8 ms·

Training is very important in duress systems. I once worked in a place with a keypad duress code on the security system. If you prefixed your security PIN with

Training is very important in duress systems. I once worked in a place with a keypad duress code on the security system. If you prefixed your security PIN with NN-, it was the duress version of the code and would trigger a silent alarm. This was setup long-ago, and not communicated. One night, the keypad was acting glitchy. Partially out of frustration (countdown is running), and partially to test, I ended up accidentally engaging the duress code by tapping a convenient corner number, which resulted in NNNNNNNNN-PIN. After law enforcement had surrounded the building, a quick chat and search alongside a few officers got it all sorted.

dheera 5y ago
An interesting way to use this PAM-Duress system would be to write a program that (a) begins recording your microphone and webcam video immediately upon login (b) Aggressively try the hell out of every passwordless Wi-Fi network it can detect, then use headless chrome to aggressively smack every button to get past the stupid login pages (c) Stream that video and audio to a server that saves it.
- unglaublich 5y ago
  or use a cellular network
- dredmorbius 5y ago
  Use Emergency SOS on your iPhone https://support.apple.com/en-us/HT208076 https://support.apple.com/en-us/HT208076
  - emmelaich 5y ago
    There's also (for Aus users), Emergency+ https://play.google.com/store/apps/details?id=com.threesixtyentertainment.nesn&hl=en_AU&gl=US https://play.google.com/store/apps/details?id=com.threesixty...
    - __d 5y ago
      Also for iOS https://apps.apple.com/au/app/emergency-plus/id691814685 https://apps.apple.com/au/app/emergency-plus/id691814685
- Sebb767 5y ago
  > begins recording your microphone and webcam video immediately upon login If your camera has an activity light, this might inadvertently worsen your situation.
  - dheera 5y ago
    Just disconnect the light
    - techrat 5y ago
      > Just disconnect the light Thanks, I'm cured. 1) A lot of laptops are sealed with glue. "Just disconnecting the light" would involve prying layers apart. 2) Companies may frown upon that if you should try to modify a company issue laptop. 3) Disabling a recording indicator may be illegal where you live.
      - dheera 5y ago
        1) Put a tiny dot of Black 2.0, not very noticeable and blocks the light very well. 2) Don't do personal stuff on your company laptop. If the company doesn't let you modify it, joke's on them, only company files will get leaked. Your personal stuff shouldn't be on that laptop. 3) Fuck that, if there are photons you can collect them Worst case just do the microphone only.
sokoloff 5y ago
I had a similar false trigger trying to make an international call from our office phones. I didn’t know the exact incantation of the prefix, but knew it was 9 for an outside line and at home I used 011 then the country code. That didn’t seem to work, so I thought maybe I needed to drop the zero, resulting in me inadvertently dialing 911 and hanging up when that didn’t give me the dial tone I expected. I found the right sequence and was interrupted multiple times in the call as our floor fire coordinator showed up, then a few minutes later facilities, then a few minutes later local police. I guess the system worked and I never forgot the correct prefix after that.
- SamBam 5y ago
  I always find it crazy when systems make you dial 9 for an outside line, for this very reason. Did the same thing myself my first week in college. Got the police. Told them what I did and I could hear the eye-roll on the other end of the line, and was told I was the third person that day.
  - moftz 5y ago
    We stopped extensions since there were multiple exchanges being used on campus so you have to dial someone's entire number. But, you will have to dial 9 and 1 and then the number. Everyone has externally accessible phone numbers so why are we still dialling 91 when youve got to dial the whole thing anyway?
  - benelvin 5y ago
    I'd always assumed (UK) that 9 was a deliberate choice to make it easier to dial the emergency number, 999, because you can just mash 9 until something happens. I guess if it's the same number in all other countries who have a range of emergency numbers, then that might not be the reason.
    - jtnag 5y ago
      My working theory is that in old times phones had rotary dial instead of key pad. Number 1 was the longest to dial, 9 was the shortest (as I remember from childhood days). Thus, fastest way to dial 3 digit code was to use numbers with as much as 9 as possible (997,998,999).
gorgoiler 5y ago
Out of interest, were you arrested? As part of a duress protocol — where your extortioner is likely observing you — law enforcement would be required to go through the motions of arresting you and taking you offsite. You can expect to be held for X hours regardless of whether they believed you had simply made a mistake. Long and unavoidable administrative delays make it much harder for villains to subvert protocols. See also time-delay bank vaults and mandatory two-week vacations for pension fund managers, where they are locked out of corpnet.
- oasisbob 5y ago
  No arrests. False alarms on silent alarm systems are common. Other factors made it clear that a real threat was unlikely. All orgs should consider locking out all employees for at least one uninterrupted week a year. Very easy way to shake out all sorts of problems.
  - matrixagent 5y ago
    > All orgs should consider locking out all employees for at least one uninterrupted week a year. Very easy way to shake out all sorts of problems. Could you give some examples?
    - JulianMorrison 5y ago
      IIRC, over here, banks are required to give employees at least one two-week contiguous block of leave, during which they can't get into the office, use work systems, or log in remotely. The idea being that oh-so-clever scams generally require the operator to be there keeping all the balls in the air, and locking them out will reveal their tricks.
    - solatic 5y ago
      Mostly cases where businesses rely on individuals instead of process. As a simple example, it's very easy, when starting a company, to issue personalized email addresses to early employees and then people communicate using those email addresses. It's perfectly fine to email the CTO at first-name@example.com, because everyone knows everyone else and it works. As you grow large, it becomes important for people to address roles rather than individuals. This way, if people leave their role, they can (semi-transparently) be replaced by someone else taking that role who will then continue to receive all of the same emails, be able to respond to them, etc. So then it becomes important to have e.g. a cto@example.com address. When the CTO takes a vacation, their email gets routed to someone taking over their duties, you don't need to communicate to everyone to start emailing somebody-else@example.com instead.
Cthulhu_ 5y ago
I found out the hard way that a job I had once (DIY store) had a hidden panic button under the counter. I was just fidgeting while we were closing up, hands found it and did their exploration thing. I mean it happens, the security company sent out a van already (as they should) and called to confirm. They charge a fee (just over €100 I believe? Or €250? I forgot) for false alarms, but that's fair enough. Better safe than sorry. Anyway, a DIY store with at most 100K in the safe (weekly takings at the time, most of that was probably electronic) is probably a lot less serious than whatever you were working for, to have it surrounded by law enforcement.
unixhero 5y ago
Is it really called "duress systems"? I work in the IT security field and have never heard that term :)
- nuvious 5y ago
  Author here; it relates more with physical security and I've used them in the military and in corporate structures. Most duress word programs are designed to be spoken; say security calls because an alarm is set off and the aggressors are coercing you to get the security off their backs. One may say, "Sorry I was working late and fumbled the alarm. Mr. Rogers has a board meeting tomorrow so I've been working late," where Mr Rogers is a fake name of no one that works at the company. I kinda just thought to turn that concept into a PAM as a thought-experiment mostly but there are some edge case security examples where something like this could be useful, say for journalists or when dealing with corporate espionage.
  - unixhero 5y ago
    I see, thanks a lot for your clarification.

