1
00:00:01,490 --> 00:00:04,210
Hey everyone, hope y'all are doing well.

2
00:00:04,210 --> 00:00:06,810
Hope everyone's staying safe out there.

3
00:00:07,230 --> 00:00:12,170
And welcome back to DEF CON Safe Mode.

4
00:00:13,370 --> 00:00:15,010
I'm nothing.

5
00:00:15,550 --> 00:00:21,670
And yeah, so I'm gonna be doing a video here.

6
00:00:21,730 --> 00:00:25,950
This is pre-recorded, but I am gonna be sitting there live with you.

7
00:00:26,170 --> 00:00:38,650
And this is gonna be going over the infamous Western Electric 30C and how I was actually able to defeat this thing.

8
00:00:40,770 --> 00:00:46,350
So, start off kind of slow for those of you who don't know anything about this lock.

9
00:00:47,590 --> 00:00:51,390
And I'm actually gonna start off talking about both of these here.

10
00:00:51,850 --> 00:01:06,850
So these locks are the result of a lot of research and development from the Western Electric Company to solve the problem of payphones.

11
00:01:06,930 --> 00:01:09,750
So these are payphone locks.

12
00:01:10,130 --> 00:01:22,330
And these were put into place during a time where people were not huge fans of the phone companies and paying for phone calls and things like that.

13
00:01:23,430 --> 00:01:49,420
So these locks were, there was a lot of money that went into the research and development of these, and they were designed to be very resilient to everything from vandalism, to weather and just all around wear and tear, and also to surreptitious entry and manipulation.

14
00:01:50,880 --> 00:02:03,260
So these locks were designed, there were a few before these, and the original patent that I'm aware of was released in 1966.

15
00:02:05,900 --> 00:02:16,960
And the original patent covered many aspects of these locks, but there's some things in the patent that weren't on these, and there's some things on these that weren't in the patent.

16
00:02:17,860 --> 00:02:22,700
So this first one you see here is the Western Electric 29A.

17
00:02:23,500 --> 00:02:28,300
And this is the lock that would protect the electronics of the payphone.

18
00:02:28,600 --> 00:02:39,540
It went in the upper portion and secured the upper housing of the payphone where all the electronic elements were.

19
00:02:40,240 --> 00:02:44,000
This is a five lever tumbler lock.

20
00:02:46,800 --> 00:02:54,780
This is actually unsprung, which means that the levers do not have a spring that will return them to their zero position.

21
00:02:56,940 --> 00:03:09,640
And instead, when you turn the key back, there is a portion on the actuator that pushes on the lower part of the levers, which returns them all to the zero position.

22
00:03:11,060 --> 00:03:35,780
And like I said, this has five levers, but this big gap you see in the key here is a stationary ward that goes in between the front two levers and the rear three levers, which makes it so that if you were to try to reproduce a key, you would have to have that gap to fit through there.

23
00:03:35,940 --> 00:03:39,660
And also in picking, this sits down pretty low.

24
00:03:39,660 --> 00:03:43,020
It makes it very difficult to get a picking wire behind it.

25
00:03:44,020 --> 00:03:48,620
So it definitely makes opening this lock without the key pretty difficult.

26
00:03:49,500 --> 00:03:55,160
Now, all the levers in here had false gates as well as true gates, of course, or else it wouldn't open.

27
00:03:57,980 --> 00:04:04,420
And actually here, I have one here that has an acrylic face on it.

28
00:04:05,040 --> 00:04:07,420
So as you can see, there's no springs.

29
00:04:07,700 --> 00:04:12,480
You can't see much because of this copper plate here that guards the levers.

30
00:04:13,020 --> 00:04:22,100
But what you can see is when I turn the key, you can see all of those levers line up.

31
00:04:22,440 --> 00:04:27,540
And that silver part that you see in there is the stationary ward.

32
00:04:28,060 --> 00:04:37,780
So the fence also has a cutout to go past that ward and be able to open up.

33
00:04:39,900 --> 00:04:44,120
Now, this is a part of the payphone, but I'm not gonna be spending a whole lot of time on this tonight.

34
00:04:44,120 --> 00:04:52,020
I just wanted to kind of give you a quick overview of this one so that you'd know the differences between this and the 30C.

35
00:04:54,280 --> 00:05:01,940
So the 30C is actually a lock with a pretty interesting history behind it.

36
00:05:04,160 --> 00:05:09,100
This lock was considered unpickable for a very long time.

37
00:05:11,320 --> 00:05:32,200
And it was considered impossible to manipulate open until a man named James Clark figured out a way to get into it and went across the country back in the 1980s, stealing over half a million dollars in coins from payphones.

