WEBVTT 00:36.590 --> 00:40.630 Most locks are not engineered to supremely high tolerances. 00:40.630 --> 00:44.970 Most locks look, and this is exaggerated, something like this. 00:45.330 --> 00:51.330 Imperfections in the machining process leave those pinstack cylinders out of alignment. 00:51.690 --> 01:01.150 And any slight deviation in that alignment means that when you torque the plug there's really only one pinstack binding at any given time. 01:01.370 --> 01:05.270 This is what makes picking possible at its most basic level. 01:05.270 --> 01:11.530 Because if you apply a little bit of pressure on that plug you can do what's called setting a pin. 01:12.790 --> 01:21.610 See we're going to torque this and if you reach in there and start pushing on a pinstack, eventually you'll reach the right height and the pin will clear. 01:21.610 --> 01:24.090 The shear line is met and it'll spin. 01:24.470 --> 01:37.010 Now granted there's not a single pinstack in a lock, there's a row of them, but because you notice when it clears this is holding up the driver that driver is now out of the equation. 01:37.010 --> 01:39.430 That driver pin will not slip back down. 01:39.570 --> 01:45.770 You can keep pressure on this plug and go through the stacks one at a time, setting them and opening the lock. 01:45.770 --> 01:47.390 It looks a little like this. 01:48.190 --> 01:52.190 A tool called a torque wrench is put in and a little bit of pressure is put on the cylinder. 01:52.730 --> 01:57.950 A pick tool, in this case we're just doing pin by pin picking, goes in you reach, you reach, oh here's one that's binding. 01:57.950 --> 01:59.510 When we set it, it clicks. 02:00.230 --> 02:02.390 Keep reaching, keep reaching, and oh there's another one. 02:02.390 --> 02:03.350 I feel it binding. 02:03.350 --> 02:09.290 That plug will click a little more and a little more and eventually you can have them all one at a time open . 02:09.630 --> 02:11.790 This is not not complex. 02:11.790 --> 02:21.850 It's not in the same order every time because those imperfections, remember they're not planned , so which pinstack is binding in which order always varies, but the principle is the same. 02:22.770 --> 02:27.710 And everyone give me some some goodwill and let's kick it off the right way. 02:27.750 --> 02:32.830 Hopefully not have a demonstration effect hit us and let's see what we can do with this lock in front of us here. 02:32.930 --> 02:38.170 Is that in pretty good focus with my craptacular webcam setup? 02:43.590 --> 02:45.730 What I'm using is called a jackknife set. 02:45.730 --> 02:47.930 It's a nice little compact job. 02:47.930 --> 02:50.410 I think the Irvine guys have these here this year. 02:50.950 --> 02:52.470 Anybody checked out the vendor areas? 02:52.470 --> 02:55.030 Irvine Underground has their spread of tools out there. 02:55.410 --> 02:56.770 Yeah, good guys. 02:57.550 --> 03:00.990 So this is, this is your basic cheap master lock. 03:01.150 --> 03:08.690 You'll find I beat up on master a lot in this talk, not because they make the worst locks out there, but, you know, they're definitely in the business of it. 03:10.850 --> 03:16.090 But honestly, I mean, we'll cover later a lot of what, you know, Mark was saying and how many people were at the last talk? 03:16.090 --> 03:17.450 The ethics of full disclosure. 03:17.670 --> 03:24.030 So you realize a lot, you know, can you really blame companies for making crappy locks if the consumers continually buy them? 03:24.030 --> 03:27.730 And can you blame the consumers really for buying crappy locks if they don't know they're crappy? 03:28.550 --> 03:35.590 Exactly who's to blame is, is really kind of up in the air, but one thing is for sure, these aren't really the most skillful locks ever. 03:38.670 --> 03:40.250 Yeah, so the lock is open now. 03:45.320 --> 03:46.100 Thank you. 03:48.020 --> 03:49.520 That, that's as simple as it is. 03:49.520 --> 03:52.040 Literally, you just reach in a little bit. 03:52.040 --> 03:54.240 This is that, this is that torque wrench I was showing you here. 03:54.240 --> 03:55.060 Are we still in frame? 03:55.060 --> 03:55.740 There we go. 03:56.040 --> 03:58.720 This is, this torque wrench just slips right down in the keyway. 03:59.280 --> 04:02.980 A little bit of torque and pushing those pins up. 04:02.980 --> 04:05.700 We're going to do a hands-on session when all this is done, by the way. 04:05.700 --> 04:08.080 I invite people to come and actually try this. 04:08.080 --> 04:09.580 You'll, you'll be amazed how easy it is. 04:09.580 --> 04:10.220 Question? 04:13.100 --> 04:16.540 Yeah, so everyone has their own technique that they like. 04:16.540 --> 04:20.360 In fact, you'll see some people like to put the torque wrench up in the top of the keyway. 04:20.620 --> 04:21.680 Mouse, you like that. 04:21.680 --> 04:23.340 Some people seat it down low. 04:23.700 --> 04:35.880 I tend to just hold it right in my hand, just let the, the torque wrench give pressure this way, because as I mentioned, the two biggest mistakes people make when they're first practicing this, when they first want to get into it, is too much effort. 04:35.960 --> 04:41.380 Some people put too much pressure on the wrench, which just means the pins are going to jam so hard you can't push them. 04:41.640 --> 04:50.520 And some people push the pins so far up that the driver clears and then the key pin goes up into the shear line and get, you fault, you set it way too high. 04:50.520 --> 04:53.360 The only way is to release pressure, let them all drop and try again. 04:53.440 --> 04:58.940 Like, the way I try to describe it to people, imagine you, well, could be applicable here. 04:58.940 --> 05:05.880 You just woke up, you're still hung over, you just smoked a fat cannon, and you're like 10 times more mellow than that. 05:05.880 --> 05:11.160 Like, dial it down a lot if you try to pick locks and it's not working for you when we're doing the hands-on thing. 05:11.200 --> 05:14.080 Chances are it's the lightest amount of pressure you could ever need. 05:15.520 --> 05:17.360 And that's really, there's, there's not a whole lot to it. 05:17.360 --> 05:18.500 That's the basics. 05:18.540 --> 05:21.960 So, how do we, how do we make locks better? 05:22.120 --> 05:26.360 How, how is a lock, you know, everyone's going to say, well, crap, I have locks like this, am I at risk? 05:26.360 --> 05:27.500 No, you're not really at risk. 05:27.500 --> 05:29.120 There are better locks out there. 05:29.320 --> 05:37.340 No one talks about this stuff, so no one buys them, but there's a whole lot of high-end features that locks can encompass, and I will cover them now. 05:37.920 --> 05:39.860 There's things called secure pins. 05:39.900 --> 05:43.460 There's a lot of other advanced features that specialty locks have in them. 05:43.460 --> 05:45.620 First, let's talk about secure pins a little bit. 05:46.300 --> 05:51.120 This is our same design, the same pin stack , but you notice the driver is a different shape. 05:51.300 --> 06:00.060 This is called a mushroom top pin or a mushroom driver, and you can, you can really just picture it, how pretty easily, if you were to try to torque this, that's going to bind up on the lip. 06:00.060 --> 06:01.040 It's going to get in your way. 06:01.040 --> 06:03.480 It's going to be just a real disaster to try to pick that. 06:03.480 --> 06:04.600 It's, it's a real headache. 06:05.440 --> 06:08.580 Another type of specialty pin is what's called a spool pin. 06:08.580 --> 06:11.460 They can have a notch that's big or small cut into it. 06:11.580 --> 06:16.680 Spool pins are even trickier, because you get the sensation of clicking and set it. 06:16.680 --> 06:17.860 You're like, oh, I felt it move. 06:17.860 --> 06:19.260 I must have set something. 06:19.260 --> 06:20.400 No, you really didn't. 06:20.540 --> 06:24.280 If you ever have a lock that you keep trying and trying and trying it, you're like, what the hell is wrong with this? 06:24.280 --> 06:25.940 You may have a spool pin in there. 06:26.780 --> 06:31.880 If you want to defeat high security pins and the other kind of, there's another called serrated pins. 06:31.880 --> 06:34.940 They just jam on everything, and they're just kind of a bitch. 06:36.560 --> 06:37.320 Yeah. 06:38.120 --> 06:43.040 If you want to defeat any type of, you know, if you want to pick, usually you'll use a tension wrench that looks like this. 06:43.040 --> 06:44.680 They're usually called feather wrenches. 06:44.920 --> 06:49.780 It's the very, very light amount of torque, the lightest amount you could ever imagine. 06:51.280 --> 06:52.520 Hey, what's going on, priest? 06:53.960 --> 06:54.860 No problem. 06:54.860 --> 06:55.420 Bring him on in. 06:55.420 --> 06:56.340 We're having a good time. 07:03.490 --> 07:08.410 Hey, with this being such a long talk, are you going to do a spot the Fed maybe in the middle of it, if we want to break it up some? 07:11.410 --> 07:17.910 So yeah, if you use a very, very light touch on the wrench, you can actually force the pin stack. 07:25.020 --> 07:26.380 Yeah, there's some seats up here. 07:26.480 --> 07:28.580 Raise your hand if there's some extra seats near you. 07:29.020 --> 07:30.920 We got, yeah, there we go. 08:02.110 --> 08:03.410 Still more over here. 08:04.070 --> 08:04.790 All the way down. 08:04.790 --> 08:06.150 You don't have to stand on the wall. 08:19.410 --> 08:22.250 Come on, everyone else got up friggin' early, and they're in their seats. 08:22.250 --> 08:23.330 You're holding up the show. 08:26.010 --> 08:27.190 Yeah, give him a chance . 08:28.670 --> 08:29.810 All right. 08:48.750 --> 08:50.090 We'll get it eventually. 08:51.570 --> 08:53.570 Just calm, small words. 09:10.710 --> 09:13.090 This is priest, everybody, for anyone who has not met. 09:13.090 --> 09:15.210 How many, how many people is this your first DEF CON? 09:16.490 --> 09:17.790 Welcome, absolutely welcome. 09:17.790 --> 09:20.290 He is kind of the epitome of the goon squad. 09:20.290 --> 09:25.630 They're really, they work hard, they make sure everything flows right, and we always appreciate all they do for us. 09:25.630 --> 09:28.030 So just, if they ask you to do something, just do it. 09:33.160 --> 09:40.640 Anyone who's had the pleasure of comparing dealings with the goons as opposed to dealings with AP security knows which end of the stick you want to be on. 09:43.870 --> 09:51.690 So, those were advanced pins, and we can defeat them, you know, defeat is kind of a rough word, but with that feather touch wrench. 09:51.710 --> 09:53.610 What about even more advanced features? 09:53.610 --> 09:57.570 Because really all this takes is a specialized tool and a little bit more patience. 09:57.610 --> 10:00.150 What if you want something even more secure than that? 10:00.150 --> 10:07.410 Well, some locks, even in the basic pin tumbler design, do incorporate additional security features, and we can cover them now. 10:10.430 --> 10:13.450 This is called a Schlage Everest lock. 10:13.590 --> 10:23.350 You can see that it has a normal complement of pins, just, you know, pin stacks like we've been looking at before, but up underneath the bottom of this plug, there's something called a check pin. 10:24.330 --> 10:31.770 By the way, this is, this will be for a couple of light, we have a lot of leftover bottle opener lighters from the BCCC event. 10:31.770 --> 10:34.190 This will be for a couple of lighters and a Red Bull. 10:34.190 --> 10:39.990 Who can tell me where at a previous DEF CON did a Schlage Everest lock appear? 10:42.150 --> 10:44.170 It was part of the obstacle course. 10:44.170 --> 10:45.230 I need more specific. 10:45.230 --> 10:47.010 It had a specific name. 10:47.670 --> 10:49.310 Two years back. 10:51.230 --> 10:52.190 Nobody? 10:52.230 --> 10:53.910 It was a big blue lock. 10:54.070 --> 10:54.550 Nobody remembers? 10:54.550 --> 10:57.030 Come on, I know you're, a drink and a lighter. 10:57.030 --> 10:57.950 Nobody remembers? 10:57.950 --> 10:58.610 What? 10:59.010 --> 11:00.030 The beer lock! 11:00.030 --> 11:02.370 Yes, it was the beer lock, which no one opened. 11:04.290 --> 11:05.510 Way to go. 11:07.090 --> 11:11.510 And it's a shame no one opened it because this is actually pretty easily beaten. 11:12.790 --> 11:16.150 As you can see, this is the plug up underneath. 11:16.210 --> 11:18.130 You can see this check pin sticking through here. 11:18.130 --> 11:26.370 Now that engages with part of the outer shell and this is not going to rotate unless the pins up top are set and this is pulled out of the way. 11:26.370 --> 11:27.910 You can see this little bar. 11:28.510 --> 11:34.150 Well, that little bar engages with a big groove slot on the side of the Everest key. 11:34.150 --> 11:36.890 You can see most keys do have grooves. 11:36.890 --> 11:40.010 They actually, they help seat the key in with what are called wards. 11:40.010 --> 11:42.950 Those protrusions are called wards that seat the keyway. 11:43.030 --> 11:50.550 This, however, the groove is deep because it actually picks up that pin and as the key travels down the keyway, it lifts it up and out of the way. 11:51.330 --> 12:07.230 Well, it didn't take people too long to realize that you can just make a tension wrench with a nice long finger and pick up the pin that way or you could take an Everest key, cut the hell out of it, stick it down the lock and use that as a tension wrench. 12:13.320 --> 12:16.720 By the way, we want to thank Matt Blaze for a lot of these beautiful photos you see. 12:16.720 --> 12:17.700 I referenced him later. 12:17.700 --> 12:21.360 He's a real groovy cat and he was very kind and let me use these. 12:21.920 --> 12:25.620 For a, let's see, we'll still work, we've got a lot of Red Bull. 12:25.620 --> 12:26.080 We're keeping working. 12:26.080 --> 12:32.260 For a Red Bull, can anyone tell me the name of the vendor who manufactures and sells these Everest picks? 12:33.580 --> 12:35.740 Don't please shout and no, it's not Southern. 12:35.740 --> 12:36.320 Let me see. 12:36.500 --> 12:37.920 You've won stuff. 12:37.920 --> 12:38.480 Wait. 12:38.520 --> 12:39.140 Yes. 12:39.860 --> 12:41.880 Yes, it is Peterson International. 12:42.900 --> 12:43.260 Very good. 12:43.260 --> 12:44.040 Applaud for the man. 12:44.040 --> 12:45.260 He knows cool shit. 12:52.950 --> 12:54.270 Yeah, this little Everest. 12:54.270 --> 12:54.810 Yeah. 12:54.970 --> 12:55.570 Yeah. 12:56.490 --> 12:58.030 Yeah, the question was, is that simple? 12:58.030 --> 13:00.790 Yeah, as far as I've seen, all the plugs have that. 13:02.590 --> 13:04.250 Yeah, these are the Peterson wrenches. 13:04.250 --> 13:06.890 They come in two different, you know, there's a left and a right one. 13:07.270 --> 13:08.710 And they're really excellent. 13:08.710 --> 13:09.410 They're very well made. 13:09.410 --> 13:11.410 Peterson, we talk about Peterson later in the talk. 13:11.410 --> 13:12.510 They're a very good supplier. 13:12.510 --> 13:13.350 They're good people. 13:14.970 --> 13:19.490 So, we're moving our way up from like ass-tacular security to almost good security. 13:19.490 --> 13:21.470 Let's talk about very nice security. 13:22.730 --> 13:25.130 This is called an Assa V10 Twin. 13:25.230 --> 13:27.690 This is a very popular lock in Europe. 13:27.690 --> 13:29.930 You don't see a lot of Assa locks in America. 13:29.930 --> 13:32.470 You actually don't see a lot of very good locks in America. 13:32.470 --> 13:33.990 There's maybe one brand. 13:34.270 --> 13:36.490 But Assa is a very good lock. 13:36.530 --> 13:39.990 And you can see it has a traditional pin stack with, as you know, it's secure. 13:39.990 --> 13:41.490 This is a spool pin up here. 13:41.490 --> 13:45.330 And the spool pin even has an extra lip that really binds up hard. 13:45.710 --> 13:51.070 But next to that, there's a tiny pin stack seated way down on the side. 13:51.370 --> 13:58.390 And you can tell that only if these pins are lifted to the right height, can what is called a sidebar fall inward. 13:58.590 --> 14:02.690 This sidebar, unlike remember the check pin was seated down here. 14:02.690 --> 14:03.910 The check pin was vulnerable. 14:03.910 --> 14:05.650 You could grab it from the keyway. 14:05.870 --> 14:10.210 The sidebar cannot be grabbed by anything you stick down the keyway. 14:10.710 --> 14:15.790 The only way the sidebar is going to move is if these tiny pins on the side, which are really hard. 14:15.790 --> 14:17.370 You can't really insert picks in there. 14:17.370 --> 14:18.830 It's a really tiny space. 14:18.910 --> 14:22.450 The only way the sidebar is going to fall inward is if that is raised up. 14:22.910 --> 14:25.630 Now, I don't know if you can see my faint text here. 14:25.630 --> 14:26.910 These are very secure. 14:26.910 --> 14:30.590 But the person, in fact, who first showed them to me, a guy named Barry Wells. 14:30.710 --> 14:32.050 How many people know Barry Wells? 14:32.050 --> 14:34.150 How many have ever heard him talk at Hope or anything? 14:34.350 --> 14:34.770 No? 14:34.770 --> 14:36.170 Oh man, you guys got it. 14:36.330 --> 14:38.590 He is... I'll show you his videos later. 14:38.590 --> 14:40.370 He's a real amazing cat. 14:41.070 --> 14:47.910 Barry, who was a big fan of this lock, was very disappointed when he found out there is what he calls a geographical weakness. 14:48.410 --> 14:51.750 You can see this lock right here with the cuts on a key. 14:51.750 --> 14:52.770 That's called the bidding. 14:53.010 --> 14:55.710 The bidding cuts are normal cuts right here. 14:55.710 --> 14:58.450 And you can see the sidebar cuts down here. 14:58.630 --> 14:59.730 What's up, X? 14:59.730 --> 15:01.550 Oh, more free stuff? 15:01.650 --> 15:02.730 Oh, yes. 15:02.810 --> 15:03.910 Agent X, everybody. 15:03.910 --> 15:06.250 He's running the show as well with the speakers. 15:06.250 --> 15:07.370 Big hand for him. 15:12.520 --> 15:20.020 In my hand, I have some individually numbered issues, hardcover, a Frac 63, final issue. 15:21.680 --> 15:22.820 They're so warm. 15:22.820 --> 15:26.380 They're still warm from the presses and from their total hot, the coolness. 15:26.600 --> 15:28.820 We're going to be schwagging them out tonight. 15:28.820 --> 15:31.660 He's going to be schwagging them out right now. 15:31.680 --> 15:35.580 Will this be for questions or just for fanfare and pandemonium? 15:36.000 --> 15:38.120 I don't want arms ripped off. 15:38.720 --> 15:43.240 We're all gentle human beings here, I'm sure. 15:43.240 --> 15:44.700 Not savages. 15:45.380 --> 15:47.000 Except for that guy. 15:50.900 --> 15:53.340 And they're individually numbered. 15:53.700 --> 15:58.000 They're giving away issue number 13 in the Apollo talk. 15:58.700 --> 16:00.260 That's cool. 16:16.120 --> 16:19.540 Limited edition, people. 16:20.840 --> 16:24.100 And here I thought I was just going to give away little cheap Red Bull and lighters. 16:29.430 --> 16:36.430 Okay, just so we're clear and there's no conflicting orders, do not stand in front of the doors. 16:37.590 --> 16:38.490 Yes, sir. 16:39.450 --> 16:41.290 I'm looking right at you with the backpack. 16:43.130 --> 16:46.430 Can we get a hand raise again real fast if there's any more seats? 16:46.430 --> 16:47.250 Do they all go? 16:47.250 --> 16:48.710 There's a few more seats, people. 16:48.850 --> 16:55.090 I know it's nice being able to have that room to spread out, but come on, really, raise your hand if you got room. 16:55.090 --> 16:56.490 I need the people back there by the door. 16:56.490 --> 16:57.650 You three in black. 16:58.650 --> 17:00.010 I need two people in the aisle. 17:02.750 --> 17:03.870 Hang on, we're getting there. 17:04.450 --> 17:07.070 And yes, I know everybody's in black, but I just pointed to you. 17:08.330 --> 17:09.970 We got one seat here. 17:10.590 --> 17:12.650 Fine looking gentlemen, ladies, come on. 17:12.910 --> 17:13.530 You know what? 17:13.530 --> 17:14.630 I'm going to bring you down. 17:22.500 --> 17:24.300 You, sir, in the yellow shirts, come up. 17:27.720 --> 17:28.340 Okay. 17:28.740 --> 17:29.920 I need to be able to see the doors. 17:29.920 --> 17:30.940 I can't see the doors. 17:32.040 --> 17:32.800 Thank you. 17:33.480 --> 17:35.840 No, this guy's not feeling any love right here. 17:35.920 --> 17:39.540 This is prime seating, especially if I start throwing stuff. 17:41.640 --> 17:43.200 Okay, we've got one more seat. 17:43.980 --> 17:45.340 Yeah, send him up, Jay. 17:46.820 --> 17:47.780 All right. 17:48.840 --> 17:51.220 Just please keep your feet tucked in. 17:51.240 --> 17:53.340 Please keep... I got one more seat. 17:53.660 --> 17:55.700 Send me somebody from this side of the room over here. 17:56.440 --> 17:58.860 Somebody raise you up in the white shirt there. 17:59.300 --> 17:59.880 Yes, you. 17:59.880 --> 18:00.580 Come on down. 18:01.940 --> 18:04.060 You're the next contestant on Get a Better View. 18:04.060 --> 18:05.820 Sir, in the yellow, right there. 18:07.800 --> 18:09.360 Is there one more, sir? 18:09.380 --> 18:10.140 Is this guy? 18:10.140 --> 18:11.500 He still needs a spot, right? 18:11.500 --> 18:12.380 You want to move right in there? 18:13.260 --> 18:13.900 Yeah, you do. 18:15.020 --> 18:16.640 We got... is that seat? 18:16.640 --> 18:17.460 Right here, guy. 18:18.720 --> 18:19.460 All right. 18:20.220 --> 18:21.460 Is there any more seats? 18:21.460 --> 18:22.120 Because I overbooked. 18:22.120 --> 18:23.200 Yes, sir, right over there. 18:24.220 --> 18:27.340 Okay, please keep the aisles clear. 18:27.920 --> 18:29.980 I've got to be able to see the doors from the stage. 18:30.520 --> 18:33.720 That means if I see you standing in front of the door from the stage, you're in front of the door. 18:34.120 --> 18:39.140 Okay, the only reason we're doing that is if a fire marshal walks in, we have the illusion of we didn't overbook too badly. 18:40.420 --> 18:43.760 We're trying to get as many people in as we can for the popular talks. 18:44.060 --> 18:46.020 Okay, we're working on something for next year. 18:46.020 --> 18:47.780 We didn't have a chance to implement it this year. 18:48.320 --> 18:54.760 Hopefully we will have it up and running by next year, where we'll have some type of signup system where you can sign up for the talks that you want to see. 18:55.120 --> 18:57.520 We'll have you... with the signup, we'll have you line up in one line. 18:57.920 --> 19:00.760 People who want to see it but didn't get to sign up will line up in another line. 19:01.100 --> 19:02.460 So it'll be first come, first served. 