1
00:00:01,060 --> 00:00:02,980
Hey and welcome to Keystone of the Kingdom.

2
00:00:03,220 --> 00:00:10,640
This is a talk on targeting best SFIC locks and you'll know in a second about what that is, just in case you don't.

3
00:00:11,280 --> 00:00:15,700
This is a talk being given to DEF CON 28's Lockpicking Village.

4
00:00:16,340 --> 00:00:28,900
Unfortunately we have COVID going on in the world and we are not going to be able to meet in person, so I would encourage you to reach out to me on Twitter, reach out to me on Discord inside of the DEF CON channel, and I'd love to have your thoughts, your opinions,

5
00:00:28,900 --> 00:00:32,500
any questions you have, send them my way, happy to discuss.

6
00:00:34,280 --> 00:00:35,820
Who am I?

7
00:00:36,280 --> 00:00:37,640
My name is Austin Mark.

8
00:00:37,640 --> 00:00:39,600
I'm a security enthusiast first and foremost.

9
00:00:40,100 --> 00:00:57,020
I have been doing pen testing for a number of years for a small to mid-market tax consulting and audit firm called RSM and doing red team assessments where we regularly run into best SFIC locks, we see them in the field.

10
00:00:58,240 --> 00:01:04,920
On the right hand side you also have my Hack the Box profile, Twitter, website, feel free to reach out to me on any of those.

11
00:01:05,360 --> 00:01:25,640
And you have a disclaimer, I am not a locksmith, so my thoughts, opinions on how to secure locks probably should only be taken as an attacker, things that I think work, but really remediating these issues or operating your locks is something that's best sent to a locksmith who can give you better advice than I can.

12
00:01:25,860 --> 00:01:28,560
And on the left hand side you have a photo of me at IKEA.

13
00:01:28,940 --> 00:01:38,380
I don't believe I ever got that mirror, which is unfortunate, but as I was flipping through photos trying to find something that I thought was appropriate for this talk, this was the one that stood out to me.

14
00:01:39,460 --> 00:01:50,100
All right, so this is Anthology, this is a collection of talks that I'm giving at DEF CON and hopefully years to come, other conferences.

15
00:01:50,180 --> 00:01:53,900
This is just how I organize my talks, it's all under this Anthology brand.

16
00:01:54,020 --> 00:02:01,580
Left hand side you've got this little picture of an ant, it's kind of like a circuit board, that's just my little Anthology symbol.

17
00:02:02,980 --> 00:02:16,500
While parts of this lab should be done with locks and keys in hand, I'd really prefer this to be a hands-on talk, we're going to deal with COVID and we're going to have some parts of this be a web-based CTF where you can at least learn a little bit about FastTaskFix.

18
00:02:17,160 --> 00:02:34,760
When we get done with the talk, I will open up the CTF and anybody who'd like to can join in, chase down some flags, there will be a prize for whomever wins, so feel free to reach out if you believe that you're the winner and I think we'll wrap this up 24 hours after the talk.

19
00:02:35,240 --> 00:02:50,060
Down at the bottom you have some logins, you have a ctflogin at pctf.ant.red, that is a CTFD instance that has some challenges, I think there's something like 10 challenges, just kind of shooting the gambit across different parts of targeting a BestSFix system.

20
00:02:50,640 --> 00:02:59,720
You also have course materials that just links out to a github page, you can pull down some pdfs and some further learning resources if you're interested in BestSFix.

21
00:03:00,120 --> 00:03:09,280
And then you've got a KeystoneWeb instance, you'll learn a little bit more in a second about what KeystoneWeb is, but there it is out at ksw.ant.red.

22
00:03:10,000 --> 00:03:12,780
And down at the bottom you have a login for that.

23
00:03:13,520 --> 00:03:15,640
All right, so let's jump into the agenda.

24
00:03:15,660 --> 00:03:18,100
So here's what we're going to try to cover.

25
00:03:18,100 --> 00:03:19,400
What are SFIX?

26
00:03:19,540 --> 00:03:21,120
What are key marks?

