Hey everyone, hope y'all are doing well.
Hope everyone's staying safe out there.
And welcome back to DEF CON Safe Mode.
I'm nothing.
And yeah, so I'm gonna be doing a video here.
This is pre-recorded,
but I am gonna be sitting there live with you.
And this is gonna be going over the
infamous Western Electric 30C
and how I was actually able to defeat this thing.
So, start off kind of slow for those of you
who don't know anything about this lock.
And I'm actually gonna start off
talking about both of these here.
So these locks are the result of a lot of research
and development from the Western Electric Company
to solve the problem of payphones.
So these are payphone locks.
And these were put into place during a time
where people were not huge fans of the phone companies
and paying for phone calls and things like that.
So these locks were,
there was a lot of money that went into the research
and development of these,
and they were designed to be very resilient
to everything from vandalism,
to weather and just all around wear and tear,
and also to surreptitious entry and manipulation.
So these locks were designed,
there were a few before these,
and the original patent that I'm aware of
was released in 1966.
And the original patent covered many aspects of these locks,
but there's some things in the patent that weren't on these,
and there's some things on these that weren't in the patent.
So this first one you see here is the Western Electric 29A.
And this is the lock that would protect the electronics
of the payphone.
It went in the upper portion
and secured the upper housing of the payphone
where all the electronic elements were.
This is a five lever tumbler lock.
This is actually unsprung,
which means that the levers do not have a spring
that will return them to their zero position.
And instead, when you turn the key back,
there is a portion on the actuator
that pushes on the lower part of the levers,
which returns them all to the zero position.
And like I said, this has five levers,
but this big gap you see in the key here
is a stationary ward that goes in between
the front two levers and the rear three levers,
which makes it so that if you were to try
to reproduce a key, you would have to have that gap
to fit through there.
And also in picking, this sits down pretty low.
It makes it very difficult to get a picking wire behind it.
So it definitely makes opening this lock
without the key pretty difficult.
Now, all the levers in here had false gates
as well as true gates, of course,
or else it wouldn't open.
And actually here, I have one here
that has an acrylic face on it.
So as you can see, there's no springs.
You can't see much because of this copper plate here
that guards the levers.
But what you can see is when I turn the key,
you can see all of those levers line up.
And that silver part that you see in there
is the stationary ward.
So the fence also has a cutout to go past that ward
and be able to open up.
Now, this is a part of the payphone,
but I'm not gonna be spending a whole lot of time
on this tonight.
I just wanted to kind of give you a quick overview
of this one so that you'd know the differences
between this and the 30C.
So the 30C is actually a lock
with a pretty interesting history behind it.
This lock was considered unpickable for a very long time.
And it was considered impossible to manipulate open
until a man named James Clark figured out a way
to get into it and went across the country
back in the 1980s, stealing over half a million dollars
in coins from payphones.
And he evaded the police by basically
by continuously moving, not really following any patterns.
There were a couple of little patterns that he followed.
He would mainly hit large sporting events, casinos,
places where a lot of people would be there
and a lot of people would be using the phone.
And apparently he would just go into the booth,
pretend to make a phone call.
And while he was sitting there on the phone,
he would manipulate the box open, steal the coins,
lock it back up and leave.
And nobody knows how he actually got into these things.
He was on America's Most Wanted twice.
He was called in the newspapers,
everything from the Payphone Bandit,
the Telephone Bandit, the Coinbox Bandit.
I've heard some people actually call him the Phone Ranger,
though I've never seen that in print anywhere.
And I looked a lot.
Honestly, all I found on the Phone Ranger
was a crappy old comic book character.
It was pretty funny.
But anyway, he is pretty well known
as the Phone Ranger among the community.
But no one was ever,
even though he was captured with his tools
and actually while he was working on one of these,
excuse me, I'm gonna have a sip of whiskey real quick.
No one ever actually was able to figure out how he did it.
Um...
Now, the Bell Company, um...
hired retired FBI agents
and spent a pretty good amount of money
trying to figure out how he was able to get into these locks.
