The "God Mode" Key, Going Up?
How a $5 piece of metal from a hardware store turns a high-rise elevator into a private express lane.
Note to readers: my book featuring white hat hacker Niko Webb is out now on Amazon! Read the first chapter for free on Substack.
THE COUNTERMEASURE
Dispatch #012
The “Invisibility Cloak” on Every Street Corner
You’ve seen them a thousand times. A plain, circular keyhole on the wall next to an elevator, or a small metal box labeled “FIRE RECALL.”
You likely ignore them. You assume they are for “authorized personnel only” and that the keys are locked away in a high-security vault.
You are wrong. In the world of physical penetration testing, we call this the “1620”. It is a small, jagged piece of metal that costs about $5 on the open market, and it is arguably the most powerful “skeleton key” in the United States.
The Hack: Taking Control of the Vertical Highway
Modern elevators are incredibly secure. They require fobs to get to specific floors, they have cameras, and they are monitored by central computers.
But they all have a “God Mode” built-in for emergencies. It’s called Phase II Fire Service.
How it works:
When a firefighter (or Niko Webb) inserts a 1620 key into the panel and turns it to “ON,” the elevator’s brain is bypassed.
The Fob Reader Dies: The elevator stops asking for credentials. It will now go to any floor you press.
The Doors Obey You: In normal mode, the doors close automatically. In Fire Service mode, the doors stay open until you manually hold the “Door Close” button. This allows you to peek out onto a floor and retreat if you see security.
The “Call” Cancel: The elevator ignores people waiting in the lobby. You own the car.
The “Crazy” Part: The Universal Standard
Here is why this is a security nightmare: Regional Standardization.
Fire departments don’t want to carry 500 different keys for 500 different buildings. So, they mandated that every building in a specific region use the exact same lock.
In much of the US, the Yale 3502 or the 1620 is the standard.
In some cities, you can literally buy the “Regional Fire Key” on eBay for the price of a sandwich.
For a guy like Niko Webb, he doesn’t need to hack the building’s mainframe to get to the CEO’s penthouse. He just needs to walk into the service elevator, turn a key he bought online, and he has a private express lane to the most secure floor in the building.
Why Companies Allow This
They don’t have a choice. It’s the law. The Life Safety Code dictates that the fire department must have access.
The vulnerability isn’t the code; it’s the access to the keys. Because these keys are so common, they are often left on “keyboard” hooks in security offices, or given to janitorial staff and never returned.
The Sign-off
Next time you get into an elevator, look for the small keyhole near the buttons. If it has a code stamped on it like “FEO-K1” or “1620,” you’re looking at a backdoor that exists in every skyscraper in the city.
Next week in The Invisible City, we’re heading underground to look at manhole covers and why a simple spray-paint mark on a sidewalk can tell a thief exactly where to “bleed” a billion-dollar company’s data.
Stay dangerous,
Alex Holt