hello everyone next topic is
lock-picking 101 102 Bezos thanks why
and this if you were here last year this
is the the same as the long presentation
last year so you know there really need
to do it again and hopefully Nina and
Joe are gonna show up at some point I
don't see them but they have a bunch of
locks and pics so people can actually
play in practice with them so it's not
just listening to a lot of stuff Plus
also this slide deck was very kindly
given to me by tool Boston the Oakland
organization of lock Vickers the u.s.
chapter so I can take no credit for the
visual materials I'm just gonna go
through through their deck and so I'm
leaving some of their stuff which which
is important to them such as the their
rules
don't pick locks which you don't own
there's actually a good reason for that
it's not just like you know we should be
nice it's because picking actually
damages locks to some extent so it's
possible to pick a lock to the point
where it doesn't work so it's nice to
just only do that to your own stuff and
other people's and that's also the
reason for rule number two if you rely
on the lock every time you pick it
you're damaging it a little bit and
eventually the proper key might not work
on it there's a few different kinds of
ways to open locks you can pick them
open you can do some sort of quick and
dirty bypass and then there's the real
covert entry high-tech thing so tool
does lock picking criminals do quick and
dirty and spies do the covert and
high-tech stuff so total teaches people
how to pick locks and they're very big
in Europe I don't know if there's a
chapter here in Serbia Serbia but there
are a lot of a lot of tool people in
here in Europe for quick and dirty to
tell you about it but don't doesn't give
you the tools
then you know nothing to do with the
covert and high-tech stuff but anyway
lock-picking is easy and fun
and most of what we'll talk about today
a pin tumbler locks because those are
most of the locks that you see on most
doors most padlocks this is what they
look like from the outside so you can
see kind of a wiggly slot that the key
goes into that's called the key way and
you can just see in the front there the
start of one of the pins so here's like
a graphic of what the pin tumbler lock
looks like from the outside and if you
just slice away that first part of the
lock what you'd see there is the first
pin stack and so there's a bottom pin a
top pin and a spring and the bottom pane
and often called the key pin that's the
one that changes lengths depending on
the bidding of the key the bidding
meaning you know the the heights that he
is cut to the top is to drive the pin
and then above that that spring is what
returns the lock to its original state
when the key is removed so I'm not sure
if I remembered now if I have to press
space to make these animations work
there we go if you try to turn the lock
plug without putting the key in that top
drive a pin prevents it from moving it
blocks the rotation of that plug if you
stick a key in there it will raise the
key pin to the correct height so that
now there is a gap that's aligned with
the outside of the plug that's called
the shear line and that allows the plug
to rotate so that's totally how the lock
works with with pin number one and then
if we look at it from the side we can
see all of the pin stacks some locks
have three or four pin stacks some have
five six seven depends on the lock so
once again
the key comes in raises all of the key
pins to the shear line and then the the
plug can turn and lock and open and all
of those have to be in exactly the right
place
so if that key is not correctly cut by
even one bidding so you can see here one
of them is too low and now not all of
those driver pins line up at the shear
line and so the plug won't turn same
situation if we've got one getting too
high so the key means if you cut
correctly or the lock doesn't open if
everything was perfect if everything was
drawing like a CAD model everything
would be perfectly in alignment here and
when you turned the plug without a key
in it all of those top pins all those
driver pins would bind at the same time
right buying meaning to stick and so if
you were to try and move those pin specs
that all be stuck when you're applying
tension to the lock but we live in the
real world where things get manufactured
to a tolerance and so that's what the
holes in the plug really look like they
are not exactly perfect same for the
pins they have defamations and and
problems with it so when you turn the
plug to provide some tension on the lock
it's as likely as not only one of the
pin stacks will bind so that means we
can check the state of that pin stock
without picks so here you'd from the
front of the lock if this pin is binding
and now we puts push up that stack then
we are able to detect the point at which
we encounter the she line so watching
that again as that set comes up you can
see we get a little movement out of the
plug when we hit the shear line and then
after that point we call we call that
the driver pin being set so after that
happens it's gonna be locked in place
and now the bottom pin can just fold
down freely and we'll be able to see
that jiggling up and down or you can
shake the lock and jiggle it and I'll
push it with with your tool whatever and
so to do that for a complete lock we
just do that process over and over again
so the piece that just came in at the
bottom there that's our tension tool
that's what we're using to apply a
torque to the lock and now we use our
pick to test some pins these ones I'm
moving you know more or less easily but
this one has got some tension on it
because it's binding and then we can
click it into place now a different pin
is binding
and so this process just repeats finding
the binding pin until eventually the
lock will open I let the animation play
and this animations been developed as
though we're not keeping track of which
one's binding so sometimes it'll go and
tests some of the ones that have already
been set and hopefully yes do the last
one quickly and then the lock turns so
that's what we that's basically what we
want to do to pick a pin tumbler lock
one of the things we have to watch out
for is over lifting so that's where
we're tension that lock and we're
pushing up the pin stacks and it's not
that difficult to quickly whip one of
these up above so that the key pin ends
up above the she line I think it'll be
on the last one here in this animation
and so now there's nothing that we can
do to open this lock
even after we you know test all the
other ones so the right thing to do like