27
00:03:21,680 --> 00:03:26,840
It's kind of in the name, it's the marks on the BestSFix keys.

28
00:03:27,080 --> 00:03:28,280
Where are SFIX?

29
00:03:28,280 --> 00:03:29,680
So where are you going to find them?

30
00:03:29,820 --> 00:03:32,240
And then what can we do once we've found them?

31
00:03:32,460 --> 00:03:34,640
So first and foremost, what is an SFIC?

32
00:03:35,000 --> 00:03:39,080
SFIC stands for Small Format Interchangeable Core.

33
00:03:39,280 --> 00:03:42,220
Let's see... yep, you guys can see it there.

34
00:03:42,700 --> 00:03:46,380
They're a way for businesses to change which key goes to which door quickly.

35
00:03:46,380 --> 00:03:48,980
They can also provide a means of access control.

36
00:03:48,980 --> 00:03:55,500
So Sally shouldn't be able to go into Jim's room, but the janitor should probably be able to go everywhere, right?

37
00:03:55,600 --> 00:03:59,280
So that janitor needs to be able to get access to both of their rooms.

38
00:03:59,280 --> 00:04:04,700
So to be able to do that, you have a master key that will open both doors.

39
00:04:05,340 --> 00:04:13,060
So to that end, these pins that go inside of these locks are considered mastered keyed.

40
00:04:13,060 --> 00:04:17,140
There's a number of different segments and you'll see in a second what those kind of look like.

41
00:04:18,880 --> 00:04:22,420
Moving on from that, where are we going to find SFIX?

42
00:04:22,420 --> 00:04:28,100
SFIX are in schools, office buildings, hotels, and very large businesses.

43
00:04:28,100 --> 00:04:31,280
So you'll see them very regularly.

44
00:04:31,280 --> 00:04:38,200
I remember when I gave this talk or a talk similar to this last year at DEF CON, I noticed a ton of SFIX all around me.

45
00:04:38,200 --> 00:04:44,080
It's kind of one of those things where you get a new car and all of a sudden everybody's driving your car, right?

46
00:04:44,080 --> 00:04:46,180
So this is kind of the same thing.

47
00:04:46,180 --> 00:04:52,660
You figure out that you have an interest in SFIX and everybody suddenly has an SFIX and it's always something to look at, right?

48
00:04:53,020 --> 00:04:55,300
So what are key marks?

49
00:04:55,300 --> 00:04:58,180
Key marks are exactly what they sound like.

50
00:04:58,180 --> 00:05:02,980
It's simply a stamp that is put on a key for tracking.

51
00:05:03,300 --> 00:05:06,440
Should help you know if a key goes to a door.

52
00:05:08,100 --> 00:05:11,140
And it'll also help you track who has access to what.

53
00:05:12,140 --> 00:05:18,320
So what can we do once we know that there's an SFIX that is part of this environment that we're targeting?

54
00:05:18,320 --> 00:05:19,580
We could potentially pick it.

55
00:05:19,580 --> 00:05:28,300
We can potentially duplicate some of those keys if we're able to get access to We're able to move laterally with those keys because they are part of the system.

56
00:05:28,300 --> 00:05:34,180
So if you know where you are within a system, you can potentially move from one door to another.

57
00:05:34,340 --> 00:05:38,100
And that all gets kind of done by doing what is called system decoding.

58
00:05:38,100 --> 00:05:41,600
And we'll walk through some of what that is and how we do that.

59
00:05:45,050 --> 00:05:50,170
All right, so we'll talk a little more about what these SFIX really are.

60
00:05:50,330 --> 00:05:53,930
So an SFIX, as it would be installed, is on the left-hand side.

61
00:05:53,970 --> 00:05:58,710
You can see on the front, you've got a core mark of what appears to be PG7.

62
00:05:59,150 --> 00:06:00,510
And it says best.

63
00:06:00,510 --> 00:06:04,770
So you definitely know you're dealing with a best SFIX rather than another manufacturer's SFIX.