19:02.460 --> 19:07.020 There won't be this rush to the other line, you know, 30 minutes after you're into the first talk. 19:07.020 --> 19:08.480 So you get to the other talk you want to see. 19:09.320 --> 19:12.060 But for now, what we're going to do is we're trying to get as many people in as we can. 19:12.120 --> 19:15.580 We have actually quadrupled the seating for last year. 19:16.380 --> 19:28.280 Okay, you'll notice that what we found was the fire marshal was working from a four-year-old occupancy limit, and we got that updated. 19:28.280 --> 19:29.240 That's why there's more people. 19:29.240 --> 19:33.320 You'll notice that you guys were in a huge line all the way back around the side of the hotel. 19:33.320 --> 19:34.280 I'm not that good. 19:34.280 --> 19:37.620 You'll notice that all of you got in, plus everybody was queued up over here. 19:38.540 --> 19:40.920 So we got everybody in as we could. 19:41.240 --> 19:43.740 We apologize for putting you on the floor like this, sir. 19:43.740 --> 19:45.400 Did he smell bad or something, sir? 19:46.440 --> 19:47.160 Okay. 19:49.140 --> 19:50.320 A little lover's quarrel. 19:52.200 --> 19:53.560 We got everybody in as we could. 19:53.560 --> 19:54.980 We're sorry you had to sit on the floor. 19:55.060 --> 19:55.760 We're doing our best. 19:55.760 --> 19:56.600 Please work with us. 19:56.600 --> 19:59.660 We appreciate your patience, and we'll keep doing what we can do. 20:00.200 --> 20:01.200 Thanks, guys. 20:07.160 --> 20:18.380 After this talk, if you buy a pair of lock picks, and the police pull you over, and they find the lock picks, do not say, I'm a hacker, and I break into my client's buildings. 20:18.740 --> 20:20.640 We actually had someone do that. 20:21.340 --> 20:25.520 Welcome to, you're now in jail for having thieving tools. 20:25.520 --> 20:29.000 The correct answer is, I'm going to locksmithing school. 20:29.560 --> 20:32.140 These are classes for my tools, or I am an apprentice. 20:32.640 --> 20:33.520 We'll cover that. 20:33.520 --> 20:35.020 There's a whole legal section we'll cover. 20:35.020 --> 20:36.900 I'm a hacker , and I break into my client's buildings. 20:38.160 --> 20:40.940 That's breaking, entering, and having thieving tools. 20:40.940 --> 20:43.340 So, a little subtlety there. 21:05.140 --> 21:06.940 Work that angle, I'm serious. 21:08.680 --> 21:13.040 Alright, so we were going to talk about the potential weakness in the V-Twin, right? 21:14.540 --> 21:15.500 What's that? 21:17.220 --> 21:18.380 Geographical weakness, yes. 21:18.380 --> 21:26.280 And the reason we call it that is because these sort of bidding cuts can be... if you've had a key made, you can see the machine's not sophisticated. 21:26.280 --> 21:29.120 It's just a grinder that just grinds off the key, does the bidding. 21:29.760 --> 21:36.820 This bidding cut down here, however, for the sidebar, is not easily accessible by a traditional grinder machine. 21:36.820 --> 21:39.020 It has to be made on a special milling machine. 21:39.020 --> 21:42.300 These blanks are special ordered, which actually increases the security. 21:42.300 --> 21:46.140 You can't just, no fool off the street can just get a key blank and cut it. 21:46.160 --> 21:52.740 But, it's a nightmare for logistics and distribution of locks to locksmith vendors. 21:52.740 --> 22:07.700 So, Barry and the people at a German sport group found out that all over Germany and other places, they're just divided into territories, and locks are sold with a certain sidebar bidding in that territory, so that all the key blanks for that territory are there. 22:08.240 --> 22:14.060 So, it's not a big weakness, but it's just kind of the cost of doing business, the way the distribution works. 22:14.120 --> 22:20.700 They don't just deal over the internet, like a guy at a local shop can't have 80 bajillion of these blanks if a customer comes in. 22:20.700 --> 22:22.340 So , it's something to keep in mind. 22:22.540 --> 22:24.700 And that comes into play with what we do bump keying later. 22:24.700 --> 22:25.740 I see a couple of hands. 22:27.140 --> 22:29.260 I do not know how many territories there are. 22:30.040 --> 22:33.180 Yeah, SSDevs, we'll talk about them later. 22:33.180 --> 22:34.240 They talk about it. 22:34.240 --> 22:34.740 Yes. 22:37.840 --> 22:40.740 I would imagine someone could be mapping that out potentially. 22:40.740 --> 22:44.280 I don't know if you can look at just the bidding and know where it came from. 22:44.920 --> 22:48.520 He was asking if you just look at that sidebar bidding, can you tell the territory? 22:48.520 --> 22:53.220 Obviously, there's got to be a master list somewhere that coordinates distribution, but I don't know of it. 22:53.220 --> 22:54.460 There was one more hand. 23:01.460 --> 23:03.540 That's a tremendous question. 23:03.560 --> 23:13.380 If simple changes to the driver pins, if the addition of a ridge or a lip or serrations, if they make it so much harder to pick, why don't all locks come with this? 23:13.380 --> 23:19.900 And the reason for that is Americans especially, but in general, people are cheap everywhere. 23:19.900 --> 23:27.200 You've got a figure that costs X number of cents to introduce that feature into a lock, multiplied by how many you distribute in a year. 23:27.200 --> 23:30.940 Someone in a boardroom looked at a spreadsheet and said, no, we don't freaking care. 23:30.940 --> 23:32.320 Let's just make them this way. 23:32.440 --> 23:33.540 That's the answer to that. 23:36.040 --> 23:37.480 Oh yeah, that's a very good point. 23:37.480 --> 23:40.280 You can retrofit, you can repin your locks. 23:40.440 --> 23:42.420 You can buy pin kits. 23:42.860 --> 23:46.320 Because the driver, the height of the driver, the size doesn't matter. 23:46.320 --> 23:49.880 It's only these bottom pins that have to be the right size to work with your key bidding. 23:49.880 --> 23:51.800 You can retrofit your drivers, definitely. 23:51.860 --> 23:56.660 And in the hands-on session, Mouse, if you have the ones that are pulled apart, we can show people how you do that. 23:58.340 --> 24:02.220 So, moving onward, that is a very nice... I don't want to knock the V10, though. 24:02.220 --> 24:05.440 For that one weakness, it's still a stupendous lock. 24:06.000 --> 24:08.600 This, however, is probably my favorite lock. 24:08.600 --> 24:12.420 And interestingly enough, it is an American company that makes this lock. 24:12.420 --> 24:14.540 How many people have heard of Medeco locks? 24:15.040 --> 24:16.420 Now, there's some hands. 24:16.420 --> 24:20.020 Medeco is one of the finest locks I can think of out there. 24:20.020 --> 24:21.280 I don't work for them. 24:21.280 --> 24:23.060 I'm, you know, not dating anyone there. 24:23.060 --> 24:24.180 They're just really good. 24:24.180 --> 24:25.740 They're really good designs. 24:26.600 --> 24:34.460 Medeco keys, besides being insanely restricted and hard to get your hands on, have what's called cross-cutting. 24:35.140 --> 24:40.240 And if you can kind of see these pins, you can notice they're chiseled on the tips. 24:40.280 --> 24:42.560 They're also serrated, by the way, these key pins. 24:42.560 --> 24:51.280 These key pins and these chisel tips actually fit into, you can kind of see here, these cross-cut notches. 24:51.380 --> 24:55.960 These pins spin as they track up and down as the key goes into the lock. 24:55.960 --> 24:57.800 It's called axial rotation. 24:58.060 --> 25:07.560 Only if these pins have spun correctly, lined up a notch on the side, will a sidebar fall inward, and then will the lock open. 25:07.560 --> 25:09.880 These locks are psycho. 25:10.680 --> 25:14.460 You can't, there's no easy bypass for this. 25:14.460 --> 25:20.380 And in fact, the gentleman we've mentioned, Barry Wells, I think is the only man alive who I know who can pick these. 25:20.400 --> 25:22.840 I've seen him do it, and I shit myself. 25:23.160 --> 25:28.900 I mean, you know, he reaches, he actually uses that finger pick, and he spins the pin by hand. 25:28.900 --> 25:32.220 And you can even see, this has a fake cut here. 25:32.220 --> 25:36.400 So you can feel like you've spun it and you've caught on something, but it's a fake cut, a deep cut. 25:36.400 --> 25:38.140 It's a really hard lock. 25:38.140 --> 25:41.820 And for someone like Barry to do it, I've seen him like eight minutes, ten minutes. 25:41.960 --> 25:48.300 A regular person, just any guy with any hope of picking this would take like an hour and a half, two hours. 25:48.320 --> 25:57.580 If you have a security situation where someone can kneel down in front of a door on your property and fiddle with something for two hours, you've got a whole different set of problems. 25:59.340 --> 26:01.080 If they're not getting noticed. 26:01.820 --> 26:05.300 So those are some examples of very high security features in locks. 26:05.300 --> 26:06.480 These are out there. 26:06.540 --> 26:08.660 They're not outrageously expensive. 26:08.720 --> 26:11.940 If you, you know, factor in the costs involved, you know, what are many costs? 26:11.940 --> 26:13.140 Like $100, $150? 26:13.380 --> 26:15.740 The V-Twin I think you can get for about $80. 26:16.440 --> 26:20.220 The cost offset is not a big difference considering what you're getting out of it. 26:20.220 --> 26:21.200 I see a hand. 26:26.620 --> 26:27.340 Yes. 26:27.400 --> 26:27.960 Yes, it is. 26:27.960 --> 26:31.920 The question was, can you replace just the cylinder, just the core of the lock? 26:32.040 --> 26:32.980 Yes, you can. 26:32.980 --> 26:35.100 You can usually mortise cylinders, screw out. 26:35.100 --> 26:36.440 You can swap out cylinders. 26:36.440 --> 26:38.760 In fact, a lot of really high-end... 26:38.760 --> 26:42.500 How many people here are in the service or affiliated with the service of any kind? 26:42.500 --> 26:43.660 Military service? 26:44.340 --> 26:45.460 Man, just a handful. 26:45.460 --> 26:46.180 Geez. 26:46.500 --> 26:52.780 A lot of military locks are standard designs, like military handcuffs, military padlocks. 26:52.780 --> 26:57.160 They're standard industry locks that have been swapped out with a Medeco biaxial core. 26:57.340 --> 26:58.420 And like you'll see... 26:58.420 --> 27:01.720 Yeah, so you can retrofit locks to varying degrees. 27:05.440 --> 27:07.900 Yeah, the Best Locks, the brand Best. 27:07.900 --> 27:08.900 I cover them in a bit. 27:08.900 --> 27:10.880 They have a very, very nice system. 27:10.940 --> 27:12.880 Especially it's one that's very nice to manage. 27:12.960 --> 27:16.080 We're jumping ahead though, but because you're on top of things, you get a free letter. 27:18.980 --> 27:19.940 Good catch! 27:22.400 --> 27:23.900 Very good point to bring up. 27:23.900 --> 27:24.840 We're going to cover Best Lock. 27:24.840 --> 27:27.520 We're going to cover a lot of stuff, so we've got to keep it moving along. 27:29.220 --> 27:31.240 Oh no, that was a very good point someone mentioned. 27:31.240 --> 27:34.460 Okay, you're not going to make this on a grinding machine or at your local hardware store. 27:34.460 --> 27:36.140 You can't make these cross cuts. 27:36.160 --> 27:38.080 Very, very restricted blanks. 27:39.060 --> 27:42.680 So that was a peek at very good security. 27:42.900 --> 27:46.880 Let's flip it back the other direction now and go back to bad security for a minute. 27:50.060 --> 27:50.760 Yes? 27:57.230 --> 27:59.510 The little light shines in the holes? 28:01.330 --> 28:02.870 I don't know what you mean. 28:04.830 --> 28:08.110 Show me later, give me an idea later and we'll talk about it. 28:19.440 --> 28:24.300 The question was, if you keep picking and playing with a lock, will it eventually wear the lock down? 28:24.300 --> 28:28.120 Yes, there's a lot of potential wear and tear that a lock can experience. 28:28.640 --> 28:32.100 The springs that push the pins, those can get weaker. 28:32.560 --> 28:35.460 A lot of pins are brass because they don't corrode. 28:35.460 --> 28:37.120 Brass is easily misshapen. 28:37.120 --> 28:39.200 In fact, I talk about that later. 28:39.200 --> 28:40.840 There's some techniques that are really bad for locks. 28:40.840 --> 28:43.220 You can beat the locks up and make them easier to pick that way. 28:43.700 --> 28:44.640 Question again? 28:50.370 --> 28:52.010 Those are called dimple locks. 28:52.010 --> 28:53.210 We're going to cover that in a minute. 28:54.810 --> 28:57.590 I've got to stop rewarding people for jumping ahead of me. 28:58.710 --> 29:00.070 But no more jumping ahead. 29:00.070 --> 29:02.010 Hold on, we're going to get to all the fun stuff. 29:03.430 --> 29:05.810 First, let's talk about really crappy things. 29:05.810 --> 29:07.050 Hang on, wait, wait, wait. 29:07.050 --> 29:08.350 I'm trying to go forward, people. 29:08.350 --> 29:09.850 I expected questions at the end. 29:09.850 --> 29:13.250 This is my second time ever speaking, so you've got to bear with me. 29:14.210 --> 29:15.310 Thank you. 29:18.250 --> 29:21.050 We're talking about very bad locks at the moment. 29:22.990 --> 29:25.750 Can I get a show of hands how many people have used this lock? 29:27.870 --> 29:29.250 That's about right. 29:31.790 --> 29:33.650 These locks are incredibly popular. 29:33.650 --> 29:35.410 These locks are everywhere in our life. 29:35.410 --> 29:38.470 Everyone and their dog has a master lock securing something. 29:39.850 --> 29:41.990 These locks do not provide anything. 29:44.170 --> 29:50.990 If you have something that you care about that you're securing with a master padlock, you know, you're pretty much doing this. 29:59.220 --> 30:00.820 Why, you say? 30:01.820 --> 30:09.340 Well, you can take a master padlock, much like this little number, and use a guy like this. 30:09.440 --> 30:10.880 Does anybody know what this is? 30:11.300 --> 30:13.220 This is a padlock shim. 30:13.700 --> 30:21.860 A padlock shim can be inserted into a lock, or it can be broken in the lock, because this shim has been beat to hell. 30:23.880 --> 30:25.780 And that'll open that lock. 30:29.780 --> 30:30.740 Question? 30:32.120 --> 30:33.240 Yes, it will. 30:33.240 --> 30:35.640 I'll cover which can and can't be shimmed. 30:36.880 --> 30:42.000 Shims are a very, very elegant sort of attack against a lock. 30:42.000 --> 30:45.100 I mean, they really, I would say, fall into the category of a bypass. 30:45.360 --> 30:55.340 Just because the simplicity of the design, and the fact that Americans, especially Americans, but everyone in general, likes convenience as opposed to utility, makes this possible. 30:55.700 --> 30:57.700 Let's look a little bit more at this master. 30:58.100 --> 31:01.600 You can see it has a, all padlocks, like, you know, it has a shackle. 31:01.680 --> 31:03.200 It has a little dog notch. 31:03.480 --> 31:09.820 And that interfaces with, let's see if we can see down here, you know, a locking bar that's in there. 31:10.020 --> 31:16.040 And only if the combination is dialed in, will that bar retract, allowing you to pull the lock open. 31:16.900 --> 31:21.380 Well, what if you're not opening the lock, but rather you're closing the lock? 31:21.420 --> 31:23.040 You don't have to dial a combination. 31:23.040 --> 31:24.680 You don't have to fiddle with a key or anything. 31:24.680 --> 31:26.360 You just, you know, slap it shut. 31:26.900 --> 31:30.300 Well, that's because that bar is spring-loaded. 31:30.540 --> 31:32.520 The bar is just going to get out of the way. 31:32.520 --> 31:35.440 It's like, oh, the shackle's coming down, I better move. 31:36.600 --> 31:40.460 The way, and I'm going to try to get, I don't make films, so bear with me. 31:40.460 --> 31:53.240 The way a shim works, a shim is inserted outside the shackle, slid down in, and then turned, effectively obscuring that dog notch. 31:53.260 --> 31:54.260 You see that? 31:54.540 --> 31:56.520 It just, I'm trying to get that in line. 31:56.520 --> 32:00.260 It just pushes the bar right out of the way. 32:00.260 --> 32:02.180 It's like credit carding a door. 32:02.740 --> 32:06.140 I have a lot of friends back home who are in theater. 32:06.140 --> 32:08.620 There are theater techs and stage designers and stuff. 32:08.620 --> 32:13.620 And there's kind of an axiom with anybody who does craft work on stage and design sets. 32:13.800 --> 32:16.860 If you're doing it with springs, you're doing it wrong. 32:17.480 --> 32:19.660 This is an example of that phenomenon. 32:19.960 --> 32:25.060 Many things in locks that involve spring action are easily, easily compromised. 32:25.060 --> 32:28.120 Because a spring is, by nature, not a, it's a dumb device. 32:28.120 --> 32:29.920 It doesn't know what's pushing on it. 32:29.920 --> 32:32.640 And you can usually just pop them right out of the way. 32:32.640 --> 32:34.260 So, padlock shims. 32:34.260 --> 32:35.940 The cheapest stuff in the world. 32:36.260 --> 32:37.960 You know, you can buy them in packs. 32:39.620 --> 32:40.620 What's that? 32:41.260 --> 32:44.320 Oh yeah, you can make, we're going to cover, that's going to be a question. 32:44.580 --> 32:45.540 Yes, question. 32:50.690 --> 32:52.090 Yes, very good point. 32:52.090 --> 32:57.150 Metal bus fuses, there's a lot of material that you can make shims out of. 32:57.190 --> 33:01.230 Shims you can buy, you know, the 20 pack is $25. 33:01.430 --> 33:05.210 I'm going to have some of them if you want to play with them in the hands-on area. 33:05.270 --> 33:07.330 You can also make your own. 33:07.570 --> 33:09.150 And this will be a question. 33:09.150 --> 33:13.490 Let's see, this is kind of a hard question because it's very, very current events, if you will. 33:13.630 --> 33:16.870 The question for a Red Bull and one of these issues of Frack. 33:18.250 --> 33:27.290 What readily available material from Defcon did we use to open a jammed padlock at Civiac's house yesterday afternoon? 33:29.510 --> 33:32.370 It was not a badge from Blastier, but a good guess. 33:32.370 --> 33:33.110 Hang on, I saw... 33:33.110 --> 33:35.230 Wait, wait, whoa, no shout out. 33:35.230 --> 33:36.770 I saw your hand next. 33:38.070 --> 33:39.670 The man is correct. 33:39.670 --> 33:40.610 Come on up. 33:44.250 --> 33:47.630 The answer was metal from a beer can. 33:47.630 --> 33:48.990 And I have to definitely apologize. 33:48.990 --> 33:52.530 I'm sure there's got to be people flailing their arms on the sides and I might not be seeing you. 33:52.530 --> 33:53.710 I apologize for that. 33:53.710 --> 33:56.550 I'm going to try to keep you in my field of vision when I'm asking questions. 33:57.070 --> 33:59.890 Yeah, just the other day, Civiac had some friends staying with them. 33:59.890 --> 34:01.970 They're moving from San Diego. 34:01.970 --> 34:02.730 Then they stopped here. 34:02.730 --> 34:03.790 They're moving up to Seattle. 34:03.790 --> 34:06.050 It's polyhazard and I forget who else. 34:06.410 --> 34:08.910 But as we, I have definitely done this before. 34:08.910 --> 34:10.110 Many people have done this before. 34:10.110 --> 34:14.110 Some locks, the shackle completely pulls off. 34:14.110 --> 34:16.850 You know, the lock base can actually be completely removed. 34:17.170 --> 34:24.430 And if you accidentally slap it shut, upside down, the keyway is kind of inaccessible. 34:28.910 --> 34:29.750 It happens. 34:29.750 --> 34:30.830 It happens to the best of us. 34:30.830 --> 34:31.390 I've done it. 34:31.390 --> 34:34.470 In fact, I first experimented with this when I did it at home. 34:34.770 --> 34:36.970 We had the right tools in hand. 34:38.290 --> 34:43.330 And a simple beer can is all it took to shim this right off. 34:43.330 --> 34:44.790 We'll do this in the hands-on session. 34:44.790 --> 34:47.430 I've got plenty of beer can metal up here, man. 34:47.430 --> 34:50.050 We're going to make some, cut them up, and have a good time with that. 34:53.350 --> 34:56.850 It may or may not have been the beer that resulted in the lock being that way. 34:56.850 --> 34:57.890 I am uncertain. 35:00.620 --> 35:02.040 Very, very, very easy to do. 35:02.040 --> 35:03.980 In fact, you can ask them. 35:03.980 --> 35:09.440 We probably took, I guess, 30, 40 minutes in midday Vegas traffic to get to the house. 35:09.440 --> 35:12.340 It probably took 30 or 40 seconds to get this lock off. 35:15.240 --> 35:17.940 There are, however, unshimmable padlocks. 35:19.180 --> 35:24.380 There are very, very good padlocks on the market that shims will do absolutely nothing to. 35:24.760 --> 35:28.280 Some padlocks have a nice big boot or collar on the top. 35:28.280 --> 35:31.780 That makes the shim really hard to insert, damn near impossible. 35:32.060 --> 35:43.640 Incidentally, for, let's say, a red, this is kind of an easy one, for a Red Bull and a lighter, and I'm keeping the sides, keep the sides in view, what is the actual purpose of the collar or boot up on these? 35:44.100 --> 35:45.400 Whoa, that was a lot of hands. 35:45.400 --> 35:47.540 I think it was this way down there. 35:50.320 --> 35:52.920 Preventing bolt cutters is the exact right answer. 35:52.920 --> 35:54.520 Come on up, get a drink and a lighter. 35:58.220 --> 36:01.520 Other locks, you can actually, let me flip back to this. 36:02.640 --> 36:11.040 This is not the best solution, but if you were to just put notches in this bar, and literally, I mean, we're not talking about re-engineering the lock here. 36:11.040 --> 36:12.040 Oh, here's a lighter, man. 36:13.020 --> 36:14.920 Bottle opener lighters, gotta dig those. 36:15.660 --> 36:17.840 You know, we're not talking about a massive new design. 36:17.840 --> 36:23.040 If you were to just notch this bar, that would rip the crap out of the shim as you try to spin it around. 36:23.280 --> 36:27.200 And if you, you can actually kind of see in there, this bar is pretty beat up. 36:27.260 --> 36:32.460 I have some padlocks that I've shimmed so many times, they just shred the shims now because there's so many scrapings. 36:32.680 --> 36:36.380 So if people would just notch the bar, it would be kind of, kind of a solution. 36:36.380 --> 36:46.320 But really, the best type of padlock, and frankly, in my mind, the only type of padlock that can be considered useful at all, involves what's called double ball locking. 36:46.880 --> 36:51.420 Double ball locked padlocks, the shackle has, you know, a dog notch on each side. 36:51.900 --> 36:55.840 And inside, there is no bar with a spring or any other horseshit like that. 36:55.840 --> 36:58.540 There are two solid steel ball bearings. 36:58.700 --> 37:03.280 These are not going to go anywhere unless this control cylinder in the middle is rotated. 37:03.280 --> 37:06.500 You can see the control cylinder has a notch on each side. 37:06.540 --> 37:10.740 That cylinder rotates, the ball bearings drop in, that the lock will open. 37:10.740 --> 37:12.340 That is a real padlock. 