DEF CON 22 - Deviant Ollam & Howard Payne - Elevator Hacking - From the Pit to the Penthouse

Elevator Hacking - From the Pit to the Penthouse
Deviant Ollam The CORE Group
Howard Payne The CORE Group
Throughout the history of hacker culture, elevators have played a key role. From the mystique of students at MIT taking late-night rides upon car tops (don't do that, please!) to the work of modern pen testers who use elevators to bypass building security systems (it's easier than you think!) these devices are often misunderstood and their full range of features and abilities go unexplored. This talk will be an in-depth explanation of how elevators work... allowing for greater understanding, system optimizing, and the subversion of security in many facilities. Those who attend will learn why an elevator is virtually no different than an unlocked staircase as far as building security is concerned!
While paying the bills as a security auditor and penetration testing consultant with his company, The CORE Group, Deviant Ollam is also member of the Board of Directors of the US division of TOOOL, The Open Organisation Of Lockpickers. Deviant runs the Lockpicking Village with TOOOL at HOPE, DEFCON, ShmooCon, etc, and he has conducted physical security training sessions for Black Hat, DeepSec, ToorCon, HackCon, ShakaCon, HackInTheBox, ekoparty, AusCERT, GovCERT, CONFidence, the United States Military Academy at West Point, and the United States Naval Academy at Annapolis. His favorite Amendments to the US Constitution are, in no particular order, the 1st, 2nd, 9th, & 10th.
Twitter: @deviantollam, @TCGsec
Howard Payne is an elevator consultant from New York specializing in code compliance and accident investigations. He has logged over 9,000 hours examining car-tops, motor rooms, and hoistways in cases ranging from minor injuries to highly-publicized fatalities, and has contributed to forensic investigations that have been recognized by local, State, and Federal courts. Howard has appeared on national broadcast television making elevators do things they never should. When he's not riding up and down high-rise hoistways, he moonlights as a drum and bass DJ and semi-professional gambler. His favorite direction is Up and his favorite elevator feature is riot mode.
Twitter: @SgtHowardPayne

[@CBaggers]

This is the only tech talk I've ever seen where multiple presenters shared the floor and it wasnt an awkward, hokey, stilted mess. Well done to these guys, and for the excellent content

[@ShahabSheikhzadeh]

this is what happens when you rehearse many, many times :)

[@MiguelisNoisy]

34:19

[@calamaria9221]

The Defcon guys really need to stop interrupting talks in the middle of them. Also lmao "I hope I didn't get you off time" when they didn't care anyway and then comes 7 minutes early to get them off the stage early.

[@soyebpatel2994]

😅😅😊😅w😊😊😮😮😮.😂😢a😮😊😅😅 8 x 😂😂🎉😂🎉

[@RandomUser2401]

fr. what buss do these guys have being on the stage. let the flippin speakers alone.

[@ViKODiN_]

Thought the same thing myself. Why not do the shots after or in the beginning instead of totally ambushing the speakers (who were killing it) 😂😂. And then he kinda has this condescending approach at the end, and the inflection he uses when trying to lure them w alcohol shots that they probably don’t give two shxts about anyways, speaking to them like pets or subhuman. Just weird behavior 😅😂

[@Cfomodz]

I understand what you’re saying, and it was a bit cringe to hear them call him a new speaker, and then later refer to them as new speaker”s” when he already said he wasn’t…. And also… is & was kind of famous in this community, so… 🤷‍♂️ but annnnyway, if you’ve never been to DEFCON in person or didn’t go to anything but talks/have only watched talks online then you likely aren’t familiar with goons being goons and doing goony stuff, but that was kind of unsurprising goon behavior if we’re being real, and they are most all actually really cool, but they are hackers/nerds in positions of authority and you can tell they’re a bit awkward and uncomfortable because that’s the type of person most of us are. I recognize this comment is 4y old, but it’s getting a ton of likes and more recent replies, so I just wanted to say this in fairness to them and the interruption. When stuff like this happens live it’s a lot less jarring as well. I don’t know if it’s on YT but I think it was DC 17 when the fire marshal showed up and 🐻 had to clear the main hall of the Riviera for like an hour. That was indeed disruptive, but stuff like this is mostly taken in stride and I would venture to say happens at every con.

[@maneatingcheeze]

The big thing I learned from this talk is that only professionals should work the shaft.

[@atanaciogarza7176]

underrated post. LMFAO

[@deathless12345678]

We work it well. Up and down all day long.

