Schneier on Security
A blog covering security and security technology.
« Privacy and Control |
| New York and the Moscow Subway Bombing »
April 6, 2010
Bypassing the Chain on Hotel-Room Doors
Technique, plus video.
Posted on April 6, 2010 at 1:40 PM
• 37 Comments
To receive these entries once a month by e-mail, sign up for the Crypto-Gram Newsletter.
Interesting, but at the same time, not terribly interesting. That only worked because the card lock was already opened. The chain normally is there to let occupants of the room open the door to check who's at the door, without necessarily letting the person it, or exposing themselves or the room to view.
If I opened the door to check who knocked, and was confronted with "Thing" from the Addams family fiddling about with an elastic band, you can bet I would have the door closed quicker than that...
I suppose that if you (perhaps rightly?) don't trust the card lock to provide security, then you can set the chain as well when you go to sleep. Otherwise, I don't see how the video technique would become relevant.
I think it's a nice technique that could be improved with some tools. This was him just goofing around showing what's possible. One key part of the technique is that the handle pulls the chain out. As I was watching, I came up with a way to pull this off with regular door knobs using some accessories. It wouldn't take much to make a quieter version, especially if something interesting (and distracting) was going on in the hotel room or outside the window.
When I was in college there was an unused room that could be unlocked using a coathanger. You just had to bend it into an appropriate (but quite complicated) shape and there was just enough room to slide it between the door and the doorframe and open the handle from the inside.
Sounds easy but it's actually pretty hard when you can't see what you're doing! In comparison this looks trivial to do with a coathanger.
I saw this demonstrated on television in the 1970s. The only difference was that they used a pushpin to create the pivot point for the rubber band instead of the handleset.
This technique doesn't seem as though it would work on the parabolic style 'chains' (the long bars with the slot down the middle), which is the only style I ever see on hotel doors anymore.
Perhaps this is why?
This technique doesn't seem as though it would work on the parabolic style 'chains' (the long bars with the slot down the middle), which is the only style I ever see on hotel doors anymore (perhaps this explains why...?).
To attach the rubber band to the handle, that guy had to reach further to the left than it would have taken to pull the chain out anyways.
Look at 0:55 or 1:03 of the video.
OK. forget what I just wrote. I realized that it only works if the chain is way too long. But still.. looks a bit strange.
And.. if you know the position of the chain lock, wouldn't a magnet be enough to slide the knob out of the chain lock?
Once stayed at a motel with card locks and chains like in the video. When I checked in for some reason the original room was unacceptable, so I had the desk change my room. They gave me a new card. Went to sleep with the chain in place and the door locked. Later that night another guest opens the lock with his card, but could not get past the chain. I shouted that the room was occupied, go away. Called the front desk to make sure I didn't get disturbed again. Maybe a trainee at the desk, in any case not exactly a 5 star joint.
Seems to me the that unless one has a pistol with which to greet the intruder the appropriate response to that sort of attack is to ram the door with as much force as possible. Might be a little rough on the perp's biometric signatures but crime is best when dangerous...
Or, you could just kick the door to break the chain, if you've already gotten that far.
(Because the chain is set, we know the room is occupied. All that monkeying around with the chain is going to do is alert the occupants anyway, assuming you didn't already alert them when finding a way past the primary lock.)
@bickerdyke: Depends on what the chain is made from. A magnet isn't going to get you far with a brass chain.
The poster mentioned that he could tell the chain had been repaired several times before. Shouldn't that say something about this hotel and its locale?
I stay in about 20-30 hotels a year. No respectable hotel today has "chains" to lock the doors. Moot point.
I think the biggest value in chains is it keeps inadvertent but non-threatning intruders out, such as another guest wrongly assigned to your room or a maid who doesn't know you are still in there.
It may also have some deterent value against a malicious intruder as it lets them know someone is in the room when they may have assumed it unoccipied (with stuff to steal, of course).
Overall though, they would not keep a serious danger out. If they get past the lock, the chain will be nothing to break. Unless of course they want to make it look like there wasn't forced entry, in which case they provide a window when the victim can see them trying to unchain it.
All in all, I think chains are valuable in many real life circumstances, but not as a defense against a serious violent threat.
