(Segments one through four of the "99 ways to defeat an alarm system" is posted directly beneath this Kindle promotion)
I want to thank everyone who helped me during my recent promotion of my Getting to Know Jack series thrillers. The results topped all previous efforts. Thanks! The three books are now back at their regular pricing ($2.99). Next month I will introduce the fourth in the series ("Superior Intrigue"). It is in the final stages of rewrites, and will go to the editor in a couple weeks. Again, thank you.
"Jack and the New York Death Mask" is the first book of the series. It consists of about 80,000 words, while the next two are closer to 50,000. No doubt, the second and third books are easier reads, on multiple levels. My background is in private security. That is clearly evident in the first book, and to a lesser degree in the next two. Many in law enforcement think that I give away too much information, particularly in the first book. But I've never been privy to classified information, so I'm not sure how they reached that conclusion.
Initially I provided the first book as a free download on a blog. Over 4000 took advantage of it. I have since made the eBook version available exclusively through Kindle. The same is true for the other two books as well.
The second and third books of the series are set in the Upper Peninsula of Michigan—in and around a very remote community called "Sugar Island."
I fell in love with Sugar Island while shopping to buy a house on Lake Superior a number of years ago. While Sugar Island is actually located in the St. Mary's River (just east of the Soo Locks), it still reflected the atmosphere I was looking for. I have three more "Jack Handler" books in the making, two of which are set on this island.
I did eventually find the house I was looking for. It is located on Lake Superior at Whitefish Point. One of the intriguing charms of this area is that 550 ships have sunk in and around Whitefish Point, including the well-known Edmund Fitzgerald. In fact, directly in front of my house one can see the bell of the Ora Endress, which sunk in the early 1900s less than 60 meters out. Between waves its brass bell reflects the sun, as it still hangs on the carcass of the wooden ship.
Parts of "Superior Peril" are set in the Whitefish Point area, as well as on Sugar Island.
I have found the people of the Upper Peninsula to be a wonderfully loyal audience. To date I have scheduled 15 book-signing venues in the area for next summer. I now consider that to be my permanent home.
Thank you for your considerations. Please enjoy the books—Michael Carrier
(The first three books in the Getting to Know Jack series available on Amazon in print and digital.)http://amzn.to/1iUlw4v
Characters in the Getting to Know Jack Series
(April 28) Segment 13: Find a good neighbor
(Keep in mind as you begin reading this series, there will be a total of ninety-nine segments to this post, with one more being added every Monday. Please also note that the segments will appear in reverse order. In 2016 all 99 segments will be published as a book.)
As is the case with all the burglary "secrets", this one will not work in every instance. Its application is limited to strip mall scenarios. That is, where there are a number of individual single-level side-by-side stores which share a single roof. And then, it will work only under specific conditions.
First, you find the store you wish to hit. Verify that the wall separating that store from the one next to it consists only of standard drywall/stud construction. It does not matter if the studs are metal or wood. You can determine this to a relatively high level of certainty by simply tapping on the wall. If it sounds as though it might have concrete block behind it, then find another store to hit. If it sounds somewhat hollow, then most likely it has only insulation inside. Sometimes you can use a restroom in the store to further test. If the restroom is on a wall that is shared by the store next to it, you can push an ice pick through the drywall. Be careful not to penetrate deeper than a couple inches. If you don't hit something very hard (such as concrete block), then you will not be successful using this method of entry--keep shopping.
If it is hollow, then you can go to next step. Now make sure the store next to the target does not have an alarm system. Many stores in strip malls, particularly in small cities, do not have alarm systems if their products are not considered high value items.
It is also critical that the target store not have ceiling-mounted motion sensors. If the target has high value merchandise, they will have an alarm system, and they will most likely have motion sensors. Generally, wall-mounted motion sensors are the norm. Find an area in the target store where a motion sensor does not cover--such as between shelves toward the center of the store. Determine the range that you can hit. Usually this will amount to a few rows of shelving. Pace off the distance to to front wall. Now you go to the store next to the target, and pace off the same distance from the from the front, and note where that point is so you can locate it in the dark.
If there is this a wall-mounted motion sensor in the target store that you suspect might be an issue, then while the store is disarmed, you can tape a piece of white paper over the sensor lens (Segment 3 of this article) to block its view. When you break in do not assume that you have located all points of protection. Limit your work to a relatively small area of the store--don't be greedy. And do not stand up. You must crawl.
