start	end	text
5600	15120	Told that everything will run on schedule, although at 4 o'clock in the tent, we're going to have the Hacker Foundation and Dunka Gardner Analyst.
16700	18080	In the tent.
23320	31780	They're going to have the Hacker Foundation in the tent with Dunka Gardner Analyst, I guess, at 4 o'clock in the tent.
32440	36000	And this is Thomas, and he'll be cracking safes for us.
67640	68780	Three letters?
81120	93730	Welcome! Can you hear me?
93730	94830	No.
95630	97230	How's that?
97550	99230	No.
100610	102990	How's that? A little bit better?
106230	108670	Not sure if the other one will reach. Let's see.
109050	110890	Do we have an audio guy in here? Is this on?
113590	115070	How about that?
115730	116530	Better?
117050	119070	Okay, just have to get up here. Alright.
120930	126690	Well, if you guys just missed a really exciting talk about how to equalize wealth in the economy.
128030	132930	Hey, you guys just missed a really exciting talk about how to equalize wealth in the economy.
132930	137150	Of course, one thing they didn't cover was safe cracking.
138770	142210	Fortunately, we're going to pick up here and get that little bit done.
151240	153600	Today we've got a little double feature going on here.
153600	155740	First of all, we're going to talk about a couple of techniques.
155740	158720	One is back dialing, and that's going to be our first topic.
159980	164140	This is the star of our show right here. That is an analog safe lock.
164220	166880	It's not the push-button digital kind.
166880	171800	It's very important because you can't back dial an electronic push-button lock.
173520	175400	So what is back dialing?
175660	182100	Well, back dialing allows you to determine the combination of a safe, an unlocked safe, just by fiddling with the dial.
182100	186440	You say, man, what's up with that? It's already unlocked.
186680	193100	Well, yeah, but if you know the combination, it allows you to access it at times that weren't scheduled.
193100	198360	It also allows you to pass along that combination to people who shouldn't know it.
198580	204080	Also, if there's like all the safes are comboed the same, even if your boss comes and opens it,
204080	206860	well, you know the combination of all of them now, don't you?
207820	210140	I'm sure that doesn't exist in the real world that way.
211680	219520	Well, a little while back there was this guy named Richard Feynman, and he's a Nobel winning physicist.
219520	220400	Sorry about that.
220400	225040	He was stuck out in Los Alamos developing the bomb in the 1940s.
225240	230240	And bored shitless, as people stuck out in the desert have become,
230240	236120	he decided he would play around with the safe locks that were on the filing cabinets around there.
236340	239620	He basically discovered a technique of back dialing.
239620	247520	That, along with a little bit of social engineering, and he pretty much had down all the combos for all the locks at Los Alamos.
248940	254640	Feynman did publish his little adventures here in a book called Surely You're Joking, Mr. Feynman.
254700	255940	It's a pretty good read.
258460	264100	Before you understand back dialing and how it works, you need to know a little bit about the inside of a safe's lock.
264800	268600	This is kind of the abbreviated version, so I hope you can follow along.
269020	270540	First of all, you get a dial.
271080	276120	Attached to the dial through a shaft is something called a drive cam, and on the drive cam there's a drive pin.
278700	288080	Besides all that stuff, there's also three or sometimes four wheels and a little metal device, kind of a tag team duo, called a lever and a fence.
291970	296070	Just like on the drive cam, each of the wheels has a drive pin.
296070	299170	It moves along with the wheel as it turns.
299370	309290	On the opposite side of the wheel, they have something called a fly, and this is where the drive pin of the other wheel connects into it.
309290	317490	So if you kind of imagine, you rotate one wheel around, when the drive pin of one wheel hits the fly on the other one, then both wheels start turning.
317490	319250	They're locked together at that point.
320870	324190	Notice that the wheels also have this little wacky thing on there called a gate.
324190	326110	It's just a notch cut out of the metal.
327350	335570	Once all of the gates on the wheels get lined up, what you're going to find is that the fence lever falls in and the lock can open.
335650	338190	This is an unlocked safe lock, if you will.
338650	341710	All the gates, all the little notches, are all lined up.
341710	343910	Notice how the fence has fallen into the hole.
343910	350310	There's even a gate on the cam, and notice that little tooth on the lever falls into that.
353850	364670	The Feynman method backdialing is a lot like a lot of backdialing in that, in fact, all backdialing, that you have to decode the information backwards.
364670	368730	That is, you're going to find out the last number of the combination of the safe first.
369990	378410	Feynman relied on the fact that even if you turn the dial, until the wheel is actually moved, the lock can be turned back to its unlocked state.
379530	383030	The vast majority of combination locks work in this way.
383070	389190	However, some changes have been made since Feynman's time, and this is not as universal as it used to be.
390050	399030	By incrementally trying numbers on the dial, that is, you keep turning a little bit more each time, then testing to see if the lock is still unlocked, you can determine what the last number was.
399030	403650	Because as soon as it becomes not unlocked anymore, that's the last number.
405590	408510	Let's go ahead and do a little demonstration here on the Feynman method.
411330	420440	Oh, hang on a second. Sorry about that.
429330	431850	Okay, we'll just go with this. Let me make this full screen.
435300	436480	There we go.
437020	438680	Let me rotate this guy around.
440460	442200	This is a safe lock.
442540	444440	This is actually a very serious safe lock.
444440	449420	This is actually the very same sort of lock you would find on a lot of vaults in the country.
453480	457860	This little guy, by comparison, is a gun safe lock.
457860	459580	It's basically a piece of crap.
460880	462260	This is not.
462340	463960	You can feel the difference.