dheera 5y ago

An interesting way to use this PAM-Duress system would be to write a program that (a) begins recording your microphone and webcam video immediately upon login (b) Aggressively try the hell out of every passwordless Wi-Fi network it can detect, then use headless chrome to aggressively smack every button to get past the stupid login pages (c) Stream that video and audio to a server that saves it.

unglaublich 5y ago
or use a cellular network
dredmorbius 5y ago
Use Emergency SOS on your iPhone https://support.apple.com/en-us/HT208076 https://support.apple.com/en-us/HT208076
- emmelaich 5y ago
  There's also (for Aus users), Emergency+ https://play.google.com/store/apps/details?id=com.threesixtyentertainment.nesn&hl=en_AU&gl=US https://play.google.com/store/apps/details?id=com.threesixty...
  - __d 5y ago
    Also for iOS https://apps.apple.com/au/app/emergency-plus/id691814685 https://apps.apple.com/au/app/emergency-plus/id691814685
Sebb767 5y ago
> begins recording your microphone and webcam video immediately upon login If your camera has an activity light, this might inadvertently worsen your situation.
- dheera 5y ago
  Just disconnect the light
  - techrat 5y ago
    > Just disconnect the light Thanks, I'm cured. 1) A lot of laptops are sealed with glue. "Just disconnecting the light" would involve prying layers apart. 2) Companies may frown upon that if you should try to modify a company issue laptop. 3) Disabling a recording indicator may be illegal where you live.
    - dheera 5y ago
      1) Put a tiny dot of Black 2.0, not very noticeable and blocks the light very well. 2) Don't do personal stuff on your company laptop. If the company doesn't let you modify it, joke's on them, only company files will get leaked. Your personal stuff shouldn't be on that laptop. 3) Fuck that, if there are photons you can collect them Worst case just do the microphone only.

sokoloff 5y ago

I had a similar false trigger trying to make an international call from our office phones. I didn’t know the exact incantation of the prefix, but knew it was 9 for an outside line and at home I used 011 then the country code. That didn’t seem to work, so I thought maybe I needed to drop the zero, resulting in me inadvertently dialing 911 and hanging up when that didn’t give me the dial tone I expected. I found the right sequence and was interrupted multiple times in the call as our floor fire coordinator showed up, then a few minutes later facilities, then a few minutes later local police. I guess the system worked and I never forgot the correct prefix after that.

