WEBVTT 00:01.490 --> 00:04.210 Hey everyone, hope y'all are doing well. 00:04.210 --> 00:06.810 Hope everyone's staying safe out there. 00:07.230 --> 00:12.170 And welcome back to DEF CON Safe Mode. 00:13.370 --> 00:15.010 I'm nothing. 00:15.550 --> 00:21.670 And yeah, so I'm gonna be doing a video here. 00:21.730 --> 00:25.950 This is pre-recorded, but I am gonna be sitting there live with you. 00:26.170 --> 00:38.650 And this is gonna be going over the infamous Western Electric 30C and how I was actually able to defeat this thing. 00:40.770 --> 00:46.350 So, start off kind of slow for those of you who don't know anything about this lock. 00:47.590 --> 00:51.390 And I'm actually gonna start off talking about both of these here. 00:51.850 --> 01:06.850 So these locks are the result of a lot of research and development from the Western Electric Company to solve the problem of payphones. 01:06.930 --> 01:09.750 So these are payphone locks. 01:10.130 --> 01:22.330 And these were put into place during a time where people were not huge fans of the phone companies and paying for phone calls and things like that. 01:23.430 --> 01:49.420 So these locks were, there was a lot of money that went into the research and development of these, and they were designed to be very resilient to everything from vandalism, to weather and just all around wear and tear, and also to surreptitious entry and manipulation. 01:50.880 --> 02:03.260 So these locks were designed, there were a few before these, and the original patent that I'm aware of was released in 1966. 02:05.900 --> 02:16.960 And the original patent covered many aspects of these locks, but there's some things in the patent that weren't on these, and there's some things on these that weren't in the patent. 02:17.860 --> 02:22.700 So this first one you see here is the Western Electric 29A. 02:23.500 --> 02:28.300 And this is the lock that would protect the electronics of the payphone. 02:28.600 --> 02:39.540 It went in the upper portion and secured the upper housing of the payphone where all the electronic elements were. 02:40.240 --> 02:44.000 This is a five lever tumbler lock. 02:46.800 --> 02:54.780 This is actually unsprung, which means that the levers do not have a spring that will return them to their zero position. 02:56.940 --> 03:09.640 And instead, when you turn the key back, there is a portion on the actuator that pushes on the lower part of the levers, which returns them all to the zero position. 03:11.060 --> 03:35.780 And like I said, this has five levers, but this big gap you see in the key here is a stationary ward that goes in between the front two levers and the rear three levers, which makes it so that if you were to try to reproduce a key, you would have to have that gap to fit through there. 03:35.940 --> 03:39.660 And also in picking, this sits down pretty low. 03:39.660 --> 03:43.020 It makes it very difficult to get a picking wire behind it. 03:44.020 --> 03:48.620 So it definitely makes opening this lock without the key pretty difficult. 03:49.500 --> 03:55.160 Now, all the levers in here had false gates as well as true gates, of course, or else it wouldn't open. 03:57.980 --> 04:04.420 And actually here, I have one here that has an acrylic face on it. 04:05.040 --> 04:07.420 So as you can see, there's no springs. 04:07.700 --> 04:12.480 You can't see much because of this copper plate here that guards the levers. 04:13.020 --> 04:22.100 But what you can see is when I turn the key, you can see all of those levers line up. 04:22.440 --> 04:27.540 And that silver part that you see in there is the stationary ward. 04:28.060 --> 04:37.780 So the fence also has a cutout to go past that ward and be able to open up. 04:39.900 --> 04:44.120 Now, this is a part of the payphone, but I'm not gonna be spending a whole lot of time on this tonight. 