you just saw is if you're picking a lock
for a while and you think you might have
over lifted a pin and it's not gonna
open just release some tension a little
bit let let those set pins click back
down again and start again so though the
lock pick that we just saw views in
those example is just a hook pick so
it's designed to actuate one pin stack
at a time but there are lots of other
types of picks so for example this is a
rake and what you're doing with raking
it's basically you're playing the odds
you're doing kind of a probabilistic
approach and you're wiggling around all
these pins at once and hoping that they
they set and then the lock up so you can
and when you're lucky rake open a lock
really really fast but raking can be not
so effective if the bidding of
neighboring pins is very different right
if so if you need to move
one pin some small amount and the other
one allowed your mount right next to it
the rakes not necessarily going to be
able to make that happen the half
diamond so here we've got a hook half
diamond and wreak on the screen and one
in the middle is the half diamond the
half time is pretty cool it's like if I
only have one pick on me it would pretty
much be a half diamond because you can
lift pins with it you can also sort of
rake with it by shoveling back and forth
and that's causing pins to flip up and
down and you can count pins using the
flat on the side so you flip the pick
over put it all the way in lift all the
pins up and then as you pull this back
you'll hear or feel or both click-click
click-click
as those pins drop down and that lets
you know how many pins you're dealing
with in the lock the tension tool
sometimes these guys call it the turning
tool it's just basically an l-shaped
piece of metal and usually you won't
want to pull on the tension tool by
using your thumb instead push it with
your finger from the other side it's a
better technique and the further out you
can push it the more leverage you have
and that gives you more control you're
not longer certainly because you want to
push that cylinder around really really
hard
but you just want to be able to apply
more or less force and that's easier
with more leverage and so a good rule of
thumb or a rule of finger if you want is
to sort of look at the color of your
finger when you're pushing on it so here
you can see the finger is still pink but
if you're pushing too hard you've got
white at the end of the finger you're
probably putting too much pressure on
the lock because you have to make the
set pin move right so the how do you
bind that pin the more difficult is
gonna be to lift it with your with your
pick and so putting too much tension on
the lock is gonna work against you
you can usually use these tools that's
turn by at the edge of the plug so
sliding in the bottom there and you're
turning tools look like this
well they've sometimes they've got a bit
at each end sometimes they're folded
over or folded and twisted the one on
the left is folded and twisted the one
all the way to the right is just folded
a lot of this is just personal
preference what you end up liking so
this is a good reason to mess around
have some fun and see what you like they
come in different widths because when
you've got a tension tool jammed in the
in the key way that takes up some space
that's a pet in that space that you
can't use to put your pick in so
sometimes you can get these slimmer
profile ones that take up less space in
the QA that's a no-show it's showing
that's the the room you've got to move
in and then you can also there's a slide
later on use one that turns from the
center of the plug instead if you need
that bottom space in the keyway be
careful here you don't want to jam it
into the bottom of the keyway because
then you're causing friction that's
actually preventing the sealing on
different turning now here's an example
of the flat turning tool on the right
that you can turn from the center of the
plug occasionally useful because it
gives you more space to work with but
you're still you know blocking some
movement of your of your pick if your
pick has a is itself wide it might run
into the bottom of the tension tool
there so it's not it's not the kind of
magic thing that's is like well why
don't we just always use that because it
does still block the key way to some
extent not all locks open in the same
direction so that's a it's good to sort
of you know have an idea of which way to
be turning it so it's gonna gonna unlock
it padlocks are often in the clockwise
direction
door locks are often the other way
except force legs which is clockwise
again deadbolts usually go both ways so
it depending on which is handedness the
door is so if the latch is on the right
of the door then the deadbolt is gonna
retract counterclockwise most likely and
then clockwise if it's on the left
if it's on the left-hand side of the
doorway I will just skip through this
stuff because this is for the tool
lockpick village but tool sells these a
range of practice locks and they have
different numbers of pins and different
difficulties they have some anti picking
things which I'll gets you later and
they tell you which is the front in the
back and on those practice locks either
directions will work so when you're
getting started and again hopefully
we'll have some stuff set up outside
after this practice lifting a pin with
the pick practice tensioning the lock
and getting pit and getting um pins to
bind practice finding the binding pin
and track this practice different types
of lifting sometimes you want to lift up
directly sometimes you can sort of rock
it and you can use the bottom of the key
ways for a bit of extra leverage and
just relax and tell people when you got
the lock open I'm just gonna move past
questions but you can shout out
questions if you if you have them
interrupt that in mind
another type of lock that you'll see a
lot of is wafer locks so wafer locks
work basically the same as pin tumbler
locks except instead of pins the pieces
that interrupt the lock are stamped
pieces of metal so flat pieces of metal
they call wafers so that's what one
that's got its case removed looks like
and you can see all of those flat metal
wafers sticking up out of the plug and
they can move up and down so if you look
at it from the front you see the front
of the of the lock and then you can see
the red piece there it's one of the
wafers you slice away that front of the
lock you can see what a wafer looks like
it's kind of an oval it's got a piece a
rectangular piece at each end which is
what interrupts the rotation of the of
the keyway and then the piece in the
