a "riot mode" where the elevator goes to every floor except the first (or ground in EU) floor aka to the lobby. The idea was that, during a riot, a luxury building in NYC would lock the stairwell access from the lobby but people could still take the elevator to the other floors to visit their neighbors etc
I realise the thread is phone phreaking related and that was kind of the point of your post; but in the spirit of the talk below to think more outside the box... There's a pretty good chance in many cases you can just open the external box with some easy to get (and relatively standard) key. And hit a button. Related: [LINK] This is a good related talk - goes outside the box on all the ways you can often get into commercial buildings without picking (or even in many cases, interacting with) the lock "The Search for the Perfect Door" by Deviant Ollam [LINK] Also good: [LINK] [Howard Payne & Deviant Ollam - This Key is Your Key, This Key is My Key] this video [DEF CON 22 - Deviant Ollam & Howard Payne - Elevator Hacking - From the Pit to the Penthouse]
I love pentesting stories. Great blog post, I was smiling while reading most of it. It reminded me of Deviant Ollam's stories such has his elevator security talk w/ Howard Payne: this video
Deviant Ollam - The Hotel Room Gourmet [LINK] Also not 2018 but his elevator with Howard Payne talk: this video (1h version) [LINK] (2h version) And the search for the perfect door: [LINK]