How to Break Into Medium-Security Installations

A Phile for the Aspiring Security Consultant

Date: Oct. 14, 1992
Revised: Sep. 15, 1993

Author: Terminal Technician 414   (TECH@902:414.00)
Co-Author: Doctor Chaos 414       (CHAOS@902:414.00)

Information From: C&M Security Systems staff (Thanx guys!)
               -( They're outta business now )-
	       And of course personal experience.

Overview

    For the purposes of this file, we'll consider any installations employing cipher or card locks and/or alarm systems to be "medium security."  This covers nearly all department stores, some houses, warehouses, telephone company installations, and some government installations.  Low-security installations are easy enough to break into, the most you'll need is a decent knowledge of lockpicking.  High-security installations (military bases, prisons, arsenals, etc) are covered in another phile.  This one will get you into most of the places you'll want to get into.

Part I: Exterior Perimeter Security

    Many medium-security installations employ external perimeter security devices.  These include the following:

We'll cover these in that order.  I'll try to include all the information you will need to identify and defeat each device.  Well, on to the fun stuff!

Fences

    The most common type of fence you will encounter is the cyclone or chainlink fence.  There are three ways to deal with a simple cyclone fence:

There are a few security devices that may be used in conjunction with fences.  The most common is the vibration sensor.  This consists of either a mercury switch or a steel ball on contacts.  These can be identified as a small box attached to the fence every 5 to 10 posts.  Vibration sensors may be defeated either by being careful not to disturb the fence, or by searching for a tree or other tall object that you may jump from and land on the other side of the fence.  Just make sure there's a way back out!  Another device is the wire resistance sensor.  This essentially turns the entire fence into a sensor.  This device will detect strong vibrations, such as those created by climbing, as well as the increase in resistance caused by cutting.  This type of sensor cannot be detected visually, but you can find them.  Simply get a few medium sized rocks, throw them forcefully at the fence.  If you're feeling confident, you can run up and shake the fence instead.  After you've done one or the other, hide somewhere (not too close) and watch.  If security personnel show up, you can assume some sort of sensor is in use.

Security Cameras

  There are two main types of cameras:  The constantly monitored variety, and the videotaped variety.  The videotaped variety presents no major problems, just wear a disguise (ski masks work well) so you can't be identified.  The constantly monitored type presents a problem.  If you can't just walk around its field-of-view, and really want to get in, this method of defeating them works very well:

The security personnel will see your nice taped image of nothing going on, while you are carting out their equipment right in front of the camera.  This technique works very well if properly executed, and very badly if you fuck it up.  Advice: Get it right the first time -- You probably won't get another try if you fuck it up.

Cipher Locks

    There are several types of these.  The most popular ones you will find on non-military installations are made by Simplex.  Two common types:

Also, these days you will find digital cipher locks.  They will usually have a keypad with digits 0 - 9.  Most of these use a 4-digit code, but I have see some that use up to 12 digits.  There are several ways to defeat these.  One way is to just watch an authorized person enter the code, then go enter it yourself later.  If this is not possible or practical, sometimes you can remove the unit from its mounting and find its output terminals.  You can just short out the terminals, and off you go.  If you want to get the code, you can apply a water-soluble ultraviolet ink to the keys.  Once an authorized person enters the code 2 or 3 times, you can look at the keys with your ultraviolet light (WHAT?  You don't have one??).  You'll get the digits but not the sequence.  Not a problem with cheap 4-digit ones, but getting 8, 10, or even 12 digits in the right order takes time, which you often will not have in abundance.

Most military installations have high-security cipher locks, with tens of thousands of combinations.  These CAN be cracked, but it's not easy.  That's another phile.  These high-security locks are usually made by Medeco or Halcroft (I think that's the name...).

Card Readers

    The card reader is one of the more secure devices available for exterior perimeter protection.  There are two varieties, optical and magnetic.  The optical type works by detecting a pattern of punched holes in a card, or reflective marks on the card's surface.  Magnetic readers detect magnetized domains in a strip of magnetic tape similar to audio tape.  Both of these CAN be fooled if you have patience.  The magnetic ones can sometimes be defrauded by running an ATM or credit card through it, jiggling the card, moving it through very rapidly, or pulling it out half way through reading it.  The optical ones can often be fooled by using an opaque card punched with holes.  The best hole spacing is around 1/64 inch.  Slide this contraption through the reader at varying speeds, and jiggle it, and maybe you'll get in.  Another method that works is to remove the reader from its mounting, and find the output terminals that indicate a successful read.  Just short those terminals, and you're in.