You are now ready to go to work. Enter the unprotected store between the hours of four and five in the morning--assuming that both stores maintain normal business hours. Find the point you determined earlier, and knock the drywall out between two studs. Remember to do this at floor level. Then knock out the drywall on the other side of the studs. Clean out a hole large enough to craw through easily. Standard construction will permit a hole nearly fifteen inches wide, and as high as you need, provided you stay below the height of the shelves in the target store. It is good not to disturb drywall higher than three and a half feet. Once that is complete, you should have free run to crawl around in the target store and pick the items you want on the lower shelves. The critical thing is to stay out of range of motion sensors. The shelves will effectively block their view. Again, don't be greedy.
Store owners. You can protect yourselves against this type of hit by installing ceiling mounted motion sensors as well as wall mounted. Most burglars already are aware of this method of entry, so if you do not have that type of sensor, and you have inadequate walls separating you from your neighbor, then take additional precautions. Call your alarm service provider and have him determine that this type of attack could not work. Generally, the best way to protect against this type of entry is to have multiple sensors installed, interior traps, and ceiling mounted motion sensors.
* * *
(April 21) Segment 12: See you later alligator
The following technique seems too simple to work. And that's the problem with it--it won't work on nearly half of the security systems in place today. But on the positive side, it will will work on 50% of them.
If all you are worried about is the police responding to a monitored security system, and if that system uses standard land lines for monitoring, defeating it is generally very easy. If the telephone interface is located on the outside of the building or home (and it will be unless the alarm company has moved it inside), a burglar can take a pack of cheap jumper cables (purchased from local electronics store), with alligator clips on the ends of them, and thwart the communication of alarm system.
The first thing you do is remove the cover from the interface. This can be usually be done with a tiny screwdriver. The screws on most interfaces have small bolts, with pins in the middle. Ostensibly the special bolts are supposed to require a special tool, however the small screw driver can usually be forced into bolt, and will work to remove stainless steel bolts. Once cover is removed, if the burglar simply attaches the cables across all green and red terminals, or blue/white white/blue, he will prevent calls and alarms from being transmitted.
The thing to be cautious about is that the color code is not always observed, especially with regard to the blue/white white/blue. Generally those colors are used as the primary land line circuit, but not always. So, it would be a good idea to jump out the first four pair. If there is a green/red pair, there is a very good chance that will represent the principal pair, and therefore the circuit communicating the alarm signals. This attack will not always work, especially if there is a radio backup system in place. And that is what I recommend for alarm system owners. Always back up your system with a radio. Contact your alarm company requesting this service--it is important.
* * *
If you watch TV at all, at least if you watch crime drama, you have seen a burglar slip a piece of aluminum foil between the top of the door and the door jam, in an effort to defeat the magnetic contact on that door. Typically, once the crook has slid the foil between the contact and its activating magnet, he is then safe to open the door and not be detected doing it. The truth is, that doesn't work.
To help you understand why that can't work, I will explain briefly how a magnetic contact on a door functions. Whether system is wired or wireless, both utilize magnetic contacts on doors. They just look and function a bit differently. With a wired system, the magnet is virtually always on the door, while the contact is mounted on or into the jam. When the door is closed, the magnet is brought within 3/8 of an inch (usually) of the contact. At that distance, the strength of the magnet will cause two pieces of thin steel inside a reed contact to be drawn together, completing a low-voltage circuit, thus allowing alarm system to remain armed but not tripped. The act of widening the gap between magnet and reed switch (such as opening the door) will cause the alarm system to trip. Sliding foil of any type between the two components does nothing to thwart the operation of the system.
The most direct way to beat the simple door contact is to remove the magnet from its mooring, and place it against the contact. This is impossible to do with a hardwired concealed contact (contact that is buried in the jam). But it is usually easy to do with a typical wireless surface mounted contact, because in most of these cases, the transmitter enclosures contain the contacts. If a burglar removes the surface mounted magnet from the door jam, and tapes it directly to the contact, the door can be opened and closed at will without activating an operational alarm system. This procedure will not work in situations where the operational contact is hardwired to the wireless transmitter. You can spot such applications because there will be no magnet visibly juxtapositioned with the transmitter. In these cases you might see a small wire coming out of the wireless transmitter. This wire will most likely lead to a contact. If the contact is concealed inside the door itself, it will be very difficult to circumvent this point of protection.
The best way for the owner of an alarm system to protect against such an attack is redundancy. Always assume that one or more components of your system can fail or be defeated, and have backup. It is beneficial to study your system by viewing as a burglar would, and convince yourself that the system has redundancy. This is particularly important if the system is more than two or three years old. Technology keeps improving, and burglary methods keep improving as well.
