WEBVTT 00:31.550 --> 00:37.190 I'm an investigative attorney, and I do a lot of security work around the world. 00:37.350 --> 00:49.790 My associate this morning is Matt Fidler, who is a security consultant and former military intelligence, and does a lot of security work, both hardware and software. 00:50.390 --> 00:57.870 The impetus for this discussion this morning grew out of last year, the conference in New York. 00:57.870 --> 01:06.810 I was part of a panel involving vulnerability of locks issues, which is what I mainly deal with. 01:06.870 --> 01:09.690 And as a result of that, there was a sense 01:15.860 --> 01:24.100 of security community with regard to the ethics of disclosure of vulnerabilities of locking systems. 01:24.100 --> 01:42.620 And so we decided that we'd put together a presentation and really would like, at the conclusion of our PowerPoint, to solicit comments from you folks as to what your thoughts are so these can be taken back to the hardware security community. 01:43.700 --> 02:00.840 Essentially, the locksmiths and their organization have determined that there should not be any disclosure of defects or vulnerabilities other than the security professionals and security management and other locksmiths. 02:00.880 --> 02:04.460 I don't particularly subscribe to that theory, nor does Matt. 02:04.460 --> 02:07.520 We want to go through why we do not. 02:07.520 --> 02:15.280 It's obviously been dealt with in the logical security community a long time ago, but not really in the hardware community. 02:15.380 --> 02:18.740 And so we'll present a PowerPoint first. 02:18.740 --> 02:19.820 Matt will do that. 02:19.820 --> 02:25.260 And then we want to solicit your comments and input. 02:25.260 --> 02:27.020 Good morning, everybody. 02:27.120 --> 02:30.060 So as Mark said, we're going to run through this pretty quick. 02:30.060 --> 02:31.080 Then we can hop down. 02:31.080 --> 02:33.260 We've got some swag to throw out. 02:45.200 --> 02:48.760 So this quote goes back over 150 years. 02:49.460 --> 02:49.820 A.C. 02:49.820 --> 02:52.880 Cox wrote the book Locks and Safes. 02:53.040 --> 03:01.540 And you can read it, but it details that the unscrupulous individuals already have this bit of information. 03:01.540 --> 03:03.220 They already know about the defects. 03:03.220 --> 03:04.980 They're already exploiting them. 03:04.980 --> 03:09.660 And it's better to provide this information to the public and make it available. 03:10.340 --> 03:15.820 This was a Usenet post in June 2nd of this year from a locksmith. 03:15.820 --> 03:34.280 And again, you can read it, but basically they're indicating that providing this type of information, and I think this was in response to top-level master key or Eric Michaud's multi-lock attack on a plate, and just indicating that this is all secret information. 03:34.280 --> 03:35.760 It should not be published. 03:37.100 --> 03:39.140 So clearly, there are no secrets. 03:39.720 --> 03:43.160 We're going to talk about the importance of full disclosure. 03:43.160 --> 03:47.720 We'll identify from a physical security perspective what defects are. 03:48.200 --> 03:50.620 Mark will go into some of the legal issues of them. 03:55.350 --> 03:58.190 And then we'll go into some case examples of the last year. 04:01.030 --> 04:05.150 So again, locksmiths are the first line in most cases. 04:05.150 --> 04:11.060 They have publicly come out and said that, like you said... 04:11.060 --> 04:12.680 That would be all of you. 04:19.840 --> 04:21.860 So defects, what are defects? 04:21.860 --> 04:25.260 They're simple bypasses, really simple tools. 04:25.260 --> 04:28.320 We're talking seconds of bypass. 04:47.110 --> 04:54.130 We're talking about the type of bypass that does not require sophisticated tools, expertise, and time. 04:54.130 --> 04:56.570 The type of tools that I routinely deal with. 04:56.670 --> 05:00.630 Versus the ballpoint pen opening the tubular lock trick. 05:01.470 --> 05:05.290 That's the type of bypass that we're really talking about. 05:05.290 --> 05:13.430 The simple, really, defects or problems that lead to the ability to circumvent a locking system. 05:17.530 --> 05:20.410 Okay, well, the legal issues are real simple. 05:20.410 --> 05:21.630 The real question is... 05:22.510 --> 05:29.030 What does the end user have a right to know about the security products that they're buying and using? 05:29.030 --> 05:38.810 And what's the liability for the locksmith or architect or hardware vendor if they don't tell you about a vulnerability? 05:38.890 --> 05:42.610 And you put in that system and then you suffer a loss. 05:42.610 --> 05:43.590 Somebody gets injured. 05:43.590 --> 05:44.690 Somebody gets killed. 05:44.690 --> 05:45.750 There's a major theft. 05:45.750 --> 05:47.890 There's a compromise of information. 05:48.270 --> 05:51.830 Who's got the liability or is there any liability? 05:51.830 --> 06:00.950 And especially involving federal and state statutes regarding the disclosure of protection of medical information, financial information. 06:00.950 --> 06:03.730 These are serious legal issues. 06:03.730 --> 06:11.030 The locksmiths really haven't come to grips with them and frankly don't understand a lot of the problems that can face them. 06:11.030 --> 06:19.450 And as an end user security administrator or person responsible for physical security, the real question is... 06:19.450 --> 06:25.310 How much information do you have a right to know in order to make the security assessment? 06:26.070 --> 06:32.390 If you rely on a security consultant to make that assessment for you, that's fine. 06:32.390 --> 06:40.630 But if you're charged with the responsibility and fail to have all the needed information, then you really can't make that assessment. 06:40.630 --> 06:42.270 And then who is liable? 06:42.390 --> 06:44.790 Those are really the critical issues. 06:45.390 --> 06:54.850 So as far as statutory liability, I'm sure most of you out there in the IT world are familiar with HIPAA, SOX, GLBA, all the regulatory compliance issues. 