WEBVTT 00:01.060 --> 00:02.980 Hey and welcome to Keystone of the Kingdom. 00:03.220 --> 00:10.640 This is a talk on targeting best SFIC locks and you'll know in a second about what that is, just in case you don't. 00:11.280 --> 00:15.700 This is a talk being given to DEF CON 28's Lockpicking Village. 00:16.340 --> 00:28.900 Unfortunately we have COVID going on in the world and we are not going to be able to meet in person, so I would encourage you to reach out to me on Twitter, reach out to me on Discord inside of the DEF CON channel, and I'd love to have your thoughts, your opinions, 00:28.900 --> 00:32.500 any questions you have, send them my way, happy to discuss. 00:34.280 --> 00:35.820 Who am I? 00:36.280 --> 00:37.640 My name is Austin Mark. 00:37.640 --> 00:39.600 I'm a security enthusiast first and foremost. 00:40.100 --> 00:57.020 I have been doing pen testing for a number of years for a small to mid-market tax consulting and audit firm called RSM and doing red team assessments where we regularly run into best SFIC locks, we see them in the field. 00:58.240 --> 01:04.920 On the right hand side you also have my Hack the Box profile, Twitter, website, feel free to reach out to me on any of those. 01:05.360 --> 01:25.640 And you have a disclaimer, I am not a locksmith, so my thoughts, opinions on how to secure locks probably should only be taken as an attacker, things that I think work, but really remediating these issues or operating your locks is something that's best sent to a locksmith who can give you better advice than I can. 01:25.860 --> 01:28.560 And on the left hand side you have a photo of me at IKEA. 01:28.940 --> 01:38.380 I don't believe I ever got that mirror, which is unfortunate, but as I was flipping through photos trying to find something that I thought was appropriate for this talk, this was the one that stood out to me. 01:39.460 --> 01:50.100 All right, so this is Anthology, this is a collection of talks that I'm giving at DEF CON and hopefully years to come, other conferences. 01:50.180 --> 01:53.900 This is just how I organize my talks, it's all under this Anthology brand. 01:54.020 --> 02:01.580 Left hand side you've got this little picture of an ant, it's kind of like a circuit board, that's just my little Anthology symbol. 02:02.980 --> 02:16.500 While parts of this lab should be done with locks and keys in hand, I'd really prefer this to be a hands-on talk, we're going to deal with COVID and we're going to have some parts of this be a web-based CTF where you can at least learn a little bit about FastTaskFix. 02:17.160 --> 02:34.760 When we get done with the talk, I will open up the CTF and anybody who'd like to can join in, chase down some flags, there will be a prize for whomever wins, so feel free to reach out if you believe that you're the winner and I think we'll wrap this up 24 hours after the talk. 02:35.240 --> 02:50.060 Down at the bottom you have some logins, you have a ctflogin at pctf.ant.red, that is a CTFD instance that has some challenges, I think there's something like 10 challenges, just kind of shooting the gambit across different parts of targeting a BestSFix system. 02:50.640 --> 02:59.720 You also have course materials that just links out to a github page, you can pull down some pdfs and some further learning resources if you're interested in BestSFix. 03:00.120 --> 03:09.280 And then you've got a KeystoneWeb instance, you'll learn a little bit more in a second about what KeystoneWeb is, but there it is out at ksw.ant.red. 03:10.000 --> 03:12.780 And down at the bottom you have a login for that. 03:13.520 --> 03:15.640 All right, so let's jump into the agenda. 03:15.660 --> 03:18.100 So here's what we're going to try to cover. 03:18.100 --> 03:19.400 What are SFIX? 03:19.540 --> 03:21.120 What are key marks? 03:21.680 --> 03:26.840 It's kind of in the name, it's the marks on the BestSFix keys. 03:27.080 --> 03:28.280 Where are SFIX? 03:28.280 --> 03:29.680 So where are you going to find them? 03:29.820 --> 03:32.240 And then what can we do once we've found them? 03:32.460 --> 03:34.640 So first and foremost, what is an SFIC? 03:35.000 --> 03:39.080 SFIC stands for Small Format Interchangeable Core. 03:39.280 --> 03:42.220 Let's see... yep, you guys can see it there. 