[@vaguelyexhausted]

you're at 69 likes so I'm not allowed to like it sorry

[@UselessDuckCompany]

this talk was fascinating. I found the interruptions to be a bit annoying though.

[@damstachizz]

The interruptions were extremely fucking annoying, the guys are up there to talk let them talk

[@jimenezdecosta8478]

It was the last talk of the day, i can understand they do something funny at the end.

[@jeremyhonner6469]

u see much defcon? every new talker has to take a shot, its been tradition for ages.

[@xl000]

that bro attitude... Alcohol is not something everyone enjoys

[@Abracadanie1]

There is another video which is a longer version of this talk on youtube, same guys, just a different Venue and two hours in stead of one.

[@levo75]

As an elevator mechanic: very good talk! Also: follow their advice on not entering the shaft if you don't know what you're doing, you will die.

[@Charliepinman]

Ill take that advice!

[@tadferd4340]

That to me says that there needs to be safer hoistway designs to keep elevator techs safe. Everyone deserves the safest possible workplace. Some jobs are inherently unsafe but elevator maintenance shouldn't be one.

[@SF-dy6hn]

@@tadferd4340 meh kinda like saying we need safer electricity. if you know what the fuck you are doing study the specific building schematics go to school for it and use proper precaution you'll be fine. it would probably require a dickload of research that your average goofball thinks he knows, but doesn't. with computers you are given a certain amount of leeway that the physical world just doesn't offer.

[@tadferd4340]

@@SF-dy6hn I disagree. You can design safer working environments, or create other engineering solutions. This is often the best solution. Humans are very good at making mistakes, even when properly trained. In other cases, no amount of training will help protect you. Using electricity as an example. Racking circuit breakers is dangerous business. Why rack in person when you can do it remotely? People will say cost but we need to stop putting monetary cost before cost of life.

[@volundrfrey896]

That sounds like a challenge to me

[@mayhem661616]

There was a case last year in California. A murderer on life sentence escaped by making a copy of the wardens master key. He got a really close look because the wardens key was in a photo on a pamphlet given to prisoners on their way into lock up.

[@supremebeme]

"we have seven minutes, and we're going to use all seven minutes"

[@pickle7056]

There's a sex joke in there somewhere...

[@tonyrivera7048]

Yeah that was cool af, respect for not being pushed over and scammed of their talking time. Especially after the first interruption

[@Volvith]

About 13 minutes into this talk, i understood why this had to be the last talk at the last day of DEFCON. ... Rule #1: Don't trust people to know what they're doing, people are idiots. You can invent better idiot proofing for anything, but the world will just invent a better idiot.

[@lousassel7809]

I spent an hour learning about elevators and was entertained the entire time. I think my 'tism is flaring up

[@ofyourbluesky]

You and me both, bud

[@Jonathan.Boring]

@@ofyourbluesky I’ve watched this talk over three times. Me three bud

[@thesomewhatfantasticmrfox]

Y'all just like me for real. Thinking about something, then trolling across the internet for some strange info you merely thought about six hours ago.

[@119793]

yeah i don’t think any normal people are on the Hour Long Elevator Video to be fair i think we’re all tism here

[@sixstringedthing]

90% of "elevator based security" relies on Joe Public looking at the keyswitches on the COP or a slightly-ajar push panel and thinking to themselves... "that looks important... better not touch it or I might get in trouble". The number of times I've opened emergency phone panels and found priority/maintenance/fire service keys just right there in the switches, waiting to be turned...

[@Cfomodz]

Easy, just put “Do not turn key” 🤣 on it

[@johnantonopoulous6381]

I work in a hospital and have been in the elevator when med flight landed and holy crap that thing moves fast when they hit the ER Call button.

[@SondreGrneng]

​@Trantor The Troll To be fair, if someone is going to the ER, chances are, they need to be there 5 minutes ago. Especially if he's coming in from the air.

[@uzaiyaro]

Anti nuisance mode works a little differently in quite a few lifts in Australia. If you press all the floor buttons, they *will* be registered, and the lift will make two stops. If it detects that no one has entered or exited for two stops, it deletes the rest of the calls and becomes idle/ready again, because the controller can reasonably assume that there is no one in it. I thought that implementation was quite clever, because it is possible that many legitimate calls may be punched in at the same time, for example a ton of people get on at one floor, you're standing next to the panel and you're kind enough to ask, "what floor do you guys need?" 4, 6, 8, 9, 10, 14, etc etc.

