Conversation with Deviant Ollam and Howard Payne: Elevator Hacking

Architecture and Background

Elevator systems in commercial high-rises and residential complexes serve as critical access control conduits, separating public lobbies from restricted executive floors and sensitive operational facilities. Physical security mechanisms in elevators rely on physical keys, fireman override modes, and service panel interfaces.

Vulnerability Analysis

Elevator controllers frequently utilize standardized, widely available keyways across entire municipalities and regions (e.g., universal firefighter service keys). In addition, maintenance modes and recall circuits rarely feature tampering detection or cryptographic authentication.

Exploitation and Demonstrations

Deviant Ollam and Howard Payne share insights from their groundbreaking DEF CON 22 presentation on elevator exploitation. They discuss standard key acquisition, social engineering methods using technician apparel, manual brake and cab overrides, and bypassing electronic floor locks.

Remediation and Defensive Strategies

Building operators and security managers must audit elevator keyway cylinders, restrict physical access to mechanical equipment rooms, integrate elevator destination dispatch systems with building access control matrices, and challenge unescorted third-party contractors.