Phreaking the memory care unit
March 17, 2024 8:22 AM Subscribe
I really want to know what Morse code has to do with it, other than perhaps having trained him to pay good attention to patterns in sound.
posted by hoyland at 9:17 AM on March 17 [4 favorites]
posted by hoyland at 9:17 AM on March 17 [4 favorites]
Yeahhh...I dunno.
If true, the story is pretty cool. But stuff just doesn’t add-up. The biggest problem for me is that numeric keypads for door locks aren’t (typically, if ever) DTMF systems. They aren’t sending signals for switching or routing. They’re simple keypads for entering a set numeric code to unlock a door. Any sound they make is normally a single simple beep. And it’s the same beep no matter which key you press.
But, let’s say the keypad was a DTMF system, I’m still not seeing how morse code training would make figuring-out the key combo at all possible. The two just don’t relate. He would still need to be familiar enough with DTMF to recognize which tones indicate which numerals, and that would be some really damned deep engineer nerdism to know that.
I think it’s more likely the guy simply saw a staff member enter the key combo.
posted by Thorzdad at 9:18 AM on March 17 [10 favorites]
If true, the story is pretty cool. But stuff just doesn’t add-up. The biggest problem for me is that numeric keypads for door locks aren’t (typically, if ever) DTMF systems. They aren’t sending signals for switching or routing. They’re simple keypads for entering a set numeric code to unlock a door. Any sound they make is normally a single simple beep. And it’s the same beep no matter which key you press.
But, let’s say the keypad was a DTMF system, I’m still not seeing how morse code training would make figuring-out the key combo at all possible. The two just don’t relate. He would still need to be familiar enough with DTMF to recognize which tones indicate which numerals, and that would be some really damned deep engineer nerdism to know that.
I think it’s more likely the guy simply saw a staff member enter the key combo.
posted by Thorzdad at 9:18 AM on March 17 [10 favorites]
Note the article's liberal use of that favorite Metafilter acronym, DTMF (although in this case it stands for Dual Tone Multi Frequency, the sounds associated with touch tone phones' keypads).
I also don't see what Morse Code has to do with any of this; I thought initially it was going to be how the couple communicated, secretly, in order to effect their escape; but it seems like a red herring here.
Morse Code anecdote from my own parents: my Dad knew it from Boy Scouts and the Army and my mom picked up enough that they said they communicated during church services (especially boring sermons) by tapping messages with their fingers into each others' palms.
posted by Rash at 9:25 AM on March 17 [14 favorites]
I also don't see what Morse Code has to do with any of this; I thought initially it was going to be how the couple communicated, secretly, in order to effect their escape; but it seems like a red herring here.
Morse Code anecdote from my own parents: my Dad knew it from Boy Scouts and the Army and my mom picked up enough that they said they communicated during church services (especially boring sermons) by tapping messages with their fingers into each others' palms.
posted by Rash at 9:25 AM on March 17 [14 favorites]
MeFi: Dual Tone Multi Frequency Already.
posted by The Bellman at 9:27 AM on March 17 [44 favorites]
posted by The Bellman at 9:27 AM on March 17 [44 favorites]
I also did not see any Morse code connection (they imply that the keypad beeps differently for each key, and he memorized the sound... using his military training in remembering codes, I guess.) But mainly I was surprised and heartened that the facility's response (at least as stated) is to increase residents' outdoor time rather than just more securely locking them in.
posted by evilmomlady at 9:35 AM on March 17 [12 favorites]
posted by evilmomlady at 9:35 AM on March 17 [12 favorites]
"Exit seeking behavior" is a hell of a phrase.
Uncomfortably reminiscent of Drapetomania.
I mean, I get that there are good reasons why people with severe memory impairment can’t safely be left to wander around on their own, but I am old enough to feel like this is mostly a sad story rather than a cute one.
posted by Horace Rumpole at 9:44 AM on March 17 [17 favorites]
Uncomfortably reminiscent of Drapetomania.
I mean, I get that there are good reasons why people with severe memory impairment can’t safely be left to wander around on their own, but I am old enough to feel like this is mostly a sad story rather than a cute one.
posted by Horace Rumpole at 9:44 AM on March 17 [17 favorites]
"Exit seeking behavior" is a hell of a phrase.