[@DataumCats]

it can work that out by knowing it weight. Threeish people got on the car but 7 floors got pressed? yea nah. Car empty and any floor is pressed? yea nah. 15 people get on and 10 floors are pressed? Just fine.

[@shepd3]

@@DataumCats So fat people get to tamper a little bit more? Being overweight has it's advantages!

[@aolson1111]

@@DataumCats And skinny people won't be able to make it to their floor.

[@amyx231]

A Olson Summer camp group enters elevator. They each have rooms on a different floor of the hotel. Multiple floors pressed. Elevator: nope, this one obese person doesn’t need 10 floors.

[@CaptainBlagbird]

@@aolson1111 Thus skinny people get skinnier by having to walk a few floors most of the time. xD

[@rchaffer]

These DEFCON talks are rediculously fascinating! Stop killing my productivity!

[@sbalogh53]

I should have been in bed 5 hours ago. It is now 5:40am. FML!

[@YoUtUbEhAnDlEsArEgReAt]

ridiculously*

[@haass...9065]

@@sbalogh53 same!!

[@DeetexSeraphine]

Never (this week) has a comment made by another read so truthful

[@StephenOwen]

Great job soldiering on through the interruptions!

[@kordru]

Very good at it too!

[@cravenmoorehead5657]

I wish that guy would shut the fuck up jesus!

[@caelan5301]

Back when I was in high school, any time me and my friends wanted to skip class, we would go to the elevator (it had a lock but one of us figured out that we could stick some paper in and make it open) and my buddy had some knowledge about all this, and we would get it in independent service mode and just hide in the elevator until the period ended. I've got fond memories playing smash with my friends in the elevator.

[@RaW_Chaos]

nice, skipping class and smashing with the homies in an elevator, very classy

[@electricimpulsetoprogramming]

@@RaW_Chaos LMAOOOOOOOOOOOOO

[@-Ncrypt]

@@RaW_Chaosthis deserves so much more than 7 likes 😢

[@GaryCameron780]

Pressing the buttons for all the floors in a 34 storey freight elevator will tie it up for 45 minutes. A work mate thought this would be a good idea and nearly got canned. (Said building only has one freight elevator)

[@hemi4722]

Gary Cameron haha that's awesome

[@SirFrag32]

Every time I've tried this the system realizes what you're doing after a few floors and clears the panel heh

[@xyzshantaram]

Pressing the button again will deactivate that destination.

[@mrlithium69]

not always

[@AdeptPaladin]

Then his building should use the anti nuisance function that elevators have in order to prevent such asshattery

[@licustoms]

A family member whom has passed away leaving me with all of their stuff was an elevator repair and installer for a very long time. This was really fascinating to see... and now I know what some of the special tools are that I have. Much appreciated! I have no idea what to do with them but for now I will keep them.

[@michaelodonoghue7464]

I was working Security in a Building and whilst travelling in the elevator with the Security Manager asked how often Security Tested the Emergency Phones. His response was that that was covered by the Lift Maintenance Contract. Yes the Circuits were Tested by Lift Maintenance for Operability, but not for Destination of Call. A Week late a Man got trapped in an Elevator for 12 Hours. His Emergency Phone although working was routed to an Answering Service in an Unattended Department. Four Hours after the Man had been rescued from the Elevator, the Security Centre got a Panic Phone Call from the Head of a Department who had just listened to 6 Phone Call from a panicked individual trapped in an Elevator. Next day, Security Personnel were Instructed to Test Emergency Phones Regularly (Daily).

[@Al-.-ex]

Love the very sensible, mature & *emphasised* safety part at the end. Felt like I could trust these guys a lot more with how much they drilled safety into your head the whole way through.

[@pyro4life64]

This has to be the most interesting elevator video on here, even as a 20 plus year elevator mechanic I found this video very well done.

[@Huntracony]

Out of curiosity, did you learn anything from it?

[@SaintNobody]

My favorite elevator control? No buttons, but a camera. On the top floor of the building, "Control," says they don't know you and asks for your chit number. You go to the top and prove you're supposed to be there. Then, they give you a chit. Four hours later, they recognize you and you just tell them where you want to go and they move you. Second favorite elevator control: Medeco key leading to floor with a surveillance killzone. You identify yourself, even though they know you, then use your OTHER medeco key to obtain access. If you're doings anything like this, bring your written orders to avoid detention.

[@peregrinusoblivione4967]

Very cool.

[@roswalt1]

Definitely don't try this in a building that handles government medical claims. You will not have a good day unless you have your "get out of jail" pen test contract with you.