466020	469600	Yeah, I don't. That's the problem. I'm sorry about that.
474010	476410	Anyone have a flashlight, USB light?
477850	481350	Willing to stand here with a lighter for the next hour and a half?
482410	484210	Oh, there you go.
488250	490330	Let's see if we can position this somewhere.
491170	494190	Oh, just don't breathe very heavy. We'll be good.
494190	495030	All right.
496190	497630	This is a safe lock.
497630	500470	It's in the unlocked position, or it can be.
502950	503870	Notice we...
503870	505250	Whoops. Hang on. Sorry.
505710	510530	With this lock over on this side, notice how that lever moves up and down.
510690	518750	Now you have that big handle on the safe, and you pull it, or sometimes in the old ones you wheel it around, and that pulls back those big metal pins on the door.
519230	524930	Well, the only thing stopping them from moving is basically this little piece of metal right over there.
528090	533850	With the Feynman method, what we're going to do is we're going to start turning this lock.
533870	535610	Okay, turning the wheel of the lock.
535870	537730	And notice I turn it a little bit.
539030	540850	You see the wheels can move, right?
541030	542610	See the wheels move back there?
544670	545870	Let me see if I can...
549050	550990	Can you see that back wheel move?
551350	552090	Okay.
554590	556970	Let me get it back into the locked position again.
557570	559890	And I'll show you how you actually do the Feynman method.
559890	564930	Now, I must say that this is what I perceive the Feynman method to be.
565430	570510	In his book he very roughly described it, and so it's not actually very clear.
570870	571390	Okay?
571550	575290	But let me go ahead, move this forward here.
576490	579130	Now notice I'm actually turning the wheel of this lock.
579850	582270	I can actually move...
582270	584330	I don't know if I can get you a good shot of this or not.
586510	588190	There we go, that's a little bit better.
588790	592270	I'm actually turning this wheel of this lock.
592270	599350	But notice that that last wheel pack back there, the last piece of metal, hasn't moved.
599670	600310	Okay?
600570	601870	Well, gee, that's kind of weird.
601870	603290	Well, yeah, it doesn't really move.
603290	604390	Oh, see, now it moved.
604390	609530	What we want to do is we want to find the right positions that make that move.
609530	610070	Okay?
610730	612210	So I'm going to turn it back.
613070	614550	Turned it a little bit too far.
615430	617930	Notice again I'm turning the wheel which turns the cam.
622360	625360	There, and I can just, see, shuttle that guy back and forth.
625360	625940	Okay?
632950	633750	Okay.
633990	635850	And what I'm going to do is the Feynman method.
635850	642150	He would start off and he would slowly turn the dial which turns that cam back there.
642150	645270	And he would keep doing that in incremental steps.
645510	646030	Okay?
646030	649210	And then he would come back and see if the safe was still unlocked.
649210	652570	And so he'd just keep bouncing it back and back and back.
652570	655350	What's going to happen is I keep turning here, and I'm going to turn very slowly.
655350	659010	Pretty soon you're going to see that that back wheel starts to move.
661790	663590	Oh, there it's moving, right?
663590	664390	Okay.
664390	667470	I can actually tell it moved right on about 40.
667470	673610	And that's actually the number on the dial that's going to, that's the last digits of the safe.
673610	675550	So let me swing back.
676930	678570	And notice it locks back.
678570	680450	You can actually feel that very easily when it locks.
680450	682890	You can actually hear it too probably with this safe.
682890	684590	It's very, very obvious.
685750	686150	So...
687390	688430	We lift it up.
688430	689410	We go over.
689990	691230	We try to drop it back.
691230	692890	Oh, it's not going to drop back anymore.
692890	693410	Okay?
693410	695310	We've turned too far, basically.
704810	705710	That's absolutely true.
705710	707430	In fact, this assumes even worse than that.
707430	709890	This assumes that the safe is actually unlocked.
710070	710710	Okay?
711310	715450	So this is not a general purpose sort of thing.
715450	716110	Okay?
716150	717350	So I can lift that guy up.
717350	718370	I can turn.
721910	723670	It's not going to lock again.
723830	728550	Now, what you have to do is, and now that we've got that part figured out.
728550	729890	Okay, it's around 40.
730190	733310	I can actually start turning back the other direction.
734950	736410	And then test.
736410	743430	And then what I'll have to do is I'll just spin back here and actually re-lock, or re-open the safe again to determine the next number.
743830	745810	It doesn't take long with a lot of practice.
745810	750950	I mean, what you end up doing is you end up bouncing slightly forward, slightly back, and then test the lock.
750950	753610	Forward a little bit more, back, test the lock.
754070	757170	And by doing this, you can find out the first digit very easily.
757170	757510	Okay?
757510	762310	Because all you've got to do is turn until, when you turn back, it won't lock again.
762330	765210	Now, Feynman did this in increments of five digits.
765210	765850	Okay?
765970	772870	That's because back then, the gate, how wide it was, that is the tolerance of the gate, was a lot wider than nowadays.
772870	777310	Now you're down to probably about one on each side.
777310	779450	So you probably have to do increments of three.
780110	783130	So, the Feynman method is okay.
783130	786790	But the problem with it is, is even he usually gave up after the second number.
786790	787050	Okay?
787050	789070	Even though it was only a three-digit combination.
789070	792570	What he did after that was he brute-forced the final digit.
792570	793010	Okay?
793010	795270	Especially in his day, there's five digits, right?
795270	797190	There's only really 20 possibilities.
797190	803630	Even though you hear that a safe lock, a typical three-wheel safe lock, has a million combinations.
803770	805610	It's a bunch of BS.
805610	806090	Alright?
