1
00:00:18,440 --> 00:00:21,900
Hawkeye Dank has been pretty active over the last while.

2
00:00:21,960 --> 00:00:23,300
It sure has.

3
00:00:23,420 --> 00:00:24,840
That looks like we're in.

4
00:00:26,240 --> 00:00:29,320
I haven't seen it yet, but I'll transition us live.

5
00:00:31,950 --> 00:00:33,470
There it is.

6
00:00:33,490 --> 00:00:34,650
Alrighty.

7
00:00:37,600 --> 00:00:40,780
Okay, thank you everybody for coming along.

8
00:00:40,780 --> 00:00:48,060
This is the Q&A portion for exploiting keyspace vulnerabilities in the physical world.

9
00:00:48,060 --> 00:00:51,560
Your main goon here is going to be Pasties.

10
00:00:51,560 --> 00:00:52,760
This is Fallible.

11
00:00:53,880 --> 00:00:57,460
And thank you, Bill Graydon, for coming to join us today.

12
00:00:57,560 --> 00:01:00,580
Bill, could you tell us a little bit about yourself before we get started?

13
00:01:01,920 --> 00:01:03,220
Yeah, absolutely.

14
00:01:03,660 --> 00:01:06,120
So, my name is Bill, as you know.

15
00:01:07,140 --> 00:01:09,100
This is my second DEF CON.

16
00:01:09,280 --> 00:01:20,660
I actually started out last year as both a main track speaker and a village lead, founding and running the Lock Bypass Village, which I'm helping out with this year as well in the online forum.

17
00:01:21,240 --> 00:01:34,120
In my non-hacker life, I worked for a company called GGR Security, doing physical security consulting, audits, and a number of related services in that regard.

18
00:01:34,120 --> 00:01:42,440
So, sort of the very flashy aspect of that job that is highly applicable to the DEF CON environment is physical penetration tests.

19
00:01:42,440 --> 00:01:46,700
With which some of these things that I talk about fit into.

20
00:01:47,940 --> 00:01:49,140
Excellent.

21
00:01:51,400 --> 00:01:52,720
Go ahead.

22
00:01:52,720 --> 00:01:55,680
Yeah, we're seeing a couple of questions come in right now.

23
00:01:56,500 --> 00:02:01,200
Well, we have one question about, have you ever created a bump key?

24
00:02:01,200 --> 00:02:06,640
Another one is your opinions on the disk style locks.

25
00:02:07,020 --> 00:02:11,440
So, some general questions about different types of locks right now.

26
00:02:12,200 --> 00:02:17,000
You're welcome to take a stab at those, and we'll wait for a few more talks to come in.

27
00:02:17,660 --> 00:02:24,380
So, in terms of creating the bump key, I've created hundreds, possibly thousands of them.

28
00:02:24,560 --> 00:02:42,020
Yeah, I mean that video that I showed at the very start of my talk with how keys actually get originated, all you have to do to make a bump key is that cutter wheel that's taking a byte out of the key at particular positions, you just take that all the way down to the bottom position and bend some,

29
00:02:42,020 --> 00:02:47,300
and you do that across all the spaces, and that'll do it for you.

30
00:02:47,480 --> 00:02:54,840
So yeah, I've absolutely done that for both regular systems as well as high security ones like Medeco.

31
00:02:56,300 --> 00:03:09,640
So, sort of along the lines with your talk, when you got to the point where you were like narrowing it down to like the last like 10 or 18 keys, is it possible to make like a targeted bump key that would just be more effective?

32
00:03:09,980 --> 00:03:12,660
Just like dealing with all of those all at once?

33
00:03:13,140 --> 00:03:17,220
That is an incredible question, and the answer is absolutely yes.

34
00:03:17,440 --> 00:03:26,660
What a targeted bump key would look like is effectively the lowest cuts that are present in any of those keys in your narrowed down key space.

35
00:03:26,960 --> 00:03:35,060
And so in fact, this is something that's been known to locksmiths for decades, actually the possibility to do something like that.

36
00:03:35,060 --> 00:03:48,200
So , I didn't have time to talk about a lot of this in the talk, but one aspect is I talked a bit about how you want your grand master key to be one cut in the highest position, so that none of the change keys under it can be filed down.

