[00:03.620 --> 00:04.560]  So, right on.
[00:04.840 --> 00:05.840]  We don't have a lot of time.
[00:06.040 --> 00:06.700]  We have, what do we got?
[00:06.780 --> 00:11.520]  We got 200 slides, virtually none of which have words, because that's our jam, so we're gonna bang right into it.
[00:12.260 --> 00:13.280]  Who's this cat right here?
[00:17.420 --> 00:18.440]  So, this is Howard.
[00:18.600 --> 00:21.940]  This is Howard on the street where you spotted, you know, some elevator van, right?
[00:22.640 --> 00:23.780]  Howard is the elevator guy.
[00:23.960 --> 00:25.060]  He's not just the elevator guy.
[00:25.200 --> 00:28.160]  He's also a gambling badass and a terrific phone phreak.
[00:28.420 --> 00:31.340]  And, you know, listen to some of his prank call stuff later.
[00:31.480 --> 00:31.900]  You'll dig it.
[00:32.400 --> 00:33.100]  Who am I?
[00:33.220 --> 00:33.700]  I'm deviant.
[00:33.860 --> 00:35.760]  I'm the lock picker and pen test guy.
[00:36.160 --> 00:40.820]  If you don't ask me about physical penetration, you're probably asking me about either cooking meat or travel.
[00:41.320 --> 00:42.880]  Because I fly all the time.
[00:43.740 --> 00:45.860]  Yeah, or guns, as people in the front point out.
[00:46.000 --> 00:47.160]  Yes, I fly with guns.
[00:47.300 --> 00:49.160]  That was a whole thing I talked about for many years.
[00:49.440 --> 00:53.920]  But when I'm flying, like, I notice a lot of goofy things, and I'll tweet funny things from planes.
[00:54.120 --> 00:55.160]  Like, the Internet switch.
[00:56.340 --> 00:59.420]  Or, you know, like, people love tweeting funny stuff on planes, right?
[00:59.520 --> 01:00.960]  Like, the plane running Windows 98.
[01:00.960 --> 01:04.760]  But there's a lot of shenanigans at airports that aren't just on planes.
[01:04.760 --> 01:09.780]  So, there was a time when people said, hey, you know, at airports, there's also, like, these big jetways.
[01:10.460 --> 01:13.020]  And, oh, my God, zone, lolz, look.
[01:13.220 --> 01:14.500]  Like, so there's these Twitter photos.
[01:16.240 --> 01:20.020]  And when these were kicking around, you know, like, oh, my God, jetway has a password of one.
[01:20.200 --> 01:21.040]  And it's written down.
[01:21.580 --> 01:26.780]  When you look at these images, people would say, you know, occasionally, most of the chatter is like, oh, it's so bad.
[01:26.780 --> 01:31.500]  But occasionally, people are like, well, you know, at least there's a mechanical key switch with it.
[01:31.700 --> 01:33.140]  So there's like, it's two factor.
[01:34.580 --> 01:36.220]  Well, not so much.
[01:36.580 --> 01:37.220]  It's a factor.
[01:37.420 --> 01:38.200]  It's a factor.
[01:39.020 --> 01:40.780]  But this is our talk.
[01:40.960 --> 01:48.020]  Our talk is about how a lot of things that have keys in this world are really not differentiated keys.
[01:48.020 --> 01:51.840]  Way more than we even got to touch on in the elevator stuff last time.
[01:52.400 --> 01:53.920]  So simple disclaimer, right?
[01:54.960 --> 01:56.840]  We're not encouraging you to do this.
[01:57.060 --> 01:59.080]  Rule number one for lockpicking still applies.
[01:59.340 --> 02:01.060]  Don't do this to locks you don't own.
[02:01.260 --> 02:03.280]  If you own the lock, do whatever you want with it.
[02:03.540 --> 02:05.920]  We happen to own several that you'll probably want to play with downstairs.
[02:06.500 --> 02:08.000]  So it's a consequence-free environment.
[02:08.140 --> 02:08.760]  Come play with it there.
[02:09.180 --> 02:09.360]  Yeah.
[02:09.660 --> 02:11.460]  So be smart about this.
[02:11.660 --> 02:14.080]  We're going to try to drop a lot of crazy on you right now.
[02:14.760 --> 02:20.240]  So who remembers the electronic voting fiasco when Diebold got in a lot of hot water for year after year?
[02:20.400 --> 02:20.680]  Yes.
[02:21.620 --> 02:23.460]  Matt, who just introduced us, and Maus.
[02:23.460 --> 02:24.900]  We haven't seen Maus all con.
[02:25.020 --> 02:25.860]  Are you in here, Maus?
[02:26.320 --> 02:26.880]  God damn it.
[02:26.940 --> 02:27.860]  We love Maus so much.
[02:28.540 --> 02:28.860]  Yes.
[02:29.080 --> 02:30.580]  So, Maus is a she, but all right.
[02:31.840 --> 02:32.480]  So yes.
[02:32.780 --> 02:35.220]  When all that went out, do you guys remember?
[02:35.740 --> 02:39.080]  It wasn't just that, oh my God, there's so much bad code in these machines.
[02:39.220 --> 02:42.060]  There was like, and they publish photos online on their website.
[02:42.280 --> 02:42.640]  Look at that.
[02:42.740 --> 02:43.240]  Ha, ha, ha.
[02:43.440 --> 02:44.140]  Diebold catalog.
[02:44.980 --> 02:45.560]  So yeah.
[02:45.660 --> 02:49.400]  Like you could look at these photos and like, oh my God, you might be able to make the key.
[02:50.200 --> 02:52.840]  But you don't really have to make the key.
[02:52.840 --> 02:55.260]  Like you could just buy the key.
[02:56.840 --> 03:00.080]  You'll notice it doesn't say Diebold anywhere in this eBay auction, right?
[03:00.560 --> 03:01.340]  What does it say?
[03:01.560 --> 03:03.140]  It's AMI jukebox cabinet key.
[03:03.280 --> 03:04.220]  Jukebox cabinet key.
[03:04.320 --> 03:04.940]  Well, that's weird.
[03:05.220 --> 03:07.720]  And a guy on Reddit, a locksmith said the following, right?
[03:08.560 --> 03:14.500]  Any experienced locksmith like me will tell you that if they showed that key, it's C415A.
[03:15.260 --> 03:20.440]  This is literally the most common cabinet like bullshit key in America.
[03:20.740 --> 03:24.620]  It's not that Diebold just like published pictures of a terrible key.
[03:24.620 --> 03:31.320]  They used the most typical key that, as the guy is like, this is probably in everyone's freaking junk drawer right now.
[03:31.840 --> 03:32.600]  In fact.
[03:32.880 --> 03:33.080]  Yeah.
[03:33.120 --> 03:35.360]  In fact, as we're doing this talk, Howard's like, wait a minute.
[03:35.480 --> 03:37.680]  And he goes to his bin of like spare parts.
[03:38.200 --> 03:39.080]  Totally found.
[03:39.080 --> 03:39.600]  It's there.
[03:39.720 --> 03:40.360]  It's there.
[03:40.680 --> 03:41.580]  Like it's in his drawer.
[03:42.400 --> 03:46.600]  So this whole like, the idea of yes, publishing keys online is bad.
[03:46.800 --> 03:50.640]  But it's really shocking that these were super reused keys to begin with.
[03:50.860 --> 03:53.160]  And this happens all the time.
[03:53.560 --> 03:58.380]  Not just with C415A, which again is a stupid common key for a lot of purposes.
[03:58.860 --> 04:04.840]  But a lot of systems have the same key over and over and over across different platforms.
[04:05.220 --> 04:06.580]  Not elevators though.
[04:06.920 --> 04:07.760]  Yeah, never elevators.
[04:07.820 --> 04:08.760]  Elevators are always key and different.
[04:08.820 --> 04:09.420]  Always secure.
[04:09.620 --> 04:10.720]  That was our point last time.
[04:11.180 --> 04:13.560]  So like Dennis Maldonado on the left up there.
[04:13.780 --> 04:14.580]  A good friend of ours.
[04:14.700 --> 04:17.220]  Dennis does a lot of work with hacking access control systems.
[04:17.220 --> 04:18.760]  If you saw him at DEFCON or anything.
[04:19.580 --> 04:22.120]  And the Lanier cabinet that he's next to right there.
[04:22.140 --> 04:23.300]  He does a lot of Lanier gear.
[04:23.460 --> 04:24.920]  And he's like, oh yeah, I noticed in my...
[04:24.920 --> 04:27.320]  He mostly did code review and checked out the electronics.
[04:27.540 --> 04:29.920]  But he's like, I also noticed they all have the same key.
[04:30.180 --> 04:33.200]  Like the same cabinet key for every enclosure I've ever found.
[04:33.460 --> 04:37.120]  And he showed me this photo and I tweeted it, I think, right?
[04:37.260 --> 04:40.360]  You sent this to me and I said, you gotta be with Dennis.
[04:41.060 --> 04:41.340]  Yeah.
[04:41.600 --> 04:42.460]  That was just their answer.
[04:42.600 --> 04:44.640]  Not like, oh, that's what key it was.
[04:44.800 --> 04:45.020]  Yeah.
[04:45.220 --> 04:46.300]  Howard's like, are you a Dennis?
[04:46.320 --> 04:48.440]  It was just the combination of things on that key ring.
[04:48.560 --> 04:50.040]  And I'll just leave that to you to decipher.
[04:50.560 --> 04:50.800]  Yeah.
[04:50.800 --> 04:51.720]  So I was like, how did you know?
[04:51.780 --> 04:55.040]  He's like, well, among other things, you've got that A126 key.
[04:55.220 --> 04:55.980]  And I was like, what?
[04:56.060 --> 04:56.340]  What is that?
[04:56.400 --> 04:58.700]  He's like, oh yeah, totally industry standard key.
[04:58.700 --> 05:02.500]  Like, and you notice, this is not like the linear website or something.
[05:02.660 --> 05:04.440]  This is just an industry supply site.
[05:04.680 --> 05:09.300]  These are common keys that get reused over and over and over and over.
[05:09.520 --> 05:14.720]  Just because one vendor is using a key for a purpose, it doesn't mean they came up with that bidding.
[05:14.720 --> 05:17.020]  It doesn't mean that they own that bidding.
[05:17.560 --> 05:19.660]  These keys show up everywhere.