06:54.850 --> 07:07.070 HIPAA, over one quarter or almost one quarter of HIPAA statutes govern physical access control, access to facilities, file lockers, etc. 07:07.070 --> 07:09.710 containing protected health information. 07:09.710 --> 07:14.870 So clearly we're all in bed with these regulatory issues. 07:14.870 --> 07:20.050 SB 1386, the loss of information, defamation assets. 07:21.410 --> 07:28.870 It's incumbent on us to understand the physical hardware that protects these assets. 07:30.770 --> 07:33.290 So we'll get into the ethical debate. 07:33.290 --> 07:37.630 Again, the question we want to throw out there, we'd like to get your feedback. 07:37.630 --> 07:39.570 Come on up, ask questions. 07:40.390 --> 07:43.950 But again, if the manufacturer is notified, what should they do? 07:43.950 --> 07:44.850 Should they admit it? 07:44.850 --> 07:46.810 Should it be publicized? 07:46.810 --> 07:48.870 We'll talk about some case examples. 07:48.870 --> 07:52.310 We recognize some other vendors and how they use it. 07:52.310 --> 07:53.630 Full disclosure. 07:53.990 --> 07:58.410 And ultimately, what is the vendor's level of negligence? 07:58.410 --> 08:00.350 And one other comment. 08:00.350 --> 08:12.070 If you find a security defect or a vulnerability that allows a lock or system to be bypassed, do you take it to the manufacturer without making it public? 08:12.210 --> 08:14.190 Or do you make it public? 08:14.190 --> 08:22.950 And that's really an interesting question because if you take it to the manufacturer and they have a large embedded base of security products, do they make it public? 08:22.950 --> 08:25.330 The responsible manufacturers will. 08:25.330 --> 08:26.650 A lot of them will not. 08:26.650 --> 08:28.830 So where does that leave the end user? 08:44.100 --> 08:45.140 Anywhere. 08:45.140 --> 08:47.180 In a closed group. 08:47.280 --> 08:49.060 In a closed group, yeah. 08:49.760 --> 08:56.700 So the second point, the reality is you disclose a defect but there isn't one really there. 09:01.430 --> 09:04.030 Someone else may or may not find it. 09:05.250 --> 09:07.690 So, again, we want to pose this question. 09:07.910 --> 09:16.450 There's been a lot of public disclosures on non-physical vulnerabilities that haven't come to fruition. 09:16.450 --> 09:21.730 They were one-time bypasses that someone was able to do in a controlled environment. 09:25.030 --> 09:39.910 Well, the other issue is, and a lot of the locksmiths have propounded, okay, if there's a known vulnerability in a lock or a piece of hardware, okay, you can tell the public, yes, there's a vulnerability, but you can't tell them what it is. 09:39.910 --> 09:41.350 What does that do for you? 09:41.350 --> 09:42.950 In our view, nothing. 09:43.150 --> 09:48.210 Because the minute you disclose there's a hardware defect, somebody's going to find it. 09:48.210 --> 09:50.330 And if they find it, they're going to publish it. 09:50.330 --> 09:52.810 A lot of locksmiths haven't heard of the Internet yet. 09:52.810 --> 09:56.210 And so they still believe that there are secrets out there. 09:56.210 --> 09:59.290 And as we keep trying to tell them, there are no secrets anymore. 10:00.970 --> 10:06.230 So some considerations for thought, again, between the questions and the evidence here. 10:06.410 --> 10:08.290 Need to know at full disclosure. 10:08.910 --> 10:11.650 The level of expertise that we spoke about, you know, some 10:20.990 --> 10:23.610 in seconds, but little or no training. 10:49.540 --> 10:55.560 So as far as UL ratings and other industry standard hardware ratings, point of danger feedback should be 10:59.040 --> 10:59.900 everywhere. 10:59.900 --> 11:01.460 And what is enough to be secured? 11:01.460 --> 11:04.020 What's too much or too little? 11:04.500 --> 11:06.440 And what's a security defect? 11:06.440 --> 11:12.940 A manufacturing defect versus an exposed vulnerability. 11:12.940 --> 11:19.640 Because there's a continuum of vulnerability versus a real significant design defect. 11:49.740 --> 11:52.940 Let me even take it farther. 11:53.860 --> 11:57.320 The real question is, who has a need to know? 11:57.320 --> 12:01.060 And let's talk about one of the security releases we did last year. 12:01.060 --> 12:05.500 I found a vulnerability in gun lock, gun trigger locks. 12:05.720 --> 12:15.400 A really serious vulnerability to the point that literally I shot a video in Toronto with an 11-year-old kid removing three of the most popular gun locks off a rifle in seconds. 12:15.500 --> 12:19.120 Should that vulnerability be disclosed to the public? 12:19.120 --> 12:21.040 Or how should they be warned? 12:21.040 --> 12:30.060 Because at some point, some kid's going to get hurt or killed by removing one of these gun locks that their parents mistakenly believe provides security on that weapon. 12:30.060 --> 12:33.600 It's a perfect example where there can be tragic results. 12:33.600 --> 12:34.460 Do you disclose it? 12:34.460 --> 12:35.400 Do you not disclose it? 12:35.400 --> 12:42.380 When I talked to one of the leading manufacturers in the industry, who I did some work for a long time ago, they didn't want to disclose. 12:42.380 --> 12:44.780 They didn't think it was a big problem, and they weren't talking about it. 12:44.780 --> 12:48.140 And they haven't to this day, and they continue to manufacture the locks. 12:48.220 --> 12:52.940 And these are major manufacturers that are putting this material out there. 12:52.960 --> 12:56.700 Every hardware store and sporting goods store in the country sells them. 12:56.700 --> 13:00.340 Should that be exposed in the national media? 13:05.270 --> 13:07.270 Okay, and we'll talk about that in a minute. 13:07.330 --> 13:21.170 Because, well, you say yes until you're the parent of a kid that reads a report on the Internet and then goes and pulls a gun lock off a weapon and shoots one of his classmates, and then you're going to be coming to me saying, what the hell did you publish it for? 13:21.650 --> 13:24.990 Because my kid wouldn't have known about it if you didn't publish it. 13:24.990 --> 13:26.310 That's the problem. 