Greetings. Welcome to track four. This is the 4.30 p.m. talk. You're going to hang out a while with Bill Graydon, and he's going to talk about physical security, which is something that should get more attention, I think.
So he's going to talk about defeating moving elements and high security keys.
Awesome. Thanks, everyone. Thanks, Fliktid.
So to get started, we'll give a brief overview of what we're going to talk about and then go through it.
So we'll first introduce what is a moving element and why it's used.
Go over some of the more naive ways to hack them, like a 3D printed cap development, a compliant mechanism.
And then we'll get into sort of what the abstract said is.
The big reveal of this talk, which is a way to do it without using those, with having a static, non-moving piece of metal that will actually actuate these mechanisms.
We'll talk about the vendor disclosure process and how that went and some of the implications and defenses.
That's a very high level.
So what is a moving element?
So here's sort of some of the four most common, at least in North America, keys that use them.
It is a piece of the key that moves relative to the rest of the key.
So with multi-lock interactive, you've got this, what's called the interactive component, and it slides in and out.
With the multi-lock MT5, you've got a spring within the key.
So that can compress down, and otherwise it will spring out and have a little bulge at the end here.
Medeco M4, which is just rolling out now, it's got a similar thing.
It's a pin that slides back and forth.
And with Abloy Protact 2, they've got a ball bearing, and that ball bearing will move.
You know, it's captive within the key, so it can't fall out, and it moves side to side.
And so that creates a protrusion on the key there, and that protrusion will then interact with an element in the lock,
and it has to be sticking out in order to work.
Now, why can't you just make that, or why does it have to move?
Why can't it just be static?
Well, because it won't actually fit in the lock if that happens.
And we'll show a couple examples of that in a bit.
So what does this protect against?
Well, it protects against captains.
It protects against the casting of keys, because if you cast a key, it's going to be completely static.
It won't move, and so that solid cast is not going to work to operate this lock.
It also provides some protection against 3D printing, because a 3D printed key, same thing.
We'll talk about some ways around that, but generally, 3D prints are a solid piece of material.
So let's start our discussion by looking at the Abloy Protact 2.
Right?
So we've got 3.
Main generations of Abloy, the classic, which was the original mainstream disk container lock.
And then we added the Protact, which is a bit of a twist on disk container, really a beautiful design.
And then Protact 2 came out a couple years ago, and now adds that captive ball bearing element.
And that element makes it a lot harder to, you know, the patent protects that element,
so it means that you can't mass produce blanks for this,
and so it helps with their key control in general.
This is sort of what it looks like when sliced open, so you've got the two halves of it there,
and then this channel that contains that ball bearing, that goes in the middle of it.
And the mechanism works like this.
So the ball bearing within the key is this one we can see on the left,
and then there's a spring that pushes it up, and this is within the lock,
and that pushes up this little shaped piece of metal here, that then allows it to move within this channel.
If that were not present in the key, this would fall down,
and this channel would block it, and it would not open the lock.
So we need to find a way with casting or 3D printing or whatever technique we're going to use
to actuate that little piece of metal and allow it to go up in that channel.
So sort of a naive approach is if we take a Protact 1 that doesn't have the ball bearing,
and make a little slot for it to allow us to stick a lock pick in,
and then we have this little tool here we made that works.
And a lock pick works as well.
And so if you have that channel, you can stick in a key,
and use a lock pick to actually actuate that and make it open.
That's not the sort of thing that Abloy is all that concerned about,
because it's not something that you're going to be able to do as, you know, selling to consumers.
Here's a blank that'll work on Abloy Protact 2.
Well, no, you've got to also stick this lock pick in.
And that video is also a bit deceptive, because that was one of many takes,
and that was the best one.
So, you know, it takes a bit of skill to get the exact same thing,
the exact right position on it, and to do it consistently every time.
So, you can do it, but that is a good illustration of why when making moving elements and keys,
it is a good idea to not have your moving element be the first thing right closest to the keyhole.
Because if there's some pins and whatnot in the way that prevent you from sticking that lock pick in around them,
that would prevent this attack.
Right, but that's old news.
And specifically as three-year-old news, we, my brother Bobby and I,
we talked about this attack amongst many other things at DEF CON 27.
We talked about duplicating restricted keys in general.
And so this talk is sort of a part two of that, if you will,
to talk explicitly about the moving elements,
because those are being sort of the industry trend right now.
