Elevators 101

Elevators 101

Speakers: Bobby Graydon; Ege Feyzioglu

Conference: DEF CON

YouTube: https://www.youtube.com/watch?v=LrzGrp8L1XI

Overview

In "Elevators 101," Ege Feyzioglu and Bobby Graydon from the Physical Security Village at DEF CON shed light on the often-overlooked vulnerabilities inherent in modern elevator systems. The talk serves as a critical introduction to "elevator hacking," which they define as manipulating elevators in ways unintended by their design to gain unauthorized access or achieve objectives within a secured building. Far from mere mischief, this capability presents significant physical security bypass opportunities for penetration testers and malicious actors alike, allowing them to circumvent traditional access controls and navigate restricted areas.

The speakers emphasize that while elevators are designed for extreme safety under normal operation, exploiting their special modes or physical components can lead to extremely dangerous situations, including electrocution, falls, and severe damage to expensive equipment. This presentation is explicitly framed as an educational overview rather than a how-to guide for untrained individuals, stressing that any practical application requires specialized training and explicit permission. The core message is that elevators, despite their ubiquitous presence, represent a significant and often neglected attack surface in physical security assessments, capable of providing direct vertical access through otherwise impenetrable floor-level barriers.

Background

▶ Watch: Introduction to elevator hacking and its purpose (0:00)

To understand elevator vulnerabilities, it's essential to grasp their fundamental mechanics and operational modes. The speakers begin by differentiating between the two primary types of elevators: traction elevators and hydraulic elevators. Traction elevators are suspended from above by cables and utilize a counterweight system, commonly found in taller buildings. Hydraulic elevators, conversely, are pushed from below by a piston driven by hydraulic pressure, typically limited to around five floors due to the immense pressures involved with greater heights. The passenger compartment itself is known as the elevator car.

Users interact with elevators via hall panels (containing hall buttons for "up" or "down" calls in the hallway) and car panels (with car buttons inside the car for specific floor selection). A crucial concept introduced is homing, where an elevator, when idle, automatically returns to a predetermined floor based on programmed logic (e.g., the lobby during check-in at a hotel). This feature, designed for user convenience, can be exploited: if an elevator homes to a restricted upper floor, an unauthorized individual can simply ride it up and exit when the doors open, bypassing conventional access controls, assuming the system isn't programmed with robust security in mind. This highlights a foundational issue: elevator programming prioritizes efficiency and convenience, often at the expense of security, creating inherent weaknesses that attackers can leverage.

Key Findings

▶ Watch: Basic elevator terminology: car, traction, hydraulic, calls (3:20)

The talk reveals that the primary avenue for "elevator hacking" lies in exploiting various special modes of operation, which are typically activated via key switches. These modes, designed for maintenance, emergency services, or specific staff functions, often bypass standard floor lockouts and authentication requirements. The key findings include:

1. Exploitable Special Modes:

• Independent Service: Allows the elevator to respond only to commands from inside the car, ignoring hall calls and often floor lockouts, making it ideal for staff like custodians or movers.
• Attendant Service: A legacy mode for VIP service, which can sometimes bypass credential requirements for specific floors.
• Inspection Service: The most powerful and dangerous mode, granting full control to a technician for hoistway access, overriding all safety interlocks to prevent unexpected movement.
• Fire Emergency Operation (Phase 1 & 2): Critically, this mode is mandated by code (e.g., in the US and Canada) to ignore all security and authentication. Phase 1 evacuates the car to a designated landing, while Phase 2 grants firefighters complete control to access any floor for emergency response, regardless of standard access restrictions.

1. Common Key Switch Vulnerabilities: Many elevators rely on standardized, low-security key switches (e.g., wafer locks, tubular keys) that can be easily picked, purchased online, or even bypassed with rudimentary tools. More secure options like Medeco cam locks are less common.

1. Physical Bypass Techniques:

• Jumpering: Directly manipulating the wiring behind key switches to simulate a key turn, effectively activating special modes without a key. This requires access to the car panel, but can bypass even high-security locks.
• Social Engineering: Highly effective methods like piggybacking, faking phone calls about forgotten fobs or urgent meetings, feigning to carry heavy items, or manipulating concierges to grant access to restricted floors.

1. Hoistway Access Dangers: While not a recommended penetration testing technique due to extreme danger, the talk briefly touches upon the mechanics of accessing the hoistway, emphasizing the numerous ways it can lead to severe injury or death, including falling, being caught by moving parts, or electrocution.