And to my knowledge, they never made any progress up to that point.
Um, so they spent quite a long time
These locks are from the single-slot Fortress payphone.
And they were in service for, I think, around 50 years.
Altogether, well, 50 years ago from now, I think they were possibly...
Some of them are still used.
They are still in places, but very rarely,
as we all know how rarely payphones are actually used these days.
But they were continuously in service for, I think, about 30 years
or so, and previous models to this
went back quite a bit further than that.
But anyway, he was ultimately arrested in 1988.
They said he was identifiable by a ponytail, a baseball cap,
and I think cowboy boots.
And he was caught in a payphone playing with a lock
or in a phone booth playing with a lock.
But anyway, so I hadn't heard about that story.
And the first time I heard about this lock, well, not the very first time,
but the first time I got interested in it
was when Matt Smith, also known as Huxley Pig,
did a video, he did a talk, and I saw the recorded talk on video
about a few really cool locks that he had been working on.
And this was one of them.
And he had actually made a little bit of progress
on how to go about beginning to pick this.
He was still working on it, and he said he had spent a lot of time
and effort in trying to figure it out.
And that kind of made me start to think about this lock.
As in, kind of a goal.
Just basically just thinking about how cool it would be
if I could be the one that actually figured it out.
And so I went online, I searched a couple of articles.
Matt Blaze has an amazing article on these locks.
There's also a little bit of information on a couple of the lock picking forums.
But it wasn't until Captain Hook released a video on Lock Pickers United
about a decoding method to get into this lock
to be able to go in there, figure out the key bitting,
and replicate a key to open this thing.
So with a set of wires similar to this,
with very precise measurements,
and little 90 degree turns on the ends,
he was able to go in there and exploit the fact that returning the key to the zero position
would also return all the levers to the zero position.
And there was a finite and an exact measurement between the keyway and the gates and the levers.
And since he was able to fit a piece of wire in there,
he was then able to determine where the gates were, true and false,
and was able to replicate and duplicate a key,
make his own key, and open the lock from there.
So when I saw that video, it kind of kicked me in the butt.
And I thought, oh man, if I'm going to do this, I better get started.
So that day, I went on eBay, found one of these, and ordered it.
And it arrived a few days later, I started messing with it,
and figured out why everybody had such a hard time with it.
This thing is an incredible pain.
But the first thing I did was...
Actually, I think... yeah.
I think the first thing I did was create an acrylic faceplate for it.
So that I could see inside.
So basically I knew what I was dealing with.
So now this is the 30C here with an acrylic faceplate.
And you can see a couple differences from the 29A.
This one actually does have a spring.
There's a single leaf spring here that puts tension on all the levers.
If you raise one lever up, it lifts this spring,
and basically eliminates spring tension from the rest of the levers,
so they are free-floating.
This one does not have that stationary ward in the center.
But everything else is pretty much the same as the 29,
besides this mechanism right here.
And this is what makes this lock so tough.
This is the tumbler blocker.
And what this does,
is this serrated piece here,
along with the points on the levers,
makes it so that as soon as you put tension
on this thing,
that blocker moves into place
and locks all the levers into place
before the fence even gets to the levers.
So in picking a lock, what we do
is we put tension on the lock.
And after you put tension on it,
you manipulate the internals, and you can feel, say,
on a lever lock, the fence rubbing on the levers.
So you'll know when you set a lever when it clicks into place.
Well, on this one,
before you can even put tension on it,
that blocker moves in and stops all those levers from being able to move.
You can see here,
that blocker's already engaged,
but the fence is super far away from the gates.
Now that is for a couple different reasons they did that.
Obviously one being pick resistance
and manipulation resistance.
But also another being lack of maintenance.
Some of these were in very remote areas
where the weather
and the environment was not very friendly.
So if you got a lot of dirt and gunk and other things in this lock
or if there was a lot of key wear, things like that,
as soon as you put the key in
and it raises the levers up to an approximate height,
that blocker will lock them all into place
and make sure that they're at the right height
for the fence to move into the gates.