806230	811250	Back in Feynman's day, there was gaps of five, and so each wheel is only 20 possibilities.
811250	811870	Right?
811870	815730	You multiply that times three, and that's what you're going to get, or a factor times three.
815930	818990	So, this lock here, by the way, is a four-wheel lock.
819210	825330	It's actually, theoretically, has 100 million combination possibilities.
825650	826710	Which is a lot.
827190	832150	But in reality, again, it really only has about a third of that.
832190	833270	Or maybe two-thirds of that.
833270	834430	Somewhere in that range.
835690	837150	That's the Feynman method.
837210	841850	It's not the greatest system in the world, because it takes a lot of time.
842290	847030	But the good news is, is you can just kind of bounce back and forth on this dial and actually determine quite a bit.
847190	850170	The way you do it is you feel when the gate falls back down.
850170	852710	And you can actually feel that very easily, a lot of times.
853410	859110	In fact, if you turn it, you're going to start pulling back that bolt once it's unlocked.
859130	863470	And you can immediately feel all the super-resistance in there, you know, when you're trying to pull back that bolt.
863530	868170	So, you can just kind of sit over here and actually determine quite a bit.
868210	873110	When you go out to a certain distance, you just have to make sure you know, okay, I'm stopping on 30.
873250	874650	I'm pulling back.
874710	875590	Test it.
875770	876570	Is it still open?
876570	877850	Okay, we'll go to 35.
878610	881070	Again, in this lock, you probably have to do increments of three.
881070	881830	Okay?
882170	884650	So, it works okay.
885270	888970	But let's take a look at another method here.
902660	904460	Alright, that's the Feynman method.
904480	906460	Somehow I've lost my presentation here.
907480	909480	So, what's a movie without a car chase?
909480	911060	This is the NASCAR method.
911060	913620	And for the NASCAR method, I'm going to switch into a different lock.
913620	919800	The problem with the Feynman method, besides being kind of a pain, really, to dial back and forth so many times and get all the digits,
919800	921800	it really takes quite a while to get that third digit.
921800	927320	Because, you know, you have to figure out the first one, then you figure out the second one by bouncing through the digits.
927320	937600	And then once you have those, what you have to do is you have to turn to the first one and turn to the second one for every increment you test on the third digit.
937600	938120	Okay?
938120	940240	Because you basically have to unlock the safe again.
940240	942720	You're just kind of doing incrementally in reverse.
952650	956490	What we're going to talk about now is what I call the NASCAR method.
956490	962850	And the NASCAR method is basically named that because it's this one big long left-hand turn.
965270	970250	Now, I hope that doesn't offend anybody, any NASCAR fan out there.
970690	978970	You know, if it does, I would kind of concentrate on more important things that are probably, you know, like whether your still is still working and, you know, maybe dental hygiene.
978970	980810	You know, some stuff like that.
981030	984770	Anyway, NASCAR is a great sport, by the way. I love it.
986030	990790	Anyway, the NASCAR method, this is the one long left-hand turn.
990950	991390	Okay?
991610	994150	There's not all this back and forth dialing, whatever.
994270	999650	It's, in a lot of ways, it's a lot more stealthy because you can just literally put your hand on the dial, pull it across.
1000410	1002410	But, in a way, it's a lot harder.
1002410	1008090	The Feynman method was kind of like hitting you over the head with a brick as far as the feedback the lock gave you.
1008090	1008710	Okay?
1008710	1010350	You would pull it back.
1010410	1016470	If the lock went to the unlocked state, if you turned any farther, it would try to pull the bolt back.
1016470	1018690	And, I mean, it's like hitting a Mack truck.
1018790	1019070	Okay?
1019070	1019910	With your hand.
1019990	1022750	So, you know, you have to put a lot of effort to actually get that bolt pulled back.
1023310	1026490	With this method, you have to have a really fine sense of touch.
1026490	1028330	And it takes a while to develop that.
1028330	1029670	That's the bad news.
1030250	1041730	The good news is, is that you can, a lot of times, easily determine the first and second wheel with just a few revolutions.
1042390	1043790	Or, first and second digits, rather.
1043790	1047570	With just a few, just one revolution or a couple revolutions, actually, of the wheel.
1047570	1048470	Of the dial.
1049570	1056690	This whole method is possible because when the drive pin of a wheel hits another wheel,
1056690	1061950	it adds the weight of that wheel to the whole mechanism that you're turning.
1062050	1062370	Okay?
1062370	1068310	So, basically, all you're trying to do is feel for the extra weight that occurs.
1070350	1074190	Now, there's one little problem with all this good stuff.
1080550	1081290	And that is...
1082670	1085710	Let me get this guy positioned so you can see it.
1100970	1103070	Yeah, this one might be a little bit hard to get...
1103070	1104190	Ah, there we go.
1104190	1105390	Now we've got a good angle.
1105590	1106890	Let's focus pretty good on that.
1108110	1108910	Okay.
1111290	1113650	This lock is actually...
1114170	1115830	It's in the unlocked state.
1116070	1116790	Okay.
1118850	1122250	What I'm going to do is, I'm going to go ahead and lock it.
1122430	1123190	See, I'm going to...
1125670	1127590	Notice that my fence lifts up.
1128230	1131230	Now, with this lock, and with a lot of locks,
1131230	1134550	if I try to go back to the unlocked state...
1134550	1135490	Let's see, I wiggle the dial.
1135490	1137530	Even though I don't move any of the wheel packs,
1137530	1140230	if I try to go to the unlocked state again,
1140230	1141470	it's not going to happen.
1141630	1142090	Okay?