[05:20.540 --> 05:21.600]  Case in point.
[05:22.080 --> 05:27.060]  As was touched, who saw the talk at like almost midnight last night with Johnny Christmas and Dark Sim and I out?
[05:27.200 --> 05:27.620]  Right on.
[05:28.080 --> 05:30.700]  So the TSA keys talk, they talked about key reuse.
[05:31.060 --> 05:33.280]  They talked about, quote unquote, the gas pump key.
[05:33.500 --> 05:37.400]  And they even showed, you know, great example of news media, like printing a key.
[05:37.740 --> 05:41.080]  And oh my God, people could maybe file the key down.
[05:41.080 --> 05:44.680]  And what if someone was really diligent as an attacker, they could get this key.
[05:44.960 --> 05:45.760]  Oh, they can get it.
[05:46.120 --> 05:47.580]  Yeah, you can totally get it.
[05:47.920 --> 05:50.340]  It's the most popular key on Amazon.
[05:51.120 --> 05:53.180]  Yeah, it's not just, it's not a gas pump.
[05:53.360 --> 05:56.740]  It's the super, you know, you said if you search for key, it's one of the top results.
[05:57.020 --> 05:59.160]  Tools and home improvement, search for key.
[06:01.240 --> 06:03.460]  Yeah, the CH751.
[06:03.780 --> 06:05.500]  This is your big money key, right?
[06:05.660 --> 06:11.000]  This is one of like, of the keys that are everywhere, including like right in the front row.
[06:11.000 --> 06:12.320]  Like there's just a bunch of them right here.
[06:13.760 --> 06:19.640]  Yeah, the CH751, that simple like up, down, up, down, you'll see it on a lot of systems.
[06:20.340 --> 06:25.260]  Search for CH751 and you will, it's gas pump keys everywhere, I'll tell you.
[06:26.680 --> 06:28.000]  Now, of course, in quotes, right?
[06:28.120 --> 06:30.960]  Because you don't see a lot of results mentioning gas pumps.
[06:31.340 --> 06:32.720]  You see them, there was a theme.
[06:32.840 --> 06:34.400]  Who sees a certain theme in these results?
[06:36.720 --> 06:37.860]  What do you see?
[06:37.920 --> 06:40.220]  What kind of devices or systems are mentioned in here mostly?
[06:40.860 --> 06:41.260]  RVs.
[06:41.540 --> 06:41.940]  RVs.
[06:41.940 --> 06:43.240]  Ah, RVs.
[06:43.300 --> 06:45.640]  Tell them about RVs and the CH751 key.
[06:46.060 --> 06:49.820]  So look, you're not going to drive off with the RV when you have a CH751 key.
[06:50.220 --> 06:56.760]  But the accessory locks, the things that don't let you into the vehicle or start the vehicle, all those little cabinets on the side.
[06:56.760 --> 07:00.980]  Every stupid panel everywhere that locks up the luggage bays, the pop-outs, the doors and windows.
[07:01.260 --> 07:04.700]  If the kitchen cabinets lock up, I'm sure they're CH751 too.
[07:04.700 --> 07:04.880]  Yeah.
[07:05.380 --> 07:08.000]  Everything on most RVs is a CH751 key.
[07:08.540 --> 07:08.940]  Everywhere.
[07:09.500 --> 07:15.740]  And so much so that there's a website, CH751.com, which is just alerting.
[07:15.920 --> 07:18.200]  Like, it's a guy trying to sell you tubular locks.
[07:18.600 --> 07:21.400]  But he's like, your RV is keyed like everyone else's.
[07:21.540 --> 07:22.820]  Well, they are unpickable, to be fair.
[07:22.900 --> 07:23.320]  That's true.
[07:23.400 --> 07:25.380]  Tubular locks, very secure, of course.
[07:26.220 --> 07:33.140]  Did anybody, like, people were tweeting us, they had found the in-room safe hidden key, which is a tubular key, which is key to like to all the ones.
[07:33.340 --> 07:34.380]  But anyway, digression.
[07:35.440 --> 07:40.160]  CH751, again, is just, this is the super, it's the super bullshit key.
[07:40.500 --> 07:48.980]  Like, if you find any little prefab enclosure that has a tiny cam lock on it, super huge likelihood it's CH751.
[07:49.260 --> 07:50.580]  We carry them on jobs.
[07:50.580 --> 07:58.560]  When we're on a job and we just see locked stuff, before we try to pick it, we're gonna throw our CH751 in everything, and hopefully it works.
[07:58.840 --> 08:02.160]  And of course, like, what do BS wafer locks protect?
[08:02.540 --> 08:04.060]  Some of the most important things, right?
[08:04.360 --> 08:04.840]  Like...
[08:06.660 --> 08:08.300]  Like, a building key box.
[08:10.140 --> 08:11.500]  But this is the best part.
[08:11.720 --> 08:17.040]  If it's CH751 locking it up, you're locking up at multiple other copies of it.
[08:17.160 --> 08:19.860]  There are other CH751s in this key box.
[08:19.860 --> 08:22.320]  Just from around this building that has, like, furniture.
[08:22.320 --> 08:22.740]  You can check that.
[08:22.840 --> 08:23.500]  Check that later.
[08:23.560 --> 08:24.880]  Yeah, you can check our slides later.
[08:25.420 --> 08:28.140]  Howard, like, Howard's the kind of guy who's like, wait, wait, let me look into that.
[08:28.480 --> 08:30.100]  Totally is on the list, a few times.
[08:31.000 --> 08:34.120]  And if you even notice that Amazon auction, customers also bought.
[08:34.440 --> 08:38.680]  Like, time clocks, controller door covers, like...
[08:38.680 --> 08:39.760]  What do those have in common?
[08:40.560 --> 08:41.280]  They're all the same.
[08:41.280 --> 08:41.860]  They're all the same.
[08:41.980 --> 08:43.440]  They're all CH751.
[08:43.760 --> 08:47.440]  And we may have, we may have come to hope with a few of these keys.
[08:48.900 --> 08:50.040]  Oh, you're dragging your...
[08:50.040 --> 08:50.280]  Oh, sorry.
[08:50.360 --> 08:50.680]  Yeah, yeah.
[08:51.520 --> 08:52.040]  There we go.
[08:52.220 --> 08:54.920]  Yeah, we may have been giving some of these out during the con.
[08:55.160 --> 08:57.880]  If you didn't get one, you probably didn't give us a good enough drink or something like that.
[08:58.200 --> 08:59.880]  So, cheers to those of you who got one.
[09:03.230 --> 09:05.110]  But let's get into even some more technical stuff.
[09:05.270 --> 09:07.170]  This is just funny starter material, right?
[09:08.110 --> 09:09.230]  So, key switches.
[09:09.770 --> 09:13.430]  How many people, as you saw some hands, who saw us last time with the elevator talk?
[09:13.830 --> 09:14.190]  Cool.
[09:14.390 --> 09:15.570]  How many of you own an elevator?
[09:16.590 --> 09:17.310]  All right.
[09:17.390 --> 09:18.130]  That gentleman does.
[09:18.130 --> 09:18.570]  Very good.
[09:19.470 --> 09:21.690]  So, you saw us talking about key switches.
[09:22.190 --> 09:23.490]  You saw us talking about...
[09:23.490 --> 09:24.270]  Oh, we lost our slides.
[09:24.650 --> 09:24.970]  Oh, well.
[09:25.170 --> 09:29.590]  You saw us talking about, for example, like the CH, the 501CH, right?
[09:30.010 --> 09:30.270]  Yeah.
[09:30.330 --> 09:33.290]  So, we were a little bit reserved when we did our talk.
[09:33.450 --> 09:36.130]  We were not trying to just drop a whole table of keys and what they do.
[09:36.130 --> 09:38.970]  So, this time let's use one specific example and just focus on it.
[09:39.850 --> 09:41.250]  This is an elevator key.
[09:41.490 --> 09:43.470]  Not that you'd know that looking at this picture.
[09:43.950 --> 09:46.410]  Not that you'd know that looking at any elevator that happens to use it.
[09:46.790 --> 09:47.510]  This just happens to use it.
[09:47.510 --> 09:48.470]  This just has a Siemens key, right?
[09:49.450 --> 09:56.790]  So, what's awesome is this website has not only published a photo of the lock that it goes with, but they've published a dimensional drawing of the key.
[09:56.970 --> 09:57.990]  Beautiful drawing of the key.
[09:58.030 --> 10:01.330]  This isn't like a photo, this is like somebody illustrated it properly.
[10:01.770 --> 10:02.050]  Yeah.
[10:02.470 --> 10:03.490]  It's like vector art.
[10:03.710 --> 10:03.910]  Right.
[10:04.570 --> 10:07.450]  But you notice it says... now this is usually in what installations?
[10:07.910 --> 10:09.130]  It's common on Schindler's.
[10:09.690 --> 10:11.170]  Definitely not the escalator out there.
[10:11.290 --> 10:13.510]  You shouldn't try to restart this with this key.
[10:14.750 --> 10:16.730]  But it doesn't say Schindler, it says Siemens.
[10:16.990 --> 10:21.090]  But if you look further along, you'd say, well, maybe this only works in Siemens equipment, right?
[10:21.630 --> 10:22.070]  Nope.
[10:23.430 --> 10:27.650]  This mechanical machine key switch will open like husky toolboxes.
[10:28.150 --> 10:32.530]  It'll open job boxes on the back of trucks that have tons of equipment in them.
[10:32.530 --> 10:33.210]  Why?
[10:33.470 --> 10:34.930]  Because this is not a Husky key.
[10:35.110 --> 10:36.190]  It's not a Siemens key.
[10:36.290 --> 10:36.830]  It's not a Schindler key.
[10:36.830 --> 10:37.090]  It's not a Schindler key.
[10:37.230 --> 10:41.070]  It's actually a Hudson key design being sold here by ESP, right?
[10:41.590 --> 10:47.230]  That one was actually Illinois, but I think the reason we use this is because this is another major vendor of it.
[10:47.230 --> 10:47.810]  Yeah, another vendor.
[10:47.990 --> 10:49.590]  So it's vendors upon vendors.
[10:49.690 --> 10:58.610]  And as Howard likes to say, you go far enough up the food chain, just like Husky isn't making the lock they put in their box, like the lock factory, right?
[10:58.610 --> 10:58.950]  Right.
