Life Safety (Friend or Enemy?)

From the mind of Gabriel Shear

Tuesday, October 27, 2015

 

 

 

 

——————————————————————–

do not block nursing home fire exit

Life Safety, Friend or Enemy?

 

The Good

Every day we go on about our way, moving in and out of buildings that serve a multitude of purposes. Very few ever take the time to look at these buildings. How they’re constructed, what they have in them, what they have in common (what they don’t).

Looking around though you will begin notice certain things that exist in almost every modern building. Things like fire sprinklers and exit signs above doors, emergency lighting, fire alarm pull stations and much more. The reason they have these things is due to the fact that almost every modern country on earth has some sort of life safety code.

These codes are created to make sure that buildings don’t become death traps for the people who use them. Things like fires are usually the first thing to come to mind. Now prior to modern life safety codes, a fire within a building could (and did in a lot of cases) mean the death of people trapped inside. Now with sprinkler systems and fire extinguishers within reasonable distances along with lighted exits, a fire in a building is usually not long-lasting and people can find their way out safely.

You might be asking then how can something that save lives and protect people and property possibly anything but good?

Well to begin, central to life safety is the idea of free egress. This basically means that you can’t keep people from leaving the building under any circumstances. Very few places are exempt from this rule, mainly prisons and jails (for obvious reasons).

Making sure people have the ability to freely exit a building under any circumstance means a few different things. First, all the doors must open outward. This feature along with the use of panic door hardware also know as “crash bars” makes sure that in a panic people won’t be crushed against doors that they couldn’t open as others behind them blindly pushed forward trying to escape. This feature has to work even when there is no electrical power. So these systems are mechanical.

In places that use automatic sliding glass doors this becomes a problem when there is no power. Most people don’t know that the sliding doors will actually pop open if pushed from the inside. Once again this is so people aren’t crushed against them during a panicked rush for the exits.

The second reason is life safety also overrides building security.  Even if a door is locked from the outside it must open from the inside regardless of who is opening it.  Keyed locks must freely open from the inside to go out towards the exit(s) of the building. In electronic security, use of electronic locks must not prohibit free egress. This means magnetic locks must open when the fire alarm is triggered as well as provide free egress during normal use. Usually code require a minimum of two ways to unlock the door. Normally a passive infra-red motion detector is used to accomplish normal egress unlocking,  along with a backup exit button that physically breaks power to magnetic lock in case of failure of the motion detector.

 

The Bad

You might be beginning to see how this idea of life safety might be used by someone to get into an area that normally would be secured. By manipulating mechanisms normally designed to protect people. Entry into secured areas is possible.  Magnetic locks are very susceptible to these kinds of attacks because at their core they require power to remain secured and are easily unlocked by removing that power. Another common attack vector is the request to exit sensor. This device’s  purpose, is to notify the access control system that a person is exiting the door from the non secured side and to ignore any alarm set off by the door opening without a valid credential. Sometimes they are set to unlock the lock if triggered. The majority of these sensors are passive infrared motion detectors and can easily be fooled by objects waved in front of it through gaps around the door. Particularly the gap at the bottom of the door.

Magnetic-Door-LockRequest-To-Exit-PIR-Sensors

If a person(s) wasn’t particularly concerned with being seen. Such as a heist during business hours. Then setting off the fire alarm system. Either through a fire alarm pull-station or by causing water flow through the sprinkler system. Is an effective way to bypass many alarms and other locked access points. This would be most effective in large buildings with many people. Such as hospitals or large corporate high rises and condo units. Places like these have to be concerned with moving large numbers of people out of the building quickly,so many systems are set up to do just that.

 

There are many more ways in which life safety systems could be used to access secured areas. I will be covering those listed above and more in greater detail in future posts. As well as methods to counter some of the issues shown. For now take a look around next time you enter a building, and think about ways that life safety might be compromising your security.

 

 

 

 

 

 

 

How To Bypass Sliding Gate Security

From the mind of Gabriel Shear

Saturday October 24, 2015

———————————————-

 

 

How To Bypass  Sliding  Gate Security

 

 

This information is provided for educational purposes only. The author nor the website are responsible for misuse of information provided below.

 

I’m going to outline a pretty simple and effective method for bypassing the security code/card locks on about 90% of all sliding security gates.

This method relies on understanding how sliding gates works and how to use this knowledge to your benefit, if ever the need may arise.