03:42.700 --> 03:46.380 They're a way for businesses to change which key goes to which door quickly. 03:46.380 --> 03:48.980 They can also provide a means of access control. 03:48.980 --> 03:55.500 So Sally shouldn't be able to go into Jim's room, but the janitor should probably be able to go everywhere, right? 03:55.600 --> 03:59.280 So that janitor needs to be able to get access to both of their rooms. 03:59.280 --> 04:04.700 So to be able to do that, you have a master key that will open both doors. 04:05.340 --> 04:13.060 So to that end, these pins that go inside of these locks are considered mastered keyed. 04:13.060 --> 04:17.140 There's a number of different segments and you'll see in a second what those kind of look like. 04:18.880 --> 04:22.420 Moving on from that, where are we going to find SFIX? 04:22.420 --> 04:28.100 SFIX are in schools, office buildings, hotels, and very large businesses. 04:28.100 --> 04:31.280 So you'll see them very regularly. 04:31.280 --> 04:38.200 I remember when I gave this talk or a talk similar to this last year at DEF CON, I noticed a ton of SFIX all around me. 04:38.200 --> 04:44.080 It's kind of one of those things where you get a new car and all of a sudden everybody's driving your car, right? 04:44.080 --> 04:46.180 So this is kind of the same thing. 04:46.180 --> 04:52.660 You figure out that you have an interest in SFIX and everybody suddenly has an SFIX and it's always something to look at, right? 04:53.020 --> 04:55.300 So what are key marks? 04:55.300 --> 04:58.180 Key marks are exactly what they sound like. 04:58.180 --> 05:02.980 It's simply a stamp that is put on a key for tracking. 05:03.300 --> 05:06.440 Should help you know if a key goes to a door. 05:08.100 --> 05:11.140 And it'll also help you track who has access to what. 05:12.140 --> 05:18.320 So what can we do once we know that there's an SFIX that is part of this environment that we're targeting? 05:18.320 --> 05:19.580 We could potentially pick it. 05:19.580 --> 05:28.300 We can potentially duplicate some of those keys if we're able to get access to We're able to move laterally with those keys because they are part of the system. 05:28.300 --> 05:34.180 So if you know where you are within a system, you can potentially move from one door to another. 05:34.340 --> 05:38.100 And that all gets kind of done by doing what is called system decoding. 05:38.100 --> 05:41.600 And we'll walk through some of what that is and how we do that. 05:45.050 --> 05:50.170 All right, so we'll talk a little more about what these SFIX really are. 05:50.330 --> 05:53.930 So an SFIX, as it would be installed, is on the left-hand side. 05:53.970 --> 05:58.710 You can see on the front, you've got a core mark of what appears to be PG7. 05:59.150 --> 06:00.510 And it says best. 06:00.510 --> 06:04.770 So you definitely know you're dealing with a best SFIX rather than another manufacturer's SFIX. 06:05.070 --> 06:11.070 For this talk, we will be specifically talking about best A2 system SFIX, which is the most common. 06:11.090 --> 06:13.470 These are the ones that I see the most often in the field. 06:14.710 --> 06:27.450 This is a door that would only be openable by the PG7 key or another master key or key that is mastered to the PG7 core mark. 06:27.550 --> 06:35.170 So if I were to get a key at an elevated part of the hierarchy, I could also operationally open this door. 06:35.730 --> 06:37.670 You also have a control key. 06:37.670 --> 06:42.210 Control keys can open any door in a system, and they're particularly sensitive. 06:42.210 --> 06:45.390 And we'll talk a little bit about how to get access to those in a little bit. 06:45.950 --> 06:51.310 So on the inside of an SFIX, this one has been fully gutted. 