Defcon 22-deviant-ollam-and-howard-payne-elevator hacking-fr
•
5 gostaram•4,997 visualizações
Defcon 22-deviant-ollam-and-howard-payne-elevator hacking-fr
Recomendados
Recomendados
Mais conteúdo relacionado
Destaque
Destaque (10)
Semelhante a Defcon 22-deviant-ollam-and-howard-payne-elevator hacking-fr
Semelhante a Defcon 22-deviant-ollam-and-howard-payne-elevator hacking-fr (20)
Mais de Priyanka Aash
Mais de Priyanka Aash (20)
Último
Último (20)
Defcon 22-deviant-ollam-and-howard-payne-elevator hacking-fr
- 1. Deviant Ollam & Howard Payne DEFCON 22 – 2014/08/03 ELEVATOR HACKING FROM THE PIT TO THE PENTHOUSE
- 2. WHO ARE WE?
- 3. http://enterthecore.net Who Are We? Deviant Ollam – Physical Penetration Tester – Red Teamer – Lockpicker – Liquor of Choice: Lagavulin Howard Payne – Elevator Consultant & Inspector – Non-Union – Boardwalk Badass – Liquor of Choice: American Adjunct Lager
- 4. http://enterthecore.net Who Are We? Deviant Ollam – Physical Penetration Tester – Red Teamer – Lockpicker – Liquor of Choice: Lagavulin Howard Payne – Elevator Consultant & Inspector – Non-Union – Boardwalk Badass – Liquor of Choice: American Adjunct Lager
- 5. WARNING!
- 6. http://enterthecore.net If Used Properly Elevators are Incredibly Safe – • NYC alone has almost 60,000 elevators • 11 billion trips per year, 30 million every day • Annually there are only about 24 injuries requiring medical attention
- 7. http://enterthecore.net If Used Properly Elevators are Incredibly Safe – • NYC alone has almost 60,000 elevators • 11 billion trips per year, 30 million every day • Annually there are only about 24 injuries requiring medical attention Throughout the entire nation of 300+ million citizens, an average of just 26 people die in a given year riding elevators…
- 8. http://enterthecore.net If Used Properly Elevators are Incredibly Safe – • NYC alone has almost 60,000 elevators • 11 billion trips per year, 30 million every day • Annually there are only about 24 injuries requiring medical attention Throughout the entire nation of 300+ million citizens, an average of just 26 people die in a given year riding elevators… … the vast majority are trained professionals working on the devices at the time.
- 9. http://enterthecore.net Warning – Dying is Not Good
- 10. http://enterthecore.net Warning – Damage is Not Good
- 11. http://enterthecore.net Warning – Damage is Not Good
- 12. http://enterthecore.net Warning – Damage is Not Good
- 13. http://enterthecore.net Warning – We’re Professionals
- 15. http://enterthecore.net Terms & Technology – Traction vs Hydro
- 16. http://enterthecore.net Terms & Technology – The Elevator Cab
- 17. http://enterthecore.net Terms & Technology – The Elevator Cab
- 18. http://enterthecore.net Terms & Technology – Rails & Rollers
- 19. http://enterthecore.net Terms & Technology – Rails & Rollers
- 20. http://enterthecore.net Terms & Technology – Fixtures Car Operating Panel Position Indicator Car Travel Lantern Hall Lantern Hall Stations
- 21. http://enterthecore.net Terms & Technology – Motor Room
- 22. http://enterthecore.net Terms & Technology – Motor Room (Hydraulic)
- 23. http://enterthecore.net Terms & Technology – No Motor Room
- 24. http://enterthecore.net Terms & Technology – Controller
- 25. http://enterthecore.net Terms & Technology – Controller
- 28. http://enterthecore.net Safety Mechanisms – Overspeed Brake
- 29. http://enterthecore.net Safety Mechanisms – Governor (to Trigger Safeties)
- 30. http://enterthecore.net Safety Mechanisms – Rail Gripper Safety
- 31. http://enterthecore.net Safety Mechanisms – Modern Rail Gripper Safety
- 32. http://enterthecore.net Safety Mechanisms – Modern Rail Gripper Safety
- 33. http://enterthecore.net Safety Mechanisms – Modern Rail Gripper Safety
- 34. http://enterthecore.net Safety Mechanisms – Modern Rail Gripper Safety
- 35. http://enterthecore.net Safety Mechanisms – Modern Rail Gripper Safety
- 36. http://enterthecore.net Safety Mechanisms – Modern Rail Gripper Safety
- 37. http://enterthecore.net Safety Mechanisms – If All Else Fails… There’s the Buffer
- 38. http://enterthecore.net Elevators Want To Keep You Alive
- 39. http://enterthecore.net Elevators on Automatic Mode Do Their Job Well Everyday
- 40. http://enterthecore.net …Unless You’re on the Car Top, Derpface
- 48. http://enterthecore.net Express / Executive / VIP service
- 55. http://enterthecore.net Anti Nuisance / No Passenger
- 56. http://enterthecore.net Anti Nuisance / No Passenger
- 57. http://enterthecore.net Up Peak / Down Peak
- 73. ELEVATOR SECURITY (HOW IT’S ATTEMPTED)
- 74. http://enterthecore.net Disabled Hall Call Buttons
- 75. http://enterthecore.net No Hall Call Buttons
- 76. http://enterthecore.net Keycard to Register Hall Call
- 84. http://enterthecore.net Physically Securing the Elevator Area
- 85. http://enterthecore.net Physically Securing the Elevator Area
- 86. http://enterthecore.net Think of Elevators like Stairwells… but Sometimes Even Worse
- 87. ELEVATOR SECURITY (HOW IT’S SUBVERTED)
- 88. http://enterthecore.net When There Are No Hall Call Buttons
- 89. http://enterthecore.net When There Are No Hall Call Buttons
- 90. http://enterthecore.net When There Are No Hall Call Buttons
- 96. Welcome To the Kingdom of Keys!