13:32.050 --> 13:32.990 I agree. 13:32.990 --> 13:34.590 We'll talk about it in just a minute. 13:38.930 --> 13:40.250 Right, well, that's the attitude. 13:40.370 --> 13:44.050 Actually, we took the attitude that we didn't publish it directly. 13:44.110 --> 13:53.550 We charged a $3 fee for the report so that you'd have to have a credit card to buy it, which would eliminate virtually every kid from buying the report. 13:53.550 --> 13:55.910 And that's how we control distribution. 13:55.910 --> 13:59.190 All right, we're going to get some swag out. 13:59.850 --> 14:01.070 Oh, yeah, that's important. 14:01.070 --> 14:02.730 Let's, uh, and R.C. 14:02.730 --> 14:04.350 and, uh, ask Bob. 14:08.890 --> 14:11.250 Yeah, that's it. 14:12.650 --> 14:14.950 All right, R.C., now you can answer. 14:16.330 --> 14:20.910 In the hardware, locked and hardware environment. 14:20.910 --> 14:21.990 Okay, there you go. 14:21.990 --> 14:24.910 Here's a copy of Make Magazine for you. 14:25.770 --> 14:28.850 So you're all familiar with the controversy. 14:28.850 --> 14:39.210 When we were in the New York Times two years ago on top-level master key, as I've referred to it in my disk set, in my book, extrapolation of the top-level master key. 14:39.210 --> 14:42.230 Very, very serious security vulnerability. 14:42.610 --> 15:01.510 Basically, anybody in an organization that has access to one key to one door that is on the top-level master key system can compromise that system unless they have the proper locks installed, they've been coded properly, and they have the proper restricted type of blank with sidebar coding. 15:01.510 --> 15:03.830 It's a serious, serious problem. 15:03.830 --> 15:08.290 Yeah, so the, uh, the second quote I got from Bob, about locksmiths 15:15.030 --> 15:17.570 being huge up in Arkansas, 15:21.430 --> 15:24.170 and that we compromise national security. 15:24.250 --> 15:31.470 Now, then, of course, they turned around and said, yes, but every locksmith has known about this for 50 years, so it's no secret. 15:31.470 --> 15:38.970 So, of course, there would be a slight inconsistency in that position, but it shouldn't have been disclosed notwithstanding everybody knew about it. 15:39.390 --> 15:41.250 Everybody except the consumer. 15:41.250 --> 15:44.690 So, the tubular lock bypass, 15:50.860 --> 15:54.860 and then shortly after Hope published information on Weinstadt 16:01.600 --> 16:06.660 News, got some, a little bit of, you know, attention. 16:06.800 --> 16:20.840 It wasn't until an individual took that bypass technique and applied it to a kryptonite lock, that bike users are, you know, a little bit more crazy than motor users. 16:20.840 --> 16:27.860 Right, well, I can tell you the first two days that we posted that on our website, we had 100,000 hits. 16:27.860 --> 16:44.940 And I had thousands of emails from security administrators from colleges, governments, hospitals, schools, wanting to know what to do about their laptop locks, which escalated into the bike lock issue and into gun locks that use tubular locks. 16:44.940 --> 16:47.600 The problem isn't with the tubular lock. 16:47.600 --> 16:51.940 The problem is with inexpensive tubular locks that aren't designed properly. 16:51.940 --> 17:01.190 Now, as a result of that, and I can talk about kryptonite, they really did the right thing. 17:01.520 --> 17:14.580 They woke up one morning to all the flood of media, and it was sort of, it was a big surprise for them. 17:14.580 --> 17:20.460 And so, they spent a couple days looking at the issue, and then they finally made a corporate decision. 17:20.460 --> 17:26.640 They were going to replace every lock, which I believe was the very responsible thing to do. 17:26.640 --> 17:28.760 Frankly, there wasn't anything else they could do. 17:31.560 --> 17:42.420 They, the management of kryptonite, which is a subcompany of Schlage Lock, they made the decision to bite the bullet. 17:42.420 --> 17:49.060 They admitted the problem, and they offered a free replacement no matter when you bought your lock. 17:49.060 --> 17:58.040 They, to date, have replaced, to my understanding, about 350,000 of them, at a cost of about $10 million or more to Schlage. 17:58.200 --> 18:04.700 That is the responsible way to do it, and they've redesigned their lock, and so now it is a very secure piece of hardware. 18:04.700 --> 18:08.980 In fact, it has a security rating in Europe from the rating agency. 18:09.100 --> 18:11.140 They're not going to be easily broken. 18:11.140 --> 18:39.100 Now, that would never have occurred if, actually, we hadn't released our initial report, and then one of the bikers picked up on it and described the vulnerability for kryptonite locks, which have been and are the leader worldwide in the industry. 18:39.100 --> 18:41.100 And so it's a prime example. 18:41.280 --> 18:44.680 You know, the bottom line is don't kill the messenger for the message. 18:44.680 --> 18:50.140 If you have a security defect or vulnerability in your hardware, fix it or don't sell it. 18:50.160 --> 18:51.820 That's really the bottom line. 18:51.820 --> 18:59.560 Now, obviously, a lot of lock manufacturers don't subscribe to that theory, but they should, and the consumer really dictates that. 18:59.560 --> 18:59.840 Right. 18:59.840 --> 19:02.540 So, again, kryptonite clearly did it right. 19:02.560 --> 19:08.500 Other vendors, and we're not going to name names, but, again, engineers could not duplicate. 19:08.500 --> 19:10.500 They couldn't take a big advantage. 19:10.500 --> 19:13.720 For our people, we flexed Krypultra to bypass the lock. 19:13.720 --> 19:14.380 It's amazing. 19:14.380 --> 19:21.560 But I can also tell you that they are, because I'm in contact with a lot of them, they are implementing design changes that frustrate the problem. 