38
00:05:32,960 --> 00:05:36,840
And he evaded the police by basically

39
00:05:40,000 --> 00:05:45,180
by continuously moving, not really following any patterns.

40
00:05:45,180 --> 00:05:47,820
There were a couple of little patterns that he followed.

41
00:05:47,960 --> 00:05:57,120
He would mainly hit large sporting events, casinos, places where a lot of people would be there and a lot of people would be using the phone.

42
00:05:57,880 --> 00:06:01,680
And apparently he would just go into the booth, pretend to make a phone call.

43
00:06:01,680 --> 00:06:08,760
And while he was sitting there on the phone, he would manipulate the box open, steal the coins, lock it back up and leave.

44
00:06:10,080 --> 00:06:13,720
And nobody knows how he actually got into these things.

45
00:06:13,740 --> 00:06:17,100
He was on America's Most Wanted twice.

46
00:06:17,560 --> 00:06:26,200
He was called in the newspapers, everything from the Payphone Bandit, the Telephone Bandit, the Coinbox Bandit.

47
00:06:26,420 --> 00:06:32,380
I've heard some people actually call him the Phone Ranger, though I've never seen that in print anywhere.

48
00:06:33,400 --> 00:06:35,340
And I looked a lot.

49
00:06:35,340 --> 00:06:40,920
Honestly, all I found on the Phone Ranger was a crappy old comic book character.

50
00:06:41,080 --> 00:06:42,640
It was pretty funny.

51
00:06:43,600 --> 00:06:48,000
But anyway, he is pretty well known as the Phone Ranger among the community.

52
00:06:51,060 --> 00:07:00,120
But no one was ever, even though he was captured with his tools and actually while he was working on one of these, excuse me, I'm gonna have a sip of whiskey real quick.

53
00:07:09,770 --> 00:07:12,690
No one ever actually was able to figure out how he did it.

54
00:07:15,430 --> 00:07:16,050
Um...

55
00:07:18,580 --> 00:07:22,040
Now, the Bell Company, um...

56
00:07:25,540 --> 00:07:34,700
hired retired FBI agents and spent a pretty good amount of money trying to figure out how he was able to get into these locks.

57
00:07:35,500 --> 00:07:40,110
And to my knowledge, they never made any progress up to that point.

58
00:07:41,500 --> 00:07:50,860
Um, so they spent quite a long time These locks are from the single-slot Fortress payphone.

59
00:07:52,340 --> 00:07:57,420
And they were in service for, I think, around 50 years.

60
00:07:58,540 --> 00:08:01,880
Altogether, well, 50 years ago from now, I think they were possibly...

61
00:08:02,440 --> 00:08:03,960
Some of them are still used.

62
00:08:03,960 --> 00:08:09,560
They are still in places, but very rarely, as we all know how rarely payphones are actually used these days.

63
00:08:10,800 --> 00:08:23,200
But they were continuously in service for, I think, about 30 years or so, and previous models to this went back quite a bit further than that.

64
00:08:25,520 --> 00:08:30,120
But anyway, he was ultimately arrested in 1988.

65
00:08:33,100 --> 00:08:39,920
They said he was identifiable by a ponytail, a baseball cap, and I think cowboy boots.

66
00:08:40,060 --> 00:08:47,300
And he was caught in a payphone playing with a lock or in a phone booth playing with a lock.

67
00:08:48,240 --> 00:08:51,720
But anyway, so I hadn't heard about that story.

68
00:08:52,180 --> 00:09:10,060
And the first time I heard about this lock, well, not the very first time, but the first time I got interested in it was when Matt Smith, also known as Huxley Pig, did a video, he did a talk, and I saw the recorded talk on video

69
00:09:13,640 --> 00:09:18,420
about a few really cool locks that he had been working on.

70
00:09:18,900 --> 00:09:20,400
And this was one of them.

71
00:09:21,280 --> 00:09:29,200
And he had actually made a little bit of progress on how to go about beginning to pick this.

72
00:09:31,020 --> 00:09:37,800
He was still working on it, and he said he had spent a lot of time and effort in trying to figure it out.

73
00:09:38,840 --> 00:09:42,180
And that kind of made me start to think about this lock.

74
00:09:42,180 --> 00:09:44,600
As in, kind of a goal.

75
00:09:48,340 --> 00:09:53,420
Just basically just thinking about how cool it would be if I could be the one that actually figured it out.

76
00:09:54,400 --> 00:09:58,100
And so I went online, I searched a couple of articles.

