Elevator Hacking

Warning: While elevators are designed to be extremely safe for intended use, their misuse can lead to severe harm or death. This page is intended for educational purposes only.

Many never even consider what an "unintended" use of an elevator may be, content to hitch their daily ride to and from the office without a thought to the potential for creative repurposing lying all around them. One feature of many, if not most, elevators is the presence of a tiny hole usually only 1-2cm in diameter in the upper corner of the closed doors as viewed from outside.

This hole is called an "escutcheon" and acts as a kind of keyhole for elevator maintenance. They may, in some cases, be plugged with a tubular lock. This is nothing a tubular lockpick could not dispatch, if you happened to have one.

Typically the key to this keyhole takes the form of a "drop-key." This is roughly the size and shape of an allen wrench with a hinged bar at the end of the longer segment. When the longer segment is inserted into the hole, the hinged bar drops downward on the opposite side of the door due to gravity and then can act as a lever when the key is turned. There may be a small protrusion, bushing or the like about midway along the longer segment, which stops the drop-key at the proper depth for the bar to engage the lever on the other side. One could certainly purchase a drop-key. Amazon carries several varieties. I have even stumbled upon a drop-key before that an unattentive maintenance personnel must have lost. If you do not have access to such a key, however, also effective is a simple hack involving a thin, bent length of metal.

I cut these from scrap metal using a standard hand-operated metal shear. I have found it best to start with 15-18" of material, and while it must be narrow enough to fit through the hole, the wider it is, the more it will resist torque. Experiment with the radius of curvature to ensure that the shortest segment at the tip of the tool is able to lie as close as possible to parallel the plane of the door on the opposite side. The bent portion on the opposite end makes it easier to turn the key once it has been inserted. The following assumes you are standing outside the elevator, at one of the elevator landings. Insert the shortest segment first, then turn the key clockwise until you feel resistance against the lock mechanism on the opposite side. It will take a firm pressure to lift this lever, which will be confirmed with a loud thunk. At this point you can press your hand against the elevator bay doors and push them open.

Be very careful, as you may be opening a door onto an open shaft.

Elevator doors have two layers, the outer "bay" or "landing" doors and the "cab" doors on the elevator car itself. If the cab is at your floor, you will see something like the above image, which depicts the motion sensing bars on the cab door. These sensors are responsible for automatically opening the door when you stick your arm through, as for example when you are trying to catch an elevator as the doors are closing. If the cab is not at your floor, you instead will see an open shaft. Be careful as there is little to protect you from falling in. Rest assured, however, that the elevator should automatically stop moving whenever a bay door is open anywhere. Thus, the elevator's current occupants are sure to notice the signs of your tampering, so it is advised to experiment only with elevators not presently in use. In most cases, when the bay door is closed again, the elevator will resume normal operation.

Elevator surfing refers to the act of recreationally riding on top of an elevator cab, inside the shaft. In rare cases one can actually surf underneath the cab. I have heard stories of intrepid rappelers at MIT attaching their ropes to an elevator cab and attempting to rappel at the same rate as the cab is rising, in order to stay stationary at a certain height. Like many of the MIT Hackers' exploits, this is ludicrously dangerous and it is not recommended that you try this at home.

If you call the empty cab to your floor, step aboard, and press the number of the floor below you before immediately stepping back off the elevator, you will send it one floor down. The benefit of this is that when you manually open the bay doors, the cab top should be only a few feet below your landing, near enough for you to step onto it.

Once safely aboard, you might be able to find a lamp, intended for elevator maintenance workers. If not, be sure to equip the headlamp you've brought along. You can operate the elevator in one of at least two ways. The first is to have a friend board the elevator properly and operate it by pressing the buttons of different floors from within. The benefit of this method is that the elevator will run at full operational speed. The second method is using the manual controls that can typically be found on top of the cab. These vary by manufacturer, but the diagram above gives a sense of their general layout. The large red button is an emergency stop. This will stop the elevator and often the machinery will thereafter have to be manually reset, so refrain from pressing this. To operate the controls, switch the knob from "Aut" (Automatic Mode) to "Insp" (Inspection Mode). Then, with one thumb holding down the "Safe" button, operate the "Up" and "Down" buttons. The elevator will run at reduced maintenance speeds, but otherwise you will have complete control. Keep well away from the walls of the shaft or any snagging hazard. Pay special note to any rising or falling counterweights when the cab is in motion. These, if present, will pass between the cab and one wall of the shaft. Rest assured, however, that there ought to be plenty of overhead space at the top of the shaft. Most elevators are "overhead traction" mechanisms, drawn by cables from above. The actual motors are usually located in a mechanical room at the top of the shaft, or sometimes beneath. Hydraulically driven elevators, on the other hand, are not guaranteed to have space at the top of the shaft. Fortunately these are less common, usually only found in buildings 2-3 stories tall, and can be easily identified by the absence of counterweights and the giant telescoping piston-like contraption that pushes the cab up from below. In an emergency, note the escapeway in the roof of most elevator cabs. While this is sometimes locked, if it is it will be locked from the outside and often with a simple latch.

This research was inspired by a presentation at DEF CON 22. Please note that this is for educational purposes only.