37:12.340 --> 37:15.060 Anything else is, you know, a paperweight. 37:15.980 --> 37:19.420 Many locks employ, they're called key retaining locks, by the way. 37:19.420 --> 37:22.440 Locks that you have to have the key to open it and close it. 37:22.600 --> 37:26.560 Those are invariably going to be high-end double ball mechanisms that are in there. 37:26.560 --> 37:29.360 But any lock, it'll stay right on the front, double ball mechanism. 37:29.360 --> 37:30.320 Look for that. 37:30.320 --> 37:34.080 It is not at all a big investment to make that leap up. 37:34.080 --> 37:37.560 It's the difference of like a $5 lock or a $12 lock. 37:39.260 --> 37:40.560 Moving on. 37:41.380 --> 37:43.620 From good locks, we'll jump back again. 37:43.620 --> 37:46.340 We're kind of doing a high and low range of things. 37:47.120 --> 37:48.240 Warded locks. 37:48.700 --> 37:51.300 How many people have ever seen locks that look like this? 37:52.080 --> 37:54.640 Alright, yes, they are a lot of places. 38:05.080 --> 38:10.020 Warded locks are really very nice locks for certain reasons. 38:10.280 --> 38:12.360 They're very popular in outdoor situations. 38:12.360 --> 38:17.060 In fact, if you notice that trailer that I showed you in the other pictures, that was a warded lock. 38:17.060 --> 38:18.500 Why are they popular outdoors? 38:18.500 --> 38:20.480 Well, they're very resistant to fouling. 38:20.480 --> 38:23.200 They're very resistant to dirt and filth. 38:23.200 --> 38:25.860 They can rust up and they'll still usually work. 38:25.860 --> 38:29.760 They don't have an intricate pin tumbler mechanism inside. 38:29.760 --> 38:37.060 The fact that they have a very rudimentary mechanism means that you can put a lot of crap in this lock and it'll still sort of work. 38:37.700 --> 38:42.000 The other side of that coin is that it's a really rudimentary mechanism and it's a joke. 38:43.480 --> 38:46.160 Warded locks look kind of like this on the inside. 38:46.420 --> 38:49.120 You have a long keyway with wards. 38:49.120 --> 38:52.120 Those are protrusions called wards that get in the way. 38:52.120 --> 38:57.500 And at the very tip, you'll have just a notch bar with a spring. 38:57.500 --> 39:01.600 Those keys, if I jump back... 39:01.600 --> 39:04.520 Those keys... let me flip to... 39:04.520 --> 39:07.920 I used to have these numbered and the numbers have all but worn off. 39:11.780 --> 39:13.320 Got it on the first one. 39:15.600 --> 39:21.060 This key, when it goes down the keyway, the only thing... can you guys see that okay? 39:21.240 --> 39:28.120 The only thing that's actually operating this lock is this very, very tip of the key. 39:28.860 --> 39:35.900 That little tip of the key is interfacing with this lock mechanism, the latch that's hidden inside. 39:36.640 --> 39:38.160 However, what that means is... 39:38.860 --> 39:41.120 Let me pull some stuff out here. 39:51.660 --> 39:56.130 My pickset is all clouded. 39:56.330 --> 39:57.710 There we go. 39:58.990 --> 40:05.970 What that means is if you take a warded key lock and you file down... can everyone see that alright? 40:06.490 --> 40:09.130 You file down all the notches. 40:09.130 --> 40:11.550 This will still operate the lock. 40:11.550 --> 40:13.270 I think this was number one. 40:13.510 --> 40:14.750 No, it's number three. 40:16.570 --> 40:23.590 So this was... I took, you know, number one is probably this guy and I just filed all the wards off of it except for the tip. 40:25.670 --> 40:27.050 Let me get that in there. 40:27.050 --> 40:29.850 That still opens this lock. 40:29.850 --> 40:31.590 Because, you know, you only need the tip. 40:31.730 --> 40:36.110 The rest of the lock, the only thing it's doing is getting in the way. 40:36.110 --> 40:40.110 So that means you can take this to any warded lock. 40:42.630 --> 40:44.050 The tip will open. 40:45.490 --> 40:47.730 And they just, you know, there you go. 40:55.240 --> 40:56.520 Oh, I saw some hands. 40:56.520 --> 40:57.980 Wait, hang on, there's people with hands. 40:57.980 --> 40:58.520 Wait. 40:58.820 --> 40:59.480 Hands? 41:01.480 --> 41:06.000 Not so much with a regular pick, but there are what are called warded picks. 41:06.000 --> 41:07.000 And there was a hand back there. 41:07.000 --> 41:08.260 Was that the same question? 41:16.460 --> 41:17.740 I'm not familiar. 41:18.040 --> 41:19.860 They were even mentioned in the last talk. 41:19.860 --> 41:20.440 I've yet to see. 41:20.440 --> 41:22.040 If anyone has one of these, I'd love to see it. 41:22.040 --> 41:23.320 The TSA luggage lock. 41:23.320 --> 41:26.540 I don't deal with... you guys who fly, you're nuts if you check bags, man. 41:26.540 --> 41:27.520 I FedEx all my shit. 41:27.520 --> 41:29.100 I don't deal with those psychos. 41:30.380 --> 41:30.940 Hand? 41:37.030 --> 41:37.530 Okay. 41:40.880 --> 41:41.440 Okay. 41:41.500 --> 41:43.300 And you were going to ask a question as well, I'm sorry. 41:44.860 --> 41:46.660 Yeah, he makes a very valid point. 41:46.660 --> 41:48.680 A lot of these locks, they're really just decoration. 41:49.560 --> 41:50.820 Oh, we have a TSA lock? 41:50.820 --> 41:51.900 Thank you, sir. 41:51.960 --> 41:53.440 He gave that man a lighter for that. 41:55.000 --> 41:56.540 This is a... are you kidding me? 41:57.260 --> 41:58.820 This is a TSA lock? 42:05.520 --> 42:07.020 Oh, for... okay. 42:07.020 --> 42:09.980 So there's apparently varieties of TSA locks. 42:10.060 --> 42:11.820 But yeah, I hate the TSA. 42:11.820 --> 42:13.320 I won't give them any of my stuff. 42:14.640 --> 42:15.920 Alright, moving on. 42:15.920 --> 42:17.260 Oh wait, sorry, question. 42:23.960 --> 42:27.660 The question was locks that are called key retaining locks. 42:27.660 --> 42:30.740 The key is inside the padlock the whole time it's operating. 42:30.960 --> 42:32.220 That's what you're asking about? 42:32.460 --> 42:35.100 And you're saying is it a spring that keeps the key in? 42:39.830 --> 42:43.730 Oh, invariably key retaining locks tend to be much higher quality. 42:43.730 --> 42:44.990 They're going to have a double ball. 42:44.990 --> 42:46.490 So no, you can't shim those. 42:47.630 --> 42:49.230 So yeah, you can buy... 42:49.230 --> 42:50.870 Does anyone see Irvine's table? 42:50.870 --> 42:52.910 Do they have the warded picks there this time around? 42:53.070 --> 42:54.570 Yeah, Irvine usually has these sets. 42:54.570 --> 42:55.710 What are they, like nine bucks? 42:56.410 --> 42:58.070 I hope I didn't lowball that price. 42:58.070 --> 42:59.310 If they're more, they're worth it. 42:59.310 --> 43:00.950 But they should be about nine bucks. 43:02.050 --> 43:04.290 Yeah, or you can literally just buy... 43:04.290 --> 43:06.530 You know, these locks cost about seven dollars. 43:06.530 --> 43:09.130 So just buy one and carve the key down. 43:09.170 --> 43:09.970 Question. 43:15.620 --> 43:17.300 Oh, why are there different shapes? 43:17.560 --> 43:19.280 You can notice that... 43:19.280 --> 43:20.980 The question is about those shapes. 43:21.260 --> 43:24.940 The key tips aren't always the same size. 43:25.220 --> 43:28.980 Sometimes there's a very, very thin tip. 43:28.980 --> 43:32.520 Now, if you had a slightly thicker one, it might not stick all the way in. 43:32.640 --> 43:33.740 But if you have a very... 43:33.740 --> 43:34.440 You couldn't just... 43:34.440 --> 43:38.580 If I just took this key, carved it all the way down, the thin is a little weaker. 43:38.780 --> 43:40.900 So this set, it gives you kind of options. 43:40.980 --> 43:44.700 You can see how they all engage that lever on one level or another. 43:45.420 --> 43:49.500 Occasionally, you don't see them anymore, but you used to see a dual lever warded lock. 43:49.580 --> 43:50.880 In fact, I think I have one over here. 43:50.880 --> 43:53.140 I used to have one on the back of my truck for my trailer hitch. 43:53.600 --> 43:55.540 But, you know, you don't see... 43:55.540 --> 43:59.320 Any one of these could probably open just about any warded lock out there. 44:02.460 --> 44:03.700 Ah, barrel locks. 44:03.700 --> 44:04.340 New this year. 44:04.340 --> 44:06.500 Anyone who saw me at SHMOO, you didn't see this part. 44:26.830 --> 44:33.030 Barrel locks are very popular with utility companies, and they're popular in outdoor situations. 44:34.150 --> 44:34.950 I would almost... 44:34.950 --> 44:36.250 These are kind of the in-between. 44:36.250 --> 44:37.470 Are these really a lock? 44:37.470 --> 44:38.190 Are they not? 44:38.190 --> 44:39.030 I don't really know. 44:39.030 --> 44:45.190 I like to kind of use them as an example of something that works like a lock, but it shouldn't be thought of as a lock. 44:45.190 --> 44:50.070 I've seen these sometimes on perimeter fence, on way out on the edge of properties. 44:50.070 --> 44:51.570 Don't use them out there. 44:51.910 --> 44:54.130 Let the utility company work with these. 44:54.130 --> 44:56.070 They're really not truly locks. 44:56.510 --> 44:58.830 And here, we're going to play with some of them in a bit. 44:59.750 --> 45:02.070 The way barrel locks work... 45:03.150 --> 45:05.910 A barrel mechanism looks something like this. 45:05.990 --> 45:14.710 It's a double ball action inside with a plunger, and if this plunger retracts, obviously, the balls fall inward. 45:15.110 --> 45:25.430 But unlike very high quality padlocks where the double ball mechanism is engaged with a key and so forth, these really just rely on a very, very strong spring. 45:26.090 --> 45:29.050 If you just reach in there with a hook, pull that out. 45:29.050 --> 45:31.070 Let me see if I can do that for you. 45:32.190 --> 45:36.310 This is a homemade tool made out of a fishing snake. 45:36.310 --> 45:37.690 You can run wire through a wall. 45:37.990 --> 45:39.390 Very, very nice steel. 45:39.550 --> 45:42.410 If you temper it right, you can make a lot of good tools out of this. 45:44.010 --> 45:45.150 This is a barrel lock. 45:45.150 --> 45:48.890 You can see the outer casing and the little balls here. 45:49.570 --> 45:52.510 If I reach in... 45:52.510 --> 45:55.010 Sorry if I'm going out of frame for a second. 45:58.850 --> 45:59.790 There we go. 45:59.890 --> 46:00.970 That's locked. 46:02.810 --> 46:03.910 That's not the cool part. 46:03.910 --> 46:06.670 It's kind of cool, but, you know... 46:06.670 --> 46:07.810 Unlocking it. 46:07.810 --> 46:08.770 There, now you can applaud. 46:08.770 --> 46:09.570 The unlocking part. 46:09.570 --> 46:10.450 That's fun. 46:13.750 --> 46:17.730 This is the plunger that would ride all the way down inside there. 46:17.730 --> 46:20.050 I don't know if we can get that up to the camera. 46:20.690 --> 46:22.830 My camera is ass-tacular. 46:23.890 --> 46:30.370 But yeah, that little plunger just rides in and out and it's not a complex mechanism. 46:30.530 --> 46:42.310 I've known people, maybe I've heard of people, who hypothetically had their gas turned off because they were potentially a moron and didn't pay their bills for maybe a year. 46:42.650 --> 46:45.210 And maybe they turned the gas back on this way. 46:45.270 --> 46:48.310 But I could just be telling a story someone told me. 46:49.110 --> 46:50.130 Was there a question? 46:50.130 --> 46:51.590 There were a couple of questions on that one. 46:54.890 --> 47:02.470 Oh, how do I... I just... Actually, I think I have one that has... You can kind of see the plunger in there. 47:03.850 --> 47:05.270 Oh, I'll show you the key. 47:05.270 --> 47:11.370 The tool that I use just reaches in and has a hook tip and I just kind of grab as hard as I can on the spring. 47:11.370 --> 47:14.970 The spring is sort of fused to the base of the plunger. 47:14.970 --> 47:17.830 So if you get that spring at all, it'll move. 47:17.890 --> 47:19.730 Was there another question before I jumped on? 47:19.730 --> 47:20.070 No? 47:20.070 --> 47:20.210 Alright 47:23.400 --> 47:23.840 . 47:24.300 --> 47:26.280 There's another type, very similar. 47:26.280 --> 47:29.220 It's just called a screw style, bolt style. 47:29.220 --> 47:35.480 In this case, there's just threading and the bolt that's inside the plunger spins outward. 47:35.920 --> 47:38.500 The key on that... Here's what keys look like. 47:38.500 --> 47:41.080 This is the actual anchor key. 47:41.080 --> 47:42.940 It's called A-N-K-E-R. 47:43.340 --> 47:44.700 It's really just... It sticks down. 47:44.700 --> 47:49.680 I think the tip of this has a pair of hooks that flange outward if you pull the handle. 47:50.200 --> 47:52.860 But, you know, that's really all it is, just a hook. 47:53.200 --> 47:54.480 And this is the bolt style. 47:54.480 --> 47:58.820 Now, you should note that this is not a regular Phillips head or hex head pattern here. 47:58.820 --> 48:00.600 This is a unique cut pattern. 48:00.760 --> 48:05.480 And the bolt on the inside, if you have a rotating bolt style barrel lock, is a unique cut pattern. 48:05.480 --> 48:08.900 So it's very, very hard to get to pick a rotating bolt style. 48:09.220 --> 48:11.700 These are... I think Agbay makes these. 48:11.700 --> 48:13.700 These are rotating disc style. 48:13.700 --> 48:17.360 You can actually get barrel locks in rotating disc. 48:17.360 --> 48:19.740 We'll talk about what a rotating disc lock is later. 48:19.740 --> 48:21.120 They are really nice. 48:21.120 --> 48:24.960 They are a whole world of difference from what you see on the table in front of me. 48:24.960 --> 48:29.320 You can do all kind of levels of permission characteristics, master keying. 48:29.500 --> 48:37.380 If any of you work for any type of a company large enough to think about barrel locks, consider going with a higher end one. 48:37.380 --> 48:41.360 I don't know the price breakdown, but it's really, really worth it. 48:43.140 --> 48:46.600 And just worth mentioning, you see these in similar situations. 48:46.600 --> 48:48.780 A lot of the same vendors sell them. 48:48.780 --> 48:50.880 They're called intimidator screws. 48:50.960 --> 48:52.780 These are included just to mention. 48:52.780 --> 48:54.480 These are obviously not locks. 48:54.480 --> 48:56.720 Their freaking name is intimidator. 48:56.720 --> 48:58.860 It's meant just to dissuade someone. 48:59.000 --> 49:01.900 These are not to be thought of as real locks. 49:02.680 --> 49:07.080 But you'll see these in very similar light duty situations. 49:08.960 --> 49:10.040 Ah, dimple locks. 49:10.040 --> 49:11.800 Someone mentioned these earlier. 49:12.140 --> 49:14.180 Let me try to make some real estate up here. 49:15.100 --> 49:16.520 Are we having fun so far? 49:16.520 --> 49:17.440 Am I doing alright? 49:32.280 --> 49:33.540 Dimple locks. 49:34.260 --> 49:37.720 You may have seen a lot of European locks are of this design. 49:37.720 --> 49:41.920 In fact, the device, you know the club that goes on automobiles? 49:41.920 --> 49:44.780 They had a competitor that came out not too long ago. 49:44.780 --> 49:45.940 I guess it's long now. 49:45.940 --> 49:48.160 That kind of wraps around the brake pedal. 49:48.280 --> 49:52.240 And one of the big things in their infomercial was that the club lock is just a joke little lock. 49:52.240 --> 49:53.740 Our lock uses a dimple key. 49:53.740 --> 49:57.820 You'll see these on higher end situations. 49:58.120 --> 50:01.740 Dimple keys, the keyway is flipped this side. 50:01.800 --> 50:05.520 It's flat, so it's a bastard to get your picks in there. 50:06.420 --> 50:09.920 And the... Where did I... Oh, never mind. 50:09.920 --> 50:12.440 I don't have a picture of the key, just other than to show you this. 50:12.700 --> 50:16.020 Yeah, dimple keys to actually carve the bidding on them. 50:16.020 --> 50:18.680 It takes a little more skill to get in there. 50:20.240 --> 50:26.080 But inside, you know, inside most of the time, these are just simple pin tumbler locks. 50:27.060 --> 50:27.920 Let's see if I have... 50:30.320 --> 50:32.800 You know, it's just a pin stack in here. 50:32.980 --> 50:34.300 You know, it's facing a different way. 50:34.300 --> 50:38.160 It looks different, but it shouldn't be thought of as dramatically different. 50:38.160 --> 50:40.700 It has its benefits, it has its weaknesses. 50:41.060 --> 50:44.300 Some people have tried to make these locks even more secure. 50:44.400 --> 50:45.820 Let me see if I have that. 50:46.220 --> 50:50.260 Well, first, instead of showing you the more secure one, let me show you the less secure one. 50:51.280 --> 50:57.540 There are other means of, you know, if I said the keyway is so small, it's hard to put your picks in. 50:57.900 --> 51:00.360 There's other means of picking them, however. 51:00.740 --> 51:02.780 There's a method called impressioning. 51:02.840 --> 51:09.400 Those of you, the few of you who said you knew Barry Wells, the rest of you shall be introduced to him with this video clip. 51:09.700 --> 51:11.380 And we hope that we have sound running. 51:11.380 --> 51:14.700 I'm jacked in and everyone heard that loud blaring of sound earlier. 51:15.000 --> 51:16.660 So let's see what we've got. 51:16.960 --> 51:19.260 It's very difficult to pick this lock. 51:19.260 --> 51:21.060 It's extremely difficult. 51:21.060 --> 51:24.800 They put in all sorts of anti-pick pins. 51:25.000 --> 51:28.020 It really is a very nasty lock to pick. 51:28.020 --> 51:32.620 On the other hand, I just explained to you a little bit about impressioning. 51:32.720 --> 51:36.480 And there is a very easy trick to open these locks. 51:36.480 --> 51:38.380 And I'll try to demonstrate it. 51:40.840 --> 51:44.680 Here you see the original key. 51:44.680 --> 51:49.400 It has a deep cut, not so deep cut, deeper cut, not so deep cut. 51:49.460 --> 51:52.140 And here's the blank that we prepared. 51:52.200 --> 51:55.140 The blank has the cuts all the way to the deepest. 51:55.280 --> 51:57.720 So this key will never open a lock. 51:57.720 --> 52:00.120 We even made it a little bit deeper. 52:00.800 --> 52:04.540 All the holes are just a little bit deeper than they normally get. 52:04.540 --> 52:13.300 And what I'm going to try to do now is put some aluminum tape over this blank key so it becomes high again. 52:13.300 --> 52:14.720 Stick it in the lock. 52:14.720 --> 52:19.920 Then the pins will push on the prepared key. 52:20.740 --> 52:22.380 They will bind. 52:22.460 --> 52:29.620 I will move it left and right and the keys that bind will actually push deeper and deeper and deeper into the foil. 52:29.620 --> 52:32.660 And at one moment hopefully the lock will turn. 52:32.660 --> 52:34.880 And I have an exact copy of the key. 52:34.920 --> 52:41.080 And this is a technique that is possible on almost all dimple lock keys. 52:41.080 --> 52:48.600 It's not possible on the Notti locks because they have pin in pin and some have to be pushed upwards and therefore it doesn't work on that. 52:48.600 --> 52:52.580 But it works on an amazingly amount of locks. 52:52.580 --> 52:53.960 I show you what I do. 52:53.960 --> 53:02.400 I put some of this aluminum foil that is being used in the car industry and the heating industry over this blank. 53:02.400 --> 53:04.300 So as you can now see it's covered. 53:04.340 --> 53:10.780 The trick is that the way where the key will enter the lock has to be perfect. 53:10.840 --> 53:15.600 Because that's where it will probably jam up if this goes wrong. 53:17.040 --> 53:17.520 Ok. 53:17.520 --> 53:21.000 I'll try to insert it. 53:21.320 --> 53:22.440 Ok. 53:24.320 --> 53:27.660 Now, the prepared blank is in the lock. 53:27.940 --> 53:30.340 And now I will wiggle it. 53:31.280 --> 53:34.640 This will take a little bit longer than the ace lock. 53:35.060 --> 53:38.000 But hopefully the result will be the same. 53:41.340 --> 53:42.380 But anyway, if... 53:43.040 --> 53:49.540 On average that would open the lock because the tin foil would slowly shape it to the right levels. 53:49.540 --> 53:52.180 You go in there you wiggle, wiggle, wiggle, wiggle, wiggle, pop. 53:52.280 --> 53:53.800 That's how it would average. 53:54.000 --> 53:54.900 It wouldn't take very long. 53:54.900 --> 53:55.860 Ok, there we go. 53:59.280 --> 54:01.160 Now watch when he pulls it out. 54:07.500 --> 54:09.660 He's made an exact copy of the key. 54:11.700 --> 54:14.920 Now remember, this is a $150 lock. 54:16.380 --> 54:21.060 Well, some people are really going to be upset because this works with a lot of these tin foil locks. 54:21.840 --> 54:23.280 So that's Barry Wells. 54:23.280 --> 54:24.860 Very, very good cat to know. 54:24.860 --> 54:26.540 He's a very bright guy. 54:26.880 --> 54:31.960 And that is the impressioning technique which made... and you can see like the room just erupted at hope. 54:31.980 --> 54:34.940 That really blows people away to see it's that simple but it works. 54:34.940 --> 54:38.440 I've seen him do it and I'm just I'm in awe of the stuff that he can pull off. 54:38.440 --> 54:39.720 He's a really great guy. 54:40.820 --> 54:45.260 There's... I'm mentioning here another technique that sometimes opens these locks called bump keying. 54:45.260 --> 54:46.540 We're going to cover that in a bit too. 54:46.540 --> 54:48.300 How many people have ever heard of bump keying? 54:48.920 --> 54:49.940 Oh, only some of you. 54:49.940 --> 54:51.560 So you're going to have some fun with this in a bit. 54:52.500 --> 54:54.180 Let me see if that's next or if I added... 54:54.180 --> 54:55.540 No, I added a new section. 54:55.540 --> 55:00.220 There is a dimple lock that's a specialized style of lock. 55:00.220 --> 55:09.820 It's a high-end dimple lock that's recently the Multilock Company who was acquired by the Abloy Group a large umbrella company of lock manufacturers in Europe. 55:09.820 --> 55:15.770 The Multilock is very special because it has what's called telescoping pins or pin-in-pin systems. 55:16.160 --> 55:26.060 The pin stacks, not only do they have regular top and bottom pins, but they have their hollow so they actually have top and bottom pins inside of the top and bottom pins. 55:26.140 --> 55:32.560 So the key cuts are both dimple cuts and sometimes little protrusions in the middle. 55:32.660 --> 55:34.300 So the pins track in and out. 55:34.300 --> 55:36.220 There's pins tracking inside of each other. 55:36.220 --> 55:38.000 It's a very, very secure design. 55:38.000 --> 55:39.500 It's a brilliant idea. 55:39.980 --> 55:45.620 It's a brilliant idea, but in theory, theory and practice are different things. 55:47.300 --> 55:52.900 This is what if you were to just kind of look down a lock at a Multilock it kind of looks like. 55:52.900 --> 55:54.480 You can see you have your pin stacks. 55:54.480 --> 55:56.240 You can see kind of protruding. 