64
00:06:05,070 --> 00:06:11,070
For this talk, we will be specifically talking about best A2 system SFIX, which is the most common.

65
00:06:11,090 --> 00:06:13,470
These are the ones that I see the most often in the field.

66
00:06:14,710 --> 00:06:27,450
This is a door that would only be openable by the PG7 key or another master key or key that is mastered to the PG7 core mark.

67
00:06:27,550 --> 00:06:35,170
So if I were to get a key at an elevated part of the hierarchy, I could also operationally open this door.

68
00:06:35,730 --> 00:06:37,670
You also have a control key.

69
00:06:37,670 --> 00:06:42,210
Control keys can open any door in a system, and they're particularly sensitive.

70
00:06:42,210 --> 00:06:45,390
And we'll talk a little bit about how to get access to those in a little bit.

71
00:06:45,950 --> 00:06:51,310
So on the inside of an SFIX, this one has been fully gutted.

72
00:06:51,310 --> 00:06:57,350
So you don't really have any pins in here, but it helps us kind of walk through what the different items are.

73
00:06:57,370 --> 00:07:00,510
There is a cap that typically goes in the top.

74
00:07:00,510 --> 00:07:13,370
You have an operating shear line that will allow this to turn freely, which would move these throw pins and unlock a door.

75
00:07:13,430 --> 00:07:31,090
Or if the control pins are set in such a way that the control lug would turn, this would allow the core to then rotate and pull in the control lug, which would allow you to remove the core from the door.

76
00:07:31,090 --> 00:07:35,210
So that is the parts and pieces of an SFIX core.

77
00:07:35,210 --> 00:07:40,450
We'll have a kind of exploded picture after this that should help explain that a little further.

78
00:07:41,370 --> 00:07:53,130
And really the goal of this slide is to make sure you're familiar with the control lug, which allows this to be placed in a door, secured to a door, and then operated with operating keys.

79
00:07:53,350 --> 00:07:56,450
All right, so IC cores.

80
00:07:56,450 --> 00:07:58,130
These are interchangeable cores.

81
00:07:58,130 --> 00:08:03,350
On the left-hand side, you have a standard housing that will typically hold one of these cores.

82
00:08:03,350 --> 00:08:07,310
It's not exclusively these indoor cores.

83
00:08:07,310 --> 00:08:10,090
You might actually have a padlock, much like this one.

84
00:08:10,750 --> 00:08:15,670
So you could potentially gain access to one of these.

85
00:08:15,670 --> 00:08:27,410
And when we start talking about removing cores and walking off with something and gaining access to the full system because you have something in hand, a padlock like this is particularly useful.

86
00:08:28,210 --> 00:08:40,370
And then on the right-hand side, you have an exploded version where you can see the key, the plug, the bottom pins, the cylinder cover, cylinder itself, all of the segments we talked about.

87
00:08:40,370 --> 00:08:42,570
So that's part of that master keying.

88
00:08:42,570 --> 00:08:55,030
And then your springs and your top pins that you will be bumping out if you're going to get one of these locks.

89
00:08:55,090 --> 00:09:00,760
All right, moving on, let's talk about S-stick keys.

90
00:09:00,760 --> 00:09:05,540
So these are S-stick keys like this.

91
00:09:05,700 --> 00:09:10,300
And you can kind of see on the front there a key mark.

92
00:09:10,300 --> 00:09:13,160
So on our screenshot, it's BA1.

93
00:09:13,160 --> 00:09:16,060
And on the one in hand, it is SR1.

94
00:09:16,260 --> 00:09:24,200
On the key in hand, we also have a keyway marking that is H, if you can see that, I hope.

95
00:09:24,200 --> 00:09:28,780
And then there's also keyway mark A on the key in the picture.

96
00:09:29,100 --> 00:09:33,620
The serialization marking is particularly useful for tracking multiples of the same key.

97
00:09:33,620 --> 00:09:39,180
So let's say we had 10 of these, and I wanted to know if Stu lost his version of the key.