04:44.120 --> 04:52.020 I just wanted to kind of give you a quick overview of this one so that you'd know the differences between this and the 30C. 04:54.280 --> 05:01.940 So the 30C is actually a lock with a pretty interesting history behind it. 05:04.160 --> 05:09.100 This lock was considered unpickable for a very long time. 05:11.320 --> 05:32.200 And it was considered impossible to manipulate open until a man named James Clark figured out a way to get into it and went across the country back in the 1980s, stealing over half a million dollars in coins from payphones. 05:32.960 --> 05:36.840 And he evaded the police by basically 05:40.000 --> 05:45.180 by continuously moving, not really following any patterns. 05:45.180 --> 05:47.820 There were a couple of little patterns that he followed. 05:47.960 --> 05:57.120 He would mainly hit large sporting events, casinos, places where a lot of people would be there and a lot of people would be using the phone. 05:57.880 --> 06:01.680 And apparently he would just go into the booth, pretend to make a phone call. 06:01.680 --> 06:08.760 And while he was sitting there on the phone, he would manipulate the box open, steal the coins, lock it back up and leave. 06:10.080 --> 06:13.720 And nobody knows how he actually got into these things. 06:13.740 --> 06:17.100 He was on America's Most Wanted twice. 06:17.560 --> 06:26.200 He was called in the newspapers, everything from the Payphone Bandit, the Telephone Bandit, the Coinbox Bandit. 06:26.420 --> 06:32.380 I've heard some people actually call him the Phone Ranger, though I've never seen that in print anywhere. 06:33.400 --> 06:35.340 And I looked a lot. 06:35.340 --> 06:40.920 Honestly, all I found on the Phone Ranger was a crappy old comic book character. 06:41.080 --> 06:42.640 It was pretty funny. 06:43.600 --> 06:48.000 But anyway, he is pretty well known as the Phone Ranger among the community. 06:51.060 --> 07:00.120 But no one was ever, even though he was captured with his tools and actually while he was working on one of these, excuse me, I'm gonna have a sip of whiskey real quick. 07:09.770 --> 07:12.690 No one ever actually was able to figure out how he did it. 07:15.430 --> 07:16.050 Um... 07:18.580 --> 07:22.040 Now, the Bell Company, um... 07:25.540 --> 07:34.700 hired retired FBI agents and spent a pretty good amount of money trying to figure out how he was able to get into these locks. 07:35.500 --> 07:40.110 And to my knowledge, they never made any progress up to that point. 07:41.500 --> 07:50.860 Um, so they spent quite a long time These locks are from the single-slot Fortress payphone. 07:52.340 --> 07:57.420 And they were in service for, I think, around 50 years. 07:58.540 --> 08:01.880 Altogether, well, 50 years ago from now, I think they were possibly... 08:02.440 --> 08:03.960 Some of them are still used. 08:03.960 --> 08:09.560 They are still in places, but very rarely, as we all know how rarely payphones are actually used these days. 08:10.800 --> 08:23.200 But they were continuously in service for, I think, about 30 years or so, and previous models to this went back quite a bit further than that. 08:25.520 --> 08:30.120 But anyway, he was ultimately arrested in 1988. 08:33.100 --> 08:39.920 They said he was identifiable by a ponytail, a baseball cap, and I think cowboy boots. 08:40.060 --> 08:47.300 And he was caught in a payphone playing with a lock or in a phone booth playing with a lock. 08:48.240 --> 08:51.720 But anyway, so I hadn't heard about that story. 08:52.180 --> 09:10.060 And the first time I heard about this lock, well, not the very first time, but the first time I got interested in it was when Matt Smith, also known as Huxley Pig, did a video, he did a talk, and I saw the recorded talk on video 09:13.640 --> 09:18.420 about a few really cool locks that he had been working on. 09:18.900 --> 09:20.400 And this was one of them. 09:21.280 --> 09:29.200 And he had actually made a little bit of progress on how to go about beginning to pick this. 09:31.020 --> 09:37.800 He was still working on it, and he said he had spent a lot of time and effort in trying to figure it out. 09:38.840 --> 09:42.180 And that kind of made me start to think about this lock. 09:42.180 --> 09:44.600 As in, kind of a goal. 09:48.340 --> 09:53.420 Just basically just thinking about how cool it would be if I could be the one that actually figured it out. 09:54.400 --> 09:58.100 And so I went online, I searched a couple of articles. 