Told that everything will run on schedule, although at 4 o'clock in the tent, we're going to have the Hacker Foundation and Dunka Gardner Analyst.
In the tent.
They're going to have the Hacker Foundation in the tent with Dunka Gardner Analyst, I guess, at 4 o'clock in the tent.
And this is Thomas, and he'll be cracking safes for us.
Three letters?
Welcome! Can you hear me?
No.
How's that?
No.
How's that? A little bit better?
Not sure if the other one will reach. Let's see.
Do we have an audio guy in here? Is this on?
How about that?
Better?
Okay, just have to get up here. Alright.
Well, if you guys just missed a really exciting talk about how to equalize wealth in the economy.
Hey, you guys just missed a really exciting talk about how to equalize wealth in the economy.
Of course, one thing they didn't cover was safe cracking.
Fortunately, we're going to pick up here and get that little bit done.
Today we've got a little double feature going on here.
First of all, we're going to talk about a couple of techniques.
One is back dialing, and that's going to be our first topic.
This is the star of our show right here. That is an analog safe lock.
It's not the push-button digital kind.
It's very important because you can't back dial an electronic push-button lock.
So what is back dialing?
Well, back dialing allows you to determine the combination of a safe, an unlocked safe, just by fiddling with the dial.
You say, man, what's up with that? It's already unlocked.
Well, yeah, but if you know the combination, it allows you to access it at times that weren't scheduled.
It also allows you to pass along that combination to people who shouldn't know it.
Also, if there's like all the safes are comboed the same, even if your boss comes and opens it,
well, you know the combination of all of them now, don't you?
I'm sure that doesn't exist in the real world that way.
Well, a little while back there was this guy named Richard Feynman, and he's a Nobel winning physicist.
Sorry about that.
He was stuck out in Los Alamos developing the bomb in the 1940s.
And bored shitless, as people stuck out in the desert have become,
he decided he would play around with the safe locks that were on the filing cabinets around there.
He basically discovered a technique of back dialing.
That, along with a little bit of social engineering, and he pretty much had down all the combos for all the locks at Los Alamos.
Feynman did publish his little adventures here in a book called Surely You're Joking, Mr. Feynman.
It's a pretty good read.
Before you understand back dialing and how it works, you need to know a little bit about the inside of a safe's lock.
This is kind of the abbreviated version, so I hope you can follow along.
First of all, you get a dial.
Attached to the dial through a shaft is something called a drive cam, and on the drive cam there's a drive pin.
Besides all that stuff, there's also three or sometimes four wheels and a little metal device, kind of a tag team duo, called a lever and a fence.
Just like on the drive cam, each of the wheels has a drive pin.
It moves along with the wheel as it turns.
On the opposite side of the wheel, they have something called a fly, and this is where the drive pin of the other wheel connects into it.
So if you kind of imagine, you rotate one wheel around, when the drive pin of one wheel hits the fly on the other one, then both wheels start turning.
They're locked together at that point.
Notice that the wheels also have this little wacky thing on there called a gate.
It's just a notch cut out of the metal.
Once all of the gates on the wheels get lined up, what you're going to find is that the fence lever falls in and the lock can open.
This is an unlocked safe lock, if you will.
All the gates, all the little notches, are all lined up.
Notice how the fence has fallen into the hole.
There's even a gate on the cam, and notice that little tooth on the lever falls into that.
The Feynman method backdialing is a lot like a lot of backdialing in that, in fact, all backdialing, that you have to decode the information backwards.
That is, you're going to find out the last number of the combination of the safe first.
Feynman relied on the fact that even if you turn the dial, until the wheel is actually moved, the lock can be turned back to its unlocked state.
The vast majority of combination locks work in this way.
However, some changes have been made since Feynman's time, and this is not as universal as it used to be.
By incrementally trying numbers on the dial, that is, you keep turning a little bit more each time, then testing to see if the lock is still unlocked, you can determine what the last number was.
Because as soon as it becomes not unlocked anymore, that's the last number.
Let's go ahead and do a little demonstration here on the Feynman method.
Oh, hang on a second. Sorry about that.
