Apartment Security Stupidity
Elana Beach
Entraguard that lets tenants screen visitors. The visitor punches a
three number code on the panel outside the front door, the tenant's
phone rings, and if it's someone they want, the tenant hits 9 on
his/her touch-tone phone. The tone triggers the front door to unlock.
All this was fine and dandy until one day when I came home, I was
taken aside by the assistant manager and told to get a new answering
machine or else. Turned out that the beep tone on my answering
machine was the same frequency as the tone that opened the door. It
also turned out that the management of my building traditionally
forced tenants to get answering machines instead of getting this
Entraguard company to fix the original problem. I talked to the head
manager, who claimed the company had come three times and tried to fix
it, and there was no fixing it at all.
I was supposedly required to get a new answering machine because
unsavory types had discovered that my answering machine would let them
in. Well, that sure explained the small number of blank messages on my
machine that sounded like they originated at the front door ...
When I heard I had to replace MY machine because of THEIR problem, I
got MAD. Off the the head manager's office I go. The main manager
claimed that since this was not a fancy high-income building, I should
not expect them to be able to afford a high-tech security system. At
the time I knew very little phone tech. I decided to fake it. I told
that manager (I was bluffing here) that all that Entraguard had to do
was install a certain electronic chip which cost less than $2 which
would allow the system to know the difference between an answering
machine and a touch-tone.
I really did not know what I was talking about, but THEY didn't know
that. Within a month, the system seems to have been fixed. They have
let me keep my answering machine, and some tests I have run recently
show no effect of my beep tone on that door. Another positive effect:
when I consulted the net for a place to ask about this, I was directed
to the TELECOM Digest. I have enjoyed reading it ever since.
I threatened the apartment management that if they ever give me
trouble about this door problem again, I was going to bore them with
some REAL technical details until it made their heads spin. They seem
to be fairly tech-allergic, and they haven't bugged me since. ;-)
[Moderator's Note: Illinois Bell offers apartment front door security
service to grandfathered customers who had it installed prior to about
1983. They use a sort of hybrid centrex from the central office to run
it. The pairs from the CO to the phones in each apartment have to be
dedicated without any possibility of multiples on those pairs. This is
done for security reasons, and other security techniques include
having the front door opening device camp-on the line *after*
decisions are made by the software to hunt, call-forward, bridge to an
answering service, etc. This prevents the place where you forwarded
your calls to or your answering service from opening the front door of
your building ... the answering service will never see the call, and
even with call-forwarding turned on, a front door call will ring
through with an easily identified ringing cadence of its own. Likewise,
the CO can tell the difference between a digit punched at the phone (4
to open the door, 6 to deny entry and disconnect) and something similar
fed to it from a foreign source like an answering machine or pocket
tone sounder. IBT called this product 'Enterphone', following the
divestiture in the early 1980's, new customers were referred to a
company called 'Interphone', a division of GTE in Canada which makes
customer premises equipment which does the same thing but instead of
being in the CO is wired up at the demarc where telco's pairs meet up
with building house pairs. I'll elaborate in more detail on both
systems here if anyone is interested. PAT]
Nelson Bolyard
entry control device similar to the one described in the cited
article.
When we went to visit her, we followed the instructions on the
intercom box, and dialed her three-digit apartment number on what was
obviously a pay-phone keypad, and waited for her to grant entry. We
then listened as the device obtained dial tone, and dialed a phone
number using touch tone dialing. We heard the phone ringing, and
heard her answer her phone, obviously not knowing we were at her
doorstep. When she told us she'd unlock the door for us, we could
hear a touch tone on the intercom at the same time the door lock
buzzed.
My first thought was that perhaps a "bad guy" with a "pocket dialer"
device (capable of producing the usual 12 dialing tones) could also
gain entry, even against the occupant's will.
Later in our visit we learned that this device is not only used by
visitors but also by the residents of the apartment building (which
has roughly 30 apartments) themselves to enter to the building. This
is done by pressing the * or # key on the outside keypad, followed by
the resident's "password" which (I learned) is set by the apartment
manager to the last four digits of the resident's phone number.
A listing of the occupants' names and apartment numbers appeared on
the front of the intercom box, and it would seem that this information
plus a phone book should suffice to grant entry to anyone.
But even without the right phone book, one can gain access pretty
quickly. This device's "password" protocol does not involve entering
the apartment number first, and any resident's password will work.