77
00:09:58,500 --> 00:10:01,660
Matt Blaze has an amazing article on these locks.

78
00:10:02,420 --> 00:10:06,420
There's also a little bit of information on a couple of the lock picking forums.

79
00:10:07,240 --> 00:10:27,010
But it wasn't until Captain Hook released a video on Lock Pickers United about a decoding method to get into this lock to be able to go in there, figure out the key bitting, and replicate a key to open this thing.

80
00:10:27,940 --> 00:10:48,580
So with a set of wires similar to this, with very precise measurements, and little 90 degree turns on the ends, he was able to go in there and exploit the fact that returning the key to the zero position would also return all the levers to the zero position.

81
00:10:49,240 --> 00:10:56,780
And there was a finite and an exact measurement between the keyway and the gates and the levers.

82
00:10:57,900 --> 00:11:14,380
And since he was able to fit a piece of wire in there, he was then able to determine where the gates were, true and false, and was able to replicate and duplicate a key, make his own key, and open the lock from there.

83
00:11:15,300 --> 00:11:20,580
So when I saw that video, it kind of kicked me in the butt.

84
00:11:20,920 --> 00:11:26,160
And I thought, oh man, if I'm going to do this, I better get started.

85
00:11:26,160 --> 00:11:32,000
So that day, I went on eBay, found one of these, and ordered it.

86
00:11:32,940 --> 00:11:40,940
And it arrived a few days later, I started messing with it, and figured out why everybody had such a hard time with it.

87
00:11:40,940 --> 00:11:44,100
This thing is an incredible pain.

88
00:11:44,780 --> 00:11:48,760
But the first thing I did was...

89
00:11:52,160 --> 00:11:54,460
Actually, I think... yeah.

90
00:11:54,460 --> 00:11:58,680
I think the first thing I did was create an acrylic faceplate for it.

91
00:11:58,880 --> 00:12:01,060
So that I could see inside.

92
00:12:01,680 --> 00:12:04,640
So basically I knew what I was dealing with.

93
00:12:05,520 --> 00:12:09,280
So now this is the 30C here with an acrylic faceplate.

94
00:12:09,680 --> 00:12:12,540
And you can see a couple differences from the 29A.

95
00:12:12,540 --> 00:12:14,720
This one actually does have a spring.

96
00:12:15,180 --> 00:12:19,680
There's a single leaf spring here that puts tension on all the levers.

97
00:12:20,540 --> 00:12:29,800
If you raise one lever up, it lifts this spring, and basically eliminates spring tension from the rest of the levers, so they are free-floating.

98
00:12:31,440 --> 00:12:35,100
This one does not have that stationary ward in the center.

99
00:12:37,000 --> 00:12:43,320
But everything else is pretty much the same as the 29, besides this mechanism right here.

100
00:12:43,520 --> 00:12:46,420
And this is what makes this lock so tough.

101
00:12:47,060 --> 00:12:49,060
This is the tumbler blocker.

102
00:12:50,260 --> 00:13:12,760
And what this does, is this serrated piece here, along with the points on the levers, makes it so that as soon as you put tension on this thing, that blocker moves into place and locks all the levers into place before the fence even gets to the levers.

103
00:13:14,380 --> 00:13:19,660
So in picking a lock, what we do is we put tension on the lock.

104
00:13:20,140 --> 00:13:28,480
And after you put tension on it, you manipulate the internals, and you can feel, say, on a lever lock, the fence rubbing on the levers.

105
00:13:28,480 --> 00:13:31,740
So you'll know when you set a lever when it clicks into place.

106
00:13:32,540 --> 00:13:41,000
Well, on this one, before you can even put tension on it, that blocker moves in and stops all those levers from being able to move.

107
00:13:42,020 --> 00:13:48,900
You can see here, that blocker's already engaged, but the fence is super far away from the gates.

108
00:13:50,240 --> 00:13:54,100
Now that is for a couple different reasons they did that.

109
00:13:54,380 --> 00:13:58,500
Obviously one being pick resistance and manipulation resistance.

110
00:13:58,560 --> 00:14:03,420
But also another being lack of maintenance.

111
00:14:04,000 --> 00:14:10,780
Some of these were in very remote areas where the weather and the environment was not very friendly.

112
00:14:11,340 --> 00:14:30,100
So if you got a lot of dirt and gunk and other things in this lock or if there was a lot of key wear, things like that, as soon as you put the key in and it raises the levers up to an approximate height, that blocker will lock them all into place and make sure that they're at the right height for the fence to move into the gates.

