Breaking Into A Facility Using Canned Air Tested

Always love your articles, Brian. While the vulnerability exists, design practice should prevent this. Ideally. In a perfect world...

My question is: with GE / Interlogix out of the mix, who actually manufactures a dual-tech request to exit now?

Thanks for sharing that! Deviant Ollam really does a good job of emphasizing the importance of dead latches in that video.

The 'thumb turn flipper' is rad.

IPVM covers a number of points/vulnerabilities he discusses, including:

• Door Hinges Guide
• Low-Tech Access Control: Master Keying Explained
• Hack Your Access Control With This $30 HID 125kHz Card Copier
• Electric Strike Installation Guide
• Door Closers Access Control Tutorial
• Exit Devices For Access Control Tutorial

His presentation reminds me there are many more topics/weaknesses we could do posts on!

The only time this should ever be an issue is for mag locks. One more reason to avoid using them.

For anything other than mag locks, (or odd-ball stuff like this), I try to always use a lockset or exit device that provides a mechanical means of free egress. I also try to get the lockset or exit device specified with an integrated REX switch, so that a PIR REX is not needed. If that is not possible and I have to use a PIR REX, I specify that the REX should only signal an exit to the Access Control System (vs a "door forced" condition). The PIR REX should never unlock the door.

(Not meant to imply that lever locksets and exit devices don't have their own, different vulnerabilities.)

I wasn't worried until I saw this article! I never knew this was on option but it actually seems painfully obvious.

This is now my favorite article of all time.

Good report Bryan, thanks

When presenting to an end-user, an integrator will gain points by informing the end-user of technology risks such as this. Most integrators don't think of this (or even realize the weakness of PIR-based REX sensors).

With a maglock, a push-button REX should always be used instead. The REX motion detector should be used to bypass the door contact on exit when using a door strike - I don't think it should ever be used to unlock the lock

I occasionally see some installs where people allow the rex to unlock a door with fail secure hardware. I always think “what noob team installed this?”.

I fail to see how one could reasonably assume that a fail safe locking device would be considered secure. They are inherently disadvantaged in that regard.

Most customers i see these days say they want security but when it comes to access control they just like the convenience of issuing cards and tracking usage after the fact. Rarely does any customer i encounter even look for forced door alarms let alone have some action for when there space is intruded upon outside of business hours. I think we all know that good security is a layered approach but the customer absolutely has to be a part of instilling a secure culture within their workplace.

I don’t quite understand your pictorial about wiring two detectors so that either detector would release the door. It seems as though to increase security and reduce the canned air vulnerability, we should connect so both detectors would have to see motion before door releases therefore increasing the difficulty of defeat.

if RTE circuit is N/O, then both detectors relays would have to be series together. If RTE circuit is N/C, then both detectors relays would have to be parallel together.

Also, can you cite a model number of the dual technology RTE detector?

Thank you

In more challenging spaces, I have used a bosch tri-tech motion to trigger events in the access control software software that effectively enable the REX motion at the door. I can set the event to be active long after the tri-tech times out. The goal is just to validate that someone is on the secure side before the REX above the door is enabled. Takes a few steps in the software events, but then all the timing is configurable remotely with out rewiring anything.

[UPDATE: Bosch Response]

Bosch sent this response to the above post, citing a feature in the DS160 that permits another input to be used that qualifies a signal from the RTE REX:

"Bosch has two Request to Exit PIRs, the DS150i and the DS160. Both are very popular, but the DS160 has a feature that was designed specifically to eliminate the possibility of surreptitious entry, such as by blowing cold air or placing an object through a crack in the door that the detector is being used to open.

The Sequential Logic Input allows the detector to be configured so that it requires a separate input to allow it to open the door. This can be used to disable the detector unless someone is actually approaching the door in the correct method.

The Sequential Logic Input can be activated in a variety of ways. One is to use another motion detector mounted inside the area where the DS160 is mounted, and where an occupant must first pass through this second detector before activating the DS160. If the DS160 is mounted inside a vestibule, a door contact activated by the inside door of the vestibule is an option for this as well.

Another way to activate the Sequential Logic Input is to use an output from the intrusion alarm system that only allows the detector to activate when the area it is mounted in is disarmed, or during certain times of day. This method ensures that the detector will only activate when the area it is mounted in is meant to be occupied.

Other installation methods, such as mounting the DS160 away from the door opening, where it cannot be reached by blowing cold air or by placing an object through the crack in the door, can be effective in these instances as well. For example, mounting the detector near the hinged side of the door and aiming the coverage across the door opening or mounting the detector on the ceiling a few feet from the door.

Both the Sequential Logic Input and mounting location methods are described in our installation manual."

Maybe use a dual-tech motion sensor from your alarm supplier.

Does not work if the sensor is only used to indicate that someone is exiting, never only use a PIR as an exit releasing device. Only connect to the system to indicate that someone is leaving and use a RTX button or crash bar to open the door.

In our jurisdiction the building inspectors put a 6’ radius on the floor around the door with painters tape then walk very slowly within that area every way possible making sure the REX trips, making it nearly impossible to mask a Rex. And we are not allowed to field design multiple devices together unless they are factory assembled as a UL listed assembly. So no two sensors to verify someone walked to a door. All has to happen in the 6’ radius, and every part of that radius. Two days after I passed building inspection a bad guy grabbed a blade of tall grass from the landscaping and squeezed it thru the double door gap (I did not spec the doors or magnets) and triggered the REX. Once in the building he busted thru 8 tenant wood doors causing 10,000 damage to the building plus what he stole. Since then I take that video and show architects that the idea of framelesss glass doors without a mechanical strike on the top header with a vertical rod panic device (I like the $3000 units from C.R. Laurence Co., Inc. as they have a mechanical strike with door contact) are not a security solution. We need a UL listed rex that meets the code but also cannot be defeated with a blade of grass.

Numerous vendors are currently promoting these as "contact free" solution to egress. Yet large 'mushroom' style buttons are just as easily elbow-operable (or your butt or a swift spinning jump kick when nobody is looking).

If it is an ADA Door does it not have a Power Door Operator which should be integrated into the Access control and the need to turn a door handle is mute?

ADA applies to an opening regardless if it is fitted with an Operator or not.

How is this relevant when exiting an access controlled door from the secure side or any door? You turn the knob and exit the door. If it has a strike, access control or if it is unlocked automatically (so you don't have to turn the knob). I am confused, is a typical door with out access control not meet NFPA 101 or are you only referencing ADA power operated doors?

Turning a knob requires multiple actions, while running into/depressing an exit device crashbar requires one to both unlatch and swing the door open.

Strikes can be made (and often are) installed to 'Fail Secure' so they remain locked upon power failure. However, 'free egress' required by code is typically satisfied by the mechanical door hardware hung on the door, and in that case RTE isn't used for egress at all - but to squelch the potential nuisance alarms of 'forced door' events.

Does that help? I hope I understand your questions, and if not just reask them and I'll clarify. Thanks for asking them!