- 97. Welcome To the Kingdom of Keys!
- 98. http://enterthecore.net Keys & Fixtures Brands of Elevator • Otis • Cemco • ThyssenKrupp • Dover • US Elevator • KONE • Montgomery • Armor • Schindler • Westinghouse • O. Thompson • Payne Brands of Fixtures • G.A.L. • EPCO • Innovation • Adams • Monitor / Janus • CJ Anderson • P.T.L. • MAD
- 109. http://enterthecore.net Keys & Fixtures The artist formerly known as
- 118. http://enterthecore.net The Industry is WAY Behind the Times on Security
- 119. http://enterthecore.net The Industry is WAY Behind the Times on Security
- 120. http://enterthecore.net The Industry is WAY Behind the Times on Security
- 121. http://enterthecore.net The Industry is WAY Behind the Times on Security
- 122. http://enterthecore.net The Industry is WAY Behind the Times on Security
- 123. http://enterthecore.net The Industry is WAY Behind the Times on Security
- 124. http://enterthecore.net The Industry is WAY Behind the Times on Security
- 125. http://enterthecore.net The Industry is WAY Behind the Times on Security
- 126. http://enterthecore.net The Industry is WAY Behind the Times on Security
- 127. http://enterthecore.net The Industry is WAY Behind the Times on Security
- 128. http://enterthecore.net The Industry is WAY Behind the Times on Security
- 129. http://enterthecore.net The Industry is WAY Behind the Times on Security
- 130. http://enterthecore.net The Industry is WAY Behind the Times on Security
- 131. http://enterthecore.net The Industry is WAY Behind the Times on Security
- 132. http://enterthecore.net ASME A17.1 (2007): Safety Code for Elevators & Escalators 2.27.8 Switch Keys The key switches required by 2.27.2 through 2.27.5 for all elevators in a building shall be operable by the same key. The keys shall be Group 3 Security (see 8.1). There shall be a key for each switch provided. These keys shall be kept on the premises in a location readily accessible to firefighters and emergency personnel, but not where they are available to the public. This key shall be of a tubular, 7 pin, style 137 construction and shall have a bitting code of 6143521. The key shall be coded "FEO-K1.“ The possession of the "FEO-K1“ key shall be limited to elevator personnel, emergency personnel, and elevator equipment manufacturers. Where provided, a lock box, including its lock and other components, shall conform to the requirements of UL 1037 (see Part 9). NOTE (2.27.8): Local authorities may specify additional requirements for a uniform keyed lock box and its location to contain the necessary keys. The Industry is WAY Behind the Times on Security
- 133. http://enterthecore.net It’s All Naked on the Inside
- 135. http://enterthecore.net What About Keycard Systems?
- 136. http://enterthecore.net What About Keycard Systems?
- 137. http://enterthecore.net Exploiting Keycards Major Malfunction – Magstripe Madness (DEFCON 14) https://www.youtube.com/watch?v=MY_p8C9jJCk MAGS TRIP EMAD NESS
- 138. So What Do Pen Testers Do?
