AI
Elevator Fundamentals and Terminology
The floaty box you stand in is the elevator car. It is suspended by cables (traction) or pushed from below by a hydraulic piston. A counterweight balances the car for traction elevators. Hall buttons in the hallway register a hall call (up or down). Car buttons inside the car register a car call. Homing moves the elevator to a programmed floor when idle – a lobby at check‑in time, for example. If the elevator homes to a restricted floor, pressing door open may let you out without a credential.
Special Modes of Operation
Independent service takes the elevator out of the bank. It answers only the person inside. Floor lockouts are ignored – the key itself is treated as authorization. Attendant service mode gives VIPs priority without a credential. Inspection mode gives a technician maximum control from inside the hoistway. Fire emergency operation (phase 1) automatically sends the car to the designated landing when a smoke detector activates. Phase 2 allows firefighters with a key to drive anywhere – the code requires the elevator to ignore all security programming.
Bypassing Key Switches
Key switches are just two wires. Short them and the controller thinks the key was turned. A screwdriver on a wafer lock works. For a medical cam lock, picking is impractical; shorting the wires bypasses it entirely. Remove the panel, unscrew the contact, or bridge the terminals. Old relay‑logic panels may carry 120 volts – use insulated tools. Tried holding a button down while the controller tries to un‑light it? Worked twice for Bobby, no idea why.
Hoistway Access and Dangers
Hoistway doors have an escutcheon hole at the top. Keys exist for professionals – not covered here. Opening the hoistway without training can kill. Inside, the car‑top control box gives movement control. Guide rails keep the car straight but can pull in clothing or fingers. Hydraulic elevators are capped at five floors; traction elevators use cables. The car‑top controller has barely changed – power, light, up/down switches. Deaths from hoistway entry happen every year.
Case Studies: Practical Elevator Hacking
Parking garage lockout: ride the elevator without badging and wait for homing to the lobby, or stay in the cab until someone calls it from a higher floor. Hall call lockout: an RFID reader on the panel is often bypassed by a common key switch nearby. Social engineering: fake a phone call – “I’m late, forgot my fob” – so the person already in the cab presses their floor without suspicion. Or drag in a heavy box and ask them to push a floor. Concierges can be fooled into granting access.
Notable Quotes
elevators are incredibly safe when you operate them the way they were designed to be operated. But when you start to mess with them, they might do things that in their heart they are trying to do to protect you, but end up hurting you really, really, really horribly. Ege Feyzioglu · ▶ 1:56
inside the code it says that when the elevator is in emergency fire operation mode, it has to ignore any sort of authentication, any sort of security programming, anything like that. Ege Feyzioglu · ▶ 15:58
it’s literally just three terminals. Ege Feyzioglu · ▶ 19:23
do not go into the hoist way unless you know what you’re doing. Bobby Graydon · ▶ 35:34
Key Takeaways
- Elevators are an overlooked vertical attack surface in physical security assessments.
- Independent service and fire modes bypass floor lockouts, often by design.
- Key switches can be shorted with a screwdriver, no picking required.
- Hoistway access is deadly without proper training and equipment.
- Social engineering tricks like a fake phone call easily defeat elevator access controls.
About the Speaker(s)
Bobby Graydon is involved in the planning of Physical Security Village. He enjoys anything mechanical and is currently serving as VP R&D at GGR Security Consultants. He likes trains and milk.
Ege Feyzioglu is a security researcher specialising in access control systems and electronics. She is currently pursuing a degree in Electrical Engineering and works part-time for GGR Security as a Security Risk Assessor.