[@konzetsu6068]

Been to a condo in London, 6 cars, no call buttons, every elevator call going up was made from the reception desk.

[@linolium4814]

I'm a wheelchair user so elevators are kind of my thing. This talk is really interesting and I learnt a lot. :)

[@matthewhall2399]

Learned*

[@linolium4814]

@@matthewhall2399 Sorry English isn't my first language

[@jformaldehydem]

I can confirm that holding the door closed button on an elevator did work on one specific location for me, for at least a year. It was at the library at the university I studied at, and I rarely abused my newfound powers...rarely...But I have never seen it work since. And I don't know how people think it works, but it was clearly a bug in the operating software, that has since been patched (I mean, I DID graduate 16 years ago). The elevator would stop as normal, which was your signal to hit the button, and you'd hear the actuators rapidly cycle to open and then closed, and the elevator would continue on its journey. I can only imagine how crazy this would drive the people on the other side, especially since I assume it would register that the call had been answered and would reset the call flag.

[@ErebuBat]

jformaldehydem that sounds like the relay logic issues they mentioned.

[@cdnbacon2001]

4am and i watched the whole thing. not sure how i got here but as an electrician and former security guard (7 years) i was fascinated.

[@poohbear01x48]

I live in Phoenix and before the news about the keys dropped, it was essentially common knowledge what the fire access code for all gated communities was. Phoenix fire has a security issue for sure.

[@amyshaw893]

that show with the guy cutting the elevator cable is called the secret life of machines

[@stevewalston7089]

Thanks! Watched the program years ago but could not remember the name. Most excellent series.

[@MikoWilson]

Defcon dude's interrupting talks is pretty old at this point. It's super cringe. Just stopppp.

[@mutatedpixel8042]

Super cool! learned a bunch of stuff I didnt know (including the escalator helicopter!)

[@DownTownDowns]

The people interrupting need to do some elevator-surfing.....and hopefully it goes wrong for them

[@lohphat]

"Rope" doesn't only mean jute/nylon. When first invented, cables were called wire or steel rope.

[@spazmaticaa7989]

Me: ooh, I interesting video maybe I'll watch 20mins do my chores and come back later. Hour later, This was awesome...

[@biggerdog2458]

I appreciate not having to watch any ads on such a long and awesome video!

[@baileyhollis4086]

These guys are setting up for one huge heist...

[@leavewe]

*hoist

[@robertoswalt319]

Why rob some place when you can get paid to do it legally over and over again?

[@khhnator]

well they did warn everyone to not use elevators for security

[@swine13]

@@robertoswalt319 agreed - at a certain point these skills will always pay better and more reliably if done for the blue team (so to speak)

[@fdsman]

The irony about the elevatorkeys bit is that howard owns the site lmao

[@Imdan92]

fdsman LOL, makes it do much better

[@ironmatic1]

Are you sure he owns elevatorkeys and not pentestingkeys?

[@testsubjectism]

Did anyone else see that you could see the numbers behind the black bars? seems like a ironic oversight

[@danmana]

made me look

[@joshuaraydunaway]

its only on the first slide of state-specific keys

[@polyjohn3425]

They're just blacked out as a courtesy gesture. The whole point of a lot of this is security, and relying on the secrecy of key bitting as a security measure is atrocious practice. And considering they showed those slides after explaining exactly how they got those numbers and how easy it was, hiding the bit numbers is barely useful. Anyone who wants to figure them out can figure them out quite easily, that's kinda the point of the talk.

[@TheEzzran]

That elevator at around 42:00 would be easy even without the fire key. Just call it, step inside, then wait for someone else to call it to leave and walk out on the next floor. I mean, not as quick as the other way, but you're in.

[@elguapo1690]

Holy shit. That would have scared the management a lot more than this guy with his keys.

[@rudolphfulmer1710]

Except the person getting off the elevator would have called it in to security since they only used that back elevator as an exit. It technically could be done but it increases the likelihood of detection exponentially unnecessarily.

[@jamiehanrahan4705]

Just FYI - the hydraulic-operated glass elevator on the El Cortez Hotel reached the "Sky Room" on the 15th storey (counting the ground floor, the origin, as the 1st).

[@smrts]

4:46 "the highest I've ever seen is eight stories" I work a convention in green bay the Hyatt attached to the Ki Convention center is 8 or 9 stories(can't remember for sure off hand) they have a piston elevator and it is the slowest thing ever.

[@firesurfer]

Macy's Herald sq freight elevators go up to 8 or 9th floor. It's hydraulic and can lift entire 40 foot trailers. The tractor stays on the ground. At least they used to, they renovated the store and I don't see the loading docks anymore.