06:51.310 --> 06:57.350 So you don't really have any pins in here, but it helps us kind of walk through what the different items are. 06:57.370 --> 07:00.510 There is a cap that typically goes in the top. 07:00.510 --> 07:13.370 You have an operating shear line that will allow this to turn freely, which would move these throw pins and unlock a door. 07:13.430 --> 07:31.090 Or if the control pins are set in such a way that the control lug would turn, this would allow the core to then rotate and pull in the control lug, which would allow you to remove the core from the door. 07:31.090 --> 07:35.210 So that is the parts and pieces of an SFIX core. 07:35.210 --> 07:40.450 We'll have a kind of exploded picture after this that should help explain that a little further. 07:41.370 --> 07:53.130 And really the goal of this slide is to make sure you're familiar with the control lug, which allows this to be placed in a door, secured to a door, and then operated with operating keys. 07:53.350 --> 07:56.450 All right, so IC cores. 07:56.450 --> 07:58.130 These are interchangeable cores. 07:58.130 --> 08:03.350 On the left-hand side, you have a standard housing that will typically hold one of these cores. 08:03.350 --> 08:07.310 It's not exclusively these indoor cores. 08:07.310 --> 08:10.090 You might actually have a padlock, much like this one. 08:10.750 --> 08:15.670 So you could potentially gain access to one of these. 08:15.670 --> 08:27.410 And when we start talking about removing cores and walking off with something and gaining access to the full system because you have something in hand, a padlock like this is particularly useful. 08:28.210 --> 08:40.370 And then on the right-hand side, you have an exploded version where you can see the key, the plug, the bottom pins, the cylinder cover, cylinder itself, all of the segments we talked about. 08:40.370 --> 08:42.570 So that's part of that master keying. 08:42.570 --> 08:55.030 And then your springs and your top pins that you will be bumping out if you're going to get one of these locks. 08:55.090 --> 09:00.760 All right, moving on, let's talk about S-stick keys. 09:00.760 --> 09:05.540 So these are S-stick keys like this. 09:05.700 --> 09:10.300 And you can kind of see on the front there a key mark. 09:10.300 --> 09:13.160 So on our screenshot, it's BA1. 09:13.160 --> 09:16.060 And on the one in hand, it is SR1. 09:16.260 --> 09:24.200 On the key in hand, we also have a keyway marking that is H, if you can see that, I hope. 09:24.200 --> 09:28.780 And then there's also keyway mark A on the key in the picture. 09:29.100 --> 09:33.620 The serialization marking is particularly useful for tracking multiples of the same key. 09:33.620 --> 09:39.180 So let's say we had 10 of these, and I wanted to know if Stu lost his version of the key. 09:39.260 --> 09:50.560 I'd like to be able to know which key is missing by maybe taking a count of all the keys and saying, hey, serialization key is missing this specific serialization. 09:50.720 --> 09:51.480 Stu, what happened? 09:51.480 --> 09:53.180 I thought we trusted you with that key. 09:53.660 --> 09:54.020 All right. 09:54.020 --> 09:56.140 And then lastly, it's just this tip stop. 10:01.600 --> 10:02.880 So let's talk about systems. 10:02.880 --> 10:06.860 So this is the hierarchy of a best SFIC system. 10:06.880 --> 10:09.040 The top, you have the control. 10:09.040 --> 10:17.220 The control key will operate every key within a system and also allow you to remove one of these SFIC cores from the door. 10:17.760 --> 10:21.000 And if you can remove a core , you can decode the entire system. 10:21.120 --> 10:25.700 We'll talk a little bit about what that means and what the impact of that is. 10:26.220 --> 10:29.020 But if you can get a control key, you're golden. 10:29.020 --> 10:31.700 If you can get a grand master key , you're also golden. 10:31.700 --> 10:39.000 A grand master key will operationally turn every lock within a system. 10:39.000 --> 10:45.260 So if you can grab a grand master key, you can open up any door within that system. 10:45.260 --> 10:51.720 So typically, you'll see GM written on a key that is a grand master key. 10:51.720 --> 11:03.460 So if you can find a key on a lanyard or sitting on a desk that says GM, that might be one to take a picture of or borrow for a moment or what have you. 11:03.660 --> 11:11.560 Typically, if there's different systems within, there might be a master of system A, master of system B, and those are just submasters. 