Okay, we'll just go with this. Let me make this full screen.
There we go.
Let me rotate this guy around.
This is a safe lock.
This is actually a very serious safe lock.
This is actually the very same sort of lock you would find on a lot of vaults in the country.
This little guy, by comparison, is a gun safe lock.
It's basically a piece of crap.
This is not.
You can feel the difference.
Yeah, I don't. That's the problem. I'm sorry about that.
Anyone have a flashlight, USB light?
Willing to stand here with a lighter for the next hour and a half?
Oh, there you go.
Let's see if we can position this somewhere.
Oh, just don't breathe very heavy. We'll be good.
All right.
This is a safe lock.
It's in the unlocked position, or it can be.
Notice we...
Whoops. Hang on. Sorry.
With this lock over on this side, notice how that lever moves up and down.
Now you have that big handle on the safe, and you pull it, or sometimes in the old ones you wheel it around, and that pulls back those big metal pins on the door.
Well, the only thing stopping them from moving is basically this little piece of metal right over there.
With the Feynman method, what we're going to do is we're going to start turning this lock.
Okay, turning the wheel of the lock.
And notice I turn it a little bit.
You see the wheels can move, right?
See the wheels move back there?
Let me see if I can...
Can you see that back wheel move?
Okay.
Let me get it back into the locked position again.
And I'll show you how you actually do the Feynman method.
Now, I must say that this is what I perceive the Feynman method to be.
In his book he very roughly described it, and so it's not actually very clear.
Okay?
But let me go ahead, move this forward here.
Now notice I'm actually turning the wheel of this lock.
I can actually move...
I don't know if I can get you a good shot of this or not.
There we go, that's a little bit better.
I'm actually turning this wheel of this lock.
But notice that that last wheel pack back there, the last piece of metal, hasn't moved.
Okay?
Well, gee, that's kind of weird.
Well, yeah, it doesn't really move.
Oh, see, now it moved.
What we want to do is we want to find the right positions that make that move.
Okay?
So I'm going to turn it back.
Turned it a little bit too far.
Notice again I'm turning the wheel which turns the cam.
There, and I can just, see, shuttle that guy back and forth.
Okay?
Okay.
And what I'm going to do is the Feynman method.
He would start off and he would slowly turn the dial which turns that cam back there.
And he would keep doing that in incremental steps.
Okay?
And then he would come back and see if the safe was still unlocked.
And so he'd just keep bouncing it back and back and back.
What's going to happen is I keep turning here, and I'm going to turn very slowly.
Pretty soon you're going to see that that back wheel starts to move.
Oh, there it's moving, right?
Okay.
I can actually tell it moved right on about 40.
And that's actually the number on the dial that's going to, that's the last digits of the safe.
So let me swing back.
And notice it locks back.
You can actually feel that very easily when it locks.
You can actually hear it too probably with this safe.
It's very, very obvious.
So...
We lift it up.
We go over.
We try to drop it back.
Oh, it's not going to drop back anymore.
Okay?
We've turned too far, basically.
That's absolutely true.
In fact, this assumes even worse than that.
This assumes that the safe is actually unlocked.
Okay?
So this is not a general purpose sort of thing.
Okay?
So I can lift that guy up.
I can turn.
It's not going to lock again.
Now, what you have to do is, and now that we've got that part figured out.
Okay, it's around 40.
I can actually start turning back the other direction.
And then test.
And then what I'll have to do is I'll just spin back here and actually re-lock, or re-open the safe again to determine the next number.
It doesn't take long with a lot of practice.
I mean, what you end up doing is you end up bouncing slightly forward, slightly back, and then test the lock.
Forward a little bit more, back, test the lock.
And by doing this, you can find out the first digit very easily.
Okay?
Because all you've got to do is turn until, when you turn back, it won't lock again.
Now, Feynman did this in increments of five digits.
Okay?
That's because back then, the gate, how wide it was, that is the tolerance of the gate, was a lot wider than nowadays.
Now you're down to probably about one on each side.
So you probably have to do increments of three.
So, the Feynman method is okay.
