start	end	text
18440	21900	Hawkeye Dank has been pretty active over the last while.
21960	23300	It sure has.
23420	24840	That looks like we're in.
26240	29320	I haven't seen it yet, but I'll transition us live.
31950	33470	There it is.
33490	34650	Alrighty.
37600	40780	Okay, thank you everybody for coming along.
40780	48060	This is the Q&A portion for exploiting keyspace vulnerabilities in the physical world.
48060	51560	Your main goon here is going to be Pasties.
51560	52760	This is Fallible.
53880	57460	And thank you, Bill Graydon, for coming to join us today.
57560	60580	Bill, could you tell us a little bit about yourself before we get started?
61920	63220	Yeah, absolutely.
63660	66120	So, my name is Bill, as you know.
67140	69100	This is my second DEF CON.
69280	73220	I actually started out last year as both a main track speaker and a village lead,
73220	80660	founding and running the Lock Bypass Village, which I'm helping out with this year as well in the online forum.
81240	86880	In my non-hacker life, I worked for a company called GGR Security,
86880	94120	doing physical security consulting, audits, and a number of related services in that regard.
94120	102440	So, sort of the very flashy aspect of that job that is highly applicable to the DEF CON environment is physical penetration tests.
102440	106700	With which some of these things that I talk about fit into.
107940	109140	Excellent.
111400	112720	Go ahead.
112720	115680	Yeah, we're seeing a couple of questions come in right now.
116500	121200	Well, we have one question about, have you ever created a bump key?
121200	126640	Another one is your opinions on the disk style locks.
127020	131440	So, some general questions about different types of locks right now.
132200	137000	You're welcome to take a stab at those, and we'll wait for a few more talks to come in.
137660	144380	So, in terms of creating the bump key, I've created hundreds, possibly thousands of them.
144560	151100	Yeah, I mean that video that I showed at the very start of my talk with how keys actually get originated,
151100	157740	all you have to do to make a bump key is that cutter wheel that's taking a byte out of the key at particular positions,
157740	165020	you just take that all the way down to the bottom position and bend some, and you do that across all the spaces,
165020	167300	and that'll do it for you.
167480	174840	So yeah, I've absolutely done that for both regular systems as well as high security ones like Medeco.
176300	179700	So, sort of along the lines with your talk,
179700	186240	when you got to the point where you were like narrowing it down to like the last like 10 or 18 keys,
186240	189640	is it possible to make like a targeted bump key that would just be more effective?
189980	192660	Just like dealing with all of those all at once?
193140	197220	That is an incredible question, and the answer is absolutely yes.
197440	206660	What a targeted bump key would look like is effectively the lowest cuts that are present in any of those keys in your narrowed down key space.
206960	212440	And so in fact, this is something that's been known to locksmiths for decades,
212440	215060	actually the possibility to do something like that.
215060	218940	So, I didn't have time to talk about a lot of this in the talk,
218940	225180	but one aspect is I talked a bit about how you want your grand master key to be one cut in the highest position,
225180	228200	so that none of the change keys under it can be filed down.
228200	232420	You also, in many cases, want it to have one cut in the lowest position.
232480	239060	And the reason for that is if there's any of your change keys that are lower than your master key in all positions,
239060	244400	then that change key will act as a bump key that will work in every lock on that system
244400	249660	and can possibly be jiggled around and bump those pins all up to the master shear lines.
251740	256420	So yeah, it's a great question and that's how you do it.
257140	264340	And the next question, which I kind of interrupted there, was what are your opinions on disk style locks?
264380	267740	Apparently storage locations hate them because they actually have to be cut off.
269040	270860	Disk detainer type locks?
272540	280280	So I'm looking at this question now. I'm not entirely sure what it means with how they have to be cut off.
280660	285720	In terms of a storage location, like if someone needs their locks removed,
285720	289800	I guess what the question is getting at is that maybe locksmiths are able to pick the other types of locks,
289800	293880	but not the disk detainer locks. That effectively comes down to the skill level of the locksmith.