09:58.500 --> 10:01.660 Matt Blaze has an amazing article on these locks. 10:02.420 --> 10:06.420 There's also a little bit of information on a couple of the lock picking forums. 10:07.240 --> 10:27.010 But it wasn't until Captain Hook released a video on Lock Pickers United about a decoding method to get into this lock to be able to go in there, figure out the key bitting, and replicate a key to open this thing. 10:27.940 --> 10:48.580 So with a set of wires similar to this, with very precise measurements, and little 90 degree turns on the ends, he was able to go in there and exploit the fact that returning the key to the zero position would also return all the levers to the zero position. 10:49.240 --> 10:56.780 And there was a finite and an exact measurement between the keyway and the gates and the levers. 10:57.900 --> 11:14.380 And since he was able to fit a piece of wire in there, he was then able to determine where the gates were, true and false, and was able to replicate and duplicate a key, make his own key, and open the lock from there. 11:15.300 --> 11:20.580 So when I saw that video, it kind of kicked me in the butt. 11:20.920 --> 11:26.160 And I thought, oh man, if I'm going to do this, I better get started. 11:26.160 --> 11:32.000 So that day, I went on eBay, found one of these, and ordered it. 11:32.940 --> 11:40.940 And it arrived a few days later, I started messing with it, and figured out why everybody had such a hard time with it. 11:40.940 --> 11:44.100 This thing is an incredible pain. 11:44.780 --> 11:48.760 But the first thing I did was... 11:52.160 --> 11:54.460 Actually, I think... yeah. 11:54.460 --> 11:58.680 I think the first thing I did was create an acrylic faceplate for it. 11:58.880 --> 12:01.060 So that I could see inside. 12:01.680 --> 12:04.640 So basically I knew what I was dealing with. 12:05.520 --> 12:09.280 So now this is the 30C here with an acrylic faceplate. 12:09.680 --> 12:12.540 And you can see a couple differences from the 29A. 12:12.540 --> 12:14.720 This one actually does have a spring. 12:15.180 --> 12:19.680 There's a single leaf spring here that puts tension on all the levers. 12:20.540 --> 12:29.800 If you raise one lever up, it lifts this spring, and basically eliminates spring tension from the rest of the levers, so they are free-floating. 12:31.440 --> 12:35.100 This one does not have that stationary ward in the center. 12:37.000 --> 12:43.320 But everything else is pretty much the same as the 29, besides this mechanism right here. 12:43.520 --> 12:46.420 And this is what makes this lock so tough. 12:47.060 --> 12:49.060 This is the tumbler blocker. 12:50.260 --> 13:12.760 And what this does, is this serrated piece here, along with the points on the levers, makes it so that as soon as you put tension on this thing, that blocker moves into place and locks all the levers into place before the fence even gets to the levers. 13:14.380 --> 13:19.660 So in picking a lock, what we do is we put tension on the lock. 13:20.140 --> 13:28.480 And after you put tension on it, you manipulate the internals, and you can feel, say, on a lever lock, the fence rubbing on the levers. 13:28.480 --> 13:31.740 So you'll know when you set a lever when it clicks into place. 13:32.540 --> 13:41.000 Well, on this one, before you can even put tension on it, that blocker moves in and stops all those levers from being able to move. 13:42.020 --> 13:48.900 You can see here, that blocker's already engaged, but the fence is super far away from the gates. 