37
00:03:48,200 --> 00:03:52,420
You also, in many cases, want it to have one cut in the lowest position.

38
00:03:52,480 --> 00:04:09,660
And the reason for that is if there's any of your change keys that are lower than your master key in all positions, then that change key will act as a bump key that will work in every lock on that system and can possibly be jiggled around and bump those pins all up to the master shear lines.

39
00:04:11,740 --> 00:04:16,420
So yeah, it's a great question and that's how you do it.

40
00:04:17,140 --> 00:04:24,340
And the next question, which I kind of interrupted there, was what are your opinions on disk style locks?

41
00:04:24,380 --> 00:04:27,740
Apparently storage locations hate them because they actually have to be cut off.

42
00:04:29,040 --> 00:04:30,860
Disk detainer type locks?

43
00:04:32,540 --> 00:04:35,900
So I'm looking at this question now.

44
00:04:35,900 --> 00:04:40,280
I'm not entirely sure what it means with how they have to be cut off.

45
00:04:40,660 --> 00:04:51,180
In terms of a storage location, like if someone needs their locks removed, I guess what the question is getting at is that maybe locksmiths are able to pick the other types of locks, but not the disk detainer locks.

46
00:04:51,240 --> 00:04:53,880
That effectively comes down to the skill level of the locksmith.

47
00:04:53,880 --> 00:04:56,520
Disk detainer locks can be picked just like any others.

48
00:04:57,240 --> 00:05:02,680
They're a much more specialized skill set to do and they require more specialized tools to do.

49
00:05:03,160 --> 00:05:05,980
And the good ones are harder.

50
00:05:06,620 --> 00:05:13,560
So if you've got an Ablet ProTek on there, there's no verified, documented picking success with those.

51
00:05:13,560 --> 00:05:20,400
So in that case, then yeah, cutting them off is your only option, which for an Ablet ProTek is also going to be a hell of a job.

52
00:05:21,180 --> 00:05:26,640
So I'm not entirely sure what the question is getting at, but I think that pretty well covers it.

53
00:05:26,640 --> 00:05:27,640
More than likely.

54
00:05:29,340 --> 00:05:41,520
I always enjoy when people come and give us more of the in-depth side of physical security stuff for DEF CON talks, and I appreciate you coming in and presenting that material.

55
00:05:41,520 --> 00:05:55,060
So as you're going through, you are explaining things from a bypass direction, at least a lot more bypass this year, right?

56
00:05:55,060 --> 00:06:00,060
You're not approaching things from the lock picking side.

57
00:06:00,060 --> 00:06:10,920
So how did you find yourself in the direction of the bypass instead of what seems to be more in vogue with the hacking community of the single pin picking?

58
00:06:12,120 --> 00:06:13,820
That's a great question.

59
00:06:13,820 --> 00:06:24,960
So with bypass, it's the sort of thing that in my anecdotal experience, at least, there's a lot less literature out there about those particular techniques.

60
00:06:24,960 --> 00:06:32,340
You've got a whole bunch of great talks at various conferences about them, but nothing super formalized.

61
00:06:32,340 --> 00:06:37,700
There's a lot in that field that really is yet to be discovered or potentially yet to be published.

62
00:06:38,220 --> 00:06:52,480
Since, as I mentioned in some of my other talks with Bypass Village, lock bypassing has traditionally been the domain of criminals and of classified materials, both of which tend not to get published.

63
00:06:53,340 --> 00:07:05,940
Locksmiths as well do it, but even still, the locksmithing industry is a very tight, tribal knowledge, apprenticeship-based type industry where they don't publish that sort of thing.

64
00:07:05,940 --> 00:07:12,900
So that's, I think, a large part of why the hacker community has not gotten into it nearly as much lately, or until lately.

65
00:07:13,660 --> 00:07:19,500
From a personal perspective as well, I have never been a very good lock picker.

66
00:07:19,500 --> 00:07:22,480
I understand the theory inside and out, but I just can't do it.

67
00:07:22,660 --> 00:07:25,420
And that's in a large part because of a fine motor disability that I have.

68
00:07:25,420 --> 00:07:30,180
So it's like, you know, I gotta go find something else that takes a bit more core skills.

69
00:07:30,780 --> 00:07:32,480
And so lock bypass is part of that.

