📜 ⬆️ ⬇️

HOPE X. Conference "Breaking the elevator: from the basement to the penthouse." Part 2. "Security Systems"

Start here: HOPE X Conference. “Elevator Hacking: From Basement to Penthouse”. Part 1. "Elevator equipment"

Diviant Ollam: one can say that in many ways the elevator industry is stuck in the past.


')
Howard Payne: this slide shows an elevator cabin in one casino. I met with the architect of this casino, who designed solutions for the entire building, including elevators. I clearly remember how he told me about the choice of components of the elevator security system and said that no one could crack it because they used anti-theft tubular locks.

Diviant Ollam: that is, he believed that the tubular locks are the newest and greatest development in the field of security.



Somehow my friend showed me a bunch of Medico keys that people put in different locks and then forget and said that he had collected a whole collection. I asked him for a screwdriver and did as shown on the next slide - you can see that all these keys from different locks are exactly the same.



The next slide shows the keys that my friend wanted to use for the elevator, and I noticed that they look like Dover impulse keys. He replied: "You will not believe it, but I pulled them out!" And showed on the machine for carbonated drinks.



Many people believe that all keys are unique for each manufacturer, but this is far from the case. There are many holes in the security systems of the most reputable manufacturers. I will cite as an example information from the site of the company MCE, one of the suppliers of elevators, which is engaged in the creation of the “Internet of things” with remote control over the network. We can say that this configuration instruction of the router configuration shows a completely devil-may-care attitude to security, since it sets the same open password to everything, I quote:

“Create a new user account by using the name msesupport and the password msesupport. Click the Add button, and then save the settings. Then go to the settings table, click on the password field and enter the word admin for the old password and msesupport for the new one and confirm the installation of the new password. Save your changes. Now, when you need to enter the settings of the router, use the username admin and the password msesupport. This completes the configuration of the VPN router configuration. ”



In the next video, another “advanced” project MSE, created on the basis of IQ-technology. If you want your elevator to have extended functionality, it must be connected to the Internet using a computer running Windows XP, and all settings are made with the same password as the login!

Howard Payne: The good news is that this hardware was installed in 2014, and I would not be surprised if they paid for the enhanced support of this operating system!

Diviant Ollam: The following video is an example of social engineering and advertises a VIP service when an OTIS Service ELIT card holder orders an elevator by phone. “You can enable for yourself an independent elevator control mode with just one phone call!” Excellent opportunity to bluff: “I want to reserve an elevator, but unfortunately, I don’t have a card in front of my eyes”! Imagine how many scammers can use this service, posing as a VIP.

Another amazing thing is the rules for the use of security codes for elevators and escalators ASME A17.1 (2007). Here we talk about the common key FEO-K1. In 2007, it was decided to free firefighters from having to carry a heavy ring with a bunch of different keys, replacing them with 1 universal key. To exclude the possibility of its use by unauthorized people, they suggested using the key bar code 6143521, which is not used in the manufacture of any other keys. It was a sensible decision, but it was unwise to put this code in a public document.



Howard Payne: this is preceded by an interesting story - in 2006, when developing this document, it was decided that this key should be turned clockwise in the lock, as is customary. However, someone decided that it was a bad idea in terms of security and suggested that the key be turned counter-clockwise.
So, we are talking about different keys, different locks, but behind all this are the usual electrical circuits. Most of them are quite simple, and if such a chain is located in front of you in free access, you actually get root-rights to manage the elevator.

The video shows how you can open the elevator control panel, located in the cab, and directly lock the two wires of the lock, including an independent mode. By doing so, you activate this mode without any key and can use the elevator at your discretion. Consider only that you need to do this carefully, since you can get a shock from the network with a voltage of 120V.



There is no sensor that would indicate to the controller that the panel is open and the elevator is cracked, so the cabin continues to function as if nothing extraordinary had happened.
Interesting things you can do with electronic key cards. Instead of the actual card, we inserted a completely different one into the scanner slot, but the scanner still worked and lit the green signal.



At the DEFCON 14 conference, a report by Major Malfunction entitled “The Madness of Magnetic Stripe Cards” was presented. It talked about scanners and card readers, how they interact with the elevator car controller, how to hack this equipment, clone it, and use key cards to their advantage. There are cabins where there is a card reader switch that can be controlled, and so on.



So what do penetration testers do during security checks? We will tell about it on the example of the Independent Service mode and sometimes on the example of the Fire Service.





Working with Howard, we sorted all the keychains: this is rarely used, we will leave it in the car, it is more universal, we put it in a red bag, and we use this one more often, put it in our pocket.

Howard Payne: Consider an example of a building. On the ground floor there is a guard post with a blue guard figure. When you enter a building, you interact with it first. This building also has a “black” passage, in the lower right part of the picture, through which you can enter and use the elevator. Let's mark it with a red arrow.



However, this elevator may not respond to calls from a person who does not have the means of access. If you manage to use this elevator in Fire Mode, you will be able to climb to the floor above and thus bypass the security, and then use the stairs.