113
00:14:31,480 --> 00:14:41,040
So that design was both for manipulation resistance but also for longevity of the lock and to allow it to work in some very harsh conditions.

114
00:14:42,900 --> 00:14:46,400
So that's what makes it so tough to pick is that blocker there.

115
00:14:47,360 --> 00:14:54,120
Now the very first time I picked this lock what I did was I bypassed that blocker.

116
00:14:54,500 --> 00:14:58,080
There's a video of it online, it was the first video that I posted of this lock

117
00:15:01,410 --> 00:15:08,730
and I took a shim like this, actually this is the one inserted it in the top

118
00:15:11,850 --> 00:15:26,190
and you gotta get it under the anti-tamper switch which I'll show you a little later and that can actually hold the blocker back so that I could go in there and manipulate the levers and see what it felt like to actually pick this thing.

119
00:15:27,610 --> 00:16:09,970
So once I did that I posted a video online to basically show my progress, show that I had actually picked the lock which at the time it was a world's first nobody had picked one of these on camera before even using a shim to bypass the blocker so it was a first but it wasn't the first that I was looking for but after posting that video I got quite a bit of response from people Captain Hook being one of them and I talked to him a bit about this lock and got some tips,

120
00:16:09,970 --> 00:16:50,030
we exchanged a couple little here and theres about the lock and got to talking, Captain Hook is an amazing person great picker, one of the best in the world and I didn't want to give too much away but I mentioned that I had been working on a method of picking it that was entirely through the keyway which is what we're looking for So the first thing I did was I took his idea of using bent wires to find the gates and I thought,

121
00:16:50,030 --> 00:17:50,730
well what if instead of identifying the gates one at a time what if I took a wire and bent it in a way that I could insert it in the lock, in the keyway and put pressure on all those levers at once I could then pick them one at a time and get the wire to go into all the true gates which would set the levers all to the correct height and I could then turn the bolt and open the lock Now this kind of worked I was actually able to get all the levers set onto the wire but when it came time to actually throw the bolt and open the lock that's where I ran into some issues It's kind of a chunky wire and there's not a lot of room to work in there So,

122
00:17:50,730 --> 00:17:54,170
it got in the way, unfortunately.

123
00:17:54,250 --> 00:18:04,710
So when I went to throw the bolt, the fence got stuck on the wire and would not move enough to actually open the lock, unfortunately.

124
00:18:05,090 --> 00:18:08,570
I spent a lot of time trying to perfect this wire method.

125
00:18:09,110 --> 00:18:18,070
That's all the scratches you see inside here, was me working on the wire, trying to get it in there perfectly and get everything to work.

126
00:18:18,070 --> 00:18:20,050
I experimented with a lot of different ways.

127
00:18:20,050 --> 00:18:28,370
I tried to get all the levers set right, then put the bolt in a little bit, and then remove the wire and continue, but nothing was working.

128
00:18:29,730 --> 00:18:37,150
I mean, it was a good idea, but it ultimately failed, unfortunately.

129
00:18:40,130 --> 00:18:45,250
So, well, here's another one that I had made.

130
00:18:45,250 --> 00:18:51,410
This is a much flatter wire that I thought might work.

131
00:18:51,410 --> 00:18:53,350
It's a much weaker, much flatter wire.

132
00:18:53,350 --> 00:19:01,650
I figured if I could do that, maybe I could just force the bolt through the wire, bend it out of the way, but at least the lock would be open, but that didn't work either.

133
00:19:04,450 --> 00:19:24,470
So I started thinking about Matt, HuxleyPig's video again, and he had come up with an idea where he would overlift one of the levers up to the point where it would hold the blocker back from the top.

134
00:19:25,090 --> 00:19:31,070
So I don't know if I can get this in here to show you how this would work, but let's see.

135
00:19:32,850 --> 00:19:38,690
So if you lift... oh, wait a minute, I've got to turn the key way.

136
00:19:40,650 --> 00:19:42,490
Get that out of the way.

137
00:19:47,550 --> 00:19:54,850
So if you lift up on one of the levers, and you lift it past where it's supposed to go...

138
00:19:54,850 --> 00:19:58,990
whoops, I don't think I can do this without actually turning the key.

139
00:20:00,010 --> 00:20:01,130
Meh.

140
00:20:02,710 --> 00:20:13,670
But you can get it overlifted to where it will actually get stuck up here and hold the blocker back, and I think you're actually deforming the lever at that point.

141
00:20:13,670 --> 00:20:16,110
It's really tough to get it up there.