Particularly a number of patent courts have started saying,
well, you can't just patent a piece of metal.
You can't patent a static shape.
It must have something else to it, and this moving element is, you know, the keyhole.
This is the solution that lock makers are converging on there.
So it is a trend that we're seeing.
Okay, so let's take a look at what we can do to actually make an Abloy ProTek2 key,
and 3D printing is one way.
So there's this really excellent library on GitHub
that lets you generate a ProTek2 key to a certain code and then print one.
And 3D printed keys in general, they're terrible, honestly.
They don't work well, right?
The material is terrible.
The material is not strong.
It doesn't let pins glide across them very well.
3D printing is, it works for keys,
but don't think you're going to 3D print your house key and use it every day.
This, though, actually works pretty well.
Like the nature of Abloy ProTek locks and disk detainers in general
is they're springless designs.
There's nothing dragging on anything else.
It suits itself well to 3D printing, and this library does it extremely well.
So kudos to them.
And so I forked that
and did a final test.
And in replace of everywhere that said ProTek with ProTek2
in the documentation.
And on this fork, I've been adding everything that I've been working on
and that we're talking about in this talk
to make ProTek2 keys 3D printable.
And I do want to give a quick shout out as well
to Moloch's incredible Defcon 26 talk
that goes much more in depth about 3D printing high security keys
in the context of Knox boxes.
So check that out if you're interested.
So the first technique,
and sort of the naive approach that we're going to try
with 3D printing a key with a captive element
is to just 3D print the captive element.
So we'll take our 3D printable model of an Abloy ProTek key
and we'll add a spherical hole in it.
And then within that spherical hole, we'll add a sphere.
And so in theory, this will simulate that captive ball bearing
and we print it and that sphere is able to move
but it's stuck within there and it will work in the lock.
And not so much because the nature of 3D printing
is you don't get perfect tolerances
and especially with resin printing,
you get things if they're too close together, they stick.
And so trying out different spacings between that sphere
and the hole that it's in, if it's too close,
they stick together, they merge
and it's just a static piece of material.
If it's too far,
the spherical ball bearing simulator falls out.
And it turns out there is no happy medium.
It's one or the other.
So I was not successful in getting
a 3D printed captive element to work.
That doesn't mean you won't be.
But it's not as trivial as you might think.
Okay, so if we need a certain minimum space
but we also need something to keep this sphere
from falling out, we could try adding
a thin piece of material to hold it in
and make a compliant mechanism.
And so that's the nice thing with 3D printed materials
is that they bend a little bit without breaking.
And so we tried this design.
And so it's got that ball bearing in the right place
and then just a long thin tongue.
And that tongue holds it in place
and lets it spring back and forth.
And it turns out that works fairly well actually.
So here's what it looks like when printed.
You can see that the printer really had a problem
on the head.
It's not very pretty, but it works, right?
So we got this captive element
and it's able to spring back and forth
and simulate that key.
So we'll just take a look at that in operation.
Right, so there it is.
We stick it into the lock.
It works really nicely.
Now this was again one take out of multiple.
And it took a lot of like little tweaks
and filing on that key
because the supports add little elements.
And you know, 3D printed keys,
they really don't work very well the first time out.
But it does work.
And so it is a cause for concern there.
Right, and so I added that to the GitHub repo as well
that you're welcome to check out and print your own.
Another thing that's worth mentioning about this
is now that you can 3D print them,
you can 3D print a whole bunch at once.
And so I gave a talk two years ago at DEF CON Safe Mode
about what you can do with information theory and key codes
and sort of brute forcing.
And so that's something that this allows you to do
pretty effectively with something as high security
as an Abloy Protect 2 now.
And so if we'd turned these keys vertical,
we could have fit hundreds of those on that one print bed.
So before we get into the big reveal
of how to do it with a static piece of material,
let's switch gears a little bit and look at multi-lock.
Multi-lock is sort of the one that really popularized these
moving elements and was,
I don't know if they were the very first ones to do it,
but they got a patent on it.
So if they were not,
there was no prior art that the patent office found.
Not that they ever try very hard.
So multi-lock interactive is the first one there.
It has these telescoping pins,
which was a holdover from the previous design,
but it's not particularly important
for what we're doing today.
What's important here is that one of those pins,
pins, on the key it moves. And it has to move a little bit higher than the plane of the
top of the blank in order to actually set that pin. Right? So the pin looks identical.
