start	end	text
1060	6100	Hey and welcome to Keystone of the Kingdom. This is a talk on targeting best SFIC locks
6100	12420	and you'll know in a second about what that is, just in case you don't. This is a talk being
12420	18280	given to DEF CON 28's Lockpicking Village. Unfortunately we have COVID going on in the
18280	21960	world and we are not going to be able to meet in person, so I would encourage you to reach out to
21960	27380	me on Twitter, reach out to me on Discord inside of the DEF CON channel, and I'd love to have your
27380	32500	thoughts, your opinions, any questions you have, send them my way, happy to discuss.
34280	39600	Who am I? My name is Austin Mark. I'm a security enthusiast first and foremost.
40100	48520	I have been doing pen testing for a number of years for a small to mid-market tax consulting
48520	55200	and audit firm called RSM and doing red team assessments where we regularly run into best SFIC
55200	61400	locks, we see them in the field. On the right hand side you also have my Hack the Box profile,
61400	66880	Twitter, website, feel free to reach out to me on any of those. And you have a disclaimer,
66880	72680	I am not a locksmith, so my thoughts, opinions on how to secure locks probably should only be taken
73880	80800	as an attacker, things that I think work, but really remediating these issues or operating
80800	85120	your locks is something that's best sent to a locksmith who can give you better advice than I
85120	90660	can. And on the left hand side you have a photo of me at IKEA. I don't believe I ever got that mirror,
90660	95480	which is unfortunate, but as I was flipping through photos trying to find something that
95480	98380	I thought was appropriate for this talk, this was the one that stood out to me.
99460	106360	All right, so this is Anthology, this is a collection of talks that I'm giving at DEF CON
106360	112180	and hopefully years to come, other conferences. This is just how I organize my talks, it's all
112180	116920	under this Anthology brand. Left hand side you've got this little picture of an ant,
116920	121580	it's kind of like a circuit board, that's just my little Anthology symbol.
122980	127220	While parts of this lab should be done with locks and keys in hand,
127220	130800	I'd really prefer this to be a hands-on talk, we're going to deal with COVID and we're going
130800	135460	to have some parts of this be a web-based CTF where you can at least learn a little bit about
135460	143260	FastTaskFix. When we get done with the talk, I will open up the CTF and anybody who'd like to
143260	149900	can join in, chase down some flags, there will be a prize for whomever wins, so feel free to
149900	154180	reach out if you believe that you're the winner and I think we'll wrap this up 24 hours after the
154180	160720	talk. Down at the bottom you have some logins, you have a ctflogin at pctf.ant.red, that is
161440	165780	a CTFD instance that has some challenges, I think there's something like 10 challenges,
165780	168960	just kind of shooting the gambit across different parts of targeting a BestSFix
168960	174820	system. You also have course materials that just links out to a github page, you can pull down
174820	181020	some pdfs and some further learning resources if you're interested in BestSFix. And then you've
181020	186500	got a KeystoneWeb instance, you'll learn a little bit more in a second about what KeystoneWeb is,
186500	192780	but there it is out at ksw.ant.red. And down at the bottom you have a login for that.
193520	198520	All right, so let's jump into the agenda. So here's what we're going to try to cover. What
198520	206840	are SFIX? What are key marks? It's kind of in the name, it's the marks on the BestSFix keys.
207080	211560	Where are SFIX? So where are you going to find them? And then what can we do once we've found
211560	219080	them? So first and foremost, what is an SFIC? SFIC stands for Small Format Interchangeable Core.
219280	224580	Let's see... yep, you guys can see it there. They're a way for businesses to change which
224580	229240	key goes to which door quickly. They can also provide a means of access control. So
229880	234380	Sally shouldn't be able to go into Jim's room, but the janitor should probably be able to go
234380	239480	everywhere, right? So that janitor needs to be able to get access to both of their rooms. So
239480	248820	to be able to do that, you have a master key that will open both doors. So to that end, these pins
248820	254000	that go inside of these locks are considered mastered keyed. There's a number of different
254000	261220	segments and you'll see in a second what those kind of look like. Moving on from that, where
261220	268100	are we going to find SFIX? SFIX are in schools, office buildings, hotels, and very large businesses.