- 140. http://enterthecore.net And Sometimes Fire Service
- 143. http://enterthecore.net Fire Service “The Post published pictures of the fire service keys only after checking with locksmiths who said duplicates could not be made without the originals in hand.” http://nypost.com/2012/10/01/lock-away-these-nyc-keys
- 144. http://enterthecore.net Fire Service The Infamous “2642 Key” Yale Y1 key (unrestricted blank) Bitting Code: 2-6-4-2-0
- 145. http://enterthecore.net Fire Service The “3502 Key” Yale Y2 key (unrestricted blank) Bitting Code: 0-3-2-3-4-8
- 146. http://enterthecore.net Fire Service The Tennessee Key Gamewell “Christmas Tree” Key reused and repurposed
- 147. http://enterthecore.net Fire Service The Indiana Key 7-pin Tubular Key (unrestricted blank) Bitting Code: X-X-X-X-X-X-X
- 148. http://enterthecore.net Fire Service The “XXXX” Key Medeco Cam (restricted blank) Bitting: X-X-X-X-X Sidebar: X-X-X-X-X
- 149. http://enterthecore.net Fire Service The “XXXX” Key Medeco Cam (restricted blank) Bitting: X-X-X-X-X Sidebar: X-X-X-X-X
- 150. http://enterthecore.net Exploiting BACnet Brad Bowers – How To Own A Building: Exploiting the Physical World With BACnet (ShmooCon 2013) http://www.youtube.com/watch?v=d3jtmv6Y9uk
- 156. http://enterthecore.net “It’s in that place where I put that thing that time.”
- 169. http://enterthecore.net Machine Room A Fair Analogy Floor Cutout Locks. . . . . . . . . . . . . . . . . . . . User Passwords Independent Service . . . . . . . . . . . . . . . . . . . . Local Admin Fire Service . . . . . . . . . . . . . . . . . . . . . . . . . Domain Admin Hoistway Access . . . . . . . . . . . . . . . . . . . . . . . . . . . System Machine Room Access . . . . . . . . . . . . . . . . . . . . Hypervisor
- 170. http://enterthecore.net Machine Room – Direct Operation via the Controller
- 171. http://enterthecore.net Machine Room – Direct Operation via the Controller
- 172. http://enterthecore.net Machine Room – Hacking & Manipulating the Controller
- 173. http://enterthecore.net Machine Room – Hacking & Manipulating the Controller
- 174. http://enterthecore.net Machine Room – Hacking & Manipulating (5-Year Test)
- 175. http://enterthecore.net Machine Room – Hacking & Manipulating is Dangerous!
- 177. ELEVATOR PHREAKING
- 178. http://enterthecore.net Emergency Phones in Elevators
- 179. http://enterthecore.net Emergency Phones in Elevators
- 180. http://enterthecore.net Emergency Phones in Elevators
- 181. http://enterthecore.net Emergency Phones in Elevators
- 182. http://enterthecore.net Emergency Phones in Elevators
- 183. http://enterthecore.net Emergency Phones in Elevators
- 184. http://enterthecore.net Emergency Phones in Elevators
- 185. http://enterthecore.net Emergency Phones in Elevators
- 186. http://enterthecore.net Emergency Phones in Elevators
- 187. http://enterthecore.net Emergency Phones in Elevators
- 188. http://enterthecore.net Emergency Phones in Elevators
- 189. http://enterthecore.net Emergency Phones in Elevators
- 190. http://enterthecore.net Emergency Phones in Elevators
- 191. http://enterthecore.net Emergency Phones in Elevators
- 192. http://enterthecore.net Emergency Phones in Elevators
- 193. http://enterthecore.net Emergency Phones in Elevators
- 194. http://enterthecore.net Emergency Phones in Elevators
- 195. http://enterthecore.net Emergency Phones in Elevators
- 196. http://enterthecore.net Emergency Phones in Elevators
- 197. COMMON VIOLATIONS, ISSUES, & GUIDANCE
- 205. http://enterthecore.net Unsecured Motor Rooms and Hoistways
- 206. http://enterthecore.net Unsecured Motor Rooms and Hoistways
- 207. http://enterthecore.net Unsecured Motor Rooms and Hoistways
- 208. http://enterthecore.net Unsecured Motor Rooms and Hoistways
- 209. http://enterthecore.net Improperly Secured Motor Rooms and Hoistways
- 210. http://enterthecore.net Improperly Secured Motor Rooms and Hoistways
- 211. http://enterthecore.net Improperly Secured Motor Rooms and Hoistways
- 212. http://enterthecore.net Improperly Secured Motor Rooms and Hoistways
- 213. http://enterthecore.net Know Who Your Contractor Is!