It’s the standard phrase to describe some memory-care patients’ actions. My mom went through a period of exit-seeking when she was in memory care. She’d stand at a door and just keep pushing on the crash bar to open it.
posted by Thorzdad at 9:58 AM on March 17 [6 favorites]
It’s the standard phrase to describe some memory-care patients’ actions. My mom went through a period of exit-seeking when she was in memory care. She’d stand at a door and just keep pushing on the crash bar to open it.
posted by Thorzdad at 9:58 AM on March 17 [6 favorites]
Depart This Medical Facility?
posted by GenjiandProust at 10:02 AM on March 17 [16 favorites]
posted by GenjiandProust at 10:02 AM on March 17 [16 favorites]
"The man said he 'previously worked with Morse code in the military' and was able to use this experience to learn the door code by listening as staff punched numbers into the keypad, documents state," per the Tennessean (the original report the FPP's Popular Mechanics article uses). Also, not all patients, or the elderly couple, got more supervised outside time: "The assisted living facility told state regulators it will prevent similar incidents by checking on residents more frequently and scheduling the man who escaped for 'walking time outside the facility with a staff member present,' according to state records." The escape happened in early 2021; within a year the facility, Elmcroft of Lebanon, transitioned to an American House Senior Living location.
posted by Iris Gambol at 10:45 AM on March 17 [12 favorites]
posted by Iris Gambol at 10:45 AM on March 17 [12 favorites]
Good to see that at least Iris Gambol didn't fail reading comprehension.
posted by The Ardship of Cambry at 11:04 AM on March 17 [3 favorites]
posted by The Ardship of Cambry at 11:04 AM on March 17 [3 favorites]
Eh, it's a broken-clock sitch. PM used the escape story for an interesting article on security: "Trained observers can deduce what people are typing on a computer keyboard just by listening to the keystrokes—specifically, how closely the strokes follow each other, says Vyas Sekar, an assistant professor of electrical and computer engineering at Carnegie Mellon University, home to the CyLab Security and Privacy Institute. It’s even possible to pick up what two people are saying in a conversation if they’re talking near a bag of potato chips, based on the bag’s vibrations" — that's wild. Nice find, latkes, thanks for posting.
posted by Iris Gambol at 11:26 AM on March 17 [1 favorite]
posted by Iris Gambol at 11:26 AM on March 17 [1 favorite]
I mean, what kind of trained observer? I type at over 100wpm if I'm really going. I'm not sure there is any information to be gleaned from listening to how close together my keystrokes are falling because often they're landing VERY close together all the time.
I have heard about the potato chip bag thing, usually done with a laser. They've been able to transcribe conversations in a room by reading the vibrations on a window caused by the speech.
posted by hippybear at 11:33 AM on March 17 [2 favorites]
I have heard about the potato chip bag thing, usually done with a laser. They've been able to transcribe conversations in a room by reading the vibrations on a window caused by the speech.
posted by hippybear at 11:33 AM on March 17 [2 favorites]
I go into memory care facilities regularly as part of my work. Probably been in every one in my city. It's common practice to have the 4-digit code printed on a label placed near the keypad and sometimes (rarely) right on it (although more commonly it's up on the header). Presumably, this works.
I remember once going to a place where there was a resident sitting in a chair in the small entry lobby. He was on the edge of the seat with his feet under his butt, rocking back and forth and ready to LAUNCH himself to the door when it opened. They kept a close eye on him but I'd bet he got out a few times. That is top-tier exit-seeking behavior.
posted by neuron at 11:34 AM on March 17 [2 favorites]
I remember once going to a place where there was a resident sitting in a chair in the small entry lobby. He was on the edge of the seat with his feet under his butt, rocking back and forth and ready to LAUNCH himself to the door when it opened. They kept a close eye on him but I'd bet he got out a few times. That is top-tier exit-seeking behavior.
posted by neuron at 11:34 AM on March 17 [2 favorites]
Besides the code posted next to the door some of these facilities have a fake bus stop right outside the door. When someone gets out they often get as far as the stop and just wait there for the bus.
I mean, what kind of trained observer? I type at over 100wpm if I'm really going. I'm not sure there is any information to be gleaned from listening to how close together my keystrokes are falling because often they're landing VERY close together all the time.