middle where that rectangle is cut out
is like the length in the case of the
pin tumbler lock like the length of the
key pin so that determines when you put
the key in how much this gets pushed up
such that it ends up in a place where
the two sheer lines are aligned and the
lock can rotate so this is just like an
easy and cheap way to make locks you
don't need two pins per stack you don't
need Springs you can make these locks
very very inexpensively and so that's
why you find them on filing cabinets on
you know electrical panels you know
stuff that is not necessarily high
security and and these can be picked
generally pretty easily you can use your
regular lock picks on them and then you
can also buy specific lock picks for
picking wafer locks and especially wafer
jigglers that you can buy a set from
places that sell lock clicking tools and
they're just like a set of a few
different keys that'll fit most wait for
lock so you just put them in and jiggle
them around and usually these things
will open very very quickly
come bow locks things which you find a
lot of time around the place especially
this the master combination lock which
is infamous for being very very common
you know school lockers and stuff like
that and also really easy to bypass in a
couple of different ways so if you're
put one of these on your locker you're
basically just telling people not to
open it because if they try they will
open it really easily it was fun last
year when I gave the short version of
this at the start of the conference
someone came along with one of these
locks that they'd forgotten the
combination for so we got to practice
all of these techniques for opening it
the easiest way to open that is with a
padlock shim so this is a very slim
piece of metal that you slide down the
hospice shackle of the lock and it just
pushes the latch out of the way it's
just kind of like using us using a
credit card to open a door you can make
these really easily out of a can so get
one of those yellow beer cans that
everywhere here and kind of cut a piece
of aluminum off the can fold it over and
then you've got yourself yeah a nice
disposable shim this won't work a lot of
times because aluminum is soft but it'll
work long enough to open one lock bend
it around the body of a ballpoint pen
and then you've got a free padlock shim
and then you just slide that down this
works on like most of these types of
padlocks on the the master lock the the
latch is on the left the one we found
last year and we opened with a shim the
latches on the other side so you might
have to try both sides of the padlock to
get this to work and then it'll just pop
right open so these are super easy and
this is
opening some truck lock with a Guinness
can padlock shim kaboom
sometimes you need to Siam's some of
these padlocks have a latch on both
sides
lots of padlocks that are better quality
and more expensive
you can't shim they have this double
ball bearing mechanism so you can see in
this diagram the two ball bearings are
inside the cutaways in the shackle the
shackle can't come out then that big
chunk of metal in the middle when the
key rotates that rotates and allows the
ball bearings to slide inwards and the
thing opens but when the the key when
the lock is locked when the key is not
in there in turned that big piece of
metal is blocking the ball bearings they
can't move so there's no way to push
them out of the way with a shim so you
can't shim this type of lock and this
slider the one on the right is the one
that you'll typically see on it on a
double ball padlock and then is that you
can you can actually buy a lot of
cutaway versions of all these locks
really cheaply now China for whatever
reason has fully got into the lock lock
Smith teaching tools game and so on
Amazon there are all these acrylic
bodied see-through transparent locks and
you can get a full set you know for
fifteen or twenty dollars including disc
detainer with double ball bearing and
various just pin tumbler padlocks and
you can see what's going on they're
really really handy and fun for
practicing lock picking because you can
get the visual feedback this is kind of
fun
the way to decode the combination for
these master locks many types of
mechanical combination lock and like you
know bad safe locks a subject to attacks
by feeling what the lock does as you
move the combination dials around you
know you could get that kind of tactile
feedback and the usual way that you do
this is you put some tension on the
shackle and
some some times that I've seen some
sites advocate putting a string around
it and that way you can slip your hand
in that string and just really you know
have a lot of leverage on that while you
manipulate the dial you put some tension
on it and then you rotate the lock first
thing by the way you have to do is to
spin this lock clockwise about three
times so that you have reset the lock
but then you're gonna rotate the dial
and feel where it seems to stick when
you've got some tension on the shackle
and it'll stick for every stick position
it'll actually stick a little bit either
side of the true position so you sort of
feel where it starts the stick and then
you go from the other side and you feel
where it's not just to stick and get an
idea of either side of the sticking
point and then write down what's in the
middle of the two sides of that sticking
point so in this case you know if we've
got it stucks T starting to stick it for
and sign just to get six then our
sticking point is five but be aware with
this type of lock that in a bunch of
cases the sticking point is are going to
be at a fractional point it's going to
be at the half point the either side is
gonna be a number and a half and the
middle is also gonna be a half and then
you're gonna write down all the places
where it sticks for this type of master
lock that should be twelve sticking
points and what we're looking for is the
odd one out
English idiom the black sheep of the
family so we're looking for a number
that's a whole number we're not gonna
worry about the fractional numbers and
that doesn't have the same last digit as
the other whole numbers that we found so
let me go back here if we look at this
one we can see we've got a lot of
fractional ones on either side and then
in the middle all the ones have a last
digit of five so there isn't an odd one
out here so that means we it up
somewhere and we didn't get exactly the
right sticking points so go back you
know look at our fractional sticking
points are we really sure that they're
all in the right place
no we got this one wrong it's really 23