But the problem with it is, is even he usually gave up after the second number.
Okay?
Even though it was only a three-digit combination.
What he did after that was he brute-forced the final digit.
Okay?
Especially in his day, there's five digits, right?
There's only really 20 possibilities.
Even though you hear that a safe lock, a typical three-wheel safe lock, has a million combinations.
It's a bunch of BS.
Alright?
Back in Feynman's day, there was gaps of five, and so each wheel is only 20 possibilities.
Right?
You multiply that times three, and that's what you're going to get, or a factor times three.
So, this lock here, by the way, is a four-wheel lock.
It's actually, theoretically, has 100 million combination possibilities.
Which is a lot.
But in reality, again, it really only has about a third of that.
Or maybe two-thirds of that.
Somewhere in that range.
That's the Feynman method.
It's not the greatest system in the world, because it takes a lot of time.
But the good news is, is you can just kind of bounce back and forth on this dial and actually determine quite a bit.
The way you do it is you feel when the gate falls back down.
And you can actually feel that very easily, a lot of times.
In fact, if you turn it, you're going to start pulling back that bolt once it's unlocked.
And you can immediately feel all the super-resistance in there, you know, when you're trying to pull back that bolt.
So, you can just kind of sit over here and actually determine quite a bit.
When you go out to a certain distance, you just have to make sure you know, okay, I'm stopping on 30.
I'm pulling back.
Test it.
Is it still open?
Okay, we'll go to 35.
Again, in this lock, you probably have to do increments of three.
Okay?
So, it works okay.
But let's take a look at another method here.
Alright, that's the Feynman method.
Somehow I've lost my presentation here.
So, what's a movie without a car chase?
This is the NASCAR method.
And for the NASCAR method, I'm going to switch into a different lock.
The problem with the Feynman method, besides being kind of a pain, really, to dial back and forth so many times and get all the digits,
it really takes quite a while to get that third digit.
Because, you know, you have to figure out the first one, then you figure out the second one by bouncing through the digits.
And then once you have those, what you have to do is you have to turn to the first one and turn to the second one for every increment you test on the third digit.
Okay?
Because you basically have to unlock the safe again.
You're just kind of doing incrementally in reverse.
What we're going to talk about now is what I call the NASCAR method.
And the NASCAR method is basically named that because it's this one big long left-hand turn.
Now, I hope that doesn't offend anybody, any NASCAR fan out there.
You know, if it does, I would kind of concentrate on more important things that are probably, you know, like whether your still is still working and, you know, maybe dental hygiene.
You know, some stuff like that.
Anyway, NASCAR is a great sport, by the way. I love it.
Anyway, the NASCAR method, this is the one long left-hand turn.
Okay?
There's not all this back and forth dialing, whatever.
It's, in a lot of ways, it's a lot more stealthy because you can just literally put your hand on the dial, pull it across.
But, in a way, it's a lot harder.
The Feynman method was kind of like hitting you over the head with a brick as far as the feedback the lock gave you.
Okay?
You would pull it back.
If the lock went to the unlocked state, if you turned any farther, it would try to pull the bolt back.
And, I mean, it's like hitting a Mack truck.
Okay?
With your hand.
So, you know, you have to put a lot of effort to actually get that bolt pulled back.
With this method, you have to have a really fine sense of touch.
And it takes a while to develop that.
That's the bad news.
The good news is, is that you can, a lot of times, easily determine the first and second wheel with just a few revolutions.
Or, first and second digits, rather.
With just a few, just one revolution or a couple revolutions, actually, of the wheel.
Of the dial.
This whole method is possible because when the drive pin of a wheel hits another wheel,
it adds the weight of that wheel to the whole mechanism that you're turning.
Okay?
So, basically, all you're trying to do is feel for the extra weight that occurs.
Now, there's one little problem with all this good stuff.
And that is...
Let me get this guy positioned so you can see it.
Yeah, this one might be a little bit hard to get...
Ah, there we go.
Now we've got a good angle.
Let's focus pretty good on that.
Okay.
This lock is actually...
It's in the unlocked state.
Okay.