142
00:20:17,550 --> 00:20:38,210
But it was an interesting idea, and it made me think about instead of trying to align the gates using a wire or anything like that, maybe I could use the levers to hold the blocker back, but in a different way.

143
00:20:39,450 --> 00:20:49,310
And one day I was driving, I was driving at work and talking to Captain Hook, and I had an idea.

144
00:20:49,310 --> 00:20:56,590
And I had to wait all day, it was super hard to wait to not leave work early or run home and try it.

145
00:20:56,850 --> 00:21:01,530
But I had an idea on what I could possibly do.

146
00:21:01,830 --> 00:21:21,550
So what I thought was if I could hold one of the levers up so that the point of the lever would sit at the point of one of these serrations, it might hold that blocker back just enough to where I could pick the levers past the blocker.

147
00:21:21,610 --> 00:21:32,030
Now I'd still have to deal with the blocker, they'd still be clicking in these little serrations, but it might be just enough to where it wouldn't be fully engaged and I could actually pick the lock.

148
00:21:33,290 --> 00:21:39,470
So I started work, as soon as I got home I started working on creating something that would make this happen.

149
00:21:42,750 --> 00:21:47,390
And ultimately, I created this.

150
00:21:49,110 --> 00:21:53,970
Just this little flag tool here, it's got some warding cut into it there.

151
00:21:55,190 --> 00:21:56,470
And what this does...

152
00:21:57,650 --> 00:21:59,350
Ah, where's that tension wrench?

153
00:21:59,350 --> 00:22:00,090
Here it is.

154
00:22:00,090 --> 00:22:10,810
Alright, so what this does is you actually insert this right into that first piece of warding, all the way back and sit it into the actuator.

155
00:22:15,020 --> 00:22:20,220
And when it's sitting there, you then tension the lock,

156
00:22:23,390 --> 00:22:26,070
and that little flag in the back...

157
00:22:26,690 --> 00:22:31,110
I don't know if you can see that, let's try to get some better light here...

158
00:22:38,300 --> 00:22:43,400
So that rear lever is sticking up just a little bit more than the rest of them.

159
00:22:43,400 --> 00:22:44,900
Can you see that back there?

160
00:22:48,330 --> 00:22:50,130
Yeah, I think you can see that.

161
00:22:50,490 --> 00:22:53,550
So that is actually holding that blocker back.

162
00:22:55,290 --> 00:22:58,370
And what I was able to do at that point...

163
00:22:59,810 --> 00:23:02,230
was get a picking wire in there.

164
00:23:02,290 --> 00:23:05,030
And actually I started with the picking wire in there.

165
00:23:05,390 --> 00:23:08,250
But it would hold the blocker just enough...

166
00:23:08,890 --> 00:23:12,250
that I was actually able to put tension on the lock...

167
00:23:13,270 --> 00:23:14,910
and move the levers.

168
00:23:16,210 --> 00:23:19,950
And that was actually the very first way that I ever picked this lock open.

169
00:23:20,310 --> 00:23:21,570
And it worked!

170
00:23:21,830 --> 00:23:23,330
It actually worked.

171
00:23:23,830 --> 00:23:26,190
There's a couple videos of it online.

172
00:23:27,470 --> 00:23:31,670
The first one got a lot of scrutiny, of course, because it was a world's first.

173
00:23:32,310 --> 00:23:41,950
There was a little piece of wire sitting on my desk that people thought was some sort of a shim to hold the blocker back, or they had all sorts of crazy ideas.

174
00:23:41,950 --> 00:23:46,590
But as soon as that happened, I immediately did another video with a clean desk...

175
00:23:46,590 --> 00:23:52,050
and made sure that there was no possible way whatsoever that it was not real.

176
00:23:53,910 --> 00:23:57,170
But that was the very first way that I picked this thing open.

177
00:23:57,170 --> 00:23:58,870
And I was super happy.

178
00:23:58,870 --> 00:24:00,390
I couldn't believe it.

179
00:24:00,590 --> 00:24:03,950
I was just out of this world ecstatic.

180
00:24:03,950 --> 00:24:05,050
It was incredible.

181
00:24:05,050 --> 00:24:06,330
It was so great.

182
00:24:10,390 --> 00:24:15,730
But in thinking about it, it wasn't the easiest thing in the world.

183
00:24:15,730 --> 00:24:18,060
It's a very delicate balancing act.

184
00:24:18,650 --> 00:24:24,050
And I wanted to make it even better.

185
00:24:25,440 --> 00:24:38,810
So with this, this was designed to hold the blocker just below that last lever's true gate.

