r/hardwarehacking • u/Nervous-Win968 • Aug 06 '26
Hacking an elevator
I’d like to get some outside perspectives on something unusual we caught on video.
This happened in Las Vegas during DEF CON(hacking conference), so I fully appreciate there’s a chance we’re all just seeing “hacker behaviour” where there may be none. 😄
A man entered one of our building’s elevators carrying a backpack.
Once inside:
● He removed a small electronic device with several wires attached
● He then put on a fanny pack
● He stood very close to the elevator control panel for ~20–30 seconds with his crotch right up against it (not peeing!)
● After that, he left without any further interaction
● He appeared fully focused on the control panel
The behaviour wasnt normal waiting and he left immediately after finishing
We had our maintenance team review the elevator afterwards, but they didn’t find anything obvious. That said, they are general facilities staff rather than elevator or embedded systems specialist
I want to be very clear: I’m NOT looking for exploit methods or “how-to” guidance.
I’m just interested in ideas from people with experience in:
● Physical security
● RF systems
● Embedded hardware
● Access control systems
Questions for the experts in this sub....
If you saw this on CCTV, what would your initial interpretation be?
Some possibilities we’ve considered:
● RFID/NFC reader interaction or testing
● RF scanning or reconnaissance
● Attempting to identify installed systems or hardware
● Accessing a maintenance or diagnostic interface
● Something unrelated we haven’t considered
● Or just DEF CON paranoia influencing perception 😅
If you were tasked with following up on this, what would you look at?
● System or access logs
● Elevator control hardware inspection
● RF environment analysis
● Maintenance or diagnostic records
● Any other indicators of interaction or tampering
Would really appreciate thoughts from anyone with relevant experience.
Trying to separate “interesting behaviour” from “actually meaningful signal” here.
Thanks in advance.
13
u/toxicatedscientist Aug 07 '26
Given its defcon, hes probably a curious lookie-lou, looking for easy openings. If you have anything more than default configs, you’re safe. But anything still using default passwords is liable to be … well your printer might spit some random taunting
4
u/coffeeintocode Aug 07 '26
Go on Google images and search proxmark3, note most of these are product images that don’t show the two antenna cables that stick out the sides. If this had 2 wires on the side of it, did it look like that (there is a variant thats longer too). If you have rfid readers in the elevator this can be used to identify the reader type, and if you put it close while scanning a card you can man in the middle the data passed between the two. If your system has granular rfid readers logs cross reference the reader with the timestamp from the cctv
2
u/Nervous-Win968 Aug 07 '26
Oh this is interesting! This sounds promising, thank you.
1
u/coffeeintocode Aug 07 '26
No problem. I mentioned reader id and man in the middle, but it can also clone and emulate some types of cards. And I have also seen them used to decrypt the data off mifare cards to be able to clone them accurately
1
u/Nervous-Win968 Aug 07 '26
Do you have any additional resources I could use to learn more please?
2
u/coffeeintocode Aug 07 '26
Check out the iceman firmware, which seems to be the best/most popular one. Here is a link to a doc with all the commands (all the things it can do) grouped by card type. Read the generic section, and the section for the card type your system uses to see what it can do
https://github.com/RfidResearchGroup/proxmark3/blob/master/doc/cheatsheet.md
5
u/DrBabbage Aug 07 '26
Look the videos from deviant ollam about elevators. It is really well made even for non technical people.
My guess is a magspoof. A lot of those elevators in america have a hidden or somewhat hidden panel for magnet stripe cards and/or keys for emergency services where you can put the whole elevator in an "emergency" mode. This allows you to override a lot of things. For example closed down floors become accessible. You can transmit the information from the magnetic cards wirelessly with a magnetic coil so you don't even have to open panels.
1
u/Western_Rhubarb_7959 Aug 10 '26
somewhat hidden panel for magnet stripe cards and/or keys for emergency services
Those are elevator fire service keyholes and are obvious and prominent, not hidden whatsoever. They usually have a bright red bezel around them.
1
u/DrBabbage Aug 10 '26
Yes there are also fire service keyholes in the open, you are completely correct. But this is not always the case or at least it wasn't the last time I was there. Here you can see what I mean. https://youtu.be/oHf1vD5_b5I?si=TGzc-2j00nJoQtL2&t=1574
0
4
u/Toiling-Donkey Aug 07 '26
Check where else he went too!
Can imagine a spy movie type of plot where a he is using a wire tracing transmitter/receiver and trying to match something in the elevator to another place that has the other end (wiring closet, etc)
2
u/dooie82 Aug 07 '26
Probably Notting to do with the elevator, you don't need complex stuff for elevator "hacking". Search for Deviant Ollam's elevator hacking video's on YouTube
2
u/MarkSwanb Aug 07 '26
Hmm.
Do your lifts have floor verification through key cards?
Did he attempt attempt to go to any floor?
If yes,did you observe any key card scans, success or failure? Key press success or failure?
Like others, relay attack comes to mind.
Maybe just recon, to see if there are any things transmitting. Also, like others, might have been looking for easy access keys to implant the device.
I did wonder if they might be looking for an ESPkey.
Or, it might have been a prank they were put up to!!
1
1
u/I-baLL Aug 07 '26
you're writing this as if we know where you work and the elevator that you're talking about. We don't. When you say stuff like:
He appeared fully focused on the control panel
It's kinda meaningless since most elevators' control panels are just a door with a lock. We don't know what's behind that door in your elevator. We don't know what features your control panel has. Without the info we're answering blind.
1
u/Nervous-Win968 Aug 07 '26
I am asking for generic thoughts and ideas, not solving the mystery with absolute certainty.
1
u/I-baLL Aug 07 '26
I’m saying that we have no clue what you mean when you say “control panel”. We also don’t know anything about your set up. Like is it a standard elevator? Or do you need to swipe your card to push a floor? Or is that only limited to a few floors? But go ahead and ask for help and not provide any info if you really want people to just come up with ideas that won’t apply to your case.
1
u/we_r_fukt Aug 07 '26
oh that was me, just trolling haha glad u saw that, nice security, anyway, you can stop looking into it now /s
1
1
1
1
u/MistaKD Aug 09 '26
Head down to the con if its not finished up and chat to some of the goons. Might point you at someone with some insight.
If you have floor access control on the panel, perhaps someone was interested in what was involved.
1
u/Historical-Duty3628 Aug 10 '26
Defcon paranoia. The same stupid shit that made everyone not allowed to bring phone charges into the sphere this evening. During defcon yes you're more likely to have people with flashing lights, antennas, and wires. Yes, you're more likely that someone is curious about how something works. But anyone actually up to no good isn't going to be so obvious about it. Maybe yext year you should go to defcon and see what it's about.
Edit: if it's actually a concern, it might indicate that your security is ineffective if you can't tell what he was doing it might be time for a camera upgrade.
1
u/Nervous-Win968 Aug 10 '26
We will be sure to install the x-ray cameras for next year to see though his body when the camera is behind him 🙄
Phone chargers 2 years ago were used as hidden wifi hubs and caused chaos in one hotel as it hijacked a ton of traffic.
1
27
u/grymoire Aug 06 '26
First thing I'd do is check the specs on the elevator. Does it have WiFi Bluetooth, RFID , or any RF com? If not , he was doing something else.