70
00:07:32,480 --> 00:07:39,820
And then having founded and run the Lock Bypass Village is like, you jump headlong into it, you can't get out once you're running a village.

71
00:07:40,640 --> 00:07:42,200
I totally understand that.

72
00:07:42,200 --> 00:07:45,040
So what's your everyday carry kit look like?

73
00:07:45,940 --> 00:07:47,160
Good question.

74
00:07:47,560 --> 00:07:50,220
I mean, I am incredibly disorganized.

75
00:07:50,220 --> 00:07:56,460
So to think that I have an everyday carry kit is a bit of gratuitous to me.

76
00:07:56,580 --> 00:08:06,440
But, you know, if I'm anticipating needing to potentially get through a door, it's like, well, in that case, I'm carrying a much larger kit than what would be everyday carry.

77
00:08:06,440 --> 00:08:09,940
If I'm anticipating, well, maybe needing it, but probably not.

78
00:08:10,760 --> 00:08:15,200
You know, I might have a rake and a tension wrench, real simple.

79
00:08:15,200 --> 00:08:21,240
That's all the picking equipment for poking the latch out of the way.

80
00:08:21,540 --> 00:08:24,260
So like a shove knife for latch bypass.

81
00:08:24,480 --> 00:08:35,420
What I've got on my key ring is a little wire that's just an L-shaped end of wire that I can whip out and do that on any lock that I might encounter.

82
00:08:35,420 --> 00:08:37,120
So I've got that.

83
00:08:37,820 --> 00:08:39,340
And really that's about it.

84
00:08:39,340 --> 00:08:41,400
I don't carry a whole lot else with me.

85
00:08:41,400 --> 00:08:49,740
And I find that in many cases, if you can't improvise, it's not worth taking that particular approach in an everyday situation.

86
00:08:50,940 --> 00:09:07,700
I know there's a lot of discussion in the community, at least in the lock picking community, of most of what we do for fun as locksporters isn't all that practical out in the world trying to be a locksmith.

87
00:09:08,060 --> 00:09:16,080
At least from what I've heard, and maybe you'll either confirm this or tear this down.

88
00:09:16,080 --> 00:09:28,840
But if you're faced with a lock, it's usually going to be easier to attack the mechanism that holds the door together or get in through a window or etc.

89
00:09:29,920 --> 00:09:31,700
Oh yeah, absolutely.

90
00:09:31,700 --> 00:09:36,340
I mean, a large part of it is sort of not just hacking, but ethical hacking.

91
00:09:36,660 --> 00:09:43,120
It's like if our goal is to get into a facility, we're sort of balancing a number of objectives here.

92
00:09:43,120 --> 00:09:45,400
How much do we care about how long it takes us to get in?

93
00:09:45,400 --> 00:09:52,140
How much do we care about the damage that we do, the noise that we make, the forensic evidence that we leave behind, etc.

94
00:09:52,200 --> 00:09:55,480
So you kind of pick and choose your techniques based on that.

95
00:09:55,480 --> 00:09:58,020
And then of course, there's a cost element, there's a skill element.

96
00:09:58,020 --> 00:10:00,140
So it's pretty multi-dimensional in that regard.

97
00:10:00,660 --> 00:10:11,560
And the vast majority of practical cases, what we see in security consulting, is you're protecting against forcible, you're protecting against very, very, very basic bypasses.

98
00:10:11,560 --> 00:10:14,320
And that's about it, and that's what your threat model is.

99
00:10:14,620 --> 00:10:26,400
And so I think in some regard, the focus of the hacker community on ethical hacking has done somewhat a disservice for the blue team because they are protecting against the wrong threat model.

100
00:10:27,520 --> 00:10:37,960
And so you see that a lot with the forcible entry being really downplayed in terms of its impact on physical security.

101
00:10:41,160 --> 00:10:42,820
I like that as a thought.

102
00:10:42,820 --> 00:10:48,960
That's really interesting of talking about training the blue team maybe to not...

103
00:10:50,520 --> 00:10:58,980
The things that people in the outside world are going to hit you with might not be the same things that we as the hobbyists are going to hit you with.

104
00:11:00,640 --> 00:11:16,180
Do you have a specific example of something that is more realistic in the real world that a blue team might encounter as far as physical security protection goes that isn't normally tested or advocated for in these kind of talks, that kind of thing?

