Ten New Things You Should Know About Lockpicking

Citation preview

^

Ten Things You Should Know About Lockpicking

by Deviant Ollam Event Name XXXX-XX-XX

Deviant Ollam http:// deviating.net / lockpicking

Who am i ?

Deviant Ollam http:// deviating.net / lockpicking

Who am i ?

Deviant Ollam http:// deviating.net / lockpicking

Who am i ? auditing assessments research trainings

Deviant Ollam http:// deviating.net / lockpicking

Who am i ? auditing assessments research trainings

workshops public lectures lockpick village contests & games

Deviant Ollam http:// deviating.net / lockpicking

Things You Should Know about Lockpicking… 1. Why locks matter to IT professionals

Deviant Ollam http:// deviating.net / lockpicking

Deviant Ollam http:// deviating.net / lockpicking

Deviant Ollam http:// deviating.net / lockpicking

Deviant Ollam http:// deviating.net / lockpicking

Deviant Ollam http:// deviating.net / lockpicking

All your hard work here…

Deviant Ollam http:// deviating.net / lockpicking

All your hard work here… gets undermined here

Deviant Ollam http:// deviating.net / lockpicking

Things You Should Know about Lockpicking… 1. Why locks matter to IT professionals 2. Pin tumblers are universal

Deviant Ollam http:// deviating.net / lockpicking

Pin Tumbler Locks

Deviant Ollam http:// deviating.net / lockpicking

Pin Tumbler Locks

Deviant Ollam http:// deviating.net / lockpicking

Pin Tumbler Locks

Deviant Ollam http:// deviating.net / lockpicking

The View From Outside

Deviant Ollam http:// deviating.net / lockpicking

What’s On The Inside

Deviant Ollam http:// deviating.net / lockpicking

What’s On The Inside

Deviant Ollam http:// deviating.net / lockpicking

What’s On The Inside

Deviant Ollam http:// deviating.net / lockpicking

It’s Not Just a Single Pin Stack

Deviant Ollam http:// deviating.net / lockpicking

It’s Not Just a Single Pin Stack

Deviant Ollam http:// deviating.net / lockpicking

The Key Has To Be Just Right

Deviant Ollam http:// deviating.net / lockpicking

The Key Has To Be Just Right

Deviant Ollam http:// deviating.net / lockpicking

Things You Should Know about Lockpicking… 1. Why locks matter to IT professionals 2. Pin tumblers are universal 3. Picking is simple and fun

Deviant Ollam http:// deviating.net / lockpicking

In An Ideal World …

Deviant Ollam http:// deviating.net / lockpicking

In The Real World …

Deviant Ollam http:// deviating.net / lockpicking

In The Real World …

Deviant Ollam http:// deviating.net / lockpicking

In The Real World …

Deviant Ollam http:// deviating.net / lockpicking

Setting a Pin

Deviant Ollam http:// deviating.net / lockpicking

Setting a Pin

Deviant Ollam http:// deviating.net / lockpicking

Setting the Pins

Deviant Ollam http:// deviating.net / lockpicking

Things You Should Know about Lockpicking… 1. 2. 3. 4.

Why locks matter to IT professionals Pin tumblers are universal Picking is simple and fun Pins are pins, in any arrangement

Deviant Ollam http:// deviating.net / lockpicking

Other Ways of Arranging the Pins

Deviant Ollam http:// deviating.net / lockpicking

Other Ways of Attacking the Pins

Deviant Ollam http:// deviating.net / lockpicking

A Fun Tubular Lock Story

Deviant Ollam http:// deviating.net / lockpicking

A Fun Tubular Lock Story

Deviant Ollam http:// deviating.net / lockpicking

A Fun Tubular Lock Story

Deviant Ollam http:// deviating.net / lockpicking

A Fun Tubular Lock Story

Deviant Ollam http:// deviating.net / lockpicking

Things You Should Know about Lockpicking… 1. 2. 3. 4. 5.