SamBam 5y ago
I always find it crazy when systems make you dial 9 for an outside line, for this very reason. Did the same thing myself my first week in college. Got the police. Told them what I did and I could hear the eye-roll on the other end of the line, and was told I was the third person that day.
- moftz 5y ago
  We stopped extensions since there were multiple exchanges being used on campus so you have to dial someone's entire number. But, you will have to dial 9 and 1 and then the number. Everyone has externally accessible phone numbers so why are we still dialling 91 when youve got to dial the whole thing anyway?
- benelvin 5y ago
  I'd always assumed (UK) that 9 was a deliberate choice to make it easier to dial the emergency number, 999, because you can just mash 9 until something happens. I guess if it's the same number in all other countries who have a range of emergency numbers, then that might not be the reason.
  - jtnag 5y ago
    My working theory is that in old times phones had rotary dial instead of key pad. Number 1 was the longest to dial, 9 was the shortest (as I remember from childhood days). Thus, fastest way to dial 3 digit code was to use numbers with as much as 9 as possible (997,998,999).

gorgoiler 5y ago

Out of interest, were you arrested? As part of a duress protocol — where your extortioner is likely observing you — law enforcement would be required to go through the motions of arresting you and taking you offsite. You can expect to be held for X hours regardless of whether they believed you had simply made a mistake. Long and unavoidable administrative delays make it much harder for villains to subvert protocols. See also time-delay bank vaults and mandatory two-week vacations for pension fund managers, where they are locked out of corpnet.

oasisbob 5y ago
No arrests. False alarms on silent alarm systems are common. Other factors made it clear that a real threat was unlikely. All orgs should consider locking out all employees for at least one uninterrupted week a year. Very easy way to shake out all sorts of problems.
- matrixagent 5y ago
  > All orgs should consider locking out all employees for at least one uninterrupted week a year. Very easy way to shake out all sorts of problems. Could you give some examples?
  - JulianMorrison 5y ago
    IIRC, over here, banks are required to give employees at least one two-week contiguous block of leave, during which they can't get into the office, use work systems, or log in remotely. The idea being that oh-so-clever scams generally require the operator to be there keeping all the balls in the air, and locking them out will reveal their tricks.
  - solatic 5y ago
    Mostly cases where businesses rely on individuals instead of process. As a simple example, it's very easy, when starting a company, to issue personalized email addresses to early employees and then people communicate using those email addresses. It's perfectly fine to email the CTO at first-name@example.com, because everyone knows everyone else and it works. As you grow large, it becomes important for people to address roles rather than individuals. This way, if people leave their role, they can (semi-transparently) be replaced by someone else taking that role who will then continue to receive all of the same emails, be able to respond to them, etc. So then it becomes important to have e.g. a cto@example.com address. When the CTO takes a vacation, their email gets routed to someone taking over their duties, you don't need to communicate to everyone to start emailing somebody-else@example.com instead.

Cthulhu_ 5y ago

I found out the hard way that a job I had once (DIY store) had a hidden panic button under the counter. I was just fidgeting while we were closing up, hands found it and did their exploration thing. I mean it happens, the security company sent out a van already (as they should) and called to confirm. They charge a fee (just over €100 I believe? Or €250? I forgot) for false alarms, but that's fair enough. Better safe than sorry. Anyway, a DIY store with at most 100K in the safe (weekly takings at the time, most of that was probably electronic) is probably a lot less serious than whatever you were working for, to have it surrounded by law enforcement.

unixhero 5y ago

Is it really called "duress systems"? I work in the IT security field and have never heard that term :)

nuvious 5y ago
Author here; it relates more with physical security and I've used them in the military and in corporate structures. Most duress word programs are designed to be spoken; say security calls because an alarm is set off and the aggressors are coercing you to get the security off their backs. One may say, "Sorry I was working late and fumbled the alarm. Mr. Rogers has a board meeting tomorrow so I've been working late," where Mr Rogers is a fake name of no one that works at the company. I kinda just thought to turn that concept into a PAM as a thought-experiment mostly but there are some edge case security examples where something like this could be useful, say for journalists or when dealing with corporate espionage.
- unixhero 5y ago
  I see, thanks a lot for your clarification.