98
00:09:39,260 --> 00:09:50,560
I'd like to be able to know which key is missing by maybe taking a count of all the keys and saying, hey, serialization key is missing this specific serialization.

99
00:09:50,720 --> 00:09:51,480
Stu, what happened?

100
00:09:51,480 --> 00:09:53,180
I thought we trusted you with that key.

101
00:09:53,660 --> 00:09:54,020
All right.

102
00:09:54,020 --> 00:09:56,140
And then lastly, it's just this tip stop.

103
00:10:01,600 --> 00:10:02,880
So let's talk about systems.

104
00:10:02,880 --> 00:10:06,860
So this is the hierarchy of a best SFIC system.

105
00:10:06,880 --> 00:10:09,040
The top, you have the control.

106
00:10:09,040 --> 00:10:17,220
The control key will operate every key within a system and also allow you to remove one of these SFIC cores from the door.

107
00:10:17,760 --> 00:10:21,000
And if you can remove a core , you can decode the entire system.

108
00:10:21,120 --> 00:10:25,700
We'll talk a little bit about what that means and what the impact of that is.

109
00:10:26,220 --> 00:10:29,020
But if you can get a control key, you're golden.

110
00:10:29,020 --> 00:10:31,700
If you can get a grand master key , you're also golden.

111
00:10:31,700 --> 00:10:39,000
A grand master key will operationally turn every lock within a system.

112
00:10:39,000 --> 00:10:45,260
So if you can grab a grand master key, you can open up any door within that system.

113
00:10:45,260 --> 00:10:51,720
So typically, you'll see GM written on a key that is a grand master key.

114
00:10:51,720 --> 00:11:03,460
So if you can find a key on a lanyard or sitting on a desk that says GM, that might be one to take a picture of or borrow for a moment or what have you.

115
00:11:03,660 --> 00:11:11,560
Typically, if there's different systems within, there might be a master of system A, master of system B, and those are just submasters.

116
00:11:11,980 --> 00:11:15,880
So those many times you'll see written as MA, MB, MC, MD.

117
00:11:16,440 --> 00:11:17,960
It's not a hard and fast rule.

118
00:11:17,960 --> 00:11:19,160
It doesn't have to be true.

119
00:11:19,160 --> 00:11:23,500
It's just kind of a general thing that has been observed over the years.

120
00:11:24,360 --> 00:11:34,500
Operating keys, as we've discussed, these are keys that you typically give an authorized user to access their office or their door or the server room or some other sensitive area.

121
00:11:34,940 --> 00:11:41,920
I've been told by a number of college students that they see these operating keys, they're giving them as part of their dorms.

122
00:11:41,920 --> 00:11:53,300
So maybe they have the operating key to their door and a submaster belongs to whoever runs that part of the dormitory.

123
00:11:53,620 --> 00:11:55,860
A CA, I think they call it.

124
00:11:56,000 --> 00:11:59,400
All right, so moving on.

125
00:12:00,320 --> 00:12:01,240
Keyways.

126
00:12:01,240 --> 00:12:03,720
So let's talk a little bit about keyways.

127
00:12:04,000 --> 00:12:09,460
The best SFIC keyways are a part of their control system.

128
00:12:10,160 --> 00:12:17,040
The keyways are intended to increase the complexity of an attack against best SFICs.

129
00:12:17,480 --> 00:12:32,120
So if I were to hold up this best SFIC that has what I believe to be a H keyway and I were to pop that key in there, he works no problem.

130
00:12:32,120 --> 00:12:34,900
So he fits in there no issue whatsoever.

131
00:12:35,000 --> 00:12:47,660
And then if I were to hold these two best SFIC keys together, you should see they're very different cuts.

132
00:12:47,660 --> 00:12:55,500
So unfortunately, even though this is a completely empty keyway, I'm not going to be able to fit that in there.

133
00:12:55,820 --> 00:13:02,420
And that's just a function of a control of the best SFIC family.

134
00:13:02,440 --> 00:13:13,260
So in the middle, you can see a chart of all the different keyways that best offers on their standard non-core max, non-overly complicated best cores.