Part II: Interior Perimeter Security

    There are several type of interior perimeter security devices.  The ones you'll encounter in everyday illegal entry are:

Well, that list doesn't do you much good, so here's a discussion of each device:

Glass Breakage Detectors

    These simple devices consist of a mercury switch in a box.  All they do is detect major accelerations in any direction.  The idea is, when you break the window, the sensor will fall down and set off the alarm.  These can be identified as a small circular or rectangular device attached to the glass of a window.  The best way to defeat them is to find another way of entry, or if you can find a big window, cut a hole in it with a glass cutter, avoiding the sensor of course, and crawl through the hole.  You can also cut a hand-hole in door glass to reach the inside lock knob.


Magnetic Reed Switches

    These sensors have two parts, a switch that mounts on the door frame, and a magnet that mounts on the door.  The switch stays closed as long as the magnet is present, and when the magnet is taken away it opens the circuit and triggers the alarm.  Magnetic reed switches can sometimes be identified as a pair of small rectangular boxes near a corner of the protected door.  Some switches are built into the doorframe, and can only be seen when the door is open.  It's best to look for them during a time when the door can be opend legally, then come back later armed with your knowledge of the position of the switches.  They can be defeated by placing a strong magnet against the door, then opening it enough to reach in and place an alligator clip lead across the terminals of the switch, bypassing it.

Infrared Beams

    This type of sensor sends a beam of invisible infrared light across a walkway.  There are two types, retroreflective and through-beam.  Retroreflective sensors have a reflector at the far end that sends the beam back to the transmitter, which is also a receiver.  Through-beam sensors have a separate receiver unit on the other side of the protected area.  These always operate along a straight line from the sender to the receiver.  You can usually spot these during daylight hours, they are usually small cylindrical or rectangular objects on either side of a hallway, or a small room.  One end may just be a reflector, a small, usually yellow device much like a automotive marker reflector.  Once you know where the beams are, you can crawl under them, jump over them, or just avoid them.  If you have special gear, you will be able to see the infrared beams and deal with them without finding the sensors first.

Vibration Sensors

    These may be mounted on a wall, door, or window.  They are rather sensitive, and will detect any fairly strong vibration within several feet of the sensor.  These look much like a magnetic reed switch, only there is no magnet and most of them have a reset button.  The reset button must be pressed to clear the sensor once it detects vibration.  The only way to defeat these is to know where they are and avoid them.  Pressing the reset button will do no good once the alarm has been set off.  If you can get at one, say on an interior door, you can place an alligator clip lead across its terminals to disable it, do your thing, then press the reset button and remove the lead.

Pressure Sensitive Mats

    These operate on the same theory as the mats that open the doors at supermarkets.  When you step on one, it closes a circuit and triggers the alarm.  Only one way to deal with these: Avoid them.

Tripwires

    These are not used much since the advent of optical beam sensors, but you may encounter them.  The tripwire is a fine wire, usually number 40 to 45 electrical wire, streched across a walkway and tightened.  When the wire is broken, an electrical circuit is disrupted and the alarm is activated.  To detect these, your best bet is to move slowly and watch downward for the wires or suspicious holes in walls where a wire may come through.  These are very uncommon, not much to worry about, but they're covered for the sake of completeness.




Part III: Interior Area Security

    Internal area security devices are some of the more devious devices to detect unwanted presence.  These devices include:

These devices all operate by detecting characteristics of human movement or presence in the protected area.  A breakdown of each device.

