RIT Secrets

For my entire life, I have always liked the thrill of getting in to places where I'm not supposed to be, seeing behind the scenes and looking at all the subsystems that make things and places tick. There are lots of really cool things to see, and you can learn a lot of things about something by examining how it works. I love the thrill of acting like you belong specifically for the purpose of gathering information. It feels like I'm a spy, or a bad guy without actually being a bad guy, or like you're part of a unique club that gets to see the "other side" of things we use every day. I also just love exploring, and the feeling that you get from being in a seldom used part of a building that's also somehow neglected.
RIT is a big college, and I've spent a long time exploring some of the behind-the-scenes stuff, because I love being in places that I'm not supposed to be. There won't be a lot of pictures, because when I go places it's suspicious to take pictures. I will provide diagrams and references when possible.
I think it goes without saying, but don't try any of this unless you're willing to risk getting kicked out, arrested, or both. I've tried this, and there's never really anything all that interesting in these places. I do it for the thrill, not looking for anything in particular, and I certainly never steal anything. Be careful, be quiet, and don't get caught. In particular, DO NOT USE THIS INFO TO GET INTO A DORM!!! Seriously, that is the worst thing you can do. It's creepy, illegal, and if you even think about doing this you are a garbage person, and are the reason women at RIT don't feel safe.
Before I talk about where you can go, I need to talk about how to get there. Let's talk about entry methods.

Entry Methods

Just walk in

A lot of places you can just walk right in if you act like you know what you're doing. It's really just that simple. If you look confident, you will get where you want to go. Bonus points if you dress for the job.
One of the most successful ways that I found to get into places you want to be is to act like you work for ITS. Nobody is going to question you if you look like you're doing IT work. Wear business casual: a collared shirt and khakis. If you carry some tech-related stuff with you like a generic Dell Latitude laptop, networking cables, or even more bonus points if you carry a netscout or other network test gear. You can always say that you are troubleshooting the Wi-Fi network, and nobody will question you.
If you really want, you can create a fake ITS name badge. I made a template in Microsoft Word, and I just put my real name on there, there's no reason hiding your name if you get caught, since you'll still get questioned by campo. Here's a template for the ITS name badge. Make sure you get the dimensions right, it's about 1.5 inches by 3 inches and it's backed with plastic so it stays away from your shirt. You can probably find blank name badges at Staples and glue the paper label to it if you are so dedicated. If not, just sticking the name tag to your shirt should work just fine.

If you don't want to look like ITS, or you want to look like someone from another department, make sure you study their uniforms, what they carry, and where they go. ITS is just the easiest to look like, and since most people don't understand what they're doing it's pretty easy to just do whatever you want and go where ever you want.
Using this method, I was able to get into President Munson's office (While he was out, of course). It's actually pretty boring, there's nothing exciting up there and also the Sentinel doesn't look like a man riding a horse from up there either.

Breaking and Entering

Don't damage any property when trying to get in to places you're not supposed to be. Not only does it increase the likelihood that you will get caught, but it also increases the likelihood of you getting kicked out of the school if you do. So, instead, you can try some non-destructive entry methods. Lock picks and bypass tools are really useful, but can be suspicious if you aren't careful or if someone sees you. Also to be wary of is alarmed doors. There are a few of these at RIT, and I will talk about them later.
Lock picks
If you aren't extremely skilled at picking locks (Like LockpickingLawyer level), you won't have any success at RIT. They use high-security locks on every door. Seriously. Especially on classrooms and labs where there's stuff to protect there are absolutely advanced locks protecting that stuff. I'm not super into lock stuff, but every single lock at RIT is master keyed and uses security pins so it's really difficult to pick. Trust me, I've tried.
Decoding master keys
It's not really possible, unfortunately. I've done research and it actually seems like RIT has specialized blanks for all their keys. I know it sounds weird, but there is absolutely no way to buy blanks for the keys RIT uses. I've asked some licensed locksmiths if they can copy the keys, they contacted Schlage to ask for the blanks, and were told they were proprietary security keys that couldn't be purchased. If you want to spend thousands of hours designing and CNC cutting a few blanks, I think you are way ahead of anyone else, and may be putting too much effort into something that's not worth it!
Lock bumping
If you don't know about lock bumping, it's basically a way of getting in to a lock that exploits tolerance issues in how the lock is constructed. I'm not an expert in exactly how it works, but you can use a key with all max cuts, and then hit it in just the right way as to get the lock to open. It's really challenging, and the lack of available key blanks for the doors at RIT makes it nearly impossible. I was able to acquire a spare key for an unrelated door at RIT, and then file it down to all max cuts, and then attempted to unlock a door by bumping. I was able to do it once, but it was extremely difficult and took a long time, making a lot of noise in the process. The second time I tried to open the same lock by bumping, I messed up some how and ended up jamming the lock in a half-open state. I just walked away from that situation, and have not tried bumping since. I would VERY MUCH not recommend trying to bump locks, since it resulted in disaster for me, and will maybe result in disaster for you if you try it.
Bypass tools
This is where stuff gets interesting. I'm going to give bypass tools their own section.