and that's the one we're looking for
that's the odd one out because it's not
a fraction it doesn't have the same last
digit as the other whole numbers that's
the one we want and this gives us what
we can call a magic number the magic
number is the modulo the modulo four
divisor this number so you divide the
number by four and the remainder is the
magic number so in this case it's a
three and now that's the that's gonna be
the last number of the three digit three
number combination right so to open
these locks you seven - three numbers
twenty-three is our last one and three
is our magic number and so now we can
come up with 20 possibilities for the
first and the second number based on
this so for the first number we start
with the magic number and then add four
repeatedly to it and that's our that's
our ten possibilities we know the first
one is 3 7 11 15 so on up to 39 and then
for the second number if a magic number
is a 0 or a 1 add 2 to it or if it's 2
or 3 subtract 2 from it and then add 4
in sequence and so what we have is a
hundred things to try because we know
the third number and so you know this
little bit of arithmetic followed by
just trying these combinations you'll
probably decode the combination in you
know maybe 15 minutes something like
that so that's kind of fun and of course
once you have the combination it always
works unlike shimming it open then if
you lock it you've got a shimmer it
again this time you've got the
combination and so you can you know
secretly open this lock whenever you
want to and this this type of technique
works for
a lot of other types of locks too not
the same one with the magic number and
all that kind of stuff that's unique to
the master combo lock but putting
tension on the shackle and feeling for
where different wheels bind and where
the shackle moves a little bit that's
just a great technique in general for
decoding combination locks
so I said before with next at some point
we'd get to pick resistance so give us
back to pin tumbler locks again so you
know everyone knows that this lock
picking these lock picking methods work
on pin tumbler locks so lock
manufacturers have made ways to
developed ways to try and make it harder
to pick things so the first kind of line
of defense is to choose the right key
way a key way that's got a lot of open
space on both sides has a lot of room
for picks to move in that makes life
easy we can make things a little bit
more difficult by making the the key way
a little ball a little more funky shaped
or making it really really thin and
curvy we can make it really hot you can
see that with not a lot of room to move
a pic around in and then something like
this that really really makes it tough
to put a pic in there and move it up and
down so you know it sort of depends on
the security level of the lock but let's
say given a normal fairly simple key way
we can also make the pins resistant to
picking so this is one of the
common pick resistant pins it's called a
spool pin because it looks like a spool
spool of thread and the spool pin allows
the lock to turn even when you know a
little bit even when the driver pin is
not at the shear line so we don't we're
not able to detect on that pin stack if
we're in the right place or not because
the locks gonna turn anyway
see ya so even when we even when we push
that pin up we might think we're in the
right place but it's finding at a place
with a lock point turn so if you're
trying to pick a lock with a spool pin
in it it's poking is a little bit more
expensive to make so often a lock will
add security by just adding one spool
pin there won't be an older pin stack so
if we think that was a spool pin and a
lock we can still try to pick it because
we can sort of mark on the key way where
the zero point is and we can see the
lock move both sort of both sides of the
spool pin when it's in there when it's
in the correct binding the setting place
and when it's not and so we can relax
ease off some of the tension as we lift
that spool pin this animation here is
assuming that it's the last pin that we
need to pick that we have the other one
set and we can sort of back off a little
but it's you know easier said than done
because the other pins are gonna gonna
drop down when we release the tension so
you have to sort of develop an idea of
what you think that spool pin is but
spool pian locks are still definitely
pickable there are other kinds of pick
resistant pins that we see the mushroom
pin which is similar similar to a spool
the serrated pin I have a lot of trouble
with these I found a lock the other day
on the road and have padlock come like
all cool practice picking and it turned
out to be some high-security padlock
where every single pin was a serrated
pin and so these pins just buy in
constantly every everywhere they are
they Jam in and you once they jammed you
can't lift them it's very difficult to
tell whether real line is and actually
so I pick up this padlock it was open I
locked it and then I haven't been able
to pick it open yet I've spent like a
couple of hours on this lock and having
been how to get it back open again
because it's all serrated pins not that
I'm the greatest lock taker but
then there's after has this sneaky pin
which has it's kind of a double spool
and then these are these are like vendor
proprietary pins there's a double
mushroom as well and yeah these these
really make picking a lot more difficult
you can still pick them but you have to
be very skilled or be very lucky like
you can maybe rake them open and then
just happen to get it the right way once
and then you know spendin how it trying
to do it a second time
another kind of interesting attack that
became super popular
I know 15 years ago or something like
that bump attacks you might have heard
of bump keys so the bump key is
basically a special kind of key that's
been cut down all the way and all of the
bidding and then had its shoulder a
little bit shaved off and then you need
a little bit of skill to use them but a
lot of locks that otherwise a pretty
high security a vulnerable to bumping
and it's related to physics it's related
to physics like you'd see on a billiards
table pool table so you know you know on
a pool table when you hit two bowls that
are touching each other sorry I messed
up the animation here here we go
the three ball there in that animation
doesn't move because all of the force is
transferred through it to the next ball
and it's the one that moves and this
technique is used in these pic snapping
guns that you might have seen sometimes
how I see sharp in the movies you know
some spy movie or something doodle just
