[Music]
all right good afternoon folks I am Eric
welcome to bypass 101 a talk about all
the ways to get around doors that don't
involve picking the lock I've been with
bypass Village now physical security
Village since 2019 when we started uh I
have a job this is not my job uh I write
high performance trading software for
Capital markets views are my own
opinions do not represent my employer
you all know the
drill um we've been on the conference
circuit for a couple years now we have
some Demos in the Village area My Hope
Is that you learn these skills here you
know you go home you apply the
remediations but you also come to a
village try them out by hand uh so we're
all the ways to get around locks lock
pville just picking locks we're not that
I'm a simple and impatient kind of
person uh with really bad fine motor
skills so I'm going to keep it simple
here uh while the basics of using doors
are understood by many uh we're going to
talk about some several Advanced door
manipulation techniques that will allow
you to take your door using game to a
whole new
level um we're going to talk a lot about
lateral thinking let's take a look at
one particular example I really enjoy is
that the right direction yeah I can't
see the screen I think it's playing
right give me a thumbs up yeah so door's
locked you know maybe we see some way
around the
door like a
mailbox
yeah cool stuff it's not always going to
be that simple but sometimes it is Don't
Stop Believing
let's think about a moment for a moment
about our model of a door right what are
the core functionalities that a door
needs to be able to firm you need to be
able to open it you need to be able to
close it ideally without manipulating it
as you're closing it's got some moving
Parts hinges locks and the things that
drive them uh latches handles uh and
each of these play a role the door needs
to remain shut when it is closed needs
to be able to close on its own uh which
you know it's an interesting engineering
problem how did the engineers of your uh
solve that problem they do it with a
latch uh so if you look at the door
there's this uh member that's kind of on
an angle and it has a lever arm that as
the door is closing that latch slides in
allows the door to slide into into the
frame uh likewise a commercial model uh
is closer to what you'd see on the
right um so that's what we're attacking
you know when we're talking about
attacking the latch but the engineers
were smart right they foresaw that
someone might come in try and Slide the
latch in pull the door open so there's a
second moving element there you see the
dead latch the the little kind of Half
Moon one right next to the other latch
when door is properly installed that
will actually be depressed when door is
in the frame uh on the one on the right
it's that second moving element below
the main latch but thankfully and like
in lockpicking we're exploiting the fact
that often times these things are not
installed properly right we're
exploiting tolerances and variances in
manufacturing and installation and if
you've ever installed a door you know
like it's a real pain right those
tolerances easily add up you know here
uh on the left we've got a strike plate
where the moving element on the
commercial door is just going to be
fully extended right it's not going to
be engaged the strike plates on the
right you see there's nowhere to catch
that dead latch so you know if it's like
that in the door you can come in and
with a uh Tool Push the latch in right
allow you to slide the door open it's
it's dead simple uh again you know Don't
Stop Believing every so often it does
come up if you find that the dead latch
is properly engaged in the strike plate
sometimes if you give the L door a
little jiggle it'll give it just enough
G give door slides in dead latch pops
out now all of a sudden you can come in
move that moving element back into the
door pull the door
open what can you do that with um little
piece of sheet metal is great uh maybe
even a piece of wire uh butter knife
works if that's all you've got right the
these are pretty crude simple
attacks um there's the old credit card
trick if you're coming from the other
direction if youve you got a nice
flexible piece of plastic you can come
in from kind of the the side of the door
that it swings away from slide it
through the door jam um in this case the
room keys from the flamingo at Defcon I
want to say was 2019 worked really well
for
this um what does it come down to you
know you want to stop these attacks it's
about doing what the engineers intended
and actually installing your door
properly it's easier said than done and
realistic if you look around your
workplace look around your home you're
probably going to see you know these
vulnerabilities present how do you deal
with that you could use something like a
um a latch guard right you've probably
seen these pieces of metal around the
handle um that's there to stop someone
from being able to come in with a little
piece of sheet metal get in under behind
the latch pop it open uh it's not ideal
right if you have a long sheet metal
element tool that you can get in and
slide it open uh that still works but
it's better than
nothing so you know it going back to our
model of a door what it needs to be able
