Inside the Hidden World of Elevator Phone Phreaking

The first time I called into an elevator, I picked up my iPhone and dialed the number—labeled on my list as the Crown Plaza Hotel in Chicago—and immediately heard two beeps, then a recording of a woman’s voice, who told me to press one to talk. When I did, I was suddenly in aural space filled with the hum of motors and the muffled twanging of steel cables under tension. “Hello, can anyone hear me?” I asked the void. The void did not respond.

I hung up and tried another number on my list: A Hilton hotel in Grand Rapids, Michigan. After just one ring I heard a series of four tones and was immediately listening to the inside of another elevator. I heard a chime, perhaps a signal that it had reached a floor, followed by the rumble of what might have been a door opening. “Hi, is anyone in here?” I asked. This time I heard a few muffled voices, then a woman answered: “There are people in here, yes.”

Sounding a little more excited than I intended, I asked if anyone was in an emergency situation, a strange question I felt compelled to lead with, to make sure I wasn’t tying up the elevator’s phone line when the occupants might need it. I got no answer except what sounded like the rumble of the door opening and closing again.

So I stayed on the line. A few seconds later, the elevator chimed, and I heard the noises of new people entering. I greeted them as I had the first passengers, but they didn’t seem to hear me even after several attempts. “Turn it over,” I heard a woman’s voice say in a Midwestern accent. “The lady at the desk just said to hold it,” a man said. I realized I was listening to a couple trying to figure out how to use their keycard to unlock the button for their floor of the hotel. I felt a transgressive excitement, a sense that I was eavesdropping on a conversation I shouldn’t be hearing, and I instinctively hung up the phone.

click to find out more
click to investigate
click to read
clicking here
company website
consultant
content
continue
continue reading
continue reading this
continue reading this..
continued
conversational tone
cool training
Get the facts
Related Site
Recommended Reading
Recommended Site
describes it
description
dig this
directory
discover here
discover more
discover more here
discover this
discover this info here
do you agree
enquiry
experienced
explanation
extra resources
find
find more
find more info
find more information
find out here
find out here now
find out more
find out this here
for beginners
from this source
full article
full report
funny postget more
get more info
get more information
get redirected here
get the facts
go
go here
go now
go right here
go to the website
go to these guys
go to this site
go to this web-site
go to this website
go to website
go!!
going here
good

This was my introduction to the illicit thrill of elevator phone phreaking. I had learned about this hobby—and received my list of working elevator phones—just a few days earlier from Will Caruana, a thirtysomething freelance security researcher. Caruana works a day job in airline customer service, mostly helping people find their lost luggage. But in his off hours, Caruana practices phreaking, a decades-old form of proto-hacking that explores the hidden features, bugs, and pathways of the global telephone system. At the Defcon hacker conference in Las Vegas today, Caruana will give a talk on a very specific subgenre of that pastime: phreaking elevator phones, the emergency call boxes legally mandated to be in every elevator in America, and largely left wide open to any caller who can determine their numbers.

Red Lights and Defaults

“I can dial into an elevator phone, listen in on private conversations, reprogram the phone so that if someone hits it in an emergency it calls a number of my choosing,” Caruana told me in our first conversation. Elevator phones typically emit audible beeps in the elevator when they connect. But if someone has dialed into the phone of the elevator you’re riding before you enter it, Caruana warned me, the only indication might be a red light on the phone’s panel. “It’s hard to notice if you’re not looking for it,” Caruana says.

Over the last year, Caruana has assembled what he believes is the largest public list of elevator phone numbers, which he plans to make available to a limited audience—although he declined to say where exactly he’s publishing it. He says he’s releasing the list of 80-plus numbers not just because he wants to foster more elevator phone phreaking as an opportunity for whimsy and chance encounters, but also to draw attention to the possibility that elevator phones could be abused for serious privacy invasion and even sabotage. Call up most elevator phones and press 2, and you’ll be asked to enter a password to reprogram them. In far too many cases, Caruana says, phone installers and building managers don’t change those passwords from easily guessable default codes, allowing anyone to tamper with their settings.

Leave a Reply

Your email address will not be published. Required fields are marked *