[10:59.150 --> 11:02.410]  The ESP is not making the zinc they die cast them out of either.
[11:02.650 --> 11:03.070]  Right.
[11:03.290 --> 11:04.850]  Everybody gets something from somewhere.
[11:05.130 --> 11:06.470]  And this is how this happens.
[11:06.770 --> 11:11.790]  So these companies that are sourcing these materials all turn to the same vendors.
[11:11.970 --> 11:17.610]  When they say, I need a lock that's, you know, this much backspacing and offset, and this is the hole it fits in.
[11:17.670 --> 11:18.970]  Oh yeah, we got those.
[11:19.150 --> 11:20.150]  Everyone wants one of those.
[11:20.330 --> 11:21.790]  We can sell you 10,000 right now.
[11:21.790 --> 11:23.990]  And they're all the same effing key.
[11:24.250 --> 11:25.310]  And nobody knows this.
[11:25.450 --> 11:26.470]  Nobody talks about this.
[11:27.850 --> 11:29.350]  So what about other things?
[11:29.450 --> 11:31.050]  What about, we talked about machine switches.
[11:31.190 --> 11:32.290]  What about larger machines?
[11:32.490 --> 11:34.710]  What about like cabinets that have machines in them?
[11:35.070 --> 11:37.570]  What about maybe you went to the retro gaming downstairs?
[11:37.890 --> 11:38.670]  Arcade cabinets.
[11:39.470 --> 11:43.070]  Do you know that arcade cabinets were most instances, they were key to like?
[11:43.430 --> 11:52.670]  If you go on retro forums, enthusiast forums, where people are restoring old hardware, you'll see the occasional post where people are like, oh yeah, Midway USA, Every Miss Pac-Man.
[11:52.790 --> 11:53.790]  Yeah, that was the standard key.
[11:53.930 --> 11:55.730]  This was the standard key for those game series.
[11:56.190 --> 11:57.930]  This is not an uncommon thing.
[11:58.130 --> 12:00.130]  And these are machines that handle money, right?
[12:00.430 --> 12:01.650]  Yeah, this is the thing though, right?
[12:01.890 --> 12:03.330]  Like games are for kids.
[12:04.130 --> 12:06.670]  Can you think of any other machines that handle money that aren't for kids?
[12:07.570 --> 12:08.190]  I can.
[12:09.770 --> 12:10.130]  Yeah.
[12:11.790 --> 12:12.150]  So?
[12:12.570 --> 12:12.850]  Yeah.
[12:13.170 --> 12:15.450]  So yeah, so slot machines have this kind of interesting feature.
[12:16.590 --> 12:19.990]  There is obviously a separation of the cash management.
[12:20.230 --> 12:23.870]  You're not going to jackpot a machine just by having what we're about to show you.
[12:23.990 --> 12:29.130]  So I need to preface it by saying nothing about what we're about to show you enables you to take money from the machine.
[12:29.670 --> 12:30.110]  But...
[12:30.110 --> 12:32.930]  Not physically, but you can take an edge on the machine maybe.
[12:33.290 --> 12:33.690]  Possibly.
[12:33.770 --> 12:33.830]  Right?
[12:34.350 --> 12:34.790]  Because...
[12:34.790 --> 12:35.390]  So this new story happened.
[12:35.750 --> 12:44.410]  When you win a jackpot, and you win more than say $600 or $1,200, depending on the game that you're playing, you get what's called a 1099G.
[12:45.010 --> 12:46.030]  You've won money.
[12:46.190 --> 12:47.810]  And the IRS wants their cut.
[12:48.010 --> 12:52.570]  So the attendant has to come over, get your social security number on the floor, which of course you say out loud.
[12:53.150 --> 12:56.430]  And then give you the tax paperwork while they give you the cash.
[12:57.030 --> 12:58.790]  Once they're done, they insert a key.
[12:59.370 --> 12:59.730]  Oh!
[12:59.870 --> 13:00.690]  It's that one right there.
[13:00.770 --> 13:01.510]  Yeah, right there in the picture.
[13:01.510 --> 13:02.290]  The two, three, four, one.
[13:03.270 --> 13:05.210]  And then it resets the jackpot.
[13:05.330 --> 13:07.110]  It allows the machine to start playing again.
[13:07.250 --> 13:08.150]  But here's what's fascinating.
[13:08.150 --> 13:15.190]  So when that happens, the attendant is also presented with information about how the game's been played, and about how the game's been paying out.
[13:15.350 --> 13:23.090]  Because of course, they want to make sure that it's not paying out above the expected value, or at least not outside of the statistical expectation.
[13:23.090 --> 13:26.650]  So in addition to being a reset key, it's a diagnostic key.
[13:26.830 --> 13:26.990]  Right.
[13:27.170 --> 13:30.230]  It shows you very specific parameters about the machine's operation.
[13:30.510 --> 13:41.670]  What happened was actually, there was a casino in Reno, the pepper mill, and a zealous employee decided to walk to the casino across the street, insert his attendant key, turn it, record all of the parameters.
[13:42.050 --> 13:42.290]  Oh, and behold, it worked.
[13:42.750 --> 13:47.050]  Return to his employer, and show them all the information he'd gathered.
[13:47.470 --> 13:49.530]  This became a thing.
[13:49.810 --> 13:50.070]  Yeah.
[13:50.070 --> 13:53.670]  It was industrial espionage, due to key to, like, friggin' casino machines.
[13:53.970 --> 13:56.370]  What's fascinating was the response from the regulator.
[13:56.830 --> 13:59.130]  Because he was caught, right, by security, eventually.
[13:59.790 --> 14:04.770]  The regulator's response was that it doesn't actually affect the integrity of the game.
[14:06.130 --> 14:08.030]  It's just an internal security issue.
[14:08.670 --> 14:18.070]  And so, the Nevada Gaming Commission is actually on the record saying, it's okay to have this, walk into a casino with it, and turn it, and it's up to the casino to stop you.
[14:18.430 --> 14:18.790]  Yeah.
[14:19.910 --> 14:24.150]  The Gaming Commission's position was, lulz key to like, that's your problem, dumbasses.
[14:27.550 --> 14:33.930]  So, when we talk about, you can get things key to like, the whole thing, our jokey name of this talk was like, can you get your neighbor's key?
[14:34.210 --> 14:35.970]  Well, there's a lot of ways to do that.
[14:36.150 --> 14:38.550]  You can become aware of the problem in instances like this.
[14:38.690 --> 14:42.570]  Let's talk about actually getting someone else's key, or some other system's key, right?
[14:42.570 --> 14:48.230]  Well, just buying whatever they have is usually a super low entry barrier.
[14:48.930 --> 14:54.330]  So, if you know, this little fire alarm pull station, if I want this key, I don't have to sit there like, impressioning it.
[14:54.530 --> 14:58.410]  I can look in the Simplex catalog, find this part, and just order one.
[14:58.570 --> 15:05.110]  And it's probably going to be way less time and money and effort and resources for me, because it'll just get delivered with a key, probably two.
[15:05.710 --> 15:07.810]  And 90% of the time, they're just going to frickin' match.
[15:08.870 --> 15:12.350]  Now, how much shenanigans I could do with like, a fire pull station?
[15:12.590 --> 15:13.190]  Not much.
[15:13.190 --> 15:13.490]  Not much.
[15:13.650 --> 15:15.450]  You're just going to set off the alarm or reset it pretty much.
[15:15.470 --> 15:15.530]  Yeah.
[15:15.530 --> 15:19.830]  But Simplex and other, you know, industrial hardware control systems, they make a lot of gear.
[15:20.030 --> 15:21.870]  They make like, exit alarms, right?
[15:22.110 --> 15:23.070]  So, this is kind of neat, right?
[15:23.110 --> 15:24.370]  There's a rim cylinder right there.
[15:24.550 --> 15:26.090]  Or, excuse me, a mortise cylinder, I suppose.
[15:26.770 --> 15:29.030]  And above that though, there's a wafer lock.
[15:29.030 --> 15:33.790]  These are those push-to-exit alarm will sound systems on like, the back doors of establishments, right?
[15:34.250 --> 15:36.650]  The big red push-to-exit alarm will sound.
[15:36.870 --> 15:43.110]  So, the main key, the on-site key, unique to them, this is what will reset or disable the alarm, right?
[15:43.770 --> 15:47.870]  This key, however, which again, comes with the unit, do you know what it does?
[15:49.650 --> 15:50.210]  Sort of.
[15:50.590 --> 15:51.190]  Ah, he heard it.
[15:51.270 --> 15:51.930]  Battery door.
[15:52.170 --> 15:53.150]  Yeah, it's the battery door.
[15:53.230 --> 15:55.370]  Because it has to sound that piezo alarm, right?
[15:55.850 --> 15:56.410]  So, yeah.
[15:56.670 --> 16:03.410]  You can just buy any of these D-Tex or Simplex products, get the battery door cover key, and then this alarm thing is doing nothing.
[16:03.590 --> 16:05.730]  There's about 20 or 30, I think, in that series.
[16:05.890 --> 16:08.450]  But even still, there's 20 or 30.
[16:08.530 --> 16:09.130]  That's your key space.
[16:09.330 --> 16:14.190]  So, the idea of like, oh, I wonder if we could break into this unit here.
[16:14.370 --> 16:15.770]  Oh, I'm gonna measure...
[16:15.770 --> 16:21.630]  Sometimes, like in movies, they'll say like, we bought the exact same one that the Target facility has, so you can practice on it.
[16:22.210 --> 16:24.850]  No, you probably like, could just buy the one and get like, the key.
[16:25.070 --> 16:26.830]  Like, the drug storage containers.
[16:27.450 --> 16:30.690]  Like, this company making drug storage containers for medical use.
[16:30.890 --> 16:33.330]  Like, I'm sure they're not keying these differently.
[16:33.850 --> 16:37.670]  MMF makes also cash boxes and other like, cash register-y kind of things.
[16:37.730 --> 16:37.890]  Yeah.
[16:38.130 --> 16:41.350]  So many pieces of these hardware, like, equipments.
[16:41.510 --> 16:42.070]  Oh, my God.
[16:42.230 --> 16:44.010]  Just, I'm sure they ship with the same keys.
[16:44.390 --> 16:47.150]  Be aware that someone could just buy the same one you've got.
