1
00:00:05,600 --> 00:00:15,120
Told that everything will run on schedule, although at 4 o'clock in the tent, we're going to have the Hacker Foundation and Dunka Gardner Analyst.

2
00:00:16,700 --> 00:00:18,080
In the tent.

3
00:00:23,320 --> 00:00:31,780
They're going to have the Hacker Foundation in the tent with Dunka Gardner Analyst, I guess, at 4 o'clock in the tent.

4
00:00:32,440 --> 00:00:36,000
And this is Thomas, and he'll be cracking safes for us.

5
00:01:07,640 --> 00:01:08,780
Three letters?

6
00:01:21,120 --> 00:01:22,800
Welcome!

7
00:01:32,450 --> 00:01:33,730
Can you hear me?

8
00:01:33,730 --> 00:01:34,830
No.

9
00:01:35,630 --> 00:01:37,230
How's that?

10
00:01:37,550 --> 00:01:39,230
No.

11
00:01:40,610 --> 00:01:41,810
How's that?

12
00:01:41,810 --> 00:01:42,990
A little bit better?

13
00:01:46,230 --> 00:01:47,890
Not sure if the other one will reach.

14
00:01:47,890 --> 00:01:48,670
Let's see.

15
00:01:49,050 --> 00:01:50,130
Do we have an audio guy in here?

16
00:01:50,130 --> 00:01:50,890
Is this on?

17
00:01:53,590 --> 00:01:55,070
How about that?

18
00:01:55,730 --> 00:01:56,530
Better?

19
00:01:57,050 --> 00:01:58,450
Okay, just have to get up here.

20
00:01:58,450 --> 00:01:59,070
Alright.

21
00:02:00,930 --> 00:02:06,690
Well, if you guys just missed a really exciting talk about how to equalize wealth in the economy.

22
00:02:08,030 --> 00:02:12,930
Hey, you guys just missed a really exciting talk about how to equalize wealth in the economy.

23
00:02:12,930 --> 00:02:17,150
Of course, one thing they didn't cover was safe cracking.

24
00:02:18,770 --> 00:02:22,210
Fortunately, we're going to pick up here and get that little bit done.

25
00:02:31,240 --> 00:02:33,600
Today we've got a little double feature going on here.

26
00:02:33,600 --> 00:02:35,740
First of all, we're going to talk about a couple of techniques.

27
00:02:35,740 --> 00:02:38,720
One is back dialing, and that's going to be our first topic.

28
00:02:39,980 --> 00:02:42,160
This is the star of our show right here.

29
00:02:42,160 --> 00:02:44,140
That is an analog safe lock.

30
00:02:44,220 --> 00:02:46,880
It's not the push-button digital kind.

31
00:02:46,880 --> 00:02:51,800
It's very important because you can't back dial an electronic push-button lock.

32
00:02:53,520 --> 00:02:55,400
So what is back dialing?

33
00:02:55,660 --> 00:03:02,100
Well, back dialing allows you to determine the combination of a safe, an unlocked safe, just by fiddling with the dial.

34
00:03:02,100 --> 00:03:04,960
You say, man, what's up with that?

35
00:03:04,960 --> 00:03:06,440
It's already unlocked.

36
00:03:06,680 --> 00:03:13,100
Well, yeah, but if you know the combination, it allows you to access it at times that weren't scheduled.

37
00:03:13,100 --> 00:03:18,360
It also allows you to pass along that combination to people who shouldn't know it.

38
00:03:18,580 --> 00:03:26,860
Also, if there's like all the safes are comboed the same, even if your boss comes and opens it, well, you know the combination of all of them now, don't you?

39
00:03:27,820 --> 00:03:30,140
I'm sure that doesn't exist in the real world that way.

40
00:03:31,680 --> 00:03:39,520
Well, a little while back there was this guy named Richard Feynman, and he's a Nobel winning physicist.

41
00:03:39,520 --> 00:03:40,400
Sorry about that.

42
00:03:40,400 --> 00:03:45,040
He was stuck out in Los Alamos developing the bomb in the 1940s.

43
00:03:45,240 --> 00:03:56,120
And bored shitless, as people stuck out in the desert have become, he decided he would play around with the safe locks that were on the filing cabinets around there.

44
00:03:56,340 --> 00:03:59,620
He basically discovered a technique of back dialing.

45
00:03:59,620 --> 00:04:07,520
That, along with a little bit of social engineering, and he pretty much had down all the combos for all the locks at Los Alamos.

46
00:04:08,940 --> 00:04:13,940
Feynman did publish his little adventures here in a book called Surely You're Joking, Mr.

47
00:04:13,940 --> 00:04:14,640
Feynman.

48
00:04:14,700 --> 00:04:15,940
It's a pretty good read.

49
00:04:18,460 --> 00:04:24,100
Before you understand back dialing and how it works, you need to know a little bit about the inside of a safe's lock.

50
00:04:24,800 --> 00:04:28,600
This is kind of the abbreviated version, so I hope you can follow along.

51
00:04:29,020 --> 00:04:30,540
First of all, you get a dial.

52
00:04:31,080 --> 00:04:36,120
Attached to the dial through a shaft is something called a drive cam, and on the drive cam there's a drive pin.

53
00:04:38,700 --> 00:04:48,080
Besides all that stuff, there's also three or sometimes four wheels and a little metal device, kind of a tag team duo, called a lever and a fence.

54
00:04:51,970 --> 00:04:56,070
Just like on the drive cam, each of the wheels has a drive pin.

55
00:04:56,070 --> 00:04:59,170
It moves along with the wheel as it turns.

56
00:04:59,370 --> 00:05:09,290
On the opposite side of the wheel, they have something called a fly, and this is where the drive pin of the other wheel connects into it.

57
00:05:09,290 --> 00:05:17,490
So if you kind of imagine, you rotate one wheel around, when the drive pin of one wheel hits the fly on the other one, then both wheels start turning.

58
00:05:17,490 --> 00:05:19,250
They're locked together at that point.

59
00:05:20,870 --> 00:05:24,190
Notice that the wheels also have this little wacky thing on there called a gate.

60
00:05:24,190 --> 00:05:26,110
It's just a notch cut out of the metal.

61
00:05:27,350 --> 00:05:35,570
Once all of the gates on the wheels get lined up, what you're going to find is that the fence lever falls in and the lock can open.

62
00:05:35,650 --> 00:05:38,190
This is an unlocked safe lock, if you will.

63
00:05:38,650 --> 00:05:41,710
All the gates, all the little notches, are all lined up.

64
00:05:41,710 --> 00:05:43,910
Notice how the fence has fallen into the hole.

65
00:05:43,910 --> 00:05:50,310
There's even a gate on the cam, and notice that little tooth on the lever falls into that.

66
00:05:53,850 --> 00:06:04,670
The Feynman method backdialing is a lot like a lot of backdialing in that, in fact, all backdialing, that you have to decode the information backwards.

67
00:06:04,670 --> 00:06:08,730
That is, you're going to find out the last number of the combination of the safe first.

68
00:06:09,990 --> 00:06:18,410
Feynman relied on the fact that even if you turn the dial, until the wheel is actually moved, the lock can be turned back to its unlocked state.

69
00:06:19,530 --> 00:06:23,030
The vast majority of combination locks work in this way.

70
00:06:23,070 --> 00:06:29,190
However, some changes have been made since Feynman's time, and this is not as universal as it used to be.

71
00:06:30,050 --> 00:06:39,030
By incrementally trying numbers on the dial, that is, you keep turning a little bit more each time, then testing to see if the lock is still unlocked, you can determine what the last number was.

72
00:06:39,030 --> 00:06:43,650
Because as soon as it becomes not unlocked anymore, that's the last number.

73
00:06:45,590 --> 00:06:48,510
Let's go ahead and do a little demonstration here on the Feynman method.

74
00:06:51,330 --> 00:06:51,790
Oh,

75
00:06:56,420 --> 00:06:59,320
hang on a second.

76
00:06:59,320 --> 00:07:00,440
Sorry about that.

77
00:07:09,330 --> 00:07:10,490
Okay, we'll just go with this.

78
00:07:10,490 --> 00:07:11,850
Let me make this full screen.

79
00:07:15,300 --> 00:07:16,480
There we go.

80
00:07:17,020 --> 00:07:18,680
Let me rotate this guy around.

81
00:07:20,460 --> 00:07:22,200
This is a safe lock.