293880	296520	Disk detainer locks can be picked just like any others.
297240	302680	They're a much more specialized skill set to do and they require more specialized tools to do.
303160	305980	And the good ones are harder.
306620	313560	So if you've got an Ablet ProTek on there, there's no verified, documented picking success with those.
313560	317600	So in that case, then yeah, cutting them off is your only option,
317600	320400	which for an Ablet ProTek is also going to be a hell of a job.
321180	326640	So I'm not entirely sure what the question is getting at, but I think that pretty well covers it.
326640	327640	More than likely.
329340	338220	I always enjoy when people come and give us more of the in-depth side of physical security stuff for DEF CON talks,
338220	341520	and I appreciate you coming in and presenting that material.
341520	355060	So as you're going through, you are explaining things from a bypass direction, at least a lot more bypass this year, right?
355060	360060	You're not approaching things from the lock picking side.
360060	370920	So how did you find yourself in the direction of the bypass instead of what seems to be more in vogue with the hacking community of the single pin picking?
372120	373820	That's a great question.
373820	384960	So with bypass, it's the sort of thing that in my anecdotal experience, at least, there's a lot less literature out there about those particular techniques.
384960	392340	You've got a whole bunch of great talks at various conferences about them, but nothing super formalized.
392340	397700	There's a lot in that field that really is yet to be discovered or potentially yet to be published.
398220	410200	Since, as I mentioned in some of my other talks with Bypass Village, lock bypassing has traditionally been the domain of criminals and of classified materials,
410200	412480	both of which tend not to get published.
413340	425940	Locksmiths as well do it, but even still, the locksmithing industry is a very tight, tribal knowledge, apprenticeship-based type industry where they don't publish that sort of thing.
425940	432900	So that's, I think, a large part of why the hacker community has not gotten into it nearly as much lately, or until lately.
433660	439500	From a personal perspective as well, I have never been a very good lock picker.
439500	442480	I understand the theory inside and out, but I just can't do it.
442660	445420	And that's in a large part because of a fine motor disability that I have.
445420	450180	So it's like, you know, I gotta go find something else that takes a bit more core skills.
450780	452480	And so lock bypass is part of that.
452480	459820	And then having founded and run the Lock Bypass Village is like, you jump headlong into it, you can't get out once you're running a village.
460640	465040	I totally understand that. So what's your everyday carry kit look like?
465940	470220	Good question. I mean, I am incredibly disorganized.
470220	476460	So to think that I have an everyday carry kit is a bit of gratuitous to me.
476580	486440	But, you know, if I'm anticipating needing to potentially get through a door, it's like, well, in that case, I'm carrying a much larger kit than what would be everyday carry.
486440	489940	If I'm anticipating, well, maybe needing it, but probably not.
490760	495200	You know, I might have a rake and a tension wrench, real simple.
495200	501240	That's all the picking equipment for poking the latch out of the way.
501540	504260	So like a shove knife for latch bypass.
504480	515420	What I've got on my key ring is a little wire that's just an L-shaped end of wire that I can whip out and do that on any lock that I might encounter.
515420	517120	So I've got that.
517820	519340	And really that's about it.
519340	521400	I don't carry a whole lot else with me.
521400	529740	And I find that in many cases, if you can't improvise, it's not worth taking that particular approach in an everyday situation.
530940	547700	I know there's a lot of discussion in the community, at least in the lock picking community, of most of what we do for fun as locksporters isn't all that practical out in the world trying to be a locksmith.
548060	556080	At least from what I've heard, and maybe you'll either confirm this or tear this down.
556080	568840	But if you're faced with a lock, it's usually going to be easier to attack the mechanism that holds the door together or get in through a window or etc.
569920	571700	Oh yeah, absolutely.
571700	576340	I mean, a large part of it is sort of not just hacking, but ethical hacking.