stick this gun in the lock and gesture
and it'll open and how that works is it
whacks all of the pins at once with that
little snapper thing and just like the
the pool balls that impulse force to the
bottom pins is transferred to the driver
pins and they all very briefly flung up
above the shield line and so if you turn
that plug at just the right moment when
all the driver pins are up above the
shear then the lock will open
it's a close-up of that mechanism so
bumping works the same way you're using
the ridges on that deep cut key to slap
those pins as you in this case jam the
bump key in or you can also do it the
other way and pull the you know have the
key only go a little bit in so this is
one we have the shoulder of the key
filed down a little bit so that the key
goes in a little further than it
ordinarily would and so what's not shown
in that animation is you're not just
pushing that key in by hand you have a
little hammer and you tap it and that
knocks everything up and you tap and
turn it in just the right timing and the
lock will open and even relatively high
security locks like medicos and so on
have been subset susceptible to bumping
attacks here's an example you know sort
of going back to the beginning if don't
do this two locks you want don't own so
here's an example of a lock that's been
bumped to destruction you can see the
cracks and and dents there where people
have just been whacking into this lock
there are some countermeasures to stop
bumping from being effective so one way
is to have a driver pin that has a
little shelf on it and sits above the
keep in there so that when they're when
they're bumped there's not an animation
for that one that final pin will jump up
but it won't transfer the force fully
that last pin it won't lift that last
pin so there'll be one pin stopping the
lock from opening still and then you can
also get these anti bump driver pins so
this is a pin that has a different
spring and different mass and so it's
not going to move the same way as all
the other pins do when they get bumped
it's a picture of that
and you can see online you know these
bump resistant cylinders and conversion
kits to make locks bump resistant this
is just a bunch of slides on like
resources where to find locksmiths and
tools which I'll just skip through
because I'm sure they have no relevance
to Serbia you guys will have to find
where to get tools and supplies from the
thing with picking is once you're done
the lock is open but if you lock it
again you have to start all over again
right and maybe you just got lucky and
raked it open and it's a really hard
lock to pick and maybe you could take a
really long time to open again so it
doesn't give you any kind of future
access to the lock the exception that I
make slides on it ah the tubular lock
picks so you know the tubular locks that
are often on bike locks vending machines
in Wills talked yesterday on freaking
elevators most of the elevator panels
that he showed had tubular locks on them
they you can get picks for those who and
they are basically an impression a tool
they have a bunch of little pins that
have like a rubber band putting some
tension on them and you manipulate them
into the lock and once you get it open
the position of those pins is set and
you can use that if you don't reset your
tubular pick you can use that to open
that lock and over and over again so
you've basically got an impression of
the lock and you can do impression with
a blank key for a normal pin tumbler
locks to and end up with a working key
so that's why at the end you've got a
key so what you do is you start off with
a bland uncut blank and push that in
there so that all of the pin stacks are
raised to the maximum point and then you
turn you know what's not gonna open
right all those key pins are above the
shear line but if you turn it real hard
then are you gonna bind at least one of
those key pins hopefully just one
and then wiggle the key and you're gonna
cause some rubbing on the top of your
key and then you take your blank out and
you look at where the rub marks are so
right here we've got two spots where
they rubbed and we fouled them down a
little bit so you get a little tiny file
file down the key whether up with a the
back side and then keep doing it still
still binding at one point still getting
a rubbing then look for our marks file
down a little bit more and keep going
and at the point when one the pins back
stops binding you'll get a new mark from
somewhere else so here we've got a mark
from this stack but not from step four
and then also a new one here so you know
we've filed down the new marks we've
we're done at the ones that don't don't
have marks this can take a while this
let's see can I see the mark
but he I think starting from the
shoulder one two three four or five
i thinkyeah to that little tiny marker
there so you know this is such a skill
it takes some practice and it's a lot
easier to do like with these guys in
competition if you can put the lock in a
vise and then you've really got some
ability to wiggle this key and make
marks on it but you can make a working
key doing it that way and to Lauren's
competitions doing this stuff I think
there's a video here
will it play
No all right well anyway spoiler alert
he does it a few times and files down
the key and the key works a lot of
systems in you know real facilities like
buildings stuff like that are mastered
so if you've ever wondered how master
keen works this the next bit will
explain it
mastering the point of doing it is so
that you can give everyone keys to their
own office but the cleaning staff can
get into all of them right or the
building manager can get into all of
them or different areas can have
different cleaning staff that can get
into all the rooms so you need a single
lock that will be opened by several
different keys and the way that works is
we introduce a new type of pin so we
have key pins we have driver pins and
now we have master pins which are
usually these little thin slice pins so
we can see here that a key that lifts
the key some of the key pins to the
right height and some of the key plus
master pins to the right height will
open the lock but for a get so for a
given stack you know we can open this
unmastered one here on the right with a
single key that's cut to a 1/8 bidding
depth but if we put it if we could
convert that 8 to a 6 and a 2 for the
two master we can now open that with a
key that's cut to a depth of 8 like the
original key or one that's cut to a
depth of 6 of that position the thing is
with mastering is that obviously it
makes the lock a little bit less secure