The pin looks identical to all the other pins except it is shorter. And that pin is too
short to be actuated by anything but a key with a moving element that sticks up beyond
the plane of the key. Right? And then we've got the moving element and the key that we
can see here. And in the bottom of the plug, there's this little spring-loaded piece of
metal that pushes up and pushes this moving element up which pushes this pin up and allows
the key to operate the lock. Right? So looking at sort of a cutaway version, we'll ignore
the pin and pin design of multilocks for now. This is essentially what's happening. Right?
We've got the key protruding above the head of the key. So we've got the key protruding
up. And so let's take a quick look at a demo for that. Actually, I'll see if we can do
a courtesy zoom here. Right? So here is an example of what that lock might look like.
And just a blank. All right? And so I'm inserting this blank in. And blanks are cut as high
as you can possibly cut them. And notice that when the blank is inserted in, this one pin
here is still too low. So even the blank with the highest possible cuts does not put
that pin at the shear line.
If we add a little protrusion to the blank, then it does. Right? And so that sets that to the
shear line. And then, of course, if we add all the rest of the cuts, we're now going to open
that lock. Right? So we have those cuts. But here's the problem. Is that if I now try to take
this key out of the lock, well, it won't fit. There's, you know, this metal is getting in the
way of the actual lock plug.
So this doesn't work. You can't just add a protruding element over top of it because
it is thicker than the hole the key hole is. And so that's sort of been the conventional
wisdom behind interactive elements. You need this moving element to open the lock, but
you need it to move back to the other position to insert and remove the key. Right? And so
that's what's happening in multilock.
The moving element is able to move up and down when it's pushed up by that little
spring loaded element inside the core. And that lifts this key to the shear or that pin to the
shear line. Okay. Here's the big reveal. And it's so stupidly simple, someone else has got to
have thought of this before. But I'm the first one that has published about it that I can find.
Here's the big reveal to avoid that problem.
You just take a bit of metal off the back of the key. That's all it takes.
And with that, we can move the entire key. And so now it fits in and we move the whole
key, we angle it up a little bit and it sets that pin to the correct height. And again,
it's so simple. I can't be the first person who has thought about this.
I couldn't find anyone else that's published on it and lock makers are putting out designs as if
they haven't thought of it either. So we're getting it out there now. And this is something to
start thinking about when doing new iterations on lock designs. Right? So to actually fabricate
this, at DEF CON 27, we talked about how you can do the regular cuts on a multilock on a drill
press. So you can check out that talk if you're interested. So we can add the cuts. But then we
have to add this.
This element protruding out as well. So what can we do about that? Well, we'll start with a classic
key blank. And so those, you know, that gives us the overall shape. It gives us everything we need
except that element protruding out. One thing is the classic key blanks are ludicrously expensive.
You know, $7 a blank, that's not something that we want to be spending. So we go to our old friend
and this is, if you search for multilock key blank on AliExpress, you're not going to find this.
It's just a very generic name. Key tool, home door, key blanks, locksmith supplies, blank keys.
But I was browsing around looking for other things and happened to stumble upon this. And I'm
like, huh, that looks a lot like a multilock. And so I ordered some and it turns out they actually
worked perfectly. They actually got extra metal taken away so they fit in a number of different sections of multilock locks.
Okay. So we take this not nearly as expensive key blank. And when we insert it into the lock, we'll see that this pin here is too low.
It doesn't have that element protruding out. And to fix that, I'm just going to shave away a bunch of metal on the pin side of the key except for that one place, right?
And so I'm leaving now a little bit poking out in that one part of the key that's got to be poking out to actuate that element and shaving away the back.
All right. And so now the entire key is able to move within the lock.
All right. So you can see that the whole key can bounce back and forth. And the pins are too low when it's in the position that will allow it to insert.
But that moving pin, that pin that's too short, does get set when it's pushed up.
All right. You'll notice it's a little bit lower than the others.
It is still within just a little bit lower than the others.
It's still in tolerance and it does open that lock.
All right. So then we have to add the cuts to it, right?
And so if we're doing that, we've just got to put a little piece of metal to shim the back of the key, otherwise our cuts are going to end up too shallow.
This happens to be on an actual multi-lock machine, but you can do it on the drill press as well.