13:50.240 --> 13:54.100 Now that is for a couple different reasons they did that. 13:54.380 --> 13:58.500 Obviously one being pick resistance and manipulation resistance. 13:58.560 --> 14:03.420 But also another being lack of maintenance. 14:04.000 --> 14:10.780 Some of these were in very remote areas where the weather and the environment was not very friendly. 14:11.340 --> 14:30.100 So if you got a lot of dirt and gunk and other things in this lock or if there was a lot of key wear, things like that, as soon as you put the key in and it raises the levers up to an approximate height, that blocker will lock them all into place and make sure that they're at the right height for the fence to move into the gates. 14:31.480 --> 14:41.040 So that design was both for manipulation resistance but also for longevity of the lock and to allow it to work in some very harsh conditions. 14:42.900 --> 14:46.400 So that's what makes it so tough to pick is that blocker there. 14:47.360 --> 14:54.120 Now the very first time I picked this lock what I did was I bypassed that blocker. 14:54.500 --> 14:58.080 There's a video of it online, it was the first video that I posted of this lock 15:01.410 --> 15:08.730 and I took a shim like this, actually this is the one inserted it in the top 15:11.850 --> 15:26.190 and you gotta get it under the anti-tamper switch which I'll show you a little later and that can actually hold the blocker back so that I could go in there and manipulate the levers and see what it felt like to actually pick this thing. 15:27.610 --> 16:09.970 So once I did that I posted a video online to basically show my progress, show that I had actually picked the lock which at the time it was a world's first nobody had picked one of these on camera before even using a shim to bypass the blocker so it was a first but it wasn't the first that I was looking for but after posting that video I got quite a bit of response from people Captain Hook being one of them and I talked to him a bit about this lock and got some tips, 16:09.970 --> 16:50.030 we exchanged a couple little here and theres about the lock and got to talking, Captain Hook is an amazing person great picker, one of the best in the world and I didn't want to give too much away but I mentioned that I had been working on a method of picking it that was entirely through the keyway which is what we're looking for So the first thing I did was I took his idea of using bent wires to find the gates and I thought, 16:50.030 --> 17:50.730 well what if instead of identifying the gates one at a time what if I took a wire and bent it in a way that I could insert it in the lock, in the keyway and put pressure on all those levers at once I could then pick them one at a time and get the wire to go into all the true gates which would set the levers all to the correct height and I could then turn the bolt and open the lock Now this kind of worked I was actually able to get all the levers set onto the wire but when it came time to actually throw the bolt and open the lock that's where I ran into some issues It's kind of a chunky wire and there's not a lot of room to work in there So, 17:50.730 --> 17:54.170 it got in the way, unfortunately. 17:54.250 --> 18:04.710 So when I went to throw the bolt, the fence got stuck on the wire and would not move enough to actually open the lock, unfortunately. 18:05.090 --> 18:08.570 I spent a lot of time trying to perfect this wire method. 18:09.110 --> 18:18.070 That's all the scratches you see inside here, was me working on the wire, trying to get it in there perfectly and get everything to work. 18:18.070 --> 18:20.050 I experimented with a lot of different ways. 18:20.050 --> 18:28.370 I tried to get all the levers set right, then put the bolt in a little bit, and then remove the wire and continue, but nothing was working. 18:29.730 --> 18:37.150 I mean, it was a good idea, but it ultimately failed, unfortunately. 