because more types of keys can open them
but it turns out actually makes the
system a lot less secure because we can
figure out if we have if we have a
working key to a lock we can figure out
what the mastering depth is the master
bidding depth and so we can actually you
know this is a fun thing to do if you're
if you're bored at work and you work in
such a facilities you can figure
with the master key is for your own
office by getting by getting blanks and
then filing them down progressively to
figure out what exactly the master
bidding depth is so run through that so
if we we know that we have a four eight
four two six that opens it so now if we
get another one cut and you can go to a
locksmith and you at least in the US you
ask for a key cut to code so if you know
what type of key it is and you you know
the bidding depths you just tell them
that code four six four to six like you
say oh I don't want Ashley C cut to four
six four to six and I'll do it for you
as long as it's not a restricted key a
restricted blank key and oftentimes
they'll do it for you anyway
depends on the locksmith or of course
you can buy some blanks online you can
do it yourself but so we know our office
key is a four six four to six but we're
gonna cut ourselves a four zero four to
six and then we try it it doesn't work
we cut it down a little bit we try it it
doesn't work cut it down a little bit
more in the two position still doesn't
work eventually we cut it down and it
opens so I guess I got the original key
was a four eight four to six but now we
know that four six four to six also
opens the lock and so we know there's a
height to master pin in the second
position in that lock and we can repeat
that for all the all the pin stacks in
our key and then we've got a master key
to the building and we can go and break
into everyone else's office cool
and that was originally published 2003
by Matt blaze lost the key lock
vulnerability and that this absolutely
works on any master key pin tumbler
system
as long as you do it right and you file
down you know get a get a vernier
caliper or a micrometer and you file
down to the correct differences in
bidding of your key which for a Schlage
is I think fifteen thousand seven inches
between adjacent numbers of bidding
depth but you can look it up to whatever
the type of lock that you have here is
just sort of an overview of different
types of picks if you go to one of these
corporate conferences which have
sponsors and vendors unlike balkon which
is more community oriented but many of
these conferences will have lockpick
vendors and stuff in the in the vendor
village and they'll you know sell these
sets and I have like 50 different types
of lock picks and you're like what the
hell are all these good for I mostly
just use a half diamond well anyway
here's his what they're good for and you
can also of course get this stuff online
and you you know you'll get these
beginner sets advanced sets like master
sets we've got tons of lock picks and
it's like you know what do i what do I
use these all for any also it might be
made out of different stuff - they may
usually may have a spring steel which
rusts probably about as common stainless
and then you know you can get your you
can pay a lot of money if you're a
titanium picks or whatever if you want
that regular stainless is is usually the
way to go and different thicknesses -
but if you're like really into this
stuff you might care and then you will
often see stuff design described as
standard profile or euro profile which
usually refers to the sort of shape of
the shoulder of the pick they're the one
place I care about that is I always get
a few euro tension tools because they
narrow down at the point where they go
into the key way and so often especially
with cheap padlocks there's that there's
often a very narrow space at the base of
the key way and the euros the euro
profile tension tools will fit in there
nicely whereas the normal ones won't
so here's lots of different types of
pics we saw these already and all the
demo animations these are the hooks and
you can get all kinds of different
shapes of hooks I would say mostly your
kit should probably include a short hook
and a medium hook the difference that
you care about in hook length is when
you're reaching past pins that are not
binding and you want to lift a pin
that's just binding sometimes you want a
longer cook and sometimes you don't this
depends on the lock so you know typical
and awesome the descriptions there if
the short hook and the gonzo hook
I've never purchased the guns the hook
I've never even seen them in the place I
buy pics from but along a long hook is
useful we have these also reach tools
you know forgetting past when you're
dealing with locks with a lot of pin
stacks then your diamonds you can also
get different different shapes mostly a
[Music]
standard sort of studying kit we'll just
have ones one size of diamond that's
usually enough and it seems to be no
real point to having a diamond on both
sides because then you can't use it to
count pin stacks and you can get these
ones that are sort of offset so again to
help you reach past and into the back of
the lock when you're getting getting
past them some pins that are in the way
in the front
then these ball profile which is you
know sort of like a in my opinion sort
of like a diamond but maybe less useful
I didn't know this says Ken this says
the Snowman can be useful but I didn't
really know when I never really found a
good use case for those that's just you
know when I when I get a kit that's got
these in them I usually just like now
either never use them or just take them
and take them out to save space but
maybe maybe some people find them useful
these yeah raking tools many many
different types of rakes so you'll
normally get like a C rake in any
beginner kit and you know you're raking
action I don't personally tend to have a
lot of success with the with a standard
the standard rakes but I don't know I'll
show another one that I like better in a
sec one thing to look for like you can
see this one if them if a lot of metal
has been cut out of the pick itself
eventually you might be left with a
weakness that can snap off inside the
lock and then your that kind of really
sucks because now you've got this piece
of metal jammed in the lock that's very
very difficult to retrieve and if you're
you know violating the rules and picking
a lock you don't know and then the owner
is gonna find that that key doesn't work
anymore and because there's a piece of
metal stuck in lock and they're gonna be