82
00:07:22,540 --> 00:07:24,440
This is actually a very serious safe lock.

83
00:07:24,440 --> 00:07:29,420
This is actually the very same sort of lock you would find on a lot of vaults in the country.

84
00:07:33,480 --> 00:07:37,860
This little guy, by comparison, is a gun safe lock.

85
00:07:37,860 --> 00:07:39,580
It's basically a piece of crap.

86
00:07:40,880 --> 00:07:42,260
This is not.

87
00:07:42,340 --> 00:07:43,960
You can feel the difference.

88
00:07:46,020 --> 00:07:47,460
Yeah, I don't.

89
00:07:47,460 --> 00:07:48,260
That's the problem.

90
00:07:48,260 --> 00:07:49,600
I'm sorry about that.

91
00:07:54,010 --> 00:07:56,410
Anyone have a flashlight, USB light?

92
00:07:57,850 --> 00:08:01,350
Willing to stand here with a lighter for the next hour and a half?

93
00:08:02,410 --> 00:08:04,210
Oh, there you go.

94
00:08:08,250 --> 00:08:10,330
Let's see if we can position this somewhere.

95
00:08:11,170 --> 00:08:13,250
Oh, just don't breathe very heavy.

96
00:08:13,350 --> 00:08:14,190
We'll be good.

97
00:08:14,190 --> 00:08:15,030
All right.

98
00:08:16,190 --> 00:08:17,630
This is a safe lock.

99
00:08:17,630 --> 00:08:20,470
It's in the unlocked position, or it can be.

100
00:08:22,950 --> 00:08:23,870
Notice we...

101
00:08:23,870 --> 00:08:24,470
Whoops.

102
00:08:24,470 --> 00:08:24,710
Hang on.

103
00:08:24,710 --> 00:08:25,250
Sorry.

104
00:08:25,710 --> 00:08:30,530
With this lock over on this side, notice how that lever moves up and down.

105
00:08:30,690 --> 00:08:38,750
Now you have that big handle on the safe, and you pull it, or sometimes in the old ones you wheel it around, and that pulls back those big metal pins on the door.

106
00:08:39,230 --> 00:08:44,930
Well, the only thing stopping them from moving is basically this little piece of metal right over there.

107
00:08:48,090 --> 00:08:53,850
With the Feynman method, what we're going to do is we're going to start turning this lock.

108
00:08:53,870 --> 00:08:55,610
Okay, turning the wheel of the lock.

109
00:08:55,870 --> 00:08:57,730
And notice I turn it a little bit.

110
00:08:59,030 --> 00:09:00,850
You see the wheels can move, right?

111
00:09:01,030 --> 00:09:02,610
See the wheels move back there?

112
00:09:04,670 --> 00:09:05,870
Let me see if I can...

113
00:09:09,050 --> 00:09:10,990
Can you see that back wheel move?

114
00:09:11,350 --> 00:09:12,090
Okay.

115
00:09:14,590 --> 00:09:16,970
Let me get it back into the locked position again.

116
00:09:17,570 --> 00:09:19,890
And I'll show you how you actually do the Feynman method.

117
00:09:19,890 --> 00:09:24,930
Now, I must say that this is what I perceive the Feynman method to be.

118
00:09:25,430 --> 00:09:30,510
In his book he very roughly described it, and so it's not actually very clear.

119
00:09:30,870 --> 00:09:31,390
Okay?

120
00:09:31,550 --> 00:09:35,290
But let me go ahead, move this forward here.

121
00:09:36,490 --> 00:09:39,130
Now notice I'm actually turning the wheel of this lock.

122
00:09:39,850 --> 00:09:42,270
I can actually move...

123
00:09:42,270 --> 00:09:44,330
I don't know if I can get you a good shot of this or not.

124
00:09:46,510 --> 00:09:48,190
There we go, that's a little bit better.

125
00:09:48,790 --> 00:09:52,270
I'm actually turning this wheel of this lock.

126
00:09:52,270 --> 00:09:59,350
But notice that that last wheel pack back there, the last piece of metal, hasn't moved.

127
00:09:59,670 --> 00:10:00,310
Okay?

128
00:10:00,570 --> 00:10:01,870
Well, gee, that's kind of weird.

129
00:10:01,870 --> 00:10:03,290
Well, yeah, it doesn't really move.

130
00:10:03,290 --> 00:10:04,390
Oh, see, now it moved.

131
00:10:04,390 --> 00:10:09,530
What we want to do is we want to find the right positions that make that move.

132
00:10:09,530 --> 00:10:10,070
Okay?

133
00:10:10,730 --> 00:10:12,210
So I'm going to turn it back.

134
00:10:13,070 --> 00:10:14,550
Turned it a little bit too far.

135
00:10:15,430 --> 00:10:17,930
Notice again I'm turning the wheel which turns the cam.

136
00:10:22,360 --> 00:10:25,360
There, and I can just, see, shuttle that guy back and forth.

137
00:10:25,360 --> 00:10:25,940
Okay?

138
00:10:32,950 --> 00:10:33,750
Okay.

139
00:10:33,990 --> 00:10:35,850
And what I'm going to do is the Feynman method.

140
00:10:35,850 --> 00:10:42,150
He would start off and he would slowly turn the dial which turns that cam back there.

141
00:10:42,150 --> 00:10:45,270
And he would keep doing that in incremental steps.

142
00:10:45,510 --> 00:10:46,030
Okay?

143
00:10:46,030 --> 00:10:49,210
And then he would come back and see if the safe was still unlocked.

144
00:10:49,210 --> 00:10:52,570
And so he'd just keep bouncing it back and back and back.

145
00:10:52,570 --> 00:10:55,350
What's going to happen is I keep turning here, and I'm going to turn very slowly.

146
00:10:55,350 --> 00:10:59,010
Pretty soon you're going to see that that back wheel starts to move.

147
00:11:01,790 --> 00:11:03,590
Oh, there it's moving, right?

148
00:11:03,590 --> 00:11:04,390
Okay.

149
00:11:04,390 --> 00:11:07,470
I can actually tell it moved right on about 40.

150
00:11:07,470 --> 00:11:13,610
And that's actually the number on the dial that's going to, that's the last digits of the safe.

151
00:11:13,610 --> 00:11:15,550
So let me swing back.

152
00:11:16,930 --> 00:11:18,570
And notice it locks back.

153
00:11:18,570 --> 00:11:20,450
You can actually feel that very easily when it locks.

154
00:11:20,450 --> 00:11:22,890
You can actually hear it too probably with this safe.

155
00:11:22,890 --> 00:11:24,590
It's very, very obvious.

156
00:11:25,750 --> 00:11:26,150
So...

157
00:11:27,390 --> 00:11:28,430
We lift it up.

158
00:11:28,430 --> 00:11:29,410
We go over.

159
00:11:29,990 --> 00:11:31,230
We try to drop it back.

160
00:11:31,230 --> 00:11:32,890
Oh, it's not going to drop back anymore.

161
00:11:32,890 --> 00:11:33,410
Okay?

162
00:11:33,410 --> 00:11:35,310
We've turned too far, basically.

163
00:11:44,810 --> 00:11:45,710
That's absolutely true.

164
00:11:45,710 --> 00:11:47,430
In fact, this assumes even worse than that.

165
00:11:47,430 --> 00:11:49,890
This assumes that the safe is actually unlocked.

166
00:11:50,070 --> 00:11:50,710
Okay?

167
00:11:51,310 --> 00:11:55,450
So this is not a general purpose sort of thing.

168
00:11:55,450 --> 00:11:56,110
Okay?

169
00:11:56,150 --> 00:11:57,350
So I can lift that guy up.

170
00:11:57,350 --> 00:11:58,370
I can turn.

171
00:12:01,910 --> 00:12:03,670
It's not going to lock again.

172
00:12:03,830 --> 00:12:08,550
Now, what you have to do is, and now that we've got that part figured out.

173
00:12:08,550 --> 00:12:09,890
Okay, it's around 40.

174
00:12:10,190 --> 00:12:13,310
I can actually start turning back the other direction.

175
00:12:14,950 --> 00:12:16,410
And then test.

176
00:12:16,410 --> 00:12:23,430
And then what I'll have to do is I'll just spin back here and actually re-lock, or re-open the safe again to determine the next number.

177
00:12:23,830 --> 00:12:25,810
It doesn't take long with a lot of practice.