19:21.560 --> 19:24.220 It's actually a very difficult problem to solve. 19:24.220 --> 19:26.520 It's not quite so easy as everybody thinks. 19:26.520 --> 19:33.700 But all of the vendors that I'm dealing with, they are taking a responsible approach now, and they are solving the problem. 19:34.440 --> 19:37.240 Okay, so bump keys or 999 keys. 19:37.240 --> 19:43.320 This is where a key is cut to its highest position on all the fittings. 19:43.420 --> 19:48.660 The inertia effect against all the pins. 19:48.660 --> 19:51.500 The key is inserted blind 20:00.350 --> 20:01.990 , and turn the key and open it. 20:01.990 --> 20:03.430 Yeah, actually, it's Mr. 20:03.430 --> 20:08.630 Newton from England, from 300 years ago, that helped us out on that with his third law of motion. 20:09.030 --> 20:14.350 He just didn't quite foresee it at that time, but that's exactly what it is. 20:14.350 --> 20:17.010 For every action, there's an equal and opposite reaction. 20:17.070 --> 20:24.490 And basically, when you wrap on the pins in a specific way, you create a few milliseconds of gap, and you can open the lock. 20:24.490 --> 20:33.870 I did some television interviews back at home demonstrating this, because it is a very big security vulnerability. 20:33.870 --> 20:39.670 Barry Wells has done a lot of work with it in Europe, and there's been a lot of publicity. 20:39.670 --> 20:42.350 Not so much in America yet, but it is a problem. 20:42.350 --> 20:45.450 It's a problem for every standard, conventional pin number lock. 20:45.450 --> 20:48.130 Not for most of the high security locks. 20:48.130 --> 21:00.310 But again, if the public doesn't know about it, then literally somebody can walk up to your residence door, your business door, and in two seconds open it with no damage and no real evidence of injury. 21:16.600 --> 21:19.020 Yeah, let me just address that for two minutes. 21:19.020 --> 21:24.300 About seven or eight years ago, I got a phone call from a locksmith in Hawaii. 21:24.500 --> 21:42.860 L-Safe, which is the largest in-room safe manufacturer in the world, they're owned by the Asa Abloy Group, has over a million safes in luxury hotel rooms, and virtually all of them are insecure than they were at that time, although they rated them as a high security safe. 21:43.140 --> 21:56.600 I looked at it, documented the defect, and frankly had a 16-year-old kid that was working for me in the office for the summer open it with a screwdriver and a paper clip in about one minute. 21:56.920 --> 21:59.340 And this was brought to the attention of L-Safe. 21:59.340 --> 22:00.540 They really didn't fix it. 22:00.540 --> 22:01.720 They didn't acknowledge it. 22:01.720 --> 22:08.820 They didn't acknowledge that I even existed because of the massive lawsuits that would have flowed from it. 22:08.820 --> 22:10.300 This is a perfect example. 22:10.300 --> 22:12.080 Hotel guests have no clue. 22:12.080 --> 22:15.000 I've done a lot of work in the hotel liability area. 22:15.000 --> 22:17.980 A lot of hotel locks are not secure. 22:17.980 --> 22:20.080 They should not be relied on. 22:20.080 --> 22:27.480 And the hotels, they're concerned, but they're not concerned because they have statutory exemption from liability and they have insurance. 22:27.600 --> 22:29.000 And so it's a problem. 22:29.000 --> 22:32.280 And again, as a consumer, you ought to be aware of the problem. 22:34.120 --> 22:37.800 So again, as Mark mentioned, we continue to do locks. 22:37.800 --> 22:41.220 That extends across the whole host of applications. 22:41.220 --> 22:45.640 Safes, Harley-Davidson brake locks, J.I.R. 22:45.640 --> 22:48.440 keys are compromised with that. 22:48.700 --> 22:49.700 It's huge. 22:49.700 --> 22:51.460 TSA luggage locks. 22:51.540 --> 22:54.160 Everybody's using them to lock their luggage when they fly. 22:54.160 --> 22:55.700 They're very insecure. 22:55.880 --> 23:06.300 We put out a security alert and demonstrated how you can take a piece of plastic from a credit card and open the most popular ones just by sticking a little piece of square plastic in the keyway. 23:06.300 --> 23:07.520 This is not security. 23:07.520 --> 23:13.420 And the real problem in that area is not theft from your luggage because it's easy to rip open luggage. 23:13.420 --> 23:23.360 The real issue, in my view, and I did a magazine article over in Europe on it, is that contraband can be put into your luggage after you think it's locked. 23:23.360 --> 23:27.520 And if it's not caught in security, then it can be a real serious problem. 23:27.520 --> 23:29.960 And again, Mark, talk about the gun 23:50.430 --> 23:50.750 . 23:50.810 --> 23:55.550 Well, multi-lock is a telescoping pin, very high security lock. 23:55.550 --> 23:56.890 They're made in Israel. 23:56.890 --> 23:59.090 I've been to their factory many times. 23:59.090 --> 24:02.230 They're also part of the Assa Abloy group out of Finland. 24:03.170 --> 24:08.890 Eric Michaud actually thought he came up with a compromise. 24:09.710 --> 24:22.090 When you are talking about bypass of locks, especially high security, one of the criteria is repeatability, which I don't believe can be shown in this particular bypass. 24:22.510 --> 24:24.710 Opening one lock doesn't mean anything. 24:24.710 --> 24:29.390 Opening all of them or 99% of them reliably within a time frame means a lot. 24:29.390 --> 24:31.950 That has not been demonstrated with multi-lock. 24:31.950 --> 24:33.550 And frankly, I don't think it will. 24:33.550 --> 24:36.750 I've done quite a bit of analysis on their locking system. 24:36.750 --> 24:38.170 It's a very secure device. 24:38.170 --> 24:40.150 But it was published. 24:40.170 --> 24:47.050 And the flip side of this argument is, it shouldn't have been published until it was truly documented. 24:47.050 --> 24:58.630 Theoretical in the laboratory is one thing, but you don't cause a manufacturer problem or you don't cause the public a security concern unless you can document it. 24:58.630 --> 25:01.770 And so that really is the flip side of this argument. 