know that someone's been messing around
with their lock these are the types of
like lifter rakes that I really like and
so the difference here is you know you
normally just wiggling this in and out
more or less maybe at a different angle
with a rake but with a lifting tool you
sort of like lifting all the pins at the
same time as you do it
and so this el rake is other ones that I
really like or at least I use I think I
feel like I have more success you're not
being scientific about this or anything
I just use use it for a while and see
what happens but I feel like I have more
success with an El rake than with us
see rake so eat you Kitt's done off
don't always come with an L rake in them
that I always buy one separately and put
it into a kit because I tried it I keep
a kid in every backpack so I've always
got a set with me and you know
individual picks are actually really
cheap so you can just get a basic set
and then add one of your one or two of
your favorite individual picks to them
these I've never seen in person the king
and the queen so I have nothing to say
about them but one of these ones that
people really really like in the Loch
sport world of the so-called Bogota
rakes which I guess were developed by a
Colombian guy Raymundo and so these
things are sort of like in-between a
rake and a lifter and they started off
as a kind kind of jiggler tools and you
can get various types of jigglers too
from vendors of lockpicks and what you
basically do with them it's sort of
in-between what you do with the rake and
with a lifter you sort of put these
things in there and you just wiggle them
around and you they usually sold in sets
of jiggler tools and so you'll try one
and wiggle it a bit and if it doesn't
work you try another one again you're
sort of playing the odds you're doing
the probability of like if I if I just
like manipulate these pins enough
eventually it'll open but you know some
people really swear by them and if you
like lock yourself out and get a
locksmith and you and the locksmith
doesn't drill you a lock right away and
replace it it's very very common the
locksmith will come with some gigolo
tools and that's kind of the first thing
they'll do is try jigglers on your house
you know you've got some low security
Fyffe pinched leg on your you know a
quick set on your house
the locksmith it's most likely gonna
come along with a gigolo tool and just
try that for a while before drilling out
of your lock
so these Bogota rakes you know sort of
owe something to the jigglers too and
they look basically like this
and I actually don't have any of these I
think maybe some maybe a couple of my
kits came with one in there but I
haven't used them a lot but the locks
book people like really like him so I
didn't try them out see what you think
how we doing for time all right this let
me see what's here there's a whole bunch
of stuff here I'm like looking for tool
marks unlocks I guess I'll do it just
for just the fun but I'll take time for
questions too or you can talk to me
afterwards as well so this this is just
kind of interesting this is not
something unless unless you work in law
enforcement or whatever you probably
would never see any of the stuff but it
to me it's just interesting that you can
see if you like really look at pins
whether or not they've been picked in
how so when you get a pin from the
manufacturer you know some like little
high speed lathe machine has made those
picks in his left tool marks on it most
likely concentric circles like that and
you know so you can you can see how it
was when it was first made and then as
that's used to be you know in the lock
and legitimately unlock you know got
you've got a key rubbing across its face
twice every time the lock gets open at
least twice because it goes in and goes
out and so you can sort of see how these
thing how these tool marks wear away as
the key is legitimately used in the lock
now similarly the plug is scraping
against those spring-loaded driver pins
every time it turns so you can see what
happens to a plug after it's been used a
lot of times and these are all sort of
predictable marks from normal use but
picks go to places the keys don't the
key is mostly touching the bottom of the
pin every time that a pick can reach
around and scrape the side of it so we
can see interesting marks on here that
may be subject to normal wear and tear
so if you look just there
there's a mark on there that would never
be caused by a regular key operation of
the lock
so here here are some examples of the
kinds of mocks and again this is what I
was saying every time you pick your lock
you're doing a little bit of damage and
you can see when you when you're picking
often little tiny flakes of bras come
out because brass is a soft metal it's
easily scratched by the pic so you know
if they you got marks all the way across
the face from a rake mixed picking there
and you know this is this is why you
don't want to you know practice on other
people's locks and upset them because
eventually you're really gonna wear down
the the pin and sooner or later it might
not open especially if you're the
legitimate key has been is multi
multiple generations from the original
key and so every time it's been cut as a
copy a little bit more era is introduced
and you know probably many of us have
experienced the case where we've had a
key that previously worked now it's
sticky and doesn't quite work right and
you got a wiggler when you get in there
because it was it was never really
perfect to begin with and things have
worn down a little bit the the snap of
guns which you know this this is just a
total bypass tool there's no skill in it
so the Loch sport people don't like them
but they're whacking the hell out of the
pins and so you can see these snap gun
marks on the pins and then especially
when you're beginning you sometimes you
know you don't know where the last pins
are and sometimes you'll really Jam the
the pic in and scrape the back so you
can find tool marks on the back of the
keyway and also like I said right right
right when we're talking about tension
tools if someone's putting too much
downward pressure they can scrape the
bottom of the key way and you can see
that too and then also if people are
trying to force the lock of course you
know you'll see some tool marks like
that the bump keys these are you know
alleged to be bump key marks I'm not
sure if you you know
I guess if you were friends a police
forensics guy you might be able to spot
these and and and say yeah that was
definitely a bump key maybe
see what's left
all right I'll play this stuff anyway