178
00:12:25,810 --> 00:12:30,950
I mean, what you end up doing is you end up bouncing slightly forward, slightly back, and then test the lock.

179
00:12:30,950 --> 00:12:33,610
Forward a little bit more, back, test the lock.

180
00:12:34,070 --> 00:12:37,170
And by doing this, you can find out the first digit very easily.

181
00:12:37,170 --> 00:12:37,510
Okay?

182
00:12:37,510 --> 00:12:42,310
Because all you've got to do is turn until, when you turn back, it won't lock again.

183
00:12:42,330 --> 00:12:45,210
Now, Feynman did this in increments of five digits.

184
00:12:45,210 --> 00:12:45,850
Okay?

185
00:12:45,970 --> 00:12:52,870
That's because back then, the gate, how wide it was, that is the tolerance of the gate, was a lot wider than nowadays.

186
00:12:52,870 --> 00:12:57,310
Now you're down to probably about one on each side.

187
00:12:57,310 --> 00:12:59,450
So you probably have to do increments of three.

188
00:13:00,110 --> 00:13:03,130
So, the Feynman method is okay.

189
00:13:03,130 --> 00:13:06,790
But the problem with it is, is even he usually gave up after the second number.

190
00:13:06,790 --> 00:13:07,050
Okay?

191
00:13:07,050 --> 00:13:09,070
Even though it was only a three-digit combination.

192
00:13:09,070 --> 00:13:12,570
What he did after that was he brute-forced the final digit.

193
00:13:12,570 --> 00:13:13,010
Okay?

194
00:13:13,010 --> 00:13:15,270
Especially in his day, there's five digits, right?

195
00:13:15,270 --> 00:13:17,190
There's only really 20 possibilities.

196
00:13:17,190 --> 00:13:23,630
Even though you hear that a safe lock, a typical three-wheel safe lock, has a million combinations.

197
00:13:23,770 --> 00:13:25,610
It's a bunch of BS.

198
00:13:25,610 --> 00:13:26,090
Alright?

199
00:13:26,230 --> 00:13:31,250
Back in Feynman's day, there was gaps of five, and so each wheel is only 20 possibilities.

200
00:13:31,250 --> 00:13:31,870
Right?

201
00:13:31,870 --> 00:13:35,730
You multiply that times three, and that's what you're going to get, or a factor times three.

202
00:13:35,930 --> 00:13:38,990
So, this lock here, by the way, is a four-wheel lock.

203
00:13:39,210 --> 00:13:45,330
It's actually, theoretically, has 100 million combination possibilities.

204
00:13:45,650 --> 00:13:46,710
Which is a lot.

205
00:13:47,190 --> 00:13:52,150
But in reality, again, it really only has about a third of that.

206
00:13:52,190 --> 00:13:53,270
Or maybe two-thirds of that.

207
00:13:53,270 --> 00:13:54,430
Somewhere in that range.

208
00:13:55,690 --> 00:13:57,150
That's the Feynman method.

209
00:13:57,210 --> 00:14:01,850
It's not the greatest system in the world, because it takes a lot of time.

210
00:14:02,290 --> 00:14:07,030
But the good news is, is you can just kind of bounce back and forth on this dial and actually determine quite a bit.

211
00:14:07,190 --> 00:14:10,170
The way you do it is you feel when the gate falls back down.

212
00:14:10,170 --> 00:14:12,710
And you can actually feel that very easily, a lot of times.

213
00:14:13,410 --> 00:14:19,110
In fact, if you turn it, you're going to start pulling back that bolt once it's unlocked.

214
00:14:19,130 --> 00:14:23,470
And you can immediately feel all the super-resistance in there, you know, when you're trying to pull back that bolt.

215
00:14:23,530 --> 00:14:28,170
So, you can just kind of sit over here and actually determine quite a bit.

216
00:14:28,210 --> 00:14:33,110
When you go out to a certain distance, you just have to make sure you know, okay, I'm stopping on 30.

217
00:14:33,250 --> 00:14:34,650
I'm pulling back.

218
00:14:34,710 --> 00:14:35,590
Test it.

219
00:14:35,770 --> 00:14:36,570
Is it still open?

220
00:14:36,570 --> 00:14:37,850
Okay, we'll go to 35.

221
00:14:38,610 --> 00:14:41,070
Again, in this lock, you probably have to do increments of three.

222
00:14:41,070 --> 00:14:41,830
Okay?

223
00:14:42,170 --> 00:14:44,650
So, it works okay.

224
00:14:45,270 --> 00:14:48,970
But let's take a look at another method here.

225
00:15:02,660 --> 00:15:04,460
Alright, that's the Feynman method.

226
00:15:04,480 --> 00:15:06,460
Somehow I've lost my presentation here.

227
00:15:07,480 --> 00:15:09,480
So, what's a movie without a car chase?

228
00:15:09,480 --> 00:15:11,060
This is the NASCAR method.

229
00:15:11,060 --> 00:15:13,620
And for the NASCAR method, I'm going to switch into a different lock.

230
00:15:13,620 --> 00:15:21,800
The problem with the Feynman method, besides being kind of a pain, really, to dial back and forth so many times and get all the digits, it really takes quite a while to get that third digit.

231
00:15:21,800 --> 00:15:27,320
Because, you know, you have to figure out the first one, then you figure out the second one by bouncing through the digits.

232
00:15:27,320 --> 00:15:37,600
And then once you have those, what you have to do is you have to turn to the first one and turn to the second one for every increment you test on the third digit.

233
00:15:37,600 --> 00:15:38,120
Okay?

234
00:15:38,120 --> 00:15:40,240
Because you basically have to unlock the safe again.

235
00:15:40,240 --> 00:15:42,720
You're just kind of doing incrementally in reverse.

236
00:15:52,650 --> 00:15:56,490
What we're going to talk about now is what I call the NASCAR method.

237
00:15:56,490 --> 00:16:02,850
And the NASCAR method is basically named that because it's this one big long left-hand turn.

238
00:16:05,270 --> 00:16:10,250
Now, I hope that doesn't offend anybody, any NASCAR fan out there.

239
00:16:10,690 --> 00:16:18,970
You know, if it does, I would kind of concentrate on more important things that are probably, you know, like whether your still is still working and, you know, maybe dental hygiene.

240
00:16:18,970 --> 00:16:20,810
You know, some stuff like that.

241
00:16:21,030 --> 00:16:23,870
Anyway, NASCAR is a great sport, by the way.

242
00:16:23,870 --> 00:16:24,770
I love it.

243
00:16:26,030 --> 00:16:30,790
Anyway, the NASCAR method, this is the one long left-hand turn.

244
00:16:30,950 --> 00:16:31,390
Okay?

245
00:16:31,610 --> 00:16:34,150
There's not all this back and forth dialing, whatever.

246
00:16:34,270 --> 00:16:39,650
It's, in a lot of ways, it's a lot more stealthy because you can just literally put your hand on the dial, pull it across.

247
00:16:40,410 --> 00:16:42,410
But, in a way, it's a lot harder.

248
00:16:42,410 --> 00:16:48,090
The Feynman method was kind of like hitting you over the head with a brick as far as the feedback the lock gave you.

249
00:16:48,090 --> 00:16:48,710
Okay?

250
00:16:48,710 --> 00:16:50,350
You would pull it back.

251
00:16:50,410 --> 00:16:56,470
If the lock went to the unlocked state, if you turned any farther, it would try to pull the bolt back.

252
00:16:56,470 --> 00:16:58,690
And, I mean, it's like hitting a Mack truck.

253
00:16:58,790 --> 00:16:59,070
Okay?

254
00:16:59,070 --> 00:16:59,910
With your hand.

255
00:16:59,990 --> 00:17:02,750
So, you know, you have to put a lot of effort to actually get that bolt pulled back.

256
00:17:03,310 --> 00:17:06,490
With this method, you have to have a really fine sense of touch.

257
00:17:06,490 --> 00:17:08,330
And it takes a while to develop that.

258
00:17:08,330 --> 00:17:09,670
That's the bad news.

259
00:17:10,250 --> 00:17:21,730
The good news is, is that you can, a lot of times, easily determine the first and second wheel with just a few revolutions.

260
00:17:22,390 --> 00:17:23,790
Or, first and second digits, rather.

261
00:17:23,790 --> 00:17:27,570
With just a few, just one revolution or a couple revolutions, actually, of the wheel.