Bypassing security

There are absolutely ways to get around some of the "advanced" security that RIT has on it's doors. In particular, I want to talk about a specific example that happened to me one time.
One time a few friends and I were attempting to get into a conference room for a meeting, and we were told that the one person who had swipe access to the room was unavailable for a while. This specific conference room is in the MAGIC center at RIT, a brand-new building that uses extremely complex security systems and touts itself as being the most high-tech building at RIT. After panicking for a bit, we figured we should figure out a way to get into the room so that we can get our meeting started. I, being familiar with bypassing the systems involved here, stood up from eating my dinner, and jammed a plastic fork into the door latch. We were able to open the door, because the locks do not use dead-latches at RIT since they are all magnetic locks.
Bypassing the magnetic locks
Unfortunately for RIT (But fortunately for me, I guess), almost all doors with swipe access at RIT are able to be opened with some simple bypass tools. In particular, I really like the Traveler's Hook for the simple reason that it's just so darn effective. RIT doesn't use the correct strike hardware for all of its doors, and the travelers hook vulnerability works on about 85% of all doors at RIT. I guess it's just how the security system works. If you want to seriously embarrass RIT, continue to exploit this vulnerability. Seriously, RIT is a brand-ambassador for Lenel, who provides the magnetic swipe system that RIT uses, and they often show it off to other companies. If their installation is found to be faulty it would be a huge embarrassment to RIT and Lenel.
Bypassing mechanical locks
There are a million ways to bypass mechanical lock systems. Most times, the traveler's hook works just fine on any door, but sometimes you need other methods. Methods that I've tried that worked include:

• Shoving plastic trash into the latch
• Plastic forks (See above)
• Piano wire (To reach around plates meant to fix the travelers hook problem)
• Someone leaving the door unlocked
• Pushing on the door frame to disengage the dead latch

While I said before that the locks that RIT uses on its doors are secure, the way they mount their doors leaves them open to some serious security vulnerabilities.
Now, some of these exploits don't work on other doors, mainly those in colleges or for labs, and some labs don't use magnetic swipe readers at all. Those doors you can basically forget about going through.

Security Systems

Unfortunately, a LOT of rooms and labs at RIT feature advance security systems. These rooms you can basically forget about getting in to. These rooms are typically accessed by multi-factor methods, meaning you need a card swipe AND enter a numeric code on a nearby keypad. Double unfortunately is that all the codes are unique per card swipe, and rooms that feature this form of multi-factor authentication cannot be opened with an allswipe card (Talked about below).
Also featured around RIT are a bunch of security cameras. These cameras are not perfect by any stretch, and some buildings don't have them. There are NO hidden security cameras anywhere, all of them are really easy to see if you just look. If you can't see a security camera, make sure you look around and double check to make sure none of them can see you.
Fortunately, most rooms that aren't alarmed are the ones that are actually interesting -- meaning those rooms you can't get into through normal means, and we'll talk about those types of rooms later.
A quick rule of thumb for avoiding security systems is: Does the room contain computers, tools, or lab equipment? If so, then the room probably has a security system.

