start	end	text
36590	40630	Most locks are not engineered to supremely high tolerances.
40630	44970	Most locks look, and this is exaggerated, something like this.
45330	49270	Imperfections in the machining process leave those pinstack cylinders
49270	53250	out of alignment. And any slight deviation
53250	56670	in that alignment means that when you torque the plug
56670	61150	there's really only one pinstack binding at any given time.
61370	65270	This is what makes picking possible at its most basic level.
65270	68690	Because if you apply a little bit of pressure on that plug
69270	71530	you can do what's called setting a pin.
72790	76450	See we're going to torque this and if you reach in there and start pushing on
76550	79690	a pinstack, eventually you'll reach the right height
80230	84090	and the pin will clear. The shear line is met and it'll spin.
84470	87550	Now granted there's not a single pinstack
87550	90750	in a lock, there's a row of them, but because
90750	94150	you notice when it clears this is holding up the driver
94910	99430	that driver is now out of the equation. That driver pin will not slip back down.
99570	102930	You can keep pressure on this plug and go through the stacks
102930	107390	one at a time, setting them and opening the lock. It looks a little like this.
108190	111390	A tool called a torque wrench is put in and a little bit of pressure is put on
111390	114370	the cylinder. A pick tool, in this case we're just
114370	117370	doing pin by pin picking, goes in you reach, you reach, oh here's one that's
117370	121790	binding. When we set it, it clicks. Keep reaching, keep reaching, and oh
121790	125170	there's another one. I feel it binding. That plug will click a little more and a
125170	128850	little more and eventually you can have them all one at a time
128850	132550	open. This is not not complex. It's not in the
132550	135510	same order every time because those imperfections, remember they're not
135510	138250	planned, so which pinstack is binding in which
138250	143090	order always varies, but the principle is the same.
144230	148190	And everyone give me some some goodwill and let's kick it off the right way.
148190	151150	Hopefully not have a demonstration effect hit us and let's see what we can
151150	155770	do with this lock in front of us here. Is that in pretty good focus with my
155770	158170	craptacular webcam setup?
163590	167930	What I'm using is called a jackknife set. It's a nice little compact job.
167930	171730	I think the Irvine guys have these here this year. Anybody checked out the
171730	175030	vendor areas? Irvine Underground has their spread of tools out there.
175410	179150	Yeah, good guys. So this is, this is your basic
179150	183770	cheap master lock. You'll find I beat up on master a lot in this talk,
183770	186970	not because they make the worst locks out there, but, you know, they're
186970	188690	definitely in the business of it.
190850	194310	But honestly, I mean, we'll cover later a lot of what, you know, Mark was saying
194310	196090	and how many people were at the last talk?
196090	199590	The ethics of full disclosure. So you realize a lot, you know, can you really
199590	202270	blame companies for making crappy locks if the
202270	205450	consumers continually buy them? And can you blame the consumers really
205450	207730	for buying crappy locks if they don't know they're crappy?
208550	212210	Exactly who's to blame is, is really kind of up in the air, but one thing is for
212210	215590	sure, these aren't really the most skillful locks ever.
218670	220250	Yeah, so the lock is open now.
225320	230660	Thank you. That, that's as simple as it is. Literally, you just reach in
231700	234240	a little bit. This is that, this is that torque wrench I was showing you here.
234240	237420	Are we still in frame? There we go. This is, this torque wrench just slips
237420	242300	right down in the keyway. A little bit of torque and pushing those
242300	245460	pins up. We're going to do a hands-on session when all this is done, by the
245460	248160	way. I invite people to come and actually try this. You'll,
248160	250220	you'll be amazed how easy it is. Question?
253100	257380	Yeah, so everyone has their own technique that they like. In fact, you'll see some
257380	260360	people like to put the torque wrench up in the top of the keyway.
260620	263340	Mouse, you like that. Some people seat it down low.
263700	267280	I tend to just hold it right in my hand, just let the, the torque wrench give
267280	269220	pressure this way, because as I mentioned,
269220	272860	the two biggest mistakes people make when they're first practicing this, when
272860	276700	they first want to get into it, is too much effort. Some people put too
276700	279480	much pressure on the wrench, which just means the pins are going to
279480	283800	jam so hard you can't push them. And some people push the pins so far up
283800	287920	that the driver clears and then the key pin goes up into the
287920	290520	shear line and get, you fault, you set it way too high.
290520	293760	The only way is to release pressure, let them all drop and try again. Like,
293760	297300	the way I try to describe it to people, imagine you,
297300	301480	well, could be applicable here. You just woke up, you're still hung over,
301480	305880	you just smoked a fat cannon, and you're like 10 times more mellow than that.
305880	309620	Like, dial it down a lot if you try to pick locks and it's not working for you
309620	312680	when we're doing the hands-on thing. Chances are it's the lightest amount of
312680	316600	pressure you could ever need. And that's really, there's, there's not
316700	321260	a whole lot to it. That's the basics. So, how do we, how do we make locks
321260	323960	better? How, how is a lock, you know, everyone's
323960	326800	going to say, well, crap, I have locks like this, am I at risk? No, you're not
326800	329120	really at risk. There are better locks out there.
329320	332960	No one talks about this stuff, so no one buys them, but there's a whole lot of
332960	337340	high-end features that locks can encompass, and I will cover them now.
337920	341540	There's things called secure pins. There's a lot of other advanced features
341540	344960	that specialty locks have in them. First, let's talk about secure pins a
344960	348540	little bit. This is our same design, the same pin
348540	351580	stack, but you notice the driver is a different shape.
351580	354920	This is called a mushroom top pin or a mushroom driver, and you can,
354920	357440	you can really just picture it, how pretty easily, if you were to try to
357440	360120	torque this, that's going to bind up on the lip. It's
360120	363080	going to get in your way. It's going to be just a real disaster to try to pick
363080	367580	that. It's, it's a real headache. Another type of specialty pin is what's
367580	369980	called a spool pin. They can have a notch that's big or
369980	373120	small cut into it. Spool pins are even trickier,
373120	377160	because you get the sensation of clicking and set it. You're like, oh, I
377160	381520	felt it move. I must have set something. No, you really didn't. If you ever have a
381520	383740	lock that you keep trying and trying and trying it, you're like, what the hell is
383740	385940	wrong with this? You may have a spool pin in there.
386780	390440	If you want to defeat high security pins and the other kind of,
390440	393700	there's another called serrated pins. They just jam on everything, and they're
393700	397320	just kind of a bitch. Yeah.
398120	401120	If you want to defeat any type of, you know, if you want to pick, usually you'll
401120	403040	use a tension wrench that looks like this.
403040	406740	They're usually called feather wrenches. It's the very, very light
406740	409780	amount of torque, the lightest amount you could ever imagine.
411280	416340	Hey, what's going on, priest? No problem. Bring him on in. We're having a good time.
423490	426530	Hey, with this being such a long talk, are you going to do a spot the Fed maybe
426530	433350	in the middle of it, if we want to break it up some? So yeah, if you use a very,
433350	445180	very light touch on the wrench, you can actually force the pin stack. Yeah,
445180	448280	there's some seats up here. Raise your hand if there's some extra seats near
448280	484850	you. We got, yeah, there we go. Still more over here. All the way down. You
484850	501510	don't have to stand on the wall. Come on, everyone else got up friggin' early,
501510	506830	and they're in their seats. You're holding up the show. Yeah, give him a
506830	533570	chance. All right. We'll get it eventually. Just calm, small words.
550710	554070	This is priest, everybody, for anyone who has not met. How many, how many people is
554070	558870	this your first DEF CON? Welcome, absolutely welcome. He is kind of the
558870	562390	epitome of the goon squad. They're really, they work hard, they make sure everything
562390	566670	flows right, and we always appreciate all they do for us. So just, if they ask you
566670	575900	to do something, just do it. Anyone who's had the pleasure of comparing dealings
575900	579480	with the goons as opposed to dealings with AP security knows which end of the
579480	588510	stick you want to be on. So, those were advanced pins, and we can defeat them,
588510	591690	you know, defeat is kind of a rough word, but with that feather touch wrench.
591710	595390	What about even more advanced features? Because really all this takes is a
595390	599050	specialized tool and a little bit more patience. What if you want something even
599050	603810	more secure than that? Well, some locks, even in the basic pin tumbler design,
603810	607410	do incorporate additional security features, and we can cover them now.
610430	615830	This is called a Schlage Everest lock. You can see that it has a normal complement
615830	619730	of pins, just, you know, pin stacks like we've been looking at before, but up
619730	623350	underneath the bottom of this plug, there's something called a check pin.
624330	629030	By the way, this is, this will be for a couple of light, we have a lot of
629030	632550	leftover bottle opener lighters from the BCCC event. This will be for a couple
632550	638130	of lighters and a Red Bull. Who can tell me where at a previous DEF CON did a
638130	644550	Schlage Everest lock appear? It was part of the obstacle course. I need more
644550	653050	specific. It had a specific name. Two years back. Nobody? It was a big blue
653050	657230	lock. Nobody remembers? Come on, I know you're, a drink and a lighter. Nobody
657230	662370	remembers? What? The beer lock! Yes, it was the beer lock, which no one opened.
664290	670390	Way to go. And it's a shame no one opened it because this is actually pretty
670390	676670	easily beaten. As you can see, this is the plug up underneath. You can see this
676670	680450	check pin sticking through here. Now that engages with part of the outer shell
680450	685110	and this is not going to rotate unless the pins up top are set and this is
685110	690610	pulled out of the way. You can see this little bar. Well, that little bar engages
690610	695630	with a big groove slot on the side of the Everest key. You can see most keys do
695630	699470	have grooves. They actually, they help seat the key in with what are called
699470	704110	wards. Those protrusions are called wards that seat the keyway. This, however,
704110	708190	the groove is deep because it actually picks up that pin and as the key travels
708190	712610	down the keyway, it lifts it up and out of the way. Well, it didn't take people
712610	716490	too long to realize that you can just make a tension wrench with a nice long
716490	722450	finger and pick up the pin that way or you could take an Everest key, cut the
722450	733760	hell out of it, stick it down the lock and use that as a tension wrench. By the
733760	736800	way, we want to thank Matt Blaze for a lot of these beautiful photos you see. I
736800	740700	referenced him later. He's a real groovy cat and he was very kind and let me use
740700	745640	these. For a, let's see, we'll still work, we've got a lot of Red Bull. We're
745640	749660	keeping working. For a Red Bull, can anyone tell me the name of the vendor who
749660	755120	manufactures and sells these Everest picks? Don't please shout and no, it's not
755120	760880	Southern. Let me see. You've won stuff. Wait. Yes. Yes, it is Peterson
760880	773730	International. Very good. Applaud for the man. He knows cool shit. Yeah, this little
773730	778870	Everest. Yeah. Yeah. Yeah, the question was, is that simple? Yeah, as far as I've
778870	784950	seen, all the plugs have that. Yeah, these are the Peterson wrenches. They come in
784950	788270	two different, you know, there's a left and a right one. And they're really
788270	791030	excellent. They're very well made. Peterson, we talk about Peterson later in
791030	796070	the talk. They're a very good supplier. They're good people. So, we're moving our
796070	800130	way up from like ass-tacular security to almost good security. Let's talk about
800130	806990	very nice security. This is called an Assa V10 Twin. This is a very popular lock
806990	810550	in Europe. You don't see a lot of Assa locks in America. You actually don't see a
810550	815690	lot of very good locks in America. There's maybe one brand. But Assa is a very good
815690	819610	lock. And you can see it has a traditional pin stack with, as you know,
819610	823450	it's secure. This is a spool pin up here. And the spool pin even has an extra lip
823450	829870	that really binds up hard. But next to that, there's a tiny pin stack seated way
829870	834190	down on the side. And you can tell that only if these pins are lifted to the
834190	839910	right height, can what is called a sidebar fall inward. This sidebar, unlike
839910	843970	remember the check pin was seated down here. The check pin was vulnerable. You
843970	848850	could grab it from the keyway. The sidebar cannot be grabbed by anything you
848850	853410	stick down the keyway. The only way the sidebar is going to move is if these
853410	857110	tiny pins on the side, which are really hard. You can't really insert picks in
857110	860750	there. It's a really tiny space. The only way the sidebar is going to fall inward
860750	865630	is if that is raised up. Now, I don't know if you can see my faint text here.
865630	869330	These are very secure. But the person, in fact, who first showed them to me, a guy
869330	872650	named Barry Wells. How many people know Barry Wells? How many have ever heard
872650	877790	him talk at Hope or anything? No? Oh man, you guys got it. He is... I'll show you
877790	882870	his videos later. He's a real amazing cat. Barry, who was a big fan of this lock,
882870	886970	was very disappointed when he found out there is what he calls a geographical
886970	891870	weakness. You can see this lock right here with the cuts on a key. That's
891870	896290	called the bidding. The bidding cuts are normal cuts right here. And you can see
896290	903450	the sidebar cuts down here. What's up, X? Oh, more free stuff? Oh, yes. Agent X,
903450	907370	everybody. He's running the show as well with the speakers. Big hand for him.
912520	918820	In my hand, I have some individually numbered issues, hardcover, a Frac 63,
918820	924940	final issue. They're so warm. They're still warm from the presses and from
924940	928820	their total hot, the coolness. We're going to be schwagging them out tonight.
928820	933320	He's going to be schwagging them out right now. Will this be for questions or
933320	940760	just for fanfare and pandemonium? I don't want arms ripped off. We're all
940760	947000	gentle human beings here, I'm sure. Not savages. Except for that guy.
950900	955640	And they're individually numbered. They're giving away issue number 13
956120	981760	in the Apollo talk. That's cool. Limited edition, people. And here I thought I was
981760	990930	just going to give away little cheap Red Bull and lighters. Okay, just so we're
990930	997870	clear and there's no conflicting orders, do not stand in front of the doors. Yes,
997870	1004850	sir. I'm looking right at you with the backpack. Can we get a hand raise again
1004850	1008170	real fast if there's any more seats? Do they all go? There's a few more seats,
1008170	1013450	people. I know it's nice being able to have that room to spread out, but come
1013450	1016070	on, really, raise your hand if you got room. I need the people back there by
1016070	1023290	the door. You three in black. I need two people in the aisle. Hang on, we're
1023290	1026470	getting there. And yes, I know everybody's in black, but I just pointed
1026470	1033170	to you. We got one seat here. Fine looking gentlemen, ladies, come on. You
1033170	1043740	know what? I'm going to bring you down. You, sir, in the yellow shirts, come
1043740	1052300	up. Okay. I need to be able to see the doors. I can't see the doors. Thank
1052300	1057760	you. No, this guy's not feeling any love right here. This is prime seating,
1057760	1064520	especially if I start throwing stuff. Okay, we've got one more seat. Yeah,
1064520	1071380	send him up, Jay. All right. Just please keep your feet tucked in. Please
1071380	1074920	keep... I got one more seat. Send me somebody from this side of the room
1074920	1080100	over here. Somebody raise you up in the white shirt there. Yes, you. Come on
1080100	1085280	down. You're the next contestant on Get a Better View. Sir, in the yellow, right
1085280	1091640	there. Is there one more, sir? Is this guy? He still needs a spot, right? You
1091640	1097100	want to move right in there? Yeah, you do. We got... is that seat? Right here,
1097100	1102660	guy. All right. Is there any more seats? Because I overbooked. Yes, sir, right
1102660	1108680	over there. Okay, please keep the aisles clear. I've got to be able to see the
1108680	1112120	doors from the stage. That means if I see you standing in front of the door
1112120	1114960	from the stage, you're in front of the door. Okay, the only reason we're doing
1114960	1118400	that is if a fire marshal walks in, we have the illusion of we didn't overbook
1118400	1122980	too badly. We're trying to get as many people in as we can for the popular
1122980	1126600	talks. Okay, we're working on something for next year. We didn't have a chance
1126600	1129840	to implement it this year. Hopefully we will have it up and running by next
1129840	1133380	year, where we'll have some type of signup system where you can sign up for
1133380	1136360	the talks that you want to see. We'll have you... with the signup, we'll have
1136360	1139660	you line up in one line. People who want to see it but didn't get to sign up
1139660	1142660	will line up in another line. So it'll be first come, first served. There won't
1142660	1146340	be this rush to the other line, you know, 30 minutes after you're into the
1146340	1164960	first talk. So you get to the other talk you want to see. But for now, what we're going to do is we're trying to get as many people in as we can. We have actually quadrupled the seating for last year. Okay, you'll notice that what we found was the fire marshal was working from a four-year-old
1164960	1169360	occupancy limit, and we got that updated. That's why there's more people. You'll
1169360	1172720	notice that you guys were in a huge line all the way back around the side of the
1172720	1201200	hotel. I'm not that good. You'll notice that all of you got in, plus everybody was queued up over here. So we got everybody in as we could. We apologize for putting you on the floor like this, sir. Did he smell bad or something, sir? Okay. A little lover's quarrel. We got everybody in as we could. We're sorry you had to sit on the floor. We're doing our best. Please work with us. We appreciate your patience, and we'll keep doing what we can do. Thanks, guys.
1207160	1232140	After this talk, if you buy a pair of lock picks, and the police pull you over, and they find the lock picks, do not say, I'm a hacker, and I break into my client's buildings. We actually had someone do that. Welcome to, you're now in jail for having thieving tools. The correct answer is, I'm going to locksmithing school. These are classes for my tools, or I am an apprentice.
1232640	1235020	We'll cover that. There's a whole legal section we'll cover.
1235020	1243340	I'm a hacker, and I break into my client's buildings. That's breaking, entering, and having thieving tools. So, a little subtlety there.
1265140	1266940	Work that angle, I'm serious.
1268680	1273040	Alright, so we were going to talk about the potential weakness in the V-Twin, right?
1274540	1275500	What's that?
1277220	1289120	Geographical weakness, yes. And the reason we call it that is because these sort of bidding cuts can be... if you've had a key made, you can see the machine's not sophisticated. It's just a grinder that just grinds off the key, does the bidding.
1289760	1302300	This bidding cut down here, however, for the sidebar, is not easily accessible by a traditional grinder machine. It has to be made on a special milling machine. These blanks are special ordered, which actually increases the security.
1302300	1306140	You can't just, no fool off the street can just get a key blank and cut it.
1306160	1312740	But, it's a nightmare for logistics and distribution of locks to locksmith vendors.
1312740	1327700	So, Barry and the people at a German sport group found out that all over Germany and other places, they're just divided into territories, and locks are sold with a certain sidebar bidding in that territory, so that all the key blanks for that territory are there.
1328240	1334060	So, it's not a big weakness, but it's just kind of the cost of doing business, the way the distribution works.
1334120	1340700	They don't just deal over the internet, like a guy at a local shop can't have 80 bajillion of these blanks if a customer comes in.
1340700	1342340	So, it's something to keep in mind.
1342540	1344700	And that comes into play with what we do bump keying later.
1344700	1345740	I see a couple of hands.
1347140	1349260	I do not know how many territories there are.
1350040	1354740	Yeah, SSDevs, we'll talk about them later. They talk about it. Yes.
1357840	1360740	I would imagine someone could be mapping that out potentially.
1360740	1364280	I don't know if you can look at just the bidding and know where it came from.
1364920	1368520	He was asking if you just look at that sidebar bidding, can you tell the territory?
1368520	1373220	Obviously, there's got to be a master list somewhere that coordinates distribution, but I don't know of it.
1373220	1374460	There was one more hand.
1381460	1383540	That's a tremendous question.
1383560	1393380	If simple changes to the driver pins, if the addition of a ridge or a lip or serrations, if they make it so much harder to pick, why don't all locks come with this?
1393380	1399900	And the reason for that is Americans especially, but in general, people are cheap everywhere.
1399900	1407200	You've got a figure that costs X number of cents to introduce that feature into a lock, multiplied by how many you distribute in a year.
1407200	1410940	Someone in a boardroom looked at a spreadsheet and said, no, we don't freaking care.
1410940	1413540	Let's just make them this way. That's the answer to that.
1416040	1420280	Oh yeah, that's a very good point. You can retrofit, you can repin your locks.
1420440	1422420	You can buy pin kits.
1422860	1426320	Because the driver, the height of the driver, the size doesn't matter.
1426320	1429880	It's only these bottom pins that have to be the right size to work with your key bidding.
1429880	1431800	You can retrofit your drivers, definitely.
1431860	1436660	And in the hands-on session, Mouse, if you have the ones that are pulled apart, we can show people how you do that.
1438340	1442220	So, moving onward, that is a very nice... I don't want to knock the V10, though.