[@jpe1]

Sabbath Mode: "It's kind of like hacking God [...] I found a loophole in scripture so I'm smarter than you!" pretty much sums up the Jewish faith:)

[@DJzSith]

That was the funniest thing I learned all thay. Never though about solving sabbath day problems before. I can now see a nice market for autonomous cars.

[@sixstringedthing]

See the wiki article on "Eruv" for the ultimate way to "legal loophole" your way out of inconvenient holy commandments.

[@iglidor]

Tyrone: There is a lot of apliances with sabbath mode. For example electric heaters that can be voice activated. Or even saw oven that is "certified" that you can use it on sabbath days so that you switching switches somehow do not count on that device since it is consecrated or whatever. Quite funny example of how people are walking circles around their own scriptures. But as long as it remains harmless, who actualy cares.

[@unflexian]

@@DJzSith Wether autonomous cars are sabbath worthy or not is a legitimate political issue in israel.

[@jpe1]

iglidor my Bosch oven has sabbath mode which means that it will automatically set and maintain the oven temp to 85°C (190°F) for the sabbath. My Libeher refrigerator has sabbath mode which means that on the sabbath opening the door does not turn the light on, and the compressor will run at random times rather than as a direct consequence of the interior warming up because the door was opened.

[@zephyfoxy]

"We're going to interrupt this talk to make people do shots and then try to end the talk early" I think these organizers had too many shots of their own already...

[@robin42]

One of the best defcon conference I've heard. It was fascinating! Thank you so much

[@dasstackenblochen9250]

I've seen Euro-profile cylinders used in many eleveator keyswitches (even dimple cores and stuff like that), however, the switch panels are always kinda thin -- so destructive access would remain very simple.

[@davinaz6885]

Its great that the baby theft elevator mode exists. It's also the saddest thing at the same time

[@NapoleonGelignite]

Great to see Tim Hunkin on this. Secret life of machines was a great show.

[@CoolMoD521]

I can't believe I watched an hour long video about elevators.

[@curtiswaters7415]

Just discovered Deviant and his speeches. What an incredible guy.

[@MmeHyraelle]

same and i love him for not being afraid to swear publicly in talks

[@JaredJanhsen]

So many high-rise convention hotels need the full-load bypass feature. I've been in a 23 story hotel in Dallas during a mass exodus from an event and waited over AN HOUR in the hall for an elevator I could hop on with my luggage. The following year at the same hotel and the same event, I just said "fuck-it" and tried the housekeeping elevator which wasn't behind a single locked door. The real bitch was finding my way out of the staff area to leave.

[@maritimemisfits3360]

I would have just used the stairs rather than wait

[@JaredJanhsen]

@@maritimemisfits3360 not when you're on the 22nd floor and have a full desktop PC to bring down with you

[@maritimemisfits3360]

@@JaredJanhsen Down is the easy part, desktop pc's don't weigh that much. Any resonably fit person could do the stairs without issue

[@JaredJanhsen]

It wasn't just a desktop. It was a full tower gaming rig plus widescreen monitor plus bag of cables and accessories plus my suitcase packed for eight nights and my snack/beverage cooler.... And the other couple thousand people with the same load out.

[@flecom5309]

I'd love more info about that failed mechanical test... link to original video?

[@Fifury161]

The clip is from a (1993!) TV series made for Channel 4 and subsequently shown on the Discovery Channel. Called The Secret Life Of Machines. The series was written by Tim Hunkin, and presented by Tim Hunkin and Rex Garrod. Eighteen programmes were made. Here's a direct link to the video on the site: www.exploratorium.edu/ronh/SLOM/0302-The_Lift.html

[@FLECOM]

the video of the motor flying off it's mounts? no it's not, I have watched the secret life of machines many times and for sure that isn't from there.. plus it looks like a cell phone video, pretty sure that wasn't around in 1993 ;)

[@Fifury161]

I was referring to the opening video clip... It's Tim Hunkin and the link I provided is the correct one...

[@----.__]

Frank wasn't referring to the opening clip, neither is Flecom. You're off your rails.

[@CGoody564]

@@Fifury161 you obviously wrote this before the end. The video being referred to is obviously not that.

[@nicholas_scott]

A trick I've seen on some elevators is if you try to open the door on any particular floor, it will cause wherever the elevator is, to stop and open its doors, briefly.... then close and continue on. Its a terrible design flaw.

