How Infrared Door Sensors Become a Secret Entry Point

The infrared sensor on your perimeter door might be the easiest way in.

Most perimeter doors use an infrared sensor on the inside to detect people walking up to exit, and automatically unlock for them. It's a convenience feature most building owners never think twice about. The problem is that with a can of compressed air and a small gap between the doors, that same sensor can be triggered from the outside. In the short video below, we show exactly how it works and what to do about it.

Watch the full conversation

Why this matters

A locked door feels like a closed door. That's the whole point of having one. But the locking mechanism is only one piece of a working perimeter, and on a lot of commercial buildings the weakest piece isn't the lock at all. It's the exit sensor that was added for convenience and never thought of as a security control. When that sensor can be tricked from the outside, the lock might as well not be there.

This isn't a theoretical problem. It's one of the more reliable ways our physical security testers get into client buildings, and it works against organizations of every size, including ones that have invested heavily in access control elsewhere.

How the bypass works

Most automatic exit sensors are passive infrared. They watch for movement and heat signatures on the inside of the door, and when they see something approaching they signal the lock to release. The assumption baked into the design is that nothing on the outside can reach the sensor's field of view.

That assumption falls apart if there's any gap between the doors, between the door and the frame, or under the door itself. A short blast of compressed air through that gap is enough to cause the temperature change the sensor is watching for. The sensor reports motion, the lock releases, and the door opens from the outside as if someone were walking up from the inside. There's no force involved, no tool that looks suspicious, and no trace left behind.

What to do about it

There are two ways to close this gap, and either one works. Pick whichever is easier to implement on your building.

Elimina