105
00:11:17,840 --> 00:11:23,320
Yeah, I mean if you... let's take a simple example.

106
00:11:23,320 --> 00:11:26,920
You're a mom and pop shop and you want to protect your store.

107
00:11:27,900 --> 00:11:35,720
If you go to... many police departments will do a very simple free security audit for you.

108
00:11:35,720 --> 00:11:41,000
And they know very well what the threat model is, and so they're recommending things like bars on the windows.

109
00:11:41,760 --> 00:11:48,640
If you go and ask many people in the hacker community to do a security audit, they're not going to think about things like that.

110
00:11:48,640 --> 00:11:57,900
They're going to try to use a fancy latch thumb turn bypass tool on the door and say, okay, you got to patch that up.

111
00:11:57,900 --> 00:12:02,960
And they might try some sort of electronic attack on your access control system.

112
00:12:02,960 --> 00:12:13,480
Sure, it's a vulnerability, but the sort of people that have the means and the motivation and the skills to perform those are not going to be breaking into their neighborhood mom and pop.

113
00:12:13,480 --> 00:12:14,220
Right.

114
00:12:15,640 --> 00:12:17,800
Matching the attacker to the threat model.

115
00:12:18,100 --> 00:12:18,820
Yeah.

116
00:12:19,760 --> 00:12:21,360
We got a question.

117
00:12:21,360 --> 00:12:26,100
Have you notified any security desks about the vulnerability of having their keys visible?

118
00:12:27,860 --> 00:12:29,600
Can you say the first part again?

119
00:12:29,600 --> 00:12:30,980
Have I notified them?

120
00:12:30,980 --> 00:12:31,440
Yeah.

121
00:12:31,440 --> 00:12:42,180
Has it been an actionable report or just informed them, like, hey, you've got your security keys on your ring and I can see them and that's a problem?

122
00:12:42,180 --> 00:12:43,140
Oh, absolutely.

123
00:12:43,140 --> 00:12:43,520
Yeah.

124
00:12:43,520 --> 00:12:48,140
It's one of the standard things we check for with any security audit.

125
00:12:48,440 --> 00:12:52,560
The biggest time that we see this is with multi-unit residential.

126
00:12:52,560 --> 00:12:55,440
If you've got a concierge desk, we leave that lying out.

127
00:12:55,440 --> 00:12:57,500
And it's a really simple human factors thing, right?

128
00:12:57,500 --> 00:13:02,720
So you just create, you know, put a little box there that they can put it in that shields it from public view.

129
00:13:02,980 --> 00:13:05,700
And that little box then can be self-locking.

130
00:13:05,700 --> 00:13:13,220
So if they have to walk away and handle something, that's not then left out there for anyone to see or take or whatnot.

131
00:13:13,220 --> 00:13:19,200
And we've seen some pretty egregious cases of that being breached when you don't have good human factor design in that regard.

132
00:13:21,500 --> 00:13:28,960
So first off, the tool that you showed off throughout the entirety of your talk, is that already available?

133
00:13:28,960 --> 00:13:32,020
Is that something that other people can see and use?

134
00:13:32,800 --> 00:13:33,340
Yes, it is.

135
00:13:33,340 --> 00:13:38,220
Yeah, so that's online at a number of links that I've posted in my talk.

136
00:13:38,220 --> 00:13:40,520
So you can find the source code on my GitHub.

137
00:13:41,400 --> 00:13:50,520
And tinyurl.com slash key dash space will link you to a version that you can run right in your web browser.

138
00:13:50,880 --> 00:13:52,220
That's awesome.

139
00:13:52,340 --> 00:13:58,400
We can share that in the track one channel here at the end if that's cool with everybody.

140
00:13:58,400 --> 00:14:10,420
So with that tool, it starts out with a pretty brute force approach and you start adding on these layers of knowledge.

141
00:14:11,160 --> 00:14:13,780
There was a lot of pieces of knowledge.

142
00:14:13,780 --> 00:14:18,660
Is that something that you just picked up through your experience?

143
00:14:18,680 --> 00:14:27,260
Or is this just like you just aggressively compiled all this information from everyone that you knew just to put this tool together?

144
00:14:28,740 --> 00:14:30,300
That's a great question.