All right. And so we add these cuts to our surrogate key, and now we have one that will actually work, right?
So you can see on the side all of those bidding cuts there and then the little element that's sticking out.
All right. And so we add these cuts to our surrogate key, and now we have one that will actually work, right?
And so we add these cuts to our surrogate key, and now we have one that will actually work, right?
And it doesn't work perfectly.
And you have to know to move it when you insert it, right?
So it's a little bit of a back and forth.
But it works well enough, right?
Like this, if my house key were a multi-lock, I would be perfectly fine using this every day, right?
So that is a bit of a problem, something that's worth dealing with.
Multi-lock interactive is long since out of patent, so it's not stopping anyone.
For manufacturing, key blanks that have that moving element, no one has that I've been able to find.
But a bit less of a concern because it's out of patent.
And you can go print your own.
So I published all of this on my GitHub as well as some elements that you can use with JS CAD.
So it's a JavaScript version of the OpenSCAD.
And so you can play around with it and do it entirely within your web browser as well.
Right?
So I was mentioning patents, right?
And patents last 20 years.
And so this is why we see these many generations of these major lock designs that we see out there, right?
So with multi-lock, the classic came out in 1977.
And then in 1994, the patent was getting close to expiring.
And they released the interactive to keep that in patents and allow them to maintain control over their key control.
Right?
And then in 2007, another almost 20 years later.
They released the MT5.
Same thing.
They're changing up how that moving element is done to a spring instead of a solid element.
And that's primarily done to keep things in patents and maintain legal enforcement ability over their key control.
Right?
So let's take a look at how we can apply this to the multi-lock MT5.
Right?
So the MT5 works similarly to the others.
Except it has this spring.
And the tip of the key.
And it's in the center.
Not collinear with the rest of the cut.
So the pin for it has to be this funny little thing that's got a little secondary pin stuck to it over the side.
It's an interesting looking pin.
And I shudder to think the expense at which they manufacture that.
But they do.
And so we've got to push this pin up by having a protrusion on the top of our key.
So we do the same thing.
Right?
We add that protrusion.
Just with an open SCAD which is the software that this was created in.
Just a cylinder.
And you rotate it and position it correctly and union it with the rest of the key.
And then we just knock off the back of that key.
So that it has space to fit in the lock.
And that will work for us.
It is worth noting that the MT5 has a variation called MT5 plus that has a track to it.
So it's also got a slider track.
And so we just have to add that to the back of the key as well.
But nothing about this technique prevents us from doing that.
Right?
So here's one that's 3D printed.
And we can see the little protrusion at the end of the key.
And then on the back side we've got that slider track printed as well.
So in one place it's actually so thin that there's no material in between them.
But that's okay.
The rest of the key supports it just fine.
And so it operates it just fine there.
Right?
And so we can see this protrusion from the 3D print sticking out there.
Right?
And so when we insert this into a lock.
We're now it's at the end rather than the base of the key that's moving.
But you can see as I tilt it back and forth.
This pin here at the far end is bouncing up and down.
Right?
And so I am successfully setting that pin that should be set by the moving element as well.
Right?
And so you can print your own of these as well at the same URLs.
And try it out for yourself.
Okay.
So now that we've got both interactive and MT5.
And MT5 is still in patent.
Right?
So this is something that they would be potentially concerned with.
I reached out to them.
Right?
And so part of the responsible process of discovering this sort of thing is you reach out to the manufacturers.
And let them know in advance of publishing it.
And give them a chance to fix things.
Or at least respond and be prepared for it.
Right?
So I reached out.
And the response.
Cricket.
You know.
So I sent multiple emails to their online forms.
I even reached out to some people I knew that happened to have family that worked at Multilock.
And I just could not get on the phone with the right person.
So if you happen to be watching this video on YouTube after or in the audience.
And you're from Multilock.
And you are the right person.
Please reach out to me.
I would love to work with you to help mitigate this.
And there are mitigations available which I'll talk about at the end.
So hopefully we can see that happen now that this is actually being released.
But it does give attackers a bit of a head start now.
All right.
Let's talk about Abloy.
Right?
So we talked about that a bit at the first part of this presentation.
We're going to come back to it.
It's a bit more complicated geometry which is why I covered Multilock first.
Right?
So we've got the disc detainer cuts are a bit more complicated.
We have to treat those with a little bit more care when we're removing the metal from the back side of it.