55:56.240 --> 55:58.260 We have pins inside of pins. 55:58.740 --> 56:01.060 And most people say, oh, that's a brilliant design. 56:01.060 --> 56:03.120 You know, you've got this Multilock and that's so... 56:03.120 --> 56:05.240 that must be hell to pick. 56:05.240 --> 56:06.600 I can't imagine something like that. 56:06.600 --> 56:09.140 Well, it's actually a little something like this. 56:09.140 --> 56:10.800 Did anyone catch the difference? 56:13.060 --> 56:15.800 This is what people think a Multilock is. 56:16.160 --> 56:18.780 This is pretty much how a Multilock works. 56:20.040 --> 56:22.800 Can anyone notice what is the difference? 56:24.420 --> 56:25.580 Yes. 56:25.580 --> 56:29.060 The top pins are not independent of one another. 56:29.060 --> 56:30.740 They are a related system. 56:30.740 --> 56:34.720 They interact with each other in ways that were not completely foreseen. 56:35.700 --> 56:38.520 Can anyone tell me... let's see... 56:39.440 --> 56:51.680 This is a really hard question, so this is definitely going to be worth this will be an issue of Frack, a Red Bull, a lighter , and I think we're going to do maybe a hard drive. 56:51.680 --> 57:01.620 I have a lot of old hard drives that are too small for me, but maybe I forgot to erase, you know, Aqua Teen Hunger Force or Monty Python or something I was storing on them. 57:01.620 --> 57:02.920 I don't know. 57:03.200 --> 57:04.580 Might be there. 57:05.420 --> 57:12.340 Can anyone tell me the name of the student from Rampamoe College in New Jersey You already got your hand up? 57:12.340 --> 57:13.120 Jesus. 57:13.480 --> 57:20.280 You have to pronounce his name correctly, who published an exploit based around this attack? 57:21.640 --> 57:23.520 Close, but no, not pronounced right. 57:23.520 --> 57:25.460 I saw a hand back here. 57:26.700 --> 57:27.780 No guess? 57:27.980 --> 57:29.260 Who was it over here? 57:31.300 --> 57:32.260 Pardon me? 57:33.240 --> 57:34.740 No, it was not Eric Murdoch. 57:34.740 --> 57:36.240 I saw a few hands. 57:36.500 --> 57:38.040 Was there anybody I feel like... 57:38.040 --> 57:38.720 I'm missing out. 57:38.720 --> 57:40.100 I know your hand must have been up. 57:40.760 --> 57:44.800 Eric Michaud is the correct answer. 57:44.800 --> 57:45.980 Way to go, man. 57:54.690 --> 58:00.370 Yeah, Eric is at WhatTheHack which unfortunately is running at the same time as Defcon this year. 58:00.570 --> 58:02.110 See that red box? 58:02.110 --> 58:05.350 Take a look in there and maybe grab a hard drive to your liking. 58:07.110 --> 58:09.010 I think FAT, probably. 58:09.010 --> 58:10.330 Probably FAT file system. 58:11.390 --> 58:14.070 The little red, the master, the box that says hard drives. 58:16.650 --> 58:19.150 Yeah, the Michaud attack... 58:19.830 --> 58:20.950 I'm sorry, what? 58:27.260 --> 58:28.220 What's that? 58:34.680 --> 58:35.840 You want to help me out, Sandy? 58:35.840 --> 58:37.020 How would we describe this? 58:37.020 --> 58:38.320 This is Mouse, everybody. 58:38.320 --> 58:41.840 She's a member of Tool USA, so she's here with us. 58:42.280 --> 58:46.260 Would we call this an exploit or a proof or what would you think this is? 59:04.880 --> 59:13.900 Yeah, this is a tool that we have worked and I'd probably snap it apart, but giving enough time, I can keep cutting these and eventually we do get them to work. 59:19.700 --> 59:21.820 Yeah, Ken Presson, the guy from Peterson. 59:21.820 --> 59:23.240 Remember I mentioned Peterson, the vendor. 59:23.240 --> 59:27.360 He is, this is definitely on his radar and he's like, oh man, I got some ideas for this. 59:30.700 --> 59:34.460 Yeah, we've engaged with Multilock is aware that people are working on this. 59:34.460 --> 59:36.680 They've acknowledged that there is something to this. 59:39.940 --> 59:42.540 Yeah, they do love to send out letters, don't they? 59:44.240 --> 59:47.900 The trick behind, I mean, you can, most of you, you can see what's going on here. 59:47.900 --> 59:50.420 You'll probably see already where this is going. 59:50.940 --> 59:58.320 Typically, the pin stack would function, this inner pin would be pushed never that high up, because you've got to picture a dimple key. 59:58.320 --> 01:00:02.120 You're not going to have a dimple that's little and like this big spike in the middle. 01:00:02.120 --> 01:00:05.420 So dimple keys usually don't push the inner pin very high. 01:00:05.820 --> 01:00:10.280 That doesn't mean you couldn't stick something in there to push that pin very high. 01:00:10.680 --> 01:00:18.020 And if you over lift that pin stack, the Michaud attack just completely moves everything out of the way. 01:00:20.360 --> 01:00:23.800 It's a very, very elegant discovery. 01:00:23.800 --> 01:00:25.620 And we're very proud of him. 01:00:25.620 --> 01:00:26.560 How old is Eric? 01:00:26.560 --> 01:00:27.540 He's like... 01:00:28.200 --> 01:00:30.320 He looks 15, but he's in his 20s. 01:00:30.320 --> 01:00:31.820 He's a really bright kid. 01:00:31.820 --> 01:00:33.440 So, way to go, Eric. 01:00:33.940 --> 01:00:38.420 Keep this on your radar and see if Peterson starts selling anything about it. 01:00:40.220 --> 01:00:45.360 Back to other locks that are less secure, and everyone knows are less secure. 01:00:45.740 --> 01:00:46.900 Tubular locks. 01:00:47.720 --> 01:00:51.560 Tubular locks, you guys must have seen tubular locks here and there in life, right? 01:00:51.560 --> 01:00:53.340 How many people have seen a tubular lock? 01:00:53.740 --> 01:00:54.600 Yes. 01:00:55.120 --> 01:00:57.760 From the last talk, we mentioned the kryptonite itself. 01:00:57.760 --> 01:01:01.640 Kryptonite tubular lock, one of the best ones that people will probably be familiar with. 01:01:01.740 --> 01:01:04.820 My parents' old house, the alarm system was a tubular lock. 01:01:04.940 --> 01:01:11.900 When tubular keys first came out, they were revered as this breakthrough because, yeah, they're a very new design. 01:01:11.900 --> 01:01:13.520 No one had, you know, wow, what is this shape? 01:01:13.520 --> 01:01:14.280 This is neat. 01:01:14.280 --> 01:01:15.840 I guess you couldn't cut this very easily. 01:01:15.840 --> 01:01:18.680 Yes, it's harder to cut a tubular key bidding. 01:01:19.660 --> 01:01:24.560 But you have a lock that's literally staring you in the face with all of the pins. 01:01:25.080 --> 01:01:33.700 It lends itself very well to a lot of experimentation and fiddling because you can independently work on these pin stacks right there. 01:01:41.020 --> 01:01:43.500 This is called a tubular pick. 01:01:44.420 --> 01:01:57.400 And a tubular pick has all these little fingers that can track up and down and actually simulate the different cut depths on a tubular key. 01:01:58.360 --> 01:02:03.780 If I were to, let's say, find a tubular lock somewhere in my belongings. 01:02:12.330 --> 01:02:16.750 Well, I'll do the crappiest one I have just because it's on the top of the pile. 01:02:17.750 --> 01:02:19.490 Everyone's seen these before. 01:02:20.210 --> 01:02:26.710 These are your basic, you know, cheap-ass, not-allowed-to-be-sold-in-stores-anymore kryptonite-type lock. 01:02:27.950 --> 01:02:34.630 The way a tubular lock works, you take the pick, stick it right in the lock, and wiggle it. 01:02:36.730 --> 01:02:37.130 And... 01:02:37.130 --> 01:02:38.850 Hang on, I've got to give a little more tension on my... 01:02:48.160 --> 01:02:53.960 The problem with this lock is I've beat it to hell because of another exploit that we'll talk about in a moment. 01:02:55.260 --> 01:02:56.560 Yeah, I think this lock... 01:02:56.560 --> 01:02:58.160 I think this lock is completely destroyed. 01:02:58.900 --> 01:03:01.980 I was going to buy a new one, but you really... You've got to give them credit. 01:03:01.980 --> 01:03:03.560 They did pull all these out of the stores. 01:03:03.560 --> 01:03:05.420 You can't get this lock anymore. 01:03:05.940 --> 01:03:07.680 So, yeah, this lock is beyond all hope. 01:03:07.680 --> 01:03:08.780 Let me grab a different one. 01:03:20.860 --> 01:03:23.380 Because of the public... Well, why aren't they selling them in stores? 01:03:23.380 --> 01:03:25.180 Let's jump to this then. 01:03:28.060 --> 01:03:34.280 This is why, if you don't have... This is a kryptonite Evolution 2000 lock. 01:03:41.060 --> 01:03:59.040 I used to use this to lock up my bike around here in Seattle until I found out that you can take a big pen and just remove the top and just pop it into the lock and just do a couple little quick twists and turns and voila! 01:03:59.820 --> 01:04:03.560 Your lock and your bike is completely compromised. 01:04:03.920 --> 01:04:06.540 So, way to go, kryptonite. 01:04:07.620 --> 01:04:09.900 That's why they don't sell it in stores anymore. 01:04:11.760 --> 01:04:14.280 Does Peterson sell big pens was the question. 01:04:14.280 --> 01:04:15.380 I don't know. 01:04:15.980 --> 01:04:20.280 Yeah, the original design, the spring tensions were really bad and it was just... 01:04:20.280 --> 01:04:22.540 That's what they were talking about in the last talk. 01:04:25.360 --> 01:04:30.360 Right, the modern tubular lock, the gentleman points out, is usually designed by Ace. 01:04:30.360 --> 01:04:32.340 There's the Ace and the Ace 2 even. 01:04:32.340 --> 01:04:35.180 Those are much better quality tubular locks. 01:04:35.180 --> 01:04:38.140 They have high tension springs, variable tension springs. 01:04:38.140 --> 01:04:39.400 You can't just jam a pen in there. 01:04:39.400 --> 01:04:41.600 I saw two hands, one and then two. 01:04:44.700 --> 01:04:51.300 Not really possible to use a shim just because traditionally tubular locks, you're not spinning something. 01:04:51.300 --> 01:04:58.240 You're actually, those are key retaining locks because of the little notch in the... well, you really can't see that. 01:04:58.820 --> 01:05:02.400 If you've ever used a tubular lock, you know you can't just leave the key in it. 01:05:02.400 --> 01:05:05.300 You have to completely pull it back around to get the key out. 01:05:05.400 --> 01:05:09.800 So there's no reason for any type of spring mechanism to be a part of the secure latch. 01:05:09.800 --> 01:05:11.220 It's all one solid piece. 01:05:11.220 --> 01:05:12.720 You really can't shim them easily. 01:05:12.740 --> 01:05:14.160 And there was one hand back here. 01:05:14.860 --> 01:05:15.700 Same question. 01:05:15.700 --> 01:05:17.520 Okay, yeah, you really can't shim them. 01:05:17.760 --> 01:05:29.860 However, if, you know, you have something that can't be defeated by a ballpoint pen, which is, you know, your Ace type design, you can get this lock pick, which is, this one's by Southerd. 01:05:29.860 --> 01:05:31.360 Other people do make them. 01:05:31.400 --> 01:05:34.160 These are really beautiful, beautiful devices. 01:05:34.740 --> 01:05:44.740 I'm just gonna make that nice and flat and flush, so that kind of simulates a, you know, you could actually see the key cuts would be of different depths. 01:05:45.060 --> 01:05:46.200 Those bidding cuts. 01:05:46.200 --> 01:05:52.540 And this simulates, let me flush it back out, this would be a tubular key that's not cut at all. 01:05:53.180 --> 01:06:01.600 If I give this a little tension, and I stick this in the lock, and I wiggle it some, and now that's open. 01:06:02.600 --> 01:06:06.500 You can see the, this is a drawback, it draws a bar back out here. 01:06:06.500 --> 01:06:08.020 This is actually a gun lock. 01:06:10.040 --> 01:06:22.740 Not only have I opened the lock, but, I have the bidding of that key, and you could take this to a locksmith shop, and get a replacement key cut, very very easily . 01:06:22.780 --> 01:06:26.900 I don't recommend that anyone walk into a locksmith shop with a pick . 01:06:28.900 --> 01:06:34.180 All the picks that you can find, usually of this nature, they come with what's called a decoder key. 01:06:34.180 --> 01:06:47.020 It's a little key that just has cuts on it of different depths, and you kind of, it's like a gauge, you go, okay, one, two, and you can actually you could walk into a lock shop and say, I need a seven pin tubular key that's bidded out at three, six, three, 01:06:47.020 --> 01:06:48.740 four, two, seven, blah, blah, blah. 01:06:48.780 --> 01:06:51.740 And they'll just punch it in the machine, and cut it out. 01:06:51.900 --> 01:06:53.560 I saw a couple hands on that one. 01:06:57.560 --> 01:07:01.940 This, talk about, talk about wonderful, wonderful girlfriends. 01:07:01.940 --> 01:07:05.440 This was a birthday gift from my girlfriend right before ShmooCon. 01:07:05.640 --> 01:07:08.140 So, this is about an $80 pick. 01:07:08.200 --> 01:07:14.300 And you got, you know, everyone else and their brother gives you, like, sweaters and, you know, oh, here's some crap you don't really care about. 01:07:14.300 --> 01:07:15.500 And I'm like, I wonder what this is going to be. 01:07:15.500 --> 01:07:16.400 And I broke this out. 01:07:16.400 --> 01:07:17.700 I just, I wanted to cry. 01:07:20.100 --> 01:07:21.400 Question over here. 01:07:25.680 --> 01:07:26.740 I'm sorry. 01:07:26.740 --> 01:07:28.660 Oh, I understand what you were saying. 01:07:28.660 --> 01:07:34.000 He asked if, while I was picking this, was I actually manipulating the heights? 01:07:34.000 --> 01:07:37.720 No, you don't have to actually force these to do anything. 01:07:37.720 --> 01:07:50.840 What happens is, much like with a pin stack that we were working before, if I put, let me see, if I put torque on this, it's not all seven pins that are binding at once. 01:07:50.840 --> 01:07:53.620 Only one pin stack is going to really bind . 01:07:53.640 --> 01:08:03.220 So by torquing, jiggling and jiggling around, the binding pin stack will start to push down, down, down, down, down on a feeler until it's at the right height. 01:08:03.260 --> 01:08:05.560 When it's at the right height, that's no longer binding. 01:08:05.560 --> 01:08:07.220 The next one will bind and so on and so forth. 01:08:07.220 --> 01:08:12.320 So all I have to do is jiggle it and they'll eventually all track down to the right height and they do it all by itself. 01:08:12.320 --> 01:08:14.500 Question here, behind you actually. 01:08:17.720 --> 01:08:19.320 I've never seen a tubular blank. 01:08:19.320 --> 01:08:24.860 I think they're just, you know, just tubes and What's that? 01:08:24.920 --> 01:08:25.660 They're blank. 01:08:27.300 --> 01:08:32.120 Yeah, so yeah, they have the little notch that keeps it seated in the lock. 01:08:32.140 --> 01:08:34.060 But you can just cut them with regular tools. 01:08:34.060 --> 01:08:35.740 There was, hang on, you and then you. 01:08:36.160 --> 01:08:38.580 And am I missing, are there hands on the outside that I'm not seeing? 01:08:38.820 --> 01:08:39.240 No? 01:08:39.240 --> 01:08:39.640 Alright. 01:08:39.640 --> 01:08:40.340 Go ahead, sir. 01:08:40.340 --> 01:08:41.580 Are they all the same diameter? 01:08:41.740 --> 01:08:43.880 The question was, are they all the same diameter? 01:08:43.880 --> 01:08:49.240 I think diameter, yes, but there are two main systems of pinning. 01:08:49.240 --> 01:08:51.040 There's seven pin and eight pin. 01:08:51.780 --> 01:08:54.200 There's actually two picks that Souther offers. 01:08:54.200 --> 01:08:56.240 I think there's a bonus if you buy them both at once. 01:08:56.240 --> 01:08:57.240 It's like a savings. 01:08:57.860 --> 01:08:59.080 There's the seven pin. 01:08:59.080 --> 01:09:01.200 By the way, everything is seven pin. 01:09:01.200 --> 01:09:03.620 I've never seen an eight pin in my life. 01:09:04.200 --> 01:09:10.560 There's also something called seven pin offset, which the eight pin pick will work in a seven pin offset lock. 01:09:10.780 --> 01:09:16.980 But , yeah, unless you are like a locksmith by profession or want to become one, just start off buying this one. 01:09:16.980 --> 01:09:20.000 The seven pin is going to be all you play with for everything you can find. 01:09:20.260 --> 01:09:22.160 There was another question over here. 01:09:40.230 --> 01:09:41.590 Yes and no. 01:09:41.590 --> 01:09:42.870 The gentleman raises a point. 01:09:42.870 --> 01:09:53.850 He said, almost all of what we're talking about, especially as far as pin tumbler picking, excuse me, is based upon misalignment and imperfection in the locks manufacturing process. 01:09:53.850 --> 01:10:00.030 And he said, you know, if you had a very precise alignment, you wouldn't need a lot of these other security features, would you? 01:10:00.030 --> 01:10:01.230 Yes and no. 01:10:01.230 --> 01:10:03.530 You can get very precise machining. 01:10:03.530 --> 01:10:11.470 And in fact, all of your well-made locks, the ones I was talking about, like the ASA locks, the Medicos, just by name, they're all engineered very, very well. 01:10:11.470 --> 01:10:13.530 They're engineered to much higher tolerances. 01:10:13.710 --> 01:10:17.270 But you guys know there's a difference between math on paper and math in real life. 01:10:17.270 --> 01:10:22.450 There's never anything that's 100% perfectly flushed down to like a micron level. 01:10:22.450 --> 01:10:25.990 There's always going to be some intolerance introduced into the equation. 01:10:25.990 --> 01:10:29.370 That's why high security pins are still very valid to have. 01:10:30.010 --> 01:10:33.350 But yes, so yeah, you can have them, some are better than others. 01:10:33.350 --> 01:10:35.670 High security locks will be better engineered. 01:10:35.810 --> 01:10:37.530 There was another hand somewhere. 01:10:37.790 --> 01:10:38.570 Yes. 01:10:43.510 --> 01:10:44.670 Pardon me? 01:10:46.210 --> 01:10:47.870 Oh, I'm sorry. 01:10:47.870 --> 01:10:49.430 Welcome from across the pond. 01:10:49.430 --> 01:10:51.710 The question was, how did the biro trick work? 01:10:51.710 --> 01:10:56.070 And for those of us yanks, that was how did the ballpoint pen work? 01:10:56.330 --> 01:11:14.450 That worked just because the spring tensions were so bad and because the pins could seat all the way in, if you just jammed, you know, you just jam a ballpoint pen in there, it smashes all the springs, all the pins, completely out of the way, and it just forces the pins way up inside the lock. 01:11:14.450 --> 01:11:16.110 Both the, Miles, am I getting this right? 01:11:16.110 --> 01:11:26.850 Both the driver and the keypin go completely yeah, both the driver and keypin go completely out of the plug and they seat way up inside the chamber so the plug can rotate freely. 01:11:26.850 --> 01:11:33.890 People also notice that if you pull the pen out, if you're doing that to a lock sometimes the pins are all screwed up then and you screw your lock up. 01:11:33.890 --> 01:11:37.170 So you need a pick like this to get it back working again. 01:11:37.390 --> 01:11:38.210 You had a question, ma'am? 01:11:55.640 --> 01:11:56.600 Very good question. 01:11:56.600 --> 01:12:07.400 The question was, if you want to get high security pins in your locks, either to practice with them or conceivably to secure your home with them, he's, you know, Viros is mentioning, where do you find these? 01:12:07.400 --> 01:12:08.400 I don't see them anywhere. 01:12:08.760 --> 01:12:12.300 That's because I'm assuming you're talking about in stores, you've never found them. 01:12:12.300 --> 01:12:12.580 Right. 01:12:12.640 --> 01:12:17.400 Because we're Americans and our stores just don't carry very good locks because they sit on the shelf. 01:12:17.400 --> 01:12:17.940 No one buys them. 01:12:17.940 --> 01:12:20.300 People are like, 70 bucks for this sucker? 01:12:20.360 --> 01:12:21.560 This is 12! 01:12:21.560 --> 01:12:22.700 Hell with that! 01:12:23.280 --> 01:12:25.160 Yeah, you buy them on the internet. 01:12:25.160 --> 01:12:26.200 Look on the internet. 01:12:26.220 --> 01:12:30.960 Any reputable vendor will actually say, you know, features high secure pins features this, that, and the other. 01:12:30.960 --> 01:12:33.440 It's not a feature that they want to be secretive about. 01:12:33.440 --> 01:12:34.760 It's a benefit to the lock. 01:12:34.760 --> 01:12:35.880 So they're going to advertise it. 01:12:37.940 --> 01:12:39.640 Oh, I understand. 01:12:39.640 --> 01:12:40.160 Right. 01:12:40.220 --> 01:12:45.120 You don't, right, he said, do you know if they're a spool pin or a mushroom pin or a serrated pin? 01:12:45.760 --> 01:12:49.020 Different vendors tend to have pins they like to use. 01:12:49.060 --> 01:12:53.280 For instance, you know, we talked about the Asa, that was a spool pin lock. 01:12:53.280 --> 01:12:55.840 We'll talk a little later about American brand padlocks. 01:12:55.840 --> 01:12:57.780 They are big on serrated pins. 01:12:58.520 --> 01:13:01.040 But, vendor by vendor, you can kind of get a feel for it. 01:13:01.040 --> 01:13:04.340 I don't know if there's a nice reference guide out there for who has what. 01:13:04.420 --> 01:13:07.320 But, you know, just break one apart and see what's in it. 01:13:07.900 --> 01:13:08.820 There was a question. 01:13:10.260 --> 01:13:11.680 Oh, very good point. 01:13:11.680 --> 01:13:12.840 Very good point. 01:13:12.920 --> 01:13:15.920 We'll talk about this in the URLs later when I give you a bunch of links. 01:13:16.420 --> 01:13:19.000 Lockpicking101.com would probably have that answer. 01:13:19.160 --> 01:13:22.300 It's a great , great user base of really knowledgeable people . 01:13:22.640 --> 01:13:27.040 Anything that I don't cover or you want to know more about, either talk to me later or check them out. 01:13:27.040 --> 01:13:28.640 I'm going to mention them again in a bit. 01:13:30.100 --> 01:13:32.520 Let's see, were there any other questions at the moment? 01:13:38.960 --> 01:13:46.500 The problem with a blank is that it might not, I'm trying to think if this was the thing, it might not grab onto... 01:13:46.500 --> 01:13:50.240 The question was, if the ballpoint pen works would just a regular blank have worked? 01:13:52.540 --> 01:13:53.700 Right, oh, alright. 01:13:53.700 --> 01:13:54.280 I understand. 01:13:54.280 --> 01:13:59.980 Part of part of the pins fitting in, let me see. 01:14:00.320 --> 01:14:01.600 I see what's going on. 01:14:03.120 --> 01:14:12.580 When you have key pins that are still in these grooves, you know, typically you'd have a driver pin stick out and the key pin would seat in this. 01:14:12.600 --> 01:14:13.780 Oh , Laz! 01:14:14.240 --> 01:14:15.340 There you are. 01:14:15.340 --> 01:14:16.420 How are you, man? 01:14:17.320 --> 01:14:18.380 Where were you? 01:14:18.460 --> 01:14:19.580 Stuck in an airplane. 01:14:19.580 --> 01:14:21.380 Oh man, sorry to hear that. 01:14:25.280 --> 01:14:28.880 Usually you would have key pins in those grooves. 