135
00:13:13,500 --> 00:13:21,720
Again, this specific talk is just going to be about best SFICs inside of the A2 system because these are the most common ones that I see.

136
00:13:22,200 --> 00:13:24,760
There are also multi-keyway keys.

137
00:13:24,980 --> 00:13:26,040
So this is kind of exciting.

138
00:13:26,040 --> 00:13:36,220
So if you take a look at the WA, WB, WC items on your chart, you'll see that those keyways are kind of similar.

139
00:13:36,340 --> 00:13:41,400
So you could potentially have a single key that works for all three.

140
00:13:41,400 --> 00:13:49,260
And this just adds additional complexity and mastering opportunities between different best SFIC cores.

141
00:13:49,260 --> 00:13:56,560
On the right-hand side, you can see a Falcon multiplex family set of core keyways.

142
00:13:57,240 --> 00:14:02,260
I think it's just a good example of an all-section key up at the top.

143
00:14:02,260 --> 00:14:05,800
And then you've got two multi-section keys that are kind of unique.

144
00:14:06,330 --> 00:14:15,060
And then it steps down into single-section keys and then another keyway that would potentially open for any key.

145
00:14:15,060 --> 00:14:23,640
So the E-keyway is potentially openable by all the other ones above it.

146
00:14:23,740 --> 00:14:27,120
All right, so moving on.

147
00:14:29,880 --> 00:14:31,380
Let's talk about lateral movement.

148
00:14:31,380 --> 00:14:35,400
This item here on the right is straight from a codebook.

149
00:14:35,400 --> 00:14:41,720
A codebook is something a locksmith uses to track what the key codes are for a key.

150
00:14:42,220 --> 00:14:46,640
If you hold this key up for you, you can see the bidding.

151
00:14:46,700 --> 00:14:49,480
That bidding directly relates to the key code.

152
00:14:49,480 --> 00:14:51,860
So if you can get a key code, you can cut a key.

153
00:14:52,520 --> 00:14:54,660
Up at the top, you have SMBA.

154
00:14:54,660 --> 00:14:58,260
So that's a submaster for the BA system.

155
00:14:59,220 --> 00:15:03,500
And then you have a couple other keys that are part of the BA system.

156
00:15:04,120 --> 00:15:19,080
All right, so if you note, there is actually a pattern going on between the fifth and sixth columns of the key code, where it kind of steps up by two and then down.

157
00:15:19,440 --> 00:15:35,300
Or vice versa, it could be if you're going from the third column from the right to the column second from the right, you're going down and then up, up, up, and you're cycling every four by two.

158
00:15:36,060 --> 00:15:45,460
So it's a lot easier for me to show you a video of what this actually looks like, because it looks a little complicated here, but there is definitely a pattern that you can abuse.

159
00:15:45,480 --> 00:15:52,500
So potentially, you can move laterally.

160
00:15:53,560 --> 00:16:00,000
All right, so we talked a little bit about the keys themselves and kind of the key codes and what they mean.

161
00:16:00,220 --> 00:16:02,360
Let's talk about what happens if you get a key in hand.

162
00:16:02,360 --> 00:16:15,440
If you can get a key in your hand, you could use a key decoder, and you could quickly discern the bidding and recreate those keys or at least get an understanding for where that key goes within a system.

163
00:16:15,820 --> 00:16:17,560
And then you could also use calipers.

164
00:16:17,560 --> 00:16:35,960
So calipers, probably not these little tiny measuring calipers on the right-hand side that attach to a keychain, but calipers will measure your pins or your bidding on a key, and you can use that to recreate either a core or the key itself.

165
00:16:35,960 --> 00:16:41,860
So if you can get a key or core in hand, you can definitely duplicate it then.

166
00:16:42,220 --> 00:16:47,400
All right, key in photo, you could use one of these decoding charts.

167
00:16:47,400 --> 00:16:48,920
These are provided by DeviantOLM.

168
00:16:48,920 --> 00:16:50,620
I find these ones very useful.