576660	583120	It's like if our goal is to get into a facility, we're sort of balancing a number of objectives here.
583120	592140	How much do we care about how long it takes us to get in? How much do we care about the damage that we do, the noise that we make, the forensic evidence that we leave behind, etc.
592200	598020	So you kind of pick and choose your techniques based on that. And then of course, there's a cost element, there's a skill element.
598020	600140	So it's pretty multi-dimensional in that regard.
600660	611560	And the vast majority of practical cases, what we see in security consulting, is you're protecting against forcible, you're protecting against very, very, very basic bypasses.
611560	614320	And that's about it, and that's what your threat model is.
614620	626400	And so I think in some regard, the focus of the hacker community on ethical hacking has done somewhat a disservice for the blue team because they are protecting against the wrong threat model.
627520	637960	And so you see that a lot with the forcible entry being really downplayed in terms of its impact on physical security.
641160	648960	I like that as a thought. That's really interesting of talking about training the blue team maybe to not...
650520	658980	The things that people in the outside world are going to hit you with might not be the same things that we as the hobbyists are going to hit you with.
660640	676180	Do you have a specific example of something that is more realistic in the real world that a blue team might encounter as far as physical security protection goes that isn't normally tested or advocated for in these kind of talks, that kind of thing?
677840	686920	Yeah, I mean if you... let's take a simple example. You're a mom and pop shop and you want to protect your store.
687900	695720	If you go to... many police departments will do a very simple free security audit for you.
695720	701000	And they know very well what the threat model is, and so they're recommending things like bars on the windows.
701760	708640	If you go and ask many people in the hacker community to do a security audit, they're not going to think about things like that.
708640	717900	They're going to try to use a fancy latch thumb turn bypass tool on the door and say, okay, you got to patch that up.
717900	722960	And they might try some sort of electronic attack on your access control system.
722960	733480	Sure, it's a vulnerability, but the sort of people that have the means and the motivation and the skills to perform those are not going to be breaking into their neighborhood mom and pop.
733480	737800	Right. Matching the attacker to the threat model.
738100	738820	Yeah.
739760	746100	We got a question. Have you notified any security desks about the vulnerability of having their keys visible?
747860	750980	Can you say the first part again? Have I notified them?
750980	762180	Yeah. Has it been an actionable report or just informed them, like, hey, you've got your security keys on your ring and I can see them and that's a problem?
762180	768140	Oh, absolutely. Yeah. It's one of the standard things we check for with any security audit.
768440	772560	The biggest time that we see this is with multi-unit residential.
772560	775440	If you've got a concierge desk, we leave that lying out.
775440	782720	And it's a really simple human factors thing, right? So you just create, you know, put a little box there that they can put it in that shields it from public view.
782980	793220	And that little box then can be self-locking. So if they have to walk away and handle something, that's not then left out there for anyone to see or take or whatnot.
793220	799200	And we've seen some pretty egregious cases of that being breached when you don't have good human factor design in that regard.
801500	812020	So first off, the tool that you showed off throughout the entirety of your talk, is that already available? Is that something that other people can see and use?
812800	818220	Yes, it is. Yeah, so that's online at a number of links that I've posted in my talk.
818220	830520	So you can find the source code on my GitHub. And tinyurl.com slash key dash space will link you to a version that you can run right in your web browser.
830880	832220	That's awesome.
832340	838400	We can share that in the track one channel here at the end if that's cool with everybody.
838400	850420	So with that tool, it starts out with a pretty brute force approach and you start adding on these layers of knowledge.
851160	858660	There was a lot of pieces of knowledge. Is that something that you just picked up through your experience?
858680	867260	Or is this just like you just aggressively compiled all this information from everyone that you knew just to put this tool together?
868740	876580	That's a great question. I'd say that a lot of it is experience just talking to people.
876580	883000	The sort of thing that, again, that kind of tribal knowledge that exists in locksmithing communities, for instance.
