Using Red Teams Techniques and a Little Common Sense to Defeat Advanced Security Systems - ITS Tactical

Shop the ITS Store!


Using Red Teams Techniques and a Little Common Sense to Defeat Advanced Security Systems

By U. Fridman

Editor-in-Chief’s note: This post was written by security expert U. Fridman and originally ran on his company blog,  Red Teams.

A few years back, a customer asked us to test their newly installed (and very expensive) surveillance and security system. The product promised them an automated system that was so secure they wouldn’t have to place a security guard there.

After some recon we discovered that while the entrance was guarded by a very secure keypad + access card combination lock, the inside had an automated “unlock” sensor so if anyone wanted to come out, the door would unlock from the inside.

Using a high resolution night capable camera, we took photos of the door and lock. After careful review of the pictures we found out that the top and bottom of the doors were not sealed tight against the floor as we could see a tiny bit of light from there. A plan was set in motion.

Later when we arrived, we approached the door carefully and removed a piece of gear from our kit that would, hopefully, allow us to bypass the “very secure” lock: an old credit card.

We slid the old credit card under the door and… nothing.

After a few seconds we agreed that the sensor wasn’t picking the movement, maybe because we were too close to the door and sensors usually “look” a bit farther out.

We retrieved another credit card and we tied it up to a piece of metal string (essentially several springs from a pens click mechanism tied together). We pushed the card under the door again, then carefully we pushed it farther with the metal string. And farther, and farther and… voila! The motion sensor detected movement “from the inside” and unlocked the door.

We were in.

Big, expensive, digital lock defeated by an old credit card and a spring.

Are you getting more than 14¢ of value per day from ITS?

Thanks to the generosity of our supporting members, we’ve eliminated annoying ads and obtrusive content. We want your experience here at ITS to be beneficial and enjoyable.

At ITS, our goal is to provide different methods, ideas and knowledge that could one day save your life. If you’re interested in supporting our mission and joining our growing community of supporters, click below to learn more.


  • John

    My locksmith continually tells me that locks are only for honest people.

    • Mike

      I was doing this same thing about 7 years ago when the company I was working for as a security contractor said their doors were secure and without a swipe card access was impossible. I walked to a door took a phone book from the recycling barrel next to it pulled off the cover and ran it through the top of the door, Voila. Beat 85% of the doors in the facility.

  • Jason

    I have used this trick a number of times when locked out of a commercial building. A piece of ceiling wire (or a stout coat hanger bent straight) bent into a hook on one end with a piece of stiff paper like a manila folder taped to it will fit through most any commercial door at the bottom if not the top and trigger the motion sensor release. There are also entry tools for exit push bars like the one 1/2 down this page . For cars (I spent many years in auto repair) the MCOT tool lets me into pretty much any car with power locks in a few seconds

    Most locks only deter the casual entrant. There are configurations that can help, like having the motion sensor not unlock the door after hours but only disable an instant alarm feature if the push bar is used (otherwise an instant alarm if the card reader is not used) Or a card out required to avoid an alarm. Fire regs do require a way to get out no mater what, but it can trigger an alarm.

  • jcrist

    I’m in the security business and trust me, we know how REX’s work. Now, a salesman from ADT or the typical poorly trained young dude working for the local burg outfit doesn’t really give a shit. If you do work for DOE facilities or the like who suffer constant security audits, this stuff doesn’t fly. I just wish there were more “security critical” customers out there we could do work for!
    Maglocks suck, and this is usually the case when this “trip the REX from outside” trick works. Using a pushbutton on the wall is an easy way to keep that trick from being utilized but it’s less “convenient” for the customer. They we go – convenient or secure. Top security facilities couldn’t care less about convenience. Electric strikes are the best way to go IMO, we always try to use them over Maglocks. But, many programmers do not set them up properly. A REX is still needed to let the system know that egress of OK at the time the door opens to prevent false “forced door” alarms but usually the default programming is for the REX not only to tell the system a door is ok to be opened – but to change relay state or unlock the strike. You are right back to being able to unlock the door by tripping the REX from outside. The correct programming is to set the REX to only tell the system a door is OK to open or “shunt door contacts only”.
    If security matters to you, contact a company that gives a shit, is involved with serious security and not just slinging hardware to meet a quota. Tactical guys make the best security contractors!

    • Mark

      Or you can just have the interior burg area turn off the REX motions when armed (i.e. interior is empty and REX is not needed). As a security integrator and former locksmith, I find maglocks to be harder to defeat than strikes (the locks themselves, not the access control systems). That said, in most cases, REX motion problems stem from an improper install. For some reason, people like to center certain models over the door, where they are looking straight down, when they were designed to be mounted on the hinge side of the door, looking diagonally down at the handle. Salespeople also like to sell the cheapest units.

      In the case cited in the article, I’d be curious to know if a simple can of air would have let them in.

Do you have what you need to prevail?

Shop the ITS Store for exclusive merchandise, equipment and hard to find tactical gear.

Do you have what you need to prevail? Tap the button below to see what you’re missing.