11:11.980 --> 11:15.880 So those many times you'll see written as MA, MB, MC, MD. 11:16.440 --> 11:17.960 It's not a hard and fast rule. 11:17.960 --> 11:19.160 It doesn't have to be true. 11:19.160 --> 11:23.500 It's just kind of a general thing that has been observed over the years. 11:24.360 --> 11:34.500 Operating keys, as we've discussed, these are keys that you typically give an authorized user to access their office or their door or the server room or some other sensitive area. 11:34.940 --> 11:41.920 I've been told by a number of college students that they see these operating keys, they're giving them as part of their dorms. 11:41.920 --> 11:53.300 So maybe they have the operating key to their door and a submaster belongs to whoever runs that part of the dormitory. 11:53.620 --> 11:55.860 A CA, I think they call it. 11:56.000 --> 11:59.400 All right, so moving on. 12:00.320 --> 12:01.240 Keyways. 12:01.240 --> 12:03.720 So let's talk a little bit about keyways. 12:04.000 --> 12:09.460 The best SFIC keyways are a part of their control system. 12:10.160 --> 12:17.040 The keyways are intended to increase the complexity of an attack against best SFICs. 12:17.480 --> 12:32.120 So if I were to hold up this best SFIC that has what I believe to be a H keyway and I were to pop that key in there, he works no problem. 12:32.120 --> 12:34.900 So he fits in there no issue whatsoever. 12:35.000 --> 12:47.660 And then if I were to hold these two best SFIC keys together, you should see they're very different cuts. 12:47.660 --> 12:55.500 So unfortunately, even though this is a completely empty keyway, I'm not going to be able to fit that in there. 12:55.820 --> 13:02.420 And that's just a function of a control of the best SFIC family. 13:02.440 --> 13:13.260 So in the middle, you can see a chart of all the different keyways that best offers on their standard non-core max, non-overly complicated best cores. 13:13.500 --> 13:21.720 Again, this specific talk is just going to be about best SFICs inside of the A2 system because these are the most common ones that I see. 13:22.200 --> 13:24.760 There are also multi-keyway keys. 13:24.980 --> 13:26.040 So this is kind of exciting. 13:26.040 --> 13:36.220 So if you take a look at the WA, WB, WC items on your chart, you'll see that those keyways are kind of similar. 13:36.340 --> 13:41.400 So you could potentially have a single key that works for all three. 13:41.400 --> 13:49.260 And this just adds additional complexity and mastering opportunities between different best SFIC cores. 13:49.260 --> 13:56.560 On the right-hand side, you can see a Falcon multiplex family set of core keyways. 13:57.240 --> 14:02.260 I think it's just a good example of an all-section key up at the top. 14:02.260 --> 14:05.800 And then you've got two multi-section keys that are kind of unique. 14:06.330 --> 14:15.060 And then it steps down into single-section keys and then another keyway that would potentially open for any key. 14:15.060 --> 14:23.640 So the E-keyway is potentially openable by all the other ones above it. 14:23.740 --> 14:27.120 All right, so moving on. 14:29.880 --> 14:31.380 Let's talk about lateral movement. 14:31.380 --> 14:35.400 This item here on the right is straight from a codebook. 14:35.400 --> 14:41.720 A codebook is something a locksmith uses to track what the key codes are for a key. 14:42.220 --> 14:46.640 If you hold this key up for you, you can see the bidding. 14:46.700 --> 14:49.480 That bidding directly relates to the key code. 14:49.480 --> 14:51.860 So if you can get a key code, you can cut a key. 14:52.520 --> 14:54.660 Up at the top, you have SMBA. 14:54.660 --> 14:58.260 So that's a submaster for the BA system. 14:59.220 --> 15:03.500 And then you have a couple other keys that are part of the BA system. 