145
00:14:31,020 --> 00:14:36,580
I'd say that a lot of it is experience just talking to people.

146
00:14:36,580 --> 00:14:43,000
The sort of thing that, again, that kind of tribal knowledge that exists in locksmithing communities, for instance.

147
00:14:43,000 --> 00:14:51,780
So we're fairly good friends with a number of locksmiths and so we chat with them about all sorts of stuff like this and get information there.

148
00:14:51,780 --> 00:14:58,420
And then a lot of it, when you kind of crunch the numbers and understand the mathematics behind how keying systems actually operate.

149
00:14:58,460 --> 00:15:03,040
At that point, you can formally model them with a number of mathematical constructs.

150
00:15:03,040 --> 00:15:06,400
And from that, these rules become a corollary of that.

151
00:15:06,400 --> 00:15:10,600
So a lot of it can be derived independently.

152
00:15:11,400 --> 00:15:15,740
And so, for instance, the rights amplification attack.

153
00:15:15,740 --> 00:15:20,960
So we derive that independently and then determine that actually this has been published about before as well.

154
00:15:20,960 --> 00:15:23,220
And it's been known in the locksmithing community.

155
00:15:23,220 --> 00:15:31,160
So it's the sort of thing that a lot of people have thought about, but hasn't until relatively recently been published widely.

156
00:15:32,040 --> 00:15:37,300
And to my knowledge, it's the first time that there's a computational tool for analyzing it.

157
00:15:37,760 --> 00:15:38,960
That's awesome.

158
00:15:40,100 --> 00:15:42,140
So we've got another question.

159
00:15:42,140 --> 00:15:47,560
Have you had any experience with working with life locks at any military contractor facilities?

160
00:15:49,480 --> 00:15:51,540
The answer is no.

161
00:15:51,540 --> 00:15:55,420
I will actually ask for clarification on what is a life lock.

162
00:15:55,420 --> 00:15:56,880
I don't know either.

163
00:15:57,820 --> 00:16:03,500
Hawkeye Denk, if you're still watching, you've got us all intrigued what a life lock is.

164
00:16:05,520 --> 00:16:11,140
I guess I'll bump back to your tool a little bit while we're waiting to hear back from Hawkeye.

165
00:16:14,420 --> 00:16:16,660
I totally blanked on my question.

166
00:16:16,660 --> 00:16:18,300
You got me.

167
00:16:18,400 --> 00:16:19,840
No , you're good.

168
00:16:19,840 --> 00:16:24,880
So your talk is quite long, and thank you for that.

169
00:16:24,880 --> 00:16:37,040
And actually, if anybody is out there looking forward to watching this, he or someone was nice enough to go through and nicely index all of the timestamps on that.

170
00:16:38,520 --> 00:16:39,580
Yeah, that was me.

171
00:16:39,580 --> 00:16:43,100
So, yeah, thank you for that.

172
00:16:43,100 --> 00:16:49,280
There was some... you mentioned some code books in there.

173
00:16:49,280 --> 00:16:56,840
And I get the impression there were some legal, possibly ethical implications of having that information available.

174
00:16:56,840 --> 00:17:04,340
Could you talk to that a little bit of any solutions that you're working on on trying to make that more accessible?

175
00:17:04,920 --> 00:17:05,840
Absolutely, yeah.

176
00:17:05,840 --> 00:17:13,220
So as far as code books are concerned, I mean, there's hundreds... well, there's thousands of them out there.

177
00:17:13,220 --> 00:17:16,980
There's hundreds that are common to see examples of in the wild.

178
00:17:17,700 --> 00:17:24,360
You know, everything from... I mean, any standard key system that has generally numbers associated with it.

179
00:17:24,360 --> 00:17:27,420
So you might have heard of common keys like 1284x.

180
00:17:27,420 --> 00:17:29,080
Well, that's part of a series.

181
00:17:29,560 --> 00:17:32,040
0151x, which you looked at in the talk, is another part of that series.

182
00:17:32,040 --> 00:17:34,780
And then there's 1700 others in it.

183
00:17:35,340 --> 00:17:39,240
C415a, so there's your national cabinet keying set.

184
00:17:39,240 --> 00:17:42,740
There's about 600 in the A series, as well as there's a B and a C.