* * *
Not only does this burglary tool almost always work, I have yet to see it not work, when skillfully applied.
It will not take me very many words to describe this practice, because its value is easily appreciated. If you are a fan of The Mentalist, then you have a pretty good idea on how to pull it off. The challenge is in doing it well enough to be convincing.
In its most professional application it is known as a confidence game. The crook gains the confidence of the victim, and then pulls off the crime.
The way this is used to defeat alarm systems is for the crook to gain the confidence of a family (often by dating a daughter), and then learning the combination to the alarm system, or when it is and is not used. Half of beating a system is understanding its most intimate details. The insider gains this knowledge, and then applies it at the appropriate time. I have seen this used dozens of times, always with success. Often it is even a family member that plans and executes it.
So, if you're an enterprising crook, use your charm to gain inside information. Even better, exploit inside information that you already have. Just make sure that you thoroughly cover your tracks. This also works very well for employees hitting the companies that they work for. In fact, I have found that a very high percentage of commercial crime is committed by insiders, and that they seldom get caught.
Alarm system owners. Let this be a word to the wise (dang, another cliche!). Study your system, figure out how it might be vulnerable to such and attack, and maintain tight user code control. Most systems now allow for multiple user codes. Provide a separate code for every user, and monitor when and by whom the codes are used. Look for patterns. All alarm companies provide this service for a small fee. It's worth it.
* * *
(March 30) Segment 9: Practice-Practice-Practice, and then have backup plan
Some time ago one of my clients had what was initially thought to be a false alarm. It occurred on a Wednesday at around 9 P.M. The client was a motorcycle shop. I dispatched the police, and they determined that it was a false alarm.
The sensors I had in place had never false tripped before, so I did not buy it. So, we were on guard.
The following Wednesday, at the same time, it tripped again. We dispatched immediately, except this time we told the police that we were suspecting a pattern, and that they should take it very seriously.
Their dispatch time was cut in half. The first car arrived within five minutes. They found in the lot an eighteen foot box truck. Twelve men had loaded fifteen motorcycles on it and they were closing the rear doors.
But that is not the end of the story.
All night long the cops remained in the store with the burglars, waiting for a state certified interpreter to show up and read them their rights. Finally, just about the time the sun was rising, an instructor for the deaf from Michigan State University arrived, and the cops read them their rights, and took them off to lockup.
Every single one of the crooks was legally deaf.
When the case went to court, I went down to the courthouse to view the proceedings. But instead of waiting with the prosecution's witnesses, I waited with the defendants. I learned that every one of them could hear well enough to converse with one another without signing.
I watched the leader of the gang. He bragged about his $1500 cowboy boots.
The trial lasted only a matter of minutes—all defendants were released on a technicality. The person used to sign them their rights, while a professor in the field, was not state certified for that specific purpose.
They walked because they had a backup plan. Plan—Plan—Plan, and then have a solid backup plan!!
Business owners, do not tolerate false alarms. If your system is false tripping, get it fixed. You might just be experiencing a well-thought-out set up.
* * *
(March 23) Segment 8: Defeating the monstrous glass break sensors--can it be done?
Come
on, Michael, you and I both know that the new glass break sensors cannot be
beaten.
I
would say to that, Really?
First we have to determine whether or not we are discussing the same
thing, or things. There are several different types of glass break sensors.
Some attach directly to the glass, and others are mounted on the wall or
ceiling. And there are even different varieties of both types.
I will start out with the unit that has found its way into the majority
of newer installations. It is a dual technology device, and it can be mounted
on the wall or ceiling, and generally has an effective range of twenty to
thirty feet. Of course, there can be no physical obstructions blocking its path
to the glass that it is protecting. This is how that sensor works:
When something is thrown against the glass in a successful attempt to
break the glass, not only does it make a pretty substantial sound, it causes a
momentary change in volumetric pressure. That is because the glass is pushed
inward just before it shatters. When the sound of breaking glass is combined
with the rapid increase in volumetric pressure, an alarm is generated. Sound or
pressure change will not initiate the alarm condition—the two must occur at
virtually the same time.
So, how simple could it get? If a burglar can cause the glass to break
silently, or without creating a change of pressure, the sensor will not detect
his entry. The method I am going to outline will not work on all glass, but it
will on most safety glass. The type of safety glass that it can be uses against
is the type of glass usually installed in sliding glass doors. It is not
effective on glass that is laminated in any way, such as the glass with the
wire mesh built into it.
