Checkmate
How I Bypassed Your Security System with a Shoe String and Hanging File Folder the Morning After You Upgraded It
by DreamsForMortar
I've been actively picking and manipulating locks for a couple of years now, though my interest in creative problem solving stems from a childhood spent disassembling anything I could get my hands on just to see how it worked.
My actual job is systems integration and troubleshooting. In my avocations however, I prefer to keep things low/no-tech for the sake of elegance and practicality, but also because I enjoy the challenge of doing more with less. What follows is yet another example of how knowledge truly is power. An example of how, by combining knowledge with the right mindset, one can solve a problem with almost nothing. A lesson for anyone involved in facilities security, about how quickly your access control systems can become a pointless investment if you don't learn to think outside the box.
I work for a company that, like so many others, particularly in the world of government contracting, enjoys droning on ad nauseam about security. Unfortunately, also like many others, it often does so while completely failing to apply a modicum of critical thinking about its own systems, policies, or procedures. It's as much of a useless "feel good" strategy to safeguarding information, assets, and personnel as "duck and cover" is for surviving a nuclear attack.
Suffice it to say, when it was announced that the building security system would be upgraded, I was not surprised that the only changes involved replacing the few dozen ugly gray proximity card readers with the sleek and sexy HID EdgeReader ER40s (at around $350-$500 each) and the back end software to interface with them (IMRON's IS2000 security management software, at a conservatively estimated $5,000 minimum). IR motion sensors, video cameras, locking systems, and even the current issued proximity cards all remained the same. Nor was I surprised when I showed up to work at 0500 the very next frigid January morning, to find that my badge was one of the few that failed to make it into the new system. It was at this point that I took stock of what was in my work bag, and seriously analyzed the doors available for entry.
We happen to have a very classy set of double glass doors at the main entrance, as well as a number of heavy wooden doors for back hallways. All are secured with magnetic locks, and all have infrared motion sensors as well as the super-sexy new badge readers. I initially suspected that the motion sensors would cause the magnetic locks to release when tripped (e.g. a warm glove on a string), but this turned out not to be the case. The glass doors, unlike the others, are designated as mass exit points in the event of a fire; thus they're equipped with panic bars (a.k.a., crash bars or push bars).
Anyone who is familiar with fire code regulations when it comes to exit devices should know that doors fitted with panic bars must, by law, be configured such that engaging the bar immediately releases any locking mechanism in place, without any interference from or reliance on other devices. The bars on these particular doors are model PL100 from Herculite. They are spring-loaded L-shaped bars that span the width of the door, turn 90 degrees, and continue to the top. I figured if I could find a way to retract the panic bar, I could open the door.
Upon closer inspection, I realized that the doors have a roughly 3/8-inch gap on the sides, and a 1/8-inch gap along the bottom; perfect for sliding something through. Each door pivots on two hinge pins, which extend from the top and bottom.
Of the items I have on me, most, including the small assortment of picks and shims I regularly carry, are useless for this particular problem. I happen to wear rather tall boots, so I keep about ten feet of paracord in my bag in case my laces break. That's perfect for pulling in the panic bar, but how do I get it around the bottom hinge pin, all the way across the inside of the door and over the horizontal bottom section of the panic bar?
Well, it's an office... I figured there was sure to be something laying around I could use and, sure enough, I found a discarded hanging file folder in a lobby trash barrel. The metal bars on these are thin but sturdy and they have a nice hook built right into each end. I tied one end of the string into a loop and slipped it into the gap on the hinge side of the door. Then I made a slight bend in the file folder bar so that the hooked end would be raised off the floor, and slid it under the door on the opposite side of the hinge pin from the string. I grabbed the loop with the hook and pulled it across to the other edge of the door and then raised both ends of the string up over the bottom of the panic bar. Then I slipped the file folder bar with the looped end of string through the crack back to my side of the door and pulled on both ends of the string until the panic bar retracted and the door popped open. Five to ten seconds and open sesame.
Less than a dollar's worth of string and office supplies: 1
A $17,600+ security system: 0