to do door needs to be able to close
itself right and that's the
vulnerability that we exploited when
we're talking about the latch attacks
right but someone also needs to be able
to from the secure side of the door use
a handle and get out um to open the door
often times fire requires that the
handle be able to independently operate
any of the other locking mechanisms
unless there's there's a dead bolt right
so that in case of a fire some other
emergency you can easily egress the
building so the handle has to be able to
open the
door um so what we're trying to do when
we're targeting the handle is emulate
somebody exiting the door from the other
side how can we do that we've got a good
demo in the village as well uh and some
pictur here if you can either under the
door or beside the door or even above
the door uh get a piece of wire around
hook it up onto the door handle apply
downwards Force easier said than done
without deforming the wire out of shape
uh that mimics somebody uh you know
pushing the handle down opening the door
from the other
side um you want about a 5ot long piece
of wire ideally with the string tied to
the end that you're going to send under
the door that's so that once you have it
hooked you can easily apply like
downwards force with the string rather
than just pulling the wire right into
the door as mentioned before this method
works with doors with lever type handles
um and you need enough room either under
or beside the door to fit the tool right
so it comes back to
variances um you'll also notice and in
the demo that we've got in the village
um some handles are are easier to attack
than others so if there's a hook on the
end it's really easy to get the wire in
there uh and and keep it engaged as
you're pulling like the one we have in
the village um it's it's like a flat
handle so as you're pulling the wire
down it it tends to slide off which
which is a big pain but probably good on
the security side if if you're the The
Blue Team door knobs much less common
now in part because of fire Cod
uh if you don't have full dexterity in
your fingers it's really difficult to
operate a door knob so we tend to not
see them too often anymore great for pen
testing um that that they aren't common
anymore to get around this it's quite
cumbersome you need again a wire to
guide a ideally pretty friction heavy
piece of rope around the door knob and
then pull that rope to kind of emulate
again someone pulling the door handle
open occasionally see this in
residential installations again not so
common in commercial industrial some
institutional thinking about like older
University buildings
maybe um crash bars not to be confused
with push bars often seen more in
commercial installations they're
relatively simple in Concept in case of
an emercy you can press without needing
to Fumble with a handle or if there's a
crowd Crush you know push up against
that crash bar will open the door
um how to um you know open this type of
door again you're trying to emulate
someone pushing on it so using a piece
of wire and string getting underneath
the bottom of the door provided there's
space getting hooking up onto the handle
and then pulling downwards Force P
pulling the handle into the door causing
the latch to disengage allowing the door
to swing open
pictures here so again about a 5 long
piece of wire coming from under the
door traveling up hooking onto the
handle and at that point pulling the
crash bar into the door allowing the
door to open how do we protect against
this um you know ideally there wouldn't
be enough space for a wire to travel
under the door but failing that uh there
are remediations right a fitted bevel uh
on the door threshold prevents bypass
tools from being able to fit through the
Gap underneath the floor alternatively
rubber door SEALS or brushes under the
door make it immensely more difficult to
execute this type of attack Also let's
think realistically it's quite
cumbersome to get a wire there um which
means that you know if you're the red
team in this situation you'd likely be
lying on the ground of a hallway you
know in a commercial building fumbling
with a tool um which um will probably
alert folks to the fact that there's
something not quite right going
on push bars are much more common in
part now because of how easily
exploitable the old crash bars were um
there's nothing really to hook on to
here often the best bypass for a push
bar is targeting the latch like we saw
earlier with the door handle uh an
alternative method is using a piece of
string if you have access to above and
below the push bar uh like you might see
in some high security fencing even um
finessing the string over the push bar
through a hole at the lower end grabbing
both sides and
pulling how can you remediate this um
one approach is to use a magnetic lock
at the top of the door we have an
example in the village as well you know
some meta remediation how do you attack
this um either by going after the power
supply these uh unlock when there's a
loss of power so that they don't trap
you in the building when there's a power
outage so you want to ensure that the
power supply is on the secure side of
the
door uh dead bolts um are much trickier
to bypass they're different from dead
latches they remain fully engaged fully