So that design was both for manipulation resistance
but also for longevity of the lock
and to allow it to work in some very harsh conditions.
So that's what makes it so tough to pick
is that blocker there.
Now the very first time I picked this lock
what I did was
I bypassed that blocker.
There's a video of it online, it was the first video that I posted of this lock
and I took a shim
like this, actually this is the one
inserted it in the top
and
you gotta get it under the anti-tamper switch
which I'll show you a little later
and that can actually hold the blocker back
so that I could go in there and manipulate the levers
and see what it felt like to actually pick this thing.
So once I did that
I posted a video online to basically
show my progress, show that I had actually picked the lock
which at the time it was a world's first
nobody had picked one of these on camera before
even using a shim to bypass the blocker
so it was a first
but it wasn't the first that I was looking for
but after posting that video
I got quite a bit
of response from people
Captain Hook being one of them
and I talked to him a bit
about this lock
and got some tips, we exchanged a couple
little here and theres
about the lock
and got to talking, Captain Hook is an amazing person
great picker, one of the best in the world
and
I didn't want to give too much away
but I mentioned that I had been working on a method
of picking it that was entirely through the keyway
which is what we're looking for
So the first thing I did
was I took his idea
of using bent wires
to find the gates
and I thought, well what if instead of identifying the gates one at a time
what if I took a wire
and bent it in a way
that I could insert it in the lock, in the keyway
and put pressure on all those
levers at once
I could then pick them one at a time
and get the wire to go into all the true gates
which would set the levers all to the correct height
and I could then
turn the bolt and open the lock
Now this kind of worked
I was actually able to
get all the levers set onto the wire
but when it came time to actually
throw the bolt and open the lock
that's where I ran into some issues
It's kind of a chunky wire
and there's not a lot of room to work in there
So, it got in the way, unfortunately.
So when I went to throw the bolt, the fence got stuck on the wire and would not move enough
to actually open the lock, unfortunately.
I spent a lot of time trying to perfect this wire method.
That's all the scratches you see inside here, was me working on the wire,
trying to get it in there perfectly and get everything to work.
I experimented with a lot of different ways. I tried to get all the levers set right,
then put the bolt in a little bit, and then remove the wire and continue,
but nothing was working.
I mean, it was a good idea, but it ultimately failed, unfortunately.
So, well, here's another one that I had made.
This is a much flatter wire that I thought might work.
It's a much weaker, much flatter wire. I figured if I could do that,
maybe I could just force the bolt through the wire, bend it out of the way,
but at least the lock would be open, but that didn't work either.
So I started thinking about Matt, HuxleyPig's video again,
and he had come up with an idea where he would overlift one of the levers
up to the point where it would hold the blocker back from the top.
So I don't know if I can get this in here to show you how this would work, but let's see.
So if you lift... oh, wait a minute, I've got to turn the key way.
Get that out of the way.
So if you lift up on one of the levers, and you lift it past where it's supposed to go...
whoops, I don't think I can do this without actually turning the key.
Meh.
But you can get it overlifted to where it will actually get stuck up here
and hold the blocker back, and I think you're actually deforming the lever at that point.
It's really tough to get it up there.
But it was an interesting idea, and it made me think about
instead of trying to align the gates using a wire or anything like that,
maybe I could use the levers to hold the blocker back, but in a different way.
And one day I was driving, I was driving at work and talking to Captain Hook,
and I had an idea.
And I had to wait all day, it was super hard to wait to not leave work early or run home and try it.
But I had an idea on what I could possibly do.
So what I thought was if I could hold one of the levers up so that the point of the lever
would sit at the point of one of these serrations, it might hold that blocker back just enough
to where I could pick the levers past the blocker.
Now I'd still have to deal with the blocker, they'd still be clicking in these little serrations,
but it might be just enough to where it wouldn't be fully engaged and I could actually pick the lock.
