WillC - Phreaking Elevators
Explores proprietary elevator controller protocols to unlock hidden floors, disable safety interlocks, and audit building security.
Summary
Elevator System Hacking
WillC presents research into elevator control systems, exposing the security assumptions (or lack thereof) in building vertical transportation infrastructure used by millions daily.
Elevator Architecture
Modern elevators use proprietary serial protocols between the main controller, door controllers, and car operating panel. WillC reverse engineers these protocols from traffic analysis and physical inspection of controller PCBs.
Hidden Floor Access
Elevator service modes, activated through undocumented key sequences or injected serial commands, unlock floors not shown on the standard panel — fire service, machine room, and penthouse floors gated only by physical key switches with easily defeated logic.
Safety Interlocks and Remote Control
The talk demonstrates injecting commands to disable door-open safety circuits and send the car to arbitrary floors, and discusses the implications for building security, emergency evacuation, and physical penetration testing.
Related talks
Main Stage·17 min
Xavier Zhang
Flaws and mutual authentication bypasses in commercial physical access control readers, controllers, and communication protocols.
Main Stage·20 min
Miana E. Windall · Micsen
Miana Windall and Micsen investigate offline RFID access control systems, demonstrating how to forge cryptographic card data to create universal digital skeleton keys.
Main Stage·43 min
Sam Quinn · Steve Povolny
Sam Quinn and Steve Povolny analyze building access control hardware, uncovering vulnerabilities in Mercury controllers that allow remote physical door unlocking.