883000	891780	So we're fairly good friends with a number of locksmiths and so we chat with them about all sorts of stuff like this and get information there.
891780	898420	And then a lot of it, when you kind of crunch the numbers and understand the mathematics behind how keying systems actually operate.
898460	903040	At that point, you can formally model them with a number of mathematical constructs.
903040	906400	And from that, these rules become a corollary of that.
906400	910600	So a lot of it can be derived independently.
911400	915740	And so, for instance, the rights amplification attack.
915740	920960	So we derive that independently and then determine that actually this has been published about before as well.
920960	923220	And it's been known in the locksmithing community.
923220	931160	So it's the sort of thing that a lot of people have thought about, but hasn't until relatively recently been published widely.
932040	937300	And to my knowledge, it's the first time that there's a computational tool for analyzing it.
937760	938960	That's awesome.
940100	942140	So we've got another question.
942140	947560	Have you had any experience with working with life locks at any military contractor facilities?
949480	951540	The answer is no.
951540	955420	I will actually ask for clarification on what is a life lock.
955420	956880	I don't know either.
957820	963500	Hawkeye Denk, if you're still watching, you've got us all intrigued what a life lock is.
965520	971140	I guess I'll bump back to your tool a little bit while we're waiting to hear back from Hawkeye.
974420	976660	I totally blanked on my question.
976660	978300	You got me.
978400	979840	No, you're good.
979840	984880	So your talk is quite long, and thank you for that.
984880	997040	And actually, if anybody is out there looking forward to watching this, he or someone was nice enough to go through and nicely index all of the timestamps on that.
998520	999580	Yeah, that was me.
999580	1003100	So, yeah, thank you for that.
1003100	1009280	There was some... you mentioned some code books in there.
1009280	1016840	And I get the impression there were some legal, possibly ethical implications of having that information available.
1016840	1024340	Could you talk to that a little bit of any solutions that you're working on on trying to make that more accessible?
1024920	1025840	Absolutely, yeah.
1025840	1033220	So as far as code books are concerned, I mean, there's hundreds... well, there's thousands of them out there.
1033220	1036980	There's hundreds that are common to see examples of in the wild.
1037700	1044360	You know, everything from... I mean, any standard key system that has generally numbers associated with it.
1044360	1047420	So you might have heard of common keys like 1284x.
1047420	1049080	Well, that's part of a series.
1049560	1052040	0151x, which you looked at in the talk, is another part of that series.
1052040	1054780	And then there's 1700 others in it.
1055340	1059240	C415a, so there's your national cabinet keying set.
1059240	1062740	There's about 600 in the A series, as well as there's a B and a C.
1063260	1065680	And there's hundreds of others like that.
1065680	1068740	Medeco, non-mastered systems have code books as well.
1068940	1078620	So this is a lot of data that's being compiled by a number of services out there, the most well-known of which is Instacode.
1078620	1090200	So anyone that's looking for that information on a case-by-case basis can get a subscription to that and look up what is C415a, what's the bidding of that.
1090200	1092700	You can't download the entire data set for that.
1092700	1094620	We happen to have the entire data set.
1094620	1100100	It's not licensed in a manner that we can then release it freely, unfortunately.
1100100	1114220	One thing that I'm toying with to make that actually happen is create a crowdsourced platform so people can, if they have access to that information in a way that they're not constrained by the license, they can upload it.
1114340	1124680	And then we can create a compendium of that, as well as I'm going to be adding back into the app a way to import that data, if you happen to have it, through whatever reason or whatever source.
1124680	1126380	And then you can analyze it that way.
1127240	1129600	So yeah, I'm working on a workaround for that.
1130720	1131900	Yeah, go ahead.
1131900	1136860	Just like spitballing, could that kind of crowdsourcing happen at a finer-grained level?
1136860	1142960	Like, I have this style of key, it's got this numeric thing on it, and here's the bidding thing.