262
00:17:27,570 --> 00:17:28,470
Of the dial.

263
00:17:29,570 --> 00:17:41,950
This whole method is possible because when the drive pin of a wheel hits another wheel, it adds the weight of that wheel to the whole mechanism that you're turning.

264
00:17:42,050 --> 00:17:42,370
Okay ?

265
00:17:42,370 --> 00:17:48,310
So, basically, all you're trying to do is feel for the extra weight that occurs.

266
00:17:50,350 --> 00:17:54,190
Now, there's one little problem with all this good stuff.

267
00:18:00,550 --> 00:18:01,290
And that is...

268
00:18:02,670 --> 00:18:05,710
Let me get this guy positioned so you can see it.

269
00:18:20,970 --> 00:18:23,070
Yeah, this one might be a little bit hard to get...

270
00:18:23,070 --> 00:18:24,190
Ah, there we go.

271
00:18:24,190 --> 00:18:25,390
Now we've got a good angle.

272
00:18:25,590 --> 00:18:26,890
Let's focus pretty good on that.

273
00:18:28,110 --> 00:18:28,910
Okay.

274
00:18:31,290 --> 00:18:33,650
This lock is actually...

275
00:18:34,170 --> 00:18:35,830
It's in the unlocked state.

276
00:18:36,070 --> 00:18:36,790
Okay.

277
00:18:38,850 --> 00:18:42,250
What I'm going to do is, I'm going to go ahead and lock it.

278
00:18:42,430 --> 00:18:43,190
See, I'm going to...

279
00:18:45,670 --> 00:18:47,590
Notice that my fence lifts up.

280
00:18:48,230 --> 00:18:54,550
Now, with this lock, and with a lot of locks, if I try to go back to the unlocked state...

281
00:18:54,550 --> 00:18:55,490
Let's see, I wiggle the dial.

282
00:18:55,490 --> 00:19:01,470
Even though I don't move any of the wheel packs, if I try to go to the unlocked state again, it's not going to happen.

283
00:19:01,630 --> 00:19:02,090
Okay?

284
00:19:02,090 --> 00:19:08,010
Because they built a little mechanism in, because people like Feynman, and they said, Ah, you know, we don't want people backdialing these things.

285
00:19:08,010 --> 00:19:09,810
But you can still backdial this lock.

286
00:19:09,810 --> 00:19:11,790
This lock, by the way, is a very nice lock.

287
00:19:11,790 --> 00:19:13,170
It used to be state-of-the-art.

288
00:19:13,990 --> 00:19:17,310
Notice that the wheel packs on this one are made out of plastic.

289
00:19:17,610 --> 00:19:19,230
They actually have a fancy name for that.

290
00:19:19,230 --> 00:19:22,970
But basically, it's a plastic designed for its X-ray resistance.

291
00:19:23,150 --> 00:19:27,230
This lock is what they call a Group 1 lock, Group 1R.

292
00:19:27,330 --> 00:19:30,210
It has a manipulation resistance.

293
00:19:30,810 --> 00:19:33,230
For instance, to actually get it to...

294
00:19:38,300 --> 00:19:39,400
Sorry, here.

295
00:19:39,400 --> 00:19:41,540
Shouldn't watch the screen, because everything's backwards.

296
00:19:42,400 --> 00:19:51,640
With this lock, what you do is you actually have to turn it over to zero, and push in to try...

297
00:19:52,540 --> 00:19:58,560
That little click that just happened was trying to force down the lever.

298
00:19:58,740 --> 00:20:04,640
In a lot of safe locks, the lever is actually resting on the wheel packs.

299
00:20:04,940 --> 00:20:06,980
And that allows you to manipulate them.

300
00:20:06,980 --> 00:20:10,060
In this lock, the lever is actually above the wheel pack.

301
00:20:10,060 --> 00:20:17,440
Only when you go to zero and press in does it try to pop down and try to actually enter the actual gates.

302
00:20:17,440 --> 00:20:21,380
And so, this pretty much prevents manipulation from happening.

303
00:20:21,380 --> 00:20:22,860
Not totally, but almost.

304
00:20:23,140 --> 00:20:24,760
So this lock's a pretty good lock.

305
00:20:26,880 --> 00:20:32,260
The way you actually do the dance car method with this, is you just very simply start turning.

306
00:20:34,960 --> 00:20:37,420
And as you do, in this case actually, I've already turned it.

307
00:20:37,420 --> 00:20:39,100
Here, so let me kind of back up.

308
00:20:39,200 --> 00:20:40,180
There we go.

309
00:20:40,780 --> 00:20:43,700
With this lock, you're going to feel a couple of things when you first start turning.

310
00:20:43,700 --> 00:20:48,140
First of all, I don't know if you can see that little cam I'm wiggling down there, this little metal roller.

311
00:20:48,620 --> 00:20:50,560
Vaguely somewhere in this vicinity.

312
00:20:51,400 --> 00:20:54,920
That actually lifts the lever out.

313
00:20:55,600 --> 00:20:58,480
You can feel that as you turn this knob.

314
00:20:59,440 --> 00:21:02,180
So you have to be careful not to get fooled.

315
00:21:02,180 --> 00:21:08,260
What you want to do is when you feel that lever lift out, you want to kind of look down at the dial and see where that area is at.

316
00:21:08,260 --> 00:21:10,400
That's basically called the forbidden zone.

317
00:21:10,400 --> 00:21:14,540
And the last digit of the combination of safe can never be in the forbidden zone.

318
00:21:15,780 --> 00:21:17,820
Because otherwise it won't work properly.

319
00:21:17,820 --> 00:21:22,680
Because that's actually the part where basically the mechanics have to lift the lever around and do some stuff.

320
00:21:22,680 --> 00:21:25,900
And so you can't also have that to be the spot where it falls in at the last.

321
00:21:26,600 --> 00:21:29,100
So what I'm going to do is I'm going to start turning this.

322
00:21:29,100 --> 00:21:31,220
And again, one long left-hand turn.

323
00:21:32,920 --> 00:21:38,900
And as soon as it hits, and you can actually feel it, I can get extra resistance.

324
00:21:38,900 --> 00:21:41,800
Usually the very first wheel is very easy to detect.

325
00:21:42,120 --> 00:21:44,400
I just turn it until I feel the first wheel.

326
00:21:44,400 --> 00:21:46,220
And you just note the number.

327
00:21:46,440 --> 00:21:47,680
Then I'm going to keep on turning.

328
00:21:48,420 --> 00:21:53,900
And what is going to happen here is I'm going to drag that wheel around until it touches the next wheel.

329
00:21:53,900 --> 00:21:55,880
And the resistance increases.

330
00:21:56,080 --> 00:21:57,440
It's sitting on 50 right now.

331
00:21:57,440 --> 00:22:01,720
So I can tell you right now the second wheel is on 50.

332
00:22:01,720 --> 00:22:03,720
And let's see if we can get the third one here.

333
00:22:09,980 --> 00:22:11,020
Right there.

334
00:22:11,660 --> 00:22:12,900
Oh, 50 again.

335
00:22:12,900 --> 00:22:15,740
It's probably set to all 50s because I'm a lazy bastard.

336
00:22:15,740 --> 00:22:16,840
Anyway.

337
00:22:18,700 --> 00:22:19,900
No, actually, I'm sorry.

338
00:22:19,900 --> 00:22:21,580
That was a...

339
00:22:21,580 --> 00:22:23,180
That was the gap there.

340
00:22:23,180 --> 00:22:24,140
I shouldn't have done that.

341
00:22:24,140 --> 00:22:24,820
Anyway.

342
00:22:25,240 --> 00:22:28,260
The third wheel is particularly hard to detect.

343
00:22:28,260 --> 00:22:31,800
Normally you only end up with the first couple of digits.

344
00:22:31,920 --> 00:22:36,440
It also really depends on how well the lock is maintained.

345
00:22:36,440 --> 00:22:40,400
If some guy has just come out and oiled the sucker, man, you're going to be in a world of hurt.

346
00:22:40,400 --> 00:22:42,700
Because it's going to turn really smoothly.

347
00:22:43,060 --> 00:22:45,000
And that causes a lot of problems.

348
00:22:45,960 --> 00:22:47,820
Also with a lock...

349
00:22:47,820 --> 00:22:48,980
Let me switch back.

350
00:22:53,850 --> 00:22:55,230
Like this guy.

351
00:22:57,370 --> 00:22:58,290
Man, it's rough.