1142090	1144990	Because they built a little mechanism in, because people like Feynman,
1144990	1145410	and they said,
1145410	1148010	Ah, you know, we don't want people backdialing these things.
1148010	1149810	But you can still backdial this lock.
1149810	1151790	This lock, by the way, is a very nice lock.
1151790	1153170	It used to be state-of-the-art.
1153990	1157310	Notice that the wheel packs on this one are made out of plastic.
1157610	1159230	They actually have a fancy name for that.
1159230	1162970	But basically, it's a plastic designed for its X-ray resistance.
1163150	1167230	This lock is what they call a Group 1 lock, Group 1R.
1167330	1170210	It has a manipulation resistance.
1170810	1173230	For instance, to actually get it to...
1178300	1179400	Sorry, here.
1179400	1181540	Shouldn't watch the screen, because everything's backwards.
1182400	1184080	With this lock,
1184080	1188640	what you do is you actually have to turn it over to zero,
1189200	1191640	and push in to try...
1192540	1198560	That little click that just happened was trying to force down the lever.
1198740	1204640	In a lot of safe locks, the lever is actually resting on the wheel packs.
1204940	1206980	And that allows you to manipulate them.
1206980	1210060	In this lock, the lever is actually above the wheel pack.
1210060	1217440	Only when you go to zero and press in does it try to pop down and try to actually enter the actual gates.
1217440	1221380	And so, this pretty much prevents manipulation from happening.
1221380	1222860	Not totally, but almost.
1223140	1224760	So this lock's a pretty good lock.
1226880	1229940	The way you actually do the dance car method with this,
1229940	1232260	is you just very simply start turning.
1234960	1237420	And as you do, in this case actually, I've already turned it.
1237420	1239100	Here, so let me kind of back up.
1239200	1240180	There we go.
1240780	1243700	With this lock, you're going to feel a couple of things when you first start turning.
1243700	1244720	First of all,
1244720	1248140	I don't know if you can see that little cam I'm wiggling down there, this little metal roller.
1248620	1250560	Vaguely somewhere in this vicinity.
1251400	1254920	That actually lifts the lever out.
1255600	1258480	You can feel that as you turn this knob.
1259440	1262180	So you have to be careful not to get fooled.
1262180	1265640	What you want to do is when you feel that lever lift out,
1265640	1268260	you want to kind of look down at the dial and see where that area is at.
1268260	1270400	That's basically called the forbidden zone.
1270400	1274540	And the last digit of the combination of safe can never be in the forbidden zone.
1275780	1277820	Because otherwise it won't work properly.
1277820	1282680	Because that's actually the part where basically the mechanics have to lift the lever around and do some stuff.
1282680	1285900	And so you can't also have that to be the spot where it falls in at the last.
1286600	1289100	So what I'm going to do is I'm going to start turning this.
1289100	1291220	And again, one long left-hand turn.
1292920	1297220	And as soon as it hits, and you can actually feel it,
1297220	1298900	I can get extra resistance.
1298900	1301800	Usually the very first wheel is very easy to detect.
1302120	1304400	I just turn it until I feel the first wheel.
1304400	1306220	And you just note the number.
1306440	1307680	Then I'm going to keep on turning.
1308420	1313900	And what is going to happen here is I'm going to drag that wheel around until it touches the next wheel.
1313900	1315880	And the resistance increases.
1316080	1317440	It's sitting on 50 right now.
1317440	1321720	So I can tell you right now the second wheel is on 50.
1321720	1323720	And let's see if we can get the third one here.
1329980	1331020	Right there.
1331660	1335740	Oh, 50 again. It's probably set to all 50s because I'm a lazy bastard.
1335740	1336840	Anyway.
1338700	1339900	No, actually, I'm sorry.
1339900	1341580	That was a...
1341580	1344140	That was the gap there. I shouldn't have done that.
1344140	1344820	Anyway.
1345240	1348260	The third wheel is particularly hard to detect.
1348260	1351800	Normally you only end up with the first couple of digits.
1351920	1356440	It also really depends on how well the lock is maintained.
1356440	1358960	If some guy has just come out and oiled the sucker,
1358960	1360400	man, you're going to be in a world of hurt.
1360400	1362700	Because it's going to turn really smoothly.
1363060	1365000	And that causes a lot of problems.
1365960	1367820	Also with a lock...
1367820	1368980	Let me switch back.
1373850	1375230	Like this guy.
1377370	1379250	Man, it's rough. Everything's backwards.
1379390	1382270	Notice this guy, the wheel, is like way over here.
1382270	1384570	And like all the lock goodies are way over there.
1384570	1386510	So like, what's up with that, you know?
1386630	1391050	What's up with that is one of the favorite safe cracking techniques
1391050	1394090	is to actually knock off this dial.
1394090	1396010	Usually with, you know, just like a big hammer.
1396010	1398610	The, you know, the big fucking hammer technique.
1398650	1401830	And then you take a punch.
1401870	1407690	And you punch out, you know, the little drive shaft in there, basically.
1407710	1411150	Now, if that drive shaft was sitting over here in this lock mechanism...
1411150	1412930	I'm sorry, you can't see me where I'm tapping.
1412930	1414170	And I can't see where...
1414170	1416790	If the drive shaft was sitting over here,
1416790	1420850	you might actually punch those wheels and just blow the hell out of the whole insides.
1421350	1423870	So that may allow you to open the safe, for instance.
1423870	1425450	That was actually a very popular technique.
1425450	1429530	So they got a little bit smart and they said, hey, let's put the wheel over here.
1429950	1430330	Okay.
1431570	1434450	Actually, in this lock...
1439390	1441230	You say, well, gee, you know, that's like a...
1441230	1443650	You said it's like a government high security lock, you know.