25:01.770 --> 25:04.190 All right. 25:04.190 --> 25:15.190 So, you know, we're really looking to empower you with your experience, your vulnerability exposures, to go out there, to look at hardware, and get all the 25:26.160 --> 25:27.060 information out there. 25:27.060 --> 25:28.800 There's a lot of material on the net. 25:28.800 --> 25:31.540 There's some on our website that's publicly available. 25:31.640 --> 25:33.200 A lot of it's restricted. 25:33.380 --> 25:36.180 But there's a lot of material out there. 25:36.180 --> 25:38.440 You really have to understand these systems. 25:38.440 --> 25:43.880 And again, it all comes down to what is your need to know, which is where I think we ought to begin this discussion. 25:43.960 --> 25:48.200 What is your need to know from manufacturers about vulnerabilities? 25:49.480 --> 25:52.040 So if you want to come up, I'll bring a mic down. 25:53.620 --> 25:58.420 And I think we ought to start off, what do you all think about the gun lock issue? 25:58.420 --> 26:01.080 And should we have disclosed it? 26:01.960 --> 26:04.640 I thought that's almost unanimous. 26:04.640 --> 26:07.540 Anyone for a free copy of LSS Plus? 26:08.280 --> 26:09.520 Come on up! 26:10.680 --> 26:11.960 I'm about to ask you a question. 26:11.960 --> 26:16.980 Actually , Matt, maybe they ought to come up afterwards, because otherwise it's going to take time into the presentation. 26:18.620 --> 26:21.240 Maybe they ought to come up to get CDs afterwards. 26:21.240 --> 26:22.100 Yeah, we'll do CDs afterwards. 26:22.100 --> 26:25.760 Why don't we do this at 10 to 11 so that we don't take time into this? 26:26.200 --> 26:30.240 Can you comment on electronic access control systems at all? 26:31.120 --> 26:31.920 Vulnerabilities? 26:32.220 --> 26:36.660 Can you comment on the vulnerabilities of electronic access control systems? 26:36.660 --> 26:45.820 Actually, I just did a survey study of all of the access control technologies for one of the government agencies. 26:46.260 --> 26:47.900 Some of them are secure. 26:47.900 --> 26:50.660 Some of them are marginally secure. 26:50.660 --> 26:54.020 There's been a lot in the media about how things can be compromised. 26:56.060 --> 27:05.900 Yeah, the real question is, if there's a security vulnerability on the electronic side, should it be published? 27:06.460 --> 27:07.920 What's your attitude? 27:10.540 --> 27:12.880 Okay, so should it be published? 27:17.250 --> 27:18.870 That's exactly correct. 27:18.870 --> 27:21.070 But the question is, should it be published? 27:23.370 --> 27:25.950 Yeah, you didn't have to use the microphone. 27:25.950 --> 27:31.710 I believe it should be, but manufacturers should be given some disclosure period so that they can react to it. 27:31.710 --> 27:36.950 Yeah, that is the responsible way to do it, unless national security is involved. 27:37.190 --> 27:44.830 Yeah, I mean, most manufacturers, us included, are working on preventing these things from coming out with new technologies. 27:44.870 --> 27:48.890 And it would be unfair for it to be disclosed before we had a solution to the problem. 27:48.890 --> 27:49.930 No , no, I agree with that. 27:50.030 --> 27:51.430 Okay, next question. 27:54.130 --> 27:57.570 Hello, my concern is... 27:57.570 --> 27:58.710 You have to speak up. 27:58.890 --> 28:08.350 My concern is with the HID card systems that I installed, just about every server room I had a chance to work in. 28:08.570 --> 28:15.010 And to date, I have not seen any published reports, any vulnerabilities on the system. 28:15.010 --> 28:20.890 I'm sure they exist, but what I'm basically concerned about is electronic systems. 28:20.890 --> 28:25.870 Well, obviously, Matt, maybe you should address that, but the old systems obviously were compromised. 28:25.870 --> 28:28.210 The newer ones are a little bit more difficult. 28:28.850 --> 28:29.630 Matt? 28:29.630 --> 28:35.910 So HID has their traditional proximity-based cards have been compromised. 28:35.910 --> 28:39.230 There is public information out there to duplicate a card. 28:39.550 --> 28:45.350 The new HID I-class cards defeat that capability. 28:45.350 --> 28:49.490 But there is publicly available information on the HID cards. 28:50.350 --> 28:51.230 Next. 28:53.130 --> 28:59.430 What do you think about a peer-review system like they do in scientific journals for lock security? 28:59.430 --> 29:00.090 Say that again? 29:00.090 --> 29:06.250 So in scientific journals, what they do is they sort of publish them and let everyone verify before it's considered good. 29:06.250 --> 29:08.310 Do you think that might apply well to lock? 29:08.310 --> 29:11.090 I think that happens on the internet about locks. 29:11.090 --> 29:16.510 It's just that it can really cause a manufacturer problem if you publish that there's a vulnerability. 29:16.510 --> 29:22.430 Well, I mean, do you think we could sort of engineer a place where you could publish a possible vulnerability and people wouldn't lose their head? 29:22.430 --> 29:25.370 I don't think... see, I think that would be all right. 29:25.670 --> 29:32.570 My theory and Matt's theory in all this is the more people that are looking at locks, the better. 29:32.570 --> 29:36.130 Because all it can do is improve the end product. 29:36.270 --> 29:39.370 There's a lot of sports lock-picking clubs in Europe. 29:39.530 --> 29:44.570 I go to some of them and routinely visit with them, speak and learn. 29:44.570 --> 29:48.290 They're just starting in America, and Matt can address that more. 29:48.390 --> 29:55.490 But I think it's a good thing because there are engineers, lawyers, doctors, teachers, kids, housewives. 29:55.730 --> 29:58.510 To pick a lock is an intellectual challenge. 29:58.510 --> 30:00.050 It's not just mechanical. 30:00.130 --> 30:01.750 To me, it's much better than chess. 30:01.750 --> 30:03.650 I've been doing it since I was 15. 