1442220	1445440	For that one weakness, it's still a stupendous lock.
1446000	1448600	This, however, is probably my favorite lock.
1448600	1452420	And interestingly enough, it is an American company that makes this lock.
1452420	1454540	How many people have heard of Medeco locks?
1455040	1456420	Now, there's some hands.
1456420	1460020	Medeco is one of the finest locks I can think of out there.
1460020	1463060	I don't work for them. I'm, you know, not dating anyone there.
1463060	1465740	They're just really good. They're really good designs.
1466600	1474460	Medeco keys, besides being insanely restricted and hard to get your hands on, have what's called cross-cutting.
1475140	1480240	And if you can kind of see these pins, you can notice they're chiseled on the tips.
1480280	1482560	They're also serrated, by the way, these key pins.
1482560	1491280	These key pins and these chisel tips actually fit into, you can kind of see here, these cross-cut notches.
1491380	1495960	These pins spin as they track up and down as the key goes into the lock.
1495960	1497800	It's called axial rotation.
1498060	1507560	Only if these pins have spun correctly, lined up a notch on the side, will a sidebar fall inward, and then will the lock open.
1507560	1509880	These locks are psycho.
1510680	1514460	You can't, there's no easy bypass for this.
1514460	1520380	And in fact, the gentleman we've mentioned, Barry Wells, I think is the only man alive who I know who can pick these.
1520400	1522840	I've seen him do it, and I shit myself.
1523160	1528900	I mean, you know, he reaches, he actually uses that finger pick, and he spins the pin by hand.
1528900	1532220	And you can even see, this has a fake cut here.
1532220	1536400	So you can feel like you've spun it and you've caught on something, but it's a fake cut, a deep cut.
1536400	1538140	It's a really hard lock.
1538140	1541820	And for someone like Barry to do it, I've seen him like eight minutes, ten minutes.
1541960	1548300	A regular person, just any guy with any hope of picking this would take like an hour and a half, two hours.
1548320	1555540	If you have a security situation where someone can kneel down in front of a door on your property and fiddle with something for two hours,
1555540	1557580	you've got a whole different set of problems.
1559340	1561080	If they're not getting noticed.
1561820	1565300	So those are some examples of very high security features in locks.
1565300	1566480	These are out there.
1566540	1568660	They're not outrageously expensive.
1568720	1571940	If you, you know, factor in the costs involved, you know, what are many costs?
1571940	1573140	Like $100, $150?
1573380	1575740	The V-Twin I think you can get for about $80.
1576440	1580220	The cost offset is not a big difference considering what you're getting out of it.
1580220	1581200	I see a hand.
1586620	1587340	Yes.
1587400	1587960	Yes, it is.
1587960	1591920	The question was, can you replace just the cylinder, just the core of the lock?
1592040	1592980	Yes, you can.
1592980	1595100	You can usually mortise cylinders, screw out.
1595100	1596440	You can swap out cylinders.
1596440	1598760	In fact, a lot of really high-end...
1598760	1602500	How many people here are in the service or affiliated with the service of any kind?
1602500	1603660	Military service?
1604340	1605460	Man, just a handful.
1605460	1606180	Geez.
1606500	1612780	A lot of military locks are standard designs, like military handcuffs, military padlocks.
1612780	1617160	They're standard industry locks that have been swapped out with a Medeco biaxial core.
1617340	1618420	And like you'll see...
1618420	1621720	Yeah, so you can retrofit locks to varying degrees.
1625440	1627900	Yeah, the Best Locks, the brand Best.
1627900	1628900	I cover them in a bit.
1628900	1630880	They have a very, very nice system.
1630940	1632880	Especially it's one that's very nice to manage.
1632960	1636080	We're jumping ahead though, but because you're on top of things, you get a free letter.
1638980	1639940	Good catch!
1642400	1643900	Very good point to bring up.
1643900	1644840	We're going to cover Best Lock.
1644840	1647520	We're going to cover a lot of stuff, so we've got to keep it moving along.
1649220	1651240	Oh no, that was a very good point someone mentioned.
1651240	1654460	Okay, you're not going to make this on a grinding machine or at your local hardware store.
1654460	1656140	You can't make these cross cuts.
1656160	1658080	Very, very restricted blanks.
1659060	1662680	So that was a peek at very good security.
1662900	1666880	Let's flip it back the other direction now and go back to bad security for a minute.
1670060	1670760	Yes?
1677230	1679510	The little light shines in the holes?
1681330	1682870	I don't know what you mean.
1684830	1688110	Show me later, give me an idea later and we'll talk about it.
1699440	1704300	The question was, if you keep picking and playing with a lock, will it eventually wear the lock down?
1704300	1708120	Yes, there's a lot of potential wear and tear that a lock can experience.
1708640	1712100	The springs that push the pins, those can get weaker.
1712560	1715460	A lot of pins are brass because they don't corrode.
1715460	1717120	Brass is easily misshapen.
1717120	1719200	In fact, I talk about that later.
1719200	1720840	There's some techniques that are really bad for locks.
1720840	1723220	You can beat the locks up and make them easier to pick that way.
1723700	1724640	Question again?
1730370	1732010	Those are called dimple locks.
1732010	1733210	We're going to cover that in a minute.
1734810	1737590	I've got to stop rewarding people for jumping ahead of me.
1738710	1740070	But no more jumping ahead.
1740070	1742010	Hold on, we're going to get to all the fun stuff.
1743430	1745810	First, let's talk about really crappy things.
1745810	1747050	Hang on, wait, wait, wait.
1747050	1748350	I'm trying to go forward, people.
1748350	1749850	I expected questions at the end.
1749850	1753250	This is my second time ever speaking, so you've got to bear with me.
1754210	1755310	Thank you.
1758250	1761050	We're talking about very bad locks at the moment.
1762990	1765750	Can I get a show of hands how many people have used this lock?
1767870	1769250	That's about right.
1771790	1773650	These locks are incredibly popular.
1773650	1775410	These locks are everywhere in our life.
1775410	1778470	Everyone and their dog has a master lock securing something.
1779850	1781990	These locks do not provide anything.
1784170	1789150	If you have something that you care about that you're securing with a master padlock,
1789150	1790990	you know, you're pretty much doing this.
1799220	1800820	Why, you say?
1801820	1807200	Well, you can take a master padlock, much like this little number,
1807200	1809340	and use a guy like this.
1809440	1810880	Does anybody know what this is?
1811300	1813220	This is a padlock shim.
1813700	1816460	A padlock shim can be inserted into a lock,
1817760	1820000	or it can be broken in the lock,
1820000	1821860	because this shim has been beat to hell.
1823880	1825780	And that'll open that lock.
1829780	1830740	Question?
1832120	1835640	Yes, it will. I'll cover which can and can't be shimmed.
1836880	1842000	Shims are a very, very elegant sort of attack against a lock.
1842000	1845100	I mean, they really, I would say, fall into the category of a bypass.
1845360	1848200	Just because the simplicity of the design,
1848200	1850520	and the fact that Americans, especially Americans,
1850520	1854000	but everyone in general, likes convenience as opposed to utility,
1854000	1855340	makes this possible.
1855700	1857700	Let's look a little bit more at this master.
1858100	1861600	You can see it has a, all padlocks, like, you know, it has a shackle.
1861680	1863200	It has a little dog notch.
1863480	1866560	And that interfaces with,
1866560	1868000	let's see if we can see down here,
1868000	1869820	you know, a locking bar that's in there.
1870020	1872520	And only if the combination is dialed in,
1872520	1876040	will that bar retract, allowing you to pull the lock open.
1876900	1878980	Well, what if you're not opening the lock,
1878980	1881380	but rather you're closing the lock?
1881420	1883040	You don't have to dial a combination.
1883040	1884680	You don't have to fiddle with a key or anything.
1884680	1886360	You just, you know, slap it shut.
1886900	1890300	Well, that's because that bar is spring-loaded.
1890540	1892520	The bar is just going to get out of the way.
1892520	1895440	It's like, oh, the shackle's coming down, I better move.
1896600	1898080	The way, and I'm going to try to get,
1898080	1900460	I don't make films, so bear with me.
1900460	1903020	The way a shim works,
1903160	1905820	a shim is inserted outside the shackle,
1905820	1907440	slid down in,
1907440	1909860	and then turned,
1909860	1913240	effectively obscuring that dog notch.
1913260	1914260	You see that?
1914540	1916520	It just, I'm trying to get that in line.
1916520	1920260	It just pushes the bar right out of the way.
1920260	1922180	It's like credit carding a door.
1922740	1926140	I have a lot of friends back home who are in theater.
1926140	1928620	There are theater techs and stage designers and stuff.
1928620	1930960	And there's kind of an axiom with anybody who does
1930960	1933620	craft work on stage and design sets.
1933800	1936860	If you're doing it with springs, you're doing it wrong.
1937480	1939660	This is an example of that phenomenon.
1939960	1942480	Many things in locks that involve spring action
1942480	1945060	are easily, easily compromised.
1945060	1946940	Because a spring is, by nature, not a,
1946940	1948120	it's a dumb device.
1948120	1949920	It doesn't know what's pushing on it.
1949920	1952640	And you can usually just pop them right out of the way.
1952640	1954260	So, padlock shims.
1954260	1955940	The cheapest stuff in the world.
1956260	1957960	You know, you can buy them in packs.
1959620	1960620	What's that?
1961260	1962920	Oh yeah, you can make, we're going to cover,
1962920	1964320	that's going to be a question.
1964580	1965540	Yes, question.
1970690	1972090	Yes, very good point.
1972090	1974850	Metal bus fuses, there's a lot of material
1974850	1977150	that you can make shims out of.
1977190	1979230	Shims you can buy, you know,
1979230	1981230	the 20 pack is $25.
1981430	1983310	I'm going to have some of them if you want to play with them
1983310	1985210	in the hands-on area.
1985270	1987330	You can also make your own.
1987570	1989150	And this will be a question.
1989150	1990970	Let's see, this is kind of a hard question
1990970	1993490	because it's very, very current events, if you will.
1993630	1994990	The question for a Red Bull
1994990	1996870	and one of these issues of Frack.
1998250	2000170	What readily available material
2000170	2002770	from Defcon did we use
2002770	2004730	to open a jammed padlock
2004730	2007290	at Civiac's house yesterday afternoon?
2009510	2011270	It was not a badge from Blastier,
2011270	2012370	but a good guess.
2012370	2013110	Hang on, I saw...
2013110	2015230	Wait, wait, whoa, no shout out.
2015230	2016770	I saw your hand next.
2018070	2019670	The man is correct.
2019670	2020610	Come on up.
2024250	2025590	The answer was
2026170	2027630	metal from a beer can.
2027630	2028990	And I have to definitely apologize.
2028990	2031310	I'm sure there's got to be people flailing their arms on the sides
2031310	2032530	and I might not be seeing you.
2032530	2033710	I apologize for that.
2033710	2035370	I'm going to try to keep you in my field of vision
2035370	2036550	when I'm asking questions.
2037070	2038090	Yeah, just the other day,
2038090	2039890	Civiac had some friends staying with them.
2039890	2041970	They're moving from San Diego.
2041970	2042730	Then they stopped here.
2042730	2043790	They're moving up to Seattle.
2043790	2046050	It's polyhazard and I forget who else.
2046410	2048910	But as we, I have definitely done this before.
2048910	2050110	Many people have done this before.
2050110	2054110	Some locks, the shackle completely pulls off.
2054110	2056850	You know, the lock base can actually be completely removed.
2057170	2061210	And if you accidentally slap it shut, upside down,
2061810	2064430	the keyway is kind of inaccessible.
2068910	2069750	It happens.
2069750	2070830	It happens to the best of us.
2070830	2071390	I've done it.
2071390	2074470	In fact, I first experimented with this when I did it at home.
2074770	2076970	We had the right tools in hand.
2078290	2083330	And a simple beer can is all it took to shim this right off.
2083330	2084790	We'll do this in the hands-on session.
2084790	2087430	I've got plenty of beer can metal up here, man.
2087430	2090050	We're going to make some, cut them up, and have a good time with that.
2093350	2096850	It may or may not have been the beer that resulted in the lock being that way.
2096850	2097890	I am uncertain.
2100620	2102040	Very, very, very easy to do.
2102040	2103980	In fact, you can ask them.
2103980	2109440	We probably took, I guess, 30, 40 minutes in midday Vegas traffic to get to the house.
2109440	2112340	It probably took 30 or 40 seconds to get this lock off.
2115240	2117940	There are, however, unshimmable padlocks.
2119180	2124380	There are very, very good padlocks on the market that shims will do absolutely nothing to.
2124760	2128280	Some padlocks have a nice big boot or collar on the top.
2128280	2131780	That makes the shim really hard to insert, damn near impossible.
2132060	2137480	Incidentally, for, let's say, a red, this is kind of an easy one, for a Red Bull and a lighter,
2137480	2139720	and I'm keeping the sides, keep the sides in view,
2139720	2143640	what is the actual purpose of the collar or boot up on these?
2144100	2147540	Whoa, that was a lot of hands. I think it was this way down there.
2150320	2152920	Preventing bolt cutters is the exact right answer.
2152920	2154520	Come on up, get a drink and a lighter.
2158220	2161520	Other locks, you can actually, let me flip back to this.
2162640	2168100	This is not the best solution, but if you were to just put notches in this bar,
2168100	2171040	and literally, I mean, we're not talking about re-engineering the lock here.
2171040	2174920	Oh, here's a lighter, man. Bottle opener lighters, gotta dig those.
2175660	2177840	You know, we're not talking about a massive new design.
2177840	2183040	If you were to just notch this bar, that would rip the crap out of the shim as you try to spin it around.
2183280	2187200	And if you, you can actually kind of see in there, this bar is pretty beat up.
2187260	2192460	I have some padlocks that I've shimmed so many times, they just shred the shims now because there's so many scrapings.
2192680	2196380	So if people would just notch the bar, it would be kind of, kind of a solution.
2196380	2204040	But really, the best type of padlock, and frankly, in my mind, the only type of padlock that can be considered useful at all,
2204040	2206320	involves what's called double ball locking.
2206880	2211420	Double ball locked padlocks, the shackle has, you know, a dog notch on each side.
2211900	2215840	And inside, there is no bar with a spring or any other horseshit like that.
2215840	2218540	There are two solid steel ball bearings.
2218700	2223280	These are not going to go anywhere unless this control cylinder in the middle is rotated.
2223280	2226500	You can see the control cylinder has a notch on each side.
2226540	2230740	That cylinder rotates, the ball bearings drop in, that the lock will open.
2230740	2232340	That is a real padlock.
2232340	2235060	Anything else is, you know, a paperweight.
2235980	2239420	Many locks employ, they're called key retaining locks, by the way.
2239420	2242440	Locks that you have to have the key to open it and close it.
2242600	2246560	Those are invariably going to be high-end double ball mechanisms that are in there.
2246560	2249360	But any lock, it'll stay right on the front, double ball mechanism.
2249360	2254080	Look for that. It is not at all a big investment to make that leap up.
2254080	2257560	It's the difference of like a $5 lock or a $12 lock.
2259260	2260560	Moving on.
2261380	2263620	From good locks, we'll jump back again.
2263620	2266340	We're kind of doing a high and low range of things.
2267120	2268240	Warded locks.
2268700	2271300	How many people have ever seen locks that look like this?
2272080	2274640	Alright, yes, they are a lot of places.
2285080	2290020	Warded locks are really very nice locks for certain reasons.
2290280	2292360	They're very popular in outdoor situations.
2292360	2297060	In fact, if you notice that trailer that I showed you in the other pictures, that was a warded lock.
2297060	2298500	Why are they popular outdoors?
2298500	2300480	Well, they're very resistant to fouling.
2300480	2303200	They're very resistant to dirt and filth.
2303200	2305860	They can rust up and they'll still usually work.
2305860	2309760	They don't have an intricate pin tumbler mechanism inside.
2309760	2312520	The fact that they have a very rudimentary mechanism
2313180	2317060	means that you can put a lot of crap in this lock and it'll still sort of work.
2317700	2322000	The other side of that coin is that it's a really rudimentary mechanism and it's a joke.
2323480	2326160	Warded locks look kind of like this on the inside.
2326420	2329120	You have a long keyway with wards.
2329120	2332120	Those are protrusions called wards that get in the way.
2332120	2337500	And at the very tip, you'll have just a notch bar with a spring.
2337500	2341600	Those keys, if I jump back...
2341600	2344520	Those keys... let me flip to...
2344520	2347920	I used to have these numbered and the numbers have all but worn off.
2351780	2353320	Got it on the first one.
2355600	2358500	This key, when it goes down the keyway,
2359040	2361060	the only thing... can you guys see that okay?
2361240	2368120	The only thing that's actually operating this lock is this very, very tip of the key.
2368860	2373760	That little tip of the key is interfacing with this lock mechanism,
2373760	2375900	the latch that's hidden inside.
2376640	2378160	However, what that means is...
2378860	2381120	Let me pull some stuff out here.
2391660	2396130	My pickset is all clouded.
2396330	2397710	There we go.
2398990	2401930	What that means is if you take a warded key lock
2403350	2405970	and you file down... can everyone see that alright?
2406490	2409130	You file down all the notches.
2409130	2411550	This will still operate the lock.
2411550	2413270	I think this was number one.
2413510	2414750	No, it's number three.
2416570	2419950	So this was... I took, you know, number one is probably this guy
2420450	2423590	and I just filed all the wards off of it except for the tip.
2425670	2427050	Let me get that in there.
2427050	2429850	That still opens this lock.
2429850	2431590	Because, you know, you only need the tip.
2431730	2436110	The rest of the lock, the only thing it's doing is getting in the way.
2436110	2440110	So that means you can take this to any warded lock.
2442630	2444050	The tip will open.
2445490	2447730	And they just, you know, there you go.
2455240	2456520	Oh, I saw some hands.
2456520	2458520	Wait, hang on, there's people with hands. Wait.
2458820	2459480	Hands?
2461480	2463480	Not so much with a regular pick,
2463480	2466000	but there are what are called warded picks.
2466000	2468260	And there was a hand back there. Was that the same question?
2476460	2477740	I'm not familiar.
2478040	2479860	They were even mentioned in the last talk.
2479860	2482040	I've yet to see. If anyone has one of these, I'd love to see it.
2482040	2483320	The TSA luggage lock.
2483320	2486540	I don't deal with... you guys who fly, you're nuts if you check bags, man.
2486540	2489100	I FedEx all my shit. I don't deal with those psychos.
2490380	2490940	Hand?
2497030	2497530	Okay.
2500880	2503300	Okay. And you were going to ask a question as well, I'm sorry.
2504860	2506660	Yeah, he makes a very valid point.
2506660	2508680	A lot of these locks, they're really just decoration.
2509560	2511900	Oh, we have a TSA lock? Thank you, sir.
2511960	2513440	He gave that man a lighter for that.
2515000	2516540	This is a... are you kidding me?
2517260	2518820	This is a TSA lock?
2525520	2527020	Oh, for... okay.
2527020	2529980	So there's apparently varieties of TSA locks.
2530060	2533320	But yeah, I hate the TSA. I won't give them any of my stuff.
2534640	2535920	Alright, moving on.
2535920	2537260	Oh wait, sorry, question.
2543960	2547660	The question was locks that are called key retaining locks.
2547660	2550740	The key is inside the padlock the whole time it's operating.
2550960	2552220	That's what you're asking about?
2552460	2555100	And you're saying is it a spring that keeps the key in?
2559830	2563730	Oh, invariably key retaining locks tend to be much higher quality.
2563730	2564990	They're going to have a double ball.
2564990	2566490	So no, you can't shim those.
2567630	2569230	So yeah, you can buy...
2569230	2570870	Does anyone see Irvine's table?
2570870	2572910	Do they have the warded picks there this time around?
2573070	2574570	Yeah, Irvine usually has these sets.
2574570	2575710	What are they, like nine bucks?
2576410	2578070	I hope I didn't lowball that price.
2578070	2579310	If they're more, they're worth it.
2579310	2580950	But they should be about nine bucks.
2582050	2584290	Yeah, or you can literally just buy...
2584290	2586530	You know, these locks cost about seven dollars.
2586530	2589130	So just buy one and carve the key down.
2589170	2589970	Question.
2595620	2597300	Oh, why are there different shapes?
2597560	2599280	You can notice that...
2599280	2600980	The question is about those shapes.
2601260	2604940	The key tips aren't always the same size.
2605220	2608980	Sometimes there's a very, very thin tip.
2608980	2610760	Now, if you had a slightly thicker one,
2610760	2612520	it might not stick all the way in.
