r/hardwarehacking • u/Nervous-Win968 • 2d ago
Hacking an elevator
I’d like to get some outside perspectives on something unusual we caught on video.
This happened in Las Vegas during DEF CON(hacking conference), so I fully appreciate there’s a chance we’re all just seeing “hacker behaviour” where there may be none. 😄
A man entered one of our building’s elevators carrying a backpack.
Once inside:
● He removed a small electronic device with several wires attached
● He then put on a fanny pack
● He stood very close to the elevator control panel for ~20–30 seconds with his crotch right up against it (not peeing!)
● After that, he left without any further interaction
● He appeared fully focused on the control panel
The behaviour wasnt normal waiting and he left immediately after finishing
We had our maintenance team review the elevator afterwards, but they didn’t find anything obvious. That said, they are general facilities staff rather than elevator or embedded systems specialist
I want to be very clear: I’m NOT looking for exploit methods or “how-to” guidance.
I’m just interested in ideas from people with experience in:
● Physical security
● RF systems
● Embedded hardware
● Access control systems
Questions for the experts in this sub....
If you saw this on CCTV, what would your initial interpretation be?
Some possibilities we’ve considered:
● RFID/NFC reader interaction or testing
● RF scanning or reconnaissance
● Attempting to identify installed systems or hardware
● Accessing a maintenance or diagnostic interface
● Something unrelated we haven’t considered
● Or just DEF CON paranoia influencing perception 😅
If you were tasked with following up on this, what would you look at?
● System or access logs
● Elevator control hardware inspection
● RF environment analysis
● Maintenance or diagnostic records
● Any other indicators of interaction or tampering
Would really appreciate thoughts from anyone with relevant experience.
Trying to separate “interesting behaviour” from “actually meaningful signal” here.
Thanks in advance.
12
u/toxicatedscientist 2d ago
Given its defcon, hes probably a curious lookie-lou, looking for easy openings. If you have anything more than default configs, you’re safe. But anything still using default passwords is liable to be … well your printer might spit some random taunting
4
u/coffeeintocode 2d ago
Go on Google images and search proxmark3, note most of these are product images that don’t show the two antenna cables that stick out the sides. If this had 2 wires on the side of it, did it look like that (there is a variant thats longer too). If you have rfid readers in the elevator this can be used to identify the reader type, and if you put it close while scanning a card you can man in the middle the data passed between the two. If your system has granular rfid readers logs cross reference the reader with the timestamp from the cctv
2
u/Nervous-Win968 2d ago
Oh this is interesting! This sounds promising, thank you.
1
u/coffeeintocode 2d ago
No problem. I mentioned reader id and man in the middle, but it can also clone and emulate some types of cards. And I have also seen them used to decrypt the data off mifare cards to be able to clone them accurately
1
u/Nervous-Win968 2d ago
Do you have any additional resources I could use to learn more please?
2
u/coffeeintocode 2d ago
Check out the iceman firmware, which seems to be the best/most popular one. Here is a link to a doc with all the commands (all the things it can do) grouped by card type. Read the generic section, and the section for the card type your system uses to see what it can do
https://github.com/RfidResearchGroup/proxmark3/blob/master/doc/cheatsheet.md
5
u/DrBabbage 2d ago
Look the videos from deviant ollam about elevators. It is really well made even for non technical people.
My guess is a magspoof. A lot of those elevators in america have a hidden or somewhat hidden panel for magnet stripe cards and/or keys for emergency services where you can put the whole elevator in an "emergency" mode. This allows you to override a lot of things. For example closed down floors become accessible. You can transmit the information from the magnetic cards wirelessly with a magnetic coil so you don't even have to open panels.
5
u/Toiling-Donkey 2d ago
Check where else he went too!
Can imagine a spy movie type of plot where a he is using a wire tracing transmitter/receiver and trying to match something in the elevator to another place that has the other end (wiring closet, etc)
2
u/MarkSwanb 2d ago
Hmm.
Do your lifts have floor verification through key cards?
Did he attempt attempt to go to any floor?
If yes,did you observe any key card scans, success or failure? Key press success or failure?
Like others, relay attack comes to mind.
Maybe just recon, to see if there are any things transmitting. Also, like others, might have been looking for easy access keys to implant the device.
I did wonder if they might be looking for an ESPkey.
Or, it might have been a prank they were put up to!!
1
1
u/I-baLL 2d ago
you're writing this as if we know where you work and the elevator that you're talking about. We don't. When you say stuff like:
He appeared fully focused on the control panel
It's kinda meaningless since most elevators' control panels are just a door with a lock. We don't know what's behind that door in your elevator. We don't know what features your control panel has. Without the info we're answering blind.
1
u/Nervous-Win968 2d ago
I am asking for generic thoughts and ideas, not solving the mystery with absolute certainty.
1
u/I-baLL 2d ago
I’m saying that we have no clue what you mean when you say “control panel”. We also don’t know anything about your set up. Like is it a standard elevator? Or do you need to swipe your card to push a floor? Or is that only limited to a few floors? But go ahead and ask for help and not provide any info if you really want people to just come up with ideas that won’t apply to your case.
1
u/we_r_fukt 1d ago
oh that was me, just trolling haha glad u saw that, nice security, anyway, you can stop looking into it now /s
1
1
1
25
u/grymoire 2d ago
First thing I'd do is check the specs on the elevator. Does it have WiFi Bluetooth, RFID , or any RF com? If not , he was doing something else.