186
00:24:39,810 --> 00:24:42,870
So that 8th lever would be the last one that I picked.

187
00:24:44,190 --> 00:24:50,370
And when I picked it, it would be the last one, and I only had to go one click to get it into its true gate.

188
00:24:50,950 --> 00:24:57,830
And I think, I'm pretty sure, that this one tool probably would have worked for any other lock...

189
00:24:57,830 --> 00:25:01,250
unless that 8th lever was a zero cut.

190
00:25:01,370 --> 00:25:02,650
If it was lower.

191
00:25:03,570 --> 00:25:06,810
Anything higher, you could have shot it up into place.

192
00:25:06,810 --> 00:25:09,790
It wouldn't have been easy, but it would have been doable.

193
00:25:11,190 --> 00:25:12,810
But, um...

194
00:25:14,090 --> 00:25:17,650
If it was a zero cut, it would already be sitting too high.

195
00:25:17,790 --> 00:25:20,530
And you'd have to hope that you could get it to drop down.

196
00:25:32,650 --> 00:25:33,410
Sorry.

197
00:25:33,410 --> 00:25:34,690
Went in my whistle again.

198
00:25:41,700 --> 00:25:49,240
So then I had the idea of, what if I can hold all the levers up to the right height?

199
00:25:51,040 --> 00:25:55,900
What if I can make all the levers hold that blocker back?

200
00:25:55,900 --> 00:25:59,940
So it didn't matter which one I picked, when, what the binding order was.

201
00:26:01,480 --> 00:26:02,000
And...

202
00:26:02,000 --> 00:26:04,720
So I started making tension wrenches.

203
00:26:05,720 --> 00:26:11,300
I designed a bunch of different tensioners that would go in and hold the levers up to different heights.

204
00:26:12,420 --> 00:26:13,440
And, um...

205
00:26:14,800 --> 00:26:17,900
There was all slight problems with it.

206
00:26:17,900 --> 00:26:24,820
You know, it was hard to get a wire in there and keep holding everything, and it was still a very delicate balancing act.

207
00:26:24,980 --> 00:26:26,280
Don't get me wrong.

208
00:26:26,600 --> 00:26:43,460
But ultimately, what I figured out was that a thin wiper insert was exactly the right height to go in there, in that first ward, and hold those levers up to the exact point where they need to be to hold that blocker back.

209
00:26:45,600 --> 00:26:48,300
And you can actually pick the lock like this too.

210
00:26:49,300 --> 00:26:51,120
Now again, it's difficult.

211
00:26:52,180 --> 00:26:54,840
Because there's not a whole lot of room to work.

212
00:26:56,120 --> 00:26:59,160
But it does hold all the levers up to where you need them.

213
00:27:00,800 --> 00:27:03,300
And you can go in and pick.

214
00:27:03,320 --> 00:27:04,660
It's possible.

215
00:27:09,040 --> 00:27:11,580
But again, that wasn't good enough.

216
00:27:11,940 --> 00:27:13,660
It wasn't easy enough.

217
00:27:17,520 --> 00:27:18,060
So...

218
00:27:19,640 --> 00:27:21,320
I started, um...

219
00:27:23,020 --> 00:27:28,920
I basically just started kind of playing with the lock, and looking at what happened when I did different things.

220
00:27:30,040 --> 00:27:34,300
So I started looking at what would happen if I just tensioned it, right?

221
00:27:34,520 --> 00:27:43,980
So you just tension it, and I finally noticed, if you look here, when you tension this thing, the blocker's not engaged.

222
00:27:44,920 --> 00:27:48,760
It's sitting point to point with one of these levers.

223
00:27:49,480 --> 00:27:53,260
But also, that bolt isn't engaged either.

224
00:27:54,900 --> 00:28:00,140
The bottom of the fence here is actually hitting the bottom of the levers.

225
00:28:04,130 --> 00:28:09,330
So, this lock starts in a very interesting configuration here.

226
00:28:09,330 --> 00:28:16,230
I mean, you'd think that the blocker would engage, hold all the levers at zero, this would have no room to go in, things like that.

227
00:28:16,230 --> 00:28:18,790
But for some reason, it's not.

228
00:28:20,230 --> 00:28:23,670
And all those levers are held right there.

229
00:28:24,350 --> 00:28:27,330
But this guy's hitting on the bottom.

230
00:28:30,230 --> 00:28:30,710
So...

231
00:28:32,270 --> 00:28:41,150
If you were to put a picking wire in here, you can actually start picking this lock.

232
00:28:41,670 --> 00:28:47,650
But unfortunately, nothing's moving, because that fence is stuck at the bottom there.

