Threat Level: green Handler on Duty: Didier Stevens

SANS ISC: InfoSec Handlers Diary Blog - SANS Internet Storm Center InfoSec Handlers Diary Blog

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
ISC StormCast for Friday, June 14th 2013

When Hotel Alarms Sound

Published: 2013-06-14
Last Updated: 2013-06-14 01:19:09 UTC
by Richard Porter (Version: 1)
10 comment(s)

I often wondered what an 'average' reaction would be to a fire alarm sounding in a hotel. My question was answered a couple of weeks ago in misty San Franscico, CA. It was checking into SANSFire 2013 here in muggy Washington, DC that made me think to post this. Before I tell the story it would be good to give out the simple template I follow every time I check into a hotel.

The Basic Plan

1) Plan and Walk my Exit Route

2) Locate Nearest Fire Extinguisher (if one is installed, not so often anymore)

3) Pick a spot for key items in hotel (Tablet, Laptop, Cell Phone)

These are simple things that if walked through once should aid a late night wake up call from a fire alarm when that collides with drowsiness.

What Happened

At 1222AM an alarm sounded at my hotel in San Francisco and I executed basic plan for egress. I was stunned at how few people were leaving hotel rooms. Some had heads peaked out of rooms looking to see if perhaps others were leaving or if they maybe "had" to leave?

When I got down stairs (Yes stairs, I did see one person staring at the elevator) this is what I was met with:

T+5 min

After about 45 minutes and hotel staff walking the floors and then instructing everyone to wait in the lobby, this was the result:


So the moral of this story is have a plan. Even though this was most obviouly a false alarm, I always treat them as if they are real.


Signing off from DC SANSFIRE 2013!

Richard Porter

@packetalien richard at isc dot sans dot edu

10 comment(s)
Diary Archives