185
00:17:43,260 --> 00:17:45,680
And there's hundreds of others like that.

186
00:17:45,680 --> 00:17:48,740
Medeco, non-mastered systems have code books as well.

187
00:17:48,940 --> 00:17:58,620
So this is a lot of data that's being compiled by a number of services out there, the most well-known of which is Instacode.

188
00:17:58,620 --> 00:18:10,200
So anyone that's looking for that information on a case-by-case basis can get a subscription to that and look up what is C415a, what's the bidding of that.

189
00:18:10,200 --> 00:18:12,700
You can't download the entire data set for that.

190
00:18:12,700 --> 00:18:14,620
We happen to have the entire data set.

191
00:18:14,620 --> 00:18:20,100
It's not licensed in a manner that we can then release it freely, unfortunately.

192
00:18:20,100 --> 00:18:34,220
One thing that I'm toying with to make that actually happen is create a crowdsourced platform so people can, if they have access to that information in a way that they're not constrained by the license, they can upload it.

193
00:18:34,340 --> 00:18:44,680
And then we can create a compendium of that, as well as I'm going to be adding back into the app a way to import that data, if you happen to have it, through whatever reason or whatever source.

194
00:18:44,680 --> 00:18:46,380
And then you can analyze it that way.

195
00:18:47,240 --> 00:18:49,600
So yeah, I'm working on a workaround for that.

196
00:18:50,720 --> 00:18:51,900
Yeah, go ahead.

197
00:18:51,900 --> 00:18:56,860
Just like spitballing, could that kind of crowdsourcing happen at a finer-grained level?

198
00:18:56,860 --> 00:19:02,960
Like, I have this style of key, it's got this numeric thing on it, and here's the bidding thing.

199
00:19:02,960 --> 00:19:09,720
Could that just be crowdsourced that way instead of fully wholesaling uploading the book?

200
00:19:10,700 --> 00:19:12,080
It absolutely could be.

201
00:19:13,580 --> 00:19:19,200
That is a little bit trickier when you intersect that with doing the analysis with this software.

202
00:19:19,200 --> 00:19:30,520
Because now it's like, if I have a photo of a key that I think is in this series, and I say I want to limit my key space to only what's in that series, if I don't have a complete series, I'm going to get a wrong answer there.

203
00:19:31,300 --> 00:19:41,180
So it does create a bit of a challenge with that, which is why there's value in that information that the codebook you've uploaded is complete.

204
00:19:42,140 --> 00:19:52,460
But for someone that just wants to do a task like look up a particular indirect bidding code to get the direct one, that would absolutely be valuable for that.

205
00:19:54,240 --> 00:19:56,740
So Hawkeye did get back to us.

206
00:19:57,120 --> 00:20:00,420
A life lock is a fail-secure combo lock.

207
00:20:00,640 --> 00:20:04,180
It can be spun to keep any further attempts to open occurring.

208
00:20:06,790 --> 00:20:07,490
Interesting.

209
00:20:07,490 --> 00:20:12,790
So is it the sort of thing where you can spin it to permanently disable lock if something's happening?

210
00:20:12,790 --> 00:20:15,510
That sounds like exactly what it is.

211
00:20:15,870 --> 00:20:17,750
That's a cool concept.

212
00:20:19,230 --> 00:20:22,230
I haven't actually worked on any of those before.

213
00:20:22,230 --> 00:20:26,850
I'm interested to look it up and see if there's any fun analytics we can do with that.

214
00:20:27,610 --> 00:20:45,570
So Hawkeye, if you have any examples of these that you would like to talk further about, this would be a good opportunity to send some messages over to Bill and DM and maybe there's some interesting future research at play there.

215
00:20:45,830 --> 00:20:49,450
Which is actually probably a good question to go to.

216
00:20:49,470 --> 00:20:51,890
What's your future research?

217
00:20:51,890 --> 00:20:53,970
Where are you going next with this project?

218
00:20:54,890 --> 00:20:56,550
That's a great question.

219
00:20:56,750 --> 00:21:04,430
So there's a number of dimensions of that research, which is applying these general methodologies to combination locks.

220
00:21:04,790 --> 00:21:11,150
So a lot of the same thing can be used if you can get any little bit of information out of, say, a safe dial.