okay the things of some of the resources
for for learning more so practical
lock-picking deviant hollom is the guy
who did most of these slides I think
certainly all the key animations deviant
did deviant also will thanked him
yesterday in his elevator freaking talk
he gave him a lot of head start stuff on
the elevator freakin so deviant school
in his book has a lot of this stuff in
it
Marc Weber Tobias is sort of one of the
guys who's written the most books on
locks and safes and stuff like that
there's a whole bunch of stuff out there
and he's also given a number of long
talks at hacker conferences so you can
look up his stuff if you want to see
some really in-depth things and then of
course the tool websites there's a guy
actually on the in some of the videos
there's this guy the lock-picking lawyer
and he does some really good YouTube
videos where he'll take some sort of
lock you know whatever it is per video
and do a do a careful deep dive into how
it works and how to pick it stuff like
that I like his videos a lot
yeah the tool websites and the deviant
site is deviating done that blah blah
blah yeah legal questions or something
maybe you should look into is this
really varies by by country and by state
whether or not lock picks a call a
considered burglary tools so in the
United States I think it varies by state
but usually then not a Berglas toll and
last year using them in a burglary so
funny story just this week there's some
penetration test is for a company that
friends of mine work for they did they
were doing an assessment on a on a court
house and they were that they're they're
like scope of work said they needed to
figure out if there's anyone any way
that someone could get the court records
but the court house thought that they
meant just electronically right just
like hacking over the Internet but these
guys thought it was a full scope of work
so they broke into
courthouse and then they set off an
alarm what everyone were caught and so
then they were put in prison and charged
with burglary and possession of burglary
tools presumably by lockpicks and stuff
and so you know we don't know yet if
they'll if that they'll keep pressing
charges because they really were you
know hired to do it but the people who
hide them didn't realize when they said
find any way to get you know get get the
records that they were gonna actually
physically break into the courthouse so
if you do penetration testing work make
sure you've got all your scope of work
fully signed off on and check your local
laws because some places in Australia
for example the people often ask me if I
ever been hassled for carrying lockpicks
when I fly because I always carry them
and the answer is twice and they were
both those times were both in Australia
I was hassled at the airport and in
Australia pics considered burglars tools
if you're not a locksmith but what does
it mean to be a locksmith so I you know
I said of the guy at the airport the
second time I'm like what yes when
someone asks you if he locks me if you
say yes right I mean that's the right
answer
so I said yes and he said can you prove
it and I said what do you how do you
want me to prove it there's no locksmith
license and he's like well you have a
business card and I said no but and so
he made me check them but then I went
home and I had some business cards made
that said locksmith on them so I haven't
I haven't had to try those yet but I
think it'll work
so check your local laws yeah all right
I think that's enough I think I think
time's up yeah any any questions
yeah
sighs Oh
yeah I mean most pin tumbler locks they
are not accessible from both sides so
the question was what if there's a key
stuck in the lock from the other side
and you're trying to open it can you
push it out in pin in the case of pin
tumbler locks it's not common to be able
to put a key in from both sides because
the same the key would have to be
symmetrical you you know in order for
the same key to work on both sides but
they do there are these ones that you
get in China I think there's a slide
here that's got a picture one can you
see if I can quickly find it where
they'll have two sets of pins and you
can unlock it from one side of the other
in that case you can't reach from one to
the other you can't push that key out
but if the key is in place the lock it's
not going to stop the lock from turning
the exception leo is the old-school
warded keys you know like you know the
sort of classic I can't have a key you
know where it's got like big handle or
the thing in these kind of wards on one
side it was common for them to be able
to be used in both sides and one way
that people were warned if you have that
kind of key on your you know a hotel
room door or whatever in your sleep
don't leave the key in the lock because
someone can push it out and put some
paper under the door and catch it and
then like bring it out of the door but
you know that no one uses those keys
anymore maybe maybe an Africa or
something I don't know
let me see if I can find the picture of
this Chinese
style locks right was in the impression
accession
[Music]
so this is this is the one that I'm
talking about where you have two
separate cylinders and the latch in the
middle when the when the cylinder
rotates that piece of metal in the
middle is what actuates the latch that
you know opens the door and so those
cylinders are the same on both sides
with the exception there's there's it's
a whole talk in itself and this guy gave
it at def con China this year so you'll
be able to look up the video if you're
interested guys names Lucas he did a
whole presentation on Chinese locks and
they do a lot of interesting things like
there's a kind that they make where they
call construction locks so these these
are lock you'd put on your house when
the construction person is working on it
and when they leave you sort of reset
the you know you use your lock to your
key to reset it so that they can't get
in anymore and so they're these kind of
they be not to change the lock so
they're designed to be installed the
construction guy uses it and then when
you use your key on it it resets the
lock just to your key and so yeah a lot
of a lot of these really interesting
Chinese locks and so if you're
interested you should watch that
presentation yeah
[Music]
fight scene
oh I know nothing about locks in Serbia
yeah well I haven't I haven't looked at
the ones actually in this building and
then the courses the electronic locks in
the hotel so yeah I haven't really
looked anyway kyral's should come and
gets it up here oh I can answer
questions and talk about locks
afterwards
you