169
00:16:51,760 --> 00:16:55,380
Their usefulness depends on the quality of the photo that you take, of course.

170
00:16:55,480 --> 00:17:04,760
If you have a photo that's kind of jostled or shot from across the room, it might be a little more difficult to actually make that photo work for you.

171
00:17:04,760 --> 00:17:07,440
But with some Photoshop magic, you might be in luck.

172
00:17:08,040 --> 00:17:10,680
There's also an app called SnapDecoder.

173
00:17:10,680 --> 00:17:13,260
I have had mixed results with this app.

174
00:17:13,460 --> 00:17:17,760
Honestly, I haven't gotten much usage out of it, but I figured I'd share it.

175
00:17:17,760 --> 00:17:25,120
This app promises to be able to discern the bidding of a key by holding it up to the app.

176
00:17:25,120 --> 00:17:37,120
So in an ideal world, you would be able to take this app, and maybe in a future update or maybe an update that I haven't seen, you'd be able to point this app at a key, tell it it's a best SVIC key, and it will tell you the bidding.

177
00:17:37,120 --> 00:17:42,400
And then you could go off-site, recreate that key, and start opening doors right then and there.

178
00:17:42,400 --> 00:17:59,060
So these are two ways that you could take a key and a photo using a decoding chart or an app, and start to understand what the bidding is for that key, and potentially recreate it before handing it back to a mark or having to leave it somewhere so you're not being detected.

179
00:17:59,060 --> 00:17:59,900
All right, cool.

180
00:18:00,220 --> 00:18:02,700
All right, so we talked about key in hand, key in photo.

181
00:18:02,700 --> 00:18:04,120
What about key on web?

182
00:18:04,660 --> 00:18:09,080
So keys on websites that are Active Directory integrated.

183
00:18:09,080 --> 00:18:11,820
That sounds great to me as an attacker.

184
00:18:12,040 --> 00:18:15,080
As a red teamer, I'm always targeting Active Directory.

185
00:18:15,080 --> 00:18:20,000
That's something we're always looking for, is a way to move laterally within AD.

186
00:18:20,140 --> 00:18:36,540
Keystone Web is an Active Directory-managed and Active Directory-joined website where you can... their phrase is, it will help the user manage keys and core records for multiple personnel throughout various locations.

187
00:18:36,540 --> 00:18:48,720
This product allows for importing and appending data, mass deletes for employees, key and door key data, and an activity log that tracks user transactions.

188
00:18:48,720 --> 00:18:53,640
So if we add a new employee, maybe he gets a new key to his door.

189
00:18:53,720 --> 00:18:57,400
If I have access to this website, I know exactly what that key is.

190
00:18:57,460 --> 00:18:59,360
And then I also know the master key, right?

191
00:18:59,360 --> 00:19:05,480
So if I look on the right-hand side here, we see the master key code is 8301836.

192
00:19:05,480 --> 00:19:11,560
If I recreate a key with that code, I can now open every door within that system.

193
00:19:11,840 --> 00:19:15,280
And then you also see the control key bidding.

194
00:19:15,280 --> 00:19:18,600
So that one was 4189250.

195
00:19:19,540 --> 00:19:33,000
That's particularly useful because that tells me that I can now start removing some of these cores from the system if I want to and adding my own for potential denial of service, of course, but there may be more interesting things that you can do by swapping out a core.

196
00:19:33,000 --> 00:19:39,420
You might be able to start decoding the system if you don't have access to something as powerful as Keystone Web.

197
00:19:39,540 --> 00:19:43,600
We can also see up at the top the system type, which is an A2 system.

198
00:19:43,600 --> 00:19:49,440
I know we spoke about specifically best SFIC A2 systems, and that's what we would be targeting.

199
00:19:49,440 --> 00:19:53,200
We see the keyway for this system, so this is an A keyway system.

200
00:19:55,360 --> 00:19:59,500
And we see it's a 7-pin system, so we know that we're going to be working with 7-pin locks.

201
00:19:59,500 --> 00:20:03,180
The majority of the best SFIC systems I see are 7-pin systems.