Passive Infrared Motion Detectors

    These employ a heat-sensitive cell.  They detect large changes in overall radiated heat, infrared radiation, in their coverage area.  They will detect a human or a large animal in their coverage area by detecting its body heat.  They respond only to fairly rapid changes.  They can be identified as small, usually white, devices of various shapes.  If you trigger one you will usually see a small red light come on.  These are best found during hours when your presence is not overly unwanted, so that you can become familiar with their location and coverage.  These can be defeated by walking VERY slowly through their coverage area.  Also, you can use an infrared beacon to fool them.  This wonderful device produces IR radiation in the same wavelength as a normal human body, and will increase the intensity of the radiation over the course of 5 minutes or so, until the detector is "blinded" and you may move around freely.  These beacons cost several hundred dollars, but hey, if it'll keep you out of jail, it's worth it...

Other Motion Detectors

  These use ultrasound (high-frequency soundwaves) or microwaves to detect movement.  These devices make use of the Doppler effect.  They look much like passive IR sensors, and can usually be defeated in the same way.

Charged Particle Sensors

    These devices give off negative ions, and detect the concentration of negative ions in the room air.  Negative ions will attach to any object in the area, so entering the area will dramatically reduce the number of ions left in the air.  These look similar to ammonia sensors but are usually mounted high on a wall, or on the ceiling.  Again, these are not common in medium-security installations, since they cost about $12,000 a pop.  Charged particle sensors can be defeated by moving very slowly in their region of sensitivity, usually the entire room containing the sensor.

Pattern Recognition Sensors

    These consist of a video camera attached to a computer.  The computer is programmed to detect any objects that look remotely human in the camera's field-of-view.  The camera has to see an object for about 1/16th of a second before it will recognize it.  To defeat them, carry a large piece of cardboard or anything that will drastically distort the camera's view of your overall shape.  Cardboard sheets with eyeholes work very well.  These systems are also terribly expensive (on the order of $15,000 for a four-camera system) so they are only used in such places as banks and sometimes in warehouses.  I guess $15,000 is cheaper than hiring guards for warehouses.

Sound Sensors

    These are primitive devices that detect anything that's loud enough to be considered an illegal intruder.  They vary greatly in reliability, and often do not work at all.  These systems are usually impossible to spot, as they need only a tiny hole in a ceiling tile or wall for the microphone.  If you suspect that sound sensors are in use, just be quiet.  That's good advice in any situation, really.

Guards

    The single most effective security system, provided they do their job.  There are two kinds of guards, those that work for the company they are guarding, and those who work for security firms.  The company employed type are generally more dangerous, since their job is on the line, where a guard working for a security firm would just get transferred to a new station.  Most guards have fixed patterns in which they circulate about the premises, and if you study these patterns, you can find gaps where you can enter and work undetected.  Guards are far more hazardous to the illegal enterist, since they can detain you on sight, where if an alarm goes off you have some time to run like hell.  If you really want to break into a facility that has security guards patrolling, study their patterns and be VERY careful.

    That about does it for security systems, now on to some helpful hints for getting into places.  If you ever plan to use the information in this file, use common sense and a lot of caution.  Keep in mind that 9 times out of 10, the security system you have just read about will not be used alone, but in combination.  The only way you can be safe is to keep a sharp eye out for the distinguishing characteristics of ALL these systems.  If you spot any systems at all, it's very likely there are more.  Don't get over confident or ignorant, and you'll do fine.  Unless you're a complete idiot, in which case, FUCK YOU.

Part IV: Key Points of Entry

    The first step in getting into any place is finding a way in.  All structures tend to have their weak points.  Fences have gates, which are usually easier to crawl under than the rest of the fence.  When trying to gain access to a building, try to choose a door that is in the shadows or away from an area where witnesses may be.  As far as buildings go, the easiest way in is usually an overhead door.  They can often be pried with a prybar enough to get your hands in and force the door.  If an overhead door is not available, look for the weakest-looking hinged door.  Usually you will find a door with a big enough gap at the latch for you to jimmy the latch or if needed cut off the bolt with a cutoff grinder.  Be sure to check the hinge pins, some doors have them welded in, but many do not.  They can be driven out with a hammer and screwdriver.  Windows are another sometimes easy target.  If they are not locked, you can just shred the screen, if there is one, and climb in.  If they are locked, you can break a pane and remedy that situation easily enough.  Breaking the glass in a window or door should be considered one of our last resorts, since that will prompt the security staff to increase the resistance to future entry.  Some buildings will have electrically operated overhead doors.  In that case, you can either use a scanning transmitter (you can buy one that scans the 13 - 49 MHz band for about $50) if they are RF operated, or cut into the wires and short conductors until something happens.  There are many possibilities, and how you go at getting in depends how badly you want to do so.  Many large warehouses have storm sewer manholes in them, and a little trip through the sewers is never out of the question.