233
00:28:51,890 --> 00:29:24,000
So, I started taking measurements, and I realized eventually, that if I took the lowest possible, or the smallest possible wiper insert, and inserted it here, in between the wards there, that, plus the picking wire, was about just the right height to hold those levers at that same zero spot where the tensioner was holding them before.

234
00:29:26,920 --> 00:29:59,180
So, what I figured out at this point, was that I can actually tension the lock, then insert a picking wire, and if I just hit the couple levers that are holding the fence back, I get to that spot where I want to be.

235
00:30:02,630 --> 00:30:13,990
Now granted, it is a balancing act, and that blocker will lock in a lot, so it takes a lot of resets.

236
00:30:13,990 --> 00:30:20,330
And if you're ever trying to pick this thing, do not be afraid to start over, because you have to start over a lot.

237
00:30:21,110 --> 00:30:25,290
But eventually, you'll start to learn which levers to pick first,

238
00:30:37,030 --> 00:30:45,360
and once you realize that, you can actually go about picking this thing.

239
00:30:53,380 --> 00:30:59,600
So, if you see that, the levers are sitting at the very bottom of the blocker there, holding it back just enough.

240
00:31:01,260 --> 00:31:11,960
So, let's go in and find the lever that the fence is stuck on, get it out of the way, so the fence will then engage, but the blocker is still being held back.

241
00:31:15,320 --> 00:31:27,020
We're then going to find a couple of the levers, and you actually want to try to pick the very tallest levers first, to get them out of your way.

242
00:31:30,720 --> 00:31:32,700
Oops, lever wrong.

243
00:31:32,700 --> 00:31:35,620
So, if you ever hit a wrong lever, you'll have to restart.

244
00:31:36,320 --> 00:31:39,180
And that's okay, like I said, it's going to happen a lot.

245
00:31:56,760 --> 00:31:59,200
So, just feel around in there for a binder.

246
00:31:59,820 --> 00:32:01,800
There we go, find the binder.

247
00:32:06,640 --> 00:32:08,760
Oop, blocker engaged again.

248
00:32:15,370 --> 00:32:24,570
So, I'm probably not going to be able to do this live on video, or not quite live, but on this video here, without some practice, I haven't picked one of these in quite a while.

249
00:32:27,930 --> 00:32:28,330
But

250
00:32:33,160 --> 00:32:35,800
, I don't know, maybe I'll get lucky.

251
00:32:43,890 --> 00:32:46,270
Oops, dropped the actuator there.

252
00:32:46,650 --> 00:32:49,450
That's what happens when your lock's not fully put together.

253
00:34:03,420 --> 00:34:05,040
Alright, now I'm determined.

254
00:35:11,780 --> 00:35:15,520
I'm going too high back there.

255
00:35:16,620 --> 00:35:18,320
Maybe not.

256
00:35:21,470 --> 00:35:23,110
There we go.

257
00:35:23,770 --> 00:35:27,090
Alright, so, there it was.

258
00:35:28,350 --> 00:35:33,290
I hope that was easy enough for everyone to see.

259
00:35:35,930 --> 00:35:38,790
But, yeah, so it is possible.

260
00:35:40,050 --> 00:35:50,690
That was a full pick, granted with a clear face, so it's not that impressive, of the Western Electric 30C.

261
00:35:51,810 --> 00:35:56,830
So, hopefully, we'll get some more people out there picking these things.

262
00:36:01,070 --> 00:36:05,650
Yeah, I hope everybody enjoyed that greatly.

263
00:36:06,470 --> 00:36:22,090
So, at the end of this, I'm actually going to attach the video where I pick this lock, without the cover taken off, fully factory sealed, with that same method.

264
00:36:24,350 --> 00:36:30,430
So you can see what it looks like without an acrylic cover on it.

265
00:36:30,790 --> 00:36:33,890
But, anyway, yeah, there we are.

266
00:36:34,450 --> 00:36:37,890
If anyone has any questions or anything, just...

267
00:36:38,990 --> 00:36:44,890
I've been here the whole time, so I'm sure you'll have asked them, but feel free to get a hold of me.

268
00:36:45,830 --> 00:36:47,790
I'm on Discord.

269
00:36:47,790 --> 00:36:50,250
The Lockpickers United Discord is nothing.

270
00:36:50,250 --> 00:36:53,570
I have a YouTube channel, which is a nothing symbol.

271
00:36:53,870 --> 00:36:57,530
If you search Western Electric 30C, you can find me.

272
00:37:00,810 --> 00:37:02,270
And I'm here.