202
00:20:03,780 --> 00:20:11,260
And part of what makes them difficult to pick is the fact that they're 7-pins, but then also they have master keying.

203
00:20:11,260 --> 00:20:23,080
And because they have master keying, it's very easy for those wafers to fall as you're picking, and it's very hard to line them up consistently with what would be an actual operating bidding.

204
00:20:23,220 --> 00:20:33,540
But we will talk a little bit about picking to control, and that is something you would do if the core is in the door.

205
00:20:33,540 --> 00:20:38,720
So if the core is in the door, you can pick to control with a Peterson I-core tensioning tool.

206
00:20:38,720 --> 00:20:41,080
So this is a type A tool.

207
00:20:41,080 --> 00:20:50,880
This is for tensioning a SFIC, and what it's doing is it's putting pressure on the bottom of the core inside of those holes that we saw.

208
00:20:51,440 --> 00:20:54,540
These same holes here, if you can see that.

209
00:20:54,540 --> 00:21:04,460
So those holes are getting tensioned by this tool, and what that does is that forces pressure on where the control pins would be.

210
00:21:04,860 --> 00:21:11,360
And because there's now pressure there, when you pick the lock, you have a higher likelihood of picking to control.

211
00:21:11,360 --> 00:21:26,680
And if you pick to control, you could potentially get this core out of the door, which would be great because now we can open that door, but we can also replace the core with a core of our choosing, or begin to decode the system.

212
00:21:26,680 --> 00:21:29,800
And we'll talk about that just after this.

213
00:21:30,080 --> 00:21:31,880
There is another option.

214
00:21:31,880 --> 00:21:34,800
You could do what is referred to as bitch picking.

215
00:21:34,800 --> 00:21:42,880
It's not my name for it, but that's basically jamming a pick inside of a best SFIC over and over again, fairly aggressively.

216
00:21:42,880 --> 00:21:45,780
These locks are actually fairly prone to that.

217
00:21:45,780 --> 00:21:49,420
Something to do with the way that master wafers work.

218
00:21:50,320 --> 00:21:57,960
A lot of times you'll get lucky enough to pick to control, and if you're able to do that, you kind of have the keys to the kingdom.

219
00:21:57,960 --> 00:22:03,340
You can decode every part of the system once a core is in your hand.

220
00:22:04,660 --> 00:22:08,000
Then I also have a photo of the Lishi best SFIC 2-in-1.

221
00:22:08,140 --> 00:22:15,760
This is a decoder for best SFIC locks that you can decode the operating key as you pick.

222
00:22:15,780 --> 00:22:23,120
So you put tension on the core and you're able to decode it using the chart on the right-hand side.

223
00:22:23,440 --> 00:22:30,320
They're a little spendy, so I don't carry one, but I do have a couple for non-best SFICs.

224
00:22:30,420 --> 00:22:34,240
So core in hand.

225
00:22:34,240 --> 00:22:37,480
Let's say we're able to get one of these cores in hand.

226
00:22:38,200 --> 00:22:44,780
What we might want to do is pull the pins out so we can actually understand how the system works and decode that system.

227
00:22:44,780 --> 00:22:49,200
So we might 3D print one of these.

228
00:22:50,240 --> 00:22:55,280
This is a SFIC pin extraction tool, or repinning tool.

229
00:22:55,860 --> 00:22:58,420
Redcat Imaging put this out on Thingiverse.

230
00:22:58,420 --> 00:23:01,460
I strongly recommend you go pull it down from there.

231
00:23:01,460 --> 00:23:12,220
A standard all-metal version of this goes for well over a hundred dollars everywhere that I've ever seen them, and a 3D printed version is pennies.

232
00:23:12,880 --> 00:23:14,500
And they work beautifully.

233
00:23:14,800 --> 00:23:25,360
So from what I've been told they're not an easy print, but if you were to pull one in and run it inside of a PRESA, apparently they've been fairly successful.

234
00:23:25,440 --> 00:23:27,940
I had a friend print this off for me and it works great.