352
00:22:58,290 --> 00:22:59,250
Everything's backwards.

353
00:22:59,390 --> 00:23:02,270
Notice this guy, the wheel, is like way over here.

354
00:23:02,270 --> 00:23:04,570
And like all the lock goodies are way over there.

355
00:23:04,570 --> 00:23:06,510
So like, what's up with that, you know?

356
00:23:06,630 --> 00:23:14,090
What's up with that is one of the favorite safe cracking techniques is to actually knock off this dial.

357
00:23:14,090 --> 00:23:16,010
Usually with, you know, just like a big hammer.

358
00:23:16,010 --> 00:23:18,610
The, you know, the big fucking hammer technique.

359
00:23:18,650 --> 00:23:21,830
And then you take a punch.

360
00:23:21,870 --> 00:23:27,690
And you punch out, you know, the little drive shaft in there, basically.

361
00:23:27,710 --> 00:23:31,150
Now, if that drive shaft was sitting over here in this lock mechanism...

362
00:23:31,150 --> 00:23:32,930
I'm sorry, you can't see me where I'm tapping.

363
00:23:32,930 --> 00:23:34,170
And I can't see where...

364
00:23:34,170 --> 00:23:40,850
If the drive shaft was sitting over here, you might actually punch those wheels and just blow the hell out of the whole insides.

365
00:23:41,350 --> 00:23:43,870
So that may allow you to open the safe, for instance.

366
00:23:43,870 --> 00:23:45,450
That was actually a very popular technique.

367
00:23:45,450 --> 00:23:49,530
So they got a little bit smart and they said, hey, let's put the wheel over here.

368
00:23:49,950 --> 00:23:50,330
Okay.

369
00:23:51,570 --> 00:23:54,450
Actually, in this lock...

370
00:23:59,390 --> 00:24:01,230
You say, well, gee, you know, that's like a...

371
00:24:01,230 --> 00:24:03,650
You said it's like a government high security lock, you know.

372
00:24:03,650 --> 00:24:06,190
Why would the feds be using something so crappy as this?

373
00:24:06,390 --> 00:24:08,550
Well, actually they got a little bit smarter.

374
00:24:08,550 --> 00:24:11,990
What they found out was, okay, well, we'll let you knock the dial off.

375
00:24:11,990 --> 00:24:13,110
We'll let you punch it.

376
00:24:13,370 --> 00:24:16,830
What's going to happen is, is this is a special kind of breakaway back.

377
00:24:16,830 --> 00:24:21,130
And part of it is designed to actually crack and fly off.

378
00:24:21,130 --> 00:24:26,550
But when that happens, there's like a little internal locking mechanism that goes into effect.

379
00:24:26,550 --> 00:24:27,970
It's called a re-locker.

380
00:24:27,990 --> 00:24:31,750
And that re-locker will prevent the bolt from actually opening.

381
00:24:31,750 --> 00:24:40,350
In fact, you're like really royally screwed if you go into a situation where you're trying to open up somebody's safe and it's been punched and the re-locker's fired.

382
00:24:40,350 --> 00:24:44,770
In fact, ask any safe technician, their big fear is that the re-locker's fired.

383
00:24:45,210 --> 00:24:47,550
Because a lock you can work on.

384
00:24:47,550 --> 00:24:52,150
You can drill a hole, you can get in there with a borescope, you can see the wheel peg, you can open it up.

385
00:24:52,210 --> 00:24:54,110
That assumes you got a working lock, doesn't it?

386
00:24:54,210 --> 00:24:56,010
Okay, not if the re-locker's are fired.

387
00:24:56,010 --> 00:24:58,510
It's not if the lock's all shot to hell from being punched.

388
00:24:58,890 --> 00:25:03,450
So, they actually do have a protection against that.

389
00:25:03,630 --> 00:25:10,150
But, you know, banks wearing the old belts and suspenders, they like to have their dials offset.

390
00:25:10,150 --> 00:25:11,370
It makes it even safer.

391
00:25:11,370 --> 00:25:16,470
Let me stop down and take some questions.

392
00:25:16,570 --> 00:25:21,150
I know this is kind of hard to visualize, but yes.

393
00:25:24,610 --> 00:25:26,670
No, the safe has to be unlocked.

394
00:25:27,250 --> 00:25:28,870
It has to be unlocked as well.

395
00:25:28,970 --> 00:25:34,370
Again, it's kind of a limited technique, but it's basically a privileged escalation attack.

396
00:25:34,370 --> 00:25:38,990
It allows you to get access whenever you're not supposed to have access.

397
00:25:38,990 --> 00:25:44,070
Also, a very common method is something called day locking.

398
00:25:44,090 --> 00:25:45,890
I don't know if everyone's ever heard of that.

399
00:25:46,070 --> 00:25:55,170
But since the manager of the Best Buy figures that nobody knows what the hell is going on in the safe, what they do is they unlock the safe.

400
00:25:55,170 --> 00:26:03,810
But just like Feynman found out, they figure out, hey, you can turn the dial back a little bit, and the safe appears to be locked at that point, but it's not really.

401
00:26:03,810 --> 00:26:08,550
All you've got to do is just turn it back to the last digit, and it'll reopen.

402
00:26:08,550 --> 00:26:10,950
That's how Feynman determines the last digit.

403
00:26:11,050 --> 00:26:14,430
He just turns it until it won't open anymore.

404
00:26:14,630 --> 00:26:17,030
So in other words, let's say the last digit was 30.

405
00:26:17,030 --> 00:26:20,930
What you would do to day lock it is you would turn this a little bit past 30, like 35.

406
00:26:21,770 --> 00:26:25,010
Now, to open the safe back up, all you've got to do is dial the last digit back again.

407
00:26:25,010 --> 00:26:30,010
You just wheel it around and past zero to 30, and it'll pull the wheel back up, and hey, it's unlocked.

408
00:26:30,210 --> 00:26:31,350
It's just quick, right?

409
00:26:31,350 --> 00:26:32,770
So it saves you some time.

410
00:26:32,930 --> 00:26:35,990
But if you know it's day locked, well, it's unlocked.

411
00:26:36,430 --> 00:26:39,350
And if it's unlocked, you can determine the combination.

412
00:26:39,990 --> 00:26:44,630
So it's not a super huge exploit, but occasionally it can be very powerful.

413
00:27:02,780 --> 00:27:04,620
I'm sorry, I don't understand the question.

414
00:27:13,810 --> 00:27:14,490
That's true.

415
00:27:14,490 --> 00:27:17,890
As far as I know, there hasn't been a whole lot of defense.

416
00:27:17,890 --> 00:27:19,690
Well, there have been a defense against the back dialing.

417
00:27:19,690 --> 00:27:22,350
There's been a lot of defense against the Feynman method.

418
00:27:24,950 --> 00:27:25,750
Let me...

419
00:27:33,190 --> 00:27:40,470
Well, when you first start turning, what you're going to be dragging is only the cam that's directly attached to the dial.

420
00:27:40,690 --> 00:27:46,670
And eventually, it's going to come around, and the drive pin on there is going to hit the fly on the first wheel.

421
00:27:46,790 --> 00:27:48,890
Then you're going to pick up the first wheel.

422
00:27:48,890 --> 00:27:51,370
You should be able to detect the change and drag.

423
00:27:57,860 --> 00:27:58,860
I'm sorry?

424
00:27:59,860 --> 00:28:01,400
Okay, I'm sorry.

425
00:28:01,400 --> 00:28:02,860
I can't get it.

426
00:28:04,520 --> 00:28:11,600
The... In Feynman's... To protect against Feynman's method, what they did, by the way, was over...

427
00:28:11,600 --> 00:28:13,540
Let's go back to video here.

428
00:28:17,610 --> 00:28:24,450
This little guy right here is the actual metal shaft, or the actual metal bolt that sticks out to actually lock the safe.

429
00:28:24,530 --> 00:28:30,470
And you can't see it, but behind here, they actually put a small ball bearing and a spring.

430
00:28:30,470 --> 00:28:33,510
And there's a little dimple in the back of this guy.

431
00:28:33,570 --> 00:28:38,150
So what happens is, when you unlock most modern safes...

432
00:28:38,150 --> 00:28:54,850
I'm sorry, when you re-lock them, what happens is that the dimple pulls this shaft and the lever arm here back.

433
00:28:54,850 --> 00:28:56,810
It kind of pops it back a little bit.

