Unlocking a door with Windex

Thread Starter

strantor

Joined Oct 3, 2010
6,875
You ever get a random memory, something you haven't thought of for years, just slam into your prefrontal cortex out of nowhere with full force, and then stay there all day occupying your conscious thought? Well, Story time...

Once upon a time (2005-2006?) a friend and I were walking drunk down a long hallway in a militarily barracks. I was drunk, he was beyond wasted. I was walking him to his room because I didn't trust he would be able to get there on his own despite it being a mere walk down a straight hallway. He could barely walk. Along the way, he tripped over flat ground and slammed into a door, forcing it open and falling inside. It was a janitorial supply closet. When I peeled him up off the floor he had a bottle of windex in his hand. He refused to put it back so we continued on our journey with the windex.

The door locks in the barracks used mag stripe keys like a credit card. Not NFC like hotels have now. The kind where there's a slot and you stick the card into it about 2" and if it's the right card then then it beeps twice, green LED flashes, and the bolt turns. If it's the wrong card you get one long beep and a red LED flashes.

After passing a couple of rooms my friend decided it would be cute to start spraying the windex into people's card slots. I feebly tried to stop him but the more I opposed him the more adamant he was about escalating his windex shenanigans. Honestly I didn't try very hard to stop him because in my own 19y/o drunken stupor I thought it was hilarious. After spritzing a half dozen or so card slot he paused on one random door and just kept. on. spraying. Over and over and over, he emptied at least half a bottle of windex into it. He did it long enough for it to get old and no longer amusing so I reached out to grab him by the collar and drag him the rest of the way to his room but before I could pull him away though, the door unlocked. The full sequence; beep beep, flash flash, ka-thunk goes the dead bolt. We both stared at it for several seconds dumbfounded and then he looked at me with a face that advertised an unhealthy kind of mischief. Then in one fluid motion he grabbed the handle, opened the door, and barged inside. With an equal amount of grace I yanked him back out of the room by his neck and slammed the door as quietly as anyone has ever slammed a door. I then dragged/pushed/pulled him the rest of the way to his room faster than two drunks ought to be able to shuffle. Nobody ever came out to see what all the commotion was about.

At the time it was a good enough explanation for me that he simply shorted something out. But now years later I've learned enough to make me think that something like this shouldn't have been possible. Say he created a short past the transistor that switches power to the coil, that might have caused the bolt to turn, but I distinctly remember the beep beep and flash flash because it was dead quiet and I was getting nervous about the amount of noise he was making and right then the beep beep sounded and to me it seemed loud as an alarm. I knew whoever was inside (apparently nobody) had definitely heard it.

So as I said I've been pondering this all day.. trying to figure out exactly how that happened. I'm fairly certain windex didn't emulate an exact correct pattern of magnetically encoded data, so still it must have been a short, but how? Where? I've never taken apart anything like this but I'm guessing that if I did, I would find at least two different circuits; one for the mag stripe and one for the lock. The beep beep and flash flash must be part of the lock circuit; just a simple sequence carried out in response to a single signal from the mag stripe circuit, and that signal is what got shorted. Does that sound reasonable? If so, then it seems like a very poor design. Has anyone had one of these kind of door locks apart and could weigh in on this?
 

Ya’akov

Joined Jan 27, 2019
10,226
There are non-networked mag stripe locks like this one that depend entirely on local programming to determine the validity of card keys. Perhaps these locks were locally programmed and the subsystem that was supposed to verify the card simply sent a go-no go signal to the subsystem that operated the locking mechanism which might otherwise been remotely sent.

So what shorted out was the verification bit and it's signal was interpreted by the unaffected lock control bit as "go".
 

MrSalts

Joined Apr 2, 2020
2,767
I was drunk, he was beyond wasted. I was walking him to his room because I didn't trust he would be able to get there on his own despite it being a mere walk down a straight hallway. He could barely walk.
My first guess would be that your story was a dream that your brain decided to remember - because your brain doesn't make good decisions while you are drunk. There is lots of research and explanations about intoxication, memory (and false memories) and dreams. Your brain can store false memories caused by physical or psychological injuries ir lack of sleep as well.
 

JohnInTX

Joined Jun 26, 2012
4,787
It is likely that the conductive Windex got onto the board and provided a current path to the solenoid/motor driver.

For the locks I've been into, when the card is swiped, the first transitions from the head/amplifier wake up a microcontroller which validates the card and unlocks the lock. The locking mechanisms vary but usually a little solenoid or motor/rack and pinion gear setup will move a pin or shuttle to allow the handle to engage the strike when turned to open the lock. All very low power. When the handle returns to the normal position the pin/shuttle is moved back. For the pins, it's usually mechanical - a spring. For the gear motors you can hear the motor run again to move the shuttle back to isolate the handle from the strike.

The drivers are high gain for low-power operation and an external conductor like Windex is plenty to bias them ON if you get lucky.

A side note: I worked in the coin-op vending industry in the early days of the move from coins to mag cards and before the later, fully connected credit card operated machines. I was surprised that so much equipment came back 'salted' i.e. someone shoot a syringe-full of salt water into the various openings of the enclosure. When that contacted a PCB, electrolysis would destroy the traces, IC pins etc. I was told that some early electronic bill changers, controlled by relays and discrete logic - gates and flip flops, could be made to 'jackpot'. Salting the board would turn on the coin dispense motor and dispense all the coins in stock. The knowledge spread and took root. Decades later, we still got equipment of all kinds salted even though actual coins were long gone. If it looked like it might have money in it, it was a target.

Random discovery by tipsy sailors aside, it amazed me how that knowledge spread pre-internet through literally generations of petty thieves and persists decades after the original problem was fixed.
 

atferrari

Joined Jan 6, 2004
5,001
It is likely that the conductive Windex got onto the board and provided a current path to the solenoid/motor driver.

For the locks I've been into, when the card is swiped, the first transitions from the head/amplifier wake up a microcontroller which validates the card and unlocks the lock. The locking mechanisms vary but usually a little solenoid or motor/rack and pinion gear setup will move a pin or shuttle to allow the handle to engage the strike when turned to open the lock. All very low power. When the handle returns to the normal position the pin/shuttle is moved back. For the pins, it's usually mechanical - a spring. For the gear motors you can hear the motor run again to move the shuttle back to isolate the handle from the strike.

The drivers are high gain for low-power operation and an external conductor like Windex is plenty to bias them ON if you get lucky.

A side note: I worked in the coin-op vending industry in the early days of the move from coins to mag cards and before the later, fully connected credit card operated machines. I was surprised that so much equipment came back 'salted' i.e. someone shoot a syringe-full of salt water into the various openings of the enclosure. When that contacted a PCB, electrolysis would destroy the traces, IC pins etc. I was told that some early electronic bill changers, controlled by relays and discrete logic - gates and flip flops, could be made to 'jackpot'. Salting the board would turn on the coin dispense motor and dispense all the coins in stock. The knowledge spread and took root. Decades later, we still got equipment of all kinds salted even though actual coins were long gone. If it looked like it might have money in it, it was a target.

Random discovery by tipsy sailors aside, it amazed me how that knowledge spread pre-internet through literally generations of petty thieves and persists decades after the original problem was fixed.
With our training ship moored in Marseille, our consul in Paris received from the metro authorities a bag full of DRF mints that were sold in the onboard canteen.

Legend has it that their size exactly matched the metro's tokens. Creative crewmembers.
 
Last edited:
Top