What I'm going to do is, I'm going to go ahead and lock it.
See, I'm going to...
Notice that my fence lifts up.
Now, with this lock, and with a lot of locks,
if I try to go back to the unlocked state...
Let's see, I wiggle the dial.
Even though I don't move any of the wheel packs,
if I try to go to the unlocked state again,
it's not going to happen.
Okay?
Because they built a little mechanism in, because people like Feynman,
and they said,
Ah, you know, we don't want people backdialing these things.
But you can still backdial this lock.
This lock, by the way, is a very nice lock.
It used to be state-of-the-art.
Notice that the wheel packs on this one are made out of plastic.
They actually have a fancy name for that.
But basically, it's a plastic designed for its X-ray resistance.
This lock is what they call a Group 1 lock, Group 1R.
It has a manipulation resistance.
For instance, to actually get it to...
Sorry, here.
Shouldn't watch the screen, because everything's backwards.
With this lock,
what you do is you actually have to turn it over to zero,
and push in to try...
That little click that just happened was trying to force down the lever.
In a lot of safe locks, the lever is actually resting on the wheel packs.
And that allows you to manipulate them.
In this lock, the lever is actually above the wheel pack.
Only when you go to zero and press in does it try to pop down and try to actually enter the actual gates.
And so, this pretty much prevents manipulation from happening.
Not totally, but almost.
So this lock's a pretty good lock.
The way you actually do the dance car method with this,
is you just very simply start turning.
And as you do, in this case actually, I've already turned it.
Here, so let me kind of back up.
There we go.
With this lock, you're going to feel a couple of things when you first start turning.
First of all,
I don't know if you can see that little cam I'm wiggling down there, this little metal roller.
Vaguely somewhere in this vicinity.
That actually lifts the lever out.
You can feel that as you turn this knob.
So you have to be careful not to get fooled.
What you want to do is when you feel that lever lift out,
you want to kind of look down at the dial and see where that area is at.
That's basically called the forbidden zone.
And the last digit of the combination of safe can never be in the forbidden zone.
Because otherwise it won't work properly.
Because that's actually the part where basically the mechanics have to lift the lever around and do some stuff.
And so you can't also have that to be the spot where it falls in at the last.
So what I'm going to do is I'm going to start turning this.
And again, one long left-hand turn.
And as soon as it hits, and you can actually feel it,
I can get extra resistance.
Usually the very first wheel is very easy to detect.
I just turn it until I feel the first wheel.
And you just note the number.
Then I'm going to keep on turning.
And what is going to happen here is I'm going to drag that wheel around until it touches the next wheel.
And the resistance increases.
It's sitting on 50 right now.
So I can tell you right now the second wheel is on 50.
And let's see if we can get the third one here.
Right there.
Oh, 50 again. It's probably set to all 50s because I'm a lazy bastard.
Anyway.
No, actually, I'm sorry.
That was a...
That was the gap there. I shouldn't have done that.
Anyway.
The third wheel is particularly hard to detect.
Normally you only end up with the first couple of digits.
It also really depends on how well the lock is maintained.
If some guy has just come out and oiled the sucker,
man, you're going to be in a world of hurt.
Because it's going to turn really smoothly.
And that causes a lot of problems.
Also with a lock...
Let me switch back.
Like this guy.
Man, it's rough. Everything's backwards.
Notice this guy, the wheel, is like way over here.
And like all the lock goodies are way over there.
So like, what's up with that, you know?
What's up with that is one of the favorite safe cracking techniques
is to actually knock off this dial.
Usually with, you know, just like a big hammer.
The, you know, the big fucking hammer technique.
And then you take a punch.
And you punch out, you know, the little drive shaft in there, basically.
Now, if that drive shaft was sitting over here in this lock mechanism...
I'm sorry, you can't see me where I'm tapping.
And I can't see where...
If the drive shaft was sitting over here,
you might actually punch those wheels and just blow the hell out of the whole insides.
So that may allow you to open the safe, for instance.
That was actually a very popular technique.
So they got a little bit smart and they said, hey, let's put the wheel over here.
Okay.