434
00:28:56,810 --> 00:29:01,850
And that prevents it from falling right back into the gates if you realign the gates again.

435
00:29:02,050 --> 00:29:05,510
So that's what prevents the Feynman method from occurring.

436
00:29:05,510 --> 00:29:13,190
As far as I know, in a mechanical safe lock, there's really no defense right now against a NASCAR sort of attack.

437
00:29:13,290 --> 00:29:17,150
The trick is, again, it depends on how well it's been maintained.

438
00:29:17,150 --> 00:29:23,790
If you get an older lock that really hasn't seen a locksmith, or probably a safe technician in a long time, you're probably going to be in good shape on that.

439
00:29:23,790 --> 00:29:26,990
Because there's going to be quite a bit of drag, especially on the first and second digits.

440
00:29:27,070 --> 00:29:28,570
Pulling off that third one is hard.

441
00:29:28,570 --> 00:29:32,690
You've got to remember that a lot of times you've got four inches of steel between you and that wheel pack.

442
00:29:32,690 --> 00:29:34,530
It makes it hard.

443
00:29:34,850 --> 00:29:36,910
Practice helps a ton on this guy.

444
00:29:40,700 --> 00:29:41,660
Yeah.

445
00:29:42,280 --> 00:30:02,800
But we're going to switch from this guy, the manual method, to electronic safes here in just a second.

446
00:30:12,870 --> 00:30:16,590
Let me just give a quick overview on some of the good and bad things about this.

447
00:30:16,590 --> 00:30:19,130
Backdialing is quick and easy with a little bit of practice.

448
00:30:19,130 --> 00:30:20,790
It's really not that hard.

449
00:30:20,930 --> 00:30:23,610
Backdialing can be the size of just fiddling with the lock.

450
00:30:23,610 --> 00:30:27,790
So you can just walk up to it and do a NASCAR turn on a safe.

451
00:30:27,790 --> 00:30:36,810
All you've got to do is glance down whenever you feel extra drag and see if that's either the forbidden zone kicking in there or an actual wheel picking up.

452
00:30:37,790 --> 00:30:46,050
Backdialing works on most mechanical safe locks, including 2M, 1, 1R, especially the NASCAR method.

453
00:30:46,050 --> 00:30:49,610
The Feynman method will pretty much only work on older safe locks.

454
00:30:50,290 --> 00:30:53,170
The information gained can be used for manipulation.

455
00:30:53,230 --> 00:30:58,330
If you already know a couple of the digits, or one of them even, that helps a lot in manipulation.

456
00:30:58,330 --> 00:31:00,930
It also obviously just helps a lot in brute forcing it.

457
00:31:03,230 --> 00:31:04,950
Backdialing only works with safe open.

458
00:31:04,950 --> 00:31:09,750
Obviously that's a huge bummer, and you're saying, oh man, you know, but it actually can be powerful.

459
00:31:09,750 --> 00:31:15,290
Because actually knowing the combination is a lot different from merely just having access to it during the day.

460
00:31:15,290 --> 00:31:17,490
Feynman just had access to it during the day.

461
00:31:17,490 --> 00:31:24,870
He wasn't even supposed to open up all of these atomic bomb secret, you know, filing cabinets that they had around there.

462
00:31:24,870 --> 00:31:28,810
Instead he just walked up and he just played with the lock while he was talking with somebody.

463
00:31:28,810 --> 00:31:29,710
No one ever noticed.

464
00:31:29,710 --> 00:31:31,450
No one actually found out the Feynman method.

465
00:31:31,450 --> 00:31:33,290
They thought he was some mechanical guru.

466
00:31:35,530 --> 00:31:42,950
Sometimes also, especially with the NASCAR method, you'll end up with the safe being locked because you won't be able to determine the third wheel.

467
00:31:42,950 --> 00:31:48,670
In reality, that's usually not such a big deal because safes get accidentally locked all the time.

468
00:31:48,990 --> 00:31:51,370
You know, people bump them and stuff like that.

469
00:31:51,370 --> 00:31:57,430
So most of the time it's not really considered a security threat that the safe, oh gee, was unlocked and now it's locked.

470
00:31:57,430 --> 00:31:59,990
Well, you know, who fucked with the safe?

471
00:32:00,070 --> 00:32:01,230
That's about it.

472
00:32:01,290 --> 00:32:03,510
That's the only security threat raised.

473
00:32:04,530 --> 00:32:06,930
The Feynman method usually takes too long.

474
00:32:06,990 --> 00:32:11,370
It's a lot of jiggling back and forth to try and bounce around and find all the numbers.

475
00:32:11,370 --> 00:32:13,970
And you really only get one time with an open safe.

476
00:32:13,970 --> 00:32:18,970
Obviously, if you screw up on either method, you're going to end up with a locked safe and you can't do back dialing.

477
00:32:20,910 --> 00:32:23,210
How do you protect your safe from back dialing?

478
00:32:23,210 --> 00:32:28,870
First of all, don't leave the safe unlocked or day locked, which is just as bad.

479
00:32:29,330 --> 00:32:34,270
Some electromechanical locks can also automatically relock themselves after a short period of time.

480
00:32:34,270 --> 00:32:35,190
That's cool.

481
00:32:35,250 --> 00:32:38,110
Mechanical locks can also be supplemented with things like alarms.

482
00:32:38,110 --> 00:32:47,930
Use of time locks, that is, you can only open the safe during business hours, well, that pretty much screws the whole point of trying to figure out how to open it up later on.

483
00:32:48,410 --> 00:32:56,530
Additional security measures such as video surveillance, guards, perimeter alarms, all that good general security stuff is a great idea to help protect your safe.

484
00:32:58,630 --> 00:33:01,990
Let's talk a little bit about my friend Spike the WonderSafe.

485
00:33:02,990 --> 00:33:08,290
If you ever wondered why I called it that, it's because I kind of wondered why Spike has even called a safe.

486
00:33:11,290 --> 00:33:16,150
Spike's full name is the Sentry A5835 Fire Safe.

487
00:33:16,790 --> 00:33:20,290
It's one model out of a dozen that are all very similar.

488
00:33:20,930 --> 00:33:22,010
They're very popular.

489
00:33:22,010 --> 00:33:24,570
Obviously, you go around and you see tons of Sentry safes.

490
00:33:24,810 --> 00:33:32,130
Sentry doesn't really claim that this provides significant burglar resistance, but people just generally assume that it does.

491
00:33:32,130 --> 00:33:39,530
Kind of like when they wander down by that hardened shackled master padlock and think it's really a significant barrier to entry.

492
00:33:40,270 --> 00:33:43,210
However, you know, like I say, Spike is terribly misunderstood.

493
00:33:43,270 --> 00:33:44,690
He's great in a fire.

494
00:33:45,250 --> 00:33:52,890
I've actually had read accounts of many locksmiths that said, man, they pulled a Sentry out of a fire, you know, they opened it up, all the contents was great.

495
00:33:52,890 --> 00:33:54,710
I mean, they really are good in a fire.

496
00:33:55,550 --> 00:33:59,250
However, to keep burglars out, or just whoever, they're pretty sucky.

497
00:34:00,850 --> 00:34:03,050
Now, Spike doesn't look totally wimpy.

498
00:34:03,050 --> 00:34:05,770
He has something kind of like two-factor authentication.

499
00:34:05,930 --> 00:34:11,230
First of all, he's got a tubular lock, and also electronic keypad is five-digit combination.

500
00:34:11,230 --> 00:34:13,410
Well, that's pretty stout, you know.

501
00:34:13,410 --> 00:34:15,410
God, I hate to guess five digits.

502
00:34:15,590 --> 00:34:17,970
You know, but unfortunately, it looks kind of deceiving.

503
00:34:18,910 --> 00:34:27,990
Spike's security problems all began back in 2000 when this guy named Freddy, you know, there's Freddy the Wire, started spilling safe-cracking secrets on the Alt Locksmith news group.

504
00:34:27,990 --> 00:34:29,910
I don't know if you guys ever frequent Alt Locksmith.

505
00:34:29,910 --> 00:34:32,470
It's pretty much useless.

506
00:34:32,770 --> 00:34:42,790
That's because a lot of locksmiths hang around it, and they like to basically dump on anything that's... any information that really comes through there.

507
00:34:42,790 --> 00:34:44,110
They spread a lot of misinformation.