1142960	1149720	Could that just be crowdsourced that way instead of fully wholesaling uploading the book?
1150700	1152080	It absolutely could be.
1153580	1159200	That is a little bit trickier when you intersect that with doing the analysis with this software.
1159200	1170520	Because now it's like, if I have a photo of a key that I think is in this series, and I say I want to limit my key space to only what's in that series, if I don't have a complete series, I'm going to get a wrong answer there.
1171300	1181180	So it does create a bit of a challenge with that, which is why there's value in that information that the codebook you've uploaded is complete.
1182140	1192460	But for someone that just wants to do a task like look up a particular indirect bidding code to get the direct one, that would absolutely be valuable for that.
1194240	1204180	So Hawkeye did get back to us. A life lock is a fail-secure combo lock. It can be spun to keep any further attempts to open occurring.
1206790	1212790	Interesting. So is it the sort of thing where you can spin it to permanently disable lock if something's happening?
1212790	1215510	That sounds like exactly what it is.
1215870	1226850	That's a cool concept. I haven't actually worked on any of those before. I'm interested to look it up and see if there's any fun analytics we can do with that.
1227610	1245570	So Hawkeye, if you have any examples of these that you would like to talk further about, this would be a good opportunity to send some messages over to Bill and DM and maybe there's some interesting future research at play there.
1245830	1253970	Which is actually probably a good question to go to. What's your future research? Where are you going next with this project?
1254890	1264430	That's a great question. So there's a number of dimensions of that research, which is applying these general methodologies to combination locks.
1264790	1271150	So a lot of the same thing can be used if you can get any little bit of information out of, say, a safe dial.
1271610	1280130	So very, very skilled people can listen to the clicks and determine what that means. Can we use a computer to make that accessible to a wider audience?
1281080	1288370	That's something that I'm currently working on and will be submitting to DEF CON in future years once that's complete.
1288370	1297950	Another dimension is tying it into the talk that I gave last year about keyways and the shape of the keys.
1298370	1307330	And so we can combine those two and really get a good sense of, from a photo, being able to disambiguate that.
1307330	1312110	And so tying those two pieces in as well.
1315920	1317170	Cool. That's awesome.
1318140	1331040	Hawk, I came back to mention that he's seen them but is not able to show pics because of policy discouraging that, which is probably expected.
1332420	1340560	So you will share all of your contact information so people can reach out to you, I'm assuming.
1340560	1344200	And you are active in some of the other communities here.
1344200	1351800	Would you tell us a little bit about the Lock Bypass Village and some of what you do over there?
1352680	1353880	Yeah, for sure.
1353880	1357520	So as I mentioned, last year was our first year at DEF CON.
1357520	1366540	And so we had a whole bunch of little doors, two feet tall, that had different types of hardware within them.
1366540	1381340	We had a car door there and some components from elevators, some components from intercom systems that people could then try and do these physical security hacks on.
1381660	1386820	And we were packed right up to fire code the entire time. People really loved doing that.
1387660	1393740	And so this year, of course, with Safe Mode, what we've done is taken what we could and made online games for it.
1393860	1400980	So you can go online to bypassvillage.org, you can practice rewiring alarms to disable them at the comms line,
1400980	1409680	you can practice using UBINC to bypass combination locks, practice using shoved knives to disable latches on doors,
1409680	1413240	and a whole bunch of other stuff that we've bought little mini-games for.
1416820	1420340	I crashed the Village last year and I loved what I saw.
1420340	1424020	The one thing that I don't know if I just missed it or if it wasn't there.
1424040	1431780	If you can add something about the magnetic door locking things, I would love to see somebody.
1432380	1436880	Yeah, we're planning to have a whole big exhibit on that this year.
1436880	1442220	And then RON-EV happens, so that will absolutely be there for you to see next year.
1442220	1444080	I look forward to it.
1445000	1450560	Was there anything that you felt like you just couldn't fit into your talk?