Swipe cards

There's actually 3 different types of swipe cards that RIT uses: Employee cards, Student IDs, and Administrative cards. The 3 different types of cards are actually pretty similar in how they work. Specifically, the only difference between the cards is the ID number and auth code that's stored on them.
Student IDs
If you've ever explored the raw data on your student ID you may be familiar with the formatting of the ID. In particular, the data is basically just your student ID + "=" + The issue number + and then a 3 digit auth code. For all student cards, the auth code is 047, and the issue number is the number of times your ID card has been re-issued, starting at 0 for the first ID and 1 for the second. The re-issue count is actually listed on the back of your ID, just below the "Issued:" date in the bottom right corner. All-in-all, an example of the data encoded on the card for a student would be:
650356985=0047
(That's not actually a real student ID as far as I know, I just pressed random buttons on my keyboard)
Employee IDs
The RIT employee IDs are a lot different than the student IDs. They typically have the same formatting on the mag-stripe, but the ID number, issue number, and auth code are all different. I mean, you can't use a meal plan if you're an employee, so of course they are different. I have not been able to explore the RIT employee ID cards because I am not an RIT employee, but I would assume that the data on the cards is all unique per employee.
Administrative Cards
Administrative Cards are a Lenel specific feature. They can do things like re-program certain readers and other stuff like that. Fortunately for security, RIT has disabled most features of Administrative Cards. There is a feature that RIT uses a lot, though, mainly for Public Safety and FMS and that is All-swipe cards. They are also referred to as all-access cards, allswipe cards, administrative access cards, emergency cards, and more. Everyone I've talked to calls them allswipe cards. They can open most card swipe doors on campus (Besides those that have multi-factor authentication like I talked about before). Unfortunately, allswipe cards are VERY heavily regulated. I have done a bit of research into them, and I was able to find some very important information that may help in the future.
In particular, the ID number on the allswipe card I researched was 012345678, The issue number was 0 and the auth code was 000.
These cards are HEAVILY restricted, and if you use one you WILL be kicked out of RIT. They have done it before, and they will probably do it again if you get found out. I have never done it, and I will never do it. Seriously. All use of these cards is logged and reviewed and if they notice a discrepancy I am sure they will investigate.

To be quite honest, that's really about it. If you can't get somewhere through easy means, figure it out. Look for security systems, and use a travelers hook.

Places to go

There's lots, actually. I'll talk about the best places I've been and what I've found here. For some of these, I will NOT disclose room numbers, exact locations, or methods I used to get in. If I don't list this information, it's most likely because the room contains dangerous stuff, like exposed electrical systems, asbestos, or machinery.
I'll be giving each place 3 scores: Difficulty getting there, how cool it is, and how risky getting in there actually is. Each of these will be out of 5.

The Asbestos Room

RIT used to be covered in asbestos, like everywhere. Back when RIT had to remove all the asbestos, they were not able to get rid of all of it for some reason. So, over the past many years RIT has slowly been taking care of some asbestos one room at a time. Of course, you legally cannot dispose of asbestos without paying extremely high disposal fees, so RIT literally just puts it all in one room in the basement of RIT. I think it goes without saying but you really shouldn't visit this room and for that reason I won't be listing how to get there or exactly where it is, but it's behind another locked door. It's literally filled with boxes of asbestos ceiling tiles, packaged and sealed containers filled with other asbestos-related stuff, and that's really about it. It's a pretty cool place, actually, but please don't go here.