508
00:34:44,350 --> 00:34:47,050
There's really not a hotbed of good information.

509
00:34:47,070 --> 00:34:51,490
If you want a hotbed of good information, go to Lockpicking101 or groups like that.

510
00:34:52,090 --> 00:34:56,030
One of the secrets that Freddy tipped was something called spiking.

511
00:34:56,790 --> 00:35:04,370
Spiking involves passing electric current inside the safe to actually open it.

512
00:35:05,350 --> 00:35:13,910
An electronic safe, basically, when you type the numbers on the keypad, all it does is compare that with a little digital chip inside and say, hmm, yeah, that's the right number.

513
00:35:13,910 --> 00:35:19,110
And it pops electric current inside the safe, which activates a solenoid.

514
00:35:19,110 --> 00:35:21,550
A solenoid is basically just an electromagnet.

515
00:35:21,590 --> 00:35:25,610
And it pulls back the bolt, which allows you to turn the handle, which allows you to open the safe.

516
00:35:26,850 --> 00:35:37,270
In 2002, there was a news group, actually a website, and a guy on there, they were having a discussion about whether you should buy electronic locks for your gun safes or whatever, because they're a lot more convenient.

517
00:35:37,390 --> 00:35:38,610
They're a lot quicker.

518
00:35:39,310 --> 00:35:44,490
Dialing a regular conventional mechanical safe lock is kind of a pain in the ass sometimes, especially if you're in a hurry.

519
00:35:45,470 --> 00:35:50,590
But one guy on there said, you know, he works as the chaplain in a penitentiary.

520
00:35:50,870 --> 00:35:53,610
And the prisoners there said, oh man, don't do that.

521
00:35:53,610 --> 00:35:55,730
You can open up those things with a nine-volt battery.

522
00:35:56,810 --> 00:35:57,830
Well, you know what?

523
00:35:57,950 --> 00:35:59,150
They were right.

524
00:36:01,090 --> 00:36:10,870
So, obviously, they've known for quite a while the people who shouldn't, so it's probably a good idea for everyone else to kind of learn what to avoid in electronic safe locks.

525
00:36:11,690 --> 00:36:14,790
You know, again, Spike has this two-factor authentication now, right?

526
00:36:14,890 --> 00:36:20,130
So, you know, even if you found out the five-digit code, you still have to work on the tubular key.

527
00:36:20,130 --> 00:36:24,070
You know, again, unfortunately for Spike, he's kind of having this run of bad luck.

528
00:36:24,810 --> 00:36:28,130
Remember the kryptonite bicycle lock in the Big Pen?

529
00:36:28,270 --> 00:36:32,050
You know, they had that Texas grudge match and the Big Pen won.

530
00:36:32,150 --> 00:36:32,910
Yeah.

531
00:36:33,150 --> 00:36:36,150
Unfortunately, Spike's pretty much got the same thing going on.

532
00:36:50,100 --> 00:36:52,880
Ah, there's our instruments of destruction.

533
00:36:52,940 --> 00:36:55,820
That is a Flexmate Grip Pen.

534
00:36:56,140 --> 00:36:57,980
Flex Grip Elite, actually.

535
00:36:58,160 --> 00:37:00,700
Oh, and that's our little Sentry Safe Spike.

536
00:37:01,400 --> 00:37:07,000
Here's the most complicated part of this process, removing the ends of the cap of the pen.

537
00:37:07,180 --> 00:37:10,020
This took the longest, actually, of the whole thing.

538
00:37:15,020 --> 00:37:16,220
Oh, there we go.

539
00:37:16,780 --> 00:37:19,120
Notice you, this is a very difficult technique.

540
00:37:19,120 --> 00:37:22,860
It involves inserting the pen into the tubular lock.

541
00:37:22,860 --> 00:37:24,820
You have to press kind of hard.

542
00:37:25,260 --> 00:37:26,400
Yeah, that's, okay.

543
00:37:26,400 --> 00:37:27,880
Oh, there we go.

544
00:37:33,630 --> 00:37:40,670
I was going to do this demo live, but lugging around 30 pounds worth of safe locks was enough, and I figured the 100-pound safe could sit in the office, you know?

545
00:37:42,470 --> 00:37:45,650
I'm going to take it out just to prove that that wasn't a fluke.

546
00:37:45,650 --> 00:37:49,430
Although I am cheating here, because actually, this pen has basically been an impression.

547
00:37:49,430 --> 00:37:53,690
It's basically a key at this point, so, you know, it's even easier the second time around.

548
00:37:54,410 --> 00:37:54,910
Yeah.

549
00:37:55,070 --> 00:37:57,170
Notice I locked it back again, too.

550
00:37:57,170 --> 00:38:02,270
This, you know, works both ways, because you don't really want people to know that you've been playing around with their sentry safe.

551
00:38:04,650 --> 00:38:07,830
Okay, now we've got to tackle the other part of our two-factor authentication.

552
00:38:08,310 --> 00:38:10,950
Well, first thing we do, we've got to get rid of that keypad.

553
00:38:11,570 --> 00:38:15,010
Fortunately, it's made out of good industrial-grade plastic.

554
00:38:16,610 --> 00:38:25,270
Get rid of all those bits we don't really need, and I'm going to get to flip this around, and I do a slightly different camera shot here to kind of show you a little bit better what's going on.

555
00:38:25,690 --> 00:38:28,590
It's hard to see, but notice there's two plugs there.

556
00:38:28,590 --> 00:38:35,750
One's got a black-and-white wire on the bottom, and the other one's got a black, I'm sorry, black-and-red wire on the bottom, and the top one's got a black-and-white wire.

557
00:38:36,030 --> 00:38:44,250
If you look at the battery pack, it's got red and black coming out of it, and if you look very carefully, you'll notice that the black-and-white wire runs inside the safe.

558
00:38:44,550 --> 00:38:46,110
Oh, gee, I wonder what that's for.

559
00:38:46,110 --> 00:38:47,170
That's a 9-volt battery.

560
00:38:47,170 --> 00:38:50,730
I put tape around the end to keep the wire separated for me very conveniently.

561
00:38:53,250 --> 00:38:53,650
And...

562
00:38:53,650 --> 00:38:54,330
Bop!

563
00:39:06,520 --> 00:39:10,620
It took my dog Ginger three weeks to learn that trick, though, so it's not that easy.

564
00:39:10,620 --> 00:39:11,720
It's really not.

565
00:39:12,340 --> 00:39:17,840
Actually, this is the other hard part, is getting that goddamn plastic thing back on.

566
00:39:18,240 --> 00:39:21,380
But, you know, you don't want to leave a messy safe, you know.

567
00:39:21,380 --> 00:39:23,040
That's what I always say, you know.

568
00:39:23,540 --> 00:39:25,540
Oh, look, so we're all locked back up again.

569
00:39:25,540 --> 00:39:26,680
Tubular lock's in.

570
00:39:26,680 --> 00:39:28,000
Pop that thing out.

571
00:39:28,320 --> 00:39:29,660
And that's it.

572
00:39:30,180 --> 00:39:32,640
You know, obviously, I went in a big hurry there.

573
00:39:32,640 --> 00:39:34,920
That whole video is three minutes long.

574
00:39:34,920 --> 00:39:38,440
The actual opening of the safe part is, like, two minutes long.

575
00:39:38,620 --> 00:39:41,600
Obviously, if I was rushing it, you'd probably do it in about a minute.

576
00:39:41,780 --> 00:39:43,560
And that's to open and close it.

577
00:39:44,320 --> 00:39:48,800
So that's about it for Spike the Sentry WonderSafe here.

578
00:39:49,700 --> 00:39:51,460
Here's some tips, folks.

579
00:39:51,660 --> 00:39:57,240
Never assume a fire-resistant safe has any burglar resistance, okay, unless it's actually rated for them.

580
00:39:57,240 --> 00:40:00,340
And there are safes that are both burglar and fire-resistant.

581
00:40:01,440 --> 00:40:05,800
Specifically ask, when you buy an electronic safe, if it's spike-resistant.

582
00:40:06,220 --> 00:40:10,120
If you're buying for somebody who doesn't know what that means, you probably need to go someplace else.

583
00:40:10,640 --> 00:40:21,500
If, you know, the locksmith guy's jaws drop open and, you know, you realize you actually know what you're talking about, then he may actually sell you a decent safe.

584
00:40:22,440 --> 00:40:26,940
A lot of these safes nowadays are really crappy.