2612640	2613740	But if you have a very...
2613740	2614440	You couldn't just...
2614440	2617280	If I just took this key, carved it all the way down,
2617280	2618580	the thin is a little weaker.
2618780	2620900	So this set, it gives you kind of options.
2620980	2623100	You can see how they all engage that lever
2623100	2624700	on one level or another.
2625420	2626680	Occasionally, you don't see them anymore,
2626680	2629500	but you used to see a dual lever warded lock.
2629580	2630880	In fact, I think I have one over here.
2630880	2632000	I used to have one on the back of my truck
2632000	2633140	for my trailer hitch.
2633600	2635540	But, you know, you don't see...
2635540	2636940	Any one of these could probably open
2636940	2639320	just about any warded lock out there.
2642460	2643700	Ah, barrel locks.
2643700	2645320	New this year. Anyone who saw me at SHMOO,
2645320	2646500	you didn't see this part.
2666830	2668710	Barrel locks are very popular
2668710	2670410	with utility companies,
2670410	2673030	and they're popular in outdoor situations.
2674150	2674950	I would almost...
2674950	2676250	These are kind of the in-between.
2676250	2678190	Are these really a lock? Are they not?
2678190	2680070	I don't really know. I like to kind of use them
2680070	2681410	as an example of something that
2682250	2684270	works like a lock, but it shouldn't be thought of
2684270	2686370	as a lock. I've seen these sometimes
2686370	2687990	on perimeter fence,
2687990	2690070	on way out on the edge of properties.
2690070	2691570	Don't use them out there.
2691910	2694130	Let the utility company work with these.
2694130	2696070	They're really not truly locks.
2696510	2698090	And here, we're going to play with some of them
2698090	2698830	in a bit.
2699750	2702070	The way barrel locks work...
2703150	2704250	A barrel mechanism
2704250	2705910	looks something like this.
2705990	2707990	It's a double ball action inside
2707990	2709930	with a plunger, and if this
2709930	2711870	plunger retracts,
2711870	2713990	obviously, the balls fall
2713990	2715810	inward. But unlike
2716350	2718050	very high quality padlocks
2718050	2720110	where the double ball mechanism is engaged
2720110	2721870	with a key and so forth, these
2721870	2724050	really just rely on a very, very
2724050	2725430	strong spring.
2726090	2727970	If you just reach in there with a hook,
2727970	2730030	pull that out. Let me see if I can do
2730030	2731070	that for you.
2732190	2733510	This is a homemade tool
2734250	2736310	made out of a fishing snake.
2736310	2737690	You can run wire through a wall.
2737990	2740230	Very, very nice steel. If you temper
2740230	2742410	it right, you can make a lot of good tools out of this.
2744010	2746070	This is a barrel lock. You can see the outer
2746070	2748310	casing and the little balls
2748310	2750250	here. If I reach
2752150	2752510	in...
2752510	2754130	Sorry if I'm going out of frame
2754130	2755010	for a second.
2758850	2760970	There we go. That's locked.
2762810	2764750	That's not the cool part. It's kind of cool,
2764750	2766670	but, you know...
2766670	2768770	Unlocking it. There, now you can applaud.
2768770	2770450	The unlocking part. That's fun.
2773750	2774990	This is the plunger
2774990	2776670	that would ride all the way down
2776670	2778810	inside there. I don't know if we can get
2778810	2780050	that up to the camera.
2780690	2782830	My camera is ass-tacular.
2783890	2784790	But yeah, that little
2784790	2786610	plunger just rides in and out
2786610	2788690	and it's not
2788890	2790370	a complex mechanism.
2790530	2792650	I've known people,
2792650	2794390	maybe I've heard of people,
2794390	2796850	who hypothetically had their gas turned off
2796850	2799290	because they were potentially a
2799290	2801090	moron and didn't pay their bills
2801510	2803110	for maybe a year.
2803110	2805870	And maybe they turned the gas back on this way.
2805870	2807250	But I could just be telling
2807250	2809630	a story someone told me.
2809710	2811070	Was there a question? There were a couple of questions
2811070	2815130	on that one.
2815130	2817470	Oh, how do I... I just...
2817470	2818750	Actually, I think I have one that has...
2818750	2821530	You can kind of see
2821530	2824390	the plunger in there.
2824390	2826090	Oh, I'll show you the key.
2826090	2826870	The tool that I use just reaches
2826870	2828450	in and has a hook tip
2828450	2831370	and I just kind of grab as hard as I can on the spring.
2831370	2832950	The spring is sort of fused
2832950	2834970	to the base of the plunger.
2834970	2836830	So if you get that spring at all, it'll
2836830	2838830	move. Was there another question before
2838830	2843840	I jumped on? No? Alright.
2844300	2846280	There's another type, very similar.
2846280	2848280	It's just called a screw style,
2848280	2850420	bolt style. In this case,
2850420	2851540	there's just threading
2851900	2853920	and the bolt that's inside the plunger
2853920	2855480	spins outward.
2855920	2858500	The key on that... Here's what keys look like.
2858500	2860620	This is the actual anchor
2860620	2862940	key. It's called A-N-K-E-R.
2863340	2864700	It's really just... It sticks down.
2864700	2866580	I think the tip of this has a pair of
2866580	2868540	hooks that flange outward if you
2868540	2870620	pull the handle. But, you know,
2870620	2872860	that's really all it is, just a hook.
2873200	2874480	And this is the bolt style.
2874480	2876260	Now, you should note that this is not a regular
2876260	2878560	Phillips head or hex head pattern
2878560	2880600	here. This is a unique cut pattern.
2880760	2882620	And the bolt on the inside, if you have a rotating
2882620	2884420	bolt style barrel lock, is a unique
2884420	2886520	cut pattern. So it's very, very hard
2886520	2888900	to get to pick a rotating bolt style.
2889220	2890340	These are... I think
2890340	2892200	Agbay makes these. These are
2892200	2894700	rotating disc style. You can actually get
2894700	2896560	barrel locks in rotating
2896560	2898400	disc. We'll talk about what a rotating
2898400	2900640	disc lock is later. They are really
2900640	2902460	nice. They are a whole world of
2902460	2904960	difference from what you see on the table in front of me.
2904960	2906440	You can do all kind of levels
2906440	2908400	of permission characteristics, master
2908400	2910680	keying. If any of you
2910680	2912520	work for any type of a company large
2912520	2914980	enough to think about barrel locks,
2914980	2916920	consider going with a higher end
2916920	2919220	one. I don't know the price breakdown,
2919220	2921360	but it's really, really worth it.
2923140	2924840	And just worth mentioning,
2924840	2927000	you see these in similar situations. A lot of the
2927000	2928780	same vendors sell them.
2928780	2930880	They're called intimidator screws.
2930960	2932780	These are included just to mention.
2932780	2934960	These are obviously not locks. Their freaking
2934960	2937020	name is intimidator. It's meant
2937020	2938860	just to dissuade someone.
2939000	2941020	These are not to be thought of as real
2941020	2943000	locks. But you'll
2943000	2944600	see these in very similar
2944600	2947080	light duty situations.
2948960	2950840	Ah, dimple locks. Someone mentioned
2950840	2952900	these earlier. Let me try to make some
2952900	2954180	real estate up here.
2955100	2956840	Are we having fun so far? Am I doing
2956840	2957440	alright?
2972280	2973540	Dimple locks.
2974260	2975900	You may have seen a lot of European
2975900	2978330	locks are of this design. In fact,
2979040	2979940	the device, you know the
2979940	2981920	club that goes on automobiles?
2981920	2983420	They had a competitor that came out
2983420	2985940	not too long ago. I guess it's long now.
2985940	2988160	That kind of wraps around the brake pedal.
2988280	2989940	And one of the big things in their infomercial
2989940	2991880	was that the club lock is just a joke little
2991880	2993740	lock. Our lock uses a dimple key.
2993740	2994860	You'll see these on
2995780	2997820	higher end situations.
2998120	2999760	Dimple keys,
2999760	3001740	the keyway is flipped this side.
3001800	3004040	It's flat, so it's a
3004040	3006540	bastard to get your picks in there.
3007540	3008300	And the...
3008300	3009920	Where did I... Oh, never mind.
3009920	3012440	I don't have a picture of the key, just other than to show you this.
3012700	3013760	Yeah, dimple keys to actually
3013760	3016020	carve the bidding on them.
3016020	3017880	It takes a little more skill to
3017880	3018680	get in there.
3020240	3021940	But inside, you know, inside most of
3021940	3023620	the time, these are just simple
3024620	3026080	pin tumbler locks.
3027060	3027920	Let's see if I have...
3030320	3032020	You know, it's just a pin stack
3032020	3034100	in here. You know, it's facing a
3034100	3036080	different way. It looks different, but it
3036080	3038160	shouldn't be thought of as dramatically different.
3038160	3040700	It has its benefits, it has its weaknesses.
3041060	3042360	Some people have tried to make
3042360	3044300	these locks even more secure.
3044400	3045820	Let me see if I have that.
3046220	3048200	Well, first, instead of showing you the more secure one,
3048200	3050260	let me show you the less secure one.
3051280	3052100	There are other
3052100	3054140	means of, you know, if I said
3054140	3056180	the keyway is so small, it's hard
3056180	3058300	to put your picks in. There's
3058300	3060360	other means of picking them, however.
3060740	3062780	There's a method called impressioning.
3062840	3064220	Those of you, the few of you
3064220	3066260	who said you knew Barry Wells,
3066260	3068020	the rest of you shall be introduced to him
3068020	3070340	with this video clip. And we hope
3070340	3072160	that we have sound running. I'm jacked in
3072160	3074700	and everyone heard that loud blaring of sound earlier.
3075000	3076660	So let's see what we've got.
3076960	3078360	It's very difficult to
3078360	3080100	pick this lock. It's extremely
3080100	3082480	difficult. They put in all sorts of
3083040	3084800	anti-pick pins.
3085000	3086380	It really is a
3086380	3088500	very nasty lock to pick.
3088500	3090360	On the other hand, I just explained to you
3090360	3093280	a little bit about impressioning.
3093280	3094340	And there is a very easy
3094340	3096480	trick to open these locks.
3096480	3098380	And I'll try to demonstrate it.
3100840	3101320	Here
3102380	3104680	you see the original key.
3104680	3106600	It has a deep cut,
3106600	3108260	not so deep cut, deeper cut,
3108260	3110520	not so deep cut. And here's the
3110520	3112140	blank that we prepared.
3112200	3114420	The blank has the cuts all the way to the
3114420	3116300	deepest. So this key
3116300	3118380	will never open a lock. We even
3118380	3120120	made it a little bit deeper.
3120800	3122400	All the holes are just a little
3122400	3124540	bit deeper than they normally get.
3124540	3126420	And what I'm going to try to do now
3126420	3127720	is put some
3128420	3130440	aluminum tape over this
3130440	3132280	blank key so it becomes
3132280	3134720	high again. Stick it in the lock.
3134720	3136420	Then the pins will
3136420	3138300	push on the
3138300	3139920	prepared key.
3140740	3142380	They will bind.
3142460	3144280	I will move it left and right
3144280	3146200	and the keys that bind will actually
3146200	3148400	push deeper and deeper and deeper into
3148400	3150440	the foil. And at one moment
3150440	3152660	hopefully the lock will turn.
3152660	3154880	And I have an exact copy of the key.
3154920	3156660	And this is a
3156660	3158700	technique that is
3158700	3160560	possible on almost all dimple
3160560	3162580	lock keys. It's not possible on the
3162580	3165240	Notti locks because they have pin in pin
3165240	3167320	and some have to be pushed upwards
3167320	3169060	and therefore it doesn't work on that.
3169060	3171040	But it works on an amazingly
3171800	3172920	amount of locks.
3172920	3174360	I show you what I do.
3174360	3176640	I put some of this aluminum foil
3176640	3178020	that is being used in the car industry
3178020	3179160	and the heating industry
3180420	3182400	over this blank.
3182400	3184300	So as you can now see it's covered.
3184340	3185240	The trick is that
3185920	3188140	the way where the
3188140	3190780	key will enter the lock has to be perfect.
3190840	3192160	Because that's
3192160	3194120	where it will probably jam up
3194120	3195600	if this goes wrong.
3197040	3197520	Ok.
3197520	3199820	I'll try to
3199820	3201000	insert it.
3201320	3202440	Ok.
3204320	3206100	Now, the prepared blank
3206100	3207660	is in the lock.
3207940	3210340	And now I will wiggle it.
3211280	3212100	This will take
3212380	3214640	a little bit longer than the ace lock.
3215060	3215980	But hopefully
3215980	3218000	the result will be the same.
3221340	3222380	But anyway, if...
3223040	3224600	On average that would open the lock
3225280	3226380	because the tin foil
3226380	3228320	would slowly shape it to the
3228320	3230100	right levels. You go in there
3230100	3232180	you wiggle, wiggle, wiggle, wiggle, wiggle, pop.
3232280	3233800	That's how it would average.
3234000	3234900	It wouldn't take very long.
3234900	3235860	Ok, there we go.
3239280	3241160	Now watch when he pulls it out.
3247500	3249660	He's made an exact copy of the key.
3251700	3253840	Now remember, this is a
3253840	3256880	$150 lock.
3256880	3258120	Well, some people are really
3258120	3259800	going to be upset because this works with
3259800	3262580	a lot of these tin foil locks.
3262580	3263940	So that's Barry Wells.
3263940	3267320	Very, very good cat to know. He's a very bright guy.
3267320	3268060	And that is the impressioning
3268060	3270080	technique which made... and you can see
3270080	3271960	like the room just erupted at hope.
3271980	3274240	That really blows people away to see it's that simple
3274240	3276260	but it works. I've seen him do it and I'm just
3276620	3278440	I'm in awe of the stuff that he can pull off.
3278440	3279720	He's a really great guy.
3280820	3282080	There's... I'm mentioning here another
3282080	3284220	technique that sometimes opens these locks
3284220	3286540	called bump keying. We're going to cover that in a bit too.
3286540	3288300	How many people have ever heard of bump keying?
3288920	3289940	Oh, only some of you.
3289940	3291560	So you're going to have some fun with this in a bit.
3292500	3294180	Let me see if that's next or if I added...
3294180	3295540	No, I added a new section.
3295540	3298160	There is a dimple lock
3298160	3300220	that's a specialized style of lock.
3300220	3301700	It's a high-end dimple lock
3301700	3303640	that's recently the Multilock Company
3303640	3305640	who was acquired by the Abloy Group
3306120	3307820	a large umbrella company
3307820	3309820	of lock manufacturers in Europe.
3309820	3311340	The Multilock is very special
3311340	3313640	because it has what's called telescoping
3313640	3315770	pins or pin-in-pin systems.
3316160	3317780	The pin stacks,
3317780	3319720	not only do they have regular top and bottom
3319720	3321840	pins, but they have their hollow
3321840	3323860	so they actually have top and bottom pins
3323860	3326060	inside of the top and bottom pins.
3326140	3327860	So the key cuts
3328560	3330020	are both dimple cuts
3330020	3332560	and sometimes little protrusions in the middle.
3332660	3334300	So the pins track in and out.
3334300	3336220	There's pins tracking inside of each other.
3336220	3338000	It's a very, very secure design.
3338000	3339500	It's a brilliant idea.
3339980	3341860	It's a brilliant idea,
3341860	3344320	but in theory, theory and practice
3344320	3345620	are different things.
3347300	3348260	This is what
3348260	3350120	if you were to just kind of look down
3351160	3352000	a lock at a Multilock
3352000	3354480	it kind of looks like. You can see you have your pin stacks.
3354480	3356240	You can see kind of protruding.
3356240	3358260	We have pins inside of pins.
3358740	3359980	And most people say, oh, that's
3360140	3362320	a brilliant design. You know, you've got this Multilock
3362320	3363120	and that's so...
3363120	3365860	that must be hell to pick. I can't imagine
3365860	3368000	something like that. Well, it's actually a little
3368000	3370060	something like this. Did anyone catch the
3370060	3370800	difference?
3373060	3373980	This is what people
3373980	3375800	think a Multilock is.
3376160	3378780	This is pretty much how a Multilock works.
3380040	3380520	Can anyone
3380520	3382800	notice what is the difference?
3384420	3385580	Yes.
3385580	3386480	The top
3386480	3388520	pins are not independent of one
3388520	3390740	another. They are a related system.
3390740	3392460	They interact with each other in ways
3392460	3394720	that were not completely foreseen.
3395700	3396620	Can anyone
3396620	3398520	tell me... let's see...
3399440	3400500	This is a really hard
3400500	3402560	question, so this is definitely going to be worth
3402560	3404900	this will be an issue of Frack,
3405080	3406700	a Red Bull, a
3406700	3408260	lighter, and
3409100	3410360	I think we're going to do
3410360	3412220	maybe a hard drive. I have a lot of
3412220	3414320	old hard drives that are too small for
3414320	3416380	me, but maybe I
3416380	3418700	forgot to erase, you know,
3418700	3420340	Aqua Teen Hunger Force or Monty Python
3420340	3422920	or something I was storing on them. I don't know.
3423200	3424580	Might be there.
3425420	3426300	Can anyone
3426300	3428380	tell me the name of the student
3428380	3430580	from Rampamoe College in New Jersey
3430580	3432340	You already got your hand up?
3432340	3434420	Jesus. You have to pronounce his name
3434420	3436320	correctly, who published an
3436320	3438280	exploit based around
3438280	3440280	this attack?
3441640	3442320	Close, but
3442320	3444400	no, not pronounced right. I saw
3444480	3445460	a hand back here.
3446700	3447780	No guess?
3447980	3449260	Who was it over here?
3451300	3452260	Pardon me?
3453240	3454740	No, it was not Eric Murdoch.
3454740	3456240	I saw a few hands.
3456500	3458040	Was there anybody I feel like...
3458040	3460100	I'm missing out. I know your hand must have been up.
3460760	3461160	Eric
3462920	3464220	Michaud is the correct
3464220	3465980	answer. Way to go, man.
3474690	3475230	Yeah,
3475230	3477310	Eric is at WhatTheHack
3477310	3479130	which unfortunately is running at the same time as
3479130	3480370	Defcon this year.
3480570	3482990	See that red box? Take a look in there
3482990	3485350	and maybe grab a hard drive to your liking.
3487110	3487730	I think
3487730	3489010	FAT, probably.
3489010	3490330	Probably FAT file system.
3491390	3493150	The little red, the master, the box that says
3493150	3494070	hard drives.
3496650	3497290	Yeah,
3497290	3499150	the Michaud attack...
3499830	3500950	I'm sorry, what?
3507260	3508220	What's that?
3514680	3515100	You want to
3515100	3517020	help me out, Sandy? How would we describe this?
3517020	3519060	This is Mouse, everybody. She's a member
3519060	3521060	of Tool USA, so she's
3521060	3523140	here with us. Would we call this
3523140	3524960	an exploit or a proof or what
3524960	3526260	would you think this is?
3544880	3545920	Yeah, this is
3546020	3547160	a tool that we have worked and
3548000	3549780	I'd probably snap it apart,
3549780	3551720	but giving enough time, I can keep cutting these
3551720	3553900	and eventually we do get them to work.
3559700	3560180	Yeah,
3560180	3562000	Ken Presson, the guy from Peterson. Remember
3562000	3564140	I mentioned Peterson, the vendor. He is, this is definitely
3564140	3566100	on his radar and he's like, oh man, I got
3566100	3567360	some ideas for this.
3570700	3571920	Yeah, we've engaged with
3572420	3573980	Multilock is aware that people are working
3573980	3576680	on this. They've acknowledged that there is something to this.
3579940	3581420	Yeah, they do love to send
3581420	3582540	out letters, don't they?
3584240	3585580	The trick behind,
3585580	3587460	I mean, you can, most of you, you can see what's
3587460	3589380	going on here. You'll probably see already where
3589380	3591660	this is going. Typically,
3591660	3593560	the pin stack would function, this inner pin
3593560	3595600	would be pushed never that high
3595600	3597520	up, because you've got to picture a dimple
3597520	3599680	key. You're not going to have a dimple
3599680	3601540	that's little and like this big spike in the
3601540	3603660	middle. So dimple keys usually don't push
3603660	3605420	the inner pin very high.
3605820	3607720	That doesn't mean you couldn't stick something
3607720	3609500	in there to push that pin very
3609500	3611340	high. And if you
3611340	3613520	over lift that pin stack,
3613520	3615540	the Michaud attack just
3615540	3618020	completely moves everything out of the way.
3620360	3621660	It's a very,
3621660	3623800	very elegant discovery.