15:04.120 --> 15:19.080 All right, so if you note, there is actually a pattern going on between the fifth and sixth columns of the key code, where it kind of steps up by two and then down. 15:19.440 --> 15:35.300 Or vice versa, it could be if you're going from the third column from the right to the column second from the right, you're going down and then up, up, up, and you're cycling every four by two. 15:36.060 --> 15:45.460 So it's a lot easier for me to show you a video of what this actually looks like, because it looks a little complicated here, but there is definitely a pattern that you can abuse. 15:45.480 --> 15:52.500 So potentially, you can move laterally. 15:53.560 --> 16:00.000 All right, so we talked a little bit about the keys themselves and kind of the key codes and what they mean. 16:00.220 --> 16:02.360 Let's talk about what happens if you get a key in hand. 16:02.360 --> 16:15.440 If you can get a key in your hand, you could use a key decoder, and you could quickly discern the bidding and recreate those keys or at least get an understanding for where that key goes within a system. 16:15.820 --> 16:17.560 And then you could also use calipers. 16:17.560 --> 16:35.960 So calipers, probably not these little tiny measuring calipers on the right-hand side that attach to a keychain, but calipers will measure your pins or your bidding on a key, and you can use that to recreate either a core or the key itself. 16:35.960 --> 16:41.860 So if you can get a key or core in hand, you can definitely duplicate it then. 16:42.220 --> 16:47.400 All right, key in photo, you could use one of these decoding charts. 16:47.400 --> 16:48.920 These are provided by DeviantOLM. 16:48.920 --> 16:50.620 I find these ones very useful. 16:51.760 --> 16:55.380 Their usefulness depends on the quality of the photo that you take, of course. 16:55.480 --> 17:04.760 If you have a photo that's kind of jostled or shot from across the room, it might be a little more difficult to actually make that photo work for you. 17:04.760 --> 17:07.440 But with some Photoshop magic, you might be in luck. 17:08.040 --> 17:10.680 There's also an app called SnapDecoder. 17:10.680 --> 17:13.260 I have had mixed results with this app. 17:13.460 --> 17:17.760 Honestly, I haven't gotten much usage out of it, but I figured I'd share it. 17:17.760 --> 17:25.120 This app promises to be able to discern the bidding of a key by holding it up to the app. 17:25.120 --> 17:37.120 So in an ideal world, you would be able to take this app, and maybe in a future update or maybe an update that I haven't seen, you'd be able to point this app at a key, tell it it's a best SVIC key, and it will tell you the bidding. 17:37.120 --> 17:42.400 And then you could go off-site, recreate that key, and start opening doors right then and there. 17:42.400 --> 17:59.060 So these are two ways that you could take a key and a photo using a decoding chart or an app, and start to understand what the bidding is for that key, and potentially recreate it before handing it back to a mark or having to leave it somewhere so you're not being detected. 17:59.060 --> 17:59.900 All right, cool. 18:00.220 --> 18:02.700 All right, so we talked about key in hand, key in photo. 18:02.700 --> 18:04.120 What about key on web? 18:04.660 --> 18:09.080 So keys on websites that are Active Directory integrated. 18:09.080 --> 18:11.820 That sounds great to me as an attacker. 18:12.040 --> 18:15.080 As a red teamer, I'm always targeting Active Directory. 18:15.080 --> 18:20.000 That's something we're always looking for, is a way to move laterally within AD. 18:20.140 --> 18:36.540 Keystone Web is an Active Directory-managed and Active Directory-joined website where you can... their phrase is, it will help the user manage keys and core records for multiple personnel throughout various locations. 18:36.540 --> 18:48.720 This product allows for importing and appending data, mass deletes for employees, key and door key data, and an activity log that tracks user transactions. 18:48.720 --> 18:53.640 So if we add a new employee, maybe he gets a new key to his door. 18:53.720 --> 18:57.400 If I have access to this website, I know exactly what that key is. 18:57.460 --> 18:59.360 And then I also know the master key, right? 18:59.360 --> 19:05.480 So if I look on the right-hand side here, we see the master key code is 8301836. 