Usually this Information is in the context of passwords which generally aren't long enough to really get up to speed and consist of common words, numbers, and names.
posted by Mitheral at 11:54 AM on March 17 [2 favorites]
I mean, what kind of trained observer? I type at over 100wpm if I'm really going. I'm not sure there is any information to be gleaned from listening to how close together my keystrokes are falling because often they're landing VERY close together all the time.
Usually this Information is in the context of passwords which generally aren't long enough to really get up to speed and consist of common words, numbers, and names.
posted by Mitheral at 11:54 AM on March 17 [2 favorites]
It’s even possible to pick up what two people are saying in a conversation if they’re talking near a bag of potato chips, based on the bag’s vibrations" — that's wild.
Sekar is likely referring to The Visual Microphone: Passive Recovery of Sound from Video, a 2014 SIGGRAPH paper.
Sekar is likely referring to The Visual Microphone: Passive Recovery of Sound from Video, a 2014 SIGGRAPH paper.
When sound hits an object, it causes small vibrations of the object’s surface. We show how, using only high-speed video of the object, we can extract those minute vibrations and partially recover the sound that produced them, allowing us to turn everyday objects—a glass of water, a potted plant, a box of tissues, or a bag of chips—into visual microphones. We recover sounds from highspeed footage of a variety of objects with different properties, and use both real and simulated data to examine some of the factors that affect our ability to visually recover sound. We evaluate the quality of recovered sounds using intelligibility and SNR metrics and provide input and recovered audio samples for direct comparison. We also explore how to leverage the rolling shutter in regular consumer cameras to recover audio from standard frame-rate videos, and use the spatial resolution of our method to visualize how sound-related vibrations vary over an object’s surface, which we can use to recover the vibration modes of an object.posted by zamboni at 11:55 AM on March 17 [5 favorites]
Back in the day, telegraph operators could distinguish between other operators based on their "hand" (the timing/rhythm of dots, dashes, pauses, etc), which came in handy if you were an intelligence agency trying to establish a baseline pattern of life so you could identify when something exceptional was going on. It's possible based on the pauses between keys and many different people entering the same code gave enough information to narrow the possibilities down to just a few options, enough to try them all and make an escape.
posted by ndr at 12:38 PM on March 17 [3 favorites]
posted by ndr at 12:38 PM on March 17 [3 favorites]
Somebody's going to make a mint once they hit on the idea of an eldercare escape room franchise
posted by phooky at 12:49 PM on March 17 [13 favorites]
posted by phooky at 12:49 PM on March 17 [13 favorites]
Memories of AIT at Ft. Gordon signal corps school 1967. 8 hour days with headphones on listening to Morse code. Starts out slow and then speeds up in following weeks. Despite my resistance I became quite proficient. It may have factored in me being sent to Germany instead of Vietnam.
posted by Czjewel at 1:03 PM on March 17 [8 favorites]
posted by Czjewel at 1:03 PM on March 17 [8 favorites]
I think the DTMF thing is a bit of a reach on the part of the article writer. What seems more probable to me is that the man recognized the cadence of the keypresses and worked out what the sequence was. I've known some very elderly hams, and a bunch of them kept amazingly good at copying CW (= Morse code) even after other memories became less sure.
→
“fist” is the more commonly-used term, as in FISTS CW Club. It's described in heartbreaking detail in Leo Marks's memoir Between Silk and Cyanide: A Codemaker's War 1941–1945, where Marks and his colleagues can tell that their resistance agent embedded deep behind enemy lines has been captured because their first is completely different. The higher-ups, however, refuse to believe them, and keep sending agents over to their deaths.
posted by scruss at 1:13 PM on March 17 [11 favorites]
→
operators could distinguish between other operators based on their "hand" (
“fist” is the more commonly-used term, as in FISTS CW Club. It's described in heartbreaking detail in Leo Marks's memoir Between Silk and Cyanide: A Codemaker's War 1941–1945, where Marks and his colleagues can tell that their resistance agent embedded deep behind enemy lines has been captured because their first is completely different. The higher-ups, however, refuse to believe them, and keep sending agents over to their deaths.
posted by scruss at 1:13 PM on March 17 [11 favorites]
Not the same, but way back in the late 80s when I was in architecture school the few computers we had access to were very locked down so we wouldn't install stuff or go rifling through their HDs. Whenever we needed something fixed or configured, we had to call the IT guy and he'd unlock it, do whatever, then lock it again.
