hey welcome to lock picking 101
my name is Andrew Riesel I go by Drew
most of the time I'm the director of
security red team operations
this basically means my team and I break
into stuff get paid for it and don't get
arrested very often
I locked pick as a hobby a sport for
work and do it because I love to get
into things I'm not supposed to get into
I'll try to cover the basics of lock
picking today which includes what a pimp
Tumbler lock is and how to identify one
the reasons we can pick locks in the
first place
my opinion on a starting set of lock
picks
General types of picks and their usage
different ways to tension a lock and
then just some general tips and tricks
of learning
so pin Tumbler lock is probably the most
common lock you'll encounter in America
these are found on front doors padlocks
safes
lock boxes mailboxes Etc
if the key has a flat bottom and teeth
on the top
it's most likely a pin Tumbler lock
the pin Tumbler lock has several parts
that make up the lock the outer casing
which holds everything together green
and the image to the right the plug
which is the part that rotates and
unlocks the device in yellow
the key pins are the pins that interact
with the key and raise the driver pins
to the correct height which are red in
the image
the shear line is where the plug meets
the outer casing
the driver pins which prevent the plug
from turning until they're raised to the
shear line which are blue
and the pin chambers that hold are that
are the holes in the outer casing that
the plug and the holes the pins in place
if you look at the graphic in the lower
left it shows that when the proper key
is inserted into the lock
the key pins are raising the driver pins
to just above the shear line which
allows the plug to rotate freely
so in a perfect world driver pins would
be exactly the same diameter and the pin
Chambers would be perfectly in line
if this were the case then lock picking
would be almost impossible
luckily for us mass production allows
tolerances of materials which are
acceptable in manufacturing
in the diagram you can see exaggerated
example of accepted tolerances
when tension or rotational pressure is
applied to this lock binding will occur
at the largest diameter pin first
followed by the next largest down to the
smallest diameter
this is referred to as the locks binding
order
in the example at the right
pin two from the front of the lock is
the largest and will bind between the
plug and the outer casing first when
tension is applied to the lock
this will be followed by the first pin
the fifth pin the third pin and then the
fourth pin
if we raise the driver pin above the
shear line the plug will rotate a very
small amount and the next largest pin
will bind
to pick this lock we only need to repeat
this process for every pin
so a large number of picks isn't
necessary especially when you start out
in my opinion you don't need any more
than eight picks to start
I have a monstrous collection of
lockpicks well over 150. but to be
honest I use four or five 99 of the time
you can get upward of 50 low quality
picks for 20 bucks on Amazon but I'd
recommend against this
you should expect to spend between
thirty five and a hundred dollars on
only eight picks that are professional
grade quality
quality picks will be made as Superior
materials have far better finish and
hold a more consistent Kick profile than
the cheaper sets
lock picking is almost exclusively based
on feel of what a lock is doing inside
better picks are going to allow you to
feel what's going on inside the lock
much better
my recommendation for a starter set
would be for single pin picking a short
hook a deeper hook a curved reach hybrid
a diamond and a gem pick and for raking
rocking and scrubbing locks I'd
recommend a Bogota a snake rake in a
city rake
these picks get their name from profile
of the pick itself and or the curvature
of the pick
so it's really important to hold a pick
in a way that you'll receive feedback
from the lock
a few recommended holds are shown in the
slide
lock picking is a delicate process most
of the time to set a pin it can take
less than a millimeter of motion
if picks are held too tightly or used or
if you're using a fist it's much more
difficult to feel what's going on inside
that lock
tensioning a lock is accomplished by
inserting a tension wrench into the
keyway and adding torque to the plug
when picking use light tension to begin
with if you can feel if you can't feel
any binding pins then increase the
tension a little bit until you feel a
pin bind
if all the pins feel like they're
binding then release a little bit of the
pressure
until you can feel just one or two pins
bind
if the part of your finger pushing on
the tension wrench is turning white
you're probably applying too much
pressure
so I've mentioned a few different
techniques of lock picking such as
single pin picking raking rocking and
scrubbing
I'll try to clarify here what each of
these are in the upcoming slides
single pin picking is a process of
finding the binding pin raising it to
the proper level above the shear line
and moving on to the next binding pin
the process is repeated until all
binding pins are at the shear line and
the plug rotates
this method will open far more locks
than scrubbing raking or rocking
you'll have far better control of what's
Happening inside the lock using this
technique
scrubbing raking and rocking a lock are
considered the easiest methods of lock
picking
it's just a matter of putting tension on
the plug using a specially designed pick
to manipulate as many pins as possible
at once
these techniques are not very successful
in high security or well manufactured
locks
in the example scrubbing is done by
applying tension to the plug and
scrubbing the pick in and out up and
down of the lock until pin set start to
set
I'll clarify here what each of these are
in upcoming slides
hooks which include deep hooks hybrid
reach short Hooks and gen picks are
primarily used for single pin picking
hooks are used by applying tension to
the plug inserting the pick into the
lock and feeling for that binding pin
The Binding pin will have more