1450560	1457380	Some piece of your tool or something else that you wanted to go over that was just fascinating for you but just got the cut?
1459000	1460680	Oh my gosh, there was so much.
1462180	1467220	I mean, I did the initial talk and thought, oh man, an hour 45, this is great, I can cover everything.
1467220	1469600	And then I had to cut it down to three hours.
1471820	1478200	So, I mean, one interesting thing that those who are mathematically inclined will be interested to play around with
1478200	1483780	is there's a separate related tool that will take, if you have a system of locks, you know what your shear lines are.
1483800	1489620	It will generate a relationship graph for all the different low-level keys, master keys, and the top-level master
1489620	1492100	for which key will work in which lock.
1492100	1501020	And you get some really neat emergent mathematical properties from that using different mastering systems.
1501020	1504180	So that's something that is up on my GitHub right now.
1504180	1509820	I will send a link as soon as I can hop over to the track one talk page.
1509820	1512520	I'll send a link to an active version you can play with.
1513440	1516760	So that's one of many things.
1516760	1522240	Did you use that to generate a key diagram in your talk at one point?
1522260	1528360	Because there was a grandmaster master key tree effect.
1528360	1533100	So that one was not auto-generated.
1533320	1539060	The auto-generated ones are not nearly as well-behaved as what I showed in the talk.
1539120	1540900	I manually made that one.
1541980	1544620	But what the auto-generated ones look like is...
1544620	1551400	One thing to consider with keying hierarchies is if I do the mastering on pins 1, 2, 3, 4, and 5,
1551400	1555500	if I have a master in pin 3, 4, 5 like in the example that I showed,
1555500	1559400	that's what a typical submaster key would look like.
1559400	1563920	I could also put a master in pins 1 and 2 and then change keys in pins 3, 4, and 5.
1563920	1571700	And so now I have a master key that's going to work on selectively some locks in the A, B, and C system and not others.
1571700	1580900	And so you actually have this n-dimensional tesseract that's created from doing up master keys in that regard.
1581040	1589040	And there's another type of system called rotating constant system that creates incredibly complex relationship graphs there.
1589440	1591800	That's absolutely awesome.
1591800	1594260	We are right almost out of time.
1594260	1597440	I love the question that Panopticon just asked, though.
1597440	1601160	Would you consider posting the director's cut version of your talk?
1603100	1605660	Yeah, I actually gave a thought to that.
1605660	1612840	I think what I'll do is break it up into bite-sized pieces and post a number of separate videos
1612840	1618540	talking about the different elements that I didn't get time to discuss in the main talk.
1618540	1623540	I just created a whole bunch of social media once this talk was accepted.
1623540	1625320	I should probably make a Twitter, so I made that.
1625320	1634580	I made a YouTube channel as well, so that's the Bert and Liam channel that's been commenting on my talk there.
1634760	1638440	That's for me and my brother, or Robert and William.
1638680	1642600	Well, Bert and Liam, that's also a valid shorthand for that.
1643200	1647860	Take a look at that, and whenever I have time after all the chaos of DEF CON comes down,
1647860	1651300	I'll be posting some bite-sized videos in there.
1651360	1654320	Awesome. Well, thank you for doing our QA session.
1654320	1656940	Thank you for doing such a fantastic talk.
1657280	1659300	Hope to see you again next year.
1660840	1662860	Thank you so much.
1663200	1666040	There's plenty more that we all want to hear from you.
1666040	1674800	For anybody who would like to know more, it sounds like you can track Bill down in the Lock Bypass Village.
1675460	1678320	There's more information over there for you to learn as well.
1678440	1679960	Thank you very much.
1680400	1686180	I'll be lurking in the Q&A page or chat for the next few minutes as well.
1686180	1687100	Perfect.
1687240	1688360	Excellent.
1688860	1689520	Cheers.
1689520	1690580	Thank you so much.