We shot a video where it can be seen that this can be done very quickly, using duplicate fire keys, so that no one will notice anything. You can use phase 1 or phase 2 independent mode. Here we come to the house from the back side, the door is closed, we open it with our key, we enter inside. I press the elevator call button, the door opens, I enter the cabin, Divian stays outside and inserts his key into the outer panel, activating phase 1. I insert my key into the lock of the internal elevator panel and turn on phase 2. The cab rises to the second floor. Having risen, we turn off the fire mode and pick up the keys. The whole process of secret entry into the building took a few seconds. We acted like professionals, but shooting this film took 20-30 minutes while we looked around and made a plan of action.

Diviant Ollam: we offer you to take a look at this article from the New York Post newspaper, which shows photos of fire keys with a comment: “We posted these photos only after duplicate keys made by locksmiths assured us that it’s impossible to make a copy such a key, without having in front of the original.



Great, this is a low resolution photo, but we have a high resolution photo that shows the infamous fire key of the New York Fire Department Yale Y1, labeled “2642”. This photo allows you to measure and cut such a key. But the most interesting thing is that its designation "2642" means nothing more than the key bar code without the last digit "0" - this is code 26420! That is, anyone who sees this photo will be able to duplicate the key on it by taking the description of the groove code from the reference book.



Howard Payne: this example serves as evidence of how slowly changes are occurring in this industry. The article was published in 2008, and since then many people have taken advantage of this opportunity to make such keys. They even sold these keys online and on eBay, and I’m sure that the New York City Police Department may regard the illegal possession of this key as a use of a cracker tool.

Diviant Allam: the next slide shows the fire key "3502", which is used throughout the states of New Jersey, New Hampshire and Massachusetts, but its number does not match the actual code of the groove.



Another interesting thing about the fire service and the possibilities of interesting operations when using it can be found in Brad Bowers’s presentation “How to take possession of the building: exploitation of the physical world using the BACnet network” at the ShmooCon 2013 conference. its parts can activate the fire mode if something is burning there, but in another part it is possible to continue operating the elevators in the normal mode if they are not in danger. At the same time, all parts of the building must be managed by the BACnet system, which exchanges data on their condition in order to make certain management decisions. So, hacking this system can lead to very interesting consequences for a large building.



Another breach in the building's security system is access to the lift shaft. The following video shows how an experienced professional serving elevators sets up a cabin on a certain floor and turns off an elevator, putting it into Inspection Mode. Then he rises to the floor above, manually opens the doors and goes down to the roof of the elevator car. In this mode, he can do with the elevator all that is required. We can move up or down in the chosen direction. What do you think, what security locks exist inside the elevator shaft? None! So we went up to the next floor, opened the doors from the inside and went outside to the hall. What other keys do we use when working with elevators?

Howard Payne: there are special keys of a different kind. If you look at the outer doors of the elevator doors, you can see a hole in the upper part of the right wing. It is called “Escutcheon hole”, or “sash hole”, and for it the mechanic uses a special tool with which he opens the doors. This tool is inserted into the hole, moves the latch flag back, the locking mechanism is released and the doors open.





The next slide shows the different keys used for such openings, they are used for different occasions, and it should be noted that each elevator door has a key.
Unauthorized people sometimes use such keys for illegal things. One of the largest elevator owners in the world, the New York City Housing Authority, has unique information about cases of illegal use of keys for elevator doors. They know a case where people used an elevator shaft to store drugs, pushing the outer doors and hiding drugs between them. They were sure that the mechanics did not drop in there, and considered this to be a safe place for a “cache”.



Diviant Allam: there are special locks with a cap for the hole in the sash. When you turn the tubular key, the cap is removed from the lock along with the key ...





Do you see what the construction of such a lock is? It consists of two cylindrical parts, one of which is screwed into the other. If you have the “right” tubular key, you insert it, turn it, and remove the cap from the lock. This is the “quick key”.

If you have any other “wrong” key, pull out the cap does not work, but you can turn the key in the other direction, hook its head with pliers or a wrench, and use it as a tool to unscrew the entire lock together with the cap! This is a “slow key”.

Howard Payne: Now let's go to the engine room.



You can draw an analogy between the elements of IT technology and elevator equipment:


There is a big difference between running an elevator from the roof of its cabin or from the engine room. You can do anything on the roof of the cabin in the elevator shaft, but the person in the engine room can simply turn off the controller in your hand and deprive you of the ability to operate the elevator. We can say that the man in the engine room controls the entire "elevator Universe".

There are computers, monitors, keyboards, mice that are connected to modern elevators. They show you all the elevators in a particular elevator bank and how they interact with the needs of passengers. The interface of the controller's direct control panel is shown in the following slides.





I note again that there are isolated contacts everywhere in the engine room and someone can make a hell of a lot of trouble here with just one piece of wire. However, sometimes we do it ourselves to close the contacts and disable some kind of security function, this is part of our work.