19:05.480 --> 19:11.560 If I recreate a key with that code, I can now open every door within that system. 19:11.840 --> 19:15.280 And then you also see the control key bidding. 19:15.280 --> 19:18.600 So that one was 4189250. 19:19.540 --> 19:33.000 That's particularly useful because that tells me that I can now start removing some of these cores from the system if I want to and adding my own for potential denial of service, of course, but there may be more interesting things that you can do by swapping out a core. 19:33.000 --> 19:39.420 You might be able to start decoding the system if you don't have access to something as powerful as Keystone Web. 19:39.540 --> 19:43.600 We can also see up at the top the system type, which is an A2 system. 19:43.600 --> 19:49.440 I know we spoke about specifically best SFIC A2 systems, and that's what we would be targeting. 19:49.440 --> 19:53.200 We see the keyway for this system, so this is an A keyway system. 19:55.360 --> 19:59.500 And we see it's a 7-pin system, so we know that we're going to be working with 7-pin locks. 19:59.500 --> 20:03.180 The majority of the best SFIC systems I see are 7-pin systems. 20:03.780 --> 20:11.260 And part of what makes them difficult to pick is the fact that they're 7-pins, but then also they have master keying. 20:11.260 --> 20:23.080 And because they have master keying, it's very easy for those wafers to fall as you're picking, and it's very hard to line them up consistently with what would be an actual operating bidding. 20:23.220 --> 20:33.540 But we will talk a little bit about picking to control, and that is something you would do if the core is in the door. 20:33.540 --> 20:38.720 So if the core is in the door, you can pick to control with a Peterson I-core tensioning tool. 20:38.720 --> 20:41.080 So this is a type A tool. 20:41.080 --> 20:50.880 This is for tensioning a SFIC, and what it's doing is it's putting pressure on the bottom of the core inside of those holes that we saw. 20:51.440 --> 20:54.540 These same holes here, if you can see that. 20:54.540 --> 21:04.460 So those holes are getting tensioned by this tool, and what that does is that forces pressure on where the control pins would be. 21:04.860 --> 21:11.360 And because there's now pressure there, when you pick the lock, you have a higher likelihood of picking to control. 21:11.360 --> 21:26.680 And if you pick to control, you could potentially get this core out of the door, which would be great because now we can open that door, but we can also replace the core with a core of our choosing, or begin to decode the system. 21:26.680 --> 21:29.800 And we'll talk about that just after this. 21:30.080 --> 21:31.880 There is another option. 21:31.880 --> 21:34.800 You could do what is referred to as bitch picking. 21:34.800 --> 21:42.880 It's not my name for it, but that's basically jamming a pick inside of a best SFIC over and over again, fairly aggressively. 21:42.880 --> 21:45.780 These locks are actually fairly prone to that. 21:45.780 --> 21:49.420 Something to do with the way that master wafers work. 21:50.320 --> 21:57.960 A lot of times you'll get lucky enough to pick to control, and if you're able to do that, you kind of have the keys to the kingdom. 21:57.960 --> 22:03.340 You can decode every part of the system once a core is in your hand. 22:04.660 --> 22:08.000 Then I also have a photo of the Lishi best SFIC 2-in-1. 22:08.140 --> 22:15.760 This is a decoder for best SFIC locks that you can decode the operating key as you pick. 22:15.780 --> 22:23.120 So you put tension on the core and you're able to decode it using the chart on the right-hand side. 22:23.440 --> 22:30.320 They're a little spendy, so I don't carry one, but I do have a couple for non-best SFICs. 22:30.420 --> 22:34.240 So core in hand. 22:34.240 --> 22:37.480 Let's say we're able to get one of these cores in hand. 22:38.200 --> 22:44.780 What we might want to do is pull the pins out so we can actually understand how the system works and decode that system. 22:44.780 --> 22:49.200 So we might 3D print one of these. 22:50.240 --> 22:55.280 This is a SFIC pin extraction tool, or repinning tool. 22:55.860 --> 22:58.420 Redcat Imaging put this out on Thingiverse. 