235
00:23:29,000 --> 00:23:33,400
Essentially you're going to take your SFIC, pop them inside.

236
00:23:34,080 --> 00:23:37,960
You can hammer on it a number of different ways.

237
00:23:39,200 --> 00:23:50,680
Some people like to use the like a flag pin that you could stick in the top of one of these holes and knock the pins out of the bottom.

238
00:23:50,680 --> 00:23:55,960
So what you're going to do is you're going to pop the caps on the back here, and hopefully all that gets collected.

239
00:23:56,100 --> 00:23:58,400
Hopefully just the top caps.

240
00:23:58,660 --> 00:24:01,540
And then you can slowly remove the rest of your pins.

241
00:24:01,640 --> 00:24:04,580
And really what you're interested in is the top pin.

242
00:24:05,660 --> 00:24:08,720
So we're going to talk a little bit about decoding pins.

243
00:24:08,720 --> 00:24:10,840
All right, so we've extracted pins.

244
00:24:11,000 --> 00:24:19,520
We've hammered them out and you can see I've got them sitting inside of a little sparrows tray that I've got with the top pins up top.

245
00:24:19,660 --> 00:24:22,520
And we can begin to kind of measure those.

246
00:24:22,520 --> 00:24:25,280
So there's my calipers on the right hand side.

247
00:24:25,600 --> 00:24:40,540
We were able to measure them and for whatever reason this is in millimeters but it needs to be converted to inches for the chart that's provided by, I believe this was from Best.

248
00:24:40,640 --> 00:24:46,800
And it comes out to, for this specific pin that I was measuring, 0.07.

249
00:24:46,800 --> 00:24:51,060
So that 0.07 pin lines up with a 6b pin.

250
00:24:51,060 --> 00:24:55,000
So we know that that pin, that top pin is a 6b pin.

251
00:24:55,220 --> 00:24:58,880
So that helps us understand, okay, so here's our top pins.

252
00:24:58,880 --> 00:25:05,640
Here's what we, here's what each of these items are if we want to recreate this core.

253
00:25:05,760 --> 00:25:12,520
But where this gets really helpful and really interesting is when we start to decode a system using this.

254
00:25:12,520 --> 00:25:14,360
So this is a decoding chart.

255
00:25:14,400 --> 00:25:19,740
So we can fill this out with your top pins, your build-up pins, master pins.

256
00:25:19,740 --> 00:25:23,940
If there are any, of course there typically will be in a lock like this.

257
00:25:23,940 --> 00:25:31,580
And then you will subtract from 13 the measure of your top pin and that will give you the control key bidding.

258
00:25:31,580 --> 00:25:37,620
So as we discussed, a control key bidding is something you can use to create a control key.

259
00:25:37,620 --> 00:25:41,700
And if you create a control key, that can open every lock in the system.

260
00:25:41,800 --> 00:25:46,900
If you can open every lock in the system, you can go into any door in the organization that you're targeting.

261
00:25:46,900 --> 00:26:12,660
So if you can potentially gain access to, you know, a lock like this, or perhaps it's the core of a bathroom or something that's non-sensitive, and you're able to decode the control key, you can now leave, come back with that control key, and start removing cores to very sensitive doors that you'd like to gain access to.

262
00:26:14,900 --> 00:26:21,500
And that's it for this talk on Keystone to the Kingdom, a talk about targeting best SFIC locks.

263
00:26:21,500 --> 00:26:28,080
I would ask for a Q&A here now, but because this is COVID, we're all remote.

264
00:26:28,080 --> 00:26:35,820
We can't do that, but I would encourage you to reach out to me on Twitter, send me a DM on Discord, and don't be a stranger.

265
00:26:35,820 --> 00:26:38,680
Feel free to reach out, give me your thoughts, ask questions.

266
00:26:38,680 --> 00:26:40,720
If something wasn't clear, let me know.

267
00:26:41,520 --> 00:26:43,660
And I welcome it.

268
00:26:43,660 --> 00:26:44,340
So thank you.