01:14:28.880 --> 01:14:31.680 They are helping to turn that center post. 01:14:31.780 --> 01:14:36.980 With the pins being all pushed out of there, there's nothing for a blank to grab onto. 01:14:37.040 --> 01:14:39.060 That's why the plastic pen works so well. 01:14:39.060 --> 01:14:42.860 It actually grabs the post because it uses the plastic misshapes. 01:14:42.860 --> 01:14:44.940 It has a little friction and it will help spin. 01:14:44.940 --> 01:14:46.260 That's why that happens. 01:14:48.380 --> 01:14:48.960 Alright . 01:14:48.960 --> 01:14:50.660 You've got a smaller fucking screen. 01:14:51.580 --> 01:14:52.800 Are you going to sit up here and bitch? 01:14:52.800 --> 01:14:54.360 What the hell, man? 01:14:55.560 --> 01:14:58.300 So that was tubular locks. 01:15:01.580 --> 01:15:03.580 There we go, moving slowly forward. 01:15:04.960 --> 01:15:05.680 Yes? 01:15:09.940 --> 01:15:10.820 Pardon me? 01:15:16.400 --> 01:15:21.820 The question was about Kensington's, the ones that you see on a lot of laptops and security locks like that. 01:15:21.820 --> 01:15:23.460 They say, was it a different diameter? 01:15:23.600 --> 01:15:24.300 I don't know. 01:15:24.300 --> 01:15:24.960 I've never... 01:15:24.960 --> 01:15:26.060 They're the same? 01:15:26.500 --> 01:15:27.100 Okay, yeah. 01:15:27.100 --> 01:15:28.780 You can big pen those as well. 01:15:35.660 --> 01:15:36.260 Okay. 01:15:37.500 --> 01:15:38.020 Alright. 01:15:38.020 --> 01:15:39.340 Oh, we've got more questions. 01:15:43.620 --> 01:15:44.420 What's that? 01:15:48.670 --> 01:15:53.030 Apparently cardboard from a toilet paper roll works very well on a Kensington lock. 01:15:55.130 --> 01:15:56.750 Alright, we've got to move on. 01:15:56.750 --> 01:15:58.490 We're already in the second hour here. 01:16:05.490 --> 01:16:06.610 Alright. 01:16:06.610 --> 01:16:07.930 Moving along. 01:16:07.930 --> 01:16:08.590 Bump keying. 01:16:08.590 --> 01:16:15.890 We were mentioning bump keying earlier briefly when I said Barry was bumping his ASSA lock and you can sometimes bump dimple locks. 01:16:16.310 --> 01:16:22.030 Bump keying is a technique used to quickly spring a lock open with a specially cut key. 01:16:22.030 --> 01:16:23.310 It's called a bump key. 01:16:23.310 --> 01:16:25.350 It's also called a 999 key. 01:16:25.350 --> 01:16:30.230 For a Red Bull, can anyone tell me why it's a 999 key, where that name comes from? 01:16:30.230 --> 01:16:31.230 I saw your hand. 01:16:35.870 --> 01:16:37.150 Very, very good. 01:16:37.150 --> 01:16:44.510 The answer is key bidding has numbers like 0 is no cut at all, 1, 2, 3, the cut depth. 01:16:44.570 --> 01:16:48.590 A bump key is made by cutting all the bidding down to the deepest depths or the 9. 01:16:48.590 --> 01:16:50.150 So it's a 999 key. 01:16:50.690 --> 01:16:52.650 Bump keys work... 01:16:53.330 --> 01:16:57.230 Bump keys work very, very similar to the way pick guns work. 01:16:57.230 --> 01:17:01.790 So let's cover pick guns very briefly and you'll see why bump keys are very, very similar. 01:17:04.690 --> 01:17:05.950 Basic physics, guys. 01:17:05.950 --> 01:17:10.110 If we have a billiard balls on the table, what's going to happen if I shoot this cue? 01:17:12.050 --> 01:17:12.930 Yes. 01:17:13.130 --> 01:17:14.870 3 is not really going to go anywhere. 01:17:14.870 --> 01:17:16.130 2 is going to go flying. 01:17:16.130 --> 01:17:17.930 Newtonian physics at its finest . 01:17:19.390 --> 01:17:21.510 Pick guns work the same way. 01:17:21.510 --> 01:17:24.190 Pick guns, just a long blade down the barrel. 01:17:24.190 --> 01:17:27.390 It's tension with a spring and a trigger that flicks this. 01:17:27.450 --> 01:17:29.890 Pick guns work by smashing on the bottom pins. 01:17:29.890 --> 01:17:34.650 Hopefully, if you get it all lined up just right, you need a little practice, but you can smash them all at the same time. 01:17:34.930 --> 01:17:41.710 And if you're lucky, all the top pins will jump up and you can turn the lock very quickly before they have a chance to spring back down. 01:17:42.650 --> 01:17:58.370 But pick guns, besides being expensive, bulky, a pain in the ass to carry around, a very hard thing to explain what the hell they are if you get asked, there's a cheaper, easier, smaller, and very simple solution that can replicate this same physics. 01:18:00.370 --> 01:18:01.910 Thank you for this, by the way. 01:18:02.750 --> 01:18:04.910 It's a retribution for a previous beer bought. 01:18:05.830 --> 01:18:10.170 Laz and I first actually met, was it here at, was it 10 or 11? 01:18:10.190 --> 01:18:11.230 I don't know, I was drunk. 01:18:11.750 --> 01:18:19.890 Laz was up on stage and he was picking away and he wanted beer and I brought one up and I think I said something about, yeah, I saw you at Hope and I learned to pick. 01:18:19.890 --> 01:18:21.550 He's like, come up here and show me, man. 01:18:21.590 --> 01:18:24.310 I'm trying to embarrass my ass and I finally picked one for you, though. 01:18:24.730 --> 01:18:26.790 By the way, you're a dick. 01:18:27.190 --> 01:18:27.790 Why am I a dick? 01:18:27.790 --> 01:18:33.990 I was sitting over in speaker registration and I saw a video of me and Barry on stage and you're like, by the way, that's Barry, you didn't fucking mention me. 01:18:34.010 --> 01:18:36.850 Well, I'm sorry, it says your name in the link, Barry and Laz. 01:18:36.930 --> 01:18:37.650 Thanks. 01:18:40.590 --> 01:18:46.730 Alright, so simulating a pick gun with a bump key works as follows. 01:18:47.890 --> 01:18:50.990 Take a key that was designed for your lock. 01:18:50.990 --> 01:18:52.950 Notice I didn't say cut for your lock. 01:18:52.950 --> 01:18:54.350 It doesn't have to be the right bidding. 01:18:54.350 --> 01:18:59.470 It just has to be the right keyway that fits down into your lock. 01:19:00.230 --> 01:19:03.470 Take that and cut all the bidding notches to the deepest level. 01:19:03.710 --> 01:19:05.190 That's where you get 999. 01:19:06.170 --> 01:19:08.810 Now I'm going to be burping from this friggin' beer. 01:19:09.490 --> 01:19:11.970 You can do this with a key machine. 01:19:12.310 --> 01:19:15.730 Go to your local hardware store and be like, can you cut it to 999? 01:19:15.730 --> 01:19:18.370 The kid who's making 550 isn't going to ask you why. 01:19:19.090 --> 01:19:22.350 Or you can do this with a Dremel. 01:19:22.350 --> 01:19:24.650 You can do this with a lot of different tools. 01:19:26.210 --> 01:19:28.850 I've hand cut them before and they will work. 01:19:29.510 --> 01:19:32.870 Take this key and insert it into your lock. 01:19:32.870 --> 01:19:33.910 Not all the way. 01:19:33.910 --> 01:19:39.250 You'll actually feel as these ridges are going past the pins you'll feel it click, click, click as it goes in. 01:19:39.510 --> 01:19:42.030 Make sure it's one pin stack out. 01:19:43.030 --> 01:19:43.990 What's that? 01:19:44.930 --> 01:19:48.610 Yeah, put it all the way in and just click it out by one. 01:19:49.370 --> 01:19:55.850 Next thing you want to do is put a little bit of torque on this key and just smash the hell out of it. 01:19:56.950 --> 01:19:58.730 You come at it with a force. 01:19:59.030 --> 01:20:02.730 It bangs across all those ridges and you can see they connect. 01:20:02.810 --> 01:20:07.550 Hopefully you'll hit all of them at the same time and all those top pins will jump up. 01:20:12.010 --> 01:20:14.290 Yeah, you'll smash your hand a lot. 01:20:15.490 --> 01:20:17.170 It's just how that goes. 01:20:17.930 --> 01:20:24.630 One thing you often will get better luck with when you make a bump key, if you cut the shoulder back just a hair farther than it should this makes life a little bit easier. 01:20:24.810 --> 01:20:28.350 It gives a little bit more wiggle room when you're bumping it and knocks them a little bit harder. 01:20:28.370 --> 01:20:29.910 Not much of a difference but it does help. 01:20:33.070 --> 01:20:37.090 This is a kind of what we'll call one grade up from master. 01:20:37.690 --> 01:20:49.770 This is a fortress lock and this is a key that originally went to let me see if I have this one right originally went to a different fortress lock but I've cut it way down. 01:20:50.650 --> 01:21:02.210 Now if I put this in this will not open this lock but if I pull it out by one I'm going to try to do this so everyone can work with the camera here. 01:21:02.250 --> 01:21:04.430 The trick is a little and a lot. 01:21:04.430 --> 01:21:07.990 A little bit of torque and a lot of a little bit of bang. 01:21:08.850 --> 01:21:16.830 You actually want the sensation of the key slipping out of your fingertips as it's being knocked by the lock. 01:21:19.650 --> 01:21:20.730 There you go. 01:21:32.950 --> 01:21:34.630 You shouldn't have tried the second time, should you? 01:21:35.070 --> 01:21:36.690 I was impressed the first time. 01:21:38.790 --> 01:21:41.450 I'm pulling it too hard because I don't want to smash my thumbs. 01:21:41.650 --> 01:21:42.450 Pussy. 01:21:44.910 --> 01:21:46.170 Here, you do it then. 01:21:46.230 --> 01:21:47.030 Shit, I don't do that. 01:21:48.070 --> 01:21:49.670 That's why I have both colors for you. 01:21:50.410 --> 01:21:51.690 So that's bump keying. 01:21:51.810 --> 01:21:53.790 But there is a... I'm sorry, question. 01:22:02.980 --> 01:22:04.440 You're a brighter man than I. 01:22:04.860 --> 01:22:06.680 The question is why can't, you know, you just put... 01:22:09.520 --> 01:22:11.520 Yeah, put a torque tool in there or on the key. 01:22:11.520 --> 01:22:13.000 Yeah, you probably could do that. 01:22:13.460 --> 01:22:15.520 I'm not thinking clearly apparently. 01:22:15.780 --> 01:22:17.800 My thumb thanks you for that. 01:22:19.120 --> 01:22:22.600 This is sort of the dirty bump method, if you will. 01:22:22.600 --> 01:22:24.000 It's not that sophisticated. 01:22:24.340 --> 01:22:29.640 There is an even better bump method that the guys in Tool in the Netherlands came up with. 01:22:32.040 --> 01:22:33.300 I'm sorry, there's a question. 01:22:33.300 --> 01:22:33.860 Where was it? 01:22:33.860 --> 01:22:34.640 Left side. 01:22:37.600 --> 01:22:38.760 Not exactly. 01:22:38.760 --> 01:22:40.860 Raking, I didn't even cover raking that much. 01:22:40.860 --> 01:22:42.380 We'll talk about it in the hands-on. 01:22:42.380 --> 01:22:50.080 Raking is just beating up the pins independently, trying to just catch a bunch of shear lines at once on a crappier lock. 01:22:50.540 --> 01:22:54.860 Bump keying actually is intended to hit all the pins simultaneously. 01:23:05.220 --> 01:23:06.340 Oh, master wafer. 01:23:06.340 --> 01:23:07.440 Yeah, that can happen. 01:23:07.440 --> 01:23:10.820 The question was, we'll talk about master pinning in a little bit. 01:23:12.160 --> 01:23:21.120 Master pinning sometimes involves very small pins inserted or actually wafer shaped pins inserted into the stack with a big gap introduced like that. 01:23:21.120 --> 01:23:22.440 Can those flip and bind up? 01:23:22.440 --> 01:23:23.920 Yes, that conceivably can happen. 01:23:23.920 --> 01:23:27.160 It's not the most common thing because the gap is only there for a second. 01:23:27.300 --> 01:23:29.160 But I imagine it could happen. 01:23:29.260 --> 01:23:31.020 A little addendum to that. 01:23:31.680 --> 01:23:39.800 If that is happening, it's because the locksmith didn't follow the manufacturer's tolerances or the lock is wearing out because they have specific minimum wafer sizes so that doesn't happen. 01:23:39.880 --> 01:23:42.680 Because that used to happen a tremendous amount with people using too small of a wafer. 01:23:43.340 --> 01:23:43.900 There you go. 01:23:43.900 --> 01:23:44.620 Thank you. 01:23:45.300 --> 01:23:46.180 Shit, I got beer, man. 01:23:46.180 --> 01:23:47.020 I'm running out. 01:23:47.100 --> 01:23:47.700 Alright. 01:23:49.140 --> 01:23:57.340 Now, with respect to the I said that was like the dirty bump technique there is a really nice bump technique that's been published by the guys in Tool. 01:23:57.340 --> 01:23:59.760 It's called the Minimal Movement Bump. 01:24:00.320 --> 01:24:02.140 They actually have a white paper about it. 01:24:02.660 --> 01:24:10.960 This involves taking an existing bump key and at two different points heavily modifying this bump key even further. 01:24:11.640 --> 01:24:20.720 You can shave off probably about a quarter to a half of a millimeter from the shoulder and a half of a millimeter or more from the tip. 01:24:22.600 --> 01:24:25.560 Now this is a very, very unique modified key. 01:24:25.560 --> 01:24:31.040 If you have it in the lock you can even squeeze it a little deeper now because you've shaved the key down. 01:24:31.160 --> 01:24:37.920 And you notice that as you squeeze it in the spring pressures from the driver pins up top will actually kind of kick it back out a millimeter or so. 01:24:38.260 --> 01:24:46.900 This enables you to deliver a lot of force right where you want it very precisely without smashing across whole rows of pins. 01:24:46.900 --> 01:24:48.020 You come at this. 01:24:48.020 --> 01:24:50.460 They have a tool they call a tomahawk. 01:24:50.500 --> 01:24:52.040 I've seen them whack right at it. 01:24:52.040 --> 01:24:59.080 It comes right into beautiful force, delivered real clean and I've seen them bump really sophisticated like Barry mentioned. 01:24:59.080 --> 01:25:02.040 Remember I said the geographical weakness on that V10? 01:25:02.360 --> 01:25:07.440 He can make a bump key out of a V10 because the top part of the bidding will bump. 01:25:07.440 --> 01:25:10.940 The bottom part of the bidding on the side bar just does its job normally. 01:25:11.140 --> 01:25:12.740 He bumps his V10 that way. 01:25:12.740 --> 01:25:14.560 He's bumped multi-locks that way I've heard. 01:25:14.560 --> 01:25:20.000 I can't imagine how, but I guess the force just gets delivered because we talked about how the interactive pins work. 01:25:21.780 --> 01:25:24.120 That's a very powerful attack. 01:25:24.320 --> 01:25:26.580 It can, by the way, be bad for the lock. 01:25:26.580 --> 01:25:31.840 If you have a family heirloom or something and you're like, I'm going to play with bump keying. 01:25:32.120 --> 01:25:37.220 Don't do it if you care about the lock because I've destroyed locks doing this, especially if you do the dirty method. 01:25:37.220 --> 01:25:38.300 It'll misshape the pins. 01:25:38.300 --> 01:25:40.000 It'll really beat things up. 01:25:40.220 --> 01:25:43.920 I've had locks that just don't even work anymore because I've bumped them to death. 01:25:48.600 --> 01:25:50.100 We can cover that a little. 01:25:50.100 --> 01:25:53.880 The question was, doesn't this leave clear indications that this has happened? 01:25:53.880 --> 01:25:54.960 There's forensic evidence. 01:25:54.960 --> 01:25:56.280 We can talk about that in a bit. 01:25:56.280 --> 01:25:57.420 I've got to keep moving through though. 01:25:57.420 --> 01:25:58.560 We've got a lot of good stuff. 01:26:00.020 --> 01:26:01.100 Wait, yes, question. 01:26:06.680 --> 01:26:08.660 What keeps the key pins? 01:26:10.280 --> 01:26:15.340 Well, they can't fall down anymore because they're in the keyway as far down as they go. 01:26:15.500 --> 01:26:19.220 And they're not going to jump up because we're transferring physical force through them. 01:26:19.220 --> 01:26:21.940 So they're just going to sit right where they are. 01:26:22.120 --> 01:26:23.880 They're not going to go up, they're not going to go down. 01:26:24.020 --> 01:26:25.340 They have nowhere to go. 01:26:25.860 --> 01:26:28.520 There's spring tension behind them so they're not staying suspended. 01:26:28.520 --> 01:26:32.440 You have a half of a split second where they're up there and you're just catching that right moment. 01:26:32.440 --> 01:26:33.900 They're not staying up there permanently. 01:26:34.080 --> 01:26:37.200 You're just hitting it and they stay there for a split second like throwing a ball in the air. 01:26:37.540 --> 01:26:39.820 And while it's upright, just at the right height is when you grab it. 01:26:40.200 --> 01:26:40.760 Alright. 01:26:42.220 --> 01:26:43.840 Let me cut you off for half a second. 01:26:43.840 --> 01:26:46.580 General disclaimer, I don't know if you did this, I'm sorry I was registering. 01:26:47.480 --> 01:26:49.040 You mentioned you can break locks. 01:26:50.120 --> 01:26:53.000 Don't practice on your front door for a number of reasons. 01:26:53.000 --> 01:26:58.100 One, because you may break the lock, but more importantly because your neighbors will call the cops because they don't know who you are. 01:26:58.720 --> 01:27:02.380 If you're going to practice on any door, try a back door or whatnot, but still you're going to get your ass locked out of your house. 01:27:02.380 --> 01:27:04.500 So just go buy a $10 lock from Home Depot to practice. 01:27:05.660 --> 01:27:06.740 Very, very good point. 01:27:07.480 --> 01:27:09.160 So yes, this can be bad for the lock. 01:27:09.160 --> 01:27:11.400 I've destroyed locks doing this. 01:27:11.420 --> 01:27:16.700 Some of my locks, I've had to try to lubricate them to open them now because they're just broken and about lubrication. 01:27:16.700 --> 01:27:18.740 The question for a Red Bull... 01:27:21.520 --> 01:27:26.400 When, if ever, do you use WD-40 in a lock and why or why not? 01:27:26.760 --> 01:27:28.060 Whoa, that was a lot of... 01:27:28.060 --> 01:27:30.980 I think it was grayish blue shirt here. 01:27:34.140 --> 01:27:35.180 Half right answer. 01:27:35.180 --> 01:27:36.260 Get you a lighter. 01:27:36.800 --> 01:27:38.040 Come on up for a lighter. 01:27:52.870 --> 01:27:54.470 Oh, well it's a little bit... 01:27:54.470 --> 01:27:59.810 You're kind of on the right track, but I'm looking for a solid answer on when, if ever, you can use WD. 01:27:59.810 --> 01:28:01.490 I've got a guy down here with the glasses. 01:28:03.050 --> 01:28:07.410 Well, his answer was never, and I'm saying that's not a completely accurate answer. 01:28:12.270 --> 01:28:14.570 Well, you're all right around... 01:28:14.570 --> 01:28:16.630 Basically, a lot of people are hitting this point. 01:28:16.630 --> 01:28:17.950 The main point I wanted to make... 01:28:17.950 --> 01:28:18.750 Hang on here. 01:28:19.190 --> 01:28:20.070 My guy's in the front. 01:28:20.070 --> 01:28:22.230 Just throw some lighter at these people with their hands up. 01:28:22.310 --> 01:28:23.770 Because everyone kind of has it. 01:28:23.950 --> 01:28:24.650 Keep your hands up. 01:28:24.650 --> 01:28:25.570 I know who you are. 01:28:26.170 --> 01:28:28.170 That, hey, extra hands just went up. 01:28:30.210 --> 01:28:34.310 The point I wanted to make is WD-40 is not good... 01:28:34.310 --> 01:28:35.870 You can... You got them? 01:28:35.870 --> 01:28:36.510 These guys? 01:28:36.510 --> 01:28:37.630 All right. 01:28:37.790 --> 01:28:39.450 Start ripping with people's heads, dude. 01:28:40.550 --> 01:28:42.150 WD-40... We got a guy... 01:28:47.540 --> 01:28:48.120 Yes. 01:28:48.180 --> 01:28:49.360 WD-40... 01:28:49.360 --> 01:28:50.580 Did you get one? 01:28:51.480 --> 01:28:52.520 Was that a question? 01:28:59.510 --> 01:29:00.470 Very, very good. 01:29:00.470 --> 01:29:01.770 He's got the full... You actually... 01:29:01.770 --> 01:29:03.610 You get the Red Bull. 01:29:07.350 --> 01:29:07.850 Yes. 01:29:07.850 --> 01:29:08.110 All right. 01:29:08.450 --> 01:29:09.510 We got to keep moving. 01:29:09.510 --> 01:29:10.090 Here's the... 01:29:10.090 --> 01:29:10.610 Oh, man. 01:29:10.610 --> 01:29:12.050 We're really dying on time. 01:29:12.070 --> 01:29:14.250 The deal is... Well, that's cool. 01:29:14.250 --> 01:29:15.750 But we got a lot to cover. 01:29:15.750 --> 01:29:17.170 I added a lot of shit. 01:29:18.850 --> 01:29:19.810 WD-40... 01:29:19.810 --> 01:29:24.590 Anybody who's in the service, especially the Navy, maybe you can tell me, what does WD-40 stand for? 01:29:25.250 --> 01:29:27.590 Water displacement is exactly right. 01:29:27.590 --> 01:29:43.170 Water displacer 40 was a formula designed to seep into maritime situations, to seep into all the cracks, to dry out in there, to actually make this little waxy buildup to keep water out of machinery so it didn't rust and corrode when it was in there. 01:29:43.170 --> 01:29:45.590 It was not meant as a lubricant. 01:29:45.590 --> 01:29:47.810 It's kind of the antithesis of a lubricant. 01:29:47.810 --> 01:29:51.050 Yes, it's greasy when it goes in, but it doesn't stay that way. 01:29:51.450 --> 01:29:54.670 There's essentially three kinds of lubricants out there. 01:29:54.670 --> 01:29:58.810 There's wet lubricant, dry lubricant, and drying lubricant. 01:29:58.810 --> 01:30:03.910 And everyone who's tuned in on the APTV system just right now, they're saying, what the hell talk is this? 01:30:03.910 --> 01:30:04.370 Looking at the... 01:30:05.950 --> 01:30:08.070 Did they move the schedule around? 01:30:10.810 --> 01:30:13.570 Different situations call for different products. 01:30:13.570 --> 01:30:23.770 If you have any precision mechanism, like, for instance, locks, you want to use exclusively a wet or oil-based lubricant, something that is going to go in wet and stay wet. 01:30:23.770 --> 01:30:29.150 I use gun oil on most of my really, really high-end locks because it'll not foul the thing up. 01:30:30.350 --> 01:30:36.710 Dirt and fouling can get into oil, and it can gum things up if you live in a really harsh environment. 01:30:36.710 --> 01:30:47.970 If you have, let's say, a lock out in the desert somewhere, Las Vegas , any locals, maybe you want to use graphite powder in a lock like that because it'll go in dry and stay dry. 01:30:48.550 --> 01:30:51.410 It'll help, you know, it won't get too fouled up and gummed up. 01:30:52.010 --> 01:30:53.210 That's right, it won't freeze. 01:30:53.270 --> 01:30:57.410 But just know that WD-40 will attract dirt and fouling. 01:30:57.410 --> 01:30:58.490 It'll trap it up. 01:30:58.490 --> 01:31:06.970 The only time, by the way, the answer, the full answer I was looking for, the only time you use WD-40 is if the lock is jammed and you don't care about the lock. 01:31:07.050 --> 01:31:13.030 If, you know, you've gone over to your aunt's house for Christmas and she says, oh, I think that's the trees out in the shed, the decorations. 01:31:13.030 --> 01:31:17.670 And you go out there and it's a lock that someone hasn't opened since 1974 and it's rusted to hell. 01:31:17.770 --> 01:31:26.650 Yeah, you can WD-40 it or you can soak it in kerosene and maybe it'll open and then you throw the lock away because it's not, that's not good for the future health of the lock. 01:31:27.810 --> 01:31:28.530 Yes? 01:31:31.750 --> 01:31:33.130 LPS makes a good product? 