So I started work, as soon as I got home I started working on creating something that would make this happen.
And ultimately, I created this.
Just this little flag tool here, it's got some warding cut into it there.
And what this does...
Ah, where's that tension wrench? Here it is.
Alright, so what this does is you actually insert this right into that first piece of warding,
all the way back and sit it into the actuator.
And when it's sitting there, you then tension the lock,
and that little flag in the back...
I don't know if you can see that, let's try to get some better light here...
So that rear lever is sticking up just a little bit more than the rest of them.
Can you see that back there?
Yeah, I think you can see that.
So that is actually holding that blocker back.
And what I was able to do at that point...
was get a picking wire in there.
And actually I started with the picking wire in there.
But it would hold the blocker just enough...
that I was actually able to put tension on the lock...
and move the levers.
And that was actually the very first way that I ever picked this lock open.
And it worked! It actually worked.
There's a couple videos of it online.
The first one got a lot of scrutiny, of course, because it was a world's first.
There was a little piece of wire sitting on my desk that people thought was some sort of a shim to hold the blocker back,
or they had all sorts of crazy ideas.
But as soon as that happened, I immediately did another video with a clean desk...
and made sure that there was no possible way whatsoever that it was not real.
But that was the very first way that I picked this thing open.
And I was super happy. I couldn't believe it.
I was just out of this world ecstatic.
It was incredible. It was so great.
But in thinking about it, it wasn't the easiest thing in the world.
It's a very delicate balancing act.
And I wanted to make it even better.
So with this, this was designed to hold the blocker just below that last lever's true gate.
So that 8th lever would be the last one that I picked.
And when I picked it, it would be the last one, and I only had to go one click to get it into its true gate.
And I think, I'm pretty sure, that this one tool probably would have worked for any other lock...
unless that 8th lever was a zero cut.
If it was lower.
Anything higher, you could have shot it up into place.
It wouldn't have been easy, but it would have been doable.
But, um...
If it was a zero cut, it would already be sitting too high.
And you'd have to hope that you could get it to drop down.
Sorry. Went in my whistle again.
So then I had the idea of, what if I can hold all the levers up to the right height?
What if I can make all the levers hold that blocker back?
So it didn't matter which one I picked, when, what the binding order was.
And...
So I started making tension wrenches.
I designed a bunch of different tensioners that would go in and hold the levers up to different heights.
And, um...
There was all slight problems with it.
You know, it was hard to get a wire in there and keep holding everything, and it was still a very delicate balancing act.
Don't get me wrong.
But ultimately, what I figured out was that a thin wiper insert was exactly the right height to go in there, in that first ward, and hold those levers up to the exact point where they need to be to hold that blocker back.
And you can actually pick the lock like this too.
Now again, it's difficult.
Because there's not a whole lot of room to work.
But it does hold all the levers up to where you need them.
And you can go in and pick. It's possible.
But again, that wasn't good enough.
It wasn't easy enough.
So...
I started, um...
I basically just started kind of playing with the lock, and looking at what happened when I did different things.
So I started looking at what would happen if I just tensioned it, right?
So you just tension it, and I finally noticed, if you look here, when you tension this thing, the blocker's not engaged.
It's sitting point to point with one of these levers.
But also, that bolt isn't engaged either.
The bottom of the fence here is actually hitting the bottom of the levers.
So, this lock starts in a very interesting configuration here.
I mean, you'd think that the blocker would engage, hold all the levers at zero, this would have no room to go in, things like that.
But for some reason, it's not.
And all those levers are held right there.
But this guy's hitting on the bottom.
So...
If you were to put a picking wire in here, you can actually start picking this lock.
But unfortunately, nothing's moving, because that fence is stuck at the bottom there.
So, I started taking measurements, and I realized eventually, that if I took the lowest possible, or the smallest possible wiper insert, and inserted it here, in between the wards there,
that, plus the picking wire, was about just the right height to hold those levers at that same zero spot where the tensioner was holding them before.