18:40.130 --> 18:45.250 So, well, here's another one that I had made. 18:45.250 --> 18:51.410 This is a much flatter wire that I thought might work. 18:51.410 --> 18:53.350 It's a much weaker, much flatter wire. 18:53.350 --> 19:01.650 I figured if I could do that, maybe I could just force the bolt through the wire, bend it out of the way, but at least the lock would be open, but that didn't work either. 19:04.450 --> 19:24.470 So I started thinking about Matt, HuxleyPig's video again, and he had come up with an idea where he would overlift one of the levers up to the point where it would hold the blocker back from the top. 19:25.090 --> 19:31.070 So I don't know if I can get this in here to show you how this would work, but let's see. 19:32.850 --> 19:38.690 So if you lift... oh, wait a minute, I've got to turn the key way. 19:40.650 --> 19:42.490 Get that out of the way. 19:47.550 --> 19:54.850 So if you lift up on one of the levers, and you lift it past where it's supposed to go... 19:54.850 --> 19:58.990 whoops, I don't think I can do this without actually turning the key. 20:00.010 --> 20:01.130 Meh. 20:02.710 --> 20:13.670 But you can get it overlifted to where it will actually get stuck up here and hold the blocker back, and I think you're actually deforming the lever at that point. 20:13.670 --> 20:16.110 It's really tough to get it up there. 20:17.550 --> 20:38.210 But it was an interesting idea, and it made me think about instead of trying to align the gates using a wire or anything like that, maybe I could use the levers to hold the blocker back, but in a different way. 20:39.450 --> 20:49.310 And one day I was driving, I was driving at work and talking to Captain Hook, and I had an idea. 20:49.310 --> 20:56.590 And I had to wait all day, it was super hard to wait to not leave work early or run home and try it. 20:56.850 --> 21:01.530 But I had an idea on what I could possibly do. 21:01.830 --> 21:21.550 So what I thought was if I could hold one of the levers up so that the point of the lever would sit at the point of one of these serrations, it might hold that blocker back just enough to where I could pick the levers past the blocker. 21:21.610 --> 21:32.030 Now I'd still have to deal with the blocker, they'd still be clicking in these little serrations, but it might be just enough to where it wouldn't be fully engaged and I could actually pick the lock. 21:33.290 --> 21:39.470 So I started work, as soon as I got home I started working on creating something that would make this happen. 21:42.750 --> 21:47.390 And ultimately, I created this. 21:49.110 --> 21:53.970 Just this little flag tool here, it's got some warding cut into it there. 21:55.190 --> 21:56.470 And what this does... 21:57.650 --> 21:59.350 Ah, where's that tension wrench? 21:59.350 --> 22:00.090 Here it is. 22:00.090 --> 22:10.810 Alright, so what this does is you actually insert this right into that first piece of warding, all the way back and sit it into the actuator. 22:15.020 --> 22:20.220 And when it's sitting there, you then tension the lock, 22:23.390 --> 22:26.070 and that little flag in the back... 22:26.690 --> 22:31.110 I don't know if you can see that, let's try to get some better light here... 22:38.300 --> 22:43.400 So that rear lever is sticking up just a little bit more than the rest of them. 22:43.400 --> 22:44.900 Can you see that back there? 22:48.330 --> 22:50.130 Yeah, I think you can see that. 22:50.490 --> 22:53.550 So that is actually holding that blocker back. 22:55.290 --> 22:58.370 And what I was able to do at that point... 22:59.810 --> 23:02.230 was get a picking wire in there. 23:02.290 --> 23:05.030 And actually I started with the picking wire in there. 23:05.390 --> 23:08.250 But it would hold the blocker just enough... 23:08.890 --> 23:12.250 that I was actually able to put tension on the lock... 23:13.270 --> 23:14.910 and move the levers. 23:16.210 --> 23:19.950 And that was actually the very first way that I ever picked this lock open. 23:20.310 --> 23:21.570 And it worked! 23:21.830 --> 23:23.330 It actually worked. 