 

A sliding gate typically consists of a few different parts:

  • Gate
  • Gate drive
  • Motor
  • Motor controller
  • Limit sensors
  • Safety sensors
  • vehicle sensors
  • Entry keypad or proximity card reader

Most gates you will see are typically chain driven and use a large roller chain and sprocket to transmit the motors rotational force into a linear one to move the gate back and forth. The other style is the direct drive. Usually only seen on high security gates, it consists of a large flat bar attached to the gate which itself is pinched between two rubber drive rollers that spin and move the bar forwards and back, opening and closing the gate.

Here are the styles:

Chain Drive Gate

Low Security Chain Drive Gate

High Security Gate

High Security Direct Drive Gate

 

Beyond the gate and motor itself, the system needs a way to control:

  • When the gate should open and close
  • How far it needs to open and close
  • When to stop (so as not to crush anyone or thing)

To achieve the above needs, a motor controller is used with an array of sensors that help it to determine when to turn on the motor and in what direction.

Typical sensors include:

Limit switches – They tell the controller when the gate has reached its fully open or closed position.

Safety sensors – Such as crush strips on the edge of the gate, so that if it hits a car or person it can stop the motor to prevent injury or damage.

Vehicle sensors – Inductive loops placed in the ground can tell the system when a vehicle is on either side of the gate or even in the gates path.

Access control – Entrance keypads or proximity card readers. Either integrated in to the controller or part of a larger building system. They allow authorized opening of the gate.

All these sensors work in conjunction with the motor controller to determine the state of the system and along with some programming what it should do an any give scenario. It is the vehicle sensors that we are going to be attacking in order to open the gate.

While a user is required to provide some sort of security credential to the system in order to operate the gate. On about 90 percent of gates  a vehicle that is leaving is usually sensed by a vehicle detection loop and the gate is automatically opened so the vehicle may leave.Vehicle Loop

This vehicle detection loop consists of a  loop of wire embedded in the ground in the path of vehicle. I works through the principle of electromagnetic induction. An explanation of how this works is that an alternating electrical current is passed through the loop. At a given frequency the loop will have a specific inductance. This inductance resists the flow of electrical current and is compared against a known value in the controller. When a metal object such as a vehicle drives over the loop. The metal acts like the metal core of a transformer and increases eddy currents do to the inductance of the loop. The increases in eddy currents are then seen by the controller and used to tell the system to open the gate.

The thing is that anything that increases the inductance of the loop will fool the system into believing a vehicle is there. any metal will increase the inductance and fool the system.

The way to bypass the security of the gate would be to slide or throw a large piece of metal over the loop. They are easy to spot as they are usually visible as cuts in the concrete/black top (as shown above). The corners of the loop are more sensitive than the center or edges. Most gates have a rather large gap underneath to slide something like a tire iron or piece of sheet metal or a length of chain. Hell one could even break the pedestal holding the keypad and use that if one was desperate enough. In either case, if the metal piece is large enough it will trigger the gate to open and the gate security has just been bypassed.

Not all gates open using vehicle detection loops, but most do and like I’ve said this should work on about 90% of gates you might encounter. I hope this information is informative and enlightening.

 

-Gabriel Shear

 

 

 

Not So “Secure” Screws

From The Mind of Gabriel Shear

Thursday, April 24 2014

 

Not So Secure Screws

 

tamperproof

I’ve been working in the security industry for many years.

I have clients that to this day; still require, or call out for in specifications. The use of tamper-proof hardware on any equipment that’s publicly accessible.

I have, and will continue to argue. That this practice is at best a waste of resources, and at its worst gives a false sense of security.

What Is Tamper-Proof Hardware?

In the world of physical security, It’s common to use what is referred to as “tamper-proof” hardware. Normally these are used on locks, and other equipment as a deterrent to theft, vandalism, and/or tampering. There are a few different designs used to meet this aim. (torx, star, spanner, etc) Most designs are of common hardware with a modification so that a normal tool would not work with, or fit in to the tamper proof hardware. There are also designs that prevent the use of common objects, or makeshift tools from being used. (common in prisons).

The main premise of using such a design. Is that the availability of the special tools required to remove the hardware would be limited, so that only authorized users would have access to them.

In reality, this may have been the case many years ago, but that is not the case today. A quick search of the internet. Will provide you with plenty of online stores to purchase the required tools, and they can easily be purchased at a local electrical distributor. Recently I was not surprised to see that they are now, even being sold at Home Depot.

 

security driver

With these tools so widely available. The original purpose of tamper proof hardware is all but destroyed, and now does nothing, but present a false sense of security. Their only affects now, are possibly to slow down an attacker, or there use in correctional facilities. were access to tools would be non-existent.

Next time your out an about. Look to see if you can find any of these, and then think about how easy you could bypass these with a quick trip to the hardware store.

– Gabriel Shear