Another
method employed against safety glass is a cutting torch, or which portable
models are now available in hardware stores. Hold a cutting torch to a piece of
standard safety glass, and it will shatter—again, without changing air
pressure.
So then, how does a business owner or home owner deal with this weakness? The answer is redundancy. Dual technology glass break sensors are great. I have designed them into hundreds of system, both residential and commercial. But you must also employ layers of secondary protection, such as critically located motion sensors, and/or other types of hidden interior protection. If your system is not designed with that in mind, you might want to talk to your alarm representative.
So then, how does a business owner or home owner deal with this weakness? The answer is redundancy. Dual technology glass break sensors are great. I have designed them into hundreds of system, both residential and commercial. But you must also employ layers of secondary protection, such as critically located motion sensors, and/or other types of hidden interior protection. If your system is not designed with that in mind, you might want to talk to your alarm representative.
* * *
(March 16) Segment 7: Entry through basement windows
Tonight I watched an interesting episode of The Mentalist. While this show is not my favorite, I almost always watch it if the network is running an original.
In this episode Grace and Rigsby are the victims of a successful burglary. And they do have an alarm system. Midway through the show it was pointed out that the burglars entered the home through a basement window, thereby circumventing the alarm system.
There is a certain element of reality to that method of attack. In fact, it is one of my favorite methods. Certainly I have never used it, but I have had dozens of my clients hit through basement windows. (That is, before I designed a system for them.)
The thing about attacking basement windows is that it will work only under certain circumstances. The window to be attacked must be the older style daylight window. That is, single pane. This is how it's accomplished. The burglar will place a damp newspaper on the glass from the outside. He will then push until the glass cracks. He removes the newspaper, usually with some of the glass sticking to it. And then he pulls the remaining glass shards out of the frame, reaches in and unlocks the window.
The older models of this type of window hinge on the bottom. So, once it is unlocked, it can be opened, and then lifted from the hinge on the bottom. The whole window can then be placed outside, and entry gained.
The thing that makes it so successful is that it is difficult and expensive to protect these windows, and so they are generally not protected by alarm companies. Furthermore, the fact that any broken piece of glass sticks to the paper and does not fall on the floor, virtually no noise is generated. That means that any type of glass break sensor that might be installed will not detect the attack.
Most newer homes employ double-thickness glass. This is true for windows like the Anderson daylight window. This attack will not work on the Anderson window--only on the older single pane windows.
There are a couple ways to protect these old windows. The one I most commonly employed was to install a break wire across the whole window, or a switch called a "Ball Trap." The Ball Trap is not what one might think. A Ball Trap consists of a strip of brass that is trapped between two spring-loaded brass balls. A wire is connected to the strip of brass, and stretches across the window opening. If the window is opened or attacked, the brass strip becomes dislodged and the alarm activated. The Ball Trap is a very old technology, but it still works amazingly well.
Sometimes I used motion sensors in the basement in place of window protection. But there were many cases in which these windows had to be protected, particularly if the basement served as a playroom for children. As I wrote above, most newer homes use multiple pane windows, thus rendering this means of attack ineffective.
If I had to state odds, I'd say (at least in the Midwest) 90% of homes built before 1970 have single pane daylight windows in the basement. And any homes built after 1995, the likelihood is that any basement windows will be multi-pane.
* * *
(March 9) Segment 6: Additional interior protection—Under-carpet mats, Interior doors, Remotely placed motion sensors, and Stress sensors
Again, the most common interior trap used in security today is the Passive Infrared. That is particularly true when the system in question is a wireless system. In earlier segments I have discussed how easily this device is defeated.
In the case of a hard-wired system, or a hybrid, then the sensor of choice would be a Dual-Tec device. I also discussed how to circumvent this product.
The odds are overwhelming that one or both of these devices are what a burglar will encounter, particularly if dealing with a small commercial or a residential system.
While it is true that in designing thousands of security systems I have included these devices in virtually all of them, in the majority of my systems I have also incorporated additional elements into the scheme. One such device is the Under-carpet pressure-sensitive mat. The beauty of this sensor is that it cannot be spotted by a burglar casing the home or business.
The product is sold by the 30' roll, and is cut to the desired length. Generally I would locate sections of it under three carpeted steps, or in a narrow hall. The downside of this device is that it will be activated by any dog and most cats. So, if there pets of any size, a burglar can be fairly confident that this device will not be employed.
Another very effective interior component is the protection (with a contact) of an interior door. For instance, the door of a gun cabinet, the door separating upper from lower levels, or the door leading into a closet where valuables are stored. This protection was my favorite secondary level of interior protection.
