AI
Latch and Carding Bypass
Matt demonstrated carding with any flat material. A credit card swiped down can open a latch door in 1.5 seconds. Dead latches prevent this by blocking the latch. If the dead latch is not actuated due to improper installation, a traveler’s hook or bent wire deactuates it. Pulling brings the latch toward you while opening the door. Shoving pushes the tool between door and strike plate. Proper installation with a flush strike plate and actuated dead latch is the fix.
Handle Bypass
Karen showed an under-door bypass tool for lever handles. Inserted under the door, it stands up, swings onto the handle, then a string pulls the lever down. For doorknobs, a wire tool with tape and string loops around the knob and rotates it. These methods mimic a person exiting from the secure side. Fire codes have phased out doorknobs, but they still appear in older buildings. The best remediation is eliminating door windows that let bypassers see where to aim the tool.
Crash Bar Bypass
Crash bars are common in retail and office spaces. A wire tool with a hook end is inserted at the side or bottom of the door. The hook latches onto the bar, and pulling the string depresses the bar from the inside. The tool bends to open the door. A coat hanger and shoelace work. Push bars require a stiff metal double-door tool inserted in the door gap. String can also be looped around push bars on gates. Remediation: tight door fit, bevel thresholds, and brush seals that restrict wire movement.
Deadbolt Bypass
Deadbolts with a thumb turn on the inside can be bypassed with a J-tool. The tool is inserted between the door and frame, its clawed end grabs the thumb turn, and turning the bottom rotates the deadbolt. Requires a few millimeters of gap. The best remediation is a double-sided deadbolt that requires a key from both sides. This eliminates the thumb turn but reduces convenience. Fire marshals may restrict double-sided deadbolts, so balance security and egress.
Padlock and Combination Lock Bypass
Padlock shims cut from soda cans deactivate the pins inside standard padlocks. Insert and rotate to lift the shackle. Manufacturers now add ball bearing designs to prevent shimming. Simplex combination locks have a factory default code: two and four pressed at the same time, then three. Roughly 30% of installations never change it. Users can set any code. Key boxes with RFID fobs inside can be cloned without unlocking the box using a Proxmark or Flipper Zero.
Electronic and Sensor Bypass
Entrophones often use default master codes available online. Many models share a branded master key. Open the panel with that key, find the access relay port, and jump the circuit with any conductive material to buzz yourself in. Wheelchair buttons on the unsecure side sometimes open the door when they should not. REXX sensors using passive infrared can be tricked with canned air sprayed upside down to create a temperature differential. Dual-technology sensors that add radar are more secure but cost thousands per unit.
Q&A
What about double-sided deadbolts? Lockpicking or find an alternate entry. ▶ 52:26
Does the double door tool work on exit paddles? Yes, with modification. ▶ 53:02
Have you heard of using a handheld magnetic de-energizer on solenoids? Yes, it is a clever bypass. ▶ 54:00
How do you conceal the tools? Coil wire in a flat envelope inside a briefcase. ▶ 55:07
How does the string hook work on push bars? The hook, not the string, grabs the bar. ▶ 56:14
Notable Quotes
if someone can stick their hand through the mail slot and let themselves in Karen Ng · ▶ 1:15
if someone can take it home and spend as much time as they need getting into it Karen Ng · ▶ 2:03
It’s two and four pressed at the same time and then three. Karen Ng · ▶ 29:52
you can stick a screwdriver into that hole and just pull the mechanism and it’ll unlock the door as if you turned the key Karen Ng · ▶ 46:38
Key Takeaways
- Most physical security weaknesses are installation errors, not lock quality.
- Wire tools made from coat hangers bypass handles, crash bars, and push bars.
- Default codes on simplex and entrophone systems remain unchanged in 30% of cases.
- Dual-technology REXX sensors add radar to defeat canned air trick.
About the Speaker(s)
Karen Ng is a Risk Analyst at GGR Security and one of GGR’s entry team for physical penetration tests. She has a strong interest in physical security, delivering trainings on physical security vulnerabilities to a wide range of audiences. Karen comes from a background in engineering and has extensive experience in major event logistics. She is one of the Village Leads at the Physical Security Village and works with the rest of the PSV team to teach how to recognize and fix security exploits to the community. Graphic design is her passion.