23:23.830 --> 23:26.190 There's a couple videos of it online. 23:27.470 --> 23:31.670 The first one got a lot of scrutiny, of course, because it was a world's first. 23:32.310 --> 23:41.950 There was a little piece of wire sitting on my desk that people thought was some sort of a shim to hold the blocker back, or they had all sorts of crazy ideas. 23:41.950 --> 23:46.590 But as soon as that happened, I immediately did another video with a clean desk... 23:46.590 --> 23:52.050 and made sure that there was no possible way whatsoever that it was not real. 23:53.910 --> 23:57.170 But that was the very first way that I picked this thing open. 23:57.170 --> 23:58.870 And I was super happy. 23:58.870 --> 24:00.390 I couldn't believe it. 24:00.590 --> 24:03.950 I was just out of this world ecstatic. 24:03.950 --> 24:05.050 It was incredible. 24:05.050 --> 24:06.330 It was so great. 24:10.390 --> 24:15.730 But in thinking about it, it wasn't the easiest thing in the world. 24:15.730 --> 24:18.060 It's a very delicate balancing act. 24:18.650 --> 24:24.050 And I wanted to make it even better. 24:25.440 --> 24:38.810 So with this, this was designed to hold the blocker just below that last lever's true gate. 24:39.810 --> 24:42.870 So that 8th lever would be the last one that I picked. 24:44.190 --> 24:50.370 And when I picked it, it would be the last one, and I only had to go one click to get it into its true gate. 24:50.950 --> 24:57.830 And I think, I'm pretty sure, that this one tool probably would have worked for any other lock... 24:57.830 --> 25:01.250 unless that 8th lever was a zero cut. 25:01.370 --> 25:02.650 If it was lower. 25:03.570 --> 25:06.810 Anything higher, you could have shot it up into place. 25:06.810 --> 25:09.790 It wouldn't have been easy, but it would have been doable. 25:11.190 --> 25:12.810 But, um... 25:14.090 --> 25:17.650 If it was a zero cut, it would already be sitting too high. 25:17.790 --> 25:20.530 And you'd have to hope that you could get it to drop down. 25:32.650 --> 25:33.410 Sorry. 25:33.410 --> 25:34.690 Went in my whistle again. 25:41.700 --> 25:49.240 So then I had the idea of, what if I can hold all the levers up to the right height? 25:51.040 --> 25:55.900 What if I can make all the levers hold that blocker back? 25:55.900 --> 25:59.940 So it didn't matter which one I picked, when, what the binding order was. 26:01.480 --> 26:02.000 And... 26:02.000 --> 26:04.720 So I started making tension wrenches. 26:05.720 --> 26:11.300 I designed a bunch of different tensioners that would go in and hold the levers up to different heights. 26:12.420 --> 26:13.440 And, um... 26:14.800 --> 26:17.900 There was all slight problems with it. 26:17.900 --> 26:24.820 You know, it was hard to get a wire in there and keep holding everything, and it was still a very delicate balancing act. 26:24.980 --> 26:26.280 Don't get me wrong. 26:26.600 --> 26:43.460 But ultimately, what I figured out was that a thin wiper insert was exactly the right height to go in there, in that first ward, and hold those levers up to the exact point where they need to be to hold that blocker back. 26:45.600 --> 26:48.300 And you can actually pick the lock like this too. 26:49.300 --> 26:51.120 Now again, it's difficult. 26:52.180 --> 26:54.840 Because there's not a whole lot of room to work. 26:56.120 --> 26:59.160 But it does hold all the levers up to where you need them. 27:00.800 --> 27:03.300 And you can go in and pick. 27:03.320 --> 27:04.660 It's possible. 27:09.040 --> 27:11.580 But again, that wasn't good enough. 27:11.940 --> 27:13.660 It wasn't easy enough. 27:17.520 --> 27:18.060 So... 27:19.640 --> 27:21.320 I started, um... 27:23.020 --> 27:28.920 I basically just started kind of playing with the lock, and looking at what happened when I did different things. 27:30.040 --> 27:34.300 So I started looking at what would happen if I just tensioned it, right? 27:34.520 --> 27:43.980 So you just tension it, and I finally noticed, if you look here, when you tension this thing, the blocker's not engaged. 