3623800	3625620	And we're very proud of him.
3625620	3627540	How old is Eric? He's like...
3628200	3629400	He looks 15, but
3629400	3631820	he's in his 20s. He's a really bright kid.
3631820	3633440	So, way to go, Eric.
3633940	3635540	Keep this on your radar and
3635540	3637480	see if Peterson starts selling anything
3637480	3638420	about it.
3640220	3641420	Back to other
3641420	3643360	locks that are less secure, and
3643360	3645360	everyone knows are less secure.
3645740	3646900	Tubular locks.
3647720	3649320	Tubular locks, you guys must have
3649320	3651560	seen tubular locks here and there in life, right?
3651560	3653340	How many people have seen a tubular lock?
3653740	3654600	Yes.
3655120	3657760	From the last talk, we mentioned the kryptonite itself.
3657760	3659260	Kryptonite tubular lock, one of the best
3659260	3661640	ones that people will probably be familiar with.
3661740	3663500	My parents' old house, the alarm system
3663500	3665540	was a tubular lock. When tubular
3665540	3667660	keys first came out, they were revered
3667660	3668860	as this breakthrough
3669340	3671900	because, yeah, they're a very new design.
3671900	3673520	No one had, you know, wow, what is this shape?
3673520	3675840	This is neat. I guess you couldn't cut this very easily.
3675840	3677700	Yes, it's harder to cut a tubular
3677700	3678680	key bidding.
3679660	3681880	But you have a lock that's literally staring
3681880	3684560	you in the face with all of the pins.
3685080	3685880	It lends
3685880	3687940	itself very well to a lot
3687940	3689420	of experimentation and fiddling
3689420	3691800	because you can independently work on these
3691800	3693700	pin stacks right there.
3701020	3703500	This is called a tubular pick.
3704420	3705240	And a tubular
3705240	3707340	pick has all these little fingers
3709100	3710660	that can track up and down
3711720	3713180	and actually simulate
3713180	3714660	the different cut depths
3715640	3717400	on a tubular key.
3718360	3720180	If I were to,
3720180	3721640	let's say, find a
3721640	3732650	tubular lock somewhere in my belongings.
3732650	3733290	Well, I'll do the
3733290	3735590	crappiest one I have just because
3735590	3738450	it's on the top of the pile.
3738450	3740850	Everyone's seen these before.
3738850	3740850	These are your
3740850	3742910	basic, you know, cheap-ass,
3742910	3744810	not-allowed-to-be-sold-in-stores-anymore
3745390	3746710	kryptonite-type lock.
3747950	3748850	The way a tubular
3748850	3750690	lock works, you take the
3750690	3752870	pick, stick it
3752870	3754630	right in the lock, and wiggle it.
3756730	3757130	And...
3757130	3758850	Hang on, I've got to give a little more tension on my...
3768160	3770620	The problem with this lock is I've beat it to hell
3770620	3772680	because of another exploit that we'll
3772680	3773960	talk about in a moment.
3775260	3776560	Yeah, I think this lock...
3776560	3778160	I think this lock is completely destroyed.
3778900	3780560	I was going to buy a new one, but you
3780560	3782480	really... You've got to give them credit. They did pull
3782480	3784580	all these out of the stores. You can't get this
3784580	3786520	lock anymore. So, yeah,
3786520	3788780	this lock is beyond all hope. Let me grab a different one.
3800860	3802440	Because of the public... Well, why aren't they
3802440	3804560	selling them in stores? Let's jump to this
3804560	3805180	then.
3808060	3808520	This is
3808520	3810540	why, if you don't
3810540	3812180	have... This is a kryptonite
3813060	3814280	Evolution 2000 lock.
3821060	3822960	I used to use this to
3822960	3824840	lock up my bike
3824840	3826820	around here in Seattle until I
3826820	3828960	found out that you can take a big pen and just
3828960	3830460	remove the top
3830460	3832820	and just pop it into
3832820	3834520	the lock and
3834520	3836500	just do a couple little quick twists
3836500	3837400	and turns and
3837400	3839040	voila!
3839820	3841880	Your lock and your bike is
3841880	3843560	completely compromised.
3843920	3845720	So, way to go,
3845720	3846540	kryptonite.
3847620	3848620	That's why they don't sell
3848620	3849900	it in stores anymore.
3851760	3852840	Does Peterson sell
3852840	3854620	big pens was the question. I don't
3854620	3856680	know. Yeah, the original
3857120	3858400	design, the spring tensions
3858400	3860280	were really bad and it was just...
3860280	3862540	That's what they were talking about in the last talk.
3865360	3866700	Right, the modern
3866700	3868620	tubular lock, the gentleman points out,
3868620	3870360	is usually designed by Ace.
3870360	3872340	There's the Ace and the Ace 2 even.
3872340	3874560	Those are much better quality tubular
3874560	3876920	locks. They have high tension springs,
3876920	3878500	variable tension springs. You can't just
3878500	3880600	jam a pen in there. I saw two hands,
3880600	3881600	one and then two.
3884700	3886700	Not really possible to use a shim
3886700	3888320	just because traditionally
3888320	3890460	tubular locks, you're not
3890460	3892440	spinning something. You're actually, those are
3892440	3894180	key retaining locks because of the
3895460	3896340	little notch
3896340	3898240	in the... well, you really can't see that.
3898820	3900760	If you've ever used a tubular lock,
3900760	3902400	you know you can't just leave the key in it.
3902400	3904420	You have to completely pull it back around to get the
3904420	3906340	key out. So there's no reason
3906340	3908520	for any type of spring mechanism to be a part
3908520	3910180	of the secure latch. It's all
3910180	3912720	one solid piece. You really can't shim them easily.
3912740	3914160	And there was one hand back here.
3914860	3916360	Same question. Okay, yeah, you really
3916360	3918400	can't shim them. However,
3919060	3920380	if, you know,
3920380	3922540	you have something that can't be defeated by a ballpoint
3922540	3924400	pen, which is, you know,
3924400	3926420	your Ace type design, you can get
3926420	3928460	this lock pick, which is,
3928460	3930300	this one's by Southerd. Other people
3930300	3932260	do make them. These are really
3932260	3934160	beautiful, beautiful devices.
3934740	3936260	I'm just gonna make that nice and flat and
3936260	3938560	flush, so that kind of simulates
3939660	3940340	a, you know,
3940340	3942220	you could actually see the key cuts
3942220	3944740	would be of different depths.
3945060	3946200	Those bidding cuts.
3946200	3948020	And this simulates,
3948020	3950760	let me flush it back out, this would be a
3950760	3953460	tubular key that's not cut at all.
3953460	3955980	If I give this a little tension,
3955980	3956580	and I stick
3956580	3959660	this in the lock, and I wiggle it some,
3959660	3961600	and now that's open.
3962600	3963940	You can see the,
3963940	3965820	this is a drawback, it draws a bar back
3965820	3968020	out here. This is actually a gun lock.
3970040	3972420	Not only have I opened the lock,
3972420	3973860	but, I have
3973860	3976500	the bidding of that key,
3976500	3978220	and you could take this to a
3978220	3980320	locksmith shop, and get a
3980320	3982260	replacement key cut, very
3982260	3984100	very easily. I don't recommend
3984100	3986420	that anyone walk into a locksmith shop
3986420	3986900	with a pick.
3988900	3989620	All the
3989620	3990840	picks that you can find, usually
3990840	3992940	of this nature, they come with what's called
3993080	3994860	a decoder key. It's a little key
3994860	3996820	that just has cuts on it of different
3996820	3998900	depths, and you kind of, it's like a gauge,
3998900	4000840	you go, okay, one, two, and you can actually
4000840	4002520	you could walk into a lock shop
4003080	4005060	and say, I need a seven pin tubular
4005060	4006800	key that's bidded out at three, six,
4006800	4008740	three, four, two, seven, blah, blah, blah.
4008780	4010640	And they'll just punch it in the machine,
4010640	4012920	and cut it out. I saw a couple hands on
4012920	4013560	that one.
4017560	4018260	This,
4018780	4019640	talk about,
4019640	4021360	talk about wonderful, wonderful
4021360	4023380	girlfriends. This was a birthday gift from
4023380	4025440	my girlfriend right before ShmooCon.
4025640	4027120	So, this is about an $80
4027120	4029340	pick. And you got,
4029340	4031480	you know, everyone else and their brother gives you, like, sweaters
4031480	4033340	and, you know, oh, here's some crap you don't really
4033340	4035500	care about. And I'm like, I wonder what this is going to be.
4035500	4037700	And I broke this out. I just, I wanted to cry.
4040100	4041400	Question over here.
4045680	4046740	I'm sorry.
4046740	4048660	Oh, I understand what you were saying.
4048660	4050720	He asked if, while I was picking this,
4050720	4052800	was I actually manipulating the
4052800	4054700	heights? No, you don't
4054700	4056680	have to actually force these to
4056680	4058400	do anything. What happens
4058400	4061460	is, much like with a
4061460	4063360	pin stack that we were working before,
4063360	4064780	if I put, let me see,
4064780	4066880	if I put torque
4066880	4069040	on this, it's not all
4069040	4071200	seven pins that are binding at once.
4071200	4073060	Only one pin stack is going to really
4073060	4074740	bind. So by torquing,
4074740	4076560	jiggling and jiggling around,
4076560	4078620	the binding pin stack will start
4078620	4080620	to push down, down, down, down, down
4080620	4082580	on a feeler until it's at the right
4082580	4084380	height. When it's at the right height,
4084380	4086360	that's no longer binding. The next one will bind
4086360	4088540	and so on and so forth. So all I have to do is jiggle it
4088540	4090480	and they'll eventually all track down to the
4090480	4092320	right height and they do it all by itself.
4092320	4094500	Question here, behind you actually.
4097720	4098540	I've never seen
4098680	4100380	a tubular blank. I think they're just, you know,
4100380	4101920	just tubes and
4104000	4104860	What's that?
4104920	4105660	They're blank.
4107300	4108060	Yeah, so yeah,
4108060	4109740	they have the little
4110100	4112120	notch that keeps it seated in the lock.
4112140	4114060	But you can just cut them with regular tools.
4114060	4115740	There was, hang on, you and then you.
4116160	4118000	And am I missing, are there hands on the outside that I'm not
4118000	4120340	seeing? No? Alright. Go ahead, sir.
4120340	4121580	Are they all the same diameter?
4121740	4123880	The question was, are they all the same diameter?
4123880	4126140	I think diameter, yes, but there are two
4126140	4126700	main
4128100	4129960	systems of pinning. There's seven pin
4129960	4131040	and eight pin.
4131780	4134200	There's actually two picks that Souther offers.
4134200	4136240	I think there's a bonus if you buy them both at once.
4136240	4137240	It's like a savings.
4137860	4140060	There's the seven pin. By the way, everything
4140060	4141940	is seven pin. I've never seen
4141940	4143620	an eight pin in my life.
4144200	4145840	There's also something called seven pin
4145840	4148020	offset, which the eight pin pick
4148020	4150560	will work in a seven pin offset lock.
4150780	4152160	But, yeah,
4152160	4153900	unless you are like a locksmith by
4153900	4155720	profession or want to become one, just
4155720	4157960	start off buying this one. The seven pin is going to be all
4157960	4160000	you play with for everything you can find.
4160260	4162160	There was another question over here.
4180230	4181590	Yes and no.
4181590	4183190	The gentleman raises a point. He said,
4183190	4185530	almost all of what we're talking about, especially as far
4185530	4187450	as pin tumbler picking,
4187990	4189370	excuse me, is based
4189370	4191530	upon misalignment and imperfection
4191530	4193850	in the locks manufacturing process.
4193850	4195450	And he said, you know, if you had a very
4195450	4197590	precise alignment, you wouldn't
4197590	4200030	need a lot of these other security features, would you?
4200030	4201890	Yes and no. You can get
4201890	4204030	very precise machining. And in fact,
4204030	4205950	all of your well-made locks, the ones I was
4205950	4207950	talking about, like the ASA locks,
4207950	4209990	the Medicos, just by name, they're all
4209990	4211890	engineered very, very well. They're engineered
4211890	4213950	to much higher tolerances. But
4213950	4215930	you guys know there's a difference between math on
4215930	4217870	paper and math in real life. There's never
4217870	4219810	anything that's 100% perfectly
4220250	4221690	flushed down to like a micron
4221690	4223790	level. There's always going to be some
4223790	4225990	intolerance introduced into the equation.
4225990	4227790	That's why high security pins are still
4227790	4229370	very valid to have.
4230010	4231750	But yes, so yeah, you can have
4231750	4233810	them, some are better than others. High security
4233810	4235670	locks will be better engineered.
4235810	4237530	There was another hand somewhere.
4237790	4238570	Yes.
4243510	4244670	Pardon me?
4246210	4246770	Oh,
4246770	4249430	I'm sorry. Welcome from across the pond.
4249430	4250590	The question was, how did the
4250590	4252770	biro trick work? And for those of us
4252770	4254170	yanks, that was how did the
4254760	4256070	ballpoint pen work?
4256330	4258610	That worked just because the
4258610	4260450	spring tensions were so bad
4260450	4262350	and because the pins could seat
4262350	4264330	all the way in, if you just
4264330	4266730	jammed, you know, you just jam a ballpoint
4266730	4268610	pen in there, it smashes all
4268610	4270590	the springs, all the pins, completely
4270590	4272570	out of the way, and it just forces
4272570	4274450	the pins way up inside the lock.
4274450	4276110	Both the, Miles, am I getting this right?
4276110	4278430	Both the driver and the keypin go completely
4278430	4280690	yeah, both the driver and keypin
4280690	4282550	go completely out of the plug
4282550	4284530	and they seat way up inside
4284530	4286850	the chamber so the plug can rotate freely.
4286850	4288850	People also notice that if you pull the
4288850	4290870	pen out, if you're doing that to a lock
4290870	4292710	sometimes the pins are all screwed up then
4292710	4294850	and you screw your lock up. So you need a pick like
4294850	4297170	this to get it back working again.
4297390	4298210	You had a question, ma'am?
4315640	4317640	Very good question. The question was, if you
4317640	4319520	want to get high security
4319520	4321580	pins in your locks, either to practice with them
4321580	4323600	or conceivably to secure your home with
4323600	4325400	them, he's, you know,
4325400	4327400	Viros is mentioning, where do you find these?
4327400	4329400	I don't see them anywhere. That's because
4329400	4331380	I'm assuming you're talking about in stores, you've never
4331380	4333420	found them. Right. Because we're
4333420	4335460	Americans and our stores just don't carry very
4335460	4337400	good locks because they sit on the shelf.
4337400	4339380	No one buys them. People are like, 70 bucks
4339380	4341560	for this sucker? This is 12!
4341560	4342700	Hell with that!
4343280	4345360	Yeah, you buy them on the internet. Look
4345360	4347280	on the internet. Any reputable vendor
4347280	4349500	will actually say, you know, features high secure pins
4349500	4351440	features this, that, and the other. It's not
4351680	4353440	a feature that they want to be secretive about.
4353440	4355500	It's a benefit to the lock. So they're going to advertise
4355500	4355880	it.
4357940	4359640	Oh, I understand.
4359640	4361560	Right. You don't, right, he said, do you
4361560	4363380	know if they're a spool pin or a mushroom
4363380	4365120	pin or a serrated pin?
4365760	4367600	Different vendors tend to have
4367600	4369440	pins they like to use. For
4369440	4371360	instance, you know, we talked about the
4371360	4373280	Asa, that was a spool pin lock.
4373280	4375840	We'll talk a little later about American brand padlocks.
4375840	4377780	They are big on serrated pins.
4378520	4379540	But, vendor by
4379540	4381420	vendor, you can kind of get a feel for it. I don't know
4381420	4383440	if there's a nice reference guide out there for who
4383440	4385080	has what. But, you know, just
4385080	4387320	break one apart and see what's in it.
4387900	4388820	There was a question.
4390260	4391680	Oh, very good point.
4391680	4393480	Very good point. We'll talk
4393480	4395440	about this in the URLs later when I give you a bunch
4395440	4397440	of links. Lockpicking101.com
4397440	4399860	would probably have that answer. It's a
4399860	4401940	great, great user base of really knowledgeable
4401940	4403600	people. Anything that I
4403600	4405720	don't cover or you want to know more about, either talk
4405720	4407900	to me later or check them out. I'm going to mention
4407900	4410460	them again in a bit.
4410460	4411420	Let's see, were there any other
4411420	4412520	questions at the moment?
4418960	4420340	The problem with a
4420340	4422140	blank is that it might not, I'm
4422140	4426500	trying to think if this was the thing, it might not grab
4426500	4426840	onto...
4426840	4428420	The question was, if the ballpoint pen works
4428580	4433100	would just a regular blank have worked?
4433100	4434960	Right, oh, alright. I understand.
4435840	4436440	Part of
4436440	4439100	part of the pins fitting
4439100	4440720	in, let me see.
4440720	4443680	I see what's going on.
4443680	4443960	When you have
4443960	4445900	key pins that are still
4446800	4448260	in these grooves,
4448260	4450040	you know, typically you'd have a driver pin stick
4450040	4452580	out and the key pin would seat in this.
4452600	4453780	Oh, Laz!
4454240	4456420	There you are. How are you, man?
4457320	4458380	Where were you?
4458460	4459580	Stuck in an airplane.
4459580	4461380	Oh man, sorry to hear that.
4465280	4465800	Usually
4465800	4467160	you would have key pins
4467160	4469500	in those grooves. They are helping
4469500	4471680	to turn that center post.
4471780	4473700	With the pins being all
4473700	4475880	pushed out of there, there's nothing for a
4475880	4478180	blank to grab onto. That's why the plastic
4478180	4480120	pen works so well. It actually grabs
4480120	4481880	the post because it uses
4481880	4484060	the plastic misshapes. It has a little friction
4484060	4488760	and it will help spin. That's why that happens.
4488760	4489180	Alright.
4489180	4491760	You've got a smaller fucking screen.
4491760	4493580	Are you going to sit up here and bitch?
4493580	4495780	What the hell, man?
4497000	4502120	So that was tubular locks.
4502120	4503580	There we go, moving slowly forward.
4504960	4505680	Yes?
4509940	4510820	Pardon me?
4516400	4517440	The question was about
4517840	4519440	Kensington's, the ones that you see
4519440	4521220	on a lot of laptops and security locks
4521220	4523460	like that. They say, was it a different diameter?
4523600	4524960	I don't know. I've never...
4524960	4527100	They're the same? Okay, yeah.
4527100	4528780	You can big pen those as well.
4535660	4536260	Okay.
4537500	4538020	Alright.
4538020	4539340	Oh, we've got more questions.
4543620	4544420	What's that?
4548670	4550750	Apparently cardboard from a toilet paper roll
4550750	4553030	works very well on a Kensington lock.
4555130	4556750	Alright, we've got to move on.
4556750	4558490	We're already in the second hour here.
4565490	4566610	Alright.
4566610	4568590	Moving along. Bump keying.
4568590	4571150	We were mentioning bump keying earlier briefly when I said
4571150	4573590	Barry was bumping his ASSA lock
4573590	4575890	and you can sometimes bump dimple locks.
4576310	4577350	Bump keying is a technique
4577350	4579370	used to quickly spring a lock
4579370	4582030	open with a specially cut key.
4582030	4583310	It's called a bump key.
4583310	4585350	It's also called a 999 key.
4585350	4587990	For a Red Bull, can anyone tell me why
4587990	4590230	it's a 999 key, where that name comes from?
4590230	4591230	I saw your hand.
4595870	4597150	Very, very good.
4597150	4598030	The answer is
4598570	4600450	key bidding has numbers
4600450	4602510	like 0 is no cut at all,
4602510	4604510	1, 2, 3, the cut depth.
4604570	4606650	A bump key is made by cutting all the
4606650	4608590	bidding down to the deepest depths or the 9.
4608590	4610150	So it's a 999 key.
4610690	4612650	Bump keys work...
4613330	4614310	Bump keys work
4614310	4616770	very, very similar to the way pick guns
4616770	4618690	work. So let's cover pick guns very briefly
4618690	4620630	and you'll see why bump keys are
4620630	4621790	very, very similar.
4624690	4627150	Basic physics, guys. If we have a
4627150	4629290	billiard balls on the table, what's going to happen
4629290	4633350	if I shoot this cue?
4633350	4633610	Yes.
4633610	4635210	3 is not really going to go anywhere.
4635210	4637490	2 is going to go flying. Newtonian physics
4637490	4640350	at its finest.
4640350	4641510	Pick guns work the same way.