Finally! The problem that this solution: http://www.artlebedev.com/everything/defendius/ has been looking for!
@Dragonfrog, I've always felt like, in hotels, the purpose of the chain lock is to protect you from the hotel staff (who have master keys). Actually, more to protect your privacy from overzealous maid services, where you don't actually need security, you just need something to differentiate an empty room from one inhabited by people who don't want to be disturbed (while having the additional feature that it can't be removed by other guests or thier mischievous kids).
Of course, in my house, the chain lock is meant to provide security against the escape of those less than 5 feet tall. Which works fine until they discover ladders, chairs, and openable windows. However, it does still function to give those short residents sufficient pause to consider the repercussions of their actions before exiting.
Looks like a good way to get your hands stomped off by any occupants.
The times i have bypassed security chains in hotels have i improvised using the do not disturb or ready for cleaning sign. They are easily available and have a good elastic quality.
You use it to push the handle back while closing the door. Laminated info sheets are also ok.
Your college had higher quality doors than mine did. Any small plastic card could open the vast majority of the dorm doors in my initial college. A number of us used that technique to enter our own rooms, since it was faster than using a key.
I guess on a positive note, once we figured that out, no one was locked out of their room for very long.
Hotel rooms are inherently insecure by design. Travelers should always use all locking devices provided and verify that they are in proper working order. This includes the windows and any connecting doors. If I had a nickel for every time I've found a 1st or 2nd floor hotel window unlocked, I'd stay at 4-star instead of 3-star hotels :)
The purpose of the chain, deadbolt or latch is to prevent even an "authorized" person from making entry quietly enough to surprise a person inside, especially while they are sleeping or otherwise occupied. That three to five seconds of warning can be enough time to scream, make lots of noise, or take other actions to protect oneself from an intruder.
I caught a hotel employee who made illicit entry to my room at 5 AM on a Sunday morning (after a big party, so no one had thrown the deadbolt). He was clearly tip-toeing and looking at people's possessions when I squinted an eye open. Without pausing to dress I quite literally dragged him down to the front desk, demanded from the manager (and got) a full refund for my stay, and have waxed lyrical about the need to guard against inside threats ever since.
Sorry, I really like this kind of stuff, but this is really so old it has dinosaur poo on it. The person actually reached in so far, they could have simply removed it. Stupid system, always was... simply push the weight of the door on a chain and it pops open (hence the chain being fixed from before, anyways. When are hotels going to get rid of such lame stuff.
I've said it befor,
"You should not put faith in the hotel supplied door furniture to protect you..."
Hotel locks are at best a joke, and most of the other locking mechanisums have known workarounds that any "hotel maintanence" staff can tell you.
The reason is fairly obvious when you think about it...
Look at it this way old people can aford to stay in hotels and they have a habit of not only using all the locks etc. But they also have the habit of dying inconveniantly (for the hotel) shortly there after more frequently than others...
Now I don't know about you but I suspect many hotel guests would be somewhat worried about people using fire axes or power tools to open a door and drag out a body bag...
And you can be very sure the hotel does not want the expense or loss of revenue the breaking down of a door would incure.
So you can take it as read that the hotel maintanence staff can get past anything on the hotel door with the mimimum of fuss and bother...
By all means use all of the locks etc, then use the "desk chair" a "bathroom towel" and your suitcase as an alarm / short term deterant.
If you do it right (back of chair to door rear legs up on a fold or two of towel) trying to open the door will cause the front legs to dig into the carpet making a sizable wedge (unless your unlucky and the chairs got castors/wheels).
The bath towel if draped over the back of the chair and tucked under the legs in the right way will stop fiber optic cameras and tools being put under the door to manipulate door furniture etc.
Your suitcase should be stood up on the chair so any small movment will make it fall to the floor.
From inside the room it is the work of seconds to just move the chair to open the door and if you get a funny look just say "sorry just unpacking", then ask about the laudry service...
Oh and a lot of these "chains" and "bars" systems can be quite effectivly jamed against these "maintanence" attacks with the likes of items found in a "grooming kit" (nail clipers / scisors etc) even a rubber band and a pencil or pen.