[16:47.150 --> 16:52.250]  Not to practice on it, quote-unquote, unless they're practicing like, so the key goes clockwise.
[16:52.930 --> 16:53.870]  Alright, I gotta remember.
[16:54.670 --> 16:54.990]  Clockwise.
[16:55.850 --> 16:56.330]  Commit that.
[16:56.410 --> 16:57.630]  Alright, I'm good for the job, man.
[16:57.670 --> 16:58.070]  Let's go.
[16:58.630 --> 17:00.470]  But you also get the blank, potentially, right?
[17:00.610 --> 17:00.810]  Yeah.
[17:00.870 --> 17:01.650]  Because it's gonna be the same lock.
[17:01.730 --> 17:03.990]  Even if it's not the same code, you're gonna get the blank, and that's a big step.
[17:04.430 --> 17:06.110]  So, what about funnier stuff?
[17:06.230 --> 17:07.750]  What about, like, vehicles?
[17:08.690 --> 17:10.370]  Vehicles could never be key to like, right?
[17:10.850 --> 17:12.450]  Well, maybe like, rinky-dink vehicles.
[17:12.710 --> 17:14.670]  Maybe like, golf carts and electric carts.
[17:14.670 --> 17:18.290]  Maybe you have a really long connection at the airport, and you want to get there faster, right?
[17:18.670 --> 17:23.390]  Well, it will maybe not shock you that most little electric carts are all key to like.
[17:23.850 --> 17:28.730]  Like, again, the CC1 golf cart key, the club car key, which is clearly a very high...
[17:28.730 --> 17:30.390]  Which you definitely couldn't pick based on that thing.
[17:30.410 --> 17:30.750]  Yeah, you could never pick that.
[17:31.970 --> 17:32.370]  So...
[17:32.370 --> 17:32.870]  Yeah.
[17:33.070 --> 17:34.810]  Also, $275 free shipping.
[17:34.930 --> 17:35.130]  Damn.
[17:35.410 --> 17:35.670]  Yeah.
[17:36.470 --> 17:37.430]  How do you even make money?
[17:37.430 --> 17:37.830]  Right.
[17:38.150 --> 17:39.070]  So, like, this...
[17:39.070 --> 17:46.290]  Again, if you're the kind of jackass who can just find a golf cart, be aware that somebody like me or someone else could just maybe turn it on.
[17:46.390 --> 17:49.230]  Now, you always want to be careful when you turn on a golf cart.
[17:49.490 --> 17:56.010]  Make sure that somebody hasn't left, like, a pile of equipment on the pedals, because that could be bad, and it might run away from you.
[17:57.250 --> 17:57.890]  And some...
[17:57.890 --> 17:59.290]  He almost controls it.
[17:59.350 --> 18:01.090]  He's like, I got it, I got it, I don't got it.
[18:04.100 --> 18:06.940]  Yeah, so like, don't F around with things that you don't know what you're doing.
[18:06.940 --> 18:09.640]  You certainly shouldn't screw around with bigger equipment, right?
[18:10.760 --> 18:11.940]  So, yeah, this...
[18:15.180 --> 18:20.700]  We don't actually have a photo of the book I'm going to reference, but it's online, and I'm sure it won't be for very long.
[18:20.900 --> 18:31.180]  But the ILCO Equipment Key Reference Book is this PDF file that actually tells you the direct bidding for all kinds of equipment based on who made it and what the equipment is.
[18:31.320 --> 18:33.400]  So it's like, oh, I have a John Deere tractor.
[18:33.400 --> 18:39.360]  You look up John Deere tractor in the ILCO Equipment Reference Book, and it'll be like, D1098JD, whatever.
[18:39.960 --> 18:41.620]  Like, that's just what you do.
[18:41.940 --> 18:44.120]  Just look it up in the book, and there's your key.
[18:44.380 --> 18:44.460]  Yeah.
[18:44.460 --> 18:49.220]  And you look up some of the most popular, like, first versions that, like, here's the first entry in the code series.
[18:49.360 --> 18:50.560]  They're the ones that get used the most.
[18:50.740 --> 18:52.240]  So, like, Caterpillar Equipment, right?
[18:52.740 --> 18:54.460]  This is the most common Caterpillar Key.
[18:54.460 --> 19:00.000]  And again, like, damn on that price, 395 for this key, which allowed...
[19:00.000 --> 19:06.560]  Now, we're not saying that people are going to run out and just steal a bunch of bulldozers, as hilarious as that could be, depending on the context.
[19:07.220 --> 19:10.900]  But think about simpler bits of, like, security risks.
[19:11.040 --> 19:16.460]  So what do a lot of equipment sites do at night with their expensive stuff, their compressors, their generators?
[19:17.540 --> 19:18.040]  Any ideas?
[19:18.280 --> 19:18.500]  They elevate it.
[19:18.700 --> 19:19.520]  They elevate them.
[19:19.720 --> 19:22.020]  They just hoist them up on the crane, leave them in the air.
[19:22.700 --> 19:23.980]  Imagine just being able...
[19:23.980 --> 19:27.220]  Somebody walks up to that crane and go, oh, yeah, that's the key I bought for $4.
[19:28.060 --> 19:28.760]  Lower that.
[19:28.900 --> 19:29.280]  All right.
[19:29.520 --> 19:29.880]  Guess...
[19:29.880 --> 19:30.900]  We eating tonight, family.
[19:31.020 --> 19:32.540]  Driving off with a solar compressor.
[19:33.080 --> 19:35.720]  Yeah, just walk away with that $1,000 compressor machine.
[19:36.300 --> 19:39.300]  So, when we said vehicles, though, we didn't mean small or large.
[19:39.400 --> 19:40.720]  We kind of meant regular vehicles.
[19:40.900 --> 19:42.820]  But that's another topic, right?
[19:42.820 --> 19:48.480]  Yeah, I mean, automotive doesn't really get a whole lot of love from, like, the lockpicking community in general, I guess.
[19:48.580 --> 19:51.260]  But there's still a little bit of applicability to what we're talking about here.
[19:51.840 --> 19:53.360]  So, yeah, we were joking on Twitter.
[19:53.720 --> 19:56.660]  Maybe some of us, some of you who follow us, they saw this conversation.
[19:56.660 --> 19:58.520]  We're like, ah, lols, no fleet keys.
[19:58.720 --> 20:00.480]  Well, what pictures were we laughing at?
[20:00.540 --> 20:02.220]  We were laughing at, you know, this kind of...
[20:02.220 --> 20:03.880]  These officers are stuck out of their car.
[20:04.160 --> 20:06.360]  Not as leet as their plate would lead you to believe.
[20:08.400 --> 20:08.760]  And...
[20:08.760 --> 20:09.340]  Not shopped.
[20:09.480 --> 20:09.700]  Not Photoshopped.
[20:09.700 --> 20:10.540]  Yeah, not Photoshopped.
[20:11.000 --> 20:12.140]  And they're doing what?
[20:12.140 --> 20:12.980]  They're trying to slim-jim.
[20:13.080 --> 20:14.080]  They're trying to get into the car.
[20:14.180 --> 20:15.960]  They obviously have locked their keys in the car.
[20:16.700 --> 20:29.340]  Well, when we're laughing about, oh, no fleet keys, do you know that a lot, and I mean a lot, of cities, municipal fleets, including the police and other, you know, official vehicles, are keyed alike?
[20:30.020 --> 20:33.360]  We'll give the feds in the audience a moment to check that this is their key.
[20:33.360 --> 20:34.120]  Yeah.
[20:36.020 --> 20:36.460]  1284x.
[20:36.800 --> 20:40.680]  Everyone go ahead and put 1284x into Google for the lulls.
[20:41.040 --> 20:44.800]  You're going to see, like this image search turns up a lot of pictures of what kind of car?
[20:45.620 --> 20:46.260]  Crown Victoria.
[20:46.420 --> 20:46.520]  Yeah.
[20:46.600 --> 20:48.240]  These are all Ford Crown Vicks, right?
[20:48.680 --> 20:57.780]  If a police department or other official agency wants to order a bunch of vehicles and they want them keyed alike, it's almost always going to be a 1284x.
[20:58.360 --> 21:02.820]  Now, the real funny thing is, what happens to a lot of police cars in big cities when they're out of service?
[21:03.020 --> 21:05.300]  Like, they've had enough duty cycles, they get sold to do what?
[21:06.380 --> 21:06.740]  Taxis.
[21:06.940 --> 21:07.280]  Yeah.
[21:07.460 --> 21:07.820]  Yes.
[21:08.520 --> 21:08.880]  Taxis.
[21:09.260 --> 21:10.760]  By the way, this is a taxi, right?
[21:11.360 --> 21:12.060]  That's a taxi.
[21:12.540 --> 21:13.080]  What's this?
[21:13.680 --> 21:14.540]  Not a taxi.
[21:14.740 --> 21:15.520]  Not a taxi.
[21:15.920 --> 21:16.720]  Don't get in there.
[21:17.020 --> 21:17.180]  Yeah.
[21:17.760 --> 21:18.480]  Can anyone...
[21:18.480 --> 21:20.520]  Like, when Howard showed me this, I didn't catch most of it.
[21:20.580 --> 21:21.280]  I was like, really?
[21:21.440 --> 21:21.560]  What?
[21:21.740 --> 21:23.760]  Can anyone shout out anything they noticed that...
[21:24.600 --> 21:25.240]  All right.
[21:25.440 --> 21:26.240]  So, yeah, we got...
[21:26.240 --> 21:26.740]  That's one.
[21:26.940 --> 21:27.680]  It's the W.
[21:28.300 --> 21:28.760]  The what?
[21:28.980 --> 21:31.000]  The W in the nameplate or whatever.
[21:31.080 --> 21:31.880]  Oh, I didn't even notice that.
[21:31.880 --> 21:32.060]  That could be...
[21:32.060 --> 21:32.860]  I actually don't know that.
[21:33.260 --> 21:34.880]  Oh, who said trim?
[21:35.360 --> 21:35.680]  Rim.
[21:35.920 --> 21:36.500]  Oh, rim.
[21:36.960 --> 21:37.920]  The panel trim.
[21:38.000 --> 21:38.860]  Yeah, look at the panel trim.
[21:39.400 --> 21:40.960]  Taxis, at least in this city, are yellow.
[21:41.660 --> 21:42.520]  Panel trim, black.