30:03.770 --> 30:05.190 And it's intriguing. 30:05.190 --> 30:07.510 In fact, I'm doing a new book on the subject. 30:07.590 --> 30:10.770 And it is really intriguing. 30:10.770 --> 30:18.190 And so the more people that are looking at locks and finding potential exploits, in my view, the better. 30:18.190 --> 30:20.970 And the responsible manufacturers will agree with me. 30:20.970 --> 30:26.770 They want the input because at the end of the day, they want to make the best locks possible. 30:26.770 --> 30:28.130 End of story. 30:28.490 --> 30:29.270 Next. 30:30.050 --> 30:36.690 Briefly, lockpicking101.com is the definitive source for information. 30:36.690 --> 30:41.570 They've started some lock sports organizations. 30:41.630 --> 30:46.330 There's one in Europe that very well runs its tool, tool.nl. 30:46.330 --> 30:48.730 I think the URL was in the presentation. 30:49.410 --> 30:51.910 But lock sports are picking up. 30:51.910 --> 30:54.350 Clearly, we have the lockpicking competition here. 30:54.770 --> 30:55.930 It's a blast. 30:55.930 --> 30:57.010 It's a lot of fun. 30:57.990 --> 31:03.070 So I'm curious to get the thoughts on going back to the tubular gun lock issue. 31:03.070 --> 31:11.810 If you remove as far layers as you want to go, that also includes, say, store locks to gun stores. 31:13.210 --> 31:23.090 Given the number of lawsuits that have come against gun manufacturers for what has happened, do you believe there will be a change before there's a lot of lawsuits against gun lock manufacturers for the same thing? 31:23.090 --> 31:23.850 No. 31:23.850 --> 31:26.890 You know, it depends if they're negligent. 31:26.890 --> 31:30.350 If it was purely a negligent design, yes. 31:30.350 --> 31:40.990 The real problem in lockpicking and decoding and impressioning is one of expertise and skill level and time and tools required. 31:41.150 --> 31:59.830 If a 10-year-old kid can open a gun lock by wrapping it on the floor or sticking an ice pick into it, which is what I demonstrated, and pop it off the weapon in two seconds, I think they're going to get sued if somebody gets hurt or killed. 32:00.930 --> 32:05.070 It's a defective manufacturer and they all copied each other's defects. 32:05.250 --> 32:08.530 If it's more esoteric than that, no. 32:09.090 --> 32:16.670 Well , the reason why I mention that is a lot of the lawsuits that have been against manufacturers of guns have just been because of guns. 32:16.670 --> 32:17.750 Yeah, that's right. 32:17.770 --> 32:35.790 And so, going along those lines, if we do end up with something like a mandatory gun lock law, which could happen, given the fact that the locks actually work and you're still able to use a weapon, do you see that going down the bad path? 32:35.790 --> 32:48.930 Yeah, I mean, if the gun locks work, and I'm dealing with some manufacturers in Europe on this issue, if they work and then there's a defect and you're able to fire the weapon, it puts them a lot closer to liability. 32:49.930 --> 32:54.250 I'm not sure I... gun locks are a really complicated problem. 32:54.990 --> 32:55.990 Next. 32:57.610 --> 33:04.750 In the American patent system, we're dealing with software now, and it's stifling innovation left and right. 33:04.750 --> 33:14.570 I was wondering about your opinion on whether or not the American patent system is stifling or helping innovation in the creation of locks, and better locks. 33:15.010 --> 33:16.190 Yeah, I think it's helping. 33:16.190 --> 33:24.990 I mean, look, if you're inventive and create something that is unique and provides security, and some of them do, some of them don't, the patent doesn't guarantee security. 33:25.150 --> 33:31.970 I think our system rewards you for that, but it gives you a monopoly on that product for 20 years. 33:33.310 --> 33:37.710 Every major design defect in locks is described as patentless improvement. 33:38.130 --> 33:40.950 And so I've done a lot of research in the U.S. 33:40.950 --> 33:46.250 and in the patent offices to find out vulnerabilities from when I write books. 33:46.410 --> 33:49.450 And so, you know, it's a positive thing. 33:49.450 --> 33:53.990 So harder designs actually do make it into multiple vendors of locks. 33:54.170 --> 33:54.670 Yeah. 33:54.750 --> 33:56.030 Oh, sure. 33:56.270 --> 33:58.590 Yeah, look, there's nothing new in locks. 33:58.590 --> 34:02.530 Everybody copies everything and modifies it for patents. 34:02.550 --> 34:03.310 Yes, sir. 34:03.310 --> 34:12.230 Hi, you mentioned the full disclosure of 7 cases of national security. 34:12.290 --> 34:17.750 If you found out that some government organization was using a certain brand of lock, do you know about the users? 34:17.750 --> 34:20.330 You know, this audio system is not really good. 34:21.010 --> 34:40.290 If you found out that some government organization, you know, like some base was using a certain brand of lock and you knew there was a streaming vulnerability and you brought it to, you know, either the attention of security forces or someone in charge of security on the base or organization, 34:40.290 --> 34:44.790 and they didn't do anything about it, I mean, how do you normally handle that? 34:46.150 --> 34:49.110 Well, that's a real judgment call. 34:49.150 --> 34:55.390 I've brought vulnerabilities to GSA's attention and did not publish them upon their request. 34:55.510 --> 35:00.510 Even though their first comment was, if it's not covert, we don't care. 35:00.510 --> 35:03.490 If you have to drill a hole in the lock, we don't care. 35:03.490 --> 35:04.830 I said, okay, we're going to publish it. 35:04.830 --> 35:05.950 No, you're not. 35:06.350 --> 35:07.270 Why not? 35:07.270 --> 35:09.810 Well, because it's a security problem. 35:09.810 --> 35:16.050 Well, but these locks are used in the banking industry and everybody ought to know about it. 35:16.050 --> 35:20.090 No, they really shouldn't know about it, and if you publish it, we'll classify it. 35:20.270 --> 35:22.390 Now, that was the government's response. 