Next time you are in a hotel room and have an idle moment or two have a play and see what you can come up with.
Though remember items of hotel door furniture are like the DHS they are all about the illusion of security, not actual security, and thus quite deliberatly designed to be full of weak spots, you are not supposed to see...
I suspect that if the hotel needs to get into a room which is chained shut, they just use big wire cutters on the chain. Maybe that is why this chain is repaired.
This method could be handy if your spouse has chained the door from inside and gone to sleep.
this still doesn't explain how the assassins managed to close the chain on their way out.
plus i suspect this method might have drawn the attention of al-Mabhouh while they were breaking into his room so i suspect they would have used a more subtle approach.
Buddy, you got it. I'm angry, right here, right now.
I fully concur with the previous comments about how poor hotel security can be.
I have had personal (med-high value) items stolen from a hotel room despite using every single security measure available simply because, as I still assert, they can be bypassed by the staff. Sadly the hotel chain in question refuse to accept that their staff would do this and instead claim I failed to use them.
If I could, I would never stay in a hotel again.
Of course there has to be a way to get it; hotel staff needs to be able to respond to a guest who has taken ill while the safety chain is on.
Having opened the door one night while heading for the bathroom (fortunately, I realized my mistake immediately) I can see how people can be locked out in an embarrassing way. I put the chain on at night to prevent that kind of mistake, if it gives me extra security that's a bonus, but not an expectation.
been there done that also.
I use the chain and put some luggage infront of the door to stop me doing it again.
So far so good.
If there is a gap between the frame and the door on the hinge side, just wedge a couple of coins in it.
The door will now need breaking down from the outside to open it.
To get out from the inside, just remember to remove your coins.
I've been in more than a few nice hotels that use them - most recently, last week. Not a five-star but not anywhere near a Holiday Inn, either.
Of course they don't provide real security - like others have pointed out, the hotel staff ALWAYS needs to be able to get in for perfectly legit. reasons. Still, they'll help prevent mistakes (other guest wandering into your room, you wandering out in the middle of the night and taking a leak in the ice machine) and might buy you a few seconds in the case of something serious.
Like Ian just said, I still see chains everywhere. I've never been someplace that didn't have them.
Mostly I use it to keep the staff from trying to come in while I'm there. On my last trip, the maids tried to come in at 8:30 on a Saturday morning--seemed unreasonably early to me. Unfortunately I'd been out late and simply forgot to put up the Do Not Disturb card, or the chain, and had to resort to quick yelling to convince them to go away.
Yes, it's useless as theft or burglar prevention, but it's saved me and others a number of times from having the desk clerk give out the key to an occupied room and accidentally walking in or being walked in on. I was put the chain on, not to prevent anyone from getting in that is determined to get in, but to prevent someone from accidentally walking in on me - I really don't need someone walking in and turning on the lights at 3am.
You guys are all right about the "avoiding unwished entries / exists" at night. But I am not quite sure whether you have considered all the implications of your decision. In case of a fire, for example, a locked door (especially at night in an unknown surrounding) may be quite hard to pass by. As it hinders you in accidently leaving (which I can not imagine happening to me) it also hinders you in rapidly leaving in case of emergency - it might be just the seconds between live and death ...
And for not wanting hotel staff to enter: there are these nice dnd-signs everywhere which so far have worked quite fine for me.
All the people saying that he reached in so far he could have just unhooked the chain: that is impossible.
The whole point of these chain locks is that opening the door shortens the chain enough that the slider cannot reach the large release hole in the slot. Try it: if your chain lock is correctly installed, you will find that when the door is closed to the point that it just reaches the jamb, the slider is still just slightly shy of reaching the release hole.
To the person asking about the "parabolic" bar locks that serve a similar purpose: no, this exact attack doesn't work on those because they open the other way, but a couple of very similar attacks do. They are no safer.
Fact is, these locks are intended to provide some protection against an intruder charging the door when you open it to answer a knock. They are not door bars and are not intended to provide protection against surreptitious entry. Having said that, I'd be much more impressed by a demonstration of how to put the catch back ON from outside the door.
Schneier.com is a personal website. Opinions expressed are not necessarily those of Co3 Systems, Inc.