1443650	1446190	Why would the feds be using something so crappy as this?
1446390	1448550	Well, actually they got a little bit smarter.
1448550	1451990	What they found out was, okay, well, we'll let you knock the dial off.
1451990	1453110	We'll let you punch it.
1453370	1456830	What's going to happen is, is this is a special kind of breakaway back.
1456830	1461130	And part of it is designed to actually crack and fly off.
1461130	1466550	But when that happens, there's like a little internal locking mechanism that goes into effect.
1466550	1467970	It's called a re-locker.
1467990	1471750	And that re-locker will prevent the bolt from actually opening.
1471750	1477530	In fact, you're like really royally screwed if you go into a situation where you're trying to open up somebody's safe
1477530	1480350	and it's been punched and the re-locker's fired.
1480350	1484770	In fact, ask any safe technician, their big fear is that the re-locker's fired.
1485210	1487550	Because a lock you can work on.
1487550	1492150	You can drill a hole, you can get in there with a borescope, you can see the wheel peg, you can open it up.
1492210	1494110	That assumes you got a working lock, doesn't it?
1494210	1496010	Okay, not if the re-locker's are fired.
1496010	1498510	It's not if the lock's all shot to hell from being punched.
1498890	1503450	So, they actually do have a protection against that.
1503630	1510150	But, you know, banks wearing the old belts and suspenders, they like to have their dials offset.
1510150	1511370	It makes it even safer.
1511370	1516470	Let me stop down and take some questions.
1516570	1521150	I know this is kind of hard to visualize, but yes.
1524610	1526670	No, the safe has to be unlocked.
1527250	1528870	It has to be unlocked as well.
1528970	1534370	Again, it's kind of a limited technique, but it's basically a privileged escalation attack.
1534370	1538990	It allows you to get access whenever you're not supposed to have access.
1538990	1544070	Also, a very common method is something called day locking.
1544090	1545890	I don't know if everyone's ever heard of that.
1546070	1552930	But since the manager of the Best Buy figures that nobody knows what the hell is going on in the safe,
1552930	1555170	what they do is they unlock the safe.
1555170	1559510	But just like Feynman found out, they figure out, hey, you can turn the dial back a little bit,
1559510	1563810	and the safe appears to be locked at that point, but it's not really.
1563810	1568550	All you've got to do is just turn it back to the last digit, and it'll reopen.
1568550	1570950	That's how Feynman determines the last digit.
1571050	1574430	He just turns it until it won't open anymore.
1574630	1577030	So in other words, let's say the last digit was 30.
1577030	1580930	What you would do to day lock it is you would turn this a little bit past 30, like 35.
1581770	1585010	Now, to open the safe back up, all you've got to do is dial the last digit back again.
1585010	1590010	You just wheel it around and past zero to 30, and it'll pull the wheel back up, and hey, it's unlocked.
1590210	1592770	It's just quick, right? So it saves you some time.
1592930	1595990	But if you know it's day locked, well, it's unlocked.
1596430	1599350	And if it's unlocked, you can determine the combination.
1599990	1604630	So it's not a super huge exploit, but occasionally it can be very powerful.
1622780	1624620	I'm sorry, I don't understand the question.
1633810	1637890	That's true. As far as I know, there hasn't been a whole lot of defense.
1637890	1639690	Well, there have been a defense against the back dialing.
1639690	1642350	There's been a lot of defense against the Feynman method.
1644950	1645750	Let me...
1653190	1660470	Well, when you first start turning, what you're going to be dragging is only the cam that's directly attached to the dial.
1660690	1666670	And eventually, it's going to come around, and the drive pin on there is going to hit the fly on the first wheel.
1666790	1668890	Then you're going to pick up the first wheel.
1668890	1671370	You should be able to detect the change and drag.
1677860	1678860	I'm sorry?
1679860	1682860	Okay, I'm sorry. I can't get it.
1684520	1691600	The... In Feynman's... To protect against Feynman's method, what they did, by the way, was over...
1691600	1693540	Let's go back to video here.
1697610	1704450	This little guy right here is the actual metal shaft, or the actual metal bolt that sticks out to actually lock the safe.
1704530	1710470	And you can't see it, but behind here, they actually put a small ball bearing and a spring.
1710470	1713510	And there's a little dimple in the back of this guy.
1713570	1718150	So what happens is, when you unlock most modern safes...
1718150	1734850	I'm sorry, when you re-lock them, what happens is that the dimple pulls this shaft and the lever arm here back.
1734850	1736810	It kind of pops it back a little bit.
1736810	1741850	And that prevents it from falling right back into the gates if you realign the gates again.
1742050	1745510	So that's what prevents the Feynman method from occurring.
1745510	1753190	As far as I know, in a mechanical safe lock, there's really no defense right now against a NASCAR sort of attack.
1753290	1757150	The trick is, again, it depends on how well it's been maintained.
1757150	1761910	If you get an older lock that really hasn't seen a locksmith, or probably a safe technician in a long time,
1761910	1763790	you're probably going to be in good shape on that.
1763790	1766990	Because there's going to be quite a bit of drag, especially on the first and second digits.
1767070	1768570	Pulling off that third one is hard.
1768570	1772690	You've got to remember that a lot of times you've got four inches of steel between you and that wheel pack.
1772690	1774530	It makes it hard.
1774850	1776910	Practice helps a ton on this guy.
1780700	1781660	Yeah.
1782280	1802800	But we're going to switch from this guy, the manual method, to electronic safes here in just a second.
1812870	1816590	Let me just give a quick overview on some of the good and bad things about this.
1816590	1819130	Backdialing is quick and easy with a little bit of practice.