268100	274680	So you'll see them very regularly. I remember when I gave this talk or a talk similar to this
274680	279400	last year at DEF CON, I noticed a ton of SFIX all around me. It's kind of one of those things where
280160	285320	you get a new car and all of a sudden everybody's driving your car, right? So this is kind of the
285320	289700	same thing. You figure out that you have an interest in SFIX and everybody suddenly has an
289700	297440	SFIX and it's always something to look at, right? So what are key marks? Key marks are exactly what
297440	305220	they sound like. It's simply a stamp that is put on a key for tracking. Should help you know if a
305220	314240	key goes to a door. And it'll also help you track who has access to what. So what can we do once we
314240	319000	know that there's an SFIX that is part of this environment that we're targeting? We could
319000	323520	potentially pick it. We can potentially duplicate some of those keys if we're able to get access to
324080	328860	We're able to move laterally with those keys because they are part of the system. So if you
328860	334180	know where you are within a system, you can potentially move from one door to another.
334340	339260	And that all gets kind of done by doing what is called system decoding. And we'll walk through
339260	348630	some of what that is and how we do that. All right, so we'll talk a little more about what
348630	354810	these SFIX really are. So an SFIX, as it would be installed, is on the left-hand side. You can see
354810	360690	on the front, you've got a core mark of what appears to be PG7. And it says best. So you
360690	365650	definitely know you're dealing with a best SFIX rather than another manufacturer's SFIX. For this
365650	371230	talk, we will be specifically talking about best A2 system SFIX, which is the most common. These
371230	379070	are the ones that I see the most often in the field. This is a door that would only be openable
379070	389030	by the PG7 key or another master key or key that is mastered to the PG7 core mark. So if I were to
389030	395170	get a key at an elevated part of the hierarchy, I could also operationally open this door.
395730	401510	You also have a control key. Control keys can open any door in a system, and they're particularly
401510	405390	sensitive. And we'll talk a little bit about how to get access to those in a little bit.
405950	412890	So on the inside of an SFIX, this one has been fully gutted. So you don't really have any pins
412890	419170	in here, but it helps us kind of walk through what the different items are. There is a cap that
419170	426670	typically goes in the top. You have an operating shear line that will allow this to turn freely,
426670	439410	which would move these throw pins and unlock a door. Or if the control pins are set in such a
439410	446730	way that the control lug would turn, this would allow the core to then rotate and pull in the
447130	454030	control lug, which would allow you to remove the core from the door. So that is the parts and pieces
454030	459370	of an SFIX core. We'll have a kind of exploded picture after this that should help explain that
459510	465950	a little further. And really the goal of this slide is to make sure you're familiar with the
465950	471810	control lug, which allows this to be placed in a door, secured to a door, and then operated with
471810	479090	operating keys. All right, so IC cores. These are interchangeable cores. On the left-hand side,
479090	484690	you have a standard housing that will typically hold one of these cores. It's not exclusively
484690	493230	these indoor cores. You might actually have a padlock, much like this one. So you could
493230	498010	potentially gain access to one of these. And when we start talking about removing cores and walking
498010	503830	off with something and gaining access to the full system because you have something in hand,
504350	509990	a padlock like this is particularly useful. And then on the right-hand side, you have an
509990	517350	exploded version where you can see the key, the plug, the bottom pins, the cylinder cover,
517350	522570	cylinder itself, all of the segments we talked about. So that's part of that master keying.
522570	531110	And then your springs and your top pins that you will be bumping out
532410	540760	if you're going to get one of these locks. All right, moving on, let's talk about S-stick keys.
540760	550300	So these are S-stick keys like this. And you can kind of see on the front there a key mark.
550300	557920	So on our screenshot, it's BA1. And on the one in hand, it is SR1. On the key in hand,
557920	565660	we also have a keyway marking that is H, if you can see that, I hope. And then there's also
565660	571100	keyway mark A on the key in the picture. The serialization marking is particularly useful
571100	576560	for tracking multiples of the same key. So let's say we had 10 of these, and I wanted to know if
576560	582720	Stu lost his version of the key. I'd like to be able to know which key is missing by maybe taking
582980	589380	a count of all the keys and saying, hey, serialization key is missing this specific
589380	594420	serialization. Stu, what happened? I thought we trusted you with that key. All right. And then
594420	605480	lastly, it's just this tip stop. So let's talk about systems. So this is the hierarchy of a
605480	611680	best SFIC system. The top, you have the control. The control key will operate every key within a
611680	619080	system and also allow you to remove one of these SFIC cores from the door. And if you can remove a
619080	624680	core, you can decode the entire system. We'll talk a little bit about what that means and what the
624680	630300	impact of that is. But if you can get a control key, you're golden. If you can get a grand master
630300	639160	key, you're also golden. A grand master key will operationally turn every lock within a system. So
639160	645360	if you can grab a grand master key, you can open up any door within that system. So
646700	653220	typically, you'll see GM written on a key that is a grand master key. So if you can find a key
653220	661060	on a lanyard or sitting on a desk that says GM, that might be one to take a picture of or
661060	666860	borrow for a moment or what have you. Typically, if there's different systems within, there might
666860	673340	be a master of system A, master of system B, and those are just submasters. So those many times
673340	679160	you'll see written as MA, MB, MC, MD. It's not a hard and fast rule. It doesn't have to be true.