Actually, in this lock...
You say, well, gee, you know, that's like a...
You said it's like a government high security lock, you know.
Why would the feds be using something so crappy as this?
Well, actually they got a little bit smarter.
What they found out was, okay, well, we'll let you knock the dial off.
We'll let you punch it.
What's going to happen is, is this is a special kind of breakaway back.
And part of it is designed to actually crack and fly off.
But when that happens, there's like a little internal locking mechanism that goes into effect.
It's called a re-locker.
And that re-locker will prevent the bolt from actually opening.
In fact, you're like really royally screwed if you go into a situation where you're trying to open up somebody's safe
and it's been punched and the re-locker's fired.
In fact, ask any safe technician, their big fear is that the re-locker's fired.
Because a lock you can work on.
You can drill a hole, you can get in there with a borescope, you can see the wheel peg, you can open it up.
That assumes you got a working lock, doesn't it?
Okay, not if the re-locker's are fired.
It's not if the lock's all shot to hell from being punched.
So, they actually do have a protection against that.
But, you know, banks wearing the old belts and suspenders, they like to have their dials offset.
It makes it even safer.
Let me stop down and take some questions.
I know this is kind of hard to visualize, but yes.
No, the safe has to be unlocked.
It has to be unlocked as well.
Again, it's kind of a limited technique, but it's basically a privileged escalation attack.
It allows you to get access whenever you're not supposed to have access.
Also, a very common method is something called day locking.
I don't know if everyone's ever heard of that.
But since the manager of the Best Buy figures that nobody knows what the hell is going on in the safe,
what they do is they unlock the safe.
But just like Feynman found out, they figure out, hey, you can turn the dial back a little bit,
and the safe appears to be locked at that point, but it's not really.
All you've got to do is just turn it back to the last digit, and it'll reopen.
That's how Feynman determines the last digit.
He just turns it until it won't open anymore.
So in other words, let's say the last digit was 30.
What you would do to day lock it is you would turn this a little bit past 30, like 35.
Now, to open the safe back up, all you've got to do is dial the last digit back again.
You just wheel it around and past zero to 30, and it'll pull the wheel back up, and hey, it's unlocked.
It's just quick, right? So it saves you some time.
But if you know it's day locked, well, it's unlocked.
And if it's unlocked, you can determine the combination.
So it's not a super huge exploit, but occasionally it can be very powerful.
I'm sorry, I don't understand the question.
That's true. As far as I know, there hasn't been a whole lot of defense.
Well, there have been a defense against the back dialing.
There's been a lot of defense against the Feynman method.
Let me...
Well, when you first start turning, what you're going to be dragging is only the cam that's directly attached to the dial.
And eventually, it's going to come around, and the drive pin on there is going to hit the fly on the first wheel.
Then you're going to pick up the first wheel.
You should be able to detect the change and drag.
I'm sorry?
Okay, I'm sorry. I can't get it.
The... In Feynman's... To protect against Feynman's method, what they did, by the way, was over...
Let's go back to video here.
This little guy right here is the actual metal shaft, or the actual metal bolt that sticks out to actually lock the safe.
And you can't see it, but behind here, they actually put a small ball bearing and a spring.
And there's a little dimple in the back of this guy.
So what happens is, when you unlock most modern safes...
I'm sorry, when you re-lock them, what happens is that the dimple pulls this shaft and the lever arm here back.
It kind of pops it back a little bit.
And that prevents it from falling right back into the gates if you realign the gates again.
So that's what prevents the Feynman method from occurring.
As far as I know, in a mechanical safe lock, there's really no defense right now against a NASCAR sort of attack.
The trick is, again, it depends on how well it's been maintained.
If you get an older lock that really hasn't seen a locksmith, or probably a safe technician in a long time,
you're probably going to be in good shape on that.
Because there's going to be quite a bit of drag, especially on the first and second digits.
Pulling off that third one is hard.
You've got to remember that a lot of times you've got four inches of steel between you and that wheel pack.
It makes it hard.
Practice helps a ton on this guy.
Yeah.