1819130	1820790	It's really not that hard.
1820930	1823610	Backdialing can be the size of just fiddling with the lock.
1823610	1827790	So you can just walk up to it and do a NASCAR turn on a safe.
1827790	1836810	All you've got to do is glance down whenever you feel extra drag and see if that's either the forbidden zone kicking in there or an actual wheel picking up.
1837790	1846050	Backdialing works on most mechanical safe locks, including 2M, 1, 1R, especially the NASCAR method.
1846050	1849610	The Feynman method will pretty much only work on older safe locks.
1850290	1853170	The information gained can be used for manipulation.
1853230	1858330	If you already know a couple of the digits, or one of them even, that helps a lot in manipulation.
1858330	1860930	It also obviously just helps a lot in brute forcing it.
1863230	1864950	Backdialing only works with safe open.
1864950	1869750	Obviously that's a huge bummer, and you're saying, oh man, you know, but it actually can be powerful.
1869750	1875290	Because actually knowing the combination is a lot different from merely just having access to it during the day.
1875290	1877490	Feynman just had access to it during the day.
1877490	1884870	He wasn't even supposed to open up all of these atomic bomb secret, you know, filing cabinets that they had around there.
1884870	1888810	Instead he just walked up and he just played with the lock while he was talking with somebody.
1888810	1891450	No one ever noticed. No one actually found out the Feynman method.
1891450	1893290	They thought he was some mechanical guru.
1895530	1902950	Sometimes also, especially with the NASCAR method, you'll end up with the safe being locked because you won't be able to determine the third wheel.
1902950	1908670	In reality, that's usually not such a big deal because safes get accidentally locked all the time.
1908990	1911370	You know, people bump them and stuff like that.
1911370	1917430	So most of the time it's not really considered a security threat that the safe, oh gee, was unlocked and now it's locked.
1917430	1919990	Well, you know, who fucked with the safe?
1920070	1923510	That's about it. That's the only security threat raised.
1924530	1926930	The Feynman method usually takes too long.
1926990	1931370	It's a lot of jiggling back and forth to try and bounce around and find all the numbers.
1931370	1933970	And you really only get one time with an open safe.
1933970	1938970	Obviously, if you screw up on either method, you're going to end up with a locked safe and you can't do back dialing.
1940910	1943210	How do you protect your safe from back dialing?
1943210	1948870	First of all, don't leave the safe unlocked or day locked, which is just as bad.
1949330	1954270	Some electromechanical locks can also automatically relock themselves after a short period of time.
1954270	1955190	That's cool.
1955250	1958110	Mechanical locks can also be supplemented with things like alarms.
1958110	1963290	Use of time locks, that is, you can only open the safe during business hours,
1963290	1967930	well, that pretty much screws the whole point of trying to figure out how to open it up later on.
1968410	1972310	Additional security measures such as video surveillance, guards, perimeter alarms,
1972310	1976530	all that good general security stuff is a great idea to help protect your safe.
1978630	1981990	Let's talk a little bit about my friend Spike the WonderSafe.
1982990	1988290	If you ever wondered why I called it that, it's because I kind of wondered why Spike has even called a safe.
1991290	1996150	Spike's full name is the Sentry A5835 Fire Safe.
1996790	2000290	It's one model out of a dozen that are all very similar.
2000930	2004570	They're very popular. Obviously, you go around and you see tons of Sentry safes.
2004810	2009930	Sentry doesn't really claim that this provides significant burglar resistance,
2009930	2012130	but people just generally assume that it does.
2012130	2016590	Kind of like when they wander down by that hardened shackled master padlock
2016590	2019530	and think it's really a significant barrier to entry.
2020270	2023210	However, you know, like I say, Spike is terribly misunderstood.
2023270	2024690	He's great in a fire.
2025250	2028330	I've actually had read accounts of many locksmiths that said,
2028330	2032890	man, they pulled a Sentry out of a fire, you know, they opened it up, all the contents was great.
2032890	2034710	I mean, they really are good in a fire.
2035550	2039250	However, to keep burglars out, or just whoever, they're pretty sucky.
2040850	2043050	Now, Spike doesn't look totally wimpy.
2043050	2045770	He has something kind of like two-factor authentication.
2045930	2051230	First of all, he's got a tubular lock, and also electronic keypad is five-digit combination.
2051230	2053410	Well, that's pretty stout, you know.
2053410	2055410	God, I hate to guess five digits.
2055590	2057970	You know, but unfortunately, it looks kind of deceiving.
2058910	2062690	Spike's security problems all began back in 2000 when this guy named Freddy,
2062690	2064110	you know, there's Freddy the Wire,
2064110	2067990	started spilling safe-cracking secrets on the Alt Locksmith news group.
2067990	2069910	I don't know if you guys ever frequent Alt Locksmith.
2069910	2072470	It's pretty much useless.
2072770	2076210	That's because a lot of locksmiths hang around it,
2076210	2082790	and they like to basically dump on anything that's... any information that really comes through there.
2082790	2084110	They spread a lot of misinformation.
2084350	2087050	There's really not a hotbed of good information.
2087070	2091490	If you want a hotbed of good information, go to Lockpicking101 or groups like that.
2092090	2096030	One of the secrets that Freddy tipped was something called spiking.
2096790	2104370	Spiking involves passing electric current inside the safe to actually open it.
2105350	2109170	An electronic safe, basically, when you type the numbers on the keypad,
2109170	2112210	all it does is compare that with a little digital chip inside and say,
2112210	2113910	hmm, yeah, that's the right number.
2113910	2119110	And it pops electric current inside the safe, which activates a solenoid.