273
00:37:02,270 --> 00:37:08,730
If anyone wants my email address, it's mr.nothingpicks at gmail.com.

274
00:37:08,750 --> 00:37:10,490
Reach out to me if you have any questions.

275
00:37:10,490 --> 00:37:15,330
If you're stuck, I will gladly help anyone through this.

276
00:37:15,930 --> 00:37:18,130
So, alright, there we are.

277
00:37:18,190 --> 00:37:19,330
Thanks a lot, all.

278
00:37:19,690 --> 00:37:24,190
I hope you all enjoyed DEF CON, and stay safe out there.

279
00:37:24,410 --> 00:37:25,210
Take care.

280
00:37:25,210 --> 00:37:25,810
Bye.

281
00:37:28,070 --> 00:37:29,910
Alright, hey everyone.

282
00:37:29,910 --> 00:37:31,670
Hope you're all doing well.

283
00:37:32,610 --> 00:37:39,010
So, I have another Western Electric 30C here.

284
00:37:39,950 --> 00:37:43,170
This one has not been taken apart yet.

285
00:37:43,470 --> 00:37:45,810
All the rivets are still intact.

286
00:37:46,690 --> 00:37:50,390
It is just like I received it.

287
00:37:50,890 --> 00:37:53,570
I do have a key for it.

288
00:37:53,770 --> 00:37:56,810
It's got some pretty extreme bidding.

289
00:37:57,770 --> 00:38:01,270
It's got a zero cut right there in the two position.

290
00:38:01,590 --> 00:38:03,970
Five cut back there.

291
00:38:04,290 --> 00:38:06,650
That number four is a one cut.

292
00:38:06,650 --> 00:38:12,710
It's annoying trying to set those levers without oversetting anything else or bumping anything else.

293
00:38:12,710 --> 00:38:13,470
Whatever.

294
00:38:14,010 --> 00:38:17,650
But, it works sometimes.

295
00:38:17,650 --> 00:38:22,010
I think one of those zero cut lever jumps up if I move the key too fast.

296
00:38:22,670 --> 00:38:27,510
And you can see the blocker, if you look in that corner, moving in and out.

297
00:38:30,610 --> 00:38:33,350
So, that's still there.

298
00:38:36,350 --> 00:38:45,350
Yeah, so, let me see if I can get this thing open here.

299
00:38:53,700 --> 00:39:02,060
Alright, so, I kind of developed a new technique that doesn't involve that third tool.

300
00:39:02,060 --> 00:39:05,360
Just a picking wire and a tensioner.

301
00:39:08,140 --> 00:39:14,160
Kind of doing a lot of trial and error on these things and research and what not.

302
00:39:14,280 --> 00:39:20,700
Hoping to get something pretty comprehensive put together at some point.

303
00:39:31,520 --> 00:39:34,620
You are going to see me reset a lot.

304
00:39:34,960 --> 00:39:40,480
Because, if I do anything wrong, I have to completely start over.

305
00:46:55,640 --> 00:46:57,120
Yes!

306
00:46:57,580 --> 00:46:59,220
Hell yeah!

307
00:46:59,880 --> 00:47:02,160
Alright, there it is.

308
00:47:02,640 --> 00:47:03,820
Oh man!

309
00:47:04,720 --> 00:47:06,180
Yes!

310
00:47:06,180 --> 00:47:07,430
Oh, I'm so happy.

311
00:47:07,780 --> 00:47:15,410
Oh, I'm so excited right now.

312
00:47:17,980 --> 00:47:28,240
Alright, so, yeah, since it's not taken apart, I can't really gut it for you.

313
00:47:28,240 --> 00:47:33,060
But, I guess I can at least kind of give you a 360 again.

314
00:47:33,620 --> 00:47:36,640
Let me drop this out of the way first.

315
00:47:41,560 --> 00:47:46,080
Alright, so, there it is, picked open.

316
00:47:52,890 --> 00:47:54,790
Oh, I'm so happy.

317
00:47:59,720 --> 00:48:02,100
Alright, now over here.

318
00:48:02,340 --> 00:48:08,660
Let's see if we can get this image of the blocker coming back out.

319
00:48:15,070 --> 00:48:16,810
There it is.

320
00:48:18,350 --> 00:48:19,990
Alright all.

321
00:48:20,790 --> 00:48:23,250
Western Electric 30C.

322
00:48:23,290 --> 00:48:24,650
Picked.

323
00:48:25,250 --> 00:48:27,690
Alright, have a great one.

324
00:48:27,690 --> 00:48:28,810
Take care all.