679160	685660	It's just kind of a general thing that has been observed over the years. Operating keys,
685660	690680	as we've discussed, these are keys that you typically give an authorized user to access
690680	696200	their office or their door or the server room or some other sensitive area. I've been told by a
696200	700940	number of college students that they see these operating keys, they're giving them as part of
700940	708460	their dorms. So maybe they have the operating key to their door and a submaster belongs to
710220	719400	whoever runs that part of the dormitory. A CA, I think they call it. All right, so moving on.
720320	728000	Keyways. So let's talk a little bit about keyways. The best SFIC keyways are a part of their
728000	735560	control system. The keyways are intended to increase the complexity of an attack against
735560	746340	best SFICs. So if I were to hold up this best SFIC that has what I believe to be a H keyway
746340	754900	and I were to pop that key in there, he works no problem. So he fits in there no issue whatsoever.
755000	764420	And then if I were to hold these two best SFIC keys together, you should see they're very different
766660	774060	cuts. So unfortunately, even though this is a completely empty keyway, I'm not going to be
774060	782420	able to fit that in there. And that's just a function of a control of the best SFIC family.
782440	786760	So in the middle, you can see a chart of all the different keyways that best offers on their
786760	796640	standard non-core max, non-overly complicated best cores. Again, this specific talk is just
796640	800800	going to be about best SFICs inside of the A2 system because these are the most common ones
800800	806580	that I see. There are also multi-keyway keys. So this is kind of exciting. So if you take a look
806580	816740	at the WA, WB, WC items on your chart, you'll see that those keyways are kind of similar. So you
816740	823420	could potentially have a single key that works for all three. And this just adds additional complexity
823420	830460	and mastering opportunities between different best SFIC cores. On the right-hand side,
830460	840480	you can see a Falcon multiplex family set of core keyways. I think it's just a good example of
840480	845800	an all-section key up at the top. And then you've got two multi-section keys that are kind of unique.
846330	853700	And then it steps down into single-section keys and then another keyway that would potentially
853700	863640	open for any key. So the E-keyway is potentially openable by all the other ones above it.
863740	873520	All right, so moving on. Let's talk about lateral movement. This item here on the right
873520	877660	is straight from a codebook. A codebook is something a locksmith uses to track
877940	886640	what the key codes are for a key. If you hold this key up for you, you can see the bidding.
886700	891860	That bidding directly relates to the key code. So if you can get a key code, you can cut a key.
892520	899840	Up at the top, you have SMBA. So that's a submaster for the BA system. And then you
899840	908060	have a couple other keys that are part of the BA system. All right, so if you note,
908060	913620	there is actually a pattern going on between the fifth and sixth columns of the key code,
914160	921760	where it kind of steps up by two and then down. Or vice versa, it could be
922460	928600	if you're going from the third column from the right to the column second from the right,
928600	935300	you're going down and then up, up, up, and you're cycling every four by two.
936060	940140	So it's a lot easier for me to show you a video of what this actually looks like,
940140	943380	because it looks a little complicated here, but there is definitely a pattern
944040	954740	that you can abuse. So potentially, you can move laterally. All right, so we talked a little bit
954740	961180	about the keys themselves and kind of the key codes and what they mean. Let's talk about what
961180	965320	happens if you get a key in hand. If you can get a key in your hand, you could use a key decoder,
965320	972920	and you could quickly discern the bidding and recreate those keys or at least get an understanding
972920	979020	for where that key goes within a system. And then you could also use calipers. So calipers,
979020	983860	probably not these little tiny measuring calipers on the right-hand side that attach to a keychain,
984660	992440	but calipers will measure your pins or your bidding on a key, and you can use that to recreate
993120	998880	either a core or the key itself. So if you can get a key or core in hand,
998880	1005580	you can definitely duplicate it then. All right, key in photo, you could use one of
1005580	1010620	these decoding charts. These are provided by DeviantOLM. I find these ones very useful.