[21:42.820 --> 21:43.200]  Big sign.
[21:43.260 --> 21:44.840]  And also, it's hard to see at this angle.
[21:44.940 --> 21:46.700]  It's like you couldn't just paint over the trim.
[21:46.880 --> 21:47.660]  The wrong wheelbase.
[21:48.040 --> 21:50.820]  So, that's just your little New York tip when you're walking around the city.
[21:51.400 --> 21:51.980]  What is it?
[21:52.360 --> 21:52.900]  It's a police car.
[21:53.040 --> 21:53.520]  It's a police car.
[21:53.680 --> 21:53.860]  Yeah.
[21:53.860 --> 21:54.860]  It's a police interceptor.
[21:55.440 --> 21:58.760]  But speaking of police and taxis, though, you got a pretty good story about this one, right?
[21:59.620 --> 21:59.840]  Yeah.
[22:00.000 --> 22:04.240]  So, this has actually been a useful thing, in fact.
[22:04.440 --> 22:13.620]  This is a bit apocryphal, so I apologize because I can't properly articulate it, but there was a police department that was arresting a taxi driver, in fact.
[22:13.620 --> 22:14.800]  Yeah, he was pulled over.
[22:14.960 --> 22:16.060]  He had a suspended license.
[22:16.140 --> 22:16.380]  He had a suspended license.
[22:16.520 --> 22:16.860]  Yeah, basically.
[22:17.160 --> 22:18.440]  So, you get cuffed.
[22:18.560 --> 22:19.460]  You can't drive home.
[22:19.980 --> 22:20.320]  You know?
[22:20.400 --> 22:21.000]  Do not pass go.
[22:21.320 --> 22:21.980]  Do not collect $200.
[22:22.440 --> 22:28.020]  They put him in the back of the car, and the officer that was making the arrest drops his keys into a storm drain.
[22:29.020 --> 22:31.860]  He doesn't want to get in trouble, so he calls one of his buddies on his phone.
[22:32.140 --> 22:35.740]  His buddy comes out with a coat hanger and tries to fish it out of the storm drain.
[22:35.840 --> 22:36.340]  He can't do it.
[22:36.340 --> 22:37.580]  They're working, they're fishing.
[22:37.740 --> 22:39.360]  They accept defeat, and they call their supervisor.
[22:39.880 --> 22:44.740]  While this is happening, the guy in the back is going, Just use my key.
[22:45.340 --> 22:46.400]  Just use my key.
[22:46.720 --> 22:48.420]  And they're like, come on, settle down.
[22:48.420 --> 22:49.000]  Pipe down back there.
[22:49.120 --> 22:49.740]  Pipe down back there.
[22:50.480 --> 22:51.320]  Just use my key.
[22:52.020 --> 22:53.640]  Finally, they're like, what are you talking about?
[22:53.860 --> 22:54.820]  And they use his key.
[22:55.380 --> 22:59.240]  Yeah, totally unlocks the door, totally starts the cruiser, totally can drive home.
[22:59.240 --> 23:14.460]  So, like, many, many cities, not New York, incidentally, many cities have the fleets of police cars keyed alike, and because of local municipal turnover, have taxis in the very same city with the same key to the police cars that are driving around.
[23:14.740 --> 23:19.040]  And, in fact, this specific department did re-key their entire fleet after this incident.
[23:19.040 --> 23:19.760]  Yeah, when they found out.
[23:19.920 --> 23:20.380]  Because it's not...
[23:20.380 --> 23:21.880]  They weren't even aware that this was a thing.
[23:22.000 --> 23:22.140]  Yeah.
[23:22.700 --> 23:23.720]  This is not just the doors.
[23:23.880 --> 23:24.900]  Like, it's the ignition, it's the trunk.
[23:25.160 --> 23:27.700]  There's nothing interesting in, like, a police car's trunk, right?
[23:28.120 --> 23:28.520]  Nothing...
[23:30.740 --> 23:32.120]  So, be aware of that.
[23:32.280 --> 23:34.720]  Be aware that this happens all the time.
[23:34.900 --> 23:38.760]  Now, when you tell people this, and you say, like, oh, yeah, this is a huge problem.
[23:38.900 --> 23:40.240]  Well, how does this happen?
[23:40.680 --> 23:44.780]  We're going to illustrate for you, through theater and scene, how this happens.
[23:45.080 --> 23:48.280]  I am a police car factory, and Howard is my supplier.
[23:48.660 --> 23:49.060]  Okay?
[24:04.710 --> 24:05.690]  Shady Lock Corp.
[24:06.070 --> 24:07.150]  Hey, yeah, man.
[24:07.250 --> 24:07.670]  How's it going?
[24:08.170 --> 24:11.030]  I got another order of those police cars from Anytown, USA.
[24:11.030 --> 24:12.230]  I got this PO here.
[24:12.410 --> 24:14.930]  It says they need 17 more units.
[24:15.170 --> 24:15.930]  But I got this...
[24:15.930 --> 24:16.510]  It's a weird note.
[24:16.650 --> 24:24.370]  It says, high security transports, special purpose, 1284x, not acceptable, key to like.
[24:25.270 --> 24:26.350]  I work with you all the time.
[24:26.470 --> 24:27.110]  Key to like...
[24:27.650 --> 24:29.010]  1284x means key to like, though, right?
[24:29.070 --> 24:29.650]  They don't want that?
[24:29.730 --> 24:30.350]  What do you do?
[24:31.250 --> 24:31.570]  Uh...
[24:31.570 --> 24:33.230]  How about 1294x?
[24:33.270 --> 24:33.950]  Does that work for you?
[24:34.530 --> 24:35.930]  I didn't know there even was that thing.
[24:36.010 --> 24:36.390]  Yeah, sure.
[24:36.950 --> 24:37.270]  1294x.
[24:37.270 --> 24:38.370]  Does it cost different?
[24:38.470 --> 24:39.030]  Does it take longer?
[24:39.430 --> 24:42.090]  Yeah, it's 200 bucks more, and it'll be a four-week delay.
[24:42.550 --> 24:43.150]  200 bucks?
[24:43.310 --> 24:44.250]  The 1284x?
[24:44.450 --> 24:45.670]  That only costs 50 bucks.
[24:45.830 --> 24:50.430]  I know, because I'm looking at a sticker from one of those cars that I totally didn't find on the Internet with police data on it.
[24:50.550 --> 24:51.550]  It says $50.
[24:52.050 --> 24:52.530]  And what?
[24:52.630 --> 24:53.670]  How much longer?
[24:53.790 --> 24:54.770]  Two, three weeks longer.
[24:55.250 --> 24:55.910]  Hey, man.
[24:55.910 --> 24:58.430]  I don't have a bunch of locks sitting on a shelf the way you want them.
[24:58.590 --> 24:59.610]  I gotta make them just for you.
[25:00.030 --> 25:00.670]  Oh, Jesus.
[25:00.950 --> 25:02.330]  I guess they're getting 1284x.
[25:03.050 --> 25:03.750]  And scene.
[25:09.040 --> 25:10.660]  So that's how this happens.
[25:11.360 --> 25:19.420]  The idea of even if there's some application where somebody somewhere in the chain is like trying to do the right thing or trying to say, man, I really...
[25:19.420 --> 25:21.300]  Jesus, these are like drug shipments.
[25:22.160 --> 25:23.580]  Oh, we should really use a different key.
[25:23.580 --> 25:29.060]  They're gonna call their supplier who is invariably going to say, oh, you don't want the ones you usually get?
[25:29.300 --> 25:31.160]  Oh, we're gonna be super back-ordered on that then.
[25:31.280 --> 25:32.200]  No one ever buys those.
[25:32.600 --> 25:40.040]  It's really common for multiple week lead times for these types of products if you actually want to even just have a bidding code that's just not the one they want to give you.
[25:40.160 --> 25:46.820]  And that should be a red flag to anybody buying it that the bidding code that you get is probably not specific or unique.
[25:47.280 --> 25:48.500]  It's just what's on the shelf.
[25:49.040 --> 25:49.260]  Yeah.
[25:49.760 --> 25:53.280]  So speaking of bidding codes, talking about looking up key codes, right?
[25:53.620 --> 25:58.900]  You can always try to look up the key to a lock you're targeting if there's any information about it.
[25:59.580 --> 26:02.240]  Let's look at this photo right here of a vending machine, okay?
[26:02.740 --> 26:05.340]  Can anybody tell me anything about the lock they see on that vending?
[26:05.360 --> 26:06.180]  What kind of lock is it?
[26:07.260 --> 26:07.580]  Tubular lock.
[26:07.580 --> 26:07.960]  Tubular lock.
[26:08.100 --> 26:08.860]  You might be able to pick it.
[26:08.960 --> 26:11.220]  Do you see anything else that you might be able to do on that lock, though?
[26:11.280 --> 26:11.820]  What else do you see?
[26:12.620 --> 26:13.320]  Anti-drill pin.
[26:13.780 --> 26:14.860]  Oh, anti-drill pin, you say, yeah.
[26:15.700 --> 26:16.340]  There is...
[26:16.340 --> 26:17.480]  Somebody said something up front.
[26:17.540 --> 26:17.940]  I heard of...
[26:17.940 --> 26:18.320]  Where was it?
[26:18.500 --> 26:19.040]  Line code.
[26:20.840 --> 26:22.860]  Yeah, not physical damage attack, though.
[26:22.860 --> 26:23.720]  I heard somebody say...
[26:23.720 --> 26:25.340]  Somebody said, you can see the key code, right?
[26:25.400 --> 26:25.960]  It's on there.
[26:26.000 --> 26:26.500]  Or you can see a code.
[26:26.700 --> 26:27.720]  It's hard to see on the slide.
[26:27.980 --> 26:29.480]  There's numbers stamped on there, right?
[26:30.740 --> 26:36.780]  For decades and decades, locksmiths have turned to their reference books, their code books.
[26:37.200 --> 26:39.320]  These are publications that have existed.
[26:39.540 --> 26:42.680]  They have been in trade, you know, usage forever.
[26:43.160 --> 26:46.320]  If you have a system that you need a new key for, you need to look up...
[26:46.320 --> 26:46.980]  Oh, what is this?
[26:47.120 --> 26:48.320]  This system leads...
[26:48.320 --> 26:50.060]  This leads to this, and you look it up in the table.