I performed a 'side channel attack' via the high-tech strategy of standing behind said IT guy, looking at the code he was typing, and memorizing it.
Boom, root access for me and my friends.
posted by signal at 1:46 PM on March 17 [3 favorites]
I performed a 'side channel attack' via the high-tech strategy of standing behind said IT guy, looking at the code he was typing, and memorizing it.
Boom, root access for me and my friends.
posted by signal at 1:46 PM on March 17 [3 favorites]
The DTMF theory is highly suspect. Far more likely the resident simply watched and memorized a code, but I would give that equal odds with the the resident coincidentally activating a delayed egress system when trying to exit. These buildings also frequently misuse bypass systems, so if someone told me the access control was disengaged at the time of egress I would believe that without batting an eye.
I can also confirm what neuron said about the codes being pasted right next to the keypads. That's incredibly common, although often the code is actually the reverse of what is posted. Staff turnover in these facilities is so high that administration doesn't even try to get people to memorize codes.
posted by forbiddencabinet at 1:55 PM on March 17 [3 favorites]
I can also confirm what neuron said about the codes being pasted right next to the keypads. That's incredibly common, although often the code is actually the reverse of what is posted. Staff turnover in these facilities is so high that administration doesn't even try to get people to memorize codes.
posted by forbiddencabinet at 1:55 PM on March 17 [3 favorites]
I'd also lay odds on the code being one of [0000, 1111, 1234].
posted by signal at 1:57 PM on March 17 [5 favorites]
posted by signal at 1:57 PM on March 17 [5 favorites]
I could see maybe the rhythm of keypresses giving some clues. Doot doot doodoot probably means the third and fourth digit are the same, so there's 1000 possible variations to guess instead of 10000. (That's still a lot of guessing though...)
posted by Foosnark at 2:05 PM on March 17 [1 favorite]
posted by Foosnark at 2:05 PM on March 17 [1 favorite]
The keystroke timing analysis is based on some research from the turn of the century related to SSH password attacks. That research was built on the fact that key timing analysis had been used to determine specific users, much like scruss's comment on Morse code operators.
All of this is based on the rhythm of key presses, and Morse code is fundamentally about the rhythm of long and short beats. The original documents do not mention anything about beeps.
At the memory care unit where I worked, the key combo was the 4-digit address of the place.
My biggest ethical dilemma in memory care was that the many residents did not want to be there. You may think there's some kind of competency hearing before you are locked into one, but there isn't. I don't doubt that this individual or any of the people I cared for needed help, but even the best places aren't where I would choose to live.
posted by betaray at 2:30 PM on March 17 [4 favorites]
All of this is based on the rhythm of key presses, and Morse code is fundamentally about the rhythm of long and short beats. The original documents do not mention anything about beeps.
At the memory care unit where I worked, the key combo was the 4-digit address of the place.
My biggest ethical dilemma in memory care was that the many residents did not want to be there. You may think there's some kind of competency hearing before you are locked into one, but there isn't. I don't doubt that this individual or any of the people I cared for needed help, but even the best places aren't where I would choose to live.
posted by betaray at 2:30 PM on March 17 [4 favorites]
listening to the keystrokesAdvantage #47 of typing on a Dvorak keyboard. My typing doesn't sound like a normal person's.
posted by Hatashran at 3:49 PM on March 17
I mean, what kind of trained observer? I type at over 100wpm if I'm really going. I'm not sure there is any information to be gleaned from listening to how close together my keystrokes are falling because often they're landing VERY close together all the time.
In addition to timing, the space bar usually makes a sound that's distinctly different than other keys. To a lesser extent and depending on the keyboard, the same can be true of other keys that are larger than 1u and might have different kinds of springs or supports. It's also true that there's variations in how hard someone might strike a key, depending on hand position and what came just prior, and that can affect the sound.
Generally speaking, I don't think we're talking about real-time analysis, but given an audio recording, there's a wealth of information to pick apart there. Typing very quickly is not an impediment.
posted by vibratory manner of working at 3:55 PM on March 17
In addition to timing, the space bar usually makes a sound that's distinctly different than other keys. To a lesser extent and depending on the keyboard, the same can be true of other keys that are larger than 1u and might have different kinds of springs or supports. It's also true that there's variations in how hard someone might strike a key, depending on hand position and what came just prior, and that can affect the sound.