1011760	1015380	Their usefulness depends on the quality of the photo that you take, of course.
1015480	1019840	If you have a photo that's kind of jostled or shot from across the room, it might be a little
1019840	1026280	more difficult to actually make that photo work for you. But with some Photoshop magic,
1026280	1032520	you might be in luck. There's also an app called SnapDecoder. I have had mixed results with this
1032520	1039380	app. Honestly, I haven't gotten much usage out of it, but I figured I'd share it. This app promises
1039380	1046720	to be able to discern the bidding of a key by holding it up to the app. So in an ideal world,
1046720	1050720	you would be able to take this app, and maybe in a future update or maybe an update that I haven't
1050720	1056160	seen, you'd be able to point this app at a key, tell it it's a best SVIC key, and it will tell
1056160	1061460	you the bidding. And then you could go off-site, recreate that key, and start opening doors right
1061460	1067480	then and there. So these are two ways that you could take a key and a photo using a decoding
1067480	1073060	chart or an app, and start to understand what the bidding is for that key, and potentially
1073060	1078300	recreate it before handing it back to a mark or having to leave it somewhere so you're not being
1078300	1083160	detected. All right, cool. All right, so we talked about key in hand, key in photo. What about key
1083160	1090760	on web? So keys on websites that are Active Directory integrated. That sounds great to me
1090760	1095420	as an attacker. As a red teamer, I'm always targeting Active Directory. That's something
1095420	1102440	we're always looking for, is a way to move laterally within AD. Keystone Web is an Active
1102440	1109700	Directory-managed and Active Directory-joined website where you can... their phrase is,
1109700	1115080	it will help the user manage keys and core records for multiple personnel throughout
1115080	1120160	various locations. This product allows for importing and appending data, mass deletes
1120160	1128880	for employees, key and door key data, and an activity log that tracks user transactions. So
1128880	1135380	if we add a new employee, maybe he gets a new key to his door. If I have access to this website,
1135380	1140220	I know exactly what that key is. And then I also know the master key, right? So if I look on the
1140220	1147640	right-hand side here, we see the master key code is 8301836. If I recreate a key with that code,
1147640	1155280	I can now open every door within that system. And then you also see the control key bidding.
1155280	1162420	So that one was 4189250. That's particularly useful because that tells me that I can now
1162420	1165920	start removing some of these cores from the system if I want to and adding my own
1166700	1170940	for potential denial of service, of course, but there may be more interesting things that you can
1170940	1175840	do by swapping out a core. You might be able to start decoding the system if you don't have access
1175840	1182380	to something as powerful as Keystone Web. We can also see up at the top the system type, which is
1182380	1188860	an A2 system. I know we spoke about specifically best SFIC A2 systems, and that's what we would be
1188860	1196600	targeting. We see the keyway for this system, so this is an A keyway system. And we see it's a 7-pin
1196600	1201040	system, so we know that we're going to be working with 7-pin locks. The majority of the best SFIC
1201040	1206440	systems I see are 7-pin systems. And part of what makes them difficult to pick is the fact
1206440	1212980	that they're 7-pins, but then also they have master keying. And because they have master keying,
1212980	1219780	it's very easy for those wafers to fall as you're picking, and it's very hard to line them up
1219780	1224500	consistently with what would be an actual operating bidding. But we will talk a little
1224500	1233540	bit about picking to control, and that is something you would do if the core is in the door.
1233540	1238720	So if the core is in the door, you can pick to control with a Peterson I-core tensioning tool.
1238720	1245880	So this is a type A tool. This is for tensioning a SFIC, and what it's doing is it's putting
1245880	1253200	pressure on the bottom of the core inside of those holes that we saw. These same holes here,
1253200	1259360	if you can see that. So those holes are getting tensioned by this tool, and what that does is that
1259360	1266300	forces pressure on where the control pins would be. And because there's now pressure there,
1266300	1271800	when you pick the lock, you have a higher likelihood of picking to control. And if you
1271800	1277900	pick to control, you could potentially get this core out of the door, which would be great because
1277900	1283020	now we can open that door, but we can also replace the core with a core of our choosing, or
1283660	1291880	begin to decode the system. And we'll talk about that just after this. There is another option.