Sometimes a second or third motion sensor can be employed in an area not generally accessible to a casual visitor. For instance, if there is a workshop in a home where expensive tools are located, that would be a good place for this secondary interior device. Commercially, a good application might be the server room.
While a burglar might thwart or disable a motion sensor located in a common area, it is less likely that he would get at such a sensor (unattended) if it was located in the server room.
Another interesting product is a stress sensor. This device is mounted under a wood floor, generally beneath a hall. It is attached to the floor joist, and so is totally invisible to a burglar during or before the attack. This device is usefully employed beneath a valuable wall-hanging. The cost of this unit is minimal, and it can accurately be adjusted to accommodate for any but the largest pets.
On the bright (side for a burglar) to my knowledge I am the only system designer to have employed a stress sensor in residential or commercial installations. Another good application for this sensor is on the steps of a deck, as it can give the homeowner early warning that someone is attacking his house. The only way a burglar would know such a sensor was used would be through a very extensive pre-attack fact finding mission. And to conduct such a study would require two parties. That makes the stress sensor a very beneficial addition to an alarm system.
There are three additional sensors that are often included in a discussion of interior protection: They are Glass-break sensors, Shock sensors, and Sound discrimination. In fact, they are frequently sold in lieu of legitimate interior sensors. That is done because they are relatively easy to install, and they can be used in many applications that are not conducive to the use of motion sensors (that is, particularly where pets are located). However, I do not consider them interior traps. They are simply perimeter protection devices that are located inside a protected area. Therefore, I will discuss them in another segment of this posting, but as perimeter protection.
Again I emphasize the importance of secondary interior devices that are not obvious, such as a protected interior door, an under-carpet pressure-sensitive mat, or a stress sensor. Unfortunately, most often these secondary devices are not employed. That's how burglars become successful.
* * *
(March 2) Segment 5: Additional interior protection—Ultrasonics
While they are not used extensively any longer, at least in new installations, there remain a relatively large number of them in place, especially in in very old installations.
In previous segments of this post I discussed Passive Infrared (PIR) devices, Microwave, Dual-Tec, and Pulsed Photoelectric sensors. This week I will cover Ultrasonic devices.
Thirty years ago a burglar would most likely encounter either a Photoelectric or and Ultrasonic device. Microwave and PIR technology was not considered stable enough to use in most applications. Therefore, the sensor of choice at that time, both residentially and commercially, was an Ultrasonic Device.
While they are not used extensively any longer, at least in new installations, there remain a relatively large number of them in place, especially in in very old installations.
While they are not used extensively any longer, at least in new installations, there remain a relatively large number of them in place, especially in in very old installations.
This means that if a burglar intends to break into a very old library or museum, he should at least be aware of what an Ultrasonic device looks like, and how they work.
The Ultrasonic device has a transmitter and a receiver. The transmitter emits an ultrasonic signal into an open area, and the receiver does just as it would seem—it receives. Once activated, if the pattern of signals received changes, an alarm is generated.
The older style Ultrasonics were generally about nine inches in length, and were mounted on the ceiling or high on a wall. You can identify these sensors because they possess two holes, which are generally protected by a plastic grille. Never are these holes fully covered.
Some of the newer Ultrasonics are small enough to be fitted into a standard-sized switch box, and mounted flush on the wall. Still, the two sensor holes are visible.
The upside of ultrasonic devices (as a security device) is that they are very difficult to beat, at least if entering after alarm system has been set. Supposedly a person can hold bed sheet or blanket and walk behind it. I wouldn't take that sort of chance.
One thing that does seem to work is extremely slow movements. Again, that is not a practical mode of attack.
I think a more sensible approach would be stuff cotton into the grille of both transmitter and receiver in order to absorb the signals and prevent them from reaching the threshold necessary to generate an alarm. However, such an attack must be made prior to the break-in. I have not tested this, but I think it ought to be a reasonable approach.
One of the most common applications of Ultrasonic devices is in the stand-along security devices. Not many professional installers use Ultrasonics in new custom installations. There are a couple good reasons they are not used.
First of all, they are relatively expensive. PIRs are less costly and therefore more frequently employed.
Second, they draw a lot of power. That means they are not practical for wireless installations. The wireless systems almost always employ PIR sensors.
A third reason that the Ultrasonic devices are not typically used in professionally installed systems is that they tend to be prone to false alarming. If employed in a monitored alarm system, Ultrasonics can run up substantial costs in fines that are typically charged by municipalities for false alarms.