But we're going to switch from this guy, the manual method, to electronic safes here in just a second.
Let me just give a quick overview on some of the good and bad things about this.
Backdialing is quick and easy with a little bit of practice.
It's really not that hard.
Backdialing can be the size of just fiddling with the lock.
So you can just walk up to it and do a NASCAR turn on a safe.
All you've got to do is glance down whenever you feel extra drag and see if that's either the forbidden zone kicking in there or an actual wheel picking up.
Backdialing works on most mechanical safe locks, including 2M, 1, 1R, especially the NASCAR method.
The Feynman method will pretty much only work on older safe locks.
The information gained can be used for manipulation.
If you already know a couple of the digits, or one of them even, that helps a lot in manipulation.
It also obviously just helps a lot in brute forcing it.
Backdialing only works with safe open.
Obviously that's a huge bummer, and you're saying, oh man, you know, but it actually can be powerful.
Because actually knowing the combination is a lot different from merely just having access to it during the day.
Feynman just had access to it during the day.
He wasn't even supposed to open up all of these atomic bomb secret, you know, filing cabinets that they had around there.
Instead he just walked up and he just played with the lock while he was talking with somebody.
No one ever noticed. No one actually found out the Feynman method.
They thought he was some mechanical guru.
Sometimes also, especially with the NASCAR method, you'll end up with the safe being locked because you won't be able to determine the third wheel.
In reality, that's usually not such a big deal because safes get accidentally locked all the time.
You know, people bump them and stuff like that.
So most of the time it's not really considered a security threat that the safe, oh gee, was unlocked and now it's locked.
Well, you know, who fucked with the safe?
That's about it. That's the only security threat raised.
The Feynman method usually takes too long.
It's a lot of jiggling back and forth to try and bounce around and find all the numbers.
And you really only get one time with an open safe.
Obviously, if you screw up on either method, you're going to end up with a locked safe and you can't do back dialing.
How do you protect your safe from back dialing?
First of all, don't leave the safe unlocked or day locked, which is just as bad.
Some electromechanical locks can also automatically relock themselves after a short period of time.
That's cool.
Mechanical locks can also be supplemented with things like alarms.
Use of time locks, that is, you can only open the safe during business hours,
well, that pretty much screws the whole point of trying to figure out how to open it up later on.
Additional security measures such as video surveillance, guards, perimeter alarms,
all that good general security stuff is a great idea to help protect your safe.
Let's talk a little bit about my friend Spike the WonderSafe.
If you ever wondered why I called it that, it's because I kind of wondered why Spike has even called a safe.
Spike's full name is the Sentry A5835 Fire Safe.
It's one model out of a dozen that are all very similar.
They're very popular. Obviously, you go around and you see tons of Sentry safes.
Sentry doesn't really claim that this provides significant burglar resistance,
but people just generally assume that it does.
Kind of like when they wander down by that hardened shackled master padlock
and think it's really a significant barrier to entry.
However, you know, like I say, Spike is terribly misunderstood.
He's great in a fire.
I've actually had read accounts of many locksmiths that said,
man, they pulled a Sentry out of a fire, you know, they opened it up, all the contents was great.
I mean, they really are good in a fire.
However, to keep burglars out, or just whoever, they're pretty sucky.
Now, Spike doesn't look totally wimpy.
He has something kind of like two-factor authentication.
First of all, he's got a tubular lock, and also electronic keypad is five-digit combination.
Well, that's pretty stout, you know.
God, I hate to guess five digits.
You know, but unfortunately, it looks kind of deceiving.
Spike's security problems all began back in 2000 when this guy named Freddy,
you know, there's Freddy the Wire,
started spilling safe-cracking secrets on the Alt Locksmith news group.
I don't know if you guys ever frequent Alt Locksmith.
It's pretty much useless.
That's because a lot of locksmiths hang around it,
and they like to basically dump on anything that's... any information that really comes through there.
They spread a lot of misinformation.
There's really not a hotbed of good information.
If you want a hotbed of good information, go to Lockpicking101 or groups like that.
One of the secrets that Freddy tipped was something called spiking.