But otherwise the process is pretty similar.
Right?
So we've got in OpenSCAD.
Which is this really awesome software that does this.
And you'll see why in a second.
We add a sphere to it.
And that adds that element sticking out.
And we've got to remove material from the back of the key so it will actually insert and fit within that lock.
Now we can't just chop it off the way we did with the Multilock because this is a disc detainer.
And it has to be able to interact on both sides of the key with the material.
So what we can do is draw a second one.
Right?
So I'm just doing Abloy protect two twice.
And then I'm rotating it.
Right?
So in this case I'm rotating it by two degrees in the Y axis.
And so you can see here that this is two keys that are rotated.
And one of the beauties of this software is that I can take the intersection of those two.
And so there's the intersection.
And so that pretty perfectly chops off metal from the back in exactly the way that I need that to happen in order for it to actually fit into the lock.
Right?
And so you can see.
Right?
I'm doing this in the code.
Drawing one Abloy protect two.
And then another that's rotated and just taking the intersection of the two.
Right?
So this is what it looks like when 3D printed.
And we can take a look at it in operation.
Right?
So there's the key with the element poking out.
And you can see when I turn it, it's thinner at the base of the key.
I insert it in.
And I push it to the left.
And then I quickly defeat that element detecting the moving element.
And then after a bit of wiggling, it's able to actually turn the disks as well and get those all to set the sidebar to go in.
So yeah.
So this works now with Abloy protect two.
And it allows you to 3D print not just with a compliant mechanism but also a completely static mechanism.
And so that's not just 3D printing that that interacts with.
But also you can make this out of metal.
Right?
So we can now make a metal key that will work for protect two.
So again, something that we want to potentially mitigate if there's a good way to do it.
Right?
So I reached out to Abloy with the same process.
And response, crickets.
So same deal.
If you are with Abloy and you are the correct person to talk to about this, please reach out to me.
I would love to work with you to help get this mitigated.
Let's talk about Medeco.
Right?
So when we started this work, right, Medeco did not have any keys with moving elements.
He had the classic and the biaxial and the M3 just added a slider there.
But soon after we were starting this work, they announced the M4.
And so the M4 has this sidebar with finger pins that get set as well as a moving element.
Okay.
So this is a pretty good opportunity.
Right?
We now have a lock that is not yet out to the public.
And we've got a potential vulnerability with it.
And so we've got an opportunity to actually get this vulnerability fixed before it's released.
That's pretty awesome.
Right?
So how does the moving element work within Medeco?
Well, we've got this moving element for the M4 is called a shuttle pin.
And it interacts with one of these finger pins called the lift pin.
And that lift pin just does this.
It doesn't have a protrusion deep enough for anything else in this sidebar track to operate it.
And so the shuttle pin has to be sticking out in order to interact with that lift pin.
Right?
And so reached out to Medeco with now this potential vulnerability.
Of course, untested because we didn't have an M4 to test with at that point because it wasn't released yet.
And said, hey, let's see if we can talk about this.
And so the vendor response was actually incredible.
They got back the same day.
And they emailed me.
And I got a phone call.
And, you know, this is like the day before New Year's.
Right?
And the guy that reached out to me, his name is on many of their patents.
So they took it quite seriously and actually reached out promptly and were very responsive with that.
So it was a good response.
Right?
And so we had a number of calls with them.
We discussed the technique and made sure they understood how it might potentially operate on the Medeco M4.
And Medeco's team tried it without success.
Right?
And so it's now our turn to try it.
But before we were able to do that, before they were able to send us any information or even a lock about the M4 so we could try it out, we had to deal with the NDA process.
Right?
So I'm sure most people in this room are familiar with that.
And that's something that when you're a hacker that discovers something and you're requested to do this, it's kind of a big decision.
Right?
And so we took this to our legal team and they looked at it and said, like, NDAs in general are fine.
The problem is when it's you, the little guy, in a contract with a giant conglomeration like Assa Abloy Group, even if you are totally legally in the right, they can put hundreds of thousands of dollars after lawyers to just make the process drag out and bankrupt you on the legal process.
So that was one of the warnings that we got.
And based on, honestly, it was pretty heavily based on how responsive and reasonable the gentleman from Medeco we've been talking to had been.
His name is Clyde Roberson, by the way.
He was responsive and reasonable.