4641510	4643370	Pick guns, just a long blade
4643370	4645570	down the barrel. It's tension with a spring
4645570	4647390	and a trigger that flicks this.
4647450	4649890	Pick guns work by smashing on the bottom pins.
4649890	4651790	Hopefully, if you get it all lined up just right,
4651790	4653470	you need a little practice, but you can smash them all
4653470	4655570	at the same time. And if you're
4655570	4657630	lucky, all the top pins will jump up
4657630	4659350	and you can turn the lock very quickly
4659350	4661710	before they have a chance to spring back down.
4662650	4663870	But pick guns,
4663870	4665750	besides being expensive,
4665750	4667970	bulky, a pain in the ass to carry around,
4668190	4669590	a very hard thing to explain what the
4669590	4671590	hell they are if you get asked,
4672670	4673670	there's a cheaper,
4673670	4675530	easier, smaller, and very simple
4675530	4677550	solution that can replicate this same
4677550	4678370	physics.
4680370	4681910	Thank you for this, by the way.
4682750	4683550	It's a retribution
4683550	4684910	for a previous beer bought.
4685830	4687550	Laz and I first actually met,
4687550	4690170	was it here at, was it 10 or 11?
4690190	4691230	I don't know, I was drunk.
4691750	4693470	Laz was up on stage and he was
4693470	4695550	picking away and he wanted beer
4695550	4697570	and I brought one up and I think I said
4697570	4699450	something about, yeah, I saw you at Hope and I learned
4699450	4701550	to pick. He's like, come up here and show me, man.
4701590	4703490	I'm trying to embarrass my ass and I finally picked one
4703490	4704310	for you, though.
4704730	4706790	By the way, you're a dick.
4707190	4709230	Why am I a dick? I was sitting over in speaker registration
4709230	4711530	and I saw a video of me and Barry on stage
4711530	4713990	and you're like, by the way, that's Barry, you didn't fucking mention me.
4714010	4715430	Well, I'm sorry, it says your name
4715430	4716850	in the link, Barry and Laz.
4716930	4717650	Thanks.
4720590	4721270	Alright, so
4721270	4723650	simulating a pick gun
4724030	4725170	with a bump key
4725170	4726730	works as follows.
4727890	4729570	Take a key that was designed
4729570	4730990	for your lock.
4730990	4732950	Notice I didn't say cut for your lock.
4732950	4734350	It doesn't have to be the right bidding.
4734350	4736910	It just has to be the right keyway that fits
4737910	4739470	down into your lock.
4740230	4741270	Take that and cut
4741270	4743470	all the bidding notches to the deepest level.
4743710	4745190	That's where you get 999.
4746170	4747030	Now I'm going to be burping
4747030	4748810	from this friggin' beer.
4749490	4751970	You can do this with a key machine.
4752310	4753090	Go to your local
4753090	4755030	hardware store and be like, can you cut it to
4755030	4757010	999? The kid who's making 550
4757010	4758370	isn't going to ask you why.
4759090	4759690	Or you can
4761230	4762350	do this with a Dremel.
4762350	4764650	You can do this with a lot of different tools.
4766210	4767010	I've hand cut
4767010	4768850	them before and they will work.
4769510	4770410	Take this key
4771030	4772870	and insert it into your lock.
4772870	4774910	Not all the way. You'll actually feel
4774910	4777070	as these ridges are going past the pins
4777070	4779250	you'll feel it click, click, click as it goes in.
4779510	4781190	Make sure it's one pin stack
4781190	4782030	out.
4783030	4783990	What's that?
4784930	4786890	Yeah, put it all the way in
4786890	4788610	and just click it out by one.
4789370	4790570	Next thing you want to do
4791050	4793130	is put a little bit of torque on this
4793130	4795210	key and just smash the hell out
4795210	4795850	of it.
4796950	4798730	You come at it with a force.
4799030	4800910	It bangs across all those ridges
4800910	4803070	and you can see they connect. Hopefully
4803510	4805270	you'll hit all of them at the same time
4805270	4807550	and all those top pins will jump up.
4812010	4813050	Yeah, you'll smash
4813050	4814290	your hand a lot.
4815490	4817170	It's just how that goes.
4817930	4818890	One thing you often will get
4818890	4820850	better luck with when you make a bump key, if you
4820850	4822990	cut the shoulder back just a hair farther than it should
4822990	4824630	this makes life a little bit easier.
4824810	4826810	It gives a little bit more wiggle room when you're bumping it
4826810	4829010	and knocks them a little bit harder. Not much of a difference
4829010	4829910	but it does help.
4833070	4834770	This is a
4834770	4835530	kind of what we'll call
4835530	4838050	one grade up from master.
4838050	4838930	This is a fortress lock
4838930	4840630	and this is a key that
4840630	4842610	originally went to
4842610	4844230	let me see if I have this one right
4844790	4846370	originally went to a different fortress lock
4847830	4848990	but I've cut it way
4848990	4850870	down. Now if I
4850870	4851510	put this in
4852710	4854190	this will not open this lock
4855130	4856690	but if I pull it out by one
4857970	4858910	I'm going to try to
4858910	4860230	do this so everyone can
4860850	4862850	work with the camera here. The trick
4862850	4864910	is a little and a lot. A little
4864910	4866910	bit of torque and a lot of
4866910	4867990	a little bit of bang.
4868850	4870490	You actually want the sensation
4870490	4872650	of the key slipping out of
4873830	4874630	your fingertips
4874630	4876830	as it's being knocked by the lock.
4879650	4880730	There you go.
4892950	4894630	You shouldn't have tried the second time, should you?
4895070	4896690	I was impressed the first time.
4898790	4901450	I'm pulling it too hard because I don't want to smash my thumbs.
4901650	4902450	Pussy.
4904910	4906170	Here, you do it then.
4906230	4907030	Shit, I don't do that.
4908070	4909670	That's why I have both colors for you.
4910410	4911690	So that's bump keying.
4911810	4913790	But there is a... I'm sorry, question.
4922980	4924440	You're a brighter man than I.
4924860	4926680	The question is why can't, you know, you just put...
4929520	4930940	Yeah, put a torque tool in there
4930940	4933000	or on the key. Yeah, you probably could do that.
4933460	4934740	I'm not thinking clearly
4934740	4936520	apparently. My thumb
4936520	4937800	thanks you for that.
4939120	4940540	This is sort of the
4940540	4942600	dirty bump method, if you will.
4942600	4944000	It's not that sophisticated.
4944340	4946740	There is an even better bump method that the guys
4946740	4949640	in Tool in the Netherlands came up with.
4952040	4953300	I'm sorry, there's a question.
4953300	4954640	Where was it? Left side.
4957600	4958760	Not exactly.
4958760	4960860	Raking, I didn't even cover raking that much.
4960860	4962380	We'll talk about it in the hands-on.
4962380	4964860	Raking is just beating up the pins
4965420	4966820	independently, trying to just
4966820	4968500	catch a bunch of shear lines at once
4968500	4970080	on a crappier lock.
4970540	4972700	Bump keying actually is intended to
4972700	4974860	hit all the pins simultaneously.
4985220	4986980	Oh, master wafer. Yeah, that can
4986980	4988960	happen. The question was, we'll talk about
4988960	4990820	master pinning in a little bit.
4992160	4992980	Master pinning
4992980	4994960	sometimes involves very small pins
4994960	4996680	inserted or actually wafer shaped pins
4996680	4999100	inserted into the stack with a
4999100	5001280	big gap introduced like that.
5001280	5002820	Can those flip and bind up? Yes, that
5002820	5004600	conceivably can happen. It's not the most
5004600	5007160	common thing because the gap is only there for a second.
5007300	5009160	But I imagine it could happen.
5009260	5011020	A little addendum to that.
5011680	5012960	If that is happening,
5012960	5014880	it's because the locksmith didn't follow the manufacturer's
5014880	5016680	tolerances or the lock is wearing out because
5016680	5018580	they have specific minimum wafer sizes
5018580	5020740	so that doesn't happen. Because that used to happen a tremendous
5020740	5022680	amount with people using too small of a wafer.
5023340	5024620	There you go. Thank you.
5025300	5027020	Shit, I got beer, man. I'm running out.
5027100	5027700	Alright.
5029140	5030760	Now, with respect to the
5030760	5032860	I said that was like the dirty bump technique
5032860	5034980	there is a really nice bump technique
5034980	5037340	that's been published by the guys in Tool.
5037340	5038880	It's called the Minimal Movement
5038880	5040960	Bump. They actually have a
5040960	5043180	white paper about it.
5043180	5045080	This involves taking an
5045080	5046900	existing bump key and
5046900	5048940	at two different points heavily
5049280	5052160	modifying this bump key even further.
5052160	5053580	You can shave off
5053580	5055200	probably about a quarter to a half
5055340	5056840	of a millimeter from the shoulder
5057920	5058700	and a half of a millimeter
5058700	5060720	or more from the tip.
5062600	5062740	Now
5062740	5064400	this is a very, very unique
5064400	5066520	modified key. If you have it in the lock
5066520	5068760	you can even squeeze it a little deeper now
5068760	5071040	because you've shaved the key down.
5071160	5072540	And you notice that as you squeeze it in
5072540	5074600	the spring pressures from the driver pins
5074600	5076540	up top will actually kind of kick it back out
5076760	5077920	a millimeter or so.
5078260	5080780	This enables you to deliver a lot of
5080780	5082280	force right where you want it
5082280	5084280	very precisely without
5084280	5086900	smashing across whole rows of pins.
5086900	5088760	You come at this. They have a tool they call
5089580	5090920	a tomahawk. I've seen them
5090920	5092560	whack right at it. It comes right into
5092560	5094540	beautiful force, delivered real clean
5094540	5096160	and I've seen them bump
5096800	5099080	really sophisticated like Barry mentioned.
5099080	5100920	Remember I said the geographical weakness
5100920	5102040	on that V10?
5102360	5104680	He can make a bump key out of a V10
5104680	5106820	because the top part of the bidding will
5106820	5108980	bump. The bottom part of the bidding on the side
5108980	5110940	bar just does its job normally.
5111140	5112740	He bumps his V10 that way.
5112740	5114560	He's bumped multi-locks that way I've heard.
5114560	5116340	I can't imagine how, but I guess the force
5116340	5118420	just gets delivered because we talked about how
5118420	5120000	the interactive pins work.
5121780	5122760	That's a very
5122760	5124120	powerful attack.
5124320	5126580	It can, by the way, be bad for the lock.
5126580	5128800	If you have a family heirloom
5128800	5130280	or something and you're like,
5130280	5131840	I'm going to play with bump keying.
5132120	5134440	Don't do it if you care about the lock because I've destroyed
5134440	5136520	locks doing this, especially if you do
5136520	5138300	the dirty method. It'll misshape the pins.
5138300	5140000	It'll really beat things up.
5140220	5142260	I've had locks that just don't even work anymore
5142260	5143920	because I've bumped them to death.
5148600	5150100	We can cover that a little.
5150100	5152320	The question was, doesn't this leave clear
5152320	5154380	indications that this has happened? There's forensic
5154380	5156280	evidence. We can talk about that in a bit.
5156280	5158560	I've got to keep moving through though. We've got a lot of good stuff.
5160020	5161100	Wait, yes, question.
5166680	5167600	What keeps the
5167600	5168660	key pins?
5170280	5171920	Well, they can't fall down
5171920	5173620	anymore because they're in the
5173620	5175340	keyway as far down as they go.
5175500	5177800	And they're not going to jump up because we're transferring
5177800	5179220	physical force through them.
5179220	5181940	So they're just going to sit right where they are.
5182120	5183880	They're not going to go up, they're not going to go down.
5184020	5185340	They have nowhere to go.
5185860	5187640	There's spring tension behind them so they're not
5187640	5189800	staying suspended. You have a half of a split
5189800	5191460	second where they're up there and you're just
5191460	5193900	catching that right moment. They're not staying up there permanently.
5194080	5195640	You're just hitting it and they stay there for a split
5195640	5197200	second like throwing a ball in the air.
5197540	5199820	And while it's upright, just at the right height is when you grab it.
5200200	5200760	Alright.
5202220	5203840	Let me cut you off for half a second.
5203840	5205680	General disclaimer, I don't know if you did this, I'm sorry I was
5206020	5206580	registering.
5207480	5209040	You mentioned you can break locks.
5210120	5211340	Don't practice on your front door
5211820	5213740	for a number of reasons. One, because you may
5213740	5215820	break the lock, but more importantly because your neighbors will call the
5215820	5218100	cops because they don't know who you are.
5218720	5219800	If you're going to practice on any door,
5219800	5221740	try a back door or whatnot, but still you're going to get your ass locked
5221740	5223800	out of your house. So just go buy a $10 lock from Home Depot
5223800	5224500	to practice.
5225660	5226740	Very, very good point.
5227480	5228680	So yes, this can be bad
5228680	5231400	for the lock. I've destroyed locks doing this.
5231420	5232860	Some of my locks, I've had to
5232860	5234540	try to lubricate them to open them now
5234540	5236700	because they're just broken and about lubrication.
5236700	5238740	The question for a Red Bull...
5241520	5242740	When, if ever,
5242740	5244860	do you use WD-40 in a lock
5244860	5246400	and why or why not?
5246760	5248060	Whoa, that was a lot of...
5248060	5250980	I think it was grayish blue shirt here.
5254140	5255180	Half right answer.
5255180	5256260	Get you a lighter.
5256800	5258040	Come on up for a lighter.
5272870	5274470	Oh, well it's a little bit...
5274470	5277150	You're kind of on the right track, but I'm looking for a solid
5277150	5279270	answer on when, if ever, you can use
5279270	5281490	WD. I've got a guy down here with the glasses.
5283050	5285070	Well, his answer was never, and I'm saying
5285070	5287410	that's not a completely accurate answer.
5292270	5294570	Well, you're all right around...
5294570	5296130	Basically, a lot of people are hitting
5296130	5297950	this point. The main point I wanted to make...
5297950	5300070	Hang on here. My guy's in the front.
5300070	5302230	Just throw some lighter at these people with their hands up.
5302310	5303770	Because everyone kind of has it.
5303950	5305570	Keep your hands up. I know who you are.
5306170	5308170	That, hey, extra hands just went up.
5310210	5312010	The point I wanted to make is
5312390	5314310	WD-40 is not good...
5314310	5315870	You can... You got them?
5315870	5317630	These guys? All right.
5317790	5319450	Start ripping with people's heads, dude.
5320550	5322150	WD-40... We got a guy...
5327540	5328120	Yes.
5328180	5329360	WD-40...
5329360	5330580	Did you get one?
5331480	5332520	Was that a question?
5339510	5340470	Very, very good.
5340470	5341770	He's got the full... You actually...
5341770	5343610	You get the Red Bull.
5347350	5348110	Yes. All right.
5348450	5350090	We got to keep moving. Here's the...
5350090	5352050	Oh, man. We're really dying on time.
5352070	5354250	The deal is... Well, that's cool.
5354250	5355750	But we got a lot to cover.
5355750	5357170	I added a lot of shit.
5358850	5359810	WD-40...
5359810	5361350	Anybody who's in the service,
5361350	5362910	especially the Navy, maybe you can tell me,
5362910	5364590	what does WD-40 stand for?
5365250	5367590	Water displacement is exactly right.
5367590	5369330	Water displacer 40 was a formula
5369330	5371190	designed to seep into
5371190	5373630	maritime situations,
5373630	5375290	to seep into all the cracks,
5375290	5377210	to dry out in there, to actually make
5377210	5379050	this little waxy buildup to keep
5379050	5380770	water out of machinery
5380770	5383170	so it didn't rust and corrode when it was in there.
5383170	5385590	It was not meant as a lubricant.
5385590	5387810	It's kind of the antithesis of a lubricant.
5387810	5389490	Yes, it's greasy when it goes in,
5389490	5391050	but it doesn't stay that way.
5391450	5393790	There's essentially three kinds of lubricants
5393790	5395990	out there. There's wet lubricant,
5395990	5397830	dry lubricant, and drying
5397830	5399670	lubricant. And everyone who's tuned
5399670	5401770	in on the APTV system just right now,
5401770	5403910	they're saying, what the hell talk is this?
5403910	5404370	Looking at the...
5405950	5408070	Did they move the schedule around?
5410810	5411770	Different situations
5411770	5413570	call for different products.
5413570	5415290	If you have any precision
5415290	5417990	mechanism, like, for instance, locks,
5417990	5419390	you want to use exclusively
5419650	5421530	a wet or oil-based lubricant,
5421530	5423770	something that is going to go in wet and stay wet.
5423770	5425410	I use gun oil on most of my
5425410	5427610	really, really high-end locks because it'll
5427610	5429150	not foul the thing up.
5430350	5431390	Dirt and fouling
5431390	5433570	can get into oil, and it
5433570	5435630	can gum things up if you live in a
5435630	5437630	really harsh environment. If you have,
5437630	5440530	let's say, a lock out in the desert somewhere,
5440530	5441770	Las Vegas, any locals,
5442230	5443830	maybe you want to use graphite
5443830	5445870	powder in a lock like that because it'll go
5445870	5447970	in dry and stay dry.
5448550	5449710	It'll help, you know, it won't get
5449710	5451410	too fouled up and gummed up.
5452010	5453690	That's right, it won't freeze. But just
5453690	5455670	know that WD-40 will
5456070	5457830	attract dirt and fouling. It'll trap
5457830	5459710	it up. The only time, by the way,
5459710	5461650	the answer, the full answer I was looking for,
5461650	5463670	the only time you use WD-40
5463670	5465850	is if the lock is jammed and you don't
5465850	5467730	care about the lock. If, you know,
5467730	5469630	you've gone over to your aunt's house for Christmas
5469630	5471450	and she says, oh, I think that's the trees
5471450	5473530	out in the shed, the decorations. And you go out there
5473530	5475650	and it's a lock that someone hasn't opened since 1974
5476070	5477670	and it's rusted to hell.
5477770	5479570	Yeah, you can WD-40 it or you can
5479570	5481670	soak it in kerosene and maybe it'll
5481670	5483530	open and then you throw the lock away
5483530	5485510	because it's not, that's not good for the future
5485510	5486650	health of the lock.
5487810	5488530	Yes?
5491750	5494050	LPS makes a good product? What is LPS?
5506290	5507010	Okay.
5508030	5509510	So yeah, he meant,
5509510	5511310	the gentleman mentions industrial lubricants,
5511310	5513430	high-end industrial lubricants are good.
5514110	5515170	Yeah, Google for LPS
5515170	5517110	or check it out, Molly Coat, those are
5517110	5518050	also good.
5519290	5521250	Let's talk about something that was referenced
5521250	5522950	in the last talk.
5524130	5525270	Firearm locks.
5525270	5527170	How many, we got a lot of libertarian type
5527170	5529610	people here at DEF CON, how many people are gun owners?
5530010	5531710	You don't have to raise your hands if you don't want to.
5532150	5533070	How many people
5533070	5534990	lock your guns in some fashion?
5536370	5537330	What I'd like to see,
5537330	5538530	maybe you don't have kids in the house,
5538530	5541050	you don't have kids in your house, then you lock your door.
5541050	5542330	Do super soakers count?
5544750	5546950	We're going to talk about something that's very serious
5546950	5549070	to me right now, just because
5549070	5549830	it's a very
5551030	5552810	important issue that people understand,
5552810	5555070	the severe weaknesses of some locks,
5555070	5556990	what they're designed to do, and what they're not
5556990	5558030	designed to do.
5558550	5560910	I would like a volunteer, I know we have
5560910	5562910	people on the goon squad, I know in fact
5562910	5564910	Vairosa, you have time in the service.
5565370	5567090	Stand up for a second, man. I'm going to use
5567090	5568890	Lou. Everyone, this is
5568890	5569750	Vairosa.
5571050	5572690	Come on, stand up for the guy.
5576170	5577430	Vairosa has served,
5577430	5579110	so he's going to be our authority
5579110	5580950	for today. I'd like, and this
5580950	5583170	is for everyone's comfort, he's
5583170	5585070	going to inspect a stage
5585070	5586990	prop that I have that looks like
5587130	5589170	a weapon, but we're going to take him
5589170	5590990	at his authority that it is not a
5590990	5592870	functioning firearm. I want everyone to
5592870	5595090	know this, I want everyone to be very...
5595090	5596930	Yeah, you haven't anything to drink, have you?
5597810	5599050	Is everyone comfortable
5599050	5600890	with his authority as opposed
5600890	5603230	to you physically inspecting it yourself? If not,
5603230	5604830	we can actually have someone else
5604830	5606770	who is even more well known,
5606770	5608910	if you'd like a priest or someone to come up. But is
5608910	5610210	everyone okay with Vairosa?