27:44.920 --> 27:48.760 It's sitting point to point with one of these levers. 27:49.480 --> 27:53.260 But also, that bolt isn't engaged either. 27:54.900 --> 28:00.140 The bottom of the fence here is actually hitting the bottom of the levers. 28:04.130 --> 28:09.330 So, this lock starts in a very interesting configuration here. 28:09.330 --> 28:16.230 I mean, you'd think that the blocker would engage, hold all the levers at zero, this would have no room to go in, things like that. 28:16.230 --> 28:18.790 But for some reason, it's not. 28:20.230 --> 28:23.670 And all those levers are held right there. 28:24.350 --> 28:27.330 But this guy's hitting on the bottom. 28:30.230 --> 28:30.710 So... 28:32.270 --> 28:41.150 If you were to put a picking wire in here, you can actually start picking this lock. 28:41.670 --> 28:47.650 But unfortunately, nothing's moving, because that fence is stuck at the bottom there. 28:51.890 --> 29:24.000 So, I started taking measurements, and I realized eventually, that if I took the lowest possible, or the smallest possible wiper insert, and inserted it here, in between the wards there, that, plus the picking wire, was about just the right height to hold those levers at that same zero spot where the tensioner was holding them before. 29:26.920 --> 29:59.180 So, what I figured out at this point, was that I can actually tension the lock, then insert a picking wire, and if I just hit the couple levers that are holding the fence back, I get to that spot where I want to be. 30:02.630 --> 30:13.990 Now granted, it is a balancing act, and that blocker will lock in a lot, so it takes a lot of resets. 30:13.990 --> 30:20.330 And if you're ever trying to pick this thing, do not be afraid to start over, because you have to start over a lot. 30:21.110 --> 30:25.290 But eventually, you'll start to learn which levers to pick first, 30:37.030 --> 30:45.360 and once you realize that, you can actually go about picking this thing. 30:53.380 --> 30:59.600 So, if you see that, the levers are sitting at the very bottom of the blocker there, holding it back just enough. 31:01.260 --> 31:11.960 So, let's go in and find the lever that the fence is stuck on, get it out of the way, so the fence will then engage, but the blocker is still being held back. 31:15.320 --> 31:27.020 We're then going to find a couple of the levers, and you actually want to try to pick the very tallest levers first, to get them out of your way. 31:30.720 --> 31:32.700 Oops, lever wrong. 31:32.700 --> 31:35.620 So, if you ever hit a wrong lever, you'll have to restart. 31:36.320 --> 31:39.180 And that's okay, like I said, it's going to happen a lot. 31:56.760 --> 31:59.200 So, just feel around in there for a binder. 31:59.820 --> 32:01.800 There we go, find the binder. 32:06.640 --> 32:08.760 Oop, blocker engaged again. 32:15.370 --> 32:24.570 So, I'm probably not going to be able to do this live on video, or not quite live, but on this video here, without some practice, I haven't picked one of these in quite a while. 32:27.930 --> 32:28.330 But 32:33.160 --> 32:35.800 , I don't know, maybe I'll get lucky. 32:43.890 --> 32:46.270 Oops, dropped the actuator there. 32:46.650 --> 32:49.450 That's what happens when your lock's not fully put together. 34:03.420 --> 34:05.040 Alright, now I'm determined. 35:11.780 --> 35:15.520 I'm going too high back there. 35:16.620 --> 35:18.320 Maybe not. 35:21.470 --> 35:23.110 There we go. 35:23.770 --> 35:27.090 Alright, so, there it was. 35:28.350 --> 35:33.290 I hope that was easy enough for everyone to see. 35:35.930 --> 35:38.790 But, yeah, so it is possible. 35:40.050 --> 35:50.690 That was a full pick, granted with a clear face, so it's not that impressive, of the Western Electric 30C. 35:51.810 --> 35:56.830 So, hopefully, we'll get some more people out there picking these things. 36:01.070 --> 36:05.650 Yeah, I hope everybody enjoyed that greatly. 