[26:50.500 --> 26:55.400]  These are all examples of code books that Howard owns that he has reference for.
[26:56.220 --> 27:04.220]  And what's fascinating is in terms of looking backwards, you know, locksmiths used to have just shelves full of books that would be references like this.
[27:04.460 --> 27:05.880]  Actually, if you could go back to the last one.
[27:07.220 --> 27:08.540]  The tubular one, yeah.
[27:08.880 --> 27:09.660]  This is fascinating.
[27:09.860 --> 27:13.080]  So randomness, I guess, wasn't so random when people didn't have computers.
[27:13.460 --> 27:17.600]  So rather than actually jumble the codes, there is definitely a discernible pattern.
[27:17.820 --> 27:18.460]  Yeah, they're just stepwise.
[27:18.700 --> 27:20.060]  In the way these have actually been created.
[27:20.260 --> 27:29.160]  It's not necessarily so obvious if you're not going to sit there and study it, but you can see a lot of the same numbers if you're just glancing at it even, that there's a pattern.
[27:29.320 --> 27:29.500]  Yeah.
[27:29.760 --> 27:33.660]  So imagine you work on a big site with many locks and you say, well, this is clearly my key.
[27:33.660 --> 27:39.460]  You can step through the biddings of the next few in the series and see if those were other locks that were installed in the series.
[27:40.220 --> 27:45.700]  But the idea like these are clearly a lot of these are old and you found these on auctions and when locksmiths you knew have closed their doors.
[27:46.660 --> 27:49.080]  Not a lot of people use code books like this anymore.
[27:49.260 --> 27:50.320]  Books are so quaint.
[27:50.440 --> 27:52.980]  Books are quaint as indeed how many people...
[27:52.980 --> 27:56.240]  I still have a huge library in my house, but I do a lot of my reading on a Kindle.
[27:56.500 --> 28:00.740]  How many people would not be surprised that there are kind of ebook versions of this?
[28:01.580 --> 28:01.940]  Yeah.
[28:02.420 --> 28:04.940]  How many people in this room have heard of Instacode?
[28:06.000 --> 28:06.980]  There's a couple of hands.
[28:07.080 --> 28:08.840]  Those of you who haven't, boy howdy.
[28:09.440 --> 28:11.880]  Let me tell you, you don't have to troll eBay like Howard.
[28:12.160 --> 28:15.320]  We should have probably gotten a referral link or an affiliate link before we did this.
[28:15.440 --> 28:15.600]  Yeah.
[28:15.680 --> 28:18.060]  All the Instacode subscriptions are going to blow through the roof.
[28:18.380 --> 28:23.420]  For $9.99, you too can have every code book in creation basically.
[28:24.140 --> 28:26.120]  So, Instacode is a subscription service.
[28:26.400 --> 28:29.620]  The monthly fee really is that low for the basic package.
[28:30.080 --> 28:33.460]  And again, like you punch in anything and there you go.
[28:33.580 --> 28:34.800]  There's your... like 1284X.
[28:34.940 --> 28:35.500]  There's the fleet key.
[28:35.660 --> 28:37.560]  There's the Ford Crown Vic in most cities.
[28:38.680 --> 28:41.980]  The CH751 we talked about, like the super utility cam lock.
[28:42.400 --> 28:43.220]  Like there that is.
[28:43.420 --> 28:46.440]  That was the quote gas pump key that the guys were talking about last night.
[28:47.260 --> 28:49.620]  Like, oh yeah, so we got 1284X, we got CH751.
[28:50.220 --> 28:50.680]  That's weird.
[28:51.040 --> 28:54.120]  The J200, that's totally not the elevators at the Hotel Pen.
[28:54.220 --> 28:55.560]  I have no idea why that's in our slides.
[28:55.720 --> 28:56.100]  Next slide.
[28:56.920 --> 28:58.280]  Yeah, let's just skip by that.
[28:58.680 --> 29:01.120]  But, this is a fun like side note here.
[29:01.340 --> 29:02.620]  So, we've got a little master lock.
[29:02.800 --> 29:04.320]  Can we hand it to you guys in the front row here?
[29:04.580 --> 29:06.200]  Verify, that's just a master lock, right?
[29:07.220 --> 29:08.920]  Now, you could do what?
[29:08.940 --> 29:10.800]  You could do what to this master lock?
[29:11.460 --> 29:12.820]  You could shim it, yes.
[29:13.140 --> 29:15.780]  Let's say you don't want to cut your fingers up on some aluminum.
[29:15.780 --> 29:17.080]  Let's say...
[29:17.080 --> 29:18.200]  Let's say you have $10.
[29:18.540 --> 29:19.580]  You have $10, though.
[29:19.740 --> 29:20.020]  And a phone.
[29:20.180 --> 29:20.640]  And a phone.
[29:20.640 --> 29:21.940]  You can get some Instacode, right?
[29:22.380 --> 29:24.900]  You ever notice those little codes that are on the back of master locks?
[29:25.400 --> 29:25.800]  Yeah.
[29:26.260 --> 29:31.240]  So, you can go ahead and take that, look at those numbers, put them into the search box in Instacode.
[29:31.780 --> 29:32.960]  Get a bunch of results.
[29:33.160 --> 29:35.100]  But, you scroll down to master lock.
[29:35.360 --> 29:35.760]  Combination.
[29:35.880 --> 29:37.180]  And there you go.
[29:37.560 --> 29:41.560]  Would anyone care to try 321432?
[29:42.540 --> 29:43.960]  And we'll see if that works.
[29:45.160 --> 29:45.520]  Yes.
[29:45.520 --> 29:45.840]  Yes, question.
[29:56.740 --> 30:00.980]  So, you used to be able to just call a lot of the manufacturers and say, hi, I'm...
[30:00.980 --> 30:01.420]  Oh, open?
[30:01.500 --> 30:01.820]  Open!
[30:02.140 --> 30:02.620]  There we go.
[30:02.740 --> 30:02.900]  Woo!
[30:03.260 --> 30:03.580]  Yeah.
[30:03.860 --> 30:06.700]  So, calling for the lookup data or using Instacode.
[30:06.800 --> 30:09.640]  Now, we said the $9.99 is the basic subscription, right?
[30:09.820 --> 30:10.640]  You can pay more.
[30:10.800 --> 30:12.600]  You can get like the auto instruction package.
[30:13.060 --> 30:16.640]  You can get like direct, you know, diagrams on how to pop doors.
[30:16.640 --> 30:20.260]  And you definitely can't just pay for one month and screenshot everything?
[30:20.640 --> 30:20.720]  Yeah.
[30:20.880 --> 30:21.760]  Because these aren't screenshots.
[30:22.000 --> 30:22.360]  These are...
[30:22.360 --> 30:22.920]  Oh, wait, shit.
[30:23.020 --> 30:23.560]  These are screenshots.
[30:23.760 --> 30:24.140]  Oh, my God.
[30:24.500 --> 30:25.240]  That works.
[30:25.720 --> 30:30.660]  And if maybe you can't even afford a laptop, but you have a smartphone, yes, of course it's a mobile app.
[30:30.660 --> 30:31.500]  There's an app for that.
[30:32.660 --> 30:36.960]  But yeah, before we actually move on, the other one, Snap Decoder, is actually free.
[30:38.640 --> 30:42.420]  So, that's about to be trending on Google Play or whatever.
[30:46.420 --> 30:47.940]  Now, they do verify, right?
[30:48.040 --> 30:48.840]  They verify something.
[30:49.020 --> 30:49.940]  It's, what is it?
[30:50.000 --> 30:50.680]  Oh, it's the zip code.
[30:50.760 --> 30:51.960]  The billing zip code of your card.
[30:52.380 --> 30:54.000]  You thought I was going to say your locksmith ID.
[30:54.200 --> 30:54.680]  Oh, my God.
[30:54.680 --> 30:54.960]  No.
[30:55.080 --> 30:55.800]  They don't verify that.
[30:55.880 --> 30:57.340]  They apparently do something.
[30:57.920 --> 30:59.380]  What the f*ck if I know what it is?
[31:00.380 --> 31:03.400]  Yeah, they take like 24 hours to process your order.
[31:03.580 --> 31:06.680]  And we always thought they were verifying things, but they really don't.
[31:06.800 --> 31:07.380]  Not so much.
[31:10.020 --> 31:12.860]  So, what about even like higher security keys?
[31:12.960 --> 31:14.780]  What about stuff that the government might be using?
[31:15.020 --> 31:16.040]  They would never...
[31:16.040 --> 31:16.360]  Come on.
[31:16.440 --> 31:19.920]  The government's not going to key everything alike in any installation ever.
[31:20.000 --> 31:20.660]  That's not going to happen.
[31:21.480 --> 31:27.380]  Well, if you saw Josveus last time at previous HOPE, he talked about traffic cameras overseas in Europe.
[31:27.800 --> 31:28.940]  Those were all key to like.
[31:29.100 --> 31:32.140]  And that was this big, oh my God, moment when the news was reporting on that.
[31:32.600 --> 31:36.900]  My personal favorite part of this story actually was not the key to like thing, even though I'm a lock guy.
[31:37.100 --> 31:39.780]  It's that like biker gangs didn't like traffic cameras.
[31:39.880 --> 31:45.320]  So they were apparently throwing like old tires over the cameras and lighting them on fire.
[31:45.480 --> 31:45.640]  Yes.
[31:45.940 --> 31:48.000]  And that was their like DOS attack on the cameras.
[31:48.140 --> 31:49.420]  That was pretty funny, I thought.
[31:50.440 --> 31:57.260]  But in the U.S. we have a very popular government key in very, very common usage in different cities that's key to like.
[31:57.380 --> 32:02.800]  Again, if you saw Dark Sim and Johnny and Night Owl, who here last night saw the postal key, right?
[32:02.900 --> 32:12.120]  This is the U.S. Post arrow key, which the idea is opening up the mailboxes with one kind of master key in each region so you can deliver the mail.
[32:12.520 --> 32:15.400]  Now, that's not the only thing that these keys open, however, right?
[32:16.140 --> 32:17.500]  Yeah, and by the way, that was on Etsy.
[32:18.600 --> 32:21.580]  So, outside of buildings, very commonly you'll see key keepers.
[32:21.760 --> 32:29.560]  It's a way for the postman to access the vestibule of a building for the purpose of leaving packages within the vestibule where it's...