01:31:33.130 --> 01:31:34.050 What is LPS? 01:31:46.290 --> 01:31:47.010 Okay. 01:31:48.030 --> 01:31:53.430 So yeah, he meant, the gentleman mentions industrial lubricants, high-end industrial lubricants are good. 01:31:54.110 --> 01:31:58.050 Yeah, Google for LPS or check it out, Molly Coat, those are also good. 01:31:59.290 --> 01:32:02.950 Let's talk about something that was referenced in the last talk. 01:32:04.130 --> 01:32:05.270 Firearm locks. 01:32:05.270 --> 01:32:09.610 How many, we got a lot of libertarian type people here at DEF CON, how many people are gun owners? 01:32:10.010 --> 01:32:11.710 You don't have to raise your hands if you don't want to. 01:32:12.150 --> 01:32:14.990 How many people lock your guns in some fashion? 01:32:16.370 --> 01:32:21.050 What I'd like to see, maybe you don't have kids in the house, you don't have kids in your house, then you lock your door. 01:32:21.050 --> 01:32:22.330 Do super soakers count? 01:32:24.750 --> 01:32:38.030 We're going to talk about something that's very serious to me right now, just because it's a very important issue that people understand, the severe weaknesses of some locks, what they're designed to do, and what they're not designed to do. 01:32:38.550 --> 01:32:44.910 I would like a volunteer, I know we have people on the goon squad, I know in fact Vairosa, you have time in the service. 01:32:45.370 --> 01:32:46.650 Stand up for a second, man. 01:32:46.650 --> 01:32:47.750 I'm going to use Lou. 01:32:48.130 --> 01:32:49.750 Everyone, this is Vairosa. 01:32:51.050 --> 01:32:52.690 Come on, stand up for the guy. 01:32:56.170 --> 01:32:59.990 Vairosa has served, so he's going to be our authority for today. 01:32:59.990 --> 01:33:12.270 I'd like, and this is for everyone's comfort, he's going to inspect a stage prop that I have that looks like a weapon, but we're going to take him at his authority that it is not a functioning firearm. 01:33:12.390 --> 01:33:15.090 I want everyone to know this, I want everyone to be very... 01:33:15.090 --> 01:33:16.930 Yeah, you haven't anything to drink, have you? 01:33:17.810 --> 01:33:22.630 Is everyone comfortable with his authority as opposed to you physically inspecting it yourself? 01:33:22.630 --> 01:33:28.710 If not, we can actually have someone else who is even more well known, if you'd like a priest or someone to come up. 01:33:28.710 --> 01:33:30.210 But is everyone okay with Vairosa? 01:33:31.010 --> 01:33:31.690 Alright. 01:33:35.190 --> 01:33:38.110 Yeah, it really pisses off the TSA when you put that in your carry-on, by the way. 01:33:38.150 --> 01:33:39.310 Yeah, FedEx. 01:33:40.270 --> 01:33:44.510 So yeah, it should be a filed down firing pin, the barrel's solid. 01:33:45.030 --> 01:33:46.690 Solid barrel will pretty much do the job. 01:33:46.690 --> 01:33:47.250 Yeah. 01:33:48.450 --> 01:33:50.990 Would you care to certify that this is a non-firing weapon? 01:33:51.490 --> 01:33:52.930 I didn't see that it's non-firing. 01:33:52.930 --> 01:33:55.210 There's nothing in it. 01:33:55.250 --> 01:33:57.250 It's completely cored up. 01:33:59.310 --> 01:34:00.590 It's a solid barrel. 01:34:05.000 --> 01:34:06.020 I don't know if you can see... 01:34:06.680 --> 01:34:07.200 Dude , don't worry. 01:34:07.280 --> 01:34:07.740 Alright. 01:34:07.740 --> 01:34:09.860 Well, I'm just very serious about this. 01:34:11.140 --> 01:34:11.940 Thank you. 01:34:11.940 --> 01:34:12.580 Thank you. 01:34:25.500 --> 01:34:29.900 How many people have ever used a trigger lock that looks like this? 01:34:31.120 --> 01:34:33.560 I'm very pleased that not too many people have. 01:34:33.960 --> 01:34:44.380 When I was... God, I want to say I was 12 or 13, I got an air gun for my birthday, and a lock like this is what was installed on it. 01:34:44.380 --> 01:34:50.220 I'm going to guess I was probably about 14 when I figured out how easy it was to bust this up. 01:34:50.860 --> 01:34:54.160 And my parents were very proud that I actually was just so proud of the discovery. 01:34:54.160 --> 01:34:55.200 I went and showed them right away. 01:34:55.200 --> 01:34:56.860 They're like, wow, that's so neat. 01:34:56.960 --> 01:34:58.560 This goes in our closet now. 01:35:07.900 --> 01:35:13.640 This is your typical trigger lock. 01:35:15.280 --> 01:35:21.560 Most vendors of trigger locks, there are two popular designs of trigger locks. 01:35:21.580 --> 01:35:24.560 There are bad, and there's colossally bad. 01:35:25.340 --> 01:35:28.240 Pretty much everyone explores these two designs of locks. 01:35:29.200 --> 01:35:31.680 This is just in the bad category. 01:35:33.600 --> 01:35:34.580 Can everyone see? 01:35:34.580 --> 01:35:35.340 I feel bad. 01:35:35.340 --> 01:35:36.980 This camera is so awful. 01:35:36.980 --> 01:35:37.640 It's not bad. 01:35:37.640 --> 01:35:38.060 No, you can see pretty good. 01:35:38.060 --> 01:35:39.420 Alright, we'll do what we can. 01:35:39.680 --> 01:35:40.500 So this is on. 01:35:40.500 --> 01:35:42.620 It's installed the way it should go. 01:35:43.320 --> 01:35:44.740 I'm going to take this tool 01:35:48.000 --> 01:35:50.080 and I can't really see. 01:35:52.660 --> 01:35:53.260 I'm going to have to... 01:35:53.260 --> 01:35:57.500 I've got to move my camera so I can see what I'm doing a little better and get my hands in it. 01:36:01.460 --> 01:36:03.520 It's upside down, but you guys can live with that. 01:36:06.520 --> 01:36:07.600 Oh, am I out of frame? 01:36:09.820 --> 01:36:12.880 For anyone who thinks he's out of frame, he's shoving a big-ass piece of metal in there. 01:36:18.780 --> 01:36:20.700 Yeah, we don't have to applaud on that one. 01:36:23.240 --> 01:36:25.480 This is a piece of wire, people. 01:36:25.520 --> 01:36:27.860 This is a piece of fish snake. 01:36:28.340 --> 01:36:29.300 There's a question? 01:36:33.280 --> 01:36:36.760 I wouldn't recommend trying it on a loaded weapon, that's for sure. 01:36:40.680 --> 01:36:44.160 Right, you're never supposed to lock a loaded weapon, people are pointing out to me. 01:36:44.160 --> 01:36:46.000 Side note for you though, on that specific weapon, no. 01:36:46.000 --> 01:36:46.920 On others, maybe. 01:36:48.020 --> 01:36:52.240 Why in the hell is this possible? 01:36:54.200 --> 01:36:57.040 Once again, the golden rule, the... 01:36:57.040 --> 01:36:58.340 I'm sorry. 01:36:59.340 --> 01:37:02.800 Yeah, keep shouting at me if I'm out of frame, because I want you guys to see everything. 01:37:03.000 --> 01:37:11.180 The golden rule of, you know, the triumph and peril of our capitalistic system is that the marketplace will regulate itself. 01:37:12.160 --> 01:37:15.360 One of the marketplace forces is convenience, users' convenience. 01:37:15.740 --> 01:37:16.960 How does this lock work? 01:37:16.960 --> 01:37:24.440 Well, this lock just has a pillar down the middle, as you can see, and a bar that rotates. 01:37:24.440 --> 01:37:24.890 Now this bar... 01:37:25.520 --> 01:37:27.940 I wonder if I could focus this a little more. 01:37:29.720 --> 01:37:31.160 Nope, that's worse. 01:37:32.780 --> 01:37:33.780 I'll take my word for it. 01:37:33.780 --> 01:37:36.980 This bar, you can kind of see, has little teeth, notched teeth. 01:37:37.720 --> 01:37:41.920 Now these teeth are exposed, and now these teeth are hidden. 01:37:43.200 --> 01:37:54.320 Those teeth completely engage with teeth that you can barely see down a steel plate, down this barrel here. 01:37:56.040 --> 01:38:00.560 This steel plate is spring-loaded. 01:38:04.400 --> 01:38:05.420 Why is that? 01:38:05.420 --> 01:38:06.900 The man points it out. 01:38:06.900 --> 01:38:15.400 So that if I want to lock this, and I don't have the key in it, I can just slide it together. 01:38:16.340 --> 01:38:25.600 Do you know how fucking ridiculously simple it would be to make this steel plate solid? 01:38:25.840 --> 01:38:29.680 Just make the bastard part of... you wouldn't even need the spring. 01:38:30.820 --> 01:38:34.460 Just, you know, oh, I need to turn my key to lock it and secure it. 01:38:34.460 --> 01:38:35.620 I'm out of frame again. 01:38:35.760 --> 01:38:38.940 I can't fathom why it was designed this way. 01:38:39.040 --> 01:38:40.260 But it was. 01:38:41.280 --> 01:38:42.620 This is not... 01:38:43.540 --> 01:38:44.480 This is nothing. 01:38:44.480 --> 01:38:45.800 This is just a joke. 01:38:46.140 --> 01:38:47.460 I made this in no time. 01:38:47.460 --> 01:38:50.100 I made this type of pick when I was 12. 01:38:50.420 --> 01:38:53.340 They mentioned in the last talk, this information is out there. 01:38:53.340 --> 01:38:54.680 How many of you have ever read about this? 01:38:54.680 --> 01:38:56.200 How many of you have ever heard about this? 01:38:56.200 --> 01:38:59.420 How many of you still use a lock, you know, a gun lock like this? 01:38:59.940 --> 01:39:03.380 Nobody talks about this, because the information just doesn't get out. 01:39:03.880 --> 01:39:10.820 I hope that if at least one of you goes home and tells somebody, maybe someone will stop using one of these, because it's really bad. 01:39:10.820 --> 01:39:12.640 It's just a really bad design. 01:39:16.930 --> 01:39:19.170 In the colossal... I'm sorry, we had a hand. 01:39:19.570 --> 01:39:20.310 All right. 01:39:23.450 --> 01:39:25.650 Who manufactures the blue lock was a question. 01:39:25.650 --> 01:39:29.830 They are somebody I've beat up enough on on this talk already. 01:39:31.010 --> 01:39:35.810 They're kind of litigious and I'm not going to say who makes it. 01:39:35.850 --> 01:39:37.810 Go to any gun shop in America. 01:39:37.810 --> 01:39:38.810 They're going to have a whole rack of them. 01:39:38.810 --> 01:39:40.070 You can see who makes it. 01:39:41.910 --> 01:39:43.130 Somebody said it. 01:39:44.730 --> 01:39:50.270 These are the, just included for your edification, these are the colossally bad category. 01:39:51.510 --> 01:39:53.170 What the hell is that? 01:39:54.050 --> 01:39:55.990 I don't even know what this is. 01:39:56.430 --> 01:39:58.210 But it's not a freaking lock. 01:39:58.290 --> 01:40:02.550 You can beat this with a paper clip that you have to pop a CD out of a jam drive. 01:40:05.400 --> 01:40:07.320 And we saw this is a slide lock. 01:40:07.320 --> 01:40:11.320 This is what I was showing you earlier when I was playing with tubular pins. 01:40:11.500 --> 01:40:13.420 A slide lock is a very nice idea. 01:40:13.420 --> 01:40:19.220 It's a little more secure in that it locks the weapon completely out of battery, so it can't be engaged, fired, anything. 01:40:19.420 --> 01:40:21.240 But, you know, I showed you this one. 01:40:21.240 --> 01:40:25.680 Great concept, but it's a really shitty tubular lock that's employing the mechanism. 01:40:25.920 --> 01:40:29.740 Put a better lock on the end and maybe put a Medeco on the end of that and you might have a pretty decent lock. 01:40:32.160 --> 01:40:33.920 Some people just use cable. 01:40:33.920 --> 01:40:35.860 You can secure firearms with cable. 01:40:35.980 --> 01:40:38.200 This is a very secure solution. 01:40:38.440 --> 01:40:41.640 Make sure you use a coated cable so it doesn't rip up the innards of your gun. 01:40:42.020 --> 01:40:49.340 Also, be aware that the majority of cable you're going to buy like this, this is going to be an Astacular 2000 series lock somehow. 01:40:49.660 --> 01:40:51.640 They just come really bad. 01:40:51.640 --> 01:40:52.680 I don't know why. 01:40:53.060 --> 01:40:54.800 And let's face it, this is not the best solution. 01:40:54.800 --> 01:40:56.600 It's a very inelegant solution. 01:40:57.680 --> 01:41:00.740 In general, why do I have this section in the talk now? 01:41:01.700 --> 01:41:02.060 Everyone... 01:41:02.060 --> 01:41:07.360 I think people here tend to be a little more clueful than the general public, so most of you should know this already. 01:41:07.380 --> 01:41:10.060 These are not security devices. 01:41:10.280 --> 01:41:14.280 These are persuading or dissuading devices. 01:41:14.280 --> 01:41:19.420 These are designed to prevent very little children from fouling around. 01:41:19.420 --> 01:41:20.960 Oh, what's under daddy's drawer? 01:41:20.960 --> 01:41:22.460 Here, they'll look at this. 01:41:22.460 --> 01:41:23.540 These are designed to... 01:41:23.540 --> 01:41:26.540 These are locks made by children for children, basically. 01:41:28.100 --> 01:41:30.880 This will not thwart criminal behavior. 01:41:30.880 --> 01:41:34.260 This will not thwart a curious teenager. 01:41:35.100 --> 01:41:45.720 Many people, I don't always get agreement with this, but I'm betting this crowd will understand that if you have kids and you have guns, you show them what the hell they are when they're very young. 01:41:45.720 --> 01:41:51.260 You teach them to respect them, you teach them not to play with them, and then you lock them the hell away from them. 01:42:00.160 --> 01:42:04.320 But people who just want to, like, no, don't tell them anything, that's not the best solution. 01:42:04.900 --> 01:42:05.860 What's up? 01:42:07.440 --> 01:42:08.900 Oh, sorry, question. 01:42:15.060 --> 01:42:15.780 That's a valid... 01:42:15.780 --> 01:42:22.120 If you have a very easily field-strippable weapon, just strip it out, take the firing pin out, put that in a secure place. 01:42:23.680 --> 01:42:25.660 Well, the man makes a point down here. 01:42:25.660 --> 01:42:28.180 Someone else could acquire another one and put it back in. 01:42:28.240 --> 01:42:33.080 So, you know, you guys are all smart enough, you can come up with solutions, but just keep this on your radar. 01:42:33.080 --> 01:42:35.280 One question and then we gotta keep it on... 01:42:41.610 --> 01:42:42.330 Yes. 01:42:45.190 --> 01:42:47.690 Those are the under desk type models, and yeah. 01:42:49.010 --> 01:42:53.010 Yeah, he mentioned the Colt Corporation, and I do love their weapons. 01:42:53.070 --> 01:43:04.530 They make a very nice box that it just has, it's almost like a hand pad, and you can feel the buttons, and if you know the order, you program the order in, you can just feel it pop, pop, pop, pop, pop, and then you can, you know, open it up. 01:43:04.710 --> 01:43:10.810 Any type of safe, or any type of box that you put a gun in is much better than just throwing a lock on the gun. 01:43:14.120 --> 01:43:18.120 Yeah, there's a lot of better gun locks out there that we can talk about some more. 01:43:18.480 --> 01:43:23.320 We're good, we still have like 45 minutes because we're rolling into the next half hour, so we can, we're still doing alright. 01:43:24.500 --> 01:43:26.300 Quick ones on handcuffs. 01:43:26.680 --> 01:43:30.000 We're, you know, more for the law enforcement crowd, I guess, guns to handcuffs. 01:43:30.720 --> 01:43:35.200 Anybody who doesn't know how handcuffs work, this is gonna be a real real brief overview. 01:43:35.640 --> 01:43:37.820 Inside of a handcuff looks something like this. 01:43:37.820 --> 01:43:44.380 You have a little ratcheting arm, and this paw that spins around has teeth on it that the arm engages. 01:43:45.180 --> 01:43:47.780 It's why you can spin the paw one way and not the other. 01:43:49.060 --> 01:43:56.340 When you stick a key in the lock, and you turn that key, it just lifts up the arm. 01:43:56.340 --> 01:43:58.860 That's what the inside of a handcuff looks like. 01:43:59.300 --> 01:44:03.760 You can see how it's, you can jam almost anything in a handcuff and just try to, you know, flip the thing. 01:44:03.760 --> 01:44:07.080 And besides, a handcuff key is a dollar, so it's not that hard to do. 01:44:07.080 --> 01:44:10.520 You can shim hand, you can do a whole lot with handcuffs that are kind of outside of the scope of this. 01:44:10.520 --> 01:44:14.060 We can, I don't have any to play with, so if anybody else does, we can play with them later. 01:44:17.600 --> 01:44:17.880 Um... 01:44:18.560 --> 01:44:21.220 That could have been interpreted differently, I guess. 01:44:24.200 --> 01:44:32.480 Could anyone tell me for a Red Bull... I gotta clear some of this out of the way. 01:44:35.520 --> 01:44:39.660 What is the little pin for on the back of a hand? 01:44:39.660 --> 01:44:41.140 I saw a hand right here. 01:44:47.450 --> 01:44:48.490 Everything alright? 01:44:49.070 --> 01:44:50.390 Hang on, yeah, he got it. 01:44:50.390 --> 01:44:52.790 The answer is, what is the little pin for? 01:44:52.790 --> 01:44:56.130 It is a double lock mechanism on a handcuff. 01:44:57.150 --> 01:45:08.930 The little hole that's on the back of a handcuff, that most people don't realize it's there for a reason, if you stick the pin in there on the back of a key, it'll actually put a bar in that prevents the pawl from I'm sorry, the ratchet from moving at all. 01:45:08.930 --> 01:45:12.230 So it can't get any tighter, it can't get any looser, you can't shim it. 01:45:12.430 --> 01:45:15.750 To open it, you see it's actually a two-step process to open it. 01:45:21.320 --> 01:45:23.080 Yeah, yeah, double lock. 01:45:23.080 --> 01:45:30.900 In fact, anybody who's ever been in custody, maybe in a street protest or something, and they over-tighten you on purpose, but no, I don't have anything negative to say about that. 01:45:31.800 --> 01:45:35.780 They're supposed to double lock you all the time, because it's actually for your own safety. 01:45:35.780 --> 01:45:40.560 So the cuffs, if you wriggle or you sit in the back of the car, they don't get tighter on you when you're in them. 01:45:40.820 --> 01:45:46.760 Most officers don't do that, and it's, you know, I assume you should. 01:45:46.760 --> 01:45:47.700 Does anyone here a cop? 01:45:47.700 --> 01:45:48.440 Do you do that? 01:45:48.540 --> 01:45:50.980 Anybody in here who's a law enforcement officer do a double lock? 01:45:52.820 --> 01:45:55.460 So we spot the fed. 01:45:59.380 --> 01:46:00.400 Yeah, they should. 01:46:00.580 --> 01:46:03.440 Frankly, it's funny, but that's true. 01:46:03.440 --> 01:46:06.660 Most of my friends who go to protests will request that. 01:46:06.660 --> 01:46:09.880 They'll say, you know, I request, please make sure you double lock this, sir. 01:46:10.100 --> 01:46:17.740 And so they don't get, because if you've ever friggin' been cuffed at a protest, you're going to be thrown in a bus somewhere for like six hours, and they're going to take two more hours to process you. 01:46:17.740 --> 01:46:21.060 If you're turning blue in the hands, it sucks really bad. 01:46:23.780 --> 01:46:24.460 Yes. 01:46:25.660 --> 01:46:26.620 Yeah. 01:46:34.750 --> 01:46:40.750 Yes, the gentleman makes the point that cooperating tends to, you'll be treated a lot better when they're locking you up. 01:46:43.710 --> 01:46:45.430 Oh, we're going to get a demo? 01:46:45.510 --> 01:46:46.770 All right. 01:46:56.710 --> 01:47:01.610 Once again, Agent X, everybody, let's thank him for doing this. 01:47:49.080 --> 01:47:50.420 Have you done this? 01:47:51.120 --> 01:47:52.640 Never slammed them against a table. 01:47:55.950 --> 01:47:56.830 Yeah! 01:48:09.420 --> 01:48:16.040 The trick is that, like you talked about all the mechanisms inside, you've got to whack this, and it'll just slide. 01:48:16.820 --> 01:48:20.340 And most of the cops are really good about keeping their kit well-oiled. 01:48:20.660 --> 01:48:22.420 There's even special handcuff oils. 01:48:22.620 --> 01:48:29.960 So, you have to whack it somewhere, which you'll see magicians do, is they'll put like a little metal piece of something in their pants, and they'll whack it against that. 01:48:30.660 --> 01:48:33.200 But usually you can find something to do it against. 01:48:33.260 --> 01:48:35.360 I find the hardest part is getting them in front. 01:48:35.360 --> 01:48:36.500 It'll kill you. 01:48:36.920 --> 01:48:38.120 That's really dangerous. 01:48:38.120 --> 01:48:45.160 I've gotten myself, by myself, in my apartment, with these, at the end of my seat. 01:48:45.440 --> 01:48:47.240 It's incredibly painful. 01:48:48.320 --> 01:48:49.920 Why were you wearing a thong? 01:48:49.920 --> 01:48:51.140 I wasn't wearing a thong. 01:48:51.140 --> 01:48:53.560 Have you taken that off? 01:49:07.880 --> 01:49:08.600 Yeah, yeah. 01:49:17.420 --> 01:49:20.700 He's showing whereabouts he whacked it, according to the request. 01:49:21.020 --> 01:49:23.040 Here's the handcuffs. 01:49:24.700 --> 01:49:27.240 And this is the pin they set right there. 01:49:27.380 --> 01:49:28.980 You can see it right there. 01:49:29.520 --> 01:49:32.360 So, what I'm doing is unsetting the pin. 01:49:32.360 --> 01:49:35.820 They have to turn the key both ways, so what you do is just go, whack! 01:49:36.040 --> 01:49:39.620 And it comes right down, and then you can shim it. 01:49:39.620 --> 01:49:42.180 Don't shim it too much, or it's really painful. 01:49:43.580 --> 01:49:47.100 If you do that while in custody, you're fucked, by the way, unless you get away. 01:49:47.740 --> 01:49:48.980 Don't fuck around. 01:49:49.260 --> 01:49:55.740 We're having fun talking about a lot of this, but more than anything, don't be that cutesy guy who's getting out of the squad car at the station. 01:50:00.820 --> 01:50:02.040 Yeah, Mr. 01:50:02.040 --> 01:50:03.060 Face, meet Mr. 01:50:03.080 --> 01:50:03.800 Pavement. 01:50:04.980 --> 01:50:07.220 It's funny if your friends are cops to fuck with them, though. 01:50:07.220 --> 01:50:08.000 It really is. 01:50:08.000 --> 01:50:14.440 By the way, if you show this to the cops, it freaks them out. 01:50:14.760 --> 01:50:19.020 The main reason I learned this is not because I ever have trouble with the law. 01:50:19.080 --> 01:50:20.820 It's because this is really a mental thing. 01:50:20.820 --> 01:50:22.600 People are like, I can't get out of handcuffs. 01:50:22.600 --> 01:50:23.580 It's impossible. 01:50:23.860 --> 01:50:25.040 I can show you how to do it. 01:50:25.040 --> 01:50:26.200 It's not that hard. 01:50:26.940 --> 01:50:28.720 It's kind of a gateless barrier thing. 01:50:29.040 --> 01:50:29.800 Give it a try. 01:50:36.320 --> 01:50:38.720 Come to the THF talk at 4 in the tent. 01:50:38.720 --> 01:50:39.560 We need your money. 01:50:40.820 --> 01:50:41.980 And we're going to have a whole... 01:50:41.980 --> 01:50:45.960 Once we wrap this up, we're going to move it into the contest area where the lockpick contest is. 01:50:45.960 --> 01:50:47.860 We're going to do a whole hands-on session. 01:50:48.020 --> 01:50:49.620 I'll take as much time as you guys want. 01:50:49.620 --> 01:50:51.480 I'm going to have a lot of kits you can play with. 01:50:51.760 --> 01:50:54.540 I ask that you give me $20-$25. 01:50:54.540 --> 01:50:56.680 And if you return it, you can have the $25. 01:50:56.720 --> 01:50:58.280 But I don't want them to walk away. 01:50:58.460 --> 01:50:59.280 A lot of locks. 01:50:59.280 --> 01:51:00.580 We're going to have a good time. 01:51:00.580 --> 01:51:02.760 So come on in if we run out of time here for questions. 