[@marksmadhousemetaphysicalm2938]

Working as an emergency/trauma nurse we used our badges all the time if the helicopter came to the roof pad…it gave us one of the elevators right to the roof and locked it out and allowed us to take a patient to the OR directly, SICU, or Cath Lab, or ED on the bottom floor…we’d get in a bunch of trouble for misusing our badges but they worked on more than just that one bank of elevators since many of us were on the code team and covered other parts of the hospital and satellite facilities. Doesn’t mean late at night we didn’t speed things up for ourselves occasionally…especially end of shift…

[@jasonmyneni8605]

I’ve been kicked off an elevator while it’s on code blue mode. I also have a code blue key and it’s really cool. However, if someone uses and a code isn’t in progress in the computer, it will activate the code system so doctors (and everyone else who has a key, like me,) can’t drive them around at their will.

[@Chaosfury50]

Sometimes when a bunch of people get in the elevator I like to say "Now I know you're all wondering why I've gathered you here today" Or another favorite elevator past time of mine is when at a hotel or casino and the top floors are labeled such as pool (roof) or club or penthouse and someone is asking people what floor to press, I'll go last and gently clear my throat and since it's quiet I'll say penthouse in a whisper as if I'm embarrassed by it amongst the poor

[@ScoobyShotU]

They typically require keys in nice hotels or casinos especially.. bad joke

[@theenterpriselab9401]

my favorite defcon talk

[@legion162]

I thought this was going to be boring af, but watched it all and was pretty interested. Thanks.

[@LuciferStarr]

8:34 It's from "The Secret Life of Machines" which was a quirky, but fascinating program in the 1980s. I don't think they'd get away with a lot of their demos nowadays.

[@Graham_Langley]

Chap on the lift was Tim Hunkin.

[@jamisusijarvi646]

Come to Finland, Otis and Kone (Kone is from Finland) are very common, but locks that we use here are very often Abloy locks

[@Finneyyy]

One of the most informative talks I've ever watched.

[@ogey_elise]

Deviant and Howard are both GOATed.

[@orxalot]

"im literally not going, because its not the top of the hour. We have seven minutes left and were gonna use all seven minutes" Remarkably based. Put your foot down.

[@PlatinumTurk3y]

Now i have a bit less Hollywood induced crash anxiety whenever I use an elevator

[@amyx231]

Friday: This elevator is needed for other reasons. Please exit. Except you Peter. Peter Parker: Oh okay. ??? Mr. Stark has entered the building.

[@ninjaofslo]

Hehe. Love it. Fire alarm tech. elevator keys will absolutely sell me the set. I work with recalls and unless it’s the FEOK1 I have ran into tons of buildings that never have the key

[@Nalianna]

Entertaining, AND safety conscious? awesome!

[@GrymsArchive]

@8:32 To give credit where it's due: Those 2 Gents are Tim Hunkin and Rex Garrod from the 80's Tv Series *The Secret Life of Machines* A Damn fine watch!

[@FurryWrecker911]

I woke up today to 3D model and draw. Just chill on a Sunday. I did that with this playing in the background and learned so much about elevators that I was not expecting.

[@HonestAuntyElle]

Close door hack has worked on exactly 1 elevator that I've tried in Adelaide Australia, I don't remember what type, but it had a custom animation on the digital display, that showed differently

[@retnikt1666]

37:40 to skip new speaker ceremony.

[@TheRealUnconnected]

Elevators (lifts if you speak english) are remarkably strong. Many of my coworkers get freaked out by lifts. I went to school in an office building for 10 years. We had the oldest still running and original lift (it was otis brand) in service in the city, and man did we abuse the shit out of it and it never killed anyone. It was a very large lift (the largest i've ever seen actually) with room for around 20 adults or 30students with capacity of around 1.8t. We would get on at the top floor and all jump at once to get that little zero g feeling (it accelerated downwards very quickly for an elevator), it handled like a tonne of students all hitting it at once and wouldn't stop. We would do 'washing machines' inside the lift, where everyone moves about back and forth with the objective of slamming the lift into the shaft walls, never failed. While i did get stuck in it a couple of times, it was never because of abuse. The building was made in the early 70s and the lift remained in service until around 2008.

