Tweet
When doing a physical penetration test the attacking team has some special options when testing larger corporations with elevators. Some times all elevators will take you to any floor with no restrictions but some times some floors have restricted access to selected floors. This could be floors dedicated to staff or floors for VIP customers in places such as hotels. These floors are potential targets for an attacker and the evaluated corporation should be aware of the risks involved in only using elevator restrictions as an access control to such floors.
In case of a fire it is vital that the local fire department has full access to any floor they need. They also need to control who is using the elevators as they can be dangerous to use if the building is on fire. This is done by putting all elevators in fire service mode and this action will require a special fire service key. In an emergency it is very important for fire fighters to have a working key at hand meaning each brand of elevators will have one or very few keys working for most or all elevators they produce. There is a security risk in having this kind of key reuse but it seems there is no other way than to accept the risk as human life is more important than a trespass. You will likely need a license or similar to buy most of these keys and the bad guys will buy them off the black marked or cut the keys themselves. As with anything else that require a license to obtain or carry, the attacker does not care so it is important to include this in a physical penetration test. Independent service mode can be utilized to gain access to restricted floors also. Different elevators have different features such as a function that will disable a cardreader while a call is placed and a wealth of other features.
If a private person or staff accidentally goes to a floor that is on fire, the elevator door will open fully and stay open for some time which can be dangerous and even potentially lethal. In fire service mode, this will not happen as the elevator door will stay closed when arriving on the destination floor until the "open door" button is pressed and held down. Also, the elevator will not be usable to anyone not in possession of the key. When local fire fighters use an elevator they will first verify if it is still safe to use and call all elevators to a particular floor. The elevators can then be used in a controlled manner to evacuate people or for firefighters to go where they need to go. Likely two floors below the fire.
Some of the below keys may work and some may not. Other kinds of keys may also allow you to go to restricted floors without items such as an access card or similar.
This is an incomplete list of such fire service keys
In case of a fire it is vital that the local fire department has full access to any floor they need. They also need to control who is using the elevators as they can be dangerous to use if the building is on fire. This is done by putting all elevators in fire service mode and this action will require a special fire service key. In an emergency it is very important for fire fighters to have a working key at hand meaning each brand of elevators will have one or very few keys working for most or all elevators they produce. There is a security risk in having this kind of key reuse but it seems there is no other way than to accept the risk as human life is more important than a trespass. You will likely need a license or similar to buy most of these keys and the bad guys will buy them off the black marked or cut the keys themselves. As with anything else that require a license to obtain or carry, the attacker does not care so it is important to include this in a physical penetration test. Independent service mode can be utilized to gain access to restricted floors also. Different elevators have different features such as a function that will disable a cardreader while a call is placed and a wealth of other features.
If a private person or staff accidentally goes to a floor that is on fire, the elevator door will open fully and stay open for some time which can be dangerous and even potentially lethal. In fire service mode, this will not happen as the elevator door will stay closed when arriving on the destination floor until the "open door" button is pressed and held down. Also, the elevator will not be usable to anyone not in possession of the key. When local fire fighters use an elevator they will first verify if it is still safe to use and call all elevators to a particular floor. The elevators can then be used in a controlled manner to evacuate people or for firefighters to go where they need to go. Likely two floors below the fire.
Some of the below keys may work and some may not. Other kinds of keys may also allow you to go to restricted floors without items such as an access card or similar.
This is an incomplete list of such fire service keys
- Statewide fire service keys
- GEM 10404 - Minnesota
- YALE 3502 - Massachusetts, New Hampshire and New Jersey
- YALE 255 - City of White Plains, NY
- AZFS - Arizona
- BFD01 - Connecticut
- SC1000 - South Carolina
- WD01 - Rhode Island
- FEO-K1 - All elevators installed since 2007 code except some states
- C.J. Anderson fire service keys
- M702
- 27379
- Epco fire service keys
- EPCO MFD1
- Kone fire service keys
- KONE3
- Monitor/Janus fire service keys
- J202
- Montgomery fire service keys
- A03
- Montgomery/Kone fire service keys
- MK05
- Haughton fire service keys
- CLC332
- Otis fire service keys
- UTF
- Otis Lexan and earlier fire service keys
- Yale SA
- Schindler fire service keys
- AS100 (Single-cut)
- H341 (Double-cut)
- Thyssen/Krupp fire service keys
- L204
- Dover fire service keys
- H2389
- H2252
- Dover Microswitch fire service keys
- H5027
- Innovation fire service keys
- EX515
- GAL fire service keys
- G1617P(X)
- GAL Medeco fire service keys (R63C)
- FS
- U.S. Elevator fire service keys
- USE1
- Adams fire service keys
- WDO1
- PTL fire service keys
- PTFS
- Elevator Research and Manufacturing, ERM fire service keys
- HW1002