Why locks matter to IT professionals Pin tumblers are universal Picking is simple and fun Pins are pins, in any arrangement Other everyday designs are often weak, too

Deviant Ollam http:// deviating.net / lockpicking

Wafer Locks

Deviant Ollam http:// deviating.net / lockpicking

Wafer Locks

Deviant Ollam http:// deviating.net / lockpicking

Wafer Locks

Deviant Ollam http:// deviating.net / lockpicking

Wafer Locks

Deviant Ollam http:// deviating.net / lockpicking

Raking & Jiggling

Deviant Ollam http:// deviating.net / lockpicking

Wafer Lock Usage

Deviant Ollam http:// deviating.net / lockpicking

Wafer Lock Usage

Deviant Ollam http:// deviating.net / lockpicking

Wafer Lock Usage

Deviant Ollam http:// deviating.net / lockpicking

Wafer Lock Usage

Deviant Ollam http:// deviating.net / lockpicking

Wafer Lock Usage

Deviant Ollam http:// deviating.net / lockpicking

Wafer Lock Usage

Deviant Ollam http:// deviating.net / lockpicking

Wafer Lock Usage

Deviant Ollam http:// deviating.net / lockpicking

Wafer Lock Usage

Deviant Ollam http:// deviating.net / lockpicking

Wafer Lock Usage

Deviant Ollam http:// deviating.net / lockpicking

Wafer Lock Usage

Deviant Ollam http:// deviating.net / lockpicking

Warded Locks

Deviant Ollam http:// deviating.net / lockpicking

Warded Locks

Deviant Ollam http:// deviating.net / lockpicking

Warded Locks

Deviant Ollam http:// deviating.net / lockpicking

Warded Lock Usage

Deviant Ollam http:// deviating.net / lockpicking

Warded Lock Usage

Deviant Ollam http:// deviating.net / lockpicking

Warded Lock Usage

Deviant Ollam http:// deviating.net / lockpicking

Warded Lock Usage

Deviant Ollam http:// deviating.net / lockpicking

Warded Lock Usage

Deviant Ollam http:// deviating.net / lockpicking

Warded Lock Usage

Deviant Ollam http:// deviating.net / lockpicking

Warded Lock Usage

Deviant Ollam http:// deviating.net / lockpicking

Warded Lock Usage

Deviant Ollam http:// deviating.net / lockpicking

Warded Lock Usage

Deviant Ollam http:// deviating.net / lockpicking

Warded Lock Usage

Deviant Ollam http:// deviating.net / lockpicking

Things You Should Know about Lockpicking… 1. 2. 3. 4. 5. 6.

Why locks matter to IT professionals Pin tumblers are universal Picking is simple and fun Pins are pins, in any arrangement Other everyday designs are often weak, too You can open locks with beer and beatings

Deviant Ollam http:// deviating.net / lockpicking

Popular Padlocks

Deviant Ollam http:// deviating.net / lockpicking

Terrible Padlocks

Deviant Ollam http:// deviating.net / lockpicking

Padlock Shims

Deviant Ollam http:// deviating.net / lockpicking

Padlock Shims… From a Catalog

Deviant Ollam http:// deviating.net / lockpicking

Padlock Shims… From a Beer Can

Deviant Ollam http:// deviating.net / lockpicking

Padlock Shims

Deviant Ollam http:// deviating.net / lockpicking

Padlock Shims

Deviant Ollam http:// deviating.net / lockpicking

Padlock Shims

Deviant Ollam http:// deviating.net / lockpicking

Padlock Shims

Deviant Ollam http:// deviating.net / lockpicking

Padlock Shims

Deviant Ollam http:// deviating.net / lockpicking

Padlock Shims

Deviant Ollam http:// deviating.net / lockpicking

Padlock Shim Prevention Double Ball Mechanism

Deviant Ollam http:// deviating.net / lockpicking

Padlock Shim Prevention Which Padlocks are Protected ?

Deviant Ollam http:// deviating.net / lockpicking

Padlock Shim Prevention

Deviant Ollam http:// deviating.net / lockpicking

Padlock Shim Prevention

Deviant Ollam http:// deviating.net / lockpicking

Bumping

Deviant Ollam http:// deviating.net / lockpicking

Bumping

Deviant Ollam http:// deviating.net / lockpicking

Bumping

Deviant Ollam http:// deviating.net / lockpicking

Bumping

Deviant Ollam http:// deviating.net / lockpicking

Bumping

Deviant Ollam http:// deviating.net / lockpicking

Things You Should Know about Lockpicking… 1. 2. 3. 4. 5. 6. 7.