And we decided to take a leap of faith and do it solely based on his demeanor and our read on the situation based on that.
Right?
But that's do beware before you sign these.
The other important thing to keep in mind is...
Make sure you read it.
And if you can, make sure you send it to someone with some legal expertise to get it reviewed.
Right?
So we've worked with NDAs loads of times before and we know what's standard.
And we noticed one paragraph in there that wasn't completely standard.
So foreground intellectual property is within a contract.
It is intellectual property that's generated as a part of that contract.
And this was an NDA.
It's supposed to be nondisclosure.
But it also said...
Well, by the way, anything that you or us develop as part of this communication, we now own.
So we being the ASSA ABLA group.
And so we looked at this and we're like...
Eh, we don't want to do this.
We want the NDA to be about nondisclosure and not intellectual property ownership.
And so we got back to them about that and said we got a concern with this paragraph.
And the response was...
Okay.
Here's a new version with that paragraph deleted.
This is actually pretty standard with NDAs.
If you don't like an NDA that someone sends you, you express your concerns.
And companies are usually very happy to modify it for you.
And so that happened here.
And it worked out quite well.
Right?
So we're all signed.
We're good to go.
We're NDAed.
And we can now actually test this thing.
Right?
And so Clyde got us sent a couple of the M4 locks.
Right?
Some of the early production versions.
And we were able to actually start testing this and see if we could find a way to make this new method work with the M4.
So attempt number one, we took a Schlage SC9 blank.
And when you file off enough metal on it, it will fit into that M4 keyway.
And we also pressed fit in a piece of metal to have it stick out on the other side.
Right?
So it's sticking out here.
And that's simulating the static component of where that shuttle pin would be moving out.
The problem with this is the sidebar.
And these things here.
These finger pins here.
Which is that the entire key has to move.
Right?
So the entire key has to move to insert it and then to actually actuate that interactive component.
Or not interactive.
That's the multi lock term.
That moving component which medical calls the lift pin.
And we also need to have these standard finger pins riding along this sidebar here.
And what happens is when you move it to the side to insert it.
The finger pins are all now down here.
And they're spring loaded.
And so those finger pins act like a ratchet mechanism.
And it prevents you from actually moving the key over and actuating that.
Okay.
So that doesn't work.
So we need a way to get those finger pins lifted to the correct height.
And give them a little ramp to do that.
And our solution was to create individual ramps.
Right?
So we added these channels here.
And so now we have a ramp for the first.
The second.
And the third finger pin individually.
And so now we can get all of those lifted up to the correct height.
Right?
So that's there we are.
That's a bit of a close up there.
And so we can see this in operation.
And it works fairly nicely.
Right?
So it's interacting with those finger pins.
And pushing them up to the correct height.
Meanwhile the protrusion we press fit in.
Is pushing the lift pin up to the correct height.
The problem is.
The old problem with keys with moving elements.
It will not insert or remove from the lock.
Right?
So this protruding element.
It just is binding with these finger pins.
Right?
So it fits in the key way just fine.
But now these finger pins are in the way.
And we could make it thinner on the back side.
And mitigate it that way.
But there's just no more metal to remove.
This thing was paper thin already.
So because of the particular shape of the M4 key way.
We couldn't make that happen.
If the key way were ever widened.
Right?
And so this is a bit of wisdom with the M3.
That did have the key way widened from biaxial.
If the M5 has a wider key way.
This attack will start to work.
Right?
So it's now something that they can be aware of.
Which is good.
The other element is that.
Corrality matters.
With this.
And so for anyone who's ever tried to pick a medico before.
You know that if you tension it one direction.
The top pins bind first.
If you tension it in the other direction.
The side bar binds first.
And what was happening with using this technique.
Is that when we inserted this surrogate key.
The direction we had to twist it.
To move it in.
And cause this lift pin to actuate.
Is actually the direction that causes the side bar.
To bind hard.
Against these finger pins.
So we're now trying to turn it in a way.
That will set that finger pin.
While we're binding the side bar hard against it.
It made it not really a viable attack.
For that reason as well.
Okay.
So let's look at what we pivoted to.
When those didn't work.
We started to think out of the box a little bit.
And looking at the actual design of the lock.
This is the lift pin.
And there's this element here.
That can be pushed down.
And it's within the plane of where that key would insert.
Without a moving element sticking out.
It's just it has to get pushed down.
Deeper than the plane of the cores milling there.