36:06.470 --> 36:22.090 So, at the end of this, I'm actually going to attach the video where I pick this lock, without the cover taken off, fully factory sealed, with that same method. 36:24.350 --> 36:30.430 So you can see what it looks like without an acrylic cover on it. 36:30.790 --> 36:33.890 But, anyway, yeah, there we are. 36:34.450 --> 36:37.890 If anyone has any questions or anything, just... 36:38.990 --> 36:44.890 I've been here the whole time, so I'm sure you'll have asked them, but feel free to get a hold of me. 36:45.830 --> 36:47.790 I'm on Discord. 36:47.790 --> 36:50.250 The Lockpickers United Discord is nothing. 36:50.250 --> 36:53.570 I have a YouTube channel, which is a nothing symbol. 36:53.870 --> 36:57.530 If you search Western Electric 30C, you can find me. 37:00.810 --> 37:02.270 And I'm here. 37:02.270 --> 37:08.730 If anyone wants my email address, it's mr.nothingpicks at gmail.com. 37:08.750 --> 37:10.490 Reach out to me if you have any questions. 37:10.490 --> 37:15.330 If you're stuck, I will gladly help anyone through this. 37:15.930 --> 37:18.130 So, alright, there we are. 37:18.190 --> 37:19.330 Thanks a lot, all. 37:19.690 --> 37:24.190 I hope you all enjoyed DEF CON, and stay safe out there. 37:24.410 --> 37:25.210 Take care. 37:25.210 --> 37:25.810 Bye. 37:28.070 --> 37:29.910 Alright, hey everyone. 37:29.910 --> 37:31.670 Hope you're all doing well. 37:32.610 --> 37:39.010 So, I have another Western Electric 30C here. 37:39.950 --> 37:43.170 This one has not been taken apart yet. 37:43.470 --> 37:45.810 All the rivets are still intact. 37:46.690 --> 37:50.390 It is just like I received it. 37:50.890 --> 37:53.570 I do have a key for it. 37:53.770 --> 37:56.810 It's got some pretty extreme bidding. 37:57.770 --> 38:01.270 It's got a zero cut right there in the two position. 38:01.590 --> 38:03.970 Five cut back there. 38:04.290 --> 38:06.650 That number four is a one cut. 38:06.650 --> 38:12.710 It's annoying trying to set those levers without oversetting anything else or bumping anything else. 38:12.710 --> 38:13.470 Whatever. 38:14.010 --> 38:17.650 But, it works sometimes. 38:17.650 --> 38:22.010 I think one of those zero cut lever jumps up if I move the key too fast. 38:22.670 --> 38:27.510 And you can see the blocker, if you look in that corner, moving in and out. 38:30.610 --> 38:33.350 So, that's still there. 38:36.350 --> 38:45.350 Yeah, so, let me see if I can get this thing open here. 38:53.700 --> 39:02.060 Alright, so, I kind of developed a new technique that doesn't involve that third tool. 39:02.060 --> 39:05.360 Just a picking wire and a tensioner. 39:08.140 --> 39:14.160 Kind of doing a lot of trial and error on these things and research and what not. 39:14.280 --> 39:20.700 Hoping to get something pretty comprehensive put together at some point. 39:31.520 --> 39:34.620 You are going to see me reset a lot. 39:34.960 --> 39:40.480 Because, if I do anything wrong, I have to completely start over. 46:55.640 --> 46:57.120 Yes! 46:57.580 --> 46:59.220 Hell yeah! 46:59.880 --> 47:02.160 Alright, there it is. 47:02.640 --> 47:03.820 Oh man! 47:04.720 --> 47:06.180 Yes! 47:06.180 --> 47:07.430 Oh, I'm so happy. 47:07.780 --> 47:15.410 Oh, I'm so excited right now. 47:17.980 --> 47:28.240 Alright, so, yeah, since it's not taken apart, I can't really gut it for you. 47:28.240 --> 47:33.060 But, I guess I can at least kind of give you a 360 again. 47:33.620 --> 47:36.640 Let me drop this out of the way first. 47:41.560 --> 47:46.080 Alright, so, there it is, picked open. 47:52.890 --> 47:54.790 Oh, I'm so happy. 47:59.720 --> 48:02.100 Alright, now over here. 48:02.340 --> 48:08.660 Let's see if we can get this image of the blocker coming back out. 48:15.070 --> 48:16.810 There it is. 48:18.350 --> 48:19.990 Alright all. 48:20.790 --> 48:23.250 Western Electric 30C. 48:23.290 --> 48:24.650 Picked. 48:25.250 --> 48:27.690 Alright, have a great one. 48:27.690 --> 48:28.810 Take care all.