2119110	2121550	A solenoid is basically just an electromagnet.
2121590	2125610	And it pulls back the bolt, which allows you to turn the handle, which allows you to open the safe.
2126850	2131170	In 2002, there was a news group, actually a website,
2131170	2136010	and a guy on there, they were having a discussion about whether you should buy electronic locks for your gun safes or whatever,
2136010	2137270	because they're a lot more convenient.
2137390	2138610	They're a lot quicker.
2139310	2143190	Dialing a regular conventional mechanical safe lock is kind of a pain in the ass sometimes,
2143190	2144490	especially if you're in a hurry.
2145470	2150590	But one guy on there said, you know, he works as the chaplain in a penitentiary.
2150870	2153610	And the prisoners there said, oh man, don't do that.
2153610	2155730	You can open up those things with a nine-volt battery.
2156810	2157830	Well, you know what?
2157950	2159150	They were right.
2161090	2164970	So, obviously, they've known for quite a while the people who shouldn't,
2164970	2170870	so it's probably a good idea for everyone else to kind of learn what to avoid in electronic safe locks.
2171690	2174790	You know, again, Spike has this two-factor authentication now, right?
2174890	2180130	So, you know, even if you found out the five-digit code, you still have to work on the tubular key.
2180130	2184070	You know, again, unfortunately for Spike, he's kind of having this run of bad luck.
2184810	2188130	Remember the kryptonite bicycle lock in the Big Pen?
2188270	2192050	You know, they had that Texas grudge match and the Big Pen won.
2192150	2192910	Yeah.
2193150	2196150	Unfortunately, Spike's pretty much got the same thing going on.
2210100	2212880	Ah, there's our instruments of destruction.
2212940	2215820	That is a Flexmate Grip Pen.
2216140	2217980	Flex Grip Elite, actually.
2218160	2220700	Oh, and that's our little Sentry Safe Spike.
2221400	2227000	Here's the most complicated part of this process, removing the ends of the cap of the pen.
2227180	2230020	This took the longest, actually, of the whole thing.
2235020	2236220	Oh, there we go.
2236780	2239120	Notice you, this is a very difficult technique.
2239120	2242860	It involves inserting the pen into the tubular lock.
2242860	2244820	You have to press kind of hard.
2245260	2246400	Yeah, that's, okay.
2246400	2247880	Oh, there we go.
2253630	2258090	I was going to do this demo live, but lugging around 30 pounds worth of safe locks was enough,
2258090	2260670	and I figured the 100-pound safe could sit in the office, you know?
2262470	2265650	I'm going to take it out just to prove that that wasn't a fluke.
2265650	2269430	Although I am cheating here, because actually, this pen has basically been an impression.
2269430	2273690	It's basically a key at this point, so, you know, it's even easier the second time around.
2274410	2274910	Yeah.
2275070	2277170	Notice I locked it back again, too.
2277170	2278550	This, you know, works both ways,
2278550	2282270	because you don't really want people to know that you've been playing around with their sentry safe.
2284650	2287830	Okay, now we've got to tackle the other part of our two-factor authentication.
2288310	2290950	Well, first thing we do, we've got to get rid of that keypad.
2291570	2295010	Fortunately, it's made out of good industrial-grade plastic.
2296610	2299310	Get rid of all those bits we don't really need,
2299950	2301290	and I'm going to get to flip this around,
2301290	2305270	and I do a slightly different camera shot here to kind of show you a little bit better what's going on.
2305690	2308590	It's hard to see, but notice there's two plugs there.
2308590	2310450	One's got a black-and-white wire on the bottom,
2310450	2313370	and the other one's got a black, I'm sorry, black-and-red wire on the bottom,
2313370	2315750	and the top one's got a black-and-white wire.
2316030	2319710	If you look at the battery pack, it's got red and black coming out of it,
2319710	2324250	and if you look very carefully, you'll notice that the black-and-white wire runs inside the safe.
2324550	2326110	Oh, gee, I wonder what that's for.
2326110	2327170	That's a 9-volt battery.
2327170	2330730	I put tape around the end to keep the wire separated for me very conveniently.
2333250	2333650	And...
2333650	2334330	Bop!
2346520	2350620	It took my dog Ginger three weeks to learn that trick, though, so it's not that easy.
2350620	2351720	It's really not.
2352340	2357840	Actually, this is the other hard part, is getting that goddamn plastic thing back on.
2358240	2361380	But, you know, you don't want to leave a messy safe, you know.
2361380	2363040	That's what I always say, you know.
2363540	2365540	Oh, look, so we're all locked back up again.
2365540	2366680	Tubular lock's in.
2366680	2368000	Pop that thing out.
2368320	2369660	And that's it.
2370180	2372640	You know, obviously, I went in a big hurry there.
2372640	2374920	That whole video is three minutes long.
2374920	2378440	The actual opening of the safe part is, like, two minutes long.
2378620	2381600	Obviously, if I was rushing it, you'd probably do it in about a minute.
2381780	2383560	And that's to open and close it.
2384320	2388800	So that's about it for Spike the Sentry WonderSafe here.
2389700	2391460	Here's some tips, folks.
2391660	2397240	Never assume a fire-resistant safe has any burglar resistance, okay, unless it's actually rated for them.
2397240	2400340	And there are safes that are both burglar and fire-resistant.
2401440	2405800	Specifically ask, when you buy an electronic safe, if it's spike-resistant.
2406220	2410120	If you're buying for somebody who doesn't know what that means, you probably need to go someplace else.
2410640	2419140	If, you know, the locksmith guy's jaws drop open and, you know, you realize you actually know what you're talking about,
2419140	2421500	then he may actually sell you a decent safe.