These findings collectively demonstrate that elevators are not merely transportation devices but complex systems with inherent design and operational characteristics that, when understood, can be exploited to compromise physical security.

Technical Deep Dive

▶ Watch: Understanding and exploiting the elevator's 'homing' behavior (4:50)

The core of elevator hacking revolves around understanding and activating the various special modes of operation, most of which are controlled by key switches located on the car panel or designated landings.

Special Modes of Operation

1. Independent Service Mode:

• Purpose: Designed for specific personnel (e.g., custodial staff, movers) who need uninterrupted control of an elevator without interference from other calls or floor restrictions.
• Functionality: When activated, the elevator isolates itself from the bank, ignoring all hall calls and often floor lockouts. It responds solely to the car calls and door commands from the occupant.
• Security Implication: The presence of the key for independent service is often treated as sufficient authorization to access any floor. For an attacker, this means if they can activate this mode, they can bypass all digital access controls for restricted floors. It can also be used to "hide" an elevator by driving it to an unused floor and keeping the doors closed, making it appear unresponsive to hall calls.

1. Attendant Service Mode:

• Purpose: A legacy mode, harkening back to when elevators had human attendants. It provides a degree of manual control for offering "VIP service."
• Functionality: An attendant can flip a switch (or use a key) to gain control, allowing them to skip hall calls, reverse direction, and prioritize specific passengers.
• Security Implication: In some less secure implementations, this mode might not enforce floor lockouts, allowing an attendant (or an attacker impersonating one) to take a VIP (or themselves) to a restricted floor without requiring a separate credential from the passenger.

1. Inspection Service Mode:

• Purpose: This is the most privileged and dangerous mode, exclusively for elevator technicians who need to physically access the hoistway (the shaft) or the top/bottom of the car for maintenance.
• Functionality: Activated by a key switch, often labeled "inspection up/down" or "inspection on/off." It gives the technician granular control over the elevator's movement, overriding standard safety interlocks. This is critical because unexpected movement in the hoistway is extremely hazardous. The term "Huanab" (hoistway enable) is mentioned as a specific switch for this.
• Security Implication: While highly dangerous and not typically a direct bypass for floor access from inside the car, its existence signifies a powerful override capability. Gaining access to this mode would grant an attacker unparalleled control over the elevator's physical position.

1. Fire Emergency Operation (Phase 1 & 2):

• Purpose: To ensure passenger safety and assist firefighters during a building fire.
• Phase 1 (Default Operation): Triggered by smoke or heat detectors in elevator lobbies. The elevator will ignore all hall calls, reverse direction if needed, and travel to a designated landing (usually the lobby, often marked with a star). If the designated landing is compromised, it will go to an alternate designated landing (typically one floor above). This prevents elevators from opening doors onto a burning floor.
• Phase 2 (Firefighter Service): Activated by firefighters using a specific key switch. This mode transforms the elevator into a critical firefighting tool.
• Security Implication (CRITICAL): According to standards like those in the US and Canada (e.g., ASME A17.1/CSA B44), when an elevator is in Phase 2 fire operation, it must ignore all authentication, security programming, and floor lockouts. This allows firefighters to access any floor to combat the fire, regardless of how sensitive or restricted that floor might normally be. For an attacker, if they can activate Phase 2 (e.g., with a readily available key), they gain unfettered access to all floors in the building. The speakers explicitly warn that improper activation can "get the elevator controller extremely mad," requiring expensive service calls and complex resets.

Activating Special Modes: Key Switches and Bypasses

Most special modes are activated by physical key switches. The security of these switches varies widely:

• Common Keys: Many buildings use standardized, low-security keys that can be purchased online (e.g., from Amazon for around $20), or are easily picked. Examples include wafer locks (which can be picked with simple tools like a ballpoint pen cap) and tubular keys.
• High-Security Keys: Some facilities, particularly those with higher security consciousness, use more robust key switches, such as Medeco cam locks, which are significantly harder to pick without specialized tools and expertise.

Even if a high-security key switch is present, it can often be bypassed through jumpering:

• Mechanism: Key switches are essentially simple electrical switches. They consist of two or three terminals. Turning a key either shorts (connects) or opens (disconnects) these terminals, sending a signal (e.g., "1" or "0") to the elevator controller.
• Bypass Technique: By carefully removing the car panel (with extreme caution for electrical hazards), an attacker can access the wiring behind the key switch. For a normally open switch, pulling a wire or unscrewing a contact can simulate "off." For a normally closed switch, bridging two contacts with a conductive object (like a screwdriver or a wire) can simulate "on."
• Safety Warning: Speakers issue a strong warning about the potential for 120 volts mains voltage in older panels, emphasizing the need for insulated tools and extreme caution. Most modern systems use safer PLC voltages, but the risk remains.