Spiking involves passing electric current inside the safe to actually open it.
An electronic safe, basically, when you type the numbers on the keypad,
all it does is compare that with a little digital chip inside and say,
hmm, yeah, that's the right number.
And it pops electric current inside the safe, which activates a solenoid.
A solenoid is basically just an electromagnet.
And it pulls back the bolt, which allows you to turn the handle, which allows you to open the safe.
In 2002, there was a news group, actually a website,
and a guy on there, they were having a discussion about whether you should buy electronic locks for your gun safes or whatever,
because they're a lot more convenient.
They're a lot quicker.
Dialing a regular conventional mechanical safe lock is kind of a pain in the ass sometimes,
especially if you're in a hurry.
But one guy on there said, you know, he works as the chaplain in a penitentiary.
And the prisoners there said, oh man, don't do that.
You can open up those things with a nine-volt battery.
Well, you know what?
They were right.
So, obviously, they've known for quite a while the people who shouldn't,
so it's probably a good idea for everyone else to kind of learn what to avoid in electronic safe locks.
You know, again, Spike has this two-factor authentication now, right?
So, you know, even if you found out the five-digit code, you still have to work on the tubular key.
You know, again, unfortunately for Spike, he's kind of having this run of bad luck.
Remember the kryptonite bicycle lock in the Big Pen?
You know, they had that Texas grudge match and the Big Pen won.
Yeah.
Unfortunately, Spike's pretty much got the same thing going on.
Ah, there's our instruments of destruction.
That is a Flexmate Grip Pen.
Flex Grip Elite, actually.
Oh, and that's our little Sentry Safe Spike.
Here's the most complicated part of this process, removing the ends of the cap of the pen.
This took the longest, actually, of the whole thing.
Oh, there we go.
Notice you, this is a very difficult technique.
It involves inserting the pen into the tubular lock.
You have to press kind of hard.
Yeah, that's, okay.
Oh, there we go.
I was going to do this demo live, but lugging around 30 pounds worth of safe locks was enough,
and I figured the 100-pound safe could sit in the office, you know?
I'm going to take it out just to prove that that wasn't a fluke.
Although I am cheating here, because actually, this pen has basically been an impression.
It's basically a key at this point, so, you know, it's even easier the second time around.
Yeah.
Notice I locked it back again, too.
This, you know, works both ways,
because you don't really want people to know that you've been playing around with their sentry safe.
Okay, now we've got to tackle the other part of our two-factor authentication.
Well, first thing we do, we've got to get rid of that keypad.
Fortunately, it's made out of good industrial-grade plastic.
Get rid of all those bits we don't really need,
and I'm going to get to flip this around,
and I do a slightly different camera shot here to kind of show you a little bit better what's going on.
It's hard to see, but notice there's two plugs there.
One's got a black-and-white wire on the bottom,
and the other one's got a black, I'm sorry, black-and-red wire on the bottom,
and the top one's got a black-and-white wire.
If you look at the battery pack, it's got red and black coming out of it,
and if you look very carefully, you'll notice that the black-and-white wire runs inside the safe.
Oh, gee, I wonder what that's for.
That's a 9-volt battery.
I put tape around the end to keep the wire separated for me very conveniently.
And...
Bop!
It took my dog Ginger three weeks to learn that trick, though, so it's not that easy.
It's really not.
Actually, this is the other hard part, is getting that goddamn plastic thing back on.
But, you know, you don't want to leave a messy safe, you know.
That's what I always say, you know.
Oh, look, so we're all locked back up again.
Tubular lock's in.
Pop that thing out.
And that's it.
You know, obviously, I went in a big hurry there.
That whole video is three minutes long.
The actual opening of the safe part is, like, two minutes long.
Obviously, if I was rushing it, you'd probably do it in about a minute.
And that's to open and close it.
So that's about it for Spike the Sentry WonderSafe here.
Here's some tips, folks.
Never assume a fire-resistant safe has any burglar resistance, okay, unless it's actually rated for them.
And there are safes that are both burglar and fire-resistant.
Specifically ask, when you buy an electronic safe, if it's spike-resistant.