01:51:02.780 --> 01:51:03.840 We'll do it in there. 01:51:06.700 --> 01:51:08.560 Can you carry a lockpick in your check bag? 01:51:08.560 --> 01:51:10.240 I'll talk about that in the legal section. 01:51:10.480 --> 01:51:11.700 Do you have a legal section? 01:51:11.740 --> 01:51:13.060 Dude, you really did add a lot of shit. 01:51:14.020 --> 01:51:15.780 Alright, we've really got to fly through. 01:51:15.780 --> 01:51:17.180 We've got about a half hour left. 01:51:17.220 --> 01:51:18.960 And I have like 150 slides. 01:51:18.960 --> 01:51:20.600 So we're maybe two-thirds of the way through. 01:51:22.460 --> 01:51:23.380 Really quick. 01:51:23.380 --> 01:51:24.340 Wafer locks. 01:51:24.540 --> 01:51:26.280 Just going to cover what they are. 01:51:26.520 --> 01:51:27.880 They're not that sophisticated. 01:51:27.900 --> 01:51:29.040 Oh, what happened? 01:51:29.440 --> 01:51:31.780 Is there another cooler talk than me? 01:51:36.350 --> 01:51:39.110 Imagine when we do the topless section for all you guys leaving. 01:51:39.250 --> 01:51:41.870 Alright, let's just blow through a lot of this now. 01:51:42.010 --> 01:51:42.990 Wafer locks. 01:51:42.990 --> 01:51:49.110 If you look at a lock, notice how this lock, there's no upper mechanism up here. 01:51:49.170 --> 01:51:51.270 This lock just kind of cuts off right here. 01:51:51.270 --> 01:51:54.570 There's no space where a pin stack could be hiding. 01:51:54.570 --> 01:51:56.950 There's no room up here for springs and pins. 01:51:57.050 --> 01:51:58.990 This is an entirely different type of mechanism. 01:51:58.990 --> 01:52:00.470 It's called a wafer mechanism. 01:52:00.570 --> 01:52:03.290 They're popular in very compact places. 01:52:03.290 --> 01:52:07.510 A lot of filing cabinets, a lot of display racks and things use wafer locks. 01:52:07.510 --> 01:52:09.870 Also automobiles, but they're more sophisticated. 01:52:11.230 --> 01:52:12.250 Not alone. 01:52:12.510 --> 01:52:19.070 If you look at a wafer from the front, and you cut on into it, this is the inside of a wafer lock, essentially. 01:52:19.070 --> 01:52:21.590 And there's stacks of these wafers in a row. 01:52:21.950 --> 01:52:24.850 The wafers have to be raised to the right height, and they'll clear. 01:52:24.850 --> 01:52:26.250 It's not that difficult. 01:52:26.950 --> 01:52:29.630 There are complex wafers that are double-sided. 01:52:29.630 --> 01:52:31.690 You can see if you raise them too high, they won't go. 01:52:31.690 --> 01:52:32.990 Too low, they won't go. 01:52:33.110 --> 01:52:37.810 And all they'll have to do is just have this rectangle cut in different places on the wafer. 01:52:37.810 --> 01:52:39.570 So that's how the key cutting works. 01:52:39.970 --> 01:52:42.850 Wafers are a really interesting sort of mix. 01:52:43.050 --> 01:52:49.390 They're very unsophisticated, but they don't lend themselves very well to most picking techniques. 01:52:49.730 --> 01:52:52.090 You can kind of pin-by-pin pick them, right? 01:52:52.090 --> 01:52:54.570 But most people just use what's called jigglers. 01:52:54.650 --> 01:52:57.990 And you just jam it in, bang it all around, and hope for the best. 01:52:57.990 --> 01:53:02.110 And you get about as good a result as you would get if you just tried to individually pick it. 01:53:05.290 --> 01:53:10.970 Yeah, raking, jiggling, the unsophisticated bang attack ends up a lot better. 01:53:11.790 --> 01:53:13.390 Alright, still moving along. 01:53:13.590 --> 01:53:15.050 Rotating disc locks. 01:53:15.050 --> 01:53:17.750 Not going to talk too much about these, because I can't pick them. 01:53:17.750 --> 01:53:18.770 I don't even own some. 01:53:18.770 --> 01:53:19.670 Anything you want to say? 01:53:19.670 --> 01:53:21.710 Or should we just show Barry and you doing a video? 01:53:22.470 --> 01:53:23.170 Show a video? 01:53:23.170 --> 01:53:24.290 I was drunk that day. 01:53:24.490 --> 01:53:27.210 If you have any questions... 01:53:27.210 --> 01:53:29.390 There's this brand called Abus. 01:53:29.790 --> 01:53:31.370 As a side note... 01:53:31.370 --> 01:53:33.270 Yeah, so this is the fucking video of me on the other side. 01:53:33.270 --> 01:53:34.230 He didn't tell me. 01:53:36.950 --> 01:53:39.810 Schedule, if you look at your schedule, there were two talks today. 01:53:39.810 --> 01:53:43.490 First is two hour intro, then another hour on high security stuff specifically. 01:53:43.490 --> 01:53:47.470 Due to some scheduling conflicts, the high security stuff was cut down to about a half an hour. 01:53:47.490 --> 01:53:49.110 And Paul Graham will be coming and giving a speech. 01:53:49.110 --> 01:53:50.890 And we'll go through all that right before we're done. 01:53:51.090 --> 01:53:54.650 So just for anyone who has high security questions, hold it off until a little bit later. 01:53:54.910 --> 01:53:56.610 This is real quick though, just showing you. 01:53:56.610 --> 01:54:01.470 And they had on their website this very challenging text saying, nobody can pick our locks. 01:54:01.470 --> 01:54:06.710 No locksmith, no test institute, no burglars are ever known to pick our locks. 01:54:06.950 --> 01:54:09.830 And this is actually the type of key... 01:54:09.830 --> 01:54:10.730 Okay. 01:54:10.730 --> 01:54:11.690 Okay. 01:54:13.270 --> 01:54:16.530 Don't you love when someone says it's impossible? 01:54:16.610 --> 01:54:19.190 Isn't that just so great when you prove them wrong? 01:54:21.130 --> 01:54:22.370 Okay. 01:54:23.530 --> 01:54:24.290 In focus. 01:54:24.290 --> 01:54:25.810 Hope everybody can see. 01:54:26.110 --> 01:54:30.670 In Germany, from my German lockpicking friends, I bought this tool. 01:54:32.830 --> 01:54:34.450 Nobody leave. 01:54:34.510 --> 01:54:36.960 And it's this tool. 01:54:38.500 --> 01:54:41.220 And it's called the Fall tool, because Mr. 01:54:41.220 --> 01:54:43.160 Fall made it. 01:54:43.160 --> 01:54:45.480 And it's a decoder pick. 01:54:45.480 --> 01:54:48.900 It picks the lock, but it also reads the lock. 01:54:48.900 --> 01:54:50.540 So you can make the key. 01:54:50.560 --> 01:54:57.940 Here you can see what pin you are picking. 01:54:57.940 --> 01:55:02.020 And here you can see the depth of the key. 01:55:02.680 --> 01:55:08.660 With this tool you can open the lock that they claimed on their website could not be picked. 01:55:08.840 --> 01:55:11.760 It was a real challenge for us to pick it. 01:55:13.180 --> 01:55:17.820 What they do with this lock is they have discs in the lock. 01:55:17.820 --> 01:55:19.620 There's no pins but discs. 01:55:19.860 --> 01:55:22.340 I'll just show you a few of these discs. 01:55:22.340 --> 01:55:24.500 I hope 01:55:28.940 --> 01:55:30.260 I'm in focus. 01:55:36.620 --> 01:55:42.060 Okay, well here you can see the discs that are inside. 01:55:42.200 --> 01:55:44.220 And here's the real notch. 01:55:44.220 --> 01:55:47.040 And they put some fake notches in as well. 01:55:47.160 --> 01:55:54.420 So when you start manipulating the lock you'll experience like it's in the right position. 01:55:54.420 --> 01:55:56.080 But it's actually not. 01:55:56.080 --> 01:56:02.080 And it took us quite a while to figure out how to actually pick this lock because of the false notches. 01:56:02.460 --> 01:56:11.960 And then Paul, Paul Crowell from Montelus, he found out that there's a technique that if you put the pick in the lock. 01:56:20.060 --> 01:56:22.380 Wow, that's a big thumb. 01:56:26.360 --> 01:56:34.860 Okay, now I'm at the first disc and I'm trying to feel the cuts. 01:56:34.860 --> 01:56:36.040 Here's one cut. 01:56:36.680 --> 01:56:37.040 Go 01:56:40.140 --> 01:56:41.860 to disc two. 01:56:47.890 --> 01:56:50.250 How many discs are usually in there? 01:56:50.270 --> 01:56:51.330 Like eight. 01:56:55.170 --> 01:56:57.630 I should have cut this video down, I apologize. 01:56:57.810 --> 01:56:59.390 It's possible to get a false cut. 01:56:59.670 --> 01:57:05.710 Now, what Paul found out about these false cuts is that they are actually just a little bit tighter. 01:57:05.710 --> 01:57:07.770 So what you do is you go to one disc. 01:57:07.950 --> 01:57:10.250 You feel hey, okay, it's getting. 01:57:10.350 --> 01:57:11.890 And you feel it's getting again. 01:57:12.210 --> 01:57:19.130 And you just go for the widest you just go from one point of the cut to the other. 01:57:19.130 --> 01:57:21.650 And the widest is the right cut. 01:57:21.910 --> 01:57:23.650 And that actually was the trick. 01:57:23.650 --> 01:57:28.390 You have to feel the cuts. 01:57:29.690 --> 01:57:30.750 Okay, it's open. 01:57:31.470 --> 01:57:32.570 Applause. 01:57:44.070 --> 01:57:46.950 Abes made an improvement on the lock. 01:57:46.950 --> 01:57:52.610 So that this tool actually only works at a certain range of their locks. 01:57:52.610 --> 01:57:57.570 But the people from the German sport group they made a tool that beats that. 01:57:58.570 --> 01:58:02.790 At this moment there is a negotiation with Abes what to do. 01:58:03.670 --> 01:58:11.130 But when Abes they just had to take the text down and now you read our locks are really secure and very hard to pick. 01:58:11.270 --> 01:58:14.630 They don't say it's impossible to pick anymore. 01:58:17.490 --> 01:58:19.590 So that's rotating discs. 01:58:19.850 --> 01:58:21.410 Gotta really keep moving here. 01:58:21.410 --> 01:58:23.210 Alright, Master Keying Theory. 01:58:23.210 --> 01:58:26.390 Once again, how many people were in the last talk with Mark and Matt? 01:58:26.570 --> 01:58:31.290 So they mentioned that there was a big fuss about this. 01:58:31.290 --> 01:58:34.350 About, oh why are people disclosing these secrets? 01:58:34.350 --> 01:58:39.910 This has been known to people all over for a long time but it's just not talked about publicly that often. 01:58:41.190 --> 01:58:47.870 Master Locks, Master not the brand but you know Master Systems where there's different levels of escalated privilege. 01:58:47.870 --> 01:58:53.290 That's achieved by an additional wafer or an additional pin in the stack. 01:58:53.610 --> 01:58:56.750 It's a standard stack but it just has more pins. 01:58:56.950 --> 01:59:00.510 So a Master Pinned Lock might look something like this. 01:59:00.510 --> 01:59:04.270 I say might because there's a couple types of Mastering Conventions. 01:59:04.890 --> 01:59:10.090 For a Red Bull, a lighter and one of those hard drives do we have any more frack? 01:59:10.090 --> 01:59:11.330 No, no more frack. 01:59:11.330 --> 01:59:17.870 Can anyone tell me which of the two Master Pinning Systems which type this is? 01:59:19.010 --> 01:59:20.030 No one. 01:59:20.130 --> 01:59:20.890 Silence. 01:59:20.990 --> 01:59:21.890 Can you tell me? 01:59:22.010 --> 01:59:23.410 I don't know what the fuck the question means. 01:59:23.410 --> 01:59:24.390 I know a lot about this stuff. 01:59:24.390 --> 01:59:28.870 Well there are, this is what's called TPP or Total Position Progression Master. 01:59:28.870 --> 01:59:33.030 There's another type called RC or Rotating Constant which is a different algorithm. 01:59:33.170 --> 01:59:33.850 Oh well. 01:59:33.950 --> 01:59:37.710 I'll just give some, whoever can ask me cool questions at the end, I'll give you hard drives for that. 01:59:37.830 --> 01:59:38.570 Can I have one? 01:59:38.810 --> 01:59:39.570 Yeah, sure. 01:59:40.170 --> 01:59:50.150 Alright, so Master you can see how let's see, you might have a user with the lowest end of the totem pole is just called a change key. 01:59:50.330 --> 01:59:52.790 That's you know, just will open this one lock. 01:59:53.310 --> 01:59:55.410 But you might have a master key. 01:59:55.410 --> 01:59:59.010 If you have a key, now this is obviously very exaggerated. 01:59:59.190 --> 02:00:03.150 If you have a master cut key, these red pins are different. 02:00:03.150 --> 02:00:05.730 These shear lines are different throughout every lock. 02:00:05.730 --> 02:00:09.910 But the combination of a red and a green, and you know these aren't the real colors. 02:00:09.910 --> 02:00:17.890 The combination of the key pin and a master pin together, that is universal throughout all the locks in let's say one facility. 02:00:17.930 --> 02:00:24.610 So a master key would always be able to find this shear line no matter what lock was in what door. 02:00:24.610 --> 02:00:28.470 Whereas a person's change key would only work on their door. 02:00:29.410 --> 02:00:44.070 However, and many of us who had college dorms with master keyed systems played with this, there is a very, very simple way that if you have any key that works in the system, you can very easily make a master key. 02:00:44.670 --> 02:00:45.510 Sometimes. 02:00:45.670 --> 02:00:47.230 Would you like to know how? 02:00:50.830 --> 02:00:53.110 That's pretty much where it starts to go to. 02:00:53.110 --> 02:00:54.330 This is what happens. 02:00:54.330 --> 02:00:55.730 Let's say I have this key. 02:00:55.990 --> 02:00:58.710 And it opens my door to my, let's say dorm room. 02:00:59.250 --> 02:01:02.130 I take it out and I file this down. 02:01:02.630 --> 02:01:06.350 And I say, well that screws me because now I can't get into my room. 02:01:06.630 --> 02:01:08.350 Because you can see this is binding. 02:01:09.190 --> 02:01:12.310 Well I better keep filing it because I got to get my room somehow. 02:01:12.310 --> 02:01:13.650 Keep filing. 02:01:13.830 --> 02:01:14.850 Keep filing. 02:01:19.950 --> 02:01:25.890 Well it couldn't be higher because then you'd have a bottom pin that's completely out of the shear line. 02:01:25.890 --> 02:01:27.370 So it has to be lower. 02:01:30.890 --> 02:01:31.650 I see what you're saying. 02:01:31.650 --> 02:01:32.590 We're going to touch on that. 02:01:32.590 --> 02:01:36.290 There is a vendor that has two completely independent shear lines. 02:01:38.550 --> 02:01:38.990 Oh yeah. 02:01:39.050 --> 02:01:48.450 Bump keying and picking is easier on traditional master keyed systems because if you bump or you pick, you might pick half of these at a master height. 02:01:48.450 --> 02:01:49.650 The lock doesn't care. 02:01:49.650 --> 02:01:52.110 As long as you got shear lines going on, it's going to open. 02:01:52.250 --> 02:01:57.690 So yeah, if you have a really poorly engineered master pinned lock, you just... there it goes. 02:01:58.670 --> 02:02:04.970 But a very nice mastering type system, a very nice system is made by Best. 02:02:04.970 --> 02:02:06.690 And they're called SFIC. 02:02:06.690 --> 02:02:08.810 Small Format Interchangeable Core. 02:02:08.810 --> 02:02:10.510 Best is the most popular vendor. 02:02:10.510 --> 02:02:11.970 Some other vendors make them. 02:02:12.050 --> 02:02:15.250 These are very easily managed locks. 02:02:15.250 --> 02:02:18.970 It's very, very popular in large enterprise deployments when you have... 02:02:18.970 --> 02:02:22.250 you're trying to manage logistics and you're swapping out core. 02:02:22.250 --> 02:02:23.930 You're trying to manage who's who. 02:02:23.930 --> 02:02:33.130 The best lock or the SFIC, this figure eight shape, you can pull this whole core right out of the lock with the use of what's called a control key. 02:02:34.790 --> 02:02:37.770 This lock core, the pins are all sitting up here. 02:02:37.830 --> 02:02:38.850 There's a plug in here. 02:02:38.850 --> 02:02:42.190 The control key engages what's called a control sleeve. 02:02:42.650 --> 02:02:45.530 And you can see this sleeve has a big piece sticking out the side. 02:02:45.530 --> 02:02:48.910 If that sleeve is engaged , it's not going to pull out of the lock. 02:02:48.910 --> 02:03:01.570 But if you stick a control key in, turn it, and actually rotate the plug and the sleeve all at once, you can actually rotate the sleeve out of the way, pull the whole lock out, and then that can be... you can eject the pins, you can manage who's what, 02:03:01.570 --> 02:03:03.050 you can swap the cores very easily. 02:03:03.050 --> 02:03:04.290 They're very nicely made. 02:03:05.490 --> 02:03:09.110 This is also a disaster to try to pick with normal tools. 02:03:10.350 --> 02:03:13.830 If you just... you can see this is the brown is sort of the control sleeve. 02:03:13.830 --> 02:03:15.610 The light color is the plug. 02:03:15.950 --> 02:03:18.970 These shear lines are completely independent of one another. 02:03:18.970 --> 02:03:26.410 So you have the top shear, the bottom shear, and if you stick... this is a regular key, this would be a control key. 02:03:27.310 --> 02:03:34.430 If you stick a regular wrench in there, and you tension it, you're going to get binding all across these shear lines. 02:03:34.590 --> 02:03:40.570 So going in and trying to lift pins up, you're almost always going to not pick them all at the right shear line. 02:03:40.570 --> 02:03:44.110 You're going to catch some top, some low, you're not going to get it picked. 02:03:44.550 --> 02:03:46.130 Matt Blaze did the math on this. 02:03:46.130 --> 02:03:49.650 You know, the odds and the likelihood of actually hitting it correctly are not good. 02:03:50.650 --> 02:04:00.170 There is, however, manufactured by our good friends at Peterson, something called a finger wrench, which can stick in the lock... 02:04:00.170 --> 02:04:02.690 Let me actually switch up here. 02:04:04.150 --> 02:04:08.550 There is a tension wrench that has little fingers on it. 02:04:09.450 --> 02:04:10.590 It's hard to see. 02:04:10.590 --> 02:04:11.710 Can you see those? 02:04:13.050 --> 02:04:24.630 What that does is stick into the keyway, stick completely through the bottom of the keyway, because there's holes in the bottom. 02:04:25.130 --> 02:04:28.190 These holes don't actually serve a purpose in the lock's function. 02:04:28.190 --> 02:04:34.110 What they do is allow an ejector tool to stick into the lock if you want to pop the pins out and manage your pinning. 02:04:34.390 --> 02:04:40.710 But if you reach down through these holes, you can actually engage just the control sleeve. 02:04:42.210 --> 02:04:47.330 By just engaging the control sleeve, you're only going to tension the top shear line. 02:04:47.470 --> 02:04:55.350 Go in with a regular pick, set the pins, this is not as easy as it sounds, and then turn the control sleeve and eject the entire core. 02:04:58.690 --> 02:05:08.590 This is one example in what I'm going to wrap up at the end talking about the idea that disclosing these vulnerabilities helps us because... 02:05:08.590 --> 02:05:10.090 Oh, by the way, this is... 02:05:10.090 --> 02:05:11.390 Is anyone going to know this? 02:05:11.390 --> 02:05:12.110 This will be for... 02:05:12.110 --> 02:05:12.850 Question? 02:05:19.760 --> 02:05:21.320 I can't hear what you're saying. 02:05:27.480 --> 02:05:29.280 I don't really understand what you mean. 02:05:31.340 --> 02:05:32.620 Oh, it's not unlocked. 02:05:32.620 --> 02:05:34.320 You're just pulling the whole thing out. 02:05:34.320 --> 02:05:37.360 And you can look down and there's little pins that you can flip. 02:05:37.360 --> 02:05:38.080 Go ahead. 02:05:40.540 --> 02:05:41.400 Pardon me? 02:05:42.640 --> 02:05:51.260 Yeah, with the core out, you can eject the pins right out of it and get the entire... Not only that, if it's a mastered system, you can get the entire master scheme for the entire facility and so forth. 02:05:52.380 --> 02:05:53.100 Yes. 02:05:53.960 --> 02:06:00.000 Does anyone know who originally came up with this design for this finger wrench for a hard drive and a Red Bull? 02:06:00.980 --> 02:06:02.140 No, not Barry. 02:06:02.140 --> 02:06:03.080 Somebody at Peterson. 02:06:03.080 --> 02:06:04.200 Peterson makes these. 02:06:05.820 --> 02:06:07.060 No, not Ken. 02:06:07.060 --> 02:06:08.140 Good guess though. 02:06:08.360 --> 02:06:08.920 Anybody? 02:06:08.920 --> 02:06:11.080 If you don't know it, a guy named Jerry Finch. 02:06:11.080 --> 02:06:12.060 Very smart cat. 02:06:12.060 --> 02:06:12.700 Question? 02:06:29.780 --> 02:06:30.500 Right. 02:06:31.400 --> 02:06:34.240 Well, that's closer to the rotating constant system. 02:06:34.240 --> 02:06:35.040 I can talk about that. 02:06:35.040 --> 02:06:37.680 I'm going to get one more... I'm going to talk about that a little later. 02:06:37.680 --> 02:06:45.160 One more question and then we're going to try to fire through the rest of these and any more questions, if we run out of time, you're going to have the whole hands-on time to talk to me. 02:06:48.440 --> 02:06:49.280 Pardon? 02:06:50.780 --> 02:06:51.820 Yes. 02:06:52.820 --> 02:06:53.760 Very good point. 02:06:53.760 --> 02:06:57.560 This is why I'm so pleased with this information coming out. 02:06:57.560 --> 02:07:00.180 He mentions that there are new sleeve designs. 02:07:00.480 --> 02:07:08.920 In fact, Matt, when he first talked about this, he took his control sleeve and just cut the holes really huge in the bottom. 02:07:09.220 --> 02:07:11.140 You can still stick an ejector tool in there. 02:07:11.140 --> 02:07:14.800 It doesn't hurt, but there's nothing for the finger wrench to grab onto. 02:07:15.000 --> 02:07:18.000 And I believe best manufacture sleeves like this now. 02:07:18.000 --> 02:07:20.920 You mentioned that sometimes the control sleeves are in segments. 02:07:21.500 --> 02:07:26.660 So, yeah, the fact that this was publicly discussed means that it's safer for everyone now. 02:07:26.660 --> 02:07:29.100 And people are retrofitting their locks with better sleeves. 02:07:29.100 --> 02:07:31.260 It's a very, very good thing to talk about. 02:07:32.320 --> 02:07:33.080 Alright. 02:07:33.260 --> 02:07:35.700 Real quick, if you... How many people are enjoying this? 02:07:35.700 --> 02:07:38.000 How many people want to get more knowledge, more involved? 02:07:38.000 --> 02:07:39.640 Are you in the room? 02:07:40.500 --> 02:07:41.820 That's what I like to hear. 02:07:41.820 --> 02:07:43.400 There's plenty of books you can read. 02:07:43.400 --> 02:07:45.940 There's a lot of good places to go online. 02:07:46.260 --> 02:07:48.000 Let's shoot through some of these real fast. 02:07:48.000 --> 02:07:51.740 These slides are all online, by the way, and I'll tell you at the end so we can really flip through this. 02:07:52.380 --> 02:07:54.440 Two of the best books that I know of. 02:07:54.480 --> 02:08:00.380 Very intro, very beginners, very what-do-you-want-to-know-immediately-first is Steel Bolt Hacking by Douglas Chick. 02:08:00.480 --> 02:08:01.620 Doug was here last year. 02:08:01.620 --> 02:08:02.560 I don't know if he's here this year. 02:08:02.560 --> 02:08:05.000 His books probably are in the vendor area somewhere. 02:08:05.000 --> 02:08:08.960 The high end is written by the gentleman who spoke before us today. 02:08:08.960 --> 02:08:11.920 Mark Tobias wrote a book called Lock, Safes, and Security. 