5611010	5611690	Alright.
5615190	5616910	Yeah, it really pisses off the TSA when you put that
5616910	5619310	in your carry-on, by the way. Yeah, FedEx.
5620270	5621370	So yeah, it
5621370	5623310	should be a filed down firing pin, the
5623310	5625430	barrel's solid. Solid
5625430	5627250	barrel will pretty much do the job. Yeah.
5628450	5629530	Would you care to certify
5629530	5630990	that this is a non-firing weapon?
5631490	5632930	I didn't see that it's non-firing.
5632930	5635210	There's nothing in it.
5635250	5637250	It's completely cored up.
5639310	5640590	It's a solid barrel.
5645000	5646020	I don't know if you can see...
5646680	5647740	Dude, don't worry. Alright.
5647740	5649860	Well, I'm just very serious about this.
5651140	5651940	Thank you.
5651940	5652580	Thank you.
5665500	5666120	How many
5666120	5667880	people have ever used
5668180	5669900	a trigger lock that looks like this?
5671120	5672020	I'm very pleased
5672020	5673560	that not too many people have.
5673960	5675980	When I was... God, I want to say
5675980	5678100	I was 12 or 13,
5678100	5680040	I got an air gun for my
5680040	5682220	birthday, and a
5682220	5684620	lock like this is what was installed on it.
5684620	5687580	I'm going to guess I was probably about
5687580	5688140	14 when I figured out
5688140	5690220	how easy it was to bust this up.
5690860	5692160	And my parents were very proud that I
5692160	5694160	actually was just so proud of the discovery.
5694160	5696860	I went and showed them right away. They're like, wow, that's so neat.
5696960	5698560	This goes in our closet now.
5707900	5708700	This is
5711620	5713640	your typical trigger lock.
5715280	5717120	Most vendors of trigger locks,
5718600	5721560	there are two popular designs of trigger locks.
5721580	5722840	There are bad,
5722840	5724560	and there's colossally bad.
5725340	5727000	Pretty much everyone explores these two
5727000	5728240	designs of locks.
5729200	5731680	This is just in the bad category.
5733600	5734580	Can everyone see?
5734580	5736980	I feel bad. This camera is so awful.
5736980	5738060	It's not bad. No, you can see pretty good.
5738060	5739420	Alright, we'll do what we can.
5739680	5742620	So this is on. It's installed the way it should go.
5743320	5744740	I'm going to take this tool
5748000	5749080	and I can't
5749080	5750080	really see.
5752660	5753260	I'm going to have to...
5753260	5754080	I've got to move my camera
5754080	5756200	so I can see what I'm doing a little better
5756200	5757500	and get my hands in it.
5761460	5762300	It's upside down,
5762300	5763520	but you guys can live with that.
5766520	5767600	Oh, am I out of frame?
5769820	5772880	For anyone who thinks he's out of frame, he's shoving a big-ass piece of metal in there.
5778780	5780700	Yeah, we don't have to applaud on that one.
5783240	5784260	This is a piece of
5784260	5786620	wire, people. This is a
5786620	5788560	piece of fish snake.
5788640	5793940	There's a question?
5793940	5795160	I wouldn't recommend trying
5795160	5801280	it on a loaded weapon, that's for sure.
5801280	5803820	Right, you're never supposed to lock a loaded weapon,
5803820	5804780	people are pointing out to me.
5804780	5810600	Side note for you though, on that specific weapon, no. On others, maybe.
5810600	5811220	Why
5811220	5812240	in the hell
5810640	5812640	is this possible?
5814200	5815360	Once again,
5815360	5817040	the golden rule, the...
5817040	5818340	I'm sorry.
5819340	5821220	Yeah, keep shouting at me if I'm out of frame,
5821220	5822800	because I want you guys to see everything.
5823000	5824800	The golden rule of, you know,
5824800	5827160	the triumph and peril of our
5827160	5829080	capitalistic system is that the marketplace
5829080	5831180	will regulate itself.
5832160	5833340	One of the marketplace forces
5833340	5835360	is convenience, users' convenience.
5835740	5836960	How does this lock work?
5836960	5839540	Well, this lock just has a
5839540	5840880	pillar down the middle,
5840880	5842700	as you can see,
5842700	5844890	and a bar that rotates. Now this bar...
5845520	5846840	I wonder if I could focus this
5847020	5847940	a little more.
5849720	5851160	Nope, that's worse.
5852780	5855060	I'll take my word for it. This bar, you can kind of see,
5855060	5856980	has little teeth, notched teeth.
5857720	5860140	Now these teeth are exposed,
5860140	5861160	and now these teeth
5861160	5861920	are hidden.
5863200	5864040	Those teeth
5865840	5867220	completely engage with
5867920	5869400	teeth that you can barely see
5869400	5871720	down a steel plate,
5871720	5874320	down this barrel here.
5876040	5877360	This steel plate
5878660	5880560	is spring-loaded.
5884400	5886900	Why is that? The man points it out.
5886900	5889180	So that if I want to lock this,
5889180	5892860	and I don't have the key in it,
5892860	5895400	I can just slide it together.
5896340	5897860	Do you know how
5898960	5900620	fucking ridiculously simple
5900620	5902400	it would be to make
5902400	5903680	this steel plate
5904720	5906620	solid? Just make
5906620	5908720	the bastard part of... you wouldn't even need
5908720	5909680	the spring.
5910820	5912700	Just, you know, oh, I need to turn my
5912700	5914460	key to lock it and secure it.
5914460	5916880	I'm out of frame again. I can't
5916880	5918940	fathom why it was designed this way.
5919040	5920260	But it was.
5921280	5922620	This is not...
5923540	5924480	This is nothing.
5924480	5926600	This is just a joke. I made
5926600	5928780	this in no time. I made this type of
5928780	5930100	pick when I was 12.
5930420	5932820	They mentioned in the last talk, this information is out
5932820	5934680	there. How many of you have ever read about this?
5934680	5936660	How many of you have ever heard about this? How many of you
5936660	5938780	still use a lock, you know, a gun lock like
5938780	5940820	this? Nobody talks
5940820	5942780	about this, because the information just doesn't get
5942780	5944920	out. I hope that
5944920	5946760	if at least one of you goes home and
5946760	5948660	tells somebody, maybe someone will stop using
5948660	5950820	one of these, because it's really bad.
5950820	5952640	It's just a really bad design.
5956930	5958510	In the colossal... I'm sorry, we had a
5958510	5960310	hand. All right.
5963450	5964610	Who manufactures the blue
5964610	5966490	lock was a question. They are
5966490	5968550	somebody I've beat up enough on
5968550	5969830	on this talk already.
5971010	5972210	They're kind of litigious
5973510	5974530	and I'm not going
5974530	5976390	to say who makes it. Go to
5976390	5978590	any gun shop in America. They're going to have a whole rack
5978590	5980070	of them. You can see who makes it.
5981910	5982570	Somebody said
5982570	5983130	it.
5984730	5986670	These are the, just included
5986670	5988770	for your edification, these are the colossally
5988770	5990270	bad category.
5991510	5993170	What the hell is that?
5994050	5994790	I don't even know
5994790	5995990	what this is.
5996430	5998730	But it's not a freaking lock. You can beat
5998730	6000290	this with a paper clip that you have to
6000290	6002550	pop a CD out of a jam drive.
6005400	6006040	And we saw
6006040	6007920	this is a slide lock. This is what I was
6007920	6010080	showing you earlier when I was playing with
6010080	6012020	tubular pins. A slide lock
6012020	6014260	is a very nice idea. It's a little more secure
6014260	6016120	in that it locks the weapon completely out
6016120	6018500	of battery, so it can't be engaged, fired,
6018500	6020300	anything. But, you know,
6020300	6022100	I showed you this one. Great concept, but
6022100	6024100	it's a really shitty tubular lock that's
6024100	6025680	employing the mechanism.
6025920	6028120	Put a better lock on the end and maybe put a Medeco on the end of that
6028120	6029740	and you might have a pretty decent lock.
6032160	6033920	Some people just use cable.
6033920	6035860	You can secure firearms with cable.
6035980	6038200	This is a very secure solution.
6038440	6040000	Make sure you use a coated cable so it doesn't
6040000	6041640	rip up the innards of your gun.
6042020	6043980	Also, be aware that the majority
6043980	6046080	of cable you're going to buy like this, this is going to be
6046080	6047940	an Astacular 2000
6047940	6049340	series lock somehow.
6049660	6052680	They just come really bad. I don't know why.
6053060	6054040	And let's face it, this is not
6054040	6056600	the best solution. It's a very inelegant solution.
6057680	6058620	In general,
6058620	6060100	why do I have this section in the talk
6060100	6062060	now? Everyone...
6062060	6063820	I think people here tend to be a little more
6063820	6065980	clueful than the general public, so most
6065980	6068240	of you should know this already. These are not
6068980	6070060	security devices.
6070280	6071220	These are
6071980	6073540	persuading or dissuading
6073540	6075340	devices. These are designed to
6075340	6077220	prevent very little children
6077220	6079420	from fouling around.
6079420	6081320	Oh, what's under daddy's drawer? Here,
6081320	6083540	they'll look at this. These are designed to...
6083540	6085120	These are locks made by children
6085120	6086540	for children, basically.
6088100	6089100	This will not
6089100	6091180	thwart criminal behavior. This will
6091180	6093040	not thwart a curious
6093040	6094260	teenager.
6095100	6097400	Many people, I don't always get agreement
6097400	6099080	with this, but I'm betting this crowd
6099080	6101040	will understand that if you have kids
6101040	6103180	and you have guns, you show them
6103180	6105180	what the hell they are when they're very
6105180	6107240	young. You teach them to respect them,
6107240	6109060	you teach them not to play with them, and then
6109060	6111260	you lock them the hell away from them.
6120160	6121100	But people who just
6121100	6123120	want to, like, no, don't tell them anything, that's
6123120	6124320	not the best solution.
6124900	6125860	What's up?
6127440	6128900	Oh, sorry, question.
6135060	6135780	That's a valid...
6135780	6137280	If you have a very easily
6137280	6139420	field-strippable weapon, just strip it out,
6139420	6141360	take the firing pin out, put that in a secure
6141360	6142120	place.
6143680	6145660	Well, the man makes a point down here.
6145660	6147380	Someone else could acquire another one and put it
6147380	6149440	back in. So, you know, you guys
6149440	6151620	are all smart enough, you can come up with solutions,
6151620	6153540	but just keep this on your radar. One question
6153540	6155280	and then we gotta keep it on...
6161610	6162330	Yes.
6165190	6165950	Those are the under
6165950	6167690	desk type models, and yeah.
6169010	6169950	Yeah, he mentioned the
6169950	6172090	Colt Corporation, and I do
6172090	6174230	love their weapons. They make a very nice
6175090	6175930	box that it just
6175930	6178150	has, it's almost like a hand pad, and you can feel
6178150	6180030	the buttons, and if you know the order,
6180030	6181990	you program the order in, you can just feel
6181990	6183910	it pop, pop, pop, pop, pop, and then you can, you know, open
6183910	6185950	it up. Any type of safe, or
6185950	6187930	any type of box that you put a gun
6187930	6189850	in is much better than just throwing a lock
6189850	6190810	on the gun.
6194120	6195500	Yeah, there's a lot of
6195500	6198120	better gun locks out there that we can talk about some more.
6198480	6199520	We're good, we still have like 45
6199520	6201620	minutes because we're rolling into the next half hour,
6201620	6203320	so we can, we're still doing alright.
6204500	6206300	Quick ones on handcuffs.
6206680	6207520	We're, you know, more for
6207520	6210000	the law enforcement crowd, I guess, guns to handcuffs.
6210720	6211720	Anybody who doesn't
6211720	6213820	know how handcuffs work, this is gonna be a real
6213820	6215200	real brief overview.
6215640	6217820	Inside of a handcuff looks something like this.
6217820	6219720	You have a little ratcheting arm,
6220220	6221720	and this paw that spins around
6221720	6223600	has teeth on it that the arm
6223600	6225560	engages. It's why
6225560	6227780	you can spin the paw one way and not the other.
6229060	6229840	When you stick
6230100	6231860	a key in the lock,
6233100	6233900	and you turn that
6233900	6235840	key, it just lifts up the
6235840	6238040	arm. That's what the inside of a handcuff
6238040	6239880	looks like. You can see how
6239880	6241880	it's, you can jam almost anything in a handcuff
6242180	6243760	and just try to, you know, flip the thing.
6243760	6245540	And besides, a handcuff key is a dollar, so
6246000	6247560	it's not that hard to do. You can shim
6247560	6249800	hand, you can do a whole lot with handcuffs that are kind of outside
6249800	6251760	of the scope of this. We can, I don't have any to play with,
6251760	6254060	so if anybody else does, we can play with them later.
6257600	6257880	Um...
6258560	6259880	That could have been interpreted
6259880	6261220	differently, I guess.
6264200	6265660	Could anyone tell me
6267740	6268740	for a
6269980	6270820	Red Bull...
6270820	6275860	I gotta clear some of this out of the way.
6275860	6277800	What is
6277800	6278320	the little
6278320	6279760	pin for on the back of a hand?
6279760	6287870	I saw a hand right here.
6287870	6289470	Everything alright?
6289470	6290470	Hang on, yeah, he got it.
6290470	6292790	The answer is, what is the little pin for?
6292790	6294850	It is a double lock mechanism
6294850	6296130	on a handcuff.
6297150	6298950	The little hole that's on the back
6298950	6300790	of a handcuff, that most people don't realize it's there
6300790	6302910	for a reason, if you stick the pin in
6302910	6304830	there on the back of a key, it'll actually
6304830	6306810	put a bar in that prevents the pawl from
6306810	6308930	I'm sorry, the ratchet from moving at all.
6308930	6310710	So it can't get any tighter, it can't get any
6310710	6312230	looser, you can't shim it.
6312430	6314730	To open it, you see it's actually a two-step process
6314730	6315750	to open it.
6321320	6323680	Yeah, yeah, double lock. In fact,
6323680	6325800	anybody who's ever been in custody,
6325800	6327560	maybe in a street protest or something, and they
6327560	6329740	over-tighten you on purpose, but no, I don't have anything
6329740	6330900	negative to say about that.
6331800	6333520	They're supposed to double lock you
6333520	6335780	all the time, because it's actually for your own safety.
6335780	6337760	So the cuffs, if you wriggle or you sit in the back
6337760	6339560	of the car, they don't get tighter on you
6339560	6341800	when you're in them. Most officers don't
6341800	6343880	do that, and it's, you know,
6343880	6345000	I assume
6345860	6347700	you should. Does anyone here a cop?
6347700	6349720	Do you do that? Anybody in here who's a law enforcement
6349720	6350980	officer do a double lock?
6352820	6353380	So we
6354300	6355460	spot the fed.
6359380	6361200	Yeah, they should. Frankly,
6362000	6363440	it's funny, but that's true.
6363440	6365120	Most of my friends who go to
6365120	6367300	protests will request that. They'll say, you know,
6367300	6369440	I request, please make sure you double lock this,
6369440	6371200	sir. And so they don't get,
6371200	6373040	because if you've ever friggin' been cuffed at a protest,
6373040	6375000	you're going to be thrown in a bus somewhere for like six
6375000	6377180	hours, and they're going to take two more hours to process
6377180	6379280	you. If you're turning blue in the hands,
6379280	6381060	it sucks really bad.
6383780	6384460	Yes.
6385660	6386620	Yeah.
6394750	6395410	Yes, the
6395410	6397710	gentleman makes the point that cooperating tends to,
6397710	6399190	you'll be treated a lot better
6399190	6400750	when they're locking you up.
6403710	6405430	Oh, we're going to get a demo?
6405510	6406770	All right.
6416710	6418810	Once again, Agent X, everybody,
6418810	6421610	let's thank him for doing this.
6469080	6470420	Have you done this?
6471120	6472640	Never slammed them against a table.
6475950	6476830	Yeah!
6489420	6491420	The trick is that,
6491420	6492720	like you talked about all the mechanisms
6492720	6494700	inside, you've got to whack this,
6494700	6496040	and it'll just slide.
6496820	6498820	And most of the cops are really good about keeping
6498820	6500340	their kit well-oiled.
6500660	6502420	There's even special handcuff oils.
6502620	6504440	So, you have to whack it somewhere,
6504440	6506780	which you'll see magicians do, is they'll put like a little
6506780	6508500	metal piece of something in their pants,
6508500	6509960	and they'll whack it against that.
6510660	6513200	But usually you can find something to do it against.
6513260	6515360	I find the hardest part is getting them in front.
6515360	6516500	It'll kill you.
6516920	6518120	That's really dangerous.
6518120	6520680	I've gotten myself, by myself,
6520680	6522060	in my apartment,
6522060	6525160	with these, at the end of my seat.
6525440	6527240	It's incredibly painful.
6528320	6529920	Why were you wearing a thong?
6529920	6531140	I wasn't wearing a thong.
6531140	6533560	Have you taken that off?
6547880	6548600	Yeah, yeah.
6557420	6558640	He's showing whereabouts
6558640	6560700	he whacked it, according to the request.
6561020	6563040	Here's the handcuffs.
6564700	6567240	And this is the pin they set right there.
6567380	6568980	You can see it right there.
6569520	6570620	So, what I'm doing
6570620	6572360	is unsetting the pin.
6572360	6573800	They have to turn the key both ways,
6573800	6575820	so what you do is just go, whack!
6576040	6578500	And it comes right down,
6578500	6579620	and then you can shim it.
6579620	6580580	Don't shim it too much,
6580580	6582180	or it's really painful.
6583580	6585380	If you do that while in custody,
6585380	6586220	you're fucked, by the way,
6586220	6587100	unless you get away.
6587740	6588980	Don't fuck around.
6589260	6591140	We're having fun talking about a lot of this,
6591140	6592500	but more than anything,
6592500	6593820	don't be that cutesy guy
6593820	6595120	who's getting out of the squad car
6595120	6595740	at the station.
6600820	6603800	Yeah, Mr. Face, meet Mr. Pavement.
6604980	6607220	It's funny if your friends are cops to fuck with them, though.
6607220	6608000	It really is.
6608000	6610120	By the way, if you
6611260	6613400	show this to the cops,
6613400	6614440	it freaks them out.
6614760	6616220	The main reason I learned this
6616220	6619020	is not because I ever have trouble with the law.
6619080	6620820	It's because this is really a mental thing.
6620820	6622600	People are like, I can't get out of handcuffs.
6622600	6623580	It's impossible.
6623860	6626200	I can show you how to do it. It's not that hard.
6626940	6628720	It's kind of a gateless barrier thing.
6629040	6629800	Give it a try.
6636320	6638720	Come to the THF talk at 4 in the tent.
6638720	6639560	We need your money.
6640820	6641980	And we're going to have a whole...
6641980	6644700	Once we wrap this up, we're going to move it into the contest area
6644700	6645960	where the lockpick contest is.
6645960	6647860	We're going to do a whole hands-on session.
6648020	6649620	I'll take as much time as you guys want.
6649620	6651480	I'm going to have a lot of kits you can play with.
6651760	6654540	I ask that you give me $20-$25.
6654540	6656680	And if you return it, you can have the $25.
6656720	6658280	But I don't want them to walk away.
6658460	6660580	A lot of locks. We're going to have a good time.
6660580	6662760	So come on in if we run out of time here for questions.
6662780	6663840	We'll do it in there.
6666700	6668560	Can you carry a lockpick in your check bag?
6668560	6670240	I'll talk about that in the legal section.
6670480	6671700	Do you have a legal section?
6671740	6673060	Dude, you really did add a lot of shit.
6674020	6675780	Alright, we've really got to fly through.
6675780	6677180	We've got about a half hour left.
6677220	6678960	And I have like 150 slides.
6678960	6680600	So we're maybe two-thirds of the way through.
6682460	6683380	Really quick.
6683380	6684340	Wafer locks.
6684540	6686280	Just going to cover what they are.
6686520	6687880	They're not that sophisticated.
6687900	6689040	Oh, what happened?
6689440	6691780	Is there another cooler talk than me?
6696350	6697950	Imagine when we do the topless section
6697950	6699110	for all you guys leaving.
6699250	6701870	Alright, let's just blow through a lot of this now.
6702010	6702990	Wafer locks.
6702990	6705270	If you look at a lock,
6705270	6707250	notice how this lock, there's no
6707250	6709110	upper mechanism up here.
6709170	6711270	This lock just kind of cuts off right here.