locked uh or fully unlocked often time
on the secure side there'll be a thumb
turn to allow you to unlock it without
needing the key uh on the secure side
um one way to attack this is by using a
we've got an example in the village as
well uh a tool that comes in through the
door and kind of it allows it it's like
kind of one of those angled drills right
if you can imagine it where you turn a
wire and then turns a handle on the
other side
get that around the door hook the handle
on uh turn on the unsecure side to open
the
deadbolt one remediation against that is
using a double-sided dead bolt where
there's a lock on both sides again the
issue with that is you're run into fire
code issues you could potentially have
someone locked on the secure side of the
door and being unable to
eress um you know think about lateral
attacks against stores uh sometimes you
can just pull really hard
um you know it's not a joke uh not all
doors are pullable but a surprising
number of them have just enough Flex in
the frame either if it's metal and it's
a hot summer day or it's uh wood and you
know flexed over time um you know if you
for example ever moved Lumber between
you know Toronto and Las Vegas for a
demo uh you find the wood flexes quite a
bit again seasonal variation causes
doors to flex it might mean that pulling
really hard on the door is just enough
um that the latch ceases to engage um
you know the skill that you need for
this is just brute strength I flew down
here yesterday with three model doors in
a single suitcase 70 pounds so you know
I started working on that
yesterday um General technique pull
really hard does it work no pull harder
go to the
gym um
so again think back to our model of the
door we've talked about the latch we've
talked about the handle what else is
left the
hinges if you can remove the hinge you
can allow the door to open in the
direction it wasn't intended right open
you know about the other angular
Direction uh sometimes the easiest way
to unlock the door is again not to
unlock it at all um if the hinges are
installed on the unsecure side and you
can access the hinges um
you know you can either tap out the
hinge or in this case if the hinge is
fully installed uh on the wrong side of
the door maybe you can get a screwdriver
in just remove the hinge take the door
right off so when you're looking at the
door you want to look you know probably
along the frame try and see if you can
identify the hinge sometimes on
Commercial installations like the
example here it's near the top and
bottom of the door right so likewise if
you remove those maybe you can take the
door straight off the frame
screwdriver probably won't see this in
real life hopefully it's quite egregious
it happens
sometimes an alternative this you might
see more often especially if the door is
opening outwards right so that you can't
kick it in you want the door to swing
outwards towards the outside this often
also means that the hinge is exposed to
the public you know screwdriver and
Hammer tap out the hinge take the door
right off uh you know you know it it
seems pretty bleak when you look at it
this way um but there are
remediations one approach is to use a
set screw in the hinge um so that when
the door is closed and that you can't
get to the set screw then uh it doesn't
allow the um pin in the hinge to slide
out so you can't tap it out anymore
another approach is to uh like on the
right use a hinge with a stud hole that
vent the two parts of the hinge from
being slit apart if the hinge is removed
right so in this case um even if you can
tap out that pin uh you can't take the
door out of the frame because those
studs are still engaged as it's engaged
on both sides of the door you can't pull
it out um this is a relatively cost-
effective remediation uh especially if
you've got hinges Exposed on the
unsecure outside side of the door which
you probably do right I mean even look
at those doors right they're exposed
hallway side if this was a secure site
maybe you can take the hinges off those
doors now I know if any of those doors
go missing uh I'm probably going to get
blamed for it
so um looking at other ways to get
through a door uh maybe there are Keys
nearby or maybe it's a lock with a
combination um often times you might see
these around a building right holding a
bunch of other keys
um and I think I have the slides
misarranged yeah oftentimes you know
they get worn down because they're
painted on the pin pad um you see which
buttons have been pressed it reduces the
solution space that you then need to
Brute
Force they also have defaults the
Simplex default is I think it's two and
four together and then
three um there's a helpful sign on the
door bottom line there change your
combination
um one other approach is if it's a pin
pad on a door using some UV ink uh
applied to the buttons allows you to
figure out which buttons are pressed
more often which is probably the ones
that someone has been keying in to get
into the site depending on the UV ink or
powder you're used it's also possible
for that pigment to then transfer from
one button to another um when someone's
using the lock allowing you to see the
sequence
um one remediation for this is scramble
pads that you might see in real high