[32:29.560 --> 32:32.280]  Yeah, if you get your mail like in your vestibule, this is usually how they're doing that.
[32:33.140 --> 32:35.460]  Now, the idea, you might say, oh, wow, that's crazy.
[32:35.580 --> 32:39.040]  Like, a key outside of a building that lets you have the key to the building?
[32:39.080 --> 32:39.800]  That's wild.
[32:39.800 --> 32:42.100]  There's no such other thing that does this.
[32:42.360 --> 32:43.580]  Oh, there is.
[32:43.980 --> 32:46.460]  Let's talk to you for a second about Knox boxes.
[32:47.020 --> 32:49.540]  How many people have heard of Knox boxes or fireboxes?
[32:49.600 --> 32:52.880]  Yeah, we've hit on this topic in other conversations before.
[32:53.140 --> 33:01.040]  And I'm going to preface this by simply saying nothing that we're about to say is to cast any dispersion on the physical security or the rating of the box itself.
[33:01.320 --> 33:03.100]  Yeah, Knox makes a robust product.
[33:03.500 --> 33:05.180]  It's a heavy-ass steel box.
[33:05.340 --> 33:07.100]  They show a lot of videos on their website, right?
[33:07.260 --> 33:07.800]  Yeah, there's...
[33:07.800 --> 33:13.560]  Well, I don't know how long it'll be there, but there's a hammer attack test video on the Knox box website, which is fascinating to watch.
[33:14.620 --> 33:15.720]  With that being said...
[33:15.720 --> 33:18.480]  The idea is the fire company has a high-security key.
[33:18.880 --> 33:22.860]  They can get your other building key inside of the Knox box if they show up.
[33:22.920 --> 33:24.340]  Or they can do other functions, right?
[33:24.460 --> 33:26.100]  Like opening gates and things like that.
[33:26.260 --> 33:26.400]  Right.
[33:26.400 --> 33:28.160]  So the firefighters have one key.
[33:28.380 --> 33:29.640]  It does things.
[33:29.700 --> 33:32.960]  And it opens it and lets them into the building when it's on fire, right?
[33:33.160 --> 33:40.620]  Now what would happen if someone were to not just compromise a Knox box and get the building key, but compromise the box itself, like take the box away?
[33:40.840 --> 33:41.000]  Right.
[33:41.080 --> 33:41.720]  Here's the thing.
[33:41.860 --> 33:43.800]  Building owners are so worried about their key.
[33:44.320 --> 33:45.560]  Well, let's step back for a second.
[33:45.560 --> 33:48.560]  If every box is opened by the same key...
[33:50.320 --> 33:53.460]  What do you think is going to happen if someone just takes the box?
[33:54.020 --> 33:56.480]  And no one would ever do such a thing, right?
[33:56.780 --> 33:57.040]  Right.
[33:57.780 --> 33:59.420]  Because they're mounted in...
[33:59.420 --> 34:00.980]  What does the actual specs say?
[34:01.060 --> 34:02.610]  It has to be mounted in reinforced concrete...
[34:03.160 --> 34:05.080]  The hammer attack test video is hilarious.
[34:05.320 --> 34:11.400]  They very quickly mention this is mounted on a reinforced concrete wall with gradated fasteners and it's six-inch fasteners.
[34:11.620 --> 34:11.720]  Oh.
[34:12.220 --> 34:13.060]  I mean...
[34:13.060 --> 34:13.480]  Okay.
[34:13.700 --> 34:14.740]  Because that's what everyone's doing, right?
[34:14.740 --> 34:15.240]  That's what everyone's...
[34:15.240 --> 34:15.960]  No one would just...
[34:15.960 --> 34:16.740]  Oh, shoot.
[34:19.520 --> 34:21.240]  That doesn't look like it's got a back plate.
[34:21.440 --> 34:21.920]  No, that's the thing.
[34:22.000 --> 34:25.100]  They actually say, oh, if you're going to mount it on a pole, you know, here's how to do it.
[34:25.840 --> 34:27.020]  But it's not like that.
[34:27.180 --> 34:27.440]  Yeah.
[34:27.500 --> 34:28.900]  And it's definitely...
[34:28.900 --> 34:29.340]  Definitely...
[34:29.340 --> 34:30.220]  Not like that.
[34:30.480 --> 34:31.860]  On final siding.
[34:32.120 --> 34:32.260]  Yeah.
[34:32.820 --> 34:36.180]  Final siding is going to hold up just fine against a hammer attack.
[34:37.200 --> 34:37.500]  And...
[34:37.500 --> 34:38.420]  Like he's really...
[34:38.420 --> 34:39.300]  Howard took these photos.
[34:39.480 --> 34:42.700]  He's really close to this Knox box on a very interesting building.
[34:42.820 --> 34:43.380]  We won't say where.
[34:44.340 --> 34:46.020]  So, this is the thing though, right?
[34:46.380 --> 34:52.880]  Stealing a Knox box, obviously, would be something that would be treated as compromising the whole system.
[34:53.160 --> 34:58.660]  But I don't know that people process that that way right now because it's not uncommon.
[34:58.940 --> 35:00.140]  In fact, I'm on Twitter.
[35:00.340 --> 35:01.580]  Maybe some of you folks are too.
[35:01.820 --> 35:03.600]  I saw this photo on Twitter.
[35:03.600 --> 35:03.920]  Yeah.
[35:04.320 --> 35:05.620]  SoB put this on Twitter.
[35:05.760 --> 35:06.540]  He was like, damn.
[35:07.360 --> 35:08.580]  There's two things to say here.
[35:08.640 --> 35:08.760]  Yeah.
[35:08.860 --> 35:10.760]  The first is, the door is missing.
[35:10.980 --> 35:12.320]  So, someone's got that door.
[35:12.480 --> 35:13.460]  Which means, the lock is missing.
[35:13.900 --> 35:14.020]  Yeah.
[35:14.020 --> 35:16.800]  Which means, it's probably in somebody's custody.
[35:16.800 --> 35:17.520]  It shouldn't be.
[35:17.700 --> 35:19.340]  And it can be reverse engineered.
[35:19.900 --> 35:23.120]  With that being said also, the tamper switch isn't wired, so it was installed wrong.
[35:23.660 --> 35:26.340]  And these are totally grade eight fasteners, right?
[35:26.340 --> 35:26.980]  Oh, wait.
[35:27.120 --> 35:28.300]  Those are blue, like, wood screws.
[35:28.740 --> 35:28.940]  Yeah.
[35:29.020 --> 35:29.280]  Sorry.
[35:30.380 --> 35:31.480]  So, the idea...
[35:31.480 --> 35:35.160]  I love when you said you were taking the Knox Box photos on the pole and the siding, right?
[35:35.240 --> 35:35.480]  Oh, yeah.
[35:35.580 --> 35:36.340]  Somebody came up to you, too.
[35:36.360 --> 35:37.160]  Can we just scroll back?
[35:37.340 --> 35:37.820]  So, yeah.
[35:38.020 --> 35:43.200]  So, I, of course, I'm, you know, doing my thing, taking photos of Knox Boxes out in public.
[35:43.700 --> 35:45.120]  And somebody goes, can I help you?
[35:45.380 --> 35:46.500]  I go, no, it's cool, man.
[35:46.520 --> 35:47.200]  I caught the Pikachu.
[35:48.220 --> 35:48.540]  Yeah.
[35:51.940 --> 35:52.260]  Yep.
[35:52.740 --> 35:53.460]  I'm done now.
[35:59.860 --> 36:04.940]  Now, as far as government keys go, some keys are actually protected by code.
[36:05.380 --> 36:07.260]  So, even though, like, oh, this is bad stuff.
[36:07.380 --> 36:09.280]  Look at the, you know, for example, the arrow key.
[36:09.440 --> 36:09.880]  Oh, my God.
[36:10.120 --> 36:10.760]  Postal keys.
[36:11.020 --> 36:14.520]  Well, like, it says specifically in code, like, no one's allowed to have this.
[36:14.740 --> 36:15.280]  This was...
[36:15.280 --> 36:16.400]  I found this one on Etsy.
[36:16.520 --> 36:16.920]  I have no idea.
[36:17.000 --> 36:17.900]  It must be deprecated.
[36:18.080 --> 36:20.680]  Or somebody's got balls of brass on Etsy.
[36:21.880 --> 36:23.900]  They sell those next to the little other trinkets.
[36:24.000 --> 36:26.760]  They're like, these are my beautiful, polished, artisanal brass balls.
[36:26.900 --> 36:27.160]  Hashtag key.
[36:27.160 --> 36:27.780]  Yeah.
[36:28.800 --> 36:31.280]  But, you know, keys being restricted by code is...
[36:31.280 --> 36:32.120]  You'd think a good thing.
[36:32.420 --> 36:35.500]  It's never going to be a problem except, oh, when it is.
[36:35.640 --> 36:38.320]  Like, do you remember the FEOK one last time around, right?
[36:38.420 --> 36:43.620]  The protection of law is only as strong as the punishment that is, like, corresponding with it.
[36:43.760 --> 36:46.480]  So, I mean, people will possess it illegally regardless.
[36:46.940 --> 36:49.040]  It's just sort of something that's going to happen.
[36:49.200 --> 36:49.220]  Yeah.
[36:49.220 --> 36:53.500]  And that's why the law is there to establish what happens when you possess it inappropriately.
[36:53.620 --> 36:59.240]  So, we showed last time, we showed in the elevator talk, like, FEOK one, the most universal fire key for elevators in the code.
[36:59.240 --> 37:02.080]  It says, only elevator personnel shall possess this key.
[37:02.400 --> 37:06.120]  Also, they put the direct f*cking bidding code in the, you know, in the code document.
[37:06.500 --> 37:07.020]  Which...
[37:07.020 --> 37:07.640]  Which...
[37:07.640 --> 37:09.240]  And to be fair...
[37:09.760 --> 37:10.680]  Since this talk...
[37:10.680 --> 37:11.360]  After our talk...
[37:11.960 --> 37:12.960]  They updated the document.
[37:13.120 --> 37:13.860]  Their code has been updated.
[37:14.700 --> 37:17.720]  Now, when you say updated, did they take the bidding code out of the document?
[37:18.300 --> 37:19.100]  Not exactly.
[37:19.400 --> 37:20.160]  No, that's still there.
[37:20.660 --> 37:21.500]  But they added...