Why locks matter to IT professionals Pin tumblers are universal Picking is simple and fun Pins are pins, in any arrangement Other everyday designs are often weak, too You can open locks with beer and beatings Many locks are pick resistant

Deviant Ollam http:// deviating.net / lockpicking

Pick-Resistant Keyways

Deviant Ollam http:// deviating.net / lockpicking

Pick-Resistant Keyways

Deviant Ollam http:// deviating.net / lockpicking

Pick-Resistant Keyways

Deviant Ollam http:// deviating.net / lockpicking

Pick-Resistant Keyways

Deviant Ollam http:// deviating.net / lockpicking

Pick-Resistant Keyways

Deviant Ollam http:// deviating.net / lockpicking

Pick-Resistant Pins

Deviant Ollam http:// deviating.net / lockpicking

Pick-Resistant Pins

Deviant Ollam http:// deviating.net / lockpicking

Pick-Resistant Pins

Deviant Ollam http:// deviating.net / lockpicking

Pick-Resistant Pins

Deviant Ollam http:// deviating.net / lockpicking

Pick-Resistant Pins

Deviant Ollam http:// deviating.net / lockpicking

Things You Should Know about Lockpicking… 1. 2. 3. 4. 5. 6. 7. 8.

Why locks matter to IT professionals Pin tumblers are universal Picking is simple and fun Pins are pins, in any arrangement Other everyday designs are often weak, too You can open locks with beer and beatings Many locks are pick resistant Some locks are wickedly secure

Deviant Ollam http:// deviating.net / lockpicking

Side Bars Similar to side pins Restrict plug movement Harder to pick than pin stacks

Deviant Ollam http:// deviating.net / lockpicking

Side Bars Finger Pins

Deviant Ollam http:// deviating.net / lockpicking

Side Bars Finger Pins

Deviant Ollam http:// deviating.net / lockpicking

Side Bars Finger Pins Schlage Primus

Deviant Ollam http:// deviating.net / lockpicking

Side Bars Sliders

Deviant Ollam http:// deviating.net / lockpicking

Side Bars Sliders

Deviant Ollam http:// deviating.net / lockpicking

Side Bars Rotating Pins

Deviant Ollam http:// deviating.net / lockpicking

Side Bars Rotating Pins

Deviant Ollam http:// deviating.net / lockpicking

Rotating Pins Medeco Locks

Medeco plug exposed, key pins rotating to align sidebar cuts Top View

Side View Deviant Ollam http:// deviating.net / lockpicking

Rotating Pins Medeco Locks Totally shot now Can be picked Can be bumped Numerous weaknesses “Open in 30 Seconds” Marc Tobias Tobias Bluzmanis

Deviant Ollam http:// deviating.net / lockpicking

Rotating Disks Tremendous Security Mimics a safe lock Very Difficult To Pick Takes much time and great skill Specialized tools required

Deviant Ollam http:// deviating.net / lockpicking

Rotating Disks Tremendous Security Mimics a safe lock Very Difficult To Pick Takes much time and great skill Specialized tools required Two-in-One Tool Manipulates disks individually Decodes cut positions Barry Wels picking a rotating disk lock with Mike Glasser

Deviant Ollam http:// deviating.net / lockpicking

Specialized Rotating Disks Abloy Protec Not just rotating disks Disk blocking mechanism False cuts everywhere

“Unpickable?” Closest I ever come to using that word Two-in-one tools cannot be used

Deviant Ollam http:// deviating.net / lockpicking

Magnetic Locks Miwa Japanese company Array of magnetic pins Simple North / South Evva MCS Austrian company Axial-rotated magnets Interaction with sidebar

Deviant Ollam http:// deviating.net / lockpicking

Miwa Magnetic Locks

Deviant Ollam http:// deviating.net / lockpicking

Miwa Magnetic Locks

Deviant Ollam http:// deviating.net / lockpicking

Miwa Magnetic Locks

Deviant Ollam http:// deviating.net / lockpicking

Evva Magnetic Code System Possibly most duplication-resistant lock out there

Deviant Ollam http:// deviating.net / lockpicking

Mul-T-Lock

Deviant Ollam http:// deviating.net / lockpicking

Mul-T-Lock

Deviant Ollam http:// deviating.net / lockpicking

Mul-T-Lock

Deviant Ollam http:// deviating.net / lockpicking

No Known Attack or Bypass

Protec

MCS

Deviant Ollam http:// deviating.net / lockpicking

Things You Should Know about Lockpicking… 1. 2. 3. 4. 5. 6. 7. 8. 9.