2422440	2426940	A lot of these safes nowadays are really crappy.
2427060	2430780	And you've got to be really careful, especially on the cheap gun safes.
2430780	2433680	I showed you that gun safe lock earlier and told you it was a piece of crap.
2433680	2435100	It is. It's mechanical.
2435160	2438720	The electronic ones are also generally pretty crappy.
2439060	2442820	There is a danger, by the way, of opening a safe via spiking.
2442820	2444640	I used a 9-volt battery.
2445020	2449160	Quite frankly, the battery pack in that machine is, I think, only produces 6 volts.
2449160	2456100	And you can actually damage the electronics on this circuit board by spiking.
2456100	2460280	Sometimes they're actually made to damage the circuit board by spiking.
2460280	2461920	That's their spike resistance, if you will.
2461920	2464160	It also allows them to sell another safe.
2464740	2467080	So that's a really great idea, I guess.
2467100	2469600	Anyway, very important.
2469600	2471880	Limit your access to fire-resistant safes.
2471880	2475880	They're generally just not that great as far as actually protecting your valuables.
2475880	2480780	Also, too, if you come up against a conventional safe cracker, he's going to break out something called a drill.
2480880	2485700	And he's going to drill through this white, fluffy cotton stuff that they have inside fireproof safes.
2485700	2488800	And let me tell you, it doesn't slow you down nearly as much as hard plate.
2488940	2493180	So it's just generally a good idea to keep an eye on your fireproof safes.
2493480	2495640	Alarms, video guards, surveillance.
2496500	2504240	If you don't get anything else out of this whole conference, you should realize that good security always relies on overlapping layers of security.
2504240	2509340	Never depend on a single firewall or that single safe to be safe.
2509520	2516360	Make sure you wrap it around with other IDSs and security guards, alarm systems, and things like that.
2516360	2519320	It's the only way you can stay safe.
2519360	2520560	Questions?
2521500	2522500	Yes.
2526830	2530550	Yeah, you can, although a lot of times they get a little bit sharper here.
2530550	2538230	And if you don't get the polarity right, or sometimes you could probably even check and have some sort of pre-circuitry.
2538230	2540170	And say, okay, well, I haven't typed in the digits.
2540170	2544710	So I'm basically in, if any electricity comes down this pike, I'm blowing myself up mode.
2545130	2548410	So there are spike-resistant safes. It's not impossible.
2548410	2550730	It's just when you deal on a cheaper level, you don't normally get it.
2550730	2551350	Yeah.
2553790	2557090	For fire resistance, I love Sentry, actually.
2557290	2560950	But, you know, they're just not burglar-resistant.
2560950	2564290	And, unfortunately, to pay to get both is pretty expensive.
2565150	2565770	Yeah.
2568530	2569490	eBay.
2569490	2581310	Everything I got here is on eBay, except the Moss Hamilton X8, which is the world's most secure lock, except for the X9, which came out in...
2581310	2582010	Anyway.
2582250	2583630	But the...
2583630	2584370	No, it's...
2584370	2587590	You'll only find this lock on high...
2587590	2589190	Yeah, let me switch back here.
2589190	2590390	Sorry, it takes so long.
2592610	2597630	I suppose they had this all set up to automatically switch, and, of course, that failed spectacularly.
2601550	2603730	This is probably going to take a while here, sorry.
2604910	2606330	And I'm running out of time.
2612550	2613690	Oh, there we go.
2614130	2614750	OK.
2614870	2616430	This is the Moss Hamilton.
2616510	2618990	It looks like a mechanical safe lock.
2618990	2620030	It is not.
2620030	2627330	It is actually very much like one of those radios you... survival radios you get that's got the crank on the side, where you have to, like, crank it up.
2627370	2631310	Basically, with the Moss Hamilton, you have to turn it until you power it up.
2631310	2633190	It's actually fully electronic.
2633190	2637510	With the Moss Hamilton, all of the electronics are inside the safe.
2637510	2639650	They're behind that four inches of hard plate.
2639690	2640070	OK.
2640150	2642270	So, you can spike this devil.
2642270	2643590	It's actually been done.
2643990	2646030	But it's not easy.
2646030	2648810	And you have to knock the dial off to get in.
2648930	2653490	And the government specifications for this was, A, it needs to be secured.
2653490	2653870	That's great.
2653870	2654590	That's wonderful.
2654590	2658230	But they wanted to make sure that no one could get in in a stealthy way.
2658230	2658470	OK.
2658470	2663510	You know, a lot of the stuff we talked about with back dialing and stuff and spiking, they're very stealthy.
2663510	2665390	You don't know that something's happened.
2665490	2668190	So, if you knock the dial off this sucker, sure, you can get into it.
2668190	2672250	I mean, you know, you can, you know, take explosives to the safe and get into it.
2672290	2674130	But people will know you've been there.
2674130	2674390	OK.
2674390	2675670	And that's all they're worried about.
2675670	2676630	It's going to take time.
2676630	2679190	It's going to take... and leave a big trail.
2679810	2683030	So, this is one of the most secure locks in the world.
2683030	2684630	They do have the new nine model.
2684630	2689030	That's the only reason why I own this one is because, of course, they closed this out and I got it, you know, reasonably cheap.
2690190	2691450	It is a great lock.
2691450	2695330	And, boy, this would definitely, you know, work great on your front door.
2697730	2698690	Anything else?
2698690	2701370	Oh, I'm afraid I've got to head on out here.
2701370	2704470	If anyone else has any questions, I'll be out that way.
2704890	2706770	And you can look at some of this stuff.
2706770	2708210	Thank you.