Generally speaking, I don't think we're talking about real-time analysis, but given an audio recording, there's a wealth of information to pick apart there. Typing very quickly is not an impediment.
posted by vibratory manner of working at 3:55 PM on March 17
“ At the memory care unit where I worked, the key combo was the 4-digit address of the place.”
I met this guy here in San Francisco back in the 90’s, who would sneak into big office buildings downtown during the first dot com boom, find an empty cubicle with Ethernet, plug in his laptop and cruise the web. He never got caught. And he said it was really easy. Network passwords and generic user IDs were easy to guess. Getting through the front door? It was the number address of the building. I think that must be a universal code.
posted by njohnson23 at 3:56 PM on March 17 [5 favorites]
I met this guy here in San Francisco back in the 90’s, who would sneak into big office buildings downtown during the first dot com boom, find an empty cubicle with Ethernet, plug in his laptop and cruise the web. He never got caught. And he said it was really easy. Network passwords and generic user IDs were easy to guess. Getting through the front door? It was the number address of the building. I think that must be a universal code.
posted by njohnson23 at 3:56 PM on March 17 [5 favorites]
I think the article obscures the attack method. Many keypads make slightly distinct clicking sounds on the different keys, sometime strikingly so. Just the mechanical mechanisms (especially as they age and the more common keystrokes wear faster than the unused ones). I'd be willing to believe that this is what the gentleman heard.
posted by meinvt at 5:53 PM on March 17 [2 favorites]
posted by meinvt at 5:53 PM on March 17 [2 favorites]
The staff has since revised the residents’ care plans with more outdoors time to decrease the “exit-seeking behaviors,” the state report says.I guess that's something.
posted by Not A Thing at 6:11 PM on March 17 [1 favorite]
An easy attack on a button-press lock dealio (security jargon—sorry) is to look at wear patterns on the keys. This can greatly reduce the search space for the code, especially with Simplex locks which can’t repeat a key. You can help this along by putting dry-erase marker on all the buttons and inspecting it after someone goes through. Just because the guy’s memory is failing doesn’t mean he has to tell them the method he actually used…
posted by Gilgamesh's Chauffeur at 8:41 PM on March 17 [4 favorites]
posted by Gilgamesh's Chauffeur at 8:41 PM on March 17 [4 favorites]
Lots of valid doubt in this thread but at least one of the memory care facilities my mom was in had a key pad that sounded different tones for each number, so I could definitely see the dude memorizing the tones.
posted by latkes at 9:37 PM on March 17 [4 favorites]
posted by latkes at 9:37 PM on March 17 [4 favorites]
I am reminded somehow of the 'security motor' in the Selectric.
Wonder if you could crack the code with an oscilloscope. (Don't they usually have oscilloscopes in memaory care units? :)
posted by MtDewd at 5:07 AM on March 18
Wonder if you could crack the code with an oscilloscope. (Don't they usually have oscilloscopes in memaory care units? :)
posted by MtDewd at 5:07 AM on March 18
I really want to know what Morse code has to do with it
help me rhonda yeah get em out of the ward
posted by snuffleupagus at 11:16 AM on March 18
help me rhonda yeah get em out of the ward
posted by snuffleupagus at 11:16 AM on March 18
Getting through the front door? It was the number address of the building. I think that must be a universal code.
High security places /hamburger use either the year or the year the system was installed.
posted by Mitheral at 2:12 PM on March 18 [1 favorite]
High security places /hamburger use either the year or the year the system was installed.
posted by Mitheral at 2:12 PM on March 18 [1 favorite]
My aunt developed dementia and was in a really good care facility. There was one of those accordion-style gates, with a foot or so open at the top. In her 80s, she climbed out. so badass.
posted by theora55 at 5:46 PM on March 18 [2 favorites]
posted by theora55 at 5:46 PM on March 18 [2 favorites]
If you're in Canada, you'd be amazed at the number of places that use 2112. I got a job once from guessing the building code when the interviewers forgot to buzz me in. They thought I was some security super-genius.
posted by scruss at 7:27 PM on March 19
posted by scruss at 7:27 PM on March 19
« Older Geddy Lee's Effin' Life live on stage | Voyager 1 sends readable message to Earth Newer »
This thread has been archived and is closed to new comments
posted by srboisvert at 9:12 AM on March 17 [34 favorites]