35:22.390 --> 35:34.370 I wasn't afraid of their response because I don't think they could sustain that, but I didn't publish it because it was a responsible thing to do about five years ago. 35:37.030 --> 35:49.210 Regarding the situation where you disclosed to the manufacturer first, before the public giving them a chance to do like what Kryptonite did, what kind of turnaround time is reasonable for a manufacturer to be able to... 35:49.210 --> 35:51.130 Oh, I think Kryptonite was pretty reasonable. 35:51.130 --> 35:53.790 They did it in, like, two months. 35:53.850 --> 35:54.330 Really? 35:54.330 --> 35:55.090 Yeah. 35:55.090 --> 36:01.910 They had a huge problem, and they acknowledged it, and they fixed it. 36:01.910 --> 36:05.390 I mean, they did what they were supposed to do, and it cost them $10 million to do it. 36:05.430 --> 36:08.690 And with no questions asked, you know, they didn't depreciate the... 36:08.690 --> 36:12.650 If you had had that lock for 10 years, they still gave you a new one. 36:12.670 --> 36:25.850 They didn't depreciate the value like your insurance company would do on your homeowners and say, well, that lock's only... you know, you paid $100 for it, but it's only worth $25, so now we're going to give you a coupon for $25 to go buy a new one, which would have been a marketing bonanza for them. 36:25.850 --> 36:26.810 They didn't do that. 36:26.810 --> 36:27.670 They just replaced it. 36:27.670 --> 36:31.350 They said, hey, you know, send us your lock or send us proof, we'll send you more. 36:34.150 --> 36:39.630 I don't know if they... I don't know if they probably not. 36:39.630 --> 36:40.710 I don't know. 36:40.710 --> 36:43.030 But they do have a better lock now. 36:43.730 --> 36:45.130 It's a tough lock. 36:46.230 --> 37:01.270 I understand your argument about defective, you know, being something that maybe a 10-year-old could open versus a skilled person, but, you know, I don't have any 10-year-olds running around my corporation, and if I go to buy a lock to lock the data center door, 37:01.270 --> 37:03.230 you know, I want to be... 37:03.230 --> 37:16.870 I think as a consumer, I'm surprised that the Consumer Product Safety Commission or somebody else wouldn't go after manufacturers because, you know, we've had Firestone for the Ford tires on the SUVs. 37:16.870 --> 37:20.290 People got killed. 37:20.290 --> 37:27.310 You know, I mean, if I lock my house and a skilled burglar comes in and murders me, you know, I'm killed. 37:27.650 --> 37:36.430 Vioxx, the anti-arthritis drug, it was, you know, clearly uncovered that they knew there was a problem and swept it under the rug, and they're being punished for that fact. 37:36.950 --> 37:38.730 Will this happen in the lock industry? 37:38.730 --> 37:40.050 I don't think so. 37:40.050 --> 37:41.850 It's a different set of problems. 37:41.850 --> 37:48.610 And frankly, the problem is, in all those cases you've named, you're not dealing with criminal actions. 37:48.610 --> 37:56.930 Here you're dealing with somebody that's violating the law, and you really can't control that other than criminal statutes. 37:56.930 --> 37:58.270 That's the sanction. 37:58.390 --> 38:10.090 And so the real question, again, that nobody's really addressed yet is, what's your... how much information do you think you ought to be entitled to from the lock manufacturer, and who ought to be entitled to it? 38:10.090 --> 38:14.930 But isn't the lock's sole purpose to prevent criminal action in some ways? 38:14.930 --> 38:22.790 Yeah, that's true, but... yeah, I agree, but it's a little more complicated. 38:26.410 --> 38:27.430 That's right. 38:28.030 --> 38:30.330 Now, they're trying to sue the gun manufacturer. 38:32.610 --> 38:33.270 Right. 38:33.510 --> 38:36.590 Well, yeah, okay, but that's not going to go anywhere. 38:36.990 --> 38:38.990 Next question, because we're running out of time. 38:40.470 --> 38:56.270 Instead of waiting for a lock manufacturer to invest marketing dollars and then pissing them off by releasing a security breach, do you think the manufacturers would consider almost like a hardware open-source review of their design before going to market? 38:56.450 --> 38:58.990 Why not? 38:58.990 --> 38:59.470 No. 38:59.470 --> 39:00.910 But isn't it better than... 39:00.910 --> 39:04.550 Well , first of all, until they receive a patent, they're not going to publish anything. 39:04.970 --> 39:07.270 That's the way things work. 39:07.270 --> 39:12.890 And, I mean, part of the security of locks is you not knowing how they work. 39:12.970 --> 39:15.910 But didn't you just prove security by obscurity doesn't work? 39:15.910 --> 39:19.210 Yeah, well, actually, I prefer to call it security by ignorance. 39:19.750 --> 39:31.110 And that's really what it is, because, look, if you're a security manager, IT professional, you're charged with a physical security responsibility as well as logical security. 39:31.110 --> 39:41.450 You can't make the risk assessment in your organization unless you know what the bypass techniques are and are shown what those are. 39:41.550 --> 39:44.470 If they'll tell you that, I don't have a problem with their policy. 39:44.470 --> 39:47.970 I don't think we ought to be telling criminals how to bypass locks. 39:47.970 --> 39:55.590 If you have a need to know because you have a protection responsibility, I think you have a right to know everything about that lock. 39:55.590 --> 40:06.390 Now, unlike software and Bill Gates and everybody who doesn't give you the code, if you're smart, you can take a lock and it'll tell you everything about itself. 40:06.470 --> 40:10.070 So if you're smart enough to figure it out, the information is there anyway. 40:10.110 --> 40:13.430 But I think you have a right to know that information. 40:13.850 --> 40:17.950 How can you differentiate between a consumer and a possible criminal? 40:17.950 --> 40:27.310 Well, that's a real good question because if the consumer relies on his locksmith or their locksmith as their security professional, then no problem. 