6711270	6713390	There's no space where a pin stack
6713390	6715330	could be hiding. There's no room
6715330	6716950	up here for springs and pins.
6717050	6718990	This is an entirely different type of mechanism.
6718990	6720470	It's called a wafer mechanism.
6720570	6723290	They're popular in very compact places.
6723290	6725010	A lot of filing cabinets,
6725090	6727510	a lot of display racks and things use wafer locks.
6727510	6729870	Also automobiles, but they're more sophisticated.
6731230	6732250	Not alone.
6732510	6734470	If you look at a wafer from the front,
6734470	6736450	and you cut on into it,
6736870	6739070	this is the inside of a wafer lock, essentially.
6739070	6741590	And there's stacks of these wafers in a row.
6741950	6743210	The wafers have to be raised
6743210	6744850	to the right height, and they'll clear.
6744850	6746250	It's not that difficult.
6746950	6749630	There are complex wafers that are double-sided.
6749630	6751130	You can see if you raise them too high,
6751130	6752990	they won't go. Too low, they won't go.
6753110	6754970	And all they'll have to do is just have
6754970	6756830	this rectangle cut in different places
6756830	6759570	on the wafer. So that's how the key cutting works.
6759970	6760890	Wafers are a really
6760890	6762850	interesting sort of mix.
6763050	6765250	They're very unsophisticated,
6765250	6766930	but they don't lend themselves
6766930	6769390	very well to most picking techniques.
6769730	6771330	You can kind of pin-by-pin
6771330	6772890	pick them, right? But most people
6772890	6774570	just use what's called jigglers.
6774650	6776850	And you just jam it in, bang it all around,
6776850	6778790	and hope for the best. And you get about
6778790	6780890	as good a result as you would get if you just tried to
6780890	6782110	individually pick it.
6785290	6787150	Yeah, raking, jiggling,
6787150	6788090	the unsophisticated
6788730	6790970	bang attack ends up a lot better.
6791790	6793390	Alright, still moving along.
6793590	6795050	Rotating disc locks.
6795050	6796670	Not going to talk too much about these, because
6796670	6798770	I can't pick them. I don't even own some.
6798770	6801710	Anything you want to say? Or should we just show Barry and you doing a video?
6802470	6803170	Show a video?
6803170	6804290	I was drunk that day.
6804490	6807210	If you have any questions...
6807210	6809390	There's this brand called Abus.
6809790	6811370	As a side note...
6811370	6813270	Yeah, so this is the fucking video of me on the other side.
6813270	6814230	He didn't tell me.
6816950	6818970	Schedule, if you look at your schedule, there were
6818970	6820990	two talks today. First is two hour intro, then
6820990	6823490	another hour on high security stuff specifically.
6823490	6825630	Due to some scheduling conflicts, the high security
6825630	6827470	stuff was cut down to about a half an hour.
6827490	6829110	And Paul Graham will be coming and giving a speech.
6829110	6830890	And we'll go through all that right before we're done.
6831090	6833310	So just for anyone who has high security questions, hold it off
6833310	6834650	until a little bit later.
6834910	6836610	This is real quick though, just showing you.
6836610	6839390	And they had on their website this very challenging text
6839390	6841470	saying, nobody can pick our locks.
6841470	6843670	No locksmith, no test institute,
6843670	6845310	no burglars are ever known to
6845310	6846710	pick our locks.
6846950	6849830	And this is actually the type of key...
6849830	6850730	Okay.
6850730	6851690	Okay.
6853270	6854690	Don't you love
6854690	6856530	when someone says it's impossible?
6856610	6859190	Isn't that just so great when you prove them wrong?
6861130	6864730	Okay. In focus. Hope everybody
6864730	6865810	can see.
6866110	6868610	In Germany, from my German lockpicking
6868610	6870670	friends, I bought this tool.
6872830	6874450	Nobody leave.
6874510	6876960	And it's this tool.
6878500	6879600	And it's called
6879600	6881720	the Fall tool, because Mr. Fall
6881720	6883160	made it.
6883160	6885480	And it's a decoder pick.
6885480	6887320	It picks the lock, but it also
6887320	6888900	reads the lock.
6888900	6890540	So you can make the key.
6890560	6891740	Here you can
6893800	6895080	see what
6895080	6896540	pin you are
6896540	6898900	picking. And here you can see
6898900	6900460	the depth of the
6900460	6902020	key.
6902680	6905180	With this tool you can open the
6905180	6907260	lock that they claimed on their website
6907260	6908660	could not be picked.
6908840	6911760	It was a real challenge for us to pick it.
6913180	6915220	What they do with this lock
6915220	6917000	is they have discs
6917000	6919620	in the lock. There's no pins but discs.
6919860	6921000	I'll just show you
6921160	6922340	a few of these discs.
6922340	6930260	I hope I'm in focus.
6936620	6938680	Okay, well here you can see
6938680	6940560	the discs
6940560	6942060	that are inside.
6942200	6944220	And here's the real notch.
6944220	6947040	And they put some fake notches in as well.
6947160	6948480	So when you start
6948480	6949600	manipulating the lock
6950600	6952260	you'll experience like
6952260	6954420	it's in the right position.
6954420	6956080	But it's actually not.
6956080	6958260	And it took us quite a while to figure out
6958260	6960500	how to actually pick this lock because of the
6960500	6962080	false notches.
6962460	6964260	And then Paul, Paul Crowell
6964260	6966620	from Montelus, he found out that
6966620	6968660	there's a technique that if you
6969900	6970780	put the pick
6970780	6971960	in the lock.
6980060	6982380	Wow, that's a big thumb.
6986360	6988300	Okay, now I'm at the
6988300	6990300	first disc and
6992700	6994860	I'm trying to feel the cuts.
6994860	6996040	Here's one cut.
6996680	7001860	Go to disc two.
7007890	7009010	How many discs are
7009010	7010250	usually in there?
7010270	7011330	Like eight.
7015170	7017630	I should have cut this video down, I apologize.
7017810	7019390	It's possible to get a false cut.
7019670	7020910	Now, what Paul
7020910	7022950	found out about these false cuts is
7022950	7025090	that they are actually just a little bit
7025090	7027030	tighter. So what you do is you go to one
7027030	7028750	disc. You feel
7028750	7031110	hey, okay, it's getting. And you feel it's getting
7031110	7033050	again. And you just
7033050	7034450	go for the widest
7035430	7037150	you just go from one
7037150	7039130	point of the cut to the other.
7039130	7041650	And the widest is the right cut.
7041910	7043650	And that actually was the trick.
7043650	7045030	You have to
7045030	7046130	feel the
7047190	7048390	cuts.
7049690	7050750	Okay, it's open.
7051470	7052570	Applause.
7064070	7064670	Abes
7064670	7066950	made an improvement on the lock.
7066950	7068630	So that this tool actually
7068630	7070790	only works at a certain
7070790	7072610	range of their locks.
7072610	7074690	But the people from the German sport group
7074690	7076190	they made a tool that
7076190	7077570	beats that.
7078570	7080710	At this moment there is a negotiation
7080710	7082790	with Abes what to do.
7083670	7084610	But when Abes
7084610	7086590	they just had to take the text
7086590	7088730	down and now you read our locks are
7088730	7091130	really secure and very hard to pick.
7091270	7092350	They don't say
7092350	7094630	it's impossible to pick anymore.
7097490	7098670	So that's rotating
7098670	7100650	discs. Gotta really keep
7100650	7103210	moving here. Alright, Master Keying Theory.
7103210	7104930	Once again, how many people were in the last talk
7104930	7106390	with Mark and Matt?
7106570	7108190	So they mentioned that
7108910	7111290	there was a big fuss about this.
7111290	7113150	About, oh why are people disclosing
7113150	7115270	these secrets? This has been known
7115270	7117150	to people all over for a long time
7117150	7119910	but it's just not talked about publicly that often.
7121190	7123010	Master Locks, Master not the brand
7123010	7124830	but you know Master Systems where
7124830	7127870	there's different levels of escalated privilege.
7127870	7129110	That's achieved by
7129110	7131110	an additional wafer or an
7131110	7133290	additional pin in the stack.
7133610	7134930	It's a standard stack
7134930	7136750	but it just has more pins.
7136950	7139130	So a Master Pinned Lock might look
7139130	7141110	something like this. I say might
7141110	7143090	because there's a couple types of Mastering
7143090	7144270	Conventions.
7144890	7147370	For a Red Bull, a
7147370	7149450	lighter and one of those hard drives
7149450	7151510	do we have any more frack? No, no more frack.
7151510	7153470	Can anyone tell me which of the
7153470	7155610	two Master Pinning Systems
7155610	7157870	which type this is?
7159010	7160030	No one.
7160130	7161890	Silence. Can you tell me?
7162010	7164390	I don't know what the fuck the question means. I know a lot about this stuff.
7164390	7165710	Well there are, this is what's called
7165710	7167790	TPP or Total
7167790	7169810	Position Progression Master. There's another type called
7169810	7171730	RC or Rotating Constant which is
7171910	7173850	a different algorithm. Oh well.
7173950	7175750	I'll just give some, whoever can ask me cool questions
7175750	7177710	at the end, I'll give you hard drives for that.
7177830	7179570	Can I have one? Yeah, sure.
7180170	7182010	Alright, so Master
7182010	7183130	you can see how
7184150	7185890	let's see, you might have a user
7185890	7188030	with the lowest end of the
7188030	7190150	totem pole is just called a change key.
7190330	7191970	That's you know, just will open this one
7191970	7194030	lock. But you might
7194030	7195950	have a master key. If you have
7196070	7197370	a key, now this is obviously very
7198050	7200070	exaggerated. If you have a master
7200070	7202050	cut key, these red
7202050	7203910	pins are different. These shear lines
7203910	7205730	are different throughout every lock.
7205730	7207950	But the combination of a red
7207950	7209910	and a green, and you know these aren't the real colors.
7209910	7212210	The combination of the key pin and a
7212210	7213810	master pin together,
7213810	7216050	that is universal throughout all the locks
7216050	7217890	in let's say one facility.
7217930	7219890	So a master key would
7219890	7221950	always be able to find this shear line
7221950	7223810	no matter what lock was in what
7223810	7225970	door. Whereas a person's change
7225970	7228470	key would only work on their door.
7229410	7230530	However,
7230530	7231830	and many of us who
7231830	7233950	had college dorms with master keyed systems
7233950	7235550	played with this,
7235550	7237770	there is a very, very simple way that
7237770	7239770	if you have any key that works
7239770	7241670	in the system, you can
7241670	7244070	very easily make a master key.
7244670	7245510	Sometimes.
7245670	7247230	Would you like to know how?
7250830	7251670	That's pretty
7251670	7253470	much where it starts to go to. This is
7253470	7255730	what happens. Let's say I have this key.
7255990	7257710	And it opens my door to my, let's
7257710	7259670	say dorm room. I
7259670	7262130	take it out and I file this down.
7262630	7263590	And I say, well
7263590	7265710	that screws me because now I can't get into my
7265710	7267610	room. Because you can see this is
7267610	7269710	binding. Well I
7269710	7271490	better keep filing it because I got to get my room
7271490	7273650	somehow. Keep filing.
7273830	7274850	Keep filing.
7279950	7280790	Well it couldn't be
7280790	7283310	higher because then you'd have a
7283310	7285170	bottom pin that's completely
7285170	7291090	out of the shear line. So it has to be lower.
7291090	7293010	I see what you're saying. We're going to touch on that. There
7293190	7295250	is a vendor that has two completely
7295250	7298670	independent shear lines.
7298670	7299490	Oh yeah.
7299490	7300750	Bump keying and picking is
7300750	7302490	easier on traditional
7302490	7304370	master keyed systems because
7304370	7306770	if you bump or you pick, you might
7306770	7308450	pick half of these at a master height.
7308450	7310830	The lock doesn't care. As long as you got shear lines going
7310830	7312790	on, it's going to open. So yeah, if you
7312790	7314710	have a really poorly engineered master
7314710	7316890	pinned lock, you just... there
7316890	7317690	it goes.
7318670	7320730	But a very nice mastering type
7320730	7321990	system, a very nice system
7323210	7324970	is made by Best.
7324970	7326690	And they're called SFIC.
7326690	7328810	Small Format Interchangeable Core.
7328810	7330830	Best is the most popular vendor. Some other
7330830	7332790	vendors make them. These are very
7332790	7335250	easily managed locks.
7335250	7337150	It's very, very popular in large
7337150	7338970	enterprise deployments when you have...
7338970	7340370	you're trying to manage logistics
7340370	7342850	and you're swapping out core. You're trying to manage
7342850	7344890	who's who. The best lock
7344890	7348230	or the SFIC, this figure eight shape,
7348230	7348770	you can
7348770	7350890	pull this whole core right out of the lock
7350890	7353130	with the use of what's called a control key.
7354790	7356790	This lock core, the pins are all
7356790	7358850	sitting up here. There's a plug in here.
7358850	7361110	The control key engages what's called a
7361110	7362970	control sleeve. And you
7362970	7364970	can see this sleeve has a big piece sticking out
7364970	7366940	the side. If that sleeve is
7367310	7369090	engaged, it's not going to pull out of the lock.
7369090	7371630	But if you stick a control key in,
7371630	7373090	turn it, and actually rotate
7373090	7375250	the plug and the sleeve all at once,
7375250	7377210	you can actually rotate the sleeve out of the way,
7377210	7378850	pull the whole lock out, and then that
7378850	7381030	can be... you can eject the pins, you can
7381030	7383130	manage who's what, you can swap the cores very easily.
7383130	7384290	They're very nicely made.
7385490	7386390	This is also
7386610	7388250	a disaster to try to pick with normal
7388250	7389110	tools.
7390350	7392370	If you just... you can see this is the brown
7392370	7394290	is sort of the control sleeve. The light
7394290	7396330	color is the plug. These
7396330	7398250	shear lines are completely independent
7398250	7400550	of one another. So you have the top shear,
7400550	7402330	the bottom shear, and if you
7402330	7404370	stick... this is a regular
7404370	7406410	key, this would be a control key.
7407310	7408730	If you stick a
7408730	7410370	regular wrench in there,
7410370	7411910	and you tension it, you're going to get
7411910	7414430	binding all across these shear lines.
7414590	7415990	So going in and trying to lift pins
7415990	7417770	up, you're almost
7417770	7419970	always going to not pick them all at the
7419970	7421910	right shear line. You're going to catch some top, some
7421910	7424110	low, you're not going to get it picked.
7424550	7426130	Matt Blaze did the math on this.
7426130	7427850	You know, the odds and the likelihood of actually
7427850	7429650	hitting it correctly are not good.
7430650	7432130	There is, however,
7432130	7435050	manufactured by our good friends at Peterson,
7435050	7436010	something called
7436850	7437910	a finger wrench,
7438610	7440170	which can stick in the lock...
7440170	7442690	Let me actually switch up here.
7444150	7445510	There is a tension wrench
7446370	7448550	that has little fingers on it.
7449450	7450290	It's hard to
7450290	7451710	see. Can you see those?
7453050	7454350	What that does
7454910	7457110	is stick into the keyway,
7457110	7458350	stick completely through
7458350	7460010	the bottom of the keyway,
7461870	7462370	because
7462370	7464630	there's holes in the bottom.
7465130	7466150	These holes don't actually
7466150	7468190	serve a purpose in the lock's function.
7468190	7470110	What they do is allow an ejector
7470110	7472310	tool to stick into the lock if you want to pop the pins
7472310	7474110	out and manage your pinning.
7474390	7476670	But if you reach down through these holes,
7476670	7477970	you can actually engage
7477970	7480710	just the control sleeve.
7482210	7484190	By just engaging the control sleeve,
7484190	7486330	you're only going to tension the top
7486330	7488290	shear line. Go in with a regular
7488290	7490150	pick, set the pins,
7490150	7492190	this is not as easy as it sounds,
7492190	7494210	and then turn the control sleeve and eject
7494210	7495350	the entire core.
7498690	7500330	This is one example
7500330	7502390	in what I'm going to wrap up at the end
7502390	7504690	talking about the idea that disclosing
7504690	7506410	these vulnerabilities helps
7506410	7508590	us because...
7508590	7510090	Oh, by the way, this is...
7510090	7512110	Is anyone going to know this? This will be for...
7512110	7512850	Question?
7519760	7521320	I can't hear what you're saying.
7527480	7528480	I don't really
7528480	7529280	understand what you mean.
7531340	7532620	Oh, it's not unlocked.
7532620	7534320	You're just pulling the whole thing out.
7534320	7536560	And you can look down and there's little pins
7536560	7538080	that you can flip. Go ahead.
7540540	7541400	Pardon me?
7542640	7544600	Yeah, with the core out, you can eject the pins
7544600	7546600	right out of it and get the entire... Not only that,
7546600	7548680	if it's a mastered system, you can get the entire
7548680	7551260	master scheme for the entire facility and so forth.
7552380	7553100	Yes.
7553960	7556520	Does anyone know who originally came up with
7556520	7558800	this design for this finger wrench for a hard drive
7558800	7560000	and a Red Bull?
7560980	7562140	No, not Barry.
7562140	7564200	Somebody at Peterson. Peterson makes these.
7565820	7568140	No, not Ken. Good guess though.
7568360	7570020	Anybody? If you don't know it, a guy
7570020	7572060	named Jerry Finch. Very smart cat.
7572060	7572700	Question?
7589780	7590500	Right.
7591400	7593200	Well, that's closer to the rotating
7593200	7595040	constant system. I can talk about that.
7595040	7596900	I'm going to get one more... I'm going to talk about that
7596980	7598900	a little later. One more question and then we're going to try
7598900	7600880	to fire through the rest of these and any more
7600880	7602940	questions, if we run out of time, you're going to have the whole
7602940	7605160	hands-on time to talk to me.
7608440	7609280	Pardon?
7610780	7611820	Yes.
7612820	7615100	Very good point. This is why
7615100	7617020	I'm so pleased with this information
7617020	7618780	coming out. He mentions that there are new
7618780	7621180	sleeve designs. In fact,
7621180	7623480	Matt, when he first talked about this,
7623480	7624780	he took his control sleeve
7624780	7626780	and just cut the holes
7626780	7628920	really huge in the bottom.
7629220	7631140	You can still stick an ejector tool in there.
7631140	7632900	It doesn't hurt, but there's nothing
7632900	7634800	for the finger wrench to grab onto.
7635000	7636780	And I believe best manufacture
7636780	7638920	sleeves like this now. You mentioned that sometimes
7638920	7640920	the control sleeves are in segments.
7641500	7642920	So, yeah, the fact that this
7642920	7644880	was publicly discussed means
7644880	7646660	that it's safer for everyone now.
7646660	7649100	And people are retrofitting their locks with better sleeves.
7649100	7651260	It's a very, very good thing to talk about.
7652320	7653080	Alright.
7653260	7655040	Real quick, if you... How many people
7655040	7657040	are enjoying this? How many people want to get more knowledge,
7657040	7658000	more involved?
7658000	7659640	Are you in the room?
7660500	7661820	That's what I like to hear.
7661820	7664080	There's plenty of books you can read. There's a lot of good
7664080	7665940	places to go online.
7666260	7668000	Let's shoot through some of these real fast.
7668000	7670100	These slides are all online, by the way, and I'll tell you at the end
7670100	7671740	so we can really flip through this.
7672380	7674440	Two of the best books that I know of.
7674480	7676080	Very intro, very beginners,
7676080	7678200	very what-do-you-want-to-know-immediately-first
7678200	7680380	is Steel Bolt Hacking by Douglas Chick.
7680480	7682020	Doug was here last year. I don't know if he's
7682020	7684020	here this year. His books probably are in the vendor
7684020	7685000	area somewhere.
7685000	7687200	The high end is written by
7687200	7688960	the gentleman who spoke before us today.
7688960	7691100	Mark Tobias wrote a book called Lock, Safes, and
7691100	7692780	Security. That's called by
7692780	7694960	many people the Lockpick Bible. It's just like
7694960	7696900	the history of locks starting in ancient Egypt
7696900	7699100	forward. It's a very, very good
7699100	7701040	tome of knowledge. Online
7701040	7703300	you can Google for the MIT Guide to Lockpicking.
7703300	7704940	It's hosted at a few places.
7705000	7706960	Some of the videos I'm showing you were cropped
7706960	7708840	from Barry's presentations available
7708840	7711240	here. There's a lot of informative pages.
7711240	7713120	All these links, you don't have to scribble them right now.
7713120	7714600	There's going to be all up at the end.