So, given that there are 30 apartments, there are 30 combinations of
four digits that will open the door. And given that less than 9000
numbers from a typical "exchange" of 10,000 are used, one has a better
than one in 300 chance that any valid phone number will work. It is
likely that any single page from a phone book contains a working
"password".
Before leaving, I advised her to keep her door deadbolted even when
home, in case she received any phone calls from any unwanted visitors.
Nelson Bolyard nel...@sgi.COM {decwrl,sun}!sgi!nelson
Disclaimer: I do not speak for my employer.
[Moderator's Note: I am rather surprised that this system actually
dialed a seven-digit phone number. Most such arragements simply seize
the pair at some point between the CO and the tenant to (1) temporar-
ily disconnect the wire from the CO and (2) impose their own battery
and ringing current on the line. Under the system where your in-law
lives, call-waiting is absolutely necessary; otherwise a visitor at
the door might wait a long time to reach someone if the line was busy.
Better quality systems such as I described will first test for busy on
the CO line (I think tip to ground or something) and if the line is
busy with a call from the CO then the device puts its own call-waiting
tone on the line (regardless of whether the tenant has it otherwise)
and when the tenant flashes the hook, the device will put the CO on
hold while connecting itself to the pair (and the tenant's phone).
When the tenant either admits the guest or denies entrance, the device
re-instates the CO and drops from the line ... the system has its own
distintive ring of course, so the tenant knows if the incoming call is
from the CO or the front door. Most lobby directories (where these
systems are installed) do NOT include the tenant's apartment number in
the directory ... merely the two or three digit door code. It is up to
the tenant to tell guests how to get where they are going. The systems
which offer 'ringback' type admission to tenants typically use a five
or six digit code selected at random and changeable at will by the
tenants. Even those systems still have a regular lock and key for the
door to use as an override as well, and for Fire Department and/ or Post
Office use. PAT]
Peter Sleggs
> company called 'Interphone', a division of GTE in Canada which makes
> customer premises equipment which does the same thing but instead of
> being in the CO is wired up at the demarc where telco's pairs meet up
> with building house pairs. I'll elaborate in more detail on both
> systems here if anyone is interested. PAT]
Please do.
Regards,
Peter
Bellatrix Systems Corp. Mississauga, Ontario Canada
pet...@bsc.guild.org or beltrix!bsc!peters
[Moderator's Note: See my detailed replies in this issue. PAT]
ron...@media.mit.edu
them leave the microphone on during the dialing. In some cases you
can flash the switchhook, get a dialtone, and use your Radio Shack $15
tone dialer to make all the phone calls you want. My friend's
building was very surprised to find several calls to expensive 900
numbers from the entry phone!
Ron (ron...@media.mit.edu)
[Moderator's Note: To repeat, the better systems do NOT use dialtone
from the CO. They generate their own dial tone and only get as far as
the box by the basement demarc or wherever. The only calls they can
make are to two, three or four digit door code numbers. Even the
system from IBT which has equipment housed in the CO uses what would
be better described as an 'intercom line' or maybe a special sort of
centrex to operate. Those phones do not get near the network. One
system I installed for a landlord here about fifteen years ago left
nothing to chance. I did not even leave a receiver there for the
people to get their dirty hands on. I used a speakerphone mounted in
the wall behind a steel plate with touchtone buttons ... sort of like
a payphone built into a wall. The touchtone buttons were steel, like
the ones on payphones. There were 94 apartments, two offices for
the real estate company, the quarters for the building engineer and
the manager's apartment. The codes were numbered 01 through 98. They
pressed '1', then the two digit code. The first digit pressed turned
the speaker on. They could hear the phone ringing in the apartment
they were calling, and converse with the tenant over the speakerphone
which I had permanently regulated as to sound level, etc. The tenant
opened the door with '14'; the digit '1' split the connection leaving
the control unit listening only to the apartment. To deny entry, the
tenant simply would hang up (or dial '16' to disconnect from the door
and return to a call left on hold). If downstairs tried to press '14'
all that happened was they cut themselves off, but otherwise, they had
no control over the downstairs unit. When the apartment disconnected,
the battery dropped off the line and the downstairs unit went dead.