One element to consider here is the use of Ultrasonic technology combined with Microwave in dual-technology applications. These do exist, and are very difficult to circumvent. Still, such sensors are not commonly used, particularly in small business and residential applications.
One element to consider here is the use of Ultrasonic technology combined with Microwave in dual-technology applications. These do exist, and are very difficult to circumvent. Still, such sensors are not commonly used, particularly in small business and residential applications.
If a system is not tied into a monitoring agency, then false alarms are not the problem that they are otherwise.
Bottom line: If a system has been professionally installed in the past fifteen years, my estimate is that there is only a very slight chance that it will employ an Ultrasonic device.
As is the case always, it is important that a burglar familiarize himself with an alarm system before every attempting an attack.
On the other side of the equation, the owner of a protected home or business can thwart even an educated attack on their alarm system by never talking about the components used in it, and by limiting access to it by others. Furthermore, the owner of an alarm system should always employ secondary interior devices that are not obvious, such as a protected interior door, an under-carpet pressure-sensitive mat, or a stress sensor. I will discuss those sensors in later segments.
* * *
(Feb. 24) Segment 4: Not another article about interior protection!
I know that eventually I will need
to move on. But, since I am have devoted the past two weeks on defeating
electronic interior security devices, I might as well stay on this topic at
least for another week (or more).
If we go to the movies, or watch
TV, we have all seen a burglar spray canned smoke into a protected area to see
if there is electronic protection. And when the smoke hits the beam it is
reflected off the smoke much like the beam of a flashlight would be.
Generally the “trap” does not
consist of a single shaft, but rather a whole labyrinth of crisscrossing beams
of energy.
Well, I have designed thousands of
systems, but none of them utilized this type of technology.
That is not to say that it doesn’t
exist, because there is not good reason why it should not. While the reason
that I have not run into it is not clear to me, I would assume that its
application is rare primarily due to cost of installation, and it relative
ineffectiveness.
I have designed and implemented
some of the most sophisticated systems in use, and yet I have never used this
technology. While it not logical for me to conclude that just because I have
never seen this technology used for security, that it is not to be found. But
it is reasonable to conclude, from what I have seen at all the security trade
shows I have participated in, and all the systems I have designed or installed,
that a burglar will likely never run into such a hybrid system. However, I cannot
guarantee it.
But there are a few additional
types of interior equipment a burglar needs to be aware of. And the one I will
discuss in the remainder of this post is by far the most common: Pulsed
Infrared. This technology is more commonly referred to by designers and installers
as “Photoelectrics.”
In fact, I think that it is the
photoelectric technology that movie directors are thinking about when they
depict the sensors I described above.
These sensors require a sender and
a receiver. These devices can be located between one foot to one-thousand feet
apart. In fact, they actually can be positioned in such a way that they create
a labyrinth not unlike the one described above. The main difference is that if
you spray canned smoke into the field, you won’t locate their positions.
This is how they work. The sending
device transmits a short burst of infrared energy every couple of seconds, or
sometimes less. That energy is registered by the receiving device. As long as a
regular pattern of bursts is detected, the device does not transmit an alarm.
If something passes between the
sender and receiver, the pattern is interrupted, and the alarm is activated.
To make this more complicated, the
packet of energy can be reflected by a series of mirrors, thus creating a
“wall” or a labyrinth of protection. The major difference between this type of
device, as opposed to what you see in the movies, is that there is no good way
to determine the pattern. This makes defeating this protection very difficult.
On the bright side, in the real world,
elaborate walls of protection seldom are installed.
Generally, the application
consists of a single or double beam system. And, generally the lower beam
passes eighteen inches or so above the floor.
So, once you determine the height
of sender and receiver (keeping in mind that a mirror or mirrors must be
regarded in this equation), you know that the beam cannot possibly be lower
than the lowest portion of the device, nor higher than the highest. It would be
physically impossible for that to be the case.
That means, in almost all cases it
would be possible for a burglar to crawl under or over the pulsed infrared
system.
If you are a business or home
owner, and you are now concerned about the level of protection you have
purchased, consider having your contractor add an additional level of interior
protection—one not visible. And keep this in mind: I have not provided any information to an intelligent burglar that he did not already have, or could have figured out. All I have really done is educate consumers as to what a security system might be lacking.
* * *
(Feb. 17) Segment 3: Another way to Circumvent Interior Burglar Protection
(Feb. 17) Segment 3: Another way to Circumvent Interior Burglar Protection
The
standard type of interior protection implemented in standard residential and
commercial security systems are of two types: Passive infrared sensors, and
Dual-Technology sensors. (I explained the difference between the two in Segment
Two of this series.)