7715920	7717020	There are sport-picking
7717020	7719180	groups. There are hobbyist groups. There's a lot of
7719180	7721100	fun things you can get involved with that way, with
7721100	7723160	local people. Every con
7723160	7725160	that you can go to now, DEFCON, back
7725160	7727100	east, the HOPE cons, what the hack
7727100	7729040	is happening now in Europe, there's
7729040	7731160	sport-picking competitions usually. In fact,
7731160	7733100	KyGoth and the DC719 crew
7733100	7735160	are running that this year again. They do a great job
7735160	7737260	of it. There's groups. I mentioned
7737260	7738640	Barry's group, TOOL.
7738780	7741460	The German group, which I think has a thousand members.
7741460	7744000	It's really huge. It's from the Dispotechnik.
7744060	7745680	TOOL USA, we recently
7745680	7747340	founded with Barry's blessing.
7747340	7749580	We're based out of Princeton University.
7749800	7751740	If there's any people near you,
7751740	7753840	meet people here. Talk and go home.
7753840	7755540	Get together and play with stuff.
7755540	7757460	Take it apart. It's excellent to do with
7757460	7759500	friends or as an individual activity.
7759500	7761420	I take a train up to Newark to go to
7761420	7762880	school and I'll just sit there
7763540	7765560	fussing with lockpicks on the train, just popping stuff
7765560	7767380	open. It's a great way to pass the time.
7767980	7769500	You get a few strange looks, but you're
7769500	7771020	not doing anything very illegal.
7771620	7773500	We're going to cover that now in the legal section.
7775020	7775480	You've got to
7775480	7777720	hold the question. I'm sorry. We're going to run out of time if we don't.
7777720	7778200	Sorry.
7779360	7781760	Buying picks. Southerd guys.
7781820	7783480	Excellent, excellent picks for starter
7783480	7785360	kits. They're very simple. The Peterson
7785860	7787340	manufacturing company makes very nice
7787340	7789380	high-end equipment. You can get
7789380	7791740	stuff here. I know the guys from IVU are around.
7791740	7793560	Check out their table. Check out some of
7793560	7795460	our stuff in the hands-on area if you want to
7795460	7797720	just pick them up from us. You can make your own.
7797720	7799680	We'll cover all kind of fun stuff, but we're
7799680	7801680	going to have our grinder tools out. We're going to make some picks
7801680	7803920	and make some fun stuff in the hands-on session.
7804200	7805840	Those of you with legal concerns,
7806620	7807820	I am not a lawyer.
7807820	7809660	I am not sleeping with one. This is
7809660	7812060	not legal advice. Take it for what it's worth.
7812060	7813580	Check your local laws.
7813880	7815980	To purchase, ship, and
7815980	7817660	in general just be involved in
7817660	7819600	the transportation of picks, there
7819600	7821660	is a federal standard. The federal
7821660	7823000	standard is a five-point
7823920	7825720	eligibility. You can be
7825940	7827640	a lock manufacturer. You can be law
7827640	7829720	enforcement. You can be in the auto
7829720	7831860	business. You can be a repo man.
7831860	7834120	Or you can be a bona fide locksmith.
7834260	7835680	The lawyers in the room will tell you
7835680	7837680	bona fide meaning in good faith. It doesn't
7837680	7839760	mean a professional locksmith. It doesn't
7839760	7841840	mean a certified locksmith. It just
7841840	7844600	means you have a good faith interest in locksmithing.
7844600	7845780	In many circles,
7845780	7847820	check with a lawyer, in many circles
7847820	7849880	this is extended to hobbyist and academic
7850600	7851800	interests. I've got to have you
7851800	7853140	wait for the question. I'm sorry.
7853620	7855000	If you have a legitimate
7855000	7857200	non-criminal interest in this, you
7857200	7859100	are covered under that part of the law.
7859100	7860960	If you're dealing with a vendor and they say
7860960	7863100	you have to fill out this form, fill it out
7863100	7865200	under check box number five and you should
7865200	7867300	be clear. Possession
7867300	7869240	of lock picks, however, can be
7869240	7871260	squirrely. Lock picks
7871260	7873340	per se, right Mike, are not illegal.
7873380	7875200	Burglary tools are illegal, right?
7875360	7877080	Depends where, but generally yes.
7877480	7879240	Burglary tools, what makes a burglary
7879240	7881320	tool? Intent. Intent
7881320	7883120	is much of the law.
7883880	7885380	Most laws, every
7885380	7887540	state, by the way, the lockpick101.com
7887540	7890200	those guys, lockpicking101.org
7890200	7891440	or com,
7891440	7893360	we'll check it again, they have a whole
7893360	7894960	legal section you can get
7894960	7897880	all the information you need. Basically,
7897880	7898920	if you have
7900220	7901060	demonstrable intent
7901060	7903520	that you're trying to commit a crime,
7903520	7905100	you've got a whole other
7905100	7907480	bag of shit you're trying to deal with. If you're just a guy
7907480	7909160	on a subway and they're doing
7909160	7911220	fascist crap in New York, patting people down now
7911220	7913320	and they say, what are these? What are these? Lock
7913320	7915160	picks? Well, you're a guy frigging
7915160	7916260	riding the subway.
7917080	7919140	I wasn't going to go somewhere and pick a lock.
7919140	7921220	No, there's no intent that you were going to do anything.
7921220	7922960	If you are squatting behind
7922960	7924420	Best Buy at 3 in the morning
7926100	7927220	at the back door
7927220	7929020	and a cop's like, what are you doing? You're like,
7929020	7931280	I'm taking a piss. And they find
7931280	7932960	lock picks on you, you've got a whole
7932960	7934920	different situation you're in there.
7935400	7937140	So, be aware of that.
7937140	7939180	Many states do not have
7939180	7941100	intent laws or they have kind of more
7941100	7943120	draconian laws. We can cover that later
7943120	7945280	on or talk to a lawyer.
7945320	7946580	These are states of concern
7947020	7949500	with what are called prima facie evidence laws.
7950100	7951520	It's all kind of relative.
7951520	7953340	Just keep intent in mind. And also
7953340	7955700	if you do anything else illegal,
7955700	7957200	sometimes possession of a lock pick
7957200	7959040	can escalate that crime. For instance,
7959040	7961080	if you're trespassing, if you have, a lot of people
7961080	7963020	here like urban exploring,
7963020	7965100	if you're somewhere you're not supposed to be, you
7965100	7967120	might turn a misdemeanor
7967120	7968880	trespass charge into a criminal
7968880	7971200	trespass charge because you had picks on you.
7971200	7973020	Keep it in mind. Check with a lawyer.
7973160	7975080	There's plenty of lawyers here. Talk to the people who
7975080	7975660	know.
7978680	7979040	Acquiring
7979040	7981640	locks. I'll shoot through this real fast. Basically,
7981640	7983160	the last, the main thing is just don't
7983160	7984840	go crazy buying them all over.
7984980	7987000	Most locks are the same. You're gonna, you know,
7987000	7989060	everyone who gets real, oh, I can pick, it's fun.
7989060	7991040	You go to the hardware store, you drop 60 bucks, you got
7991040	7992860	you know, a ton of the same lock.
7992860	7994820	Look through your basement. Look through old stuff
7994820	7996820	that relatives have left in a box somewhere.
7996820	7998420	Look for old exotic designs.
7998640	8000720	You can get really nice what are called training
8000720	8002600	kits. I have one that you can play with at
8002600	8004420	the hands-on where it's
8004420	8006740	pinned, you know, they're keyed the same, but
8006740	8009000	it's only like a one pin stack, then a two pin stack,
8009000	8010720	then a three. So you can actually get the feel
8010720	8012620	for it and get started that way.
8012620	8014800	There's a lot of really good places you can acquire
8014800	8016480	locks. Ask me about later.
8017500	8018920	So how does this all break
8018920	8020860	down into the real world? What does this really
8020860	8023200	bear on in the big picture?
8023440	8024920	They mentioned in the last talk,
8024920	8026880	it's very valid. Criminals
8026880	8028920	don't tend to use lock picks.
8028920	8030760	I'm not saying no one ever picks a lock
8030760	8032780	with criminal intent, but usually
8032780	8034620	yeah, you're going to get a boot to the door.
8034640	8036780	Anybody who was watching sneakers on the Defcon movie
8036780	8039440	channel last night, you know, they just kick the door down.
8039460	8040800	Brute force is what criminals
8040800	8042860	use. Don't buy the most expensive
8042860	8044520	lock on the shelf and put it, you know,
8044520	8047000	in a non-solid core door
8047000	8048860	with like a balsa wood frame, just, you know,
8048860	8050900	with little quarter inch screws.
8051580	8053060	Situate the lock properly.
8053060	8054940	Consider the overall scope of it.
8054940	8056900	I mentioned, you know, if a guy can sit
8056900	8058980	there next to your server room or your records
8058980	8061360	room picking a lock for an hour,
8061360	8062800	why don't you have a security
8062800	8064960	camera near that door? Why don't you have a security guard
8064960	8066560	who occasionally walks by?
8066620	8069200	Keep the big picture in mind.
8071240	8072580	What make good locks?
8072580	8074680	I always get asked this, so I put this page in
8074680	8076820	just to shoot down a few names. I don't work for any of
8076820	8079340	these guys. They just kind of impress me.
8079340	8080780	Those Medicos with the biaxial
8080780	8082580	pins, I love them to death.
8082620	8084840	The Assa V10, for the slight flaw that it
8084840	8086420	has, it's still magnificent.
8086500	8089140	Those best FICs, they're very hard to pick.
8089140	8090980	They're very nice to do logistics
8090980	8092480	of large scale deployment.
8092800	8095060	Abus, that was what Barry was picking, the
8095060	8097000	rotating disk lock. They make a
8097000	8098940	very, very nice strong lock.
8098940	8101020	American, we're going to talk about a little bit more at my
8101020	8103020	very end slide, but they tend to make
8103020	8105140	good things. And if anybody here is in the military,
8105140	8106980	by the way, anybody who can
8106980	8108960	score me one of these bad boys?
8109560	8111000	The Sergeant in Greenleaf
8111000	8113020	833, I've heard it told
8113020	8115280	that if you come across one of these,
8115280	8117160	somewhere far, far away,
8117160	8119140	there's a lieutenant screaming at a corporal as to why
8119140	8121100	it's not inventoried properly, because they're
8121100	8122680	not supposed to get out there.
8123860	8124940	You got one? You got one?
8127780	8128940	That's what I've heard. These are
8128940	8131580	armory locks. These are a
8131580	8133340	Medico biaxial core, situated
8133340	8135280	in what is the most beautifully designed and
8135280	8137300	engineered housing I've ever
8137300	8138480	seen in my life.
8139120	8141300	Yes, some bad locks stand out. We've been kind of
8141300	8143100	beaten up on Master for this talk, and I
8143100	8145200	don't like to all the time, because they make a high-end
8145200	8147220	model, just no one buys them, because they
8147220	8149120	keep frigging making shitty models that everyone
8149120	8151440	buys, because they're cheap. Quickset,
8152100	8153220	everyone who's ever got a door
8153220	8155200	in your house that has a quickset, you'll
8155200	8157100	shit your pants when you pick it in three seconds.
8158160	8159120	Keep in mind,
8159120	8161360	you get what you pay for. If there's
8161360	8163360	three different locks on the shelf, one costs
8163360	8166000	nothing, one costs middle, and one costs a lot,
8166000	8167420	chances are, the
8167420	8169320	expensive one's going to be better.
8169320	8171360	If you're in the American marketplace,
8171360	8173100	if it's a free market system,
8173100	8175060	if you're a recognizable name,
8175060	8177240	you can't keep producing garbage
8177240	8179220	year after year, and people aren't going to keep
8179220	8181900	buying your product, unless you're Microsoft.
8184100	8185540	If it's a
8185540	8188020	reputable brand and it's expensive, you're probably halfway
8187360	8189360	there.
8191360	8193600	You picked a quickset with a popsicle stick?
8193600	8195380	It wouldn't surprise me.
8196240	8197480	Keep playing
8197480	8199200	with these locks. Keep
8199200	8201660	experimenting. Security
8201660	8203860	is achieved through openness,
8203860	8205620	not just in the digital world.
8205620	8207040	We should not be
8207040	8209180	so eager to be hushed up
8209180	8211360	about when we discover things in the physical
8211360	8213640	world. Craziness
8213640	8215480	next door. The American
8215480	8217820	700 is a story I love to tell,
8217820	8219260	because it's a complete example
8219260	8221060	of this phenomenon.
8221920	8223820	Anybody live in a big city?
8223820	8225120	Been to a big city?
8226380	8227400	So if you're walking
8227400	8229260	around at night,
8230840	8231360	you'll see that
8231360	8233560	every storefront is closed down
8233560	8235640	with a big honking sucker.
8236600	8237940	Almost always,
8237940	8239500	storefronts and big
8239500	8241620	where brute force, where some guy with a crowbar
8241620	8243700	is going to be the assault, is going to be
8243700	8245360	either an American lock or
8245580	8247240	a clone of an American lock.
8247240	8249360	This is their 700 series lock.
8249360	8251040	It's a very nice padlock.
8251400	8253060	It has a flaw, however,
8253060	8254380	which was discovered.
8255940	8256860	This lock
8256860	8259240	is a removable core. You can see that
8259240	8261160	when the lock is unlocked, you can
8261160	8263740	unscrew from the inside, drop the eight plate off,
8263740	8265320	eject the core. The core is a nice
8265320	8267200	little self-contained unit. This
8267200	8269280	core interfaces with
8269280	8271200	the double ball control cylinder
8271200	8272500	by means of
8273340	8274880	the core has a raised
8274880	8276900	half circle piece and the control
8276900	8278800	cylinder has a raised quarter circle
8278800	8280740	piece. Can you guys see that? How they just
8280740	8282600	fit together and when they're together,
8282600	8284280	they turn and they engage.
8286120	8286840	Peterson makes
8286840	8288900	this tool called
8288900	8290660	the American Bypass Tool.
8293020	8294380	This is the bypass tool
8296340	8296900	and if
8296900	8298600	I stick this all the way down this lock
8304380	8304940	and I
8304940	8305960	beat this tool to hell
8309020	8309500	that
8309500	8310880	opens that lock.
8312240	8313220	Why is that?
8313220	8314500	Well, it's because if you're looking
8314500	8316780	at this core, this ejected
8316780	8318680	core, this is the back end of it.
8318760	8320420	The keyway is
8320420	8322460	visible. The keyway is cut all the way
8322460	8324420	through and the
8324420	8326580	Peterson tool, the bypass tool
8326580	8327860	just has a little
8327860	8330340	hockey stick kind of end. It slips
8330340	8332020	all the way down through the keyway
8332020	8333520	and it spins
8334820	8335620	that second
8336620	8337420	cylinder.
8337580	8339540	The cylinder, it just fits right in where it should be
8339540	8342080	and it just kind of just flicks the cylinder and just turns it.
8342380	8343640	It's a very elegant
8343640	8345740	bypass. It's got a lot of attention
8346600	8347580	but American is
8347740	8349720	a great company. Instead of trying to sue people
8349720	8353000	over this, instead of trying to make a huge fuss,
8353000	8353640	American just
8353640	8355480	came out with something called a security
8355480	8357600	wafer. They're hard to order but they
8357600	8359460	do have a part number. You can find them by some
8359460	8361620	vendors. You can take your core,
8361620	8363540	eject it out, and put this security wafer
8363540	8365420	in. And it's literally, I
8365420	8367640	love how it's such a, like the digital world,
8367640	8369200	it's like they released a patch.
8369560	8371680	So it's like a hot fix.
8372020	8373600	And you put the lock back together
8373600	8375740	and you can't stick the American tool
8375740	8377120	down the keyway.
8377660	8381240	Never one to be discouraged,
8381240	8381720	Ken came
8381720	8383620	up with this, which
8383620	8385220	is a wafer breaker kit.
8387420	8388260	You stick
8388260	8390000	these down the
8390000	8391940	keyway, you smash on them, and those
8391940	8393920	wafers are spread out in their history.
8394360	8396380	So we'll see what happens next.
8396520	8398000	I would like to think American
8398000	8400000	is a good company. Chances are they're going
8400000	8401920	to try to come up with something even better. And
8401920	8403880	Ken's going to kind of come up with something better.
8403880	8406040	And the end result is better security for all
8406040	8408000	of us. Because we talk about it,
8408000	8410020	the vendors address it. That's not
8410480	8411480	a bad thing.
8412380	8413960	You know, this is, we know
8413960	8415920	about all of this. You guys, all we know about
8415920	8418000	security through obscurity versus real
8418000	8419780	security in the digital world.
8419860	8422140	Think about it the same way in the real world.
8422140	8423760	The physical world is no different.
8424120	8426280	Matt Blaze wrote a couple of great papers about this.
8426280	8427480	I have the links later.
8428800	8429600	Ultimately,
8429600	8432100	I like to kind of wrap it up by saying
8432980	8434260	don't be super
8434260	8435620	trusting of anything.
8435860	8438100	When I was real young, my dad
8438100	8439960	was in the service, and he had his
8439960	8442560	issue weapons in the house. And when I was growing up,
8442560	8444080	he showed me guns when I was
8444080	8446020	real little. And he said, you know, he's showing me
8446020	8447960	how this is how it's open and closed, and he's
8447960	8449820	showing me how you can look down the barrel and the
8449820	8452040	chamber is empty. And I said, well, why am I showing
8452040	8454020	you this? Because, son, a gun is
8454020	8456200	not safe. A gun is not
8457260	8458060	okay unless
8458060	8459920	you've seen that it's safe. You're not
8459920	8461900	protected unless you've seen it. What did I just
8461900	8464200	tell you? And I was like, a gun's
8464200	8466000	not safe unless I know it's safe.
8466000	8467960	He goes, no. It's not safe unless you've
8467960	8469980	seen that it's safe. See
8469980	8471960	it for yourself. Take things
8471960	8473940	apart. Play with them.
8473940	8475980	Don't just take people at their word.
8476460	8477740	You know, we joke around, and
8477740	8480060	when AST Cell and other guys are out walking
8480060	8481880	around at night, and we all take pictures, you know,
8481880	8484640	oh, the hacker salute, DEF CON salute.
8485340	8485940	This is
8485940	8487540	more powerful than you know.
8488020	8490020	This is something that you should fly
8490020	8492040	in the face of people who try to stop you
8492040	8494100	from exploring. Nothing
8494100	8496060	can be healthier than a really
8496060	8497780	nice, hearty, fuck you
8497780	8500040	to some people who say that learning
8500040	8502000	about things is bad. Can I
8502000	8504140	get everyone to practice this one time all together?
8504680	8506700	Out loud. One, two, three.
8506740	8508200	Fuck you!
8508620	8510220	Hey, man. Those are trade
8510220	8512520	secrets. Those are copyrighted.
8512520	8514360	You can't explore our designs.
8514360	8516300	Just buy them.
8516320	8518040	Fuck you!
8518100	8520360	The Department of Justice is in control.
8520360	8522020	Leave it to your legislators. We will pass
8522020	8523980	laws that take care of you.
8523980	8525960	You don't have to know how things work.
8526100	8527600	Fuck you!
8527640	8530040	Why are you trying to explore things? You're just
8530180	8532560	a criminal. You're not interested in security.
8532980	8534220	Fuck you!
8534460	8535680	Exposing bad security
8535680	8537960	is what protects us all.
8553230	8554170	Thank you very
8554170	8556130	much. I could not have...
8556130	8556950	Oh, sorry.
8558550	8560210	To say that I came up
8560210	8562790	and did this on my own would be just ridiculous.
8563270	8564410	Barry, Matt,
8564410	8566250	Mike here, RenderMan, who you've seen
8566250	8567550	around with the fedora.
8568070	8569870	Before everyone leaves, there's going to be a Q&A.
8569870	8572170	Everybody from Tool, DC719
8572170	8574410	and Kygoth, everybody in Tool USA,
8574410	8575930	I've got to thank them all.
8576150	8578430	We can do Q&A with the few minutes we've got.
8578430	8580570	Here's all the links.
8581030	8582290	Or if you want, we're really
8582290	8584250	short on time. Do you guys want to just break
8584250	8586330	it down here? I'll pack all this up.
8586330	8588230	We can meet in the contest area, do some
8588230	8589850	hands-on work, and
8589850	8592310	we'll do questions there. Everyone, pie and punch will be
8592310	8594030	served at the contest area.
8595750	8596290	By the
8596290	8598250	way, if you're leaving, leave through
8598250	8600230	those doors. Doors to your
8600230	8602330	left as you face the stage.
8602650	8603610	Thank you.