DEF CON 22 - Deviant Ollam & Howard Payne - Elevator Hacking - From the Pit to the Penthouse

DEFCONConference5 HN recommenders · 2016–2026
877K views · talk · evergreen · Uploaded 2015-01-07

Deviant Ollam and Howard Payne give an in-depth DEF CON 22 explanation of how elevators work, from the pit to the penthouse. It covers their control modes and how pen testers use elevators to bypass building security.

HN brings it up in any thread about elevators or physical security as a fascinating, entertaining deep dive.

Watch on YouTube

9 comments from Hacker News

@DyslexicAtheist2016 · in “Reverse Engineering a Mysterious UDP Stream in My Hotel”

yeah and deliver some badass mixes of The girl from Ipanema. :-) Though I wonder if he had time to look at the packets long or careful enough. Would have been interesting to inspect all these devices closer too. Were there also other sessions established maybe that could hint at controlling them? E.g. such as volume of the sound? I doubt that the actual elevator would be controlled could be controlled remotely: [VIDEO]

@lathiat2017 · in “Evan Doorbell's Classic Phreaking Tapes”

I realise the thread is phone phreaking related and that was kind of the point of your post; but in the spirit of the talk below to think more outside the box... There's a pretty good chance in many cases you can just open the external box with some easy to get (and relatively standard) key. And hit a button. Related: [LINK] This is a good related talk - goes outside the box on all the ways you can often get into commercial buildings without picking (or even in many cases, interacting with) the lock "The Search for the Perfect Door" by Deviant Ollam [LINK] Also good: [LINK] [Howard Payne & Deviant Ollam - This Key is Your Key, This Key is My Key] [VIDEO] [DEF CON 22 - Deviant Ollam & Howard Payne - Elevator Hacking - From the Pit to the Penthouse]

RecommendsView on HN
@lathiat2018 · in “Ask HN: Best talks of 2018?”

Deviant Ollam - The Hotel Room Gourmet [LINK] Also not 2018 but his elevator with Howard Payne talk: [VIDEO] (1h version) [LINK] (2h version) And the search for the perfect door: [LINK]

RecommendsView on HN
@lozf2021 · in “List of Special Elevator Modes”

Deviant Ollam & Howard Payne did a great talk on Elevator Hacking at Def Con 22. You can catch it at: [LINK] or [VIDEO] [01:00:15]

RecommendsView on HN
@Twisol2021 · in “Saintcon: Lock Picking Lawyer Keynote”

> You can break a window open or just find an unlocked door if you are looking to do some bad shit. > A higher security lock on your home isn’t going to make your flimsy door harder to kick down, or your window harder to break From the keynote, that's why LPL puts a heavy focus on bike locks, gun safe locks, etc. The audiences for those locks have a more vested interest in physical security than mere "social conventions". A well-locked bike makes it more difficult for a thief to get all the / enough value from the target. A well-locked gun safe prevents accidents and saves lives. Also, I live in an apartment on an upper floor. No accessible windows. The only viable way into my residence is through the front door. (There are like two RFID-gated doors before mine, but tailgating renders them pretty ineffectual, and let's not talk about elevator security. [0]) It's not worth it for me to put a better lock on my door, but I'm also not kidding myself about its effectiveness. [0] [VIDEO]

@alexpotato2023 · in “The Door Close Button”

If you liked the original post, you will probably LOVE this DEFCON talk about elevator hacking: [VIDEO] It also gives a lot of fascinating information about elevators in general and specific operation modes. e.g. there is a "riot mode" where the elevator goes to every floor except the first (or ground in EU) floor aka to the lobby. The idea was that, during a riot, a luxury building in NYC would lock the stairwell access from the lobby but people could still take the elevator to the other floors to visit their neighbors etc

Strongly recommendsView on HN
@jedimastert2025 · in “Malicious compliance by booking an available meeting room”

> funny DefCon video on elevator hacking For those wondering, is Deviant Ollam's talk on elevators. [VIDEO]

@simlevesque2026 · in “Let's Get Physical”

I love pentesting stories. Great blog post, I was smiling while reading most of it. It reminded me of Deviant Ollam's stories such has his elevator security talk w/ Howard Payne: [VIDEO]

RecommendsView on HN
@cruffle_duffle2026 · in “Elevators”

If you like elevator hacking don’t forget the seminal DEF CON talk by Deviant Ollam and Howard Payne: [VIDEO] I watch it like once a year because it always tickles some part of me. Like all the different modes you can get an elevator into. The most fancy one people might encounter is when moving into or out of a building. The front office can give you a key to give exclusive control over an elevator so your movers aren’t waiting around on elevators. Put it in that mode and it will stop responding to calls from other floors. Only the person with the key can control the elevator. You get on, select the floor, door closes elevator goes, and then just chills there with the door open waiting for you. Annoying for the rest if the building (the building is down an elevator when in that mode) but is amazing for the person using it! But there are way, way more depending on the installation and function. Fun fact: most elevator shafts are sealed at the top as tight as possible to prevent them from becoming a giant chimney in a fire. It never even occurred to me until I was in a mechanical room wondering “where is the hatch to look down the shaft?” The answer is “there is none, and it’s a feature not a bug.” You want to block all airflow so fire doesn’t chase up the shaft into neighboring floors. Who knew!

Strongly recommendsView on HN