- 214. http://enterthecore.net Know Who Your Contractor Is! 1. Facilities / Operations 2. Elevator Contractor - Constructor - Maintenance Contractor / Mechanic • parts, oil, grease -or- regular maintenance • basic troubleshooting - Adjuster / Troubleshooter 3. Consultants - Performance - Monitoring - Safety / Post-accidents 4. Inspection - AHJ (Authority Having Jurisdiction… Municipal / State Inspectors) - Third Party (QEI – Qualified Elevator Inspector) - Second Party (Contractor inspects and certifies self)
- 215. http://enterthecore.net Oversight of Your Maintenance Control Program
- 216. http://enterthecore.net Oversight of Your Maintenance Control Program
- 217. http://enterthecore.net Oversight of Your Maintenance Control Program
- 218. http://enterthecore.net Oversight of Your Maintenance Control Program
- 220. http://enterthecore.net Be Wary of Bullshit Service
- 221. http://enterthecore.net Be Wary of Bullshit Service
- 223. http://enterthecore.net Follow All of Your Building Procedures
- 224. SO WHAT NOW?
- 225. http://enterthecore.net So What Now? APT elevator attacks?? Impossibru!!
- 226. http://enterthecore.net There are Elevator Techs
- 227. http://enterthecore.net And There are Elevator Techs who are Security Consultants
- 228. http://enterthecore.net “I Don’t Want My Elevator on the Internet but I Want Monitoring”
- 229. FINAL TIPS PREVENTING & CORRECTING PROBLEMS
- 230. http://enterthecore.net If Someone (Including You) Is Stuck in an Elevator
- 231. http://enterthecore.net Follow These Simple Steps… 1. Don’t Panic
- 232. http://enterthecore.net Follow These Simple Steps… 1. Don’t Panic (and don’t press emergency call just yet)
- 233. http://enterthecore.net Follow These Simple Steps… 1. Don’t Panic • Main lights off? You don’t have many options (emerg. call) • Main lights on? Try the following…
- 234. http://enterthecore.net Follow These Simple Steps… 1. Don’t Panic 2. Press Door Open (exit safely if doors open)
- 235. http://enterthecore.net Follow These Simple Steps… 1. Don’t Panic 2. Press Door Open 3. Press Door Close, Then Press Door Open Again
- 236. http://enterthecore.net Follow These Simple Steps… 1. Don’t Panic 2. Press Door Open 3. Press Door Close, Then Press Door Open Again 4. Try Placing Calls to Other Floors, Including Lobby
- 237. http://enterthecore.net Follow These Simple Steps… 1. Don’t Panic 2. Press Door Open 3. Press Door Close, Then Press Door Open Again 4. Try Placing Calls to Other Floors, Including Lobby 5. Make Sure You’re Badged In, Try Floor Calls Again
- 238. http://enterthecore.net Follow These Simple Steps… 1. Don’t Panic 2. Press Door Open 3. Press Door Close, Then Press Door Open Again 4. Try Placing Calls to Other Floors, Including Lobby 5. Make Sure You’re Badged In, Try Floor Calls Again 6. If Authorized, Try Using Keyswitches (IND Mode)
- 239. http://enterthecore.net Follow These Simple Steps… 1. Don’t Panic 2. Press Door Open 3. Press Door Close, Then Press Door Open Again 4. Try Placing Calls to Other Floors, Including Lobby 5. Make Sure You’re Badged In, Try Floor Calls Again 6. If Authorized, Try Using Keyswitches (IND Mode) 7. Verify the Cab Doors Are Closed (Unless you heard something loudly fail)
- 240. http://enterthecore.net Follow These Simple Steps… 1. Don’t Panic 2. Press Door Open 3. Press Door Close, Then Press Door Open Again 4. Try Placing Calls to Other Floors, Including Lobby 5. Make Sure You’re Badged In, Try Floor Calls Again 6. If Authorized, Try Using Keyswitches (IND Mode) 7. Verify the Cab Doors Are Closed 8. If Nothing Worked, Call For Help (Emergency Phone or Mobile Phone or Radio)
- 241. http://enterthecore.net Things To NEVER Try When Stuck… 1. Leaving Through the Top Hatch • It’s dangerous • It will foul up other procedures
- 242. http://enterthecore.net Things To NEVER Try When Stuck… 1. Leaving Through the Top Hatch 2. Exiting a Mis-Leveled Car • If you have to jump, that’s too far!
- 243. http://enterthecore.net Things To NEVER Try When Stuck… 1. Leaving Through the Top Hatch 2. Exiting a Mis-Leveled Car 3. The Safest Place to Be is in the Elevator Itself
- 244. http://enterthecore.net Thank You Very Much! delta@enterthecore.net howard@payneelevator.com @deviantollam @sgthowardpayne