Skip to content
0:00 / 0:00

#elevatorhacking#physicalsecurity#deviantollam

DEF CON 22 - Deviant Ollam & Howard Payne - Elevator Hacking - From the Pit to the Penthouse

DEFCONConference

419K subscribers • 61 videos on Hallway • Conference channel

YouTube
  • Recommended by 5 people: 5 on Hacker News.
  • A classic. People kept recommending it from 2017 to 2026.
  • Presented by Deviant Ollam and Howard Payne, physical security researchers

Intermediate. Assumes working knowledge.

877K views11 years ago5 recommendations

SecurityExploits and vulnerabilities

Deviant Ollam and Howard Payne explain how elevators work, their various control modes, and how physical penetration testers exploit them.

Elevator Hacking - From the Pit to the Penthouse Deviant Ollam The CORE Group Howard Payne The CORE Group Throughout the history of hacker culture, elevators have played a key role. From the mystique of students at MIT taking late-night rides upon car tops (don't do that, please!) to the work of modern pen testers who use elevators to bypass building security systems (it's easier than you think!) these devices are often misunderstood and their full range of features and abilities go unexplored. This talk will be an in-depth explanation of how elevators work... allowing for greater understanding, system optimizing, and the subversion of security in many facilities. Those who attend will learn why an elevator is virtually no different than an unlocked staircase as far as building security is concerned! While paying the bills as a security auditor and penetration testing consultant with his company, The CORE Group, Deviant Ollam is also member of the Board of Directors of the US division of TOOOL, The Open Organisation Of Lockpickers. Deviant runs the Lockpicking Village with TOOOL at HOPE, DEFCON, ShmooCon, etc, and he has conducted physical security training sessions for Black Hat, DeepSec, ToorCon, HackCon, ShakaCon, HackInTheBox, ekoparty, AusCERT, GovCERT, CONFidence, the United States Military Academy at West Point, and the United States Naval Academy at Annapolis. His favorite Amendments to the US Constitution are, in no particular order, the 1st, 2nd, 9th, & 10th. Twitter: @deviantollam, @TCGsec Howard Payne is an elevator consultant from New York specializing in code compliance and accident investigations. He has logged over 9,000 hours examining car-tops, motor rooms, and hoistways in cases ranging from minor injuries to highly-publicized fatalities, and has contributed to forensic investigations that have been recognized by local, State, and Federal courts. Howard has appeared on national broadcast television making elevators do things they never should. When he's not riding up and down high-rise hoistways, he moonlights as a drum and bass DJ and semi-professional gambler. His favorite direction is Up and his favorite elevator feature is riot mode. Twitter: @SgtHowardPayne

Why it's here

5 people recommend this

What people say. Recommended as a classic and highly entertaining DEF CON talk on elevator mechanics and physical security bypasses.

alexpotatoon Hacker News • Recommends

On “The Door Close Button”

If you liked the original post, you will probably LOVE this DEFCON talk about elevator hacking: link to this video It also gives a lot of fascinating information about elevators in general and specific operation modes. e.g. there is a "riot mode" where the elevator goes to every floor except the first (or ground in EU) floor aka to the lobby. The idea was that, during a riot, a luxury building in NYC would lock the stairwell access from the lobby but people could still take the elevator to the other floors to visit their neighbors etc

cruffle_duffleon Hacker News • Recommends

On “Elevators”

If you like elevator hacking don’t forget the seminal DEF CON talk by Deviant Ollam and Howard Payne: link to this video I watch it like once a year because it always tickles some part of me. Like all the different modes you can get an elevator into. The most fancy one people might encounter is when moving into or out of a building. The front office can give you a key to give exclusive control over an elevator so your movers aren’t waiting around on elevators. Put it in that mode and it will stop responding to calls from other floors. Only the person with the key can control the elevator. You get on, select the floor, door closes elevator goes, and then just chills there with the door open waiting for…

lathiaton Hacker News • Recommends

On “Evan Doorbell's Classic Phreaking Tapes”

…tton. Related: link This is a good related talk - goes outside the box on all the ways you can often get into commercial buildings without picking (or even in many cases, interacting with) the lock "The Search for the Perfect Door" by Deviant Ollam link Also good: link Howard Payne & Deviant Ollam - This Key is Your Key, This Key is My Key link to this video [DEF CON 22 - Deviant Ollam & Howard Payne - Elevator Hacking - From the Pit to the Penthouse]…

lathiaton Hacker News • Recommends

On “Ask HN: Best talks of 2018?”

Deviant Ollam - The Hotel Room Gourmet link Also not 2018 but his elevator with Howard Payne talk: link to this video (1h version) link (2h version) And the search for the perfect door: link

lozfon Hacker News • Recommends

On “List of Special Elevator Modes”

Deviant Ollam & Howard Payne did a great talk on Elevator Hacking at Def Con 22. You can catch it at: link or link to this video 01:00:15

simlevesqueon Hacker News • Recommends

On “Let's Get Physical”

I love pentesting stories. Great blog post, I was smiling while reading most of it. It reminded me of Deviant Ollam's stories such has his elevator security talk w/ Howard Payne: link to this video

DyslexicAtheiston Hacker News • Mentions

On “Reverse Engineering a Mysterious UDP Stream in My Hotel”

yeah and deliver some badass mixes of The girl from Ipanema. :-) Though I wonder if he had time to look at the packets long or careful enough. Would have been interesting to inspect all these devices closer too. Were there also other sessions established maybe that could hint at controlling them? E.g. such as volume of the sound? I doubt that the actual elevator would be controlled could be controlled remotely: link to this video

Twisolon Hacker News • Mentions

On “Saintcon: Lock Picking Lawyer Keynote”

…ccessible windows. The only viable way into my residence is through the front door. (There are like two RFID-gated doors before mine, but tailgating renders them pretty ineffectual, and let's not talk about elevator security. 0) It's not worth it for me to put a better lock on my door, but I'm also not kidding myself about its effectiveness. 0 link to this video…

jedimasterton Hacker News • Mentions

On “Malicious compliance by booking an available meeting room”

> funny DefCon video on elevator hacking For those wondering, is Deviant Ollam's talk on elevators. link to this video