So, what I figured out at this point, was that I can actually tension the lock, then insert a picking wire,
and if I just hit the couple levers that are holding the fence back, I get to that spot where I want to be.
Now granted, it is a balancing act, and that blocker will lock in a lot, so it takes a lot of resets.
And if you're ever trying to pick this thing, do not be afraid to start over, because you have to start over a lot.
But eventually, you'll start to learn which levers to pick first, and once you realize that, you can actually go about picking this thing.
So, if you see that, the levers are sitting at the very bottom of the blocker there, holding it back just enough.
So, let's go in and find the lever that the fence is stuck on, get it out of the way, so the fence will then engage, but the blocker is still being held back.
We're then going to find a couple of the levers, and you actually want to try to pick the very tallest levers first, to get them out of your way.
Oops, lever wrong. So, if you ever hit a wrong lever, you'll have to restart.
And that's okay, like I said, it's going to happen a lot.
So, just feel around in there for a binder.
There we go, find the binder.
Oop, blocker engaged again.
So, I'm probably not going to be able to do this live on video, or not quite live, but on this video here, without some practice, I haven't picked one of these in quite a while.
But, I don't know, maybe I'll get lucky.
Oops, dropped the actuator there. That's what happens when your lock's not fully put together.
Alright, now I'm determined.
I'm going too high back there.
Maybe not.
There we go.
Alright, so, there it was.
I hope that was easy enough for everyone to see.
But, yeah, so it is possible.
That was a full pick, granted with a clear face, so it's not that impressive, of the Western Electric 30C.
So, hopefully, we'll get some more people out there picking these things.
Yeah, I hope everybody enjoyed that greatly.
So, at the end of this, I'm actually going to attach the video where I pick this lock, without the cover taken off, fully factory sealed, with that same method.
So you can see what it looks like without an acrylic cover on it.
But, anyway, yeah, there we are.
If anyone has any questions or anything, just...
I've been here the whole time, so I'm sure you'll have asked them, but feel free to get a hold of me.
I'm on Discord. The Lockpickers United Discord is nothing.
I have a YouTube channel, which is a nothing symbol.
If you search Western Electric 30C, you can find me.
And I'm here. If anyone wants my email address, it's mr.nothingpicks at gmail.com.
Reach out to me if you have any questions. If you're stuck, I will gladly help anyone through this.
So, alright, there we are. Thanks a lot, all.
I hope you all enjoyed DEF CON, and stay safe out there.
Take care. Bye.
Alright, hey everyone. Hope you're all doing well.
So, I have another Western Electric 30C here.
This one has not been taken apart yet.
All the rivets are still intact.
It is just like I received it.
I do have a key for it.
It's got some pretty extreme bidding.
It's got a zero cut right there in the two position.
Five cut back there.
That number four is a one cut.
It's annoying trying to set those levers without oversetting anything else or bumping anything else. Whatever.
But, it works sometimes.
I think one of those zero cut lever jumps up if I move the key too fast.
And you can see the blocker, if you look in that corner, moving in and out.
So, that's still there.
Yeah, so, let me see if I can get this thing open here.
Alright, so, I kind of developed a new technique that doesn't involve that third tool.
Just a picking wire and a tensioner.
Kind of doing a lot of trial and error on these things and research and what not.
Hoping to get something pretty comprehensive put together at some point.
You are going to see me reset a lot.
Because, if I do anything wrong, I have to completely start over.
Yes!
Hell yeah!
Alright, there it is.
Oh man!
Yes!
Oh, I'm so happy.
Oh, I'm so excited right now.
Alright, so, yeah, since it's not taken apart, I can't really gut it for you.
But, I guess I can at least kind of give you a 360 again.
Let me drop this out of the way first.
Alright, so, there it is, picked open.
Oh, I'm so happy.
Alright, now over here.
Let's see if we can get this image of the blocker coming back out.
There it is.
Alright all.
Western Electric 30C.
Picked.
Alright, have a great one. Take care all.