585
00:40:27,060 --> 00:40:30,780
And you've got to be really careful, especially on the cheap gun safes.

586
00:40:30,780 --> 00:40:33,680
I showed you that gun safe lock earlier and told you it was a piece of crap.

587
00:40:33,680 --> 00:40:34,160
It is.

588
00:40:34,160 --> 00:40:35,100
It's mechanical.

589
00:40:35,160 --> 00:40:38,720
The electronic ones are also generally pretty crappy.

590
00:40:39,060 --> 00:40:42,820
There is a danger, by the way, of opening a safe via spiking.

591
00:40:42,820 --> 00:40:44,640
I used a 9-volt battery.

592
00:40:45,020 --> 00:40:49,160
Quite frankly, the battery pack in that machine is, I think, only produces 6 volts.

593
00:40:49,160 --> 00:40:56,100
And you can actually damage the electronics on this circuit board by spiking.

594
00:40:56,100 --> 00:41:00,280
Sometimes they're actually made to damage the circuit board by spiking.

595
00:41:00,280 --> 00:41:01,920
That's their spike resistance, if you will.

596
00:41:01,920 --> 00:41:04,160
It also allows them to sell another safe.

597
00:41:04,740 --> 00:41:07,080
So that's a really great idea, I guess.

598
00:41:07,100 --> 00:41:09,600
Anyway, very important.

599
00:41:09,600 --> 00:41:11,880
Limit your access to fire-resistant safes.

600
00:41:11,880 --> 00:41:15,880
They're generally just not that great as far as actually protecting your valuables.

601
00:41:15,880 --> 00:41:20,780
Also, too, if you come up against a conventional safe cracker, he's going to break out something called a drill.

602
00:41:20,880 --> 00:41:25,700
And he's going to drill through this white, fluffy cotton stuff that they have inside fireproof safes.

603
00:41:25,700 --> 00:41:28,800
And let me tell you, it doesn't slow you down nearly as much as hard plate.

604
00:41:28,940 --> 00:41:33,180
So it's just generally a good idea to keep an eye on your fireproof safes.

605
00:41:33,480 --> 00:41:35,640
Alarms, video guards, surveillance.

606
00:41:36,500 --> 00:41:44,240
If you don't get anything else out of this whole conference, you should realize that good security always relies on overlapping layers of security.

607
00:41:44,240 --> 00:41:49,340
Never depend on a single firewall or that single safe to be safe.

608
00:41:49,520 --> 00:41:56,360
Make sure you wrap it around with other IDSs and security guards, alarm systems, and things like that.

609
00:41:56,360 --> 00:41:59,320
It's the only way you can stay safe.

610
00:41:59,360 --> 00:42:00,560
Questions?

611
00:42:01,500 --> 00:42:02,500
Yes.

612
00:42:06,830 --> 00:42:10,550
Yeah, you can, although a lot of times they get a little bit sharper here.

613
00:42:10,550 --> 00:42:18,230
And if you don't get the polarity right, or sometimes you could probably even check and have some sort of pre-circuitry.

614
00:42:18,230 --> 00:42:20,170
And say, okay, well, I haven't typed in the digits.

615
00:42:20,170 --> 00:42:24,710
So I'm basically in, if any electricity comes down this pike, I'm blowing myself up mode.

616
00:42:25,130 --> 00:42:27,590
So there are spike-resistant safes.

617
00:42:27,590 --> 00:42:28,410
It's not impossible.

618
00:42:28,410 --> 00:42:30,730
It's just when you deal on a cheaper level, you don't normally get it.

619
00:42:30,730 --> 00:42:31,350
Yeah.

620
00:42:33,790 --> 00:42:37,090
For fire resistance, I love Sentry, actually.

621
00:42:37,290 --> 00:42:40,950
But, you know, they're just not burglar-resistant.

622
00:42:40,950 --> 00:42:44,290
And, unfortunately, to pay to get both is pretty expensive.

623
00:42:45,150 --> 00:42:45,770
Yeah.

624
00:42:48,530 --> 00:42:49,490
eBay.

625
00:42:49,490 --> 00:43:01,310
Everything I got here is on eBay, except the Moss Hamilton X8, which is the world's most secure lock, except for the X9, which came out in...

626
00:43:01,310 --> 00:43:02,010
Anyway.

627
00:43:02,250 --> 00:43:03,630
But the...

628
00:43:03,630 --> 00:43:04,370
No, it's...

629
00:43:04,370 --> 00:43:07,590
You'll only find this lock on high...

630
00:43:07,590 --> 00:43:09,190
Yeah, let me switch back here.

631
00:43:09,190 --> 00:43:10,390
Sorry, it takes so long.

632
00:43:12,610 --> 00:43:17,630
I suppose they had this all set up to automatically switch, and, of course, that failed spectacularly.

633
00:43:21,550 --> 00:43:23,730
This is probably going to take a while here, sorry.

634
00:43:24,910 --> 00:43:26,330
And I'm running out of time.

635
00:43:32,550 --> 00:43:33,690
Oh, there we go.

636
00:43:34,130 --> 00:43:34,750
OK.

637
00:43:34,870 --> 00:43:36,430
This is the Moss Hamilton.

638
00:43:36,510 --> 00:43:38,990
It looks like a mechanical safe lock.

639
00:43:38,990 --> 00:43:40,030
It is not.

640
00:43:40,030 --> 00:43:47,330
It is actually very much like one of those radios you... survival radios you get that's got the crank on the side, where you have to, like, crank it up.

641
00:43:47,370 --> 00:43:51,310
Basically, with the Moss Hamilton, you have to turn it until you power it up.

642
00:43:51,310 --> 00:43:53,190
It's actually fully electronic.

643
00:43:53,190 --> 00:43:57,510
With the Moss Hamilton, all of the electronics are inside the safe.

644
00:43:57,510 --> 00:43:59,650
They're behind that four inches of hard plate.

645
00:43:59,690 --> 00:44:00,070
OK.

646
00:44:00,150 --> 00:44:02,270
So, you can spike this devil.

647
00:44:02,270 --> 00:44:03,590
It's actually been done.

648
00:44:03,990 --> 00:44:06,030
But it's not easy.

649
00:44:06,030 --> 00:44:08,810
And you have to knock the dial off to get in.

650
00:44:08,930 --> 00:44:13,490
And the government specifications for this was, A, it needs to be secured.

651
00:44:13,490 --> 00:44:13,870
That's great.

652
00:44:13,870 --> 00:44:14,590
That's wonderful.

653
00:44:14,590 --> 00:44:18,230
But they wanted to make sure that no one could get in in a stealthy way.

654
00:44:18,230 --> 00:44:18,470
OK.

655
00:44:18,470 --> 00:44:23,510
You know, a lot of the stuff we talked about with back dialing and stuff and spiking, they're very stealthy.

656
00:44:23,510 --> 00:44:25,390
You don't know that something's happened.

657
00:44:25,490 --> 00:44:28,190
So, if you knock the dial off this sucker, sure, you can get into it.

658
00:44:28,190 --> 00:44:32,250
I mean, you know, you can, you know, take explosives to the safe and get into it.

659
00:44:32,290 --> 00:44:34,130
But people will know you've been there.

660
00:44:34,130 --> 00:44:34,390
OK.

661
00:44:34,390 --> 00:44:35,670
And that's all they're worried about.

662
00:44:35,670 --> 00:44:36,630
It's going to take time.

663
00:44:36,630 --> 00:44:39,190
It's going to take... and leave a big trail.

664
00:44:39,810 --> 00:44:43,030
So, this is one of the most secure locks in the world.

665
00:44:43,030 --> 00:44:44,630
They do have the new nine model.

666
00:44:44,630 --> 00:44:49,030
That's the only reason why I own this one is because, of course, they closed this out and I got it, you know, reasonably cheap.

667
00:44:50,190 --> 00:44:51,450
It is a great lock.

668
00:44:51,450 --> 00:44:55,330
And, boy, this would definitely, you know, work great on your front door.

669
00:44:57,730 --> 00:44:58,690
Anything else?

670
00:44:58,690 --> 00:45:01,370
Oh, I'm afraid I've got to head on out here.

671
00:45:01,370 --> 00:45:04,470
If anyone else has any questions, I'll be out that way.

672
00:45:04,890 --> 00:45:06,770
And you can look at some of this stuff.

673
00:45:06,770 --> 00:45:08,210
Thank you.