Part V: Tools and Supplies

    One thing that will come in handy is a large collection of keys.  I keep every key I ever find, and copy every one I have access to.  Right now, I have around 2000 of them, all arranged by size, brand, and type of lock.  With a collection that size, odds are good that one of them will get you in with a little wiggling.  A set of lockpicks is also handy but not essential, since there are always other ways in.  As for tools, your best bet is not to carry an arsenal of them with you, but to observe the site, find out what you will need, then get it.  If you are caught on a site with a large supply of tools, there will be no doubt as to what you are doing.  It's best to use cheap tools, so that if need be you can ditch them in a quick escape.  Always wear gloves or coat your hands with a substance that will block your fingerprints.  Rubber cement works well and still provides an excellent grip.  I recommend acquiring the following tools and supplies if you do not have them already:

All these supplies should run you maybe 20 bucks, depending where you buy them, and every one will come in handy sometime when you're out having phun.

Part VI: Tools and Supplies

    One thing you'll find is that you never have a tool when you need one, or you don't have time to do something right.  In that case, I offer a few suggestions on how to improvise simple tools on the spot to do what you need.  Most cars come with a lugwrench, and really nothing works better for removing padlocks the quick way.  Your car jack will come in handy some day when you need to open an overhead door.  If you come across one of those cheap little locks with the zigzag keyhole (I believe warded lock is the proper term) you can make a pick by taking a paper clip and bending the end into a small U-shape, and twisting it in the keyhole.  With practice you'll be able to open them faster than you could with the key.  I recommend practicing this tactic at home, as well as carrying a premade pick with you.  Carrying a tube of crazy glue with you is a good idea.  If you are being chased, apply it to any doorknob your pursuer will have to touch within the next few seconds, and that will stop him in his tracks.  There are many situations where you will be able to devise quick booby-traps to stop the security guy from catching you.  Tip over a pile of junk on him, set something up for him to trip over, etc, etc...

Part VII: Miscellaneous - Thoughts and Insane Ramblings

    This file has been provided because the few members of the Realm of Chaos enjoy doing these things, and enjoy helping others do them.  If you plan to use this information, I must warn you, just having this information is NOT all you need.  You need common sense, and you must be careful.  Some people tend to get overconfident after a while, which is fine until they hit something they've never seen before and find that they've rushed in too fast.  I know people who have been busted this way.  One has been in jail for two years now.  I've provided a lot of tips and techniques and explanations, but it's all worthless without some intelligence on your part.  Another helpful hint:  Work alone, or only with trusted friends.  Too many people have been busted because a "friend" ratted on them.  I know this from personal experience, and no I don't want to talk about it, thank you very much.  If you want to practice the techniques I have presented in this file, it's best to do it in relatively insecure buildings.  Once you get a feel for finding and disabling various types of security systems, you will be able to do it faster and with more accuracy, which is critical in this profession.  If you can, find someone at a security equipment supplier who will let you look at the various pieces of equipment and get an idea of what each device looks like.  It will help you immensely to be able to tell the difference between a reed switch and a vibration detector in the dark.  And finally, I really don't condone reckless vandalism, unless it's of a police department.  There's really very little point in breaking into a telco building and going wild with a baseball bat.  If you want to get yourself some equipment, go ahead.  If you just want to snoop and learn, that's fine too, but don't wreck it for the rest of us.  I think I've said enough now, I'm starting to sound like my mother.  Have fun with your new skills and don't get busted!

(And if you DO, well, you didn't learn all your tricks from me!)

                          --==>> Credits <<==--

Terminal Technician 414 - Author, contributor
Doctor Chaos 414        - Editor, contributor
Cracker Jack 414        - Provider of lots of info on passive IR sensors
Digital Death 414       - Guinea pig and general purpose pest