221
00:21:11,610 --> 00:21:15,290
So very, very skilled people can listen to the clicks and determine what that means.

222
00:21:15,290 --> 00:21:20,130
Can we use a computer to make that accessible to a wider audience?

223
00:21:21,080 --> 00:21:28,370
That's something that I'm currently working on and will be submitting to DEF CON in future years once that's complete.

224
00:21:28,370 --> 00:21:37,950
Another dimension is tying it into the talk that I gave last year about keyways and the shape of the keys.

225
00:21:38,370 --> 00:21:47,330
And so we can combine those two and really get a good sense of, from a photo, being able to disambiguate that.

226
00:21:47,330 --> 00:21:52,110
And so tying those two pieces in as well.

227
00:21:55,920 --> 00:21:56,340
Cool.

228
00:21:56,340 --> 00:21:57,170
That's awesome.

229
00:21:58,140 --> 00:22:11,040
Hawk, I came back to mention that he's seen them but is not able to show pics because of policy discouraging that, which is probably expected.

230
00:22:12,420 --> 00:22:20,560
So you will share all of your contact information so people can reach out to you, I'm assuming.

231
00:22:20,560 --> 00:22:24,200
And you are active in some of the other communities here.

232
00:22:24,200 --> 00:22:31,800
Would you tell us a little bit about the Lock Bypass Village and some of what you do over there?

233
00:22:32,680 --> 00:22:33,880
Yeah, for sure.

234
00:22:33,880 --> 00:22:37,520
So as I mentioned, last year was our first year at DEF CON.

235
00:22:37,520 --> 00:22:46,540
And so we had a whole bunch of little doors, two feet tall, that had different types of hardware within them.

236
00:22:46,540 --> 00:23:01,340
We had a car door there and some components from elevators, some components from intercom systems that people could then try and do these physical security hacks on.

237
00:23:01,660 --> 00:23:05,580
And we were packed right up to fire code the entire time.

238
00:23:05,580 --> 00:23:06,820
People really loved doing that.

239
00:23:07,660 --> 00:23:13,740
And so this year, of course, with Safe Mode, what we've done is taken what we could and made online games for it.

240
00:23:13,860 --> 00:23:33,240
So you can go online to bypassvillage.org, you can practice rewiring alarms to disable them at the comms line, you can practice using UBINC to bypass combination locks, practice using shoved knives to disable latches on doors, and a whole bunch of other stuff that we've bought little mini-games for.

241
00:23:36,820 --> 00:23:40,340
I crashed the Village last year and I loved what I saw.

242
00:23:40,340 --> 00:23:44,020
The one thing that I don't know if I just missed it or if it wasn't there.

243
00:23:44,040 --> 00:23:51,780
If you can add something about the magnetic door locking things, I would love to see somebody.

244
00:23:52,380 --> 00:23:56,880
Yeah, we're planning to have a whole big exhibit on that this year.

245
00:23:56,880 --> 00:24:02,220
And then RON-EV happens, so that will absolutely be there for you to see next year.

246
00:24:02,220 --> 00:24:04,080
I look forward to it.

247
00:24:05,000 --> 00:24:10,560
Was there anything that you felt like you just couldn't fit into your talk?

248
00:24:10,560 --> 00:24:17,380
Some piece of your tool or something else that you wanted to go over that was just fascinating for you but just got the cut?

249
00:24:19,000 --> 00:24:20,680
Oh my gosh, there was so much.

250
00:24:22,180 --> 00:24:27,220
I mean, I did the initial talk and thought, oh man, an hour 45, this is great, I can cover everything.

251
00:24:27,220 --> 00:24:29,600
And then I had to cut it down to three hours.

252
00:24:31,820 --> 00:24:43,780
So, I mean, one interesting thing that those who are mathematically inclined will be interested to play around with is there's a separate related tool that will take, if you have a system of locks, you know what your shear lines are.

253
00:24:43,800 --> 00:24:52,100
It will generate a relationship graph for all the different low-level keys, master keys, and the top-level master for which key will work in which lock.

254
00:24:52,100 --> 00:25:01,020
And you get some really neat emergent mathematical properties from that using different mastering systems.

255
00:25:01,020 --> 00:25:04,180
So that's something that is up on my GitHub right now.