resistance than the other pins and feels
more like a metal on metal rubbing
once The Binding pin is found the key
pin is raised until the driver pin is
set immediately above the shear line
once this is accomplished the next
binding pin will be found and the
process repeats for as many pins as
there are in the lock
so what do the pins feel like at each
stage
a non-binding pin that is not set will
feel a little bit springy they'll be
obvious downward Force pushing on that
PIN
a binding pin will feel like metal on
metal friction and have a little bit
more resistance
a pin that is already set will have no
added downward Force it won't feel
springy at all you'll only feel the
weight of the key pin and gravity
the half diamond pick named due to the
appearance of the head of the pick can
be used to single pick or can be used to
rake or scrub a lock
in this example we're seeing the half
Diamond being used as a single pin pick
the half diamond is inserted into the
lock and each pin is touched to find The
Binding pin
once located the pin is raised until the
driver pin is just above the shear line
and again at that point the next binding
pin is located and raised
the Bogota pick is primarily used to
rake a lock
raking a lock is all about moving
multiple pins at once and applying
tension to the plug
a rake type pick is inserted into the
lock and moved in and out up and down in
the keyway until the lock opens
if the lock doesn't open in a minute or
two release all the tension on the plug
and try again
other common picks that can be used for
raking are the snake rake in the city
rake
rocking a lock is done by inserting the
pick a city raking this example all the
way into the lock and moving the pick up
and down rocking it on an imaginary
fulcrum point forward and backward
movement is also applied to the pick in
order to hit the higher and low sections
of the pick
so setting the driver pin exactly in the
right location above the shear line is
what makes lock picking challenging
if you raise the keep in too high you'll
end up over setting the PIN
over setting is when the key pin is
pushed up past the share line and gets
stuck up there due to the tension
if this occurs
the plug will not rotate even if you
have all the other pins set
it's difficult to recover from over
setting and sometimes easier just to
start over again
a recovery method that's worked for me
is to very slowly release tension on the
lock until you hear or feel the over pin
overset pin drop
you might drop more than one pin that
was over set but you might get lucky and
only drop that one
so tensioning there are two primary
methods to tensional lock from the
bottom and from the top of the keyway
with bottom of keyway tensioning the
tensioner is placed at the bottom of the
keyway
bottom of tensioning tools are normally
a piece of flat metal bent into an L
shape
they can have twists in the body to
provide additional Comfort while picking
however these twists can dampen feedback
on the lock
with top of keyway the tensioner is
placed at the top of the keyway
commercial type of keyway tensioners
have an s-shape and little teeth at the
end
these can have a longer side that helps
you get into keyways that sit much
deeper in the housing and a short side
for normal keyways that are flush with
the housing
a lot of Pickers add shrink wrap to the
handles of top of keyway tensioners for
comfort
two of mine in the lower left show this
these additions again are more
comfortable but they can dampen feedback
from the lock
so bottom of keyway tensioning is where
most people start out since it's
incredibly stable
the end of the L shape that's inserted
into the keyway can be very long since
it doesn't interfere with any of the
pins above it
the tensioner itself can also provide a
nice bottom platform that you can slide
on slide picks on
this platform is useful in raking and
scrubbing locks
the biggest disadvantage of using bottom
of keyway tensioning tools is it takes
up a lot of space in the keyway which
reduces the space a picker has to work
with
so in this slide on the
right hand side
the green portion indicates where the
pins sit and the purple portion
indicates the room a picker has to work
with when using bottom of keyway
top of keyway tensioning is what most
Pickers progress to over time
as a picker starts to single pin pick
more and more a larger work area is
desired
top of keyway provides a much larger
area for pigs to move
there are two examples of topic keyway
tensioners in this Slide the one on the
left hand side shows a commercial
tensioner and the one on the right shows
a custom made tensioner
I'll cover how the custom tensioners are
made in later slides
a disadvantage of top of keyway
tensioning is the amount of material
that is inserted into the keyway is far
less than that a bottom of key wave
this length is restricted by the first
pin in a lock
this can cause the tensioner to slip out
of the keyway much much easier
so on the left side with the green
that's the commercial top of keyway
tensioner the green portion is going to
be where your PIN sit and the purple
portion is going to be how much room you
actually have to work with your pick
on the right hand side is the custom
tensioner
the green portion is going to be where
the tensioner actually sits the red is
where the pins sit and then that large
purple area is going to be how much room
you actually have to work with your
tools
so when I started out picking I hadn't I
had trouble determining what locks to
attempt next I'd finish a Master Lock
and just go buy another Master Lock
at the time I didn't realize that there
were different difficulties and locks
based on manufacturers and security
levels
there's a really useful Reddit group
that's put together a belt system for
lock Pickers this is like the belt
system that's used in certain martial
arts
in order to progress to the next level
belt color a certain criteria must be
met first
this is normally advancing to a more
secure or better manufactured lock
shown in the slide are the first three
belts that can be obtained and the locks
that qualify for those rankings
additional information on this can be