So we need an overhang.
On our key to cause that to happen.
And so to make one.
We took pieces of metal and bent it.
So we have this little J shape.
And that allows us to create an overhang.
And then we added this little.
Little peak to it.
And so that peak.
The finger pins are able to ride over that peak just fine.
But it can push in.
And hit that little part.
Of the lock.
And push it down.
To get the finger pin to the correct height.
And it works.
Badly.
It honestly doesn't work very well.
It's like you got to try it a bunch of times.
And you know.
Out of ten.
You're able to get it to work.
And it's got to get perfectly positioned.
But it does in theory allow.
A blank to be mass produced.
That might not work great.
But does work.
So it's something that's potentially worth mitigating.
And this last element.
We just sort of had a stroke.
Of the idea there.
Fairly recently.
So this was only presented to Medeco fairly recently.
And so they're still in the process.
Of deciding.
Of going to mitigate it.
The mitigation is fairly straightforward.
You just deepen this.
Or possibly add sort of a bowl concave cut to it.
To prevent that from working.
And currently their response is.
They're leaning towards doing the mitigation.
But you know.
It requires tooling changes.
And things are further along the production schedule now.
So it is something that takes them a bit of time to figure out.
But you know.
So there's a good outcome here.
So we've got a.
Not a great attack.
But we're still likely going to mitigate there.
For the actual fabrication.
And I've talked a little bit about how.
You don't want to have.
You know.
From the lock maker's perspective.
They really don't want something that anyone can make.
Right.
So like those.
Those ones that you could buy on AliExpress.
They don't want that happening.
For their own keys.
And so to make it yourself.
If you can't have one that anyone can make.
3D printing is one option.
These are the two main types of printers.
Filament printers are just not detailed enough.
For printing most keys.
When we do it.
We'll print the blank.
And then add the cuts using traditional methods.
But resin 3D printing is absolutely the way to go.
For making keys.
It gives you ten times better resolution.
For making it out of metal.
Right.
So in this case.
Adding that J shape.
We were able to do with just a little clamp.
Except we had to.
Give the clamp some help with the hydraulic press.
So.
You know.
These fabrication techniques.
Are not necessarily something that everyone has the ability to do.
When adding the cuts to it.
Because these blanks are imperfect.
They come out of the clamp and bend nastily.
And you also would need a machine that's capable of adding these top cuts.
Which not everyone has.
Have to jump through all sorts of hoops doing it.
So.
When adding the cuts to this particular version.
We had to put.
Two things together.
One to prevent this clamp.
From pushing in the press fit element.
And misplacing it.
And another to give support on the bottom side.
Because this blank was paper thin at this point.
You know.
So it's not a trivial process.
And then we had to mill out a little bit at the end.
To allow it to insert all the way.
And have the tip warding not be a problem for it.
So.
You know.
In general.
These fabrications are something that you can do.
So.
It's the sort of thing that lock makers are considering.
When they're deciding whether to mitigate.
Is what is the effort required to actually carry out this attack.
And patents are effectiveish.
Against mass production.
Right.
Against someone in China going and making a version that does work.
Right.
In China you can't really control that with a manufacturer.
But you can at least control it on the import side.
And you can certainly stop someone doing that domestically.
Right.
So one of their key concerns.
With key control here was that.
Any attack we were able to successfully do.
Did not.
Allow someone to make this key.
In a way that bypassed the patent.
Right.
So a valid consideration there.
We'll chat a little bit briefly.
About some alternative attacks.
So things that people should consider.
Before they're worried about this.
And then some defenses available to you as well.
All right.
So this is one of the.
The gates of the New York City subway station.
And they've got two locks here you'll notice.
One is a high security medical.
With great key control on it.
One is a Yale.
And so Yale locks are.
The keys are not at all controlled.
And it's also this.
Which most people in this room will have heard of.
Is it's the same thing for.
For everything in that.
In New York City.
And people are getting it.
So it's something that.
You got to make sure that you're not going to be doing something like that.
If you're worrying too hard about the key control.
For one of your two locks.
You can also attack the.
The code card.
And so in this case.
What we've done is taken a multi lock interactive code card.
And it's just got the code stamped onto it.
And so we've just re-stamped it.
So on the original.
This 264S is the key way.
And we've changed it to 200S.
And so in this case.
You can see that little artifact there.
We didn't do it great.