[@deathless12345678]

Old Otis were tanks. Beautiful machines. Did a demo on one, not because of its performance, but its code compliance. Just too old. Early 60s if I remember right

[@Charliepinman]

good talk, nearly all industries are as behind in this. That's the problem the current solution is security by ignorance. People are wising up slowly like routers get different default passwords when shipped. But there is alot of products and services that have very similar obvious security flaws. Generally only people in the industry are aware of them . There's loads of examples from tonnes of industries the scariest one is the nuclear football passcode was 8 0s for 20 years(go america). In some industries it is good enough, like electronic padlocks unless its common knowledge how to dissemble one, it is good enough as crime is often by opportunity. Thieves wont spend 100s of dollars to buy one to find its flaws, but people like' jerry rig everything' do videos on these supposed flaws. Ruins their product! If you buy cheap security, expect there to be an easy work around, it's fine if it's relatively unknown. Lifts on the other hand. They deserve proper security. I understand that without the right codes it could be impossible to modify or fix issues. In cases of people being trapped there should be a specific mode to secure escape. But beyond that it should be made impossible to do anything to the system unless with verified codes provided by the company who built it much like car keys and their remote unlock. A really good example(to scare people) i came across months back is that you can unlock pretty much and card secured door with relative ease. Meaning you could steal from the majority of hotels in the world. I believe the update went out a while back but the fix is to disconnect the door and update the firmware. To each one, separately(literally days of work for big hotels). How many hotels do you think really did that? Maybe only the high priced one.

[@ThatGamerBlue]

Two hour version of this talk with more stuff and less annoying defcon staff is on Deviant's channel at kzbin.info/www/bejne/kIbZeJmrgdGNq9U

[@TheOReport1994]

Started with the Pen testing and now I'm here XD Bloody brilliant!

[@pickle7056]

I've been stuck in a loop for 3 days! Send help! :o

[@calvinkrist5672]

Those two people sure have a lot of power, on some ways...

[@magin9228]

if an elevator ever told me to get out, i'd stay in just out of curiosity.

[@Huntracony]

Elevator: There's a fire! Leave the building immediately! You: Hmm, I wonder what happens if I stayed.

[@furydeath]

43:39 that's a mighty black box xD

[@kevinward6077]

furydeath

[@TheSuckerOfTheWorld]

You probably couldn't see through it on the actual talk, but here we can! The bitting is 0-3-2-3-4-8

[@NetRolller3D]

Or you can just read it off the key itself, as that's not blacked out.

[@Sichelschurke]

Haha had to see this first and then continue the Darknet Diaries Podcast.

[@Microtonal_Cats]

Good talk. I like that the audio quality on these has improved over the years...from horrible to passable. It's not rocket science. Plus, BAD AUDIO IS A HATE CRIME! #BAIAHC

[@kalasnokov]

I really should be sleeping but here i am learning about elevators.

[@WallsOfAbaddon]

So great to see that Murr from Impractical Jokers has transitioned into a more technical line of work.

[@rudidower]

Those old 70's safety ads are really scary. They used to be on late night in the UK.

[@jamegumb7298]

10:10 The piston can still fuck you up for life. Once a lift repairman, I happen to know the guy, wanted to go fatser and so neglected a support beam for safety, so he could get home and watch football faster, a mishap, lift falls, piston saves his life. He had to have both ankles rebuilt, and his knees are messed up. He still walks akward to this day. I never knew before, but once an ankle has been broken it will never be as stable as it was before.

[@Citizen5000]

defcon must have the cringiest nerd rituals of all conferences, its really hard to not just nope out. the talk is great though!

[@edwardpulaski855]

i be honest with you,m the firefighter set that had multiple states would actualy be useful for me. maybe. often i wind up in random states protecting random structures as a wildland firefighter and being able to bust into a concrete building to ride out a fire has crossed my mind more than once. ive thought about ways to bust doors with my axe, but other than wood doors thats useless, i can keep a door tool in the rigs, but having lighter tools would be better.

[@edwardpulaski855]

in california we had to defend a water treatment facility and being able to bust into that and keep the doors closed would have been awesome, the building had concrete walls around it. definitely would have been a good option for people and our equipment/rigs.

[@ironmatic1]

How would the elevator key help with that? That would be the Knox box key which is different for every city.

[@KanaalMTS]

28:10 Schindler's Lift?

[@deam0155]

I don't know if this is on purpose, and I know this is old... But the 3502 key isn't really redacted on your slide ha. "Transparent black"

[@anthonyfontanez6356]

Good on Deviant basically saying GTFO without saying GTFO.

[@unfa00]

43:47 - you can read the full bitting code: 0-3-2-3-4-8, why did they add this dark grey rectangle if it didn't blank out the code?