If you're buying for somebody who doesn't know what that means, you probably need to go someplace else.
If, you know, the locksmith guy's jaws drop open and, you know, you realize you actually know what you're talking about,
then he may actually sell you a decent safe.
A lot of these safes nowadays are really crappy.
And you've got to be really careful, especially on the cheap gun safes.
I showed you that gun safe lock earlier and told you it was a piece of crap.
It is. It's mechanical.
The electronic ones are also generally pretty crappy.
There is a danger, by the way, of opening a safe via spiking.
I used a 9-volt battery.
Quite frankly, the battery pack in that machine is, I think, only produces 6 volts.
And you can actually damage the electronics on this circuit board by spiking.
Sometimes they're actually made to damage the circuit board by spiking.
That's their spike resistance, if you will.
It also allows them to sell another safe.
So that's a really great idea, I guess.
Anyway, very important.
Limit your access to fire-resistant safes.
They're generally just not that great as far as actually protecting your valuables.
Also, too, if you come up against a conventional safe cracker, he's going to break out something called a drill.
And he's going to drill through this white, fluffy cotton stuff that they have inside fireproof safes.
And let me tell you, it doesn't slow you down nearly as much as hard plate.
So it's just generally a good idea to keep an eye on your fireproof safes.
Alarms, video guards, surveillance.
If you don't get anything else out of this whole conference, you should realize that good security always relies on overlapping layers of security.
Never depend on a single firewall or that single safe to be safe.
Make sure you wrap it around with other IDSs and security guards, alarm systems, and things like that.
It's the only way you can stay safe.
Questions?
Yes.
Yeah, you can, although a lot of times they get a little bit sharper here.
And if you don't get the polarity right, or sometimes you could probably even check and have some sort of pre-circuitry.
And say, okay, well, I haven't typed in the digits.
So I'm basically in, if any electricity comes down this pike, I'm blowing myself up mode.
So there are spike-resistant safes. It's not impossible.
It's just when you deal on a cheaper level, you don't normally get it.
Yeah.
For fire resistance, I love Sentry, actually.
But, you know, they're just not burglar-resistant.
And, unfortunately, to pay to get both is pretty expensive.
Yeah.
eBay.
Everything I got here is on eBay, except the Moss Hamilton X8, which is the world's most secure lock, except for the X9, which came out in...
Anyway.
But the...
No, it's...
You'll only find this lock on high...
Yeah, let me switch back here.
Sorry, it takes so long.
I suppose they had this all set up to automatically switch, and, of course, that failed spectacularly.
This is probably going to take a while here, sorry.
And I'm running out of time.
Oh, there we go.
OK.
This is the Moss Hamilton.
It looks like a mechanical safe lock.
It is not.
It is actually very much like one of those radios you... survival radios you get that's got the crank on the side, where you have to, like, crank it up.
Basically, with the Moss Hamilton, you have to turn it until you power it up.
It's actually fully electronic.
With the Moss Hamilton, all of the electronics are inside the safe.
They're behind that four inches of hard plate.
OK.
So, you can spike this devil.
It's actually been done.
But it's not easy.
And you have to knock the dial off to get in.
And the government specifications for this was, A, it needs to be secured.
That's great.
That's wonderful.
But they wanted to make sure that no one could get in in a stealthy way.
OK.
You know, a lot of the stuff we talked about with back dialing and stuff and spiking, they're very stealthy.
You don't know that something's happened.
So, if you knock the dial off this sucker, sure, you can get into it.
I mean, you know, you can, you know, take explosives to the safe and get into it.
But people will know you've been there.
OK.
And that's all they're worried about.
It's going to take time.
It's going to take... and leave a big trail.
So, this is one of the most secure locks in the world.
They do have the new nine model.
That's the only reason why I own this one is because, of course, they closed this out and I got it, you know, reasonably cheap.
It is a great lock.
And, boy, this would definitely, you know, work great on your front door.
Anything else?
Oh, I'm afraid I've got to head on out here.
If anyone else has any questions, I'll be out that way.
And you can look at some of this stuff.
Thank you.