40:27.310 --> 40:30.310 Let the security professional say, look, yeah, there's a vulnerability. 40:30.310 --> 40:31.990 You don't need to know what it is. 40:31.990 --> 40:34.950 I mean, my mother, she puts new locks on their house. 40:34.950 --> 40:37.130 She doesn't need to know how to pick them or open them. 40:37.130 --> 40:42.870 She just needs to know, is it secure and how long would it take a competent burglar to open it? 40:42.870 --> 40:45.610 Well, first of all, burglars don't open locks by picking them. 40:45.610 --> 40:47.890 They use a crowbar or a brick. 40:47.970 --> 40:50.590 Ninety-nine percent of the burglaries are done that way. 40:50.590 --> 40:57.450 We're talking about more sophisticated burglaries and information theft and compromise of data and that type of thing. 40:57.770 --> 41:05.190 Just a quick question about, you were saying that 50 years they knew how to circumvent the tumbler lock. 41:05.190 --> 41:12.990 And I'm wondering if the information space in lock picking is a lot tighter than information security because 50 years the public hasn't heard about this. 41:12.990 --> 41:15.330 Honestly, they really haven't. 41:15.330 --> 41:16.710 It's really quite amazing. 41:16.710 --> 41:22.290 This has been around for a long, long time, especially on plum keying and on master keying. 41:23.150 --> 41:24.770 A lot of folks know about it. 41:24.770 --> 41:26.870 The locksmithing community was aware of it. 41:26.870 --> 41:30.830 The problem was they weren't telling their end-user customers. 41:30.830 --> 41:32.570 A lot of them didn't understand it. 41:32.570 --> 41:35.970 So the end-user customer had no way to assess their risk. 41:35.970 --> 41:41.250 So the second part of the question I had is, for the kryptonite locks, I don't know a lot about locks, but I know about bytes. 41:41.250 --> 41:47.890 And I haven't seen, before this vulnerability was published, anyone whose kryptonite lock ever was really knocked open. 41:49.410 --> 41:52.250 I'm sure there are, but I'm wondering if you have any statistics. 41:52.410 --> 41:58.110 Actually, what we published, a variance of that was published about 10 years before in the UK. 41:58.110 --> 41:59.690 Nobody paid any attention to it. 42:00.550 --> 42:06.310 If you understand lock-picking theory and impressioning theory, then it's a real simple deal. 42:10.710 --> 42:13.830 Going to travel locks for a second. 42:13.830 --> 42:24.910 About 10 years ago, actually maybe 12 or 13, we had an attempt by the government to put something into place called Keyestro in cryptography. 42:25.970 --> 42:32.650 Would you consider the quote-unquote TSA safe locks to be a form of physical Keyestro? 42:33.730 --> 42:34.550 No. 42:34.550 --> 42:37.330 First of all, they're $10 cheap locks. 42:37.330 --> 42:39.990 And the problem is the public doesn't understand that. 42:39.990 --> 42:41.890 They think they're buying security. 42:41.890 --> 42:43.790 And it's a matter of convenience. 42:43.790 --> 42:45.130 Look, you have two choices. 42:45.130 --> 42:56.710 If you want to lock your luggage to prevent pilfering, allegedly, then you put a lock that TSA can get into, because otherwise they're going to cut the lock, because they have a legitimate interest in seeing what's in your luggage. 42:56.710 --> 42:57.230 End of story. 42:57.230 --> 42:59.310 I mean, that's why TSA locks were developed. 42:59.510 --> 43:11.990 A trade organization got all the lock manufacturers together, established criteria for five different kinds of locks that all have master keys or a bypass key that TSA can get into. 43:12.050 --> 43:13.370 And that's their sole purpose. 43:13.370 --> 43:17.150 But isn't that a... that's not a form of Keyestro? 43:17.150 --> 43:21.290 It's not a form of giving them, here's the pattern for the key to get into the lock? 43:21.290 --> 43:22.950 In that regard, yeah. 43:22.950 --> 43:27.290 But I don't think anybody's going to disagree that TSA doesn't have the right to check your luggage. 43:27.290 --> 43:28.430 No, I'm not disagreeing with that. 43:28.430 --> 43:29.310 I'm just saying that this is... 43:29.970 --> 43:30.310 Yeah , maybe. 43:30.310 --> 43:32.330 I mean, it's a loose parallel. 43:33.110 --> 43:34.790 I don't think it's exact. 43:35.370 --> 43:36.090 Okay. 43:36.090 --> 43:36.430 Yeah. 43:36.430 --> 43:37.190 All right. 43:39.070 --> 43:40.230 Yeah, actually, I would just... 43:41.250 --> 43:45.290 I travel a lot, and I would recommend, instead of using a lock, use a penetration tag. 43:45.290 --> 43:47.350 Use, like, the little wire tags or something like that. 43:47.350 --> 43:49.530 Because at least that way you know if somebody broke into the bag. 43:49.810 --> 43:51.110 You tagged it. 43:51.110 --> 43:53.210 You know when you pull it... 44:01.510 --> 44:05.030 Well, it's not TSA that I'm worried about sticking something back in there. 44:05.030 --> 44:05.690 They'll steal it. 44:05.690 --> 44:06.950 They won't put it back in. 44:08.450 --> 44:10.350 Well, that's been documented. 44:10.350 --> 44:11.490 There's been lots of arrests. 44:11.490 --> 44:22.330 The problem is your hotel porter in London putting something into your locked luggage that you don't know is there, either narcotics or explosives or whatever, and you think you're okay because it was locked. 44:22.330 --> 44:24.050 That's where I think the problem is. 44:24.290 --> 44:26.130 We've got time for one more quick question. 44:26.130 --> 44:26.570 Yeah . 44:32.250 --> 44:36.750 I'd love to do something with it. 44:36.750 --> 44:38.650 I had some media interest, but nobody... 44:38.650 --> 44:39.470 It's America. 44:39.470 --> 44:40.590 Nobody does anything. 44:40.590 --> 44:42.570 I think it's a great idea, though. 44:43.370 --> 44:44.630 Are we out of time, Matt? 44:44.630 --> 44:45.590 Yeah, we're out of time. 44:45.870 --> 44:47.190 Thank you very much. 44:49.970 --> 44:50.650 Pleasure.