Scores
Coolness: 2/5
Difficulty: 3/5
Risk: 5/5

E-Waste Recycling room

In Institute hall, there is a "hidden" recycling room that you can get to via an unlocked door next to the back elevator. This is the same elevator you would normally take to get to The Construct. It's on the ground floor, and it's very obviously labeled as "Recycling" so it's pretty easy to find, and it's directly next to the back door for the building. Once you get there, there's a blue bin to the left that will be filled with lots of IT related stuff from the server room in the basement, or a few of the nearby colleges. You can find all kinds of cool stuff in here. I've found music CDs, working Dell laptop docks and chargers, cables, working small-form-factor PCs, and even a whole racks worth of fully functional servers that were just thrown out. I've gotten a LOT of cool stuff from here, and I continue to go back to check stuff out every so often. It's also a useful place if you want to properly get rid of your old e-waste stuff, since you can just throw it in the bin and then leave. I think they empty the bin every Thursday morning, since I've seen a truck for an e-waste company outside of Institute on Thursdays, and the bin usually seems to be empty afterwards. The only real risk if you go here is that someone might tell you to get out, but I've been there digging through the bin while employees were actively moving stuff around the room, and have even been told I needed to leave by campo only because they were closing the building. I don't think students are explicitly allowed to be there, but I don't think anyone cares, either. Just please don't let this room fall to the Tragedy of the Commons like happened many years ago with other recycling rooms.

Photos

Scores
Coolness: 4/5
Difficulty: 1/5
Risk: 2/5

FMS Headquarters

There is a really weird FMS "Headquarters" in the tunnels underneath the engineering building. Sometimes they will just leave the door open and you can walk in, but other times the doors are locked. There's not much interesting in here besides some spare parts for various fixtures around the academic side of campus, an office with some posters on the wall listing labor laws, a tool rack, a bunch of older promotional signs for stuff around campus, and some chairs. It's kinda boring, but it's kinda cool to go there just because it's there.

Scores
Coolness: 1/5
Difficulty: 3/5
Risk: 4/5

Bone Room

RIT has a bone room/body freezer. This is in the sub-basement of the science building. You used to be able to get here fairly easily, but the problem is it's in a high-traffic area where you are easily spotted picking or bypassing locks. Additionally, there is no swipe card, and the strike plate is correctly fitted so you cannot bypass the lock. I think it is also alarmed, and there are cameras down there. I was able to go down there with a friend who had reason to be there, and it's extraordinarily creepy. On the wall, they have written or listed the names of every body that has been used for science at RIT, bones, specimens for biology classes, and other science gear. It also used to be a fallout shelter, but I guess it is no longer designated for that purpose, since the signs that were down there have since been removed. It goes without saying, do not go down here unless you are authorized to be down here.

Scores
Coolness: 5/5
Difficulty: 5/5
Risk: 5/5

Munson's Office

Munson's Office is boring. It looks exactly like what you would expect it to look like, honestly. There are some bookshelves with stuff on them, and a desk with a lamp on it and a name badge that says "President Munson". In the corner, there are some flags, but that's really about it. The sentinel does NOT look any more coherent from the window, either. I give it a 2 in coolness only because it's somewhat cool to be in the president's office without beingr in trouble. I was able to walk in there disguised as ITS, and I told them that I was troubleshooting a report of an access point being down in the area, and needed to get access to his office to test for signal strength. They just let me in. It's a bit harder to get up there outside of normal hours, since the elevator requires a cad swipe to use. This might be bypassable with firefighter's keys, but I did not explore that option.

Scores
Coolness: 2/5
Difficulty: 3/5
Risk: 1/5

NRH Mechanical Room

NRH has a mechanical room underneath the building. It's boring, but it does have a controller for the elevator, along with a listed phone number for the elevator's emergency phone. There's also some stuff for the cellphone transmitter site on top of the building, but it's just a fiber connection and some RF gear. There's documentation from Verizon and AT&T in binders, but I did not look at it since the area is kind of high-traffic so I wanted to get in and out as quick as possible. The door is usually unlocked, but if it's not you can slide a piece of trash into the latch and bypass the lock with ease.

Scores
Coolness: 1/5
Difficulty: 1/5
Risk: 2/5

Theaters

There are a few theaters around campus, and they are extremely easy to get inside of. Once you're in there, you can watch movies on the big screen so I gave it a 3 for coolness. The worst thing that can happen if you get caught is they tell you to leave. People use them for all kinds of unauthorized purposes all the time, so there's no risk to being in there. You can also just reserve one for free online if you want to actually host an event without risk of being told to leave.

Scores
Coolness: 3/5
Difficulty: 1/5
Risk: 1/5

Scores
Coolness: 0/5
Difficulty: 0/5
Risk: 0/5

Scores
Coolness: 0/5
Difficulty: 0/5
Risk: 0/5

---