256
00:25:04,180 --> 00:25:09,820
I will send a link as soon as I can hop over to the track one talk page.

257
00:25:09,820 --> 00:25:12,520
I'll send a link to an active version you can play with.

258
00:25:13,440 --> 00:25:16,760
So that's one of many things.

259
00:25:16,760 --> 00:25:22,240
Did you use that to generate a key diagram in your talk at one point?

260
00:25:22,260 --> 00:25:28,360
Because there was a grandmaster master key tree effect.

261
00:25:28,360 --> 00:25:33,100
So that one was not auto-generated.

262
00:25:33,320 --> 00:25:39,060
The auto-generated ones are not nearly as well-behaved as what I showed in the talk.

263
00:25:39,120 --> 00:25:40,900
I manually made that one.

264
00:25:41,980 --> 00:25:44,620
But what the auto-generated ones look like is...

265
00:25:44,620 --> 00:25:59,400
One thing to consider with keying hierarchies is if I do the mastering on pins 1, 2, 3, 4, and 5, if I have a master in pin 3, 4, 5 like in the example that I showed, that's what a typical submaster key would look like.

266
00:25:59,400 --> 00:26:03,920
I could also put a master in pins 1 and 2 and then change keys in pins 3, 4, and 5.

267
00:26:03,920 --> 00:26:11,700
And so now I have a master key that's going to work on selectively some locks in the A, B, and C system and not others.

268
00:26:11,700 --> 00:26:20,900
And so you actually have this n-dimensional tesseract that's created from doing up master keys in that regard.

269
00:26:21,040 --> 00:26:29,040
And there's another type of system called rotating constant system that creates incredibly complex relationship graphs there.

270
00:26:29,440 --> 00:26:31,800
That's absolutely awesome.

271
00:26:31,800 --> 00:26:34,260
We are right almost out of time.

272
00:26:34,260 --> 00:26:37,440
I love the question that Panopticon just asked, though.

273
00:26:37,440 --> 00:26:41,160
Would you consider posting the director's cut version of your talk?

274
00:26:43,100 --> 00:26:45,660
Yeah, I actually gave a thought to that.

275
00:26:45,660 --> 00:26:58,540
I think what I'll do is break it up into bite-sized pieces and post a number of separate videos talking about the different elements that I didn't get time to discuss in the main talk.

276
00:26:58,540 --> 00:27:03,540
I just created a whole bunch of social media once this talk was accepted.

277
00:27:03,540 --> 00:27:05,320
I should probably make a Twitter, so I made that.

278
00:27:05,320 --> 00:27:14,580
I made a YouTube channel as well, so that's the Bert and Liam channel that's been commenting on my talk there.

279
00:27:14,760 --> 00:27:18,440
That's for me and my brother, or Robert and William.

280
00:27:18,680 --> 00:27:22,600
Well, Bert and Liam, that's also a valid shorthand for that.

281
00:27:23,200 --> 00:27:31,300
Take a look at that, and whenever I have time after all the chaos of DEF CON comes down, I'll be posting some bite-sized videos in there.

282
00:27:31,360 --> 00:27:31,960
Awesome.

283
00:27:31,960 --> 00:27:34,320
Well, thank you for doing our QA session.

284
00:27:34,320 --> 00:27:36,940
Thank you for doing such a fantastic talk.

285
00:27:37,280 --> 00:27:39,300
Hope to see you again next year.

286
00:27:40,840 --> 00:27:42,860
Thank you so much.

287
00:27:43,200 --> 00:27:46,040
There's plenty more that we all want to hear from you.

288
00:27:46,040 --> 00:27:54,800
For anybody who would like to know more, it sounds like you can track Bill down in the Lock Bypass Village.

289
00:27:55,460 --> 00:27:58,320
There's more information over there for you to learn as well.

290
00:27:58,440 --> 00:27:59,960
Thank you very much.

291
00:28:00,400 --> 00:28:06,180
I'll be lurking in the Q&A page or chat for the next few minutes as well.

292
00:28:06,180 --> 00:28:07,100
Perfect.

293
00:28:07,240 --> 00:28:08,360
Excellent.

294
00:28:08,860 --> 00:28:09,520
Cheers.

295
00:28:09,520 --> 00:28:10,580
Thank you so much.