Welcome to the second part of our blog series, "From Trash to Treachery: How Intruders Turn Everyday Items into Physical Breaching Tools." In this series, we explore how everyday objects can be used by intruders to bypass physical security measures and gain unauthorized access to sensitive areas. Last time, we discussed bypassing REX censors, which you can read about here. This time, we'll explore how to create a tool on the fly.
The most versatile tool in a physical pentester's arsenal is the traveler's hook, a simple piece of hardware consisting of a plastic handle and a short metal hook. It's used to slip latches when the door swings outward, providing easy access to secure areas. But what if this tool is unavailable or breaks? In this article, we'll show you how to create a functional replacement using a wire hanger and a simple letherman or pliers.
To begin, we'll need to cut a wire hanger to the desired length. The hook pictured above measures 4 inches long with a ½ inch hook. We suggest cutting a length of 14 inches, which can be trimmed down if necessary. Next, we'll fashion a handle by crimping the wire 2 inches from the end and wrapping it around itself. To add leverage, we'll create a right angle in the handle. Finally, we'll cut the tip down to approximately ½ inch. If our leatherman has a file attachment we can use it to file the tip to a point. Alternatively a rock, or concrete can do the trick as well. This point will help grab onto the latch. The result is a functional and versatile tool that can be used to bypass latches on outward swinging doors.
Not too shabby. I know what you’re asking, “does it work?” You betcha!
This video shows our target door, “secured” by a card reader to the left, opened in a few seconds with our tool. Did you spot the problem? Correct, an improperly hung door that doesn’t engage the deadlatch. To put it simply, any door that is not hung properly can be opened with this tool. We see it all the time, a door with about ½ a mile between the door and frame. When we see a door improperly hung like this, it is typically a door we can access. such improperly hung doors are typically much easier to breach. A well-installed door, on the other hand, will feature a strike plate that engages a deadlatch, effectively preventing the latch from retracting while engaged. In such cases, even if one applies pressure to the latch, they won't be able to gain access without the proper authorization.
But improper hanging isn't the only vulnerability to bypassing physical security measures. Commercial doors that use a toggle switch on the side are also easy targets for unauthorized access. Simply reach alongside the door and flip the switch to unlock it. This is a common way to lock up at night without issuing a key, but it's also a prime target for intruders.
So, how can you prevent unwanted access to your secure areas? One of the most effective ways is to ensure your doors are installed correctly. Use the appropriate strike plate from the manufacturer and make sure the door fits snugly. Avoid having excess space between the door and frame, as this can allow a bypass tool to be used to disengage the latch. If you can't avoid having space, consider installing door shrouds on the outside to obstruct access to the latches. Door shrouds are an affordable and reliable solution to improve your door's security and ensure it meets code.
In conclusion, creating a functional traveler's hook replacement is a simple and effective way to bypass physical security measures. But it's also important to ensure that your doors are properly installed to prevent unwanted access. By taking these steps, you can protect your sensitive areas from intruders and safeguard your organization's assets.
