Hacking for Locksmiths - Part I

[EventualFate]

Please understand that the following is intended for educational use only.


Electric Strike Vulnerablilities

It's amazing how many electric strikes are left exposed. Many times you will come across an electric strike that does not have an astragal or latch protector (link) guarding the latch from tampering. In this case, a jackknife or small slotted screwdriver (often given out for free as a promotional tool amongst locksmiths or commonly found in watch repair screwdriver kits, which are entirely useful anyways!) will be sufficient to pry the latch and deadlatch out from behind the strike.

Keep in mind that most buildings recently constructed, will have door contacts to monitor the security. But not all premises with card access have an alarm system, or at least a monitored one. Some alarms may setup for shunting via the card access system (bypassing a strike will not shunt an alarm).

The first thing you should do before drilling (that's noise) is to try opening the ceiling tile closest to the door, this is why it's important to keep a small foldable step ladder with you at all times. You would be very surprised to discover that many times, the power supply for the strike/even the card access controller (watch for tamper switches) is on the insecure side of the door in the ceiling. Sometimes you can crawl into the ceiling and bypass doors altogether. I'm tall, so it's easier for me. Drop tile ceilings usually hide walls that don't continue upwards to the next floor. If you can access the wires going down into the wall, in the ceiling or not, (keep a drywall saw handy, above the ceiling line, nobody would know if that hole was there already or not.) it will be much quieter than breaking out your DeWalt.

In the case of a fail-safe electric strike, (if power fails, strike unlocks) you must drill a hole in the door jamb or mullion, large enough to cut the wires. As soon as the power is cut, the strike will be compromised. These situations are less common, but are found sometimes in college/school buildings due to fire code regulations.

In the case of a fail-secure electric strike (if power fails, strike remains locked), you must drill a hole in the door jamb or mullion, large enough to cut the wires. Then you can apply your external power supply's power to energize the strike and give you access.

In the case of an AC powered strike (you should be able to tell from the loud buzzing sound) the instructions are the same, except you do not need to match the red and black wires as polarity is not an issue.


Common Exploitable Vulnerability in Automatic Doors

If you come across a double-set of automatic sliding or swing doors without a mullion (center jamb) many times all you have to do to get in is wave a folded piece of paper into the slot at the top between the doors, you'll find that most of the time, installers will center the T-REX/PIR Sensor in the middle of the automatic door header. Since you can always get out from inside, as an inherent egress safety feature, you've created a request to exit, from the outside! How embarrassing that you are in. Idiot!