12

I remember when I was a kid and was waiting for someone in a long hall, there was a motion sensor and security panel by the door. To kill time, I would go away from the door, then try to move so slowly the sensor couldn't detect me differentially (I figured out it works that way) - aiming to stealth walk to the door, pretending I would disable the security then. When I made a mistake, I could see corresponding LED light go on on the control panel.

Now later on I was thinking about the slow movement. What I would pick a laser, infrared I assume, and slowly - just as I moved slowly when playing - increase the power to the point where the sensors on the detector reach saturation (they couldn't measure any higher value)? My expectation is that if I mounted such laser safely and disable the sensors this way, I could then just walk around the place without disturbing the alarm.

After my evil deed was done, I could even re-enable the alarm the same way, leaving quite a mystery for the investigators.

Is my expectation correct? I know there are other motion sensors than infrared ones, but they really aren't that common. So this is about active and passive IR sensors only (if anyone didn't get it from the text above).

  • It depends on which kind of motion sensor you're trying to crack. Most of them are passive IR sensors and measure body heat, and I'm pretty sure your laser would be either ineffective or even counter-productive by triggering the sensor. Idk for other types of sensors. – André Borie Apr 14 '16 at 15:24
  • Based on @AndréBorie's insights into IR - If lasers wouldn't work, how about a hair dryer on the end of a pole? Assuming your evil deed can be accomplished with slightly more involved setup? – Dave Apr 14 '16 at 23:17
  • I meant IR lasers - those emit the same radiation as your body does. – Tomáš Zato Apr 15 '16 at 7:49
14

I wrote the security technical advisor to the movie Sneakers, Mr John Strauchs. Sneakers includes a scene where intruders increase the ambient temperature of the room in order to defeat the IR motion sensors. John wrote the technical details of that scene (including the purposeful errors).

John is a former operations officer at the CIA, and designs security systems for major locations around the world. This is a synopsis of what he had to say.

There are a couple factors to consider in your IR laser scenario.

First, is the complexity of the sensor itself. Top-of-the-line sensor units are a cluster of multiple sensors (up to 16) that create different zones to monitor. If you want to blind this type of unit, you would need to blind all 16 sensors. Cheap sensor units have only one sensor, and manufacturers break up the field into zones using physical means. One need only blind the one sensor in a cheap model.

Second, is the nature of the IR laser itself. It would have to mimic the IR signature of the thermal energy in the sensor zone it was in when you first turned it on. The IR signature would have to match everything between the sensor and the barrier in that zone. You could obtain this with an IR camera and some fancy math to program the laser, but it would be tricky, if not impossible, assuming you could get the IR laser to even produce a signature something close to the thermal equivalent to room temperature. To have this level of control this would require a near-weaponized level of complexity in an IR laser. In short, using a laser would be the easiest way to trip the sensor, not blind it.

John says that this is unnecessary, though, if you have close physical access to the sensor when it was off. A simple silicone spray will blind the sensor, and is invisible to the naked eye. It leaves a trace, but it might not be discovered until much later, if at all. Alternatively, you could place glass in front of the sensor when it was off, which would do the same thing. Glass and silicone sprays block the IR wavelength bodies emit.

That last piece of advice is the kicker for defenders. PIR sensors need to be inspected regularly, and even opened to see if glass or plastic was inserted inside the unit. Sometimes contractors will "tune" the unit by putting plastic inside to make the unit less sensitive. Always test PIR units by doing boundary tests, not by waving your hand right in front of it.

TL;DR:

It depends on the sensor manufacturer, and you would need a weaponized IR laser to even attempt this. Inspect your PIRs frequently for glass, plastic, and coatings, and test frequently using boundary tests, not waving your arms in front of it. You get what you pay for in sensor units.

  • I thought the sensor compares differences between frames, not the first frame when it was turned off. How else it would be possible to walk undetected when moving slowly? I assume this also depends on sensor type. – Tomáš Zato Apr 16 '16 at 10:28
  • @TomášZato they also detect changes within the zone from one set of milliseconds to another – schroeder Apr 16 '16 at 16:21
  • That's exactly what I originally assumed. Both your reply and your comment indicate that you didn't understand my question - I only accepted your answer because I failed to find anything better on Google. – Tomáš Zato Nov 30 '16 at 8:47
  • @TomášZato uh, thanks, I guess? Like I say, I have the technical info you would require. If you could better explain your question, I could provide a better answer. – schroeder Nov 30 '16 at 17:26
  • I do not see, what is there to explain. I explicitly described that I was about to increase the gradually from zero to maximum output (saturation). If you did not understand that, please propose edit to my post that explains it better. – Tomáš Zato Dec 1 '16 at 1:12
1

Your approach reminds me of a really interesting talk at the Blackhat 2013 about defeating physical security measures. There it was demonstrated that some PIR motion sensors can be turned off by using a lighter from medium or low distance. To get closer to the sensor you can use some kind of 'shield' which has room temperature and blocks your body heat.

I think your laser approach could work if the laser emits similar energy as a lighter even from higher distances. However this is very hardware dependent so you must try it by yourself.

Personally I'd rather try to tamper the keypad, RFID reader or whatever is needed to disable the system completely while it's unarmed since this scenario is only feasible for targeted attacks because I must know the type of the system and the type and position of all sensors anyway. This implies that I already need physical access for recon.

  • You have 90 seconds to tamper the keypad before the alarm goes off in most setups. Most companies I've been to are protected with four to six digit code. They have own UPS and both the control panel and the UPS is within the controlled region. – Tomáš Zato Apr 15 '16 at 7:52
  • Since I have to recon the location anyway I would manipulate the keypad while the system in unarmed. There are many ways to get the entered pin from a keypad. It's just a matter of time. – Noir Apr 15 '16 at 8:12
  • Shields have a low chance of working, because they might block IR sources in the room, and end up tripping the alarm. – schroeder Apr 15 '16 at 22:29

protected by Community Aug 26 '17 at 12:50

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.