But up here.
And we can change the full bidding on this.
And get a code card that authorizes.
A locksmith to create.
An entirely new key for us.
And of course.
The blanks are.
Once they're out of patent.
They're not necessarily as easy to control.
The sale of.
So you can buy these blanks on eBay.
And so these are two of the ones we bought.
And there's actually a bit of a story.
With this one up top here.
Which is that when we received this.
It had coining on one side.
For a locksmith that was actually local to us.
A locksmith that we knew.
And they were in business still.
Cutting multi-locks.
And so I reached out to them.
And I said like guys.
I just bought keys on eBay.
Coined with your business.
Is this right?
There's a bunch of things about this that don't add up.
They got back to me that very same day.
And said yeah.
This is not right.
There's clearly a problem here.
And so I blacked this out.
To not dox them.
Because they're an honest business.
Trying to do.
Standard locksmithing.
And they don't want to deal with all of this crap.
That us in the hacker community get up to.
But yeah.
So we reached out to them.
And they did some investigation.
And it turned out that three years before.
They had a package arrived by courier.
With more blanks in it.
And the package was manifested for 25 pounds.
And the delivery driver said.
Something's wrong here.
And it turns out at some point.
They don't know when or how.
Those keys got stolen out of the box.
In transit.
So talk about a supply chain vulnerability there.
So they reported it to Multilock.
And then when I reached out.
They were able to recover nine out of ten.
Of the stolen boxes.
From the seller on eBay.
That was just selling all ten of the stolen boxes.
Right.
And so when you happen upon stolen property.
There's no compensation owed to you.
For that.
That belongs to them.
But they insisted on compensating us.
And so I eventually gave in to that.
But that's something to be wary of.
When buying stuff on eBay.
That might potentially come from.
Less than upright sources.
So what can we do to defend against this?
Well the first one.
One of the first ones we thought of is.
Take the moving element.
Put another one beside it.
And have it go the opposite direction.
And now the key is actually widening.
And so that prevents us from moving the entire key.
Because it's getting wider.
Right.
So that's one option available to us.
Multilock actually has.
Already two moving elements.
This isn't for that purpose.
It's just so that you can insert the key in either direction.
And it's going to work.
But that's something that potentially could be.
Modified to apply this attack for.
There's a reason it can't.
There's a trivial work around.
If they decide to use this.
I've got a nice shiny new set of medical bump keys.
For the first person after this talk.
To think of what that trivial work around is.
And if you're watching this talk.
On YouTube afterwards.
Put it in the comments.
And I might send something your way.
So that's one option.
Another is these side bars.
So this side bar.
This secondary locking element.
Itself prevents motion of the entire key.
Because it interferes with the operation.
Of the secondary element.
So the medical M4.
As it turns out.
Is a great example of a good defense.
Against this particular technique.
The one that actually was valid.
Used a completely separate.
And happen stance vulnerability in the lock.
Right.
So the multi lock MT5.
Would have that defense available to them.
With the finger pin line on the bottom.
Except that those finger pins are not string loaded.
Which means that I can insert the key.
In one position.
And set all the finger pins at the bottom.
And set the top pins on top.
And there's no spring.
To spring the finger pins back.
And frustrate me there.
So the mitigation here is pretty simple.
Just add a spring behind.
Even just one of these.
And that's going to prevent this attack from working.
So a mitigation that's available there to you.
And if you happen to have MT5s.
You can even do this yourself.
Get a little tiny spring.
And stick that in behind that pin.
You'll have to drill it out a bit.
For stability as well.
So there are options available to you.
And the last thing is.
To defend against this.
You don't want to be laser focused on the wrong thing.
You need to make sure.
That there's no other glaring problems in your facility.
Before you're worried about.
Something as niche as this.
So here's.
I'm sticking a key in.
Key turns.
I open the door.
Well that's the wrong key.
That key is not turning in the lock.
The entire lock is turning in the door.
Because there's a retaining pin.
That's supposed to hold that lock in from doing that.
That has not been properly installed there.
We see crap like that.
All the time.
In facilities.
And so you really want to make sure.
If you are running a facility.
That you get all of that.
Looked at and fixed.
Before you're worried about extremely niche attacks.
Like what I've just talked about now.
So with that.
I'd like to thank everyone for listening.
If you have any questions.
I'm happy to take them there.
Thank you very much folks.