To utilize this attack, you must be able to
access the sensors prior to intended circumvention.
Due
to the nature of the devices, to activate they require an unfettered “view” of
surroundings, at least that is the case for the passive-infrared portion of the
dual-technology sensor.
Therefore,
if you cut a piece of white paper to the size of the IR portion of sensor, and
tape it over the IR lens, it will incapacitate the sensor. That is because an
activation of the sensor requires both sensors, simultaneously. Standard copy
paper does not allow infrared energy to pass through it, therefore it serves as
a very effective filter, and thwarts the operation of the sensor.
Please note that the microwave part of the sensor is not affected by the filter--you must make certain that you cover only the PI portion.
Attack
method—inexpensive, simple, yet effective.
* * *(Feb. 10) Segment 2: Circumventing Interior Burglar Protection
(Keep in mind as you begin reading this series, there will be a total of ninety-nine segments to this blog, with one more being added every Monday. Please also note that the segments will appear in reverse order.)
(Just a note: In the first book of my Getting to Know Jack series (Jack and the New York Death Mask) I take Jack step by step through a successful break-in of an upscale home with a radio-monitored burglar alarm system.)
In almost every burglar alarm
application, the design incorporates two principal levels—perimeter protection,
and interior protection. (Please note: more sophisticated alarm systems have
additional levels of protection. I will cover them later.)
That means, if a burglar is able to
get past the perimeter sensors, the interior protection should catch him—at
least that is the plan.
By far the most commonly installed
interior electronic security protection devices today are Dual Technology sensors.
These units generally employ both infrared sensing capability, along with microwave
sensors.
The infrared sensor detects the
motion of a large heat-emitting object (something that generates infrared
energy). Generally that would be a human being. The microwave aspect of the
device, on the other hand, functions in much the same way as does radar. It
sends out a burst of microwave energy, and then waits for it to bounce off moving
objects, and back to its antenna (similar to what happens in a speed trap).
When operating independently, both
technologies are substantially susceptible to false alarming. But when placed
together in the same enclosure, and with an alarm condition generated only when
both technologies are triggered at the same time, the chances of a false alarm
are greatly mitigated.
Some of these devices allow for the
fine calibration of each of the technologies for particular applications. But,
even though that level of engineering is built into these devices, it is seldom
used. What happens in the field is that the settings are generally set to
“medium” sensitivity, with no fine-tuning attempted.
That means that (in most cases) all a burglar
would have to do to defeat the sensor would be to raise the temperature in the
protected area above 98.6F. This works because an infrared sensor is seeking to
find the motion of a heat-generating mass approximating that of a human being,
and if it cannot differentiate between the temperature of a wall, and the mass
in motion, that sensor will not activate. And unless both the microwave and the
infrared sensors are activated at the same time, an alarm will not be
generated.
I have witnessed this phenomenon
on numerous occasions and know it to be the case. I have tested systems in
unoccupied offices during summer months, and was physically unable to trip the
interior sensing device because of ambient heat.
The security solution: Heat
sensors able to detect temperatures of 90F and above. These are a good idea
even apart from their security value. The finishes on furniture can crack, and
computers crash, in high heat. These heat sensors are not to be confused with
135F sensors used in fire systems.
Because it takes a long time to build up sufficient heat in a home or office, if a sensor notified the alarm company when the temperature reached 90F, then preemptive action could be taken.
Next week I will discuss a second
method of circumventing both stand alone infrared sensors, as well as most (if
not all) DualTec devices. (Note: All three of my books in the Getting to Know
Jack series (Jack and the New York Death Mask, Murder on Sugar Island, and
Superior Peril) will be available free as Amazon Kindle downloads on February
14 through 16. Remember that you don’t have to have a kindle reader to read
Kindle books. Amazon has a free application for both PC and Mac.)
(Feb. 3) Segment 1: Entering through Garage Service Door
* * *
While this method of entry (through garage service doors) is very effective, it might not work every time—and if it does, it might require the use of additional measures to actually enter the home.
Most burglars already recognize the fact that one of the very easiest ways to gain entry into a home is through the rear garage service door. Of course, this works only in the case of an attached garage. If there is no garage, or if the garage stands apart from the home, this method of entry would not apply.
If there is no rear
service door, then the front one will do. Almost all attached garages have at
least one service door in the event of a power outage. When the power goes out,
the electric garage door will not work, and the homeowner needs some means of
getting back into his house.