A less reliable but occasionally successful technique mentioned is holding a floor button down. While almost always ineffective, Bobby Graydon reported it working in two engagements, with no clear explanation as to why.

Hoistway Access (for Trained Professionals Only)

The talk briefly touches upon hoistway access, reiterating its extreme danger.

• Anatomy: The inner elevator door is part of the car, while the outer door (or hoistway door) is in the hallway. When the car is at a floor, a mechanism on the inner door engages the outer door to open both simultaneously.
• Escutcheon Holes: These small holes, often in the top corner of hoistway doors, are points where specialized keys can be inserted to manually open the outer doors even when the car is not present.
• Dangers: The hoistway is a vertical shaft with numerous hazards: falling down the shaft (a 20+ story drop), being crushed by the counterweight in traction elevators, entanglement in the cable riser (carrying control signals), being caught in pinch areas along the guide rails (which keep the car aligned), and electrocution from various electrical components. The car top control box on the roof of the elevator car allows a technician to move the car up and down and provides light and power for tools.

Demo / Proof of Concept

▶ Watch: Introduction to 'Independent Service' mode and its function (6:20)

While the talk strongly discourages direct, unauthorized manipulation of elevators due to extreme safety risks and potential for damage, it presents several case studies that demonstrate the practical impact of these vulnerabilities in real-world penetration tests. These serve as "proof of concept" for clients, showing how security can be bypassed without necessarily performing destructive or highly dangerous actions.

1. Parking Garage Lockout Bypass:

• Scenario: A common setup where parking garages are publicly accessible, but their elevators require RFID or other credentials to access upper, restricted floors of the building.
• Techniques Demonstrated:
• Homing Exploitation: An attacker enters the elevator in the parking garage and simply waits. If the elevator's programming dictates it "homes" to a higher floor (e.g., the lobby) during certain times, the attacker is carried up, and can exit when the doors open.
• Waiting for a Hall Call: Similar to homing, but relies on another legitimate occupant calling the elevator from a higher floor. The attacker enters the elevator in the garage, waits, and when a call comes from, say, the 30th floor, they are taken directly to that floor. This is particularly effective in multi-bank elevators during working hours.
• Jumpering to Independent Service: If access to the car panel is possible, jumpering the key switch to activate independent service mode allows the attacker to select any floor directly, bypassing the parking garage lockout.

1. Hall Call Lockout Bypass:

• Scenario: Elevators equipped with advanced RFID readers or other fob technologies to restrict floor access from the car panel.
• Techniques Demonstrated: Even with sophisticated digital access control, many elevators still feature simple, physical key switches (like the common wafer lock or tubular key) on the car panel or within the elevator frame. These physical switches, often overlooked, can override the digital lockouts. An attacker can use a readily available key or jumper the switch to gain full access, rendering the fancy RFID system ineffective.

1. Social Engineering Case Studies:

• Scenario: Leveraging human factors to gain access without any technical bypass. This is often the starting point for elevator hacking.
• Techniques Demonstrated:
• Piggybacking: Simply following a legitimate occupant into the elevator and riding to their floor. This is common in condos or offices.
• Fake Phone Call: An attacker enters an elevator with a legitimate occupant, holds their phone to their ear, and pretends to be on an urgent call. They might say, "I'm sorry I'm late, forgot my fob, taking the stairs from the 30th floor," leading the legitimate occupant to assume they belong and are just in a rush, making them less likely to question the attacker's presence.
• Carrying Something Heavy: An attacker struggling with a heavy box or equipment asks a legitimate occupant already in the elevator to press a specific floor for them (e.g., "Hey, can you get floor 13?"). This creates a plausible reason for not pressing the button themselves and elicits helpfulness.
• Concierge Manipulation: In newer buildings, concierges often have direct control over elevator access for guests. An attacker can social engineer the concierge (e.g., by posing as a contractor, delivery person, or attendee for an event) to grant them access to a restricted floor.

These case studies illustrate that a comprehensive understanding of elevator systems, combined with social engineering skills, provides numerous avenues for bypassing physical security without resorting to the highly dangerous and destructive actions of direct hoistway manipulation.