22:58.420 --> 23:01.460 I strongly recommend you go pull it down from there. 23:01.460 --> 23:12.220 A standard all-metal version of this goes for well over a hundred dollars everywhere that I've ever seen them, and a 3D printed version is pennies. 23:12.880 --> 23:14.500 And they work beautifully. 23:14.800 --> 23:25.360 So from what I've been told they're not an easy print, but if you were to pull one in and run it inside of a PRESA, apparently they've been fairly successful. 23:25.440 --> 23:27.940 I had a friend print this off for me and it works great. 23:29.000 --> 23:33.400 Essentially you're going to take your SFIC, pop them inside. 23:34.080 --> 23:37.960 You can hammer on it a number of different ways. 23:39.200 --> 23:50.680 Some people like to use the like a flag pin that you could stick in the top of one of these holes and knock the pins out of the bottom. 23:50.680 --> 23:55.960 So what you're going to do is you're going to pop the caps on the back here, and hopefully all that gets collected. 23:56.100 --> 23:58.400 Hopefully just the top caps. 23:58.660 --> 24:01.540 And then you can slowly remove the rest of your pins. 24:01.640 --> 24:04.580 And really what you're interested in is the top pin. 24:05.660 --> 24:08.720 So we're going to talk a little bit about decoding pins. 24:08.720 --> 24:10.840 All right, so we've extracted pins. 24:11.000 --> 24:19.520 We've hammered them out and you can see I've got them sitting inside of a little sparrows tray that I've got with the top pins up top. 24:19.660 --> 24:22.520 And we can begin to kind of measure those. 24:22.520 --> 24:25.280 So there's my calipers on the right hand side. 24:25.600 --> 24:40.540 We were able to measure them and for whatever reason this is in millimeters but it needs to be converted to inches for the chart that's provided by, I believe this was from Best. 24:40.640 --> 24:46.800 And it comes out to, for this specific pin that I was measuring, 0.07. 24:46.800 --> 24:51.060 So that 0.07 pin lines up with a 6b pin. 24:51.060 --> 24:55.000 So we know that that pin, that top pin is a 6b pin. 24:55.220 --> 24:58.880 So that helps us understand, okay, so here's our top pins. 24:58.880 --> 25:05.640 Here's what we, here's what each of these items are if we want to recreate this core. 25:05.760 --> 25:12.520 But where this gets really helpful and really interesting is when we start to decode a system using this. 25:12.520 --> 25:14.360 So this is a decoding chart. 25:14.400 --> 25:19.740 So we can fill this out with your top pins, your build-up pins, master pins. 25:19.740 --> 25:23.940 If there are any, of course there typically will be in a lock like this. 25:23.940 --> 25:31.580 And then you will subtract from 13 the measure of your top pin and that will give you the control key bidding. 25:31.580 --> 25:37.620 So as we discussed, a control key bidding is something you can use to create a control key. 25:37.620 --> 25:41.700 And if you create a control key, that can open every lock in the system. 25:41.800 --> 25:46.900 If you can open every lock in the system, you can go into any door in the organization that you're targeting. 25:46.900 --> 26:12.660 So if you can potentially gain access to, you know, a lock like this, or perhaps it's the core of a bathroom or something that's non-sensitive, and you're able to decode the control key, you can now leave, come back with that control key, and start removing cores to very sensitive doors that you'd like to gain access to. 26:14.900 --> 26:21.500 And that's it for this talk on Keystone to the Kingdom, a talk about targeting best SFIC locks. 26:21.500 --> 26:28.080 I would ask for a Q&A here now, but because this is COVID, we're all remote. 26:28.080 --> 26:35.820 We can't do that, but I would encourage you to reach out to me on Twitter, send me a DM on Discord, and don't be a stranger. 26:35.820 --> 26:38.680 Feel free to reach out, give me your thoughts, ask questions. 26:38.680 --> 26:40.720 If something wasn't clear, let me know. 26:41.520 --> 26:43.660 And I welcome it. 26:43.660 --> 26:44.340 So thank you.