found at the r lock picking on Reddit
so bottom of key tensioners are
incredibly easy to make and in most time
in most cases absolutely free the main
material for these can be found inside
old windshield wiper blades
when people change out the windshield
wiper blades at auto parts stores they
throw away the old ones so when it rains
or snows head out to one of these stores
and grab as many old windshield wiper
blades as you want
there's a long flat piece of Steel
inside the blade that's the perfect size
for bottom of key tensioners
additionally there are different widths
of this piece of metal inside certain
blades
this will allow you to build a tensioner
that fits inside of smaller keyways and
smaller locks much easier
to build one of these go out and get an
old windshield wiper blade pull out that
thin piece of metal that will be used
for your tensioning tool
cut it to the desired size and put a 90
degree Bend in the end
you can then put a Twist in the body if
you like for comfort
so cut top of keyway tensioners are also
fairly easy to make
the difference is the material will need
to be purchased
I make my top of keyway tensioners out
of Music wire that I get off of
amazon.com
I've included the link at the end of
this presentation if you're interested
once you have the music wire bend the
tip 90 degrees before you cut it since
the tip of the top of keyway is much
shorter than out of bottom of keyway
it's easier to bend first and then cut
you want it long enough to tension the
lock but not so long that it touches the
first pin inside the lock
cut the handle to the desired size after
that and file the tip until it fits
snugly into the top of the keyway
the tighter the fit the more control
you'll have over the plug
come find me in the lock picking Village
if I'm not there if you'd like to try
one of these top of keyway tensioners
out
so lock pits are mass produced and have
little bits of metal still attached to
them from the stamping process
finish on these picks are not always the
best and can feel rough inside of a lock
if you polish a pick you'll be able to
feel what's happening inside of a lock
much better
to do this grab some sandpaper I usually
start with 500 grit and work my way up
to a thousand Grit
sand the sides the top the bottom of the
pick until it is smooth to the touch
make sure you don't change the profile
of the pick tip
I'll then use a flitz metal polish after
this process to put a mirror finish on
the tool
remember you're only doing this to
remove leftover material from the
manufacturing process and to give the
pick a nicer feel you're not really
wanting to remove the metal of the pick
itself
so practice locks are great to see
what's going on inside of a lock
this will help you identify how far the
distance between pins are
and what it looks like when the key pin
is raised as well as when the driver pin
is set
remember lock picking is based on feel
not sight so if you decide to get one of
these locks be careful that you don't
become dependent on picking visually
there are two types of practice locks
that I'm familiar with the clear acrylic
locks that allow you to see through the
entire body
and the Cutaway type that has a window
cut out of a real lock
because cutaway locks are made from real
locks they can be useful in learning the
feel of how log picking works
the acrylic locks tend to feel much
different than a real lock in my opinion
another option is to create a practice
lock on your own
excuse me by gutting the lock and
re-pinning it with just a few pins at a
time this is called Progressive pinning
by doing this you'll get the feel of
where each pin is and what it's like
when a pin is set to the correct height
an additional benefit to this method is
that it gives you a real in-depth
knowledge of how locks work and how to
pin them
so over time locks get all kinds of
garbage in the keyway this can gum up
the pins and the plugs making it more
difficult to feel what's going on in
there whenever I pick a lock I hit it
with something called Houdini lock Lube
if I have it
it cleans out the junk in a lock and
lubricates the moving Parts without
gumming up the inside like other Loops
can
another option is to use dry graphite
spray it doesn't clean out the lock but
it does provide a good lubricant
try to avoid stuff like three in one
oils and WD-40 to lube a lock
they'll do a job in a pinch but over
time tend to gum up the insides and make
everything feel pretty sticky
so you can get locks from all over the
place you can buy them at hardware
stores buy special ones off the internet
or even trade locks unlock picking
forums
if you live near a truck stop people cut
locks off their trailers all the time
and they just leave it on the ground
these things are perfectly pickable you
don't need the shackle portion to be
intact to practice with it
a place I use frequently is the Habitat
for Humanity
they can't sell locks they don't have
keys so they take the locks off and sell
them for scrap metal
if you offer to buy them at scrap metal
prices or a little above they tend to go
for that sale
can normally get a five gallon bucket
full of locks for about 20 bucks
these are some of the sites I borrowed
images from and gifts for this
presentation I would highly recommend
reading the book or PDF lock picking
detailed Overkill by m Gibson it's
downloadable all over the place from a
lot of areas for free
a few channels I watch regularly on
YouTube are the lock picking lawyer The
Helpful lock picker in Bosnian build
if I get stuck on a specific lock most
likely one of these guys will have
suggestions on how to defeat it
the link for the music wire that I use
for my top of keyway tensioner is at the
bottom right
the QR code on the right will link
directly to the page I use
just ignore the C2 agent install and
select yes when prompted
so I hope you enjoyed this presentation
and are leaving with something new if
you have any questions or comments that
you'd like to share with me feel free to
email me at Drew red hyphen team.fun
anybody have any questions
yes
yes the slide deck will be made
available
all right thank you so much guys
[Applause]