security facilities where you press a
button that then there are like LEDs in
each of the buttons on the pin pad that
get shuffled around so that it's not
going to be the same arrangement of
buttons each time uh that's a relatively
high cost for mediation
though uh ener phones you often see
these on the outside of apartment
buildings to allow you know your
visitors in so that you don't have to
come down and get them each time
um there are master codes often on these
that can be found online bottom line
there is make sure you change your
default
passwords also often times these are
locked so you can't get into the
internals but these locks are key to
like um there's really no reason for you
to use the key to like enter phone key
they can be
changed if you can use that key to like
key to get behind the enterphone panel
you can likely
identify which
uh which
jumper is used to unlock the door I
think that's
up
cool which is the set of pins that go
to uh go to High when um the like n DTMF
tone is received um but then allow you
to uh um allow the door to open so if
you can identify that jumper that once
you're under the Ender phone panel uh
you can uh get
in see does that bring back up the
slides remediation for this you can put
a security bar on the front of the enter
phone locked separately uh or just
change the lock uh Rec sensors you're on
the secure side you want to get out uh
of sometimes they'll be IR sensors above
the door that then unlock the door they
rely on passive infrared so they're
looking for changes in heat generally
body heat but it also means that if you
have something that can generate a lot
of cold generate a big thermal
difference that also trips the inner
phone um allows the door to open
remediation for this either pass back
like tap your pass to get out or have a
request to exit button next to the door
uh there are also some dual technology
recck sensors that use both passive ir
and radar to identify if there's
actually someone on the secure side uh
they're pretty cool they're more
expensive
though um you want to be careful though
that your request to exit sensor isn't
quite too close to the you know Gap in
the door uh We've also got an example in
the village where you can come through
and using a tool tap the Cris to exit
button opens the door uh my office has
has this exact issue as well if if you
were so inclined please don't look up
where I work um or you could just
straight up avoid the doors alt together
elevators uh very common in modern
buildings often times there'll be floors
in the elevator that are locked out so
you need either a key card to get to or
the elevator will just you know not take
you there
um luckily there are ways to bypass
these and get to the locked out floors
through elevator hacking uh I won't get
into that now except to say that it is
possible either through putting the
elevator into attendant mode fire mode
gaining access to the Hoist way elevator
surfing to the floor in inspection mode
right the these are modes that generally
bypass any lockouts on the elevator what
do you want to do you can generally
switch out most of the common service
locks on elevators however the fire
locks cannot be changed uh what you can
do is not rely on elevator lockouts for
security so you do have a secure floor
don't assume that the lock out on the
elevator is going to keep that floor
secure you want to have a door on that
floor as well which is secure um after
the elevator to stop some from being
able to access the rest of the
floor and hey sometimes doors are just
left propped open either Human air uh a
warped door frame air pressure
differentials especially you know
thinking about scientific buildings
where where there is higher pressure on
one side or the other that PR prevents
the door from fully closing um or the
door is just broken or there straight up
no lock um yeah and sometimes you don't
even need to find a door uh here's a you
know a good security fill we saw it's a
ladder going up the side of a building
very secure it's got a cage around it
right no way you could get around that
uh but look at the back hey there's a
ladder on the other side that you could
just as easily take out um let's say
you've got a fence that you're trying to
get around hey maybe there's a tree
growing in the fence I was at a site a
couple of weeks ago and there's a huge
mound of snow uh right next to the fence
line just as easily climb that mound of
slow snow climb over the
fence you know ducting where does it go
I don't know it could be interesting
drop ceilings you know we're kind of
getting into you know uh serious
coordinated Heist stuff but you know
often times even if there is a door
maybe the drop ceiling allows you to
bypass that altogether uh what could you
do drywall Maybe
um that'll be a a pain in the butt to
fix mind you uh and that concludes the
presentation the bottom line is it comes
down to tolerances and precision right
the security Engineers when they were
designing the doors were real smart um
and then it comes down to you know the
fact that's such a pain to install these
things properly so keep an eye out think
about some of the remediations give it a
try uh in your home we have Demos in the
Village area you come talk to me if
you've got questions thank you
[Applause]
all