One reason this
type of entry is relatively easy is because generally the locking hardware used
on the garage entry doors is of lower quality than that used to secure the
inner door.
Interestingly, most
alarm companies, for various reasons, do not protect the garage service doors. Sometimes
they are left unprotected so that deliveries can be made into the garage
without activating the alarm system. Plus, not protecting these doors saves
money on installation.
A burglar should
check out in advance to determine whether or not these doors are protected. He
can determine this by looking for the contact or the magnet. If the door is
hardwired, then he might look for the contact on the surface of the jam,
usually on top. If it is wireless, the transmitter should be obvious.
Sometimes the
contact is buried into the jam itself. If this is the case, then he will see a
3/8th or 7/8th inch round plastic cap in the jam. As I
said before, most garage service doors are not protected.
Also, most such
doors hinge in. That means that you can slide a screwdriver between the jam and
the door, and force the latch open. If there is a dead bolt, this technique
will not work exactly the same way. Often, if there is glass in the service
door, it is single thickness. If so, you can remove the glass, reach through
and open the door.
The value of this
method of entry is threefold. First of all, there might be many things worth
stealing in the garage itself, such as expensive mountain bikes, camping equipment,
etc. Also, once a burglar has gained entry into the garage, the noise that will
be generated by attacking the better locking hardware generally installed on
the inner door will not be heard or seen from the outside.
Finally, while it
is virtually certain that the inner door will be equipped with alarm hardware,
often there is an attic access in the garage. So, the burglar can simply go up
into the attic in the garage, and then move over in the open attic until above
the master bedroom, and there knock a hole through the drywall and drop into
the bedroom (this will be covered in another segment).
Well, that’s it
for this week. I will blog the second installment next Monday.
Introductory Overview
One of the questions you might want to ask me is this, “What qualifies you to write this blog?”
You might be disappointed to learn
that I am not a professional thief.
We are all aware of the many fine
articles and even books that have been written over the years by reformed burglars
describing the tricks they have used to bypass burglar alarm systems. Well, that's not who I am.
I come at the issue from a
different direction. For over thirty years I designed alarm systems—thousands
of them.
Some of my larger customers have included
fortune fifty corporations and the US Military. But not all the systems I
designed were that sophisticated. I have protected thousands of private homes,
families, and small to medium sized businesses.
Through coming weeks you will find
that not every circumvention applies to every application. That is, I may
present a means of defeating a particular alarm system, or a particular component, under a specific set of
circumstances; but these procedures might not work at all in a different
scenario.
That is, each case is unique. If
you take the information I provide and try to use it in the field, and you get
caught, I take no responsibility for your legal fees or lost income.
In fact, the purpose these posts are not to make a burglar better. Rather they are intended to educate the homeowner or
business owner. In other words, if you own an alarm system such as I describe,
and you think it has vulnerabilities similar to those I point out, then you
should consult your alarm contractor to make sure the issues are corrected.
Besides, if you currently have a
suspect alarm system, you can be fairly certain that a good burglar already
knows all the weaknesses inherent with it.
My plan is to introduce one new
security circumvention each week, for ninety-nine weeks.
In many of the cases the
information I provide will be very specific. That is, I may describe how a
single component can be successfully attacked, as opposed to an entire system. In
fact, in most instances that will be exactly how I present it. That way I will
not give away too much general information at any give time.
There will, however, be times that
I will cite specific cases which I have witnessed. In some of those instances I
may follow an entire burglary attempt from beginning to end.
As you follow this blog, you
should feel free to ask questions. In some cases I may choose not to respond (if
I suspect that additional information might not be appropriate). However, in
most cases I will try to answer your questions.
My intention is to present a fresh
article every Monday morning. Of course, there may come times when I will be
unable to complete my task for one reason or another. But, unless something
comes up (such as illness or holiday), you can pretty much count on a new
article every Monday morning.
The first such entry will be
blogged on February 3, 2014.
Join me then.
And, if you enjoy a good crime
story, with believable characters, then you should get to know Jack Handler
better. Jack is the main character in my “Getting to Jack Series.”
So far I have published three Jack
Handler novels: “Jack and the New York Death Mask,” “Murder on Sugar Island,”
and “Superior Peril.”
All three are available on Amazon,
both in print and as a Kindle book.
I have three more Jack Handler
books on the way, one (“Superior Intrigue) will be published in February of
this year, the second (“Sugar Island Girl, Missing in Paris) in late April, and
the third (not yet titled) will come out in June of this year.
I hope you enjoy this blog, and that you get to
know Jack.