02:08:11.980 --> 02:08:14.460 That's called by many people the Lockpick Bible. 02:08:14.460 --> 02:08:17.480 It's just like the history of locks starting in ancient Egypt forward. 02:08:17.480 --> 02:08:20.360 It's a very, very good tome of knowledge. 02:08:20.600 --> 02:08:23.300 Online you can Google for the MIT Guide to Lockpicking. 02:08:23.300 --> 02:08:24.940 It's hosted at a few places. 02:08:25.000 --> 02:08:29.660 Some of the videos I'm showing you were cropped from Barry's presentations available here. 02:08:29.660 --> 02:08:31.240 There's a lot of informative pages. 02:08:31.240 --> 02:08:33.120 All these links, you don't have to scribble them right now. 02:08:33.120 --> 02:08:34.600 There's going to be all up at the end. 02:08:35.920 --> 02:08:37.680 There are sport-picking groups. 02:08:37.680 --> 02:08:38.680 There are hobbyist groups. 02:08:38.680 --> 02:08:42.100 There's a lot of fun things you can get involved with that way, with local people. 02:08:42.380 --> 02:08:50.680 Every con that you can go to now, DEFCON, back east, the HOPE cons, what the hack is happening now in Europe, there's sport-picking competitions usually. 02:08:50.680 --> 02:08:54.440 In fact, KyGoth and the DC719 crew are running that this year again. 02:08:54.440 --> 02:08:55.780 They do a great job of it. 02:08:56.020 --> 02:08:56.900 There's groups. 02:08:56.900 --> 02:08:58.640 I mentioned Barry's group, TOOL. 02:08:58.780 --> 02:09:01.460 The German group, which I think has a thousand members. 02:09:01.460 --> 02:09:02.380 It's really huge. 02:09:02.380 --> 02:09:04.000 It's from the Dispotechnik. 02:09:04.060 --> 02:09:07.340 TOOL USA, we recently founded with Barry's blessing. 02:09:07.340 --> 02:09:09.580 We're based out of Princeton University. 02:09:09.800 --> 02:09:12.580 If there's any people near you, meet people here. 02:09:12.580 --> 02:09:13.840 Talk and go home. 02:09:13.840 --> 02:09:15.540 Get together and play with stuff. 02:09:15.540 --> 02:09:16.500 Take it apart. 02:09:16.500 --> 02:09:19.500 It's excellent to do with friends or as an individual activity. 02:09:19.500 --> 02:09:25.840 I take a train up to Newark to go to school and I'll just sit there fussing with lockpicks on the train, just popping stuff open. 02:09:25.840 --> 02:09:27.380 It's a great way to pass the time. 02:09:27.980 --> 02:09:31.020 You get a few strange looks, but you're not doing anything very illegal. 02:09:31.620 --> 02:09:33.500 We're going to cover that now in the legal section. 02:09:35.020 --> 02:09:36.280 You've got to hold the question. 02:09:36.280 --> 02:09:36.620 I'm sorry. 02:09:36.620 --> 02:09:37.720 We're going to run out of time if we don't. 02:09:37.720 --> 02:09:38.200 Sorry. 02:09:39.360 --> 02:09:40.320 Buying picks. 02:09:40.800 --> 02:09:41.760 Southerd guys. 02:09:41.820 --> 02:09:43.920 Excellent, excellent picks for starter kits. 02:09:43.920 --> 02:09:44.860 They're very simple. 02:09:44.940 --> 02:09:48.420 The Peterson manufacturing company makes very nice high-end equipment. 02:09:48.840 --> 02:09:49.940 You can get stuff here. 02:09:49.940 --> 02:09:51.740 I know the guys from IVU are around. 02:09:51.740 --> 02:09:52.840 Check out their table. 02:09:52.960 --> 02:09:56.680 Check out some of our stuff in the hands-on area if you want to just pick them up from us. 02:09:56.760 --> 02:09:57.720 You can make your own. 02:09:57.720 --> 02:10:00.900 We'll cover all kind of fun stuff, but we're going to have our grinder tools out. 02:10:00.900 --> 02:10:03.920 We're going to make some picks and make some fun stuff in the hands-on session. 02:10:04.200 --> 02:10:07.820 Those of you with legal concerns, I am not a lawyer. 02:10:07.820 --> 02:10:09.240 I am not sleeping with one. 02:10:09.240 --> 02:10:10.960 This is not legal advice. 02:10:10.980 --> 02:10:12.060 Take it for what it's worth. 02:10:12.060 --> 02:10:13.580 Check your local laws. 02:10:13.880 --> 02:10:21.000 To purchase, ship, and in general just be involved in the transportation of picks, there is a federal standard. 02:10:21.200 --> 02:10:24.720 The federal standard is a five-point eligibility. 02:10:25.020 --> 02:10:27.180 You can be a lock manufacturer. 02:10:27.200 --> 02:10:28.480 You can be law enforcement. 02:10:28.620 --> 02:10:30.440 You can be in the auto business. 02:10:30.440 --> 02:10:31.860 You can be a repo man. 02:10:31.860 --> 02:10:34.120 Or you can be a bona fide locksmith. 02:10:34.260 --> 02:10:37.400 The lawyers in the room will tell you bona fide meaning in good faith. 02:10:37.400 --> 02:10:39.400 It doesn't mean a professional locksmith. 02:10:39.400 --> 02:10:41.480 It doesn't mean a certified locksmith. 02:10:41.480 --> 02:10:44.600 It just means you have a good faith interest in locksmithing. 02:10:44.600 --> 02:10:51.160 In many circles, check with a lawyer, in many circles this is extended to hobbyist and academic interests. 02:10:51.160 --> 02:10:52.460 I've got to have you wait for the question. 02:10:52.460 --> 02:10:53.140 I'm sorry. 02:10:53.620 --> 02:10:59.100 If you have a legitimate non-criminal interest in this, you are covered under that part of the law. 02:10:59.100 --> 02:11:06.140 If you're dealing with a vendor and they say you have to fill out this form, fill it out under check box number five and you should be clear. 02:11:06.860 --> 02:11:10.200 Possession of lock picks, however, can be squirrely. 02:11:10.820 --> 02:11:13.340 Lock picks per se, right Mike, are not illegal. 02:11:13.380 --> 02:11:15.200 Burglary tools are illegal, right? 02:11:15.360 --> 02:11:17.080 Depends where, but generally yes. 02:11:17.480 --> 02:11:20.000 Burglary tools, what makes a burglary tool? 02:11:20.200 --> 02:11:20.860 Intent. 02:11:20.880 --> 02:11:23.120 Intent is much of the law. 02:11:23.880 --> 02:11:36.760 Most laws, every state, by the way, the lockpick101.com those guys, lockpicking101.org or com, we'll check it again, they have a whole legal section you can get all the information you need. 02:11:37.040 --> 02:11:46.700 Basically, if you have demonstrable intent that you're trying to commit a crime, you've got a whole other bag of shit you're trying to deal with. 02:11:46.700 --> 02:11:52.580 If you're just a guy on a subway and they're doing fascist crap in New York, patting people down now and they say, what are these? 02:11:52.580 --> 02:11:53.240 What are these? 02:11:53.240 --> 02:11:53.900 Lock picks? 02:11:54.220 --> 02:11:56.260 Well, you're a guy frigging riding the subway. 02:11:57.080 --> 02:11:59.140 I wasn't going to go somewhere and pick a lock. 02:11:59.140 --> 02:12:01.220 No, there's no intent that you were going to do anything. 02:12:01.220 --> 02:12:08.820 If you are squatting behind Best Buy at 3 in the morning at the back door and a cop's like, what are you doing? 02:12:08.820 --> 02:12:10.240 You're like, I'm taking a piss. 02:12:10.460 --> 02:12:14.920 And they find lock picks on you, you've got a whole different situation you're in there. 02:12:15.400 --> 02:12:17.140 So, be aware of that. 02:12:17.140 --> 02:12:22.120 Many states do not have intent laws or they have kind of more draconian laws. 02:12:22.120 --> 02:12:25.280 We can cover that later on or talk to a lawyer. 02:12:25.320 --> 02:12:29.500 These are states of concern with what are called prima facie evidence laws. 02:12:30.100 --> 02:12:31.520 It's all kind of relative. 02:12:31.520 --> 02:12:32.860 Just keep intent in mind. 02:12:32.860 --> 02:12:38.600 And also if you do anything else illegal, sometimes possession of a lock pick can escalate that crime. 02:12:38.600 --> 02:12:51.200 For instance, if you're trespassing, if you have, a lot of people here like urban exploring, if you're somewhere you're not supposed to be, you might turn a misdemeanor trespass charge into a criminal trespass charge because you had picks on you. 02:12:51.200 --> 02:12:51.980 Keep it in mind. 02:12:51.980 --> 02:12:53.020 Check with a lawyer. 02:12:53.160 --> 02:12:54.360 There's plenty of lawyers here. 02:12:54.360 --> 02:12:55.660 Talk to the people who know. 02:12:58.680 --> 02:12:59.460 Acquiring locks. 02:12:59.460 --> 02:13:00.840 I'll shoot through this real fast. 02:13:00.860 --> 02:13:04.840 Basically, the last, the main thing is just don't go crazy buying them all over. 02:13:04.980 --> 02:13:06.300 Most locks are the same. 02:13:06.300 --> 02:13:09.060 You're gonna, you know, everyone who gets real, oh, I can pick, it's fun. 02:13:09.060 --> 02:13:12.860 You go to the hardware store, you drop 60 bucks, you got you know, a ton of the same lock. 02:13:12.860 --> 02:13:14.060 Look through your basement. 02:13:14.060 --> 02:13:16.820 Look through old stuff that relatives have left in a box somewhere. 02:13:16.820 --> 02:13:18.420 Look for old exotic designs. 02:13:18.640 --> 02:13:21.140 You can get really nice what are called training kits. 02:13:21.140 --> 02:13:29.560 I have one that you can play with at the hands-on where it's pinned, you know, they're keyed the same, but it's only like a one pin stack, then a two pin stack, then a three. 02:13:29.560 --> 02:13:32.620 So you can actually get the feel for it and get started that way. 02:13:32.620 --> 02:13:35.380 There's a lot of really good places you can acquire locks. 02:13:35.380 --> 02:13:36.480 Ask me about later. 02:13:37.500 --> 02:13:40.040 So how does this all break down into the real world? 02:13:40.040 --> 02:13:43.200 What does this really bear on in the big picture? 02:13:43.440 --> 02:13:46.220 They mentioned in the last talk, it's very valid. 02:13:46.520 --> 02:13:48.920 Criminals don't tend to use lock picks. 02:13:48.920 --> 02:13:54.620 I'm not saying no one ever picks a lock with criminal intent, but usually yeah, you're going to get a boot to the door. 02:13:54.640 --> 02:13:59.440 Anybody who was watching sneakers on the Defcon movie channel last night, you know, they just kick the door down. 02:13:59.460 --> 02:14:01.660 Brute force is what criminals use. 02:14:01.660 --> 02:14:10.900 Don't buy the most expensive lock on the shelf and put it, you know, in a non-solid core door with like a balsa wood frame, just, you know, with little quarter inch screws. 02:14:11.580 --> 02:14:13.060 Situate the lock properly. 02:14:13.060 --> 02:14:14.940 Consider the overall scope of it. 02:14:14.940 --> 02:14:23.840 I mentioned, you know, if a guy can sit there next to your server room or your records room picking a lock for an hour, why don't you have a security camera near that door? 02:14:23.840 --> 02:14:26.560 Why don't you have a security guard who occasionally walks by? 02:14:26.620 --> 02:14:29.200 Keep the big picture in mind. 02:14:31.240 --> 02:14:32.580 What make good locks? 02:14:32.580 --> 02:14:36.200 I always get asked this, so I put this page in just to shoot down a few names. 02:14:36.200 --> 02:14:37.720 I don't work for any of these guys. 02:14:37.720 --> 02:14:39.340 They just kind of impress me. 02:14:39.340 --> 02:14:42.580 Those Medicos with the biaxial pins, I love them to death. 02:14:42.620 --> 02:14:46.420 The Assa V10, for the slight flaw that it has, it's still magnificent. 02:14:46.500 --> 02:14:49.140 Those best FICs, they're very hard to pick. 02:14:49.140 --> 02:14:52.480 They're very nice to do logistics of large scale deployment. 02:14:52.800 --> 02:14:56.360 Abus, that was what Barry was picking, the rotating disk lock. 02:14:56.360 --> 02:14:58.440 They make a very , very nice strong lock. 02:14:58.540 --> 02:15:03.540 American , we're going to talk about a little bit more at my very end slide, but they tend to make good things. 02:15:03.540 --> 02:15:08.960 And if anybody here is in the military, by the way, anybody who can score me one of these bad boys? 02:15:09.560 --> 02:15:22.680 The Sergeant in Greenleaf 833, I've heard it told that if you come across one of these, somewhere far, far away, there's a lieutenant screaming at a corporal as to why it's not inventoried properly, because they're not supposed to get out there. 02:15:23.860 --> 02:15:24.400 You got one? 02:15:24.400 --> 02:15:24.940 You got one? 02:15:27.780 --> 02:15:28.660 That's what I've heard. 02:15:28.660 --> 02:15:29.860 These are armory locks. 02:15:29.860 --> 02:15:38.480 These are a Medico biaxial core, situated in what is the most beautifully designed and engineered housing I've ever seen in my life. 02:15:39.120 --> 02:15:40.680 Yes, some bad locks stand out. 02:15:40.680 --> 02:15:50.300 We've been kind of beaten up on Master for this talk, and I don't like to all the time, because they make a high-end model, just no one buys them, because they keep frigging making shitty models that everyone buys, because they're cheap. 02:15:50.900 --> 02:15:57.100 Quickset, everyone who's ever got a door in your house that has a quickset, you'll shit your pants when you pick it in three seconds. 02:15:58.160 --> 02:16:00.520 Keep in mind, you get what you pay for. 02:16:00.560 --> 02:16:09.320 If there's three different locks on the shelf, one costs nothing, one costs middle, and one costs a lot, chances are, the expensive one's going to be better. 02:16:09.320 --> 02:16:21.900 If you're in the American marketplace, if it's a free market system, if you're a recognizable name, you can't keep producing garbage year after year, and people aren't going to keep buying your product, unless you're Microsoft. 02:16:24.100 --> 02:16:28.020 If it's a reputable brand and it's expensive, you're probably halfway there. 02:16:31.360 --> 02:16:33.600 You picked a quickset with a popsicle stick? 02:16:33.600 --> 02:16:35.380 It wouldn't surprise me. 02:16:36.240 --> 02:16:38.960 Keep playing with these locks. 02:16:38.980 --> 02:16:40.620 Keep experimenting. 02:16:41.200 --> 02:16:45.620 Security is achieved through openness, not just in the digital world. 02:16:45.620 --> 02:16:52.360 We should not be so eager to be hushed up about when we discover things in the physical world. 02:16:53.040 --> 02:16:54.720 Craziness next door. 02:16:55.020 --> 02:17:01.060 The American 700 is a story I love to tell, because it's a complete example of this phenomenon. 02:17:01.920 --> 02:17:03.820 Anybody live in a big city? 02:17:03.820 --> 02:17:05.120 Been to a big city? 02:17:06.380 --> 02:17:15.640 So if you're walking around at night, you'll see that every storefront is closed down with a big honking sucker. 02:17:16.600 --> 02:17:27.240 Almost always, storefronts and big where brute force, where some guy with a crowbar is going to be the assault, is going to be either an American lock or a clone of an American lock. 02:17:27.240 --> 02:17:29.360 This is their 700 series lock. 02:17:29.360 --> 02:17:31.040 It's a very nice padlock. 02:17:31.400 --> 02:17:34.380 It has a flaw, however, which was discovered. 02:17:35.940 --> 02:17:38.540 This lock is a removable core. 02:17:38.540 --> 02:17:44.660 You can see that when the lock is unlocked, you can unscrew from the inside, drop the eight plate off, eject the core. 02:17:44.660 --> 02:17:46.780 The core is a nice little self-contained unit. 02:17:46.980 --> 02:17:59.260 This core interfaces with the double ball control cylinder by means of the core has a raised half circle piece and the control cylinder has a raised quarter circle piece. 02:17:59.260 --> 02:18:00.440 Can you guys see that? 02:18:00.440 --> 02:18:04.280 How they just fit together and when they're together, they turn and they engage. 02:18:06.120 --> 02:18:10.660 Peterson makes this tool called the American Bypass Tool. 02:18:13.020 --> 02:18:18.600 This is the bypass tool and if I stick this all the way down this lock 02:18:24.380 --> 02:18:25.960 and I beat this tool to hell 02:18:29.020 --> 02:18:30.880 that opens that lock. 02:18:32.240 --> 02:18:33.220 Why is that? 02:18:33.220 --> 02:18:38.680 Well, it's because if you're looking at this core, this ejected core, this is the back end of it. 02:18:38.760 --> 02:18:41.080 The keyway is visible. 02:18:41.080 --> 02:18:49.860 The keyway is cut all the way through and the Peterson tool, the bypass tool just has a little hockey stick kind of end. 02:18:49.960 --> 02:18:57.420 It slips all the way down through the keyway and it spins that second cylinder. 02:18:57.580 --> 02:19:02.080 The cylinder, it just fits right in where it should be and it just kind of just flicks the cylinder and just turns it. 02:19:02.380 --> 02:19:04.420 It's a very elegant bypass. 02:19:04.420 --> 02:19:08.620 It's got a lot of attention but American is a great company. 02:19:08.620 --> 02:19:16.260 Instead of trying to sue people over this, instead of trying to make a huge fuss, American just came out with something called a security wafer. 02:19:16.420 --> 02:19:18.540 They're hard to order but they do have a part number. 02:19:18.540 --> 02:19:20.200 You can find them by some vendors. 02:19:20.320 --> 02:19:24.400 You can take your core, eject it out, and put this security wafer in. 02:19:24.460 --> 02:19:29.200 And it's literally, I love how it's such a, like the digital world, it's like they released a patch. 02:19:29.560 --> 02:19:31.680 So it's like a hot fix. 02:19:32.020 --> 02:19:37.120 And you put the lock back together and you can't stick the American tool down the keyway. 02:19:37.660 --> 02:19:45.220 Never one to be discouraged, Ken came up with this, which is a wafer breaker kit. 02:19:47.420 --> 02:19:53.920 You stick these down the keyway, you smash on them, and those wafers are spread out in their history. 02:19:54.360 --> 02:19:56.380 So we'll see what happens next. 02:19:56.520 --> 02:19:59.200 I would like to think American is a good company. 02:19:59.320 --> 02:20:01.800 Chances are they're going to try to come up with something even better. 02:20:01.800 --> 02:20:03.880 And Ken's going to kind of come up with something better. 02:20:03.880 --> 02:20:06.680 And the end result is better security for all of us. 02:20:06.700 --> 02:20:09.340 Because we talk about it, the vendors address it. 02:20:09.340 --> 02:20:11.480 That's not a bad thing. 02:20:12.380 --> 02:20:14.700 You know, this is, we know about all of this. 02:20:14.700 --> 02:20:19.780 You guys, all we know about security through obscurity versus real security in the digital world. 02:20:19.860 --> 02:20:22.140 Think about it the same way in the real world. 02:20:22.140 --> 02:20:23.760 The physical world is no different. 02:20:24.120 --> 02:20:26.280 Matt Blaze wrote a couple of great papers about this. 02:20:26.280 --> 02:20:27.480 I have the links later. 02:20:28.800 --> 02:20:35.620 Ultimately, I like to kind of wrap it up by saying don't be super trusting of anything. 02:20:35.860 --> 02:20:41.360 When I was real young, my dad was in the service, and he had his issue weapons in the house. 02:20:41.360 --> 02:20:45.000 And when I was growing up, he showed me guns when I was real little. 02:20:45.060 --> 02:20:51.100 And he said, you know, he's showing me how this is how it's open and closed, and he's showing me how you can look down the barrel and the chamber is empty. 02:20:51.200 --> 02:20:52.540 And I said, well, why am I showing you this? 02:20:52.540 --> 02:20:55.300 Because, son, a gun is not safe. 02:20:55.400 --> 02:20:59.400 A gun is not okay unless you've seen that it's safe. 02:20:59.400 --> 02:21:01.380 You're not protected unless you've seen it. 02:21:01.380 --> 02:21:02.720 What did I just tell you? 02:21:02.720 --> 02:21:06.000 And I was like, a gun's not safe unless I know it's safe. 02:21:06.000 --> 02:21:06.700 He goes, no. 02:21:06.700 --> 02:21:09.740 It's not safe unless you've seen that it's safe. 02:21:09.760 --> 02:21:11.200 See it for yourself. 02:21:11.500 --> 02:21:12.740 Take things apart. 02:21:12.980 --> 02:21:13.940 Play with them. 02:21:13.940 --> 02:21:15.980 Don't just take people at their word. 02:21:16.460 --> 02:21:24.640 You know, we joke around, and when AST Cell and other guys are out walking around at night, and we all take pictures, you know, oh, the hacker salute, DEF CON salute. 02:21:25.340 --> 02:21:27.540 This is more powerful than you know. 02:21:28.020 --> 02:21:33.120 This is something that you should fly in the face of people who try to stop you from exploring. 02:21:33.760 --> 02:21:41.640 Nothing can be healthier than a really nice, hearty, fuck you to some people who say that learning about things is bad. 02:21:41.720 --> 02:21:44.140 Can I get everyone to practice this one time all together? 02:21:44.680 --> 02:21:45.520 Out loud. 02:21:45.520 --> 02:21:46.700 One, two, three. 02:21:46.740 --> 02:21:48.200 Fuck you! 02:21:48.620 --> 02:21:49.400 Hey, man. 02:21:49.400 --> 02:21:51.100 Those are trade secrets. 02:21:51.100 --> 02:21:52.520 Those are copyrighted. 02:21:52.520 --> 02:21:54.360 You can't explore our designs. 02:21:54.360 --> 02:21:56.300 Just buy them. 02:21:56.320 --> 02:21:58.040 Fuck you! 02:21:58.100 --> 02:22:00.360 The Department of Justice is in control. 02:22:00.360 --> 02:22:01.480 Leave it to your legislators. 02:22:01.480 --> 02:22:03.980 We will pass laws that take care of you. 02:22:03.980 --> 02:22:05.960 You don't have to know how things work. 02:22:06.100 --> 02:22:07.600 Fuck you! 02:22:07.640 --> 02:22:09.620 Why are you trying to explore things? 02:22:09.620 --> 02:22:10.820 You're just a criminal. 02:22:10.820 --> 02:22:12.560 You're not interested in security. 02:22:12.980 --> 02:22:14.220 Fuck you! 02:22:14.460 --> 02:22:17.960 Exposing bad security is what protects us all. 02:22:33.230 --> 02:22:35.030 Thank you very much. 02:22:35.070 --> 02:22:36.130 I could not have... 02:22:36.130 --> 02:22:36.950 Oh, sorry. 02:22:38.550 --> 02:22:42.790 To say that I came up and did this on my own would be just ridiculous. 02:22:43.270 --> 02:22:47.550 Barry, Matt, Mike here, RenderMan, who you've seen around with the fedora. 02:22:48.070 --> 02:22:49.870 Before everyone leaves, there's going to be a Q&A. 02:22:49.870 --> 02:22:55.930 Everybody from Tool, DC719 and Kygoth, everybody in Tool USA, I've got to thank them all. 02:22:56.150 --> 02:22:58.430 We can do Q&A with the few minutes we've got. 02:22:58.430 --> 02:23:00.570 Here's all the links. 02:23:01.030 --> 02:23:03.190 Or if you want, we're really short on time. 02:23:03.190 --> 02:23:05.290 Do you guys want to just break it down here? 02:23:05.310 --> 02:23:06.330 I'll pack all this up. 02:23:06.330 --> 02:23:11.330 We can meet in the contest area, do some hands-on work, and we'll do questions there. 02:23:11.330 --> 02:23:14.030 Everyone, pie and punch will be served at the contest area. 02:23:15.750 --> 02:23:19.530 By the way, if you're leaving, leave through those doors. 02:23:19.530 --> 02:23:22.330 Doors to your left as you face the stage. 02:23:22.650 --> 02:23:23.610 Thank you.