1291880	1296180	You could do what is referred to as bitch picking. It's not my name for it,
1296180	1301100	but that's basically jamming a pick inside of a best SFIC over and over again,
1301760	1305780	fairly aggressively. These locks are actually fairly prone to that.
1305780	1309420	Something to do with the way that master wafers work.
1310320	1314980	A lot of times you'll get lucky enough to pick to control, and if you're able to do that,
1316240	1319780	you kind of have the keys to the kingdom. You can decode every part of the system
1320800	1328000	once a core is in your hand. Then I also have a photo of the Lishi best SFIC 2-in-1.
1328140	1335760	This is a decoder for best SFIC locks that you can decode the operating key as you pick.
1335780	1343120	So you put tension on the core and you're able to decode it using the chart on the right-hand side.
1343440	1350320	They're a little spendy, so I don't carry one, but I do have a couple for non-best SFICs.
1350420	1357480	So core in hand. Let's say we're able to get one of these cores in hand.
1358200	1362880	What we might want to do is pull the pins out so we can actually understand how the system works
1362880	1373760	and decode that system. So we might 3D print one of these. This is a SFIC pin extraction tool,
1373760	1379860	or repinning tool. Redcat Imaging put this out on Thingiverse. I strongly recommend you go
1379860	1385460	pull it down from there. A standard all-metal version of this goes for well over a hundred
1385460	1392220	dollars everywhere that I've ever seen them, and a 3D printed version is pennies.
1392880	1400980	And they work beautifully. So from what I've been told they're not an easy print, but if you were
1400980	1405360	to pull one in and run it inside of a PRESA, apparently they've been fairly successful.
1405440	1411860	I had a friend print this off for me and it works great. Essentially you're going to take your SFIC,
1411860	1421360	pop them inside. You can hammer on it a number of different ways. Some people like to use the
1424000	1430300	like a flag pin that you could stick in the top of one of these holes and knock the pins out of
1430300	1433960	the bottom. So what you're going to do is you're going to pop the caps on the back here, and
1433960	1440460	hopefully all that gets collected. Hopefully just the top caps. And then you can slowly remove the
1440460	1446980	rest of your pins. And really what you're interested in is the top pin. So we're going to
1446980	1452120	talk a little bit about decoding pins. All right, so we've extracted pins. We've hammered them out
1452680	1457160	and you can see I've got them sitting inside of a little sparrows tray that I've got
1457160	1463980	with the top pins up top. And we can begin to kind of measure those. So there's my calipers
1463980	1473620	on the right hand side. We were able to measure them and for whatever reason this is in millimeters
1473620	1479740	but it needs to be converted to inches for the chart that's provided by, I believe this was from
1479740	1489160	Best. And it comes out to, for this specific pin that I was measuring, 0.07. So that 0.07 pin lines
1489160	1496800	up with a 6b pin. So we know that that pin, that top pin is a 6b pin. So that helps us understand,
1496800	1504040	okay, so here's our top pins. Here's what we, here's what each of these items are if we want
1504040	1510260	to recreate this core. But where this gets really helpful and really interesting is when we start
1510260	1516420	to decode a system using this. So this is a decoding chart. So we can fill this out with
1516420	1522360	your top pins, your build-up pins, master pins. If there are any, of course there typically will
1522360	1529240	be in a lock like this. And then you will subtract from 13 the measure of your top pin and that will
1529240	1536420	give you the control key bidding. So as we discussed, a control key bidding is something you can use to
1536420	1541940	create a control key. And if you create a control key, that can open every lock in the system. If
1541940	1546440	you can open every lock in the system, you can go into any door in the organization that you're
1546440	1552880	targeting. So if you can potentially gain access to, you know, a lock like this, or perhaps it's
1552880	1560360	the core of a bathroom or something that's non-sensitive, and you're able to decode
1560360	1568340	the control key, you can now leave, come back with that control key, and start removing
1568340	1572660	cores to very sensitive doors that you'd like to gain access to.
1574900	1581500	And that's it for this talk on Keystone to the Kingdom, a talk about targeting best SFIC locks.
1581500	1588940	I would ask for a Q&A here now, but because this is COVID, we're all remote. We can't do
1588940	1593400	that, but I would encourage you to reach out to me on Twitter, send me a DM on Discord,
1594560	1598680	and don't be a stranger. Feel free to reach out, give me your thoughts, ask questions.
1598680	1604340	If something wasn't clear, let me know. And I welcome it. So thank you.