Diviant Ollam: for example, if the elevator doors are open, he will not go, just as the elevator will not go if he has reached the top stop. What does a mechanic do to set him in motion? Just manually closes the contacts of the limiter.

Howard Payne: it is difficult to remember where to put the jumpers in order to close the circuit, so many mechanics use what can be called lift graffiti, like these inscriptions from inside the cabinet door with chopper switches.



Diviant Ollam: this is what people like Howard do - they start the elevator in an unusual way and in unusual modes, for example, dropping at full speed, with full load on the shock absorbers at the bottom of the mine.

Howard Payne: Yes, every 5 years it is necessary to conduct test tests of traction drive elevators, cable lifts. At the same time, it is necessary to load the cab with a standard weight and add a little more weight using test lead weights and send it down at maximum speed. This checks the operation of the main controller and additional equipment. We accelerate the cab to maximum speed using electrical and mechanical equipment, then turn off the electrics, accelerate again and check how only the mechanical part ensures safety.

The screen shows a video of testing the elevator, when the cabin accelerates to maximum speed, dropping down from the 40th floor, and hits the oil-damper rod at the bottom of the shaft. This is done using manual controls from the engine room in order to make sure that the shock absorber will withstand a shock at that speed. The following shows how a mechanic with 35 years of experience explains how to connect contacts to a cable block and tries to pull out a pair of wires on the block, while a short circuit occurs and sparks fly.

Diviant Ollam: if you don’t know exactly what you are doing when you close the contacts, you better not go into the engine room at all. Now is the time to move to the fun part of our presentation.

Howard Payne: you know, there is a saying “When the POTUS (President of the United States) comes to town everything shuts down”. “When the President of the United States arrives in the city, everything is cut down, everything closes around,” his visit is guarded. We know that the president will never use the elevator, because this is contrary to security reasons, but some people thought that if he wanted to use the elevator during his visit, then a Secret Service agent should be in the engine room next to the mechanic.

If something is wrong with the elevator and it stops between floors, the team immediately says on the radio: “Immediately lower this thing down, I don't care how you do it, even if you destroy all your fuses, let's move, move!” As far as I know, the last president who used the elevator was Lyndon Johnson.

So, the cabs have two-way voice telephones, which ensures the safety of this part of the elevator. I said “with voice communication”, but this is not necessary - you can not say anything, for example, if you do not know English, but simply press the emergency button located in the cabin in an emergency. Many phones have a pre-programmed voice message. If you press a button, a call is activated, for example, to the 911 service, and when there they pick up the phone, they will play an alarm message.

Each lift cabin is connected to a regular telephone line, the wire of which is laid in one of the cables and goes to the engine room. You can see that in some cases the emergency telephone is located behind the panel in the cabin wall and you cannot easily reach it. , - . , , .



, , , . , « » , .



: , , - , , .



« » , , , , , . , - ? , - , , - , , .

, , .

: , , , location ID. GAL, , « hands-free GAL-6400», .



, . , , .



: , , . , .

: «3000 », -, . - «» , 7- (!) .

: , , , !

: «» , , , .





: , . , Draka Cam .

, « », , , .

: .

: , , , . , . « 2» , , , , -1000 , , .

Sneakers («»), , , . , - , The Usual Suspects (« »). , , , .

, .

: , - . , -, , PBS Nova. , , 48 .



, , , . .

: , Emergency Stop.







: , . 1970 2000 , , , , , , «» , . , , , , , «» . , .

: , , , . -, , , .



, , . , . , , , , .

: , , , , . 30 , , . , , , . , , . :


, , , . , , , , , .



, , 2012 , 2013.

, , , , , «».

, , OTIS, , .





, , , , . , , .

, , , .



, , . , .

, .

, , , , .

, , « ».

, . , - , . , .

, . , . , , - .

, . , .

: , , . , , . , , , . , . , , . , . , .
, , ! Thank you very much!

: , ?

: , , , , . , , .

: ?

: . , SD- . - , .

: , . , , , . ?

: , . YouTube , .


Thank you for staying with us. Do you like our articles? Want to see more interesting materials? Support us by placing an order or recommending to friends, 30% discount for Habr users on a unique analogue of the entry-level servers that we invented for you: The whole truth about VPS (KVM) E5-2650 v4 (6 Cores) 10GB DDR4 240GB SSD 1Gbps from $ 20 or how to share the server? (Options are available with RAID1 and RAID10, up to 24 cores and up to 40GB DDR4).

Dell R730xd 2 times cheaper? Only we have 2 x Intel Dodeca-Core Xeon E5-2650v4 128GB DDR4 6x480GB SSD 1Gbps 100 TV from $ 249 in the Netherlands and the USA! Read about How to build an infrastructure building. class c using servers Dell R730xd E5-2650 v4 worth 9000 euros for a penny?

Source: https://habr.com/ru/post/354498/


All Articles