The tenants all used keys to open the door as did the postman, and the
newspaper delivery man. PAT]
ethan miller
> [Moderator's Note: To repeat, the better systems do NOT use dialtone
> from the CO. They generate their own dial tone and only get as far
> as the box by the basement demarc or wherever. The only calls they
> can make are to two, three or four digit door code numbers. Even the
> system from IBT which has equipment housed in the CO uses what would
> be better described as an 'intercom line' or maybe a special sort of
> centrex to operate. Those phones do not get near the network. ...]
The key word here is "better systems."
We have a lot of small (8-25 unit) buildings here in Berkeley. Many
are protected by intercom security systems. Some of the systems are
totally separate from the phone system (push buttons on a wall speaker
in the apartment, typically). All of the rest (my sample size is
dozens) dial the full phone number. I know; I can recognize the
tenant's phone number from the tones or pulses(!) that the system uses
to dial.
A separate phone line system is *much* cheaper to install for a
building without a preexisting security system. You need to put in a
new phone line ($40 in Berkeley), a wire from the new line's demarc to
the security box, and the box itself. Since the box is on an outside
wall, running the phone wire isn't terribly hard. Monthly cost is
around $10. My girlfriend's building got such a system about a year
ago. It definitely dials her number (via pulse dialing) when I punch
up the appropriate code. It even gets a busy signal occasionally.
The two digit code number from the keypad is translated to a seven
digit phone number. I'll experiment to see if I can make other calls
using an external dialer.
ethan miller--cs grad student
e...@cs.berkeley.edu #include <std/disclaimer.h>
[Moderator's Note: All the landlord needs is a few long distance calls
made from that phone to demonstrate a 'regular phone line' is NOT a
cheaper way to go. Some landlords may even be too stupid to have those
phones blocked from 900/976/incoming calls, allowing someone to stand
at the front door and accept incoming collect calls from sex services,
etc. The CPE version, from GTE in Canada only cost me about two grand
when I installed it for the apartment building I mentioned yesterday.
Of course, I did not charge myself for my own labor. :) PAT]
Mike Kimura
> dialed a seven-digit phone number. Most such arragements simply seize
I am not surprised since both the apartment I previously lived at and
my current condominium use a system that dials the telephone number.
In fact, at most of the security units I visit I can hear the system
dialing (sometimes even pulsing) the telephone number.
We used to have a private intercom system that opened the front gate.
It was inconvenient because the ringer was so quiet I couldn't hear it
from upstairs and you had to be downstairs where the unit was to talk
and open the gate. When our condo board decided to upgrade to a
system using the telephone, I extracted some articles from Telecom,
which our Moderator wrote, describing the "better" system.
However, next we received a request to provide our telephone number so
it could be programmed into both of our entry gates. Instructions
indicated to push "9" to let someone in. No mention was made as to
how to deny entrance nor was any mention made as to a "password" to
open the gate yourself. Also, it was suggested that we purchase
Call-Waiting so people at the front gate won't get a busy signal.
Most recently the condominium board has been bemoaning the fact that
PacBell charges them for two (one at each gate) *BUSINESS* lines. I
believe each call from the gate to a condo unit ends up being charged
at business rates. Also, the phone lines to these entry gates
terminate in the parking garage with a regular phone jack. I wonder
how long before someone taps in a phone there and makes calls charge
to the association?
Mike Kimura (m...@mass.dnet.hac.com)
[Moderator's Note: Well again, the 'better' systems don't leave this
sort of thing to chance. They do not require call waiting; they do not
require that you provide your phone number for programming; they do
not even require that you have phone service from telco. With the
system from IBT, if by chance your phone service is terminated, let's
say due to a credit disconnect, the front door intercom still works.
Your phone may be sitting there dead 99 percent of the time, but if
someone comes to the door, presto, you get the door call. The better
systems do not care who plugs into whatever jack they please: all they
will get is a dialtone to a very limited in scope 'network'.
Incidentally, tell the condo association to get only one business line
if they insist on doing it the way they are. Have the phone at the
back gate be an extension to the one at the front gate. Given that the
door calls are only a few seconds in length ideally (in fact, IBT
times out the connection after 30 seconds, as does the customer
premises version), it would be rare that someone was trying to use the
phone at the front gate simultaneously with someone at the back gate.
By bringing the gate latch through a certain contact in the phone unit
itself, it is possible to fix things so only the gate where the phone
is off hook at that moment would get the unlatching pulse, and an
'in-use' light on the phone would be honored by most courteous people
who saw it illuminated for a few seconds when they arrived. PAT]