Defensive Implications

▶ Watch: How Independent Service mode bypasses floor lockouts for access (7:00)

The insights from "Elevators 101" provide critical guidance for facilities looking to bolster their physical security posture. Elevators, often viewed purely as logistical infrastructure, must be recognized as potential bypass points for unauthorized access.

1. Comprehensive Security Planning: Facilities should integrate elevator security into their broader physical security assessments. Security planning should not be confined to a "horizontal plane" (i.e., door-to-door access on a single floor) but must account for "vertical plane" access through elevators and stairwells.
2. Upgrade Key Switches: A significant vulnerability lies in the widespread use of common, low-security key switches (e.g., wafer locks, tubular keys) for activating special modes. Facilities should:

• Identify: Inspect all elevator car panels and designated landing panels for key switches.
• Replace: Swap out any common or easily pickable key switches with high-security alternatives, such as Medeco cam locks or other proprietary, restricted-key systems. This will significantly deter opportunistic attackers who rely on readily available keys or simple lock-picking techniques.
• Secure Panels: Consider using security fasteners (e.g., tamper-resistant screws) on elevator car panels to prevent easy removal and access to internal wiring, thereby mitigating the risk of jumpering key switches.

1. Review Elevator Programming for Homing: Assess the programming logic for elevator homing functions. While designed for convenience, ensure that homing protocols do not inadvertently facilitate access to restricted floors during off-hours or specific operational periods.
2. Security Awareness Training for Staff: Educate all staff, especially receptionists, concierges, and security personnel, about social engineering tactics related to elevators. Training should cover:

• Vigilance against piggybacking: Encouraging staff to politely challenge unknown individuals who follow them into elevators or through secure entry points.
• Verifying credentials: Implementing strict protocols for verifying identities of contractors, delivery personnel, or guests requesting elevator access.
• Recognizing plausible but false narratives: Training staff to identify common social engineering ploys, such as fake phone calls, claims of forgotten fobs, or feigning to carry heavy items.

1. Audit Fire Emergency Operation Key Access: The fact that Phase 2 Fire Emergency Operation bypasses all security is a critical design feature for safety, but it also creates a potent attack vector if the key is compromised. Facilities should:

• Restrict Access: Implement extremely tight controls over who possesses the fire service key and where it is stored. It should only be accessible by trained emergency personnel.
• Monitor Usage: Log all activations of fire service mode to detect any unauthorized or anomalous usage.
• Educate Stakeholders: Ensure building owners and security managers are aware that, by code, fire mode will override all other security measures, and this must be factored into their risk assessments.

1. Avoid Hoistway Access for Untrained Personnel: Reiterate and enforce strict policies against any unauthorized or untrained personnel attempting to access the hoistway. The extreme dangers (falls, crushing hazards, electrocution) make this an unacceptable risk.

By addressing these points, facilities can significantly reduce their exposure to elevator-based physical security breaches, transforming elevators from overlooked vulnerabilities into properly secured components of a comprehensive security strategy.

Key Takeaways

• Elevators are Overlooked Vulnerabilities: Elevators represent a significant, yet frequently ignored, attack surface in physical security, capable of bypassing traditional horizontal access controls.
• Special Modes Bypass Security: Independent, Attendant, Inspection, and critically, Fire Emergency Operation (Phase 2) modes can override standard floor lockouts and authentication, granting unauthorized access.
• Common Key Switches are Weak Points: Many elevators use low-security key switches that are easily picked, purchased, or bypassed, rendering more advanced digital access controls ineffective.
• Physical Bypass and Social Engineering are Effective: Jumpering key switches to activate special modes and various social engineering tactics (piggybacking, fake calls, concierge manipulation) are highly successful methods for gaining access.
• Hoistway Access is Extremely Dangerous: Direct access to the elevator hoistway is profoundly hazardous and should only be attempted by highly trained professionals due to severe risks of injury or death.
• Facilities Must Prioritize Elevator Security: Building owners and security teams need to integrate elevator security into their overall physical security planning, including upgrading key switches, securing panels, and training staff on social engineering awareness.

About the Speaker(s)

Ege Feyzioglu and Bobby Graydon are associated with the Physical Security Village, a prominent feature at DEF CON. Their expertise lies in identifying and demonstrating vulnerabilities within physical security systems. As speakers, they aim to educate the security community on practical attack vectors that are often overlooked, such as those found in elevator systems. Their presentation style combines technical detail with a strong emphasis on safety and responsible disclosure, underscoring the dangers inherent in physical security testing while providing actionable insights for defenders.