Why locks matter to IT professionals Pin tumblers are universal Picking is simple and fun Pins are pins, in any arrangement Other everyday designs are often weak, too You can open locks with beer and beatings Many locks are pick resistant Some locks are wickedly secure It comes down to your attackers and defenders Deviant Ollam http:// deviating.net / lockpicking

Deviant Ollam http:// deviating.net / lockpicking

Deviant Ollam http:// deviating.net / lockpicking

Deviant Ollam http:// deviating.net / lockpicking

Deviant Ollam http:// deviating.net / lockpicking

Deviant Ollam http:// deviating.net / lockpicking

Deviant Ollam http:// deviating.net / lockpicking

Most Attacks are Brute Force

Deviant Ollam http:// deviating.net / lockpicking

Social Engineering

Deviant Ollam http:// deviating.net / lockpicking

Social Engineering

Deviant Ollam http:// deviating.net / lockpicking

Social Engineering

Deviant Ollam http:// deviating.net / lockpicking

Social Engineering Preparedness

Stop

Deviant Ollam http:// deviating.net / lockpicking

Social Engineering Preparedness

Stop

Challenge

Deviant Ollam http:// deviating.net / lockpicking

Social Engineering Preparedness

Stop

Challenge

Authenticate

Deviant Ollam http:// deviating.net / lockpicking

Social Engineering Preparedness

Stop

Challenge

Authenticate

Deviant Ollam http:// deviating.net / lockpicking

Social Engineering Preparedness

Stop

Challenge

Authenticate

… then you follow this with “Reward” Deviant Ollam http:// deviating.net / lockpicking

Social Engineering

Deviant Ollam http:// deviating.net / lockpicking

Social Engineering

Deviant Ollam http:// deviating.net / lockpicking

Things You Should Know about Lockpicking… 1. Why locks matter to IT professionals 2. Pin tumblers are universal 3. Picking is simple and fun 4. Pins are pins, in any arrangement 5. Other everyday designs are often weak, too 6. You can open locks with beer and beatings 7. Many locks are pick resistant 8. Some locks are wickedly secure 9. It comes down to your attackers and defenders 10. The truth is out there… or, rather, in there Deviant Ollam http:// deviating.net / lockpicking

Forensic Evidence

Deviant Ollam http:// deviating.net / lockpicking

Forensic Evidence

Deviant Ollam http:// deviating.net / lockpicking

Forensic Evidence

Deviant Ollam http:// deviating.net / lockpicking

Forensic Evidence – 250 uses

Deviant Ollam http:// deviating.net / lockpicking

Forensic Evidence – 1,500 uses

Deviant Ollam http:// deviating.net / lockpicking

Forensic Evidence – 5,000 uses

Deviant Ollam http:// deviating.net / lockpicking

Forensic Evidence – 250 uses

Deviant Ollam http:// deviating.net / lockpicking

Forensic Evidence – 1,500 uses

Deviant Ollam http:// deviating.net / lockpicking

Forensic Evidence – 5,000 uses

Deviant Ollam http:// deviating.net / lockpicking

Forensic Evidence

Deviant Ollam http:// deviating.net / lockpicking

Forensic Evidence

Deviant Ollam http:// deviating.net / lockpicking

Forensic Evidence

Deviant Ollam http:// deviating.net / lockpicking

Forensic Evidence

Deviant Ollam http:// deviating.net / lockpicking

Forensic Evidence – picking

Deviant Ollam http:// deviating.net / lockpicking

Forensic Evidence – raking

Deviant Ollam http:// deviating.net / lockpicking

Forensic Evidence – both

Deviant Ollam http:// deviating.net / lockpicking

Forensic Evidence – ugh

Deviant Ollam http:// deviating.net / lockpicking

Forensic Evidence – wow

Deviant Ollam http:// deviating.net / lockpicking

Forensic Evidence

Deviant Ollam http:// deviating.net / lockpicking

Forensic Evidence

Deviant Ollam http:// deviating.net / lockpicking

Forensic Evidence – bumping

Deviant Ollam http:// deviating.net / lockpicking

Forensic Evidence – bumping

Deviant Ollam http:// deviating.net / lockpicking

Security is only as effective

… as the people behind it Deviant Ollam http:// deviating.net / lockpicking

Thank you very much.

Special thanks to TOOOL, Babak, and Daisy

http://deviating.net

http://enterthecore.net

http://toool.us

Deviant Ollam this presentation is CopyLeft by Deviant Ollam. you are free to reuse any or all of this material as long as it is attributed and freedom for other s to do the same is maintainedhttp:// deviating.net / lockpicking