[@EvanLeyis]

different color grading on monitors could have made it invisible when they edited the slide, but they were different shades in reality, also providing a portion of the bitting basically means covering the rest was a courtesy, and since they provided the method by which they got the bitting code anyways, it probably wasn't exactly meant to be that preventative

[@lucianhardy6142]

A month late, but because it's an unrestricted bit code. It's already publicly available.

[@maxwell_edison]

QUESTION, what is this line of work called when someone gets companies to hire them to.. break in to their place? I want to see compilations of this stuff on youtube. They probably aren't allowed to record their work but im sure someone has filmed a few. I wanna see more stuff like I see in these conferences, but Deviant Ollam doesn't seem to have a youtube channel, so help a brother out? Where do I find more casual format videos of this stuff?

[@steve6721]

Maxwell_ Edison Should be called "penetration testers"

[@slappomatthew]

watch sneakers with robert redford.......

[@phelpysan]

Penetration testers, or just pen testers for short. There's another video from one of these cons called I'll let myself in.

[@ParallaxThe]

There was this great video where a 'pen tester' talked about the fact he was able to walk into a bank branch office allowed by the cashiers to update the security software on a teller's pc without as much as a call to a hq. After they secured most of the cash away.

[@zephyfoxy]

He said it a few times in the video, penetration testers

[@danielaslan512]

If there is any pentest left would love one. GOOD LUCK getting the issue fixed

[@x9x9x9x9x9]

Occupy Tulsa was a real thing. I mean there was no riot that happened in 1921 and is called the Tulsa Race Riot but still I find it odd he chose Tulsa to be the City to mention.

[@andreassjoberg3145]

A lot of places are to stupid to run the alarm if a "firefighter" enters using bypasses... Ofcourse the firefighters should be able to enter... but the alarm should go off anyhow. In a real fire the firefighters can smash the alarm-speaker to bits if it gets annoying, the insurance will cover it....

[@lsswappedcessna]

Would kinda suck to have to pressure wash brain matter off a counterweight. Also, they made a mistake in editing, at 43:38 with the 3502 Yale Y2 Key, the black censor box is not dark enough. The numbers are 0-3-2-3-4-8.

[@TheDct88]

i love the name schindlers ... schindlers lifts lol

[@eddiebernays514]

the elevator in my old apartment building was a Schindler and I always thought of Schindler's list lol

[@Nanorisk]

I guess you guys mean "Schneider", right? It does look like Schindler a bit.

[@beyondbeyond1965]

+Nanorisk Look again 28:16 schindler.com

[@GegoXaren]

"lift" is the standard English word for what in American English is called "elevator".

[@morphman86]

Most of Europe uses the British English word though, and Schindler is a very popular brand here. Schindler and Otis are the two biggest in Europe. So on most tags you'll see written "Schindler's Lift LLC." or regional variants.

[@skullclamp8082]

is it just me or for the 3502 key I saw the bitting code they blacked out

[@JamEngulfer]

I think that one was intentional

[@Make-Asylums-Great-Again]

032348

[@eggnuggs9013]

43:40 did they mean to make the numbers 3-4-8 legible through the black strip in the code. This is literally how I got straight As and placed nearly the top percentile in the state for math when I was in preschool because our teacher did a shitty job white outing the awnser keys. she would use them to make copies for us to fill out and I guess I was the only kid who figured it out. and yes I get straight D's in high school math now XD

[@timewave02012]

LOL

[@leonardsalt]

I was hoping for the slideshow to just have a black box on top of the numbers, which would be easy to just edit out. So I downloaded it out of curiosity and found out that particular key isn't even redacted. All others are tho, completley...

[@Make-Asylums-Great-Again]

032348

[@blehe38]

why were you taking standardized tests in preschool

[@rmp5s]

One of my all time top three favorite con talks...and it's about fucking elevators...go figure. lol

[@orgohappy69]

Really interesting talk, a little ruined by the prat trying to take you off stage. He needs locking in a lift (Im from UK) for 8hours.

[@granskare]

when I was in Berlin in the 50's...it was a single person lift that constantly moved

[@emka333]

You mean a Paternoster? Germany still has some of them today.

[@billc.riemers3245]

You could just wait in the elevator for someone to call it on another floor. You don't need the key. You just need the key if you are impatient.

[@LaskyLabs]

"No one should get in there and *RIDE THE FUCKING COUNTERWEIGHT!"*

[@ushiocheng]

imagine when a hotel want you to scan your card to use the elevator but have the room number written on the card. (which means they probably never rewrite the cards so you can just copy it and do whatever you want with that)