[37:22.060 --> 37:24.660]  They doubled down and published a dimensional drawing.
[37:25.040 --> 37:25.220]  Yeah.
[37:27.180 --> 37:31.460]  So, if you have any FEOK one keys that don't work right, like, double check your notes.
[37:31.580 --> 37:32.040]  Hope you were...
[37:32.040 --> 37:36.020]  If you were cutting it to the Chicago key style, yeah, that explains why.
[37:36.380 --> 37:37.240]  ASME's got you covered.
[37:37.340 --> 37:37.560]  It wasn't working.
[37:38.380 --> 37:40.560]  So, yeah, you'd think, like, that's a one-off joke.
[37:40.560 --> 37:44.260]  Like, keys being published by the very entities that should be protecting them.
[37:44.360 --> 37:44.800]  But it's not.
[37:45.320 --> 37:49.820]  So, Howard is the amazing, like, Google dork in the ways that I wish I could be.
[37:50.040 --> 37:52.060]  And starts showing me things he searched for.
[37:52.180 --> 37:53.140]  He's like, well, check it out, Dave.
[37:53.460 --> 38:01.960]  If you search 1284x file type PDF, pretty much spits out a list of municipalities all over that are using this for their police car key fleet.
[38:02.380 --> 38:02.820]  Like...
[38:02.820 --> 38:04.800]  I guess thanks for letting me know.
[38:05.240 --> 38:05.480]  Yeah.
[38:06.140 --> 38:06.860]  You can just...
[38:06.860 --> 38:09.080]  Like, you were searching just file types on gov sites.
[38:09.080 --> 38:09.500]  It's keyed on like...
[38:09.500 --> 38:11.660]  Key to like, site gov file type PDF.
[38:12.440 --> 38:12.700]  Yeah.
[38:13.020 --> 38:14.960]  You get a lot of interesting PDFs.
[38:14.980 --> 38:18.320]  You got this PDF from the Department of Housing and Urban Development, right?
[38:18.460 --> 38:23.820]  This one is actually so ridiculous that we took steps to take some information out, which...
[38:23.820 --> 38:23.940]  Yeah.
[38:23.940 --> 38:26.080]  We put some little redactions in here because it contains...
[38:26.700 --> 38:27.020]  What?
[38:27.100 --> 38:28.700]  It contains the HUD office keys, right?
[38:28.860 --> 38:30.100]  The full bidding code.
[38:30.220 --> 38:34.420]  They're saying, we want our office keyed this way with this bidding code.
[38:34.420 --> 38:36.240]  What could possibly go wrong?
[38:36.720 --> 38:38.360]  In like, every city ever, right?
[38:38.560 --> 38:39.360]  It just goes through...
[38:39.360 --> 38:40.220]  It keeps going on, yeah.
[38:40.320 --> 38:40.440]  Yeah.
[38:40.440 --> 38:42.020]  Like, here's this state, that state, the other place.
[38:42.540 --> 38:44.720]  So, the idea of just publishing...
[38:44.720 --> 38:44.980]  These are...
[38:44.980 --> 38:46.240]  I mean, these are contractor specs.
[38:46.700 --> 38:55.660]  These are specifications to be followed, but the fact that it's online and it's all key to like, for every office in the state of Maryland, every office in the state of wherever.
[38:56.160 --> 38:58.040]  That's in freaking sane.
[38:58.440 --> 39:04.500]  Does an official from Maryland need to like, go to every office of the HUD in Maryland before 9am and they just need the one key?
[39:04.620 --> 39:05.020]  I don't know.
[39:06.120 --> 39:07.160]  This is a great...
[39:07.160 --> 39:08.100]  Who follows...
[39:08.100 --> 39:09.840]  There's a couple of YouTube channels.
[39:09.960 --> 39:10.900]  I'm a big YouTube dork.
[39:11.020 --> 39:12.720]  Like, I don't have TV, but I enjoy my YouTube.
[39:13.160 --> 39:17.880]  I live in this little town in Montana where like, SciShow is produced and a bunch of other channels that I love.
[39:18.140 --> 39:23.780]  But Veritasium, this guy, Derek from New Zealand, he did a visit to a nuclear silo.
[39:23.780 --> 39:27.020]  And like, I love the history of America's nuclear arms.
[39:27.040 --> 39:29.720]  And I love the whole, like the control systems that were down there.
[39:30.000 --> 39:33.460]  So it was a thrill getting to see, like, he does a little...
[39:33.460 --> 39:34.120]  It's a museum.
[39:34.240 --> 39:35.280]  One that's been turned into a museum.
[39:35.280 --> 39:36.480]  So he got to do a dry run.
[39:36.640 --> 39:39.420]  He's with the Proctor and he's like, they're turning the keys, man.
[39:39.700 --> 39:42.600]  And I paused it and I was like, Howard, Howard, check this link out, man.
[39:42.640 --> 39:43.460]  What do you think of this key?
[39:44.240 --> 39:44.600]  Like...
[39:44.600 --> 39:46.100]  So this is kind of interesting.
[39:47.220 --> 39:47.760]  All right.
[39:48.040 --> 39:49.660]  I know what kind of key it is.
[39:49.780 --> 39:49.920]  Yeah.
[39:49.920 --> 39:58.100]  Certainly that doesn't limit it down to exactly 405 different possibilities that you can buy on the guide key set is what it's called, by the way.
[39:58.620 --> 40:02.480]  There's literally a set of every key in the series that you can buy.
[40:02.700 --> 40:06.200]  Now, it's not as if an attacker was going to get into the facility and turn this key.
[40:06.340 --> 40:11.160]  What Howard found funny is Howard actually knows the code about DOD keys, right?
[40:11.160 --> 40:12.020]  Well, not exactly.
[40:12.140 --> 40:13.260]  I'm not going to pretend I'm a lawyer.
[40:13.400 --> 40:16.600]  But what happened was, of course, with the Google Foo, we started searching U.S.
[40:16.720 --> 40:18.260]  code for the word key.
[40:18.980 --> 40:19.220]  Yeah.
[40:19.480 --> 40:21.140]  And this popped up, which is fascinating.
[40:22.100 --> 40:26.060]  Because any lock or key adopted by the DOD is covered in the scope of this.
[40:26.380 --> 40:31.900]  And they actually go so far as to say that key means any key, key blank, or key way.
[40:31.900 --> 40:32.780]  So apparently, yeah.
[40:32.780 --> 40:34.280]  That protects important things.
[40:34.540 --> 40:40.460]  Apparently, during the time when at least the Titan 2 systems were online, the CG1 keyway was just verboten.
[40:40.620 --> 40:42.820]  The CG1 keyway should have been illegal, technically.
[40:43.100 --> 40:43.140]  Yes.
[40:43.140 --> 40:45.040]  But it really wasn't, I guess, because reasons.
[40:45.760 --> 40:49.920]  But yeah, like government key systems being key to like, of course, why not?
[40:50.040 --> 40:50.740]  This is the government.
[40:51.860 --> 40:54.120]  But to bring it back, I mean, I know we've been...
[40:54.120 --> 40:55.400]  A lot of these are just funny stories.
[40:55.400 --> 40:57.480]  We're not just going to make you all laugh up here the whole time.
[40:57.780 --> 41:01.780]  We do want to kind of drop something that is meaningful, especially to the city of New York.
[41:02.240 --> 41:05.040]  Let's come back to the 2642 key.
[41:05.620 --> 41:12.140]  And this, boy, this topic, if you saw us in the elevator talk, you saw us talking about this is the New York City fire key.
[41:12.280 --> 41:14.540]  Every elevator in New York uses this key.
[41:14.760 --> 41:15.420]  Sure does.
[41:16.020 --> 41:18.280]  And a friend of ours who is here today.
[41:18.480 --> 41:19.180]  That's the state.
[41:19.920 --> 41:20.360]  That's...
[41:20.360 --> 41:21.020]  The 1620 is the city.
[41:21.200 --> 41:23.240]  Well, the 1620 is the fire door key.
[41:23.340 --> 41:27.080]  The 2642 is just the fire service key on the key switch.
[41:27.400 --> 41:27.700]  That's the state.
[41:27.940 --> 41:28.780]  The city is 1620.
[41:28.900 --> 41:29.220]  Okay.
[41:29.220 --> 41:30.960]  So, Tarabit...
[41:31.620 --> 41:32.840]  Tarabit sends us this photo.
[41:33.500 --> 41:34.780]  And we're not going to lie, dude.
[41:34.960 --> 41:37.060]  Like, get yourself a drink because right now...
[41:37.060 --> 41:41.280]  The first thing that I said when I saw this was bullshit.
[41:41.860 --> 41:42.000]  Yeah.
[41:42.300 --> 41:43.120]  And I was...
[41:43.120 --> 41:43.580]  We're DMing.
[41:43.680 --> 41:46.920]  We're like, that's some really good Photoshop with the mirror image of the key.
[41:47.160 --> 41:50.900]  Like, he's really trying hard to pull our fricking leg here with this stupid-ass key.
[41:50.900 --> 41:52.280]  So, we all...
[41:52.280 --> 41:55.520]  Like, Howard and I were like, it's a f*cking Kwikset key.
[41:55.980 --> 41:57.960]  No way is that real.
[41:58.740 --> 42:00.780]  So, then brother sends us this video.
[42:01.720 --> 42:02.940]  In a fire panel.
[42:03.360 --> 42:04.060]  And we're like, alright.
[42:04.300 --> 42:07.180]  He's got the key and he's trying to just pretend...
[42:07.180 --> 42:07.380]  What?
[42:10.880 --> 42:12.240]  So, now we got interested.
[42:12.400 --> 42:12.820]  We're like...
[42:12.820 --> 42:15.080]  So, then wheels start turning.
[42:15.940 --> 42:16.220]  Alright.
[42:16.380 --> 42:18.240]  And we buy, of course, a similar lock.
[42:18.240 --> 42:23.440]  Let's talk about some of the very popular lock installations for fire service keys in New York.
[42:23.640 --> 42:26.140]  This is a cam lock that would...
[42:26.140 --> 42:27.840]  Now, there's different ways of doing fire service.
[42:28.080 --> 42:30.400]  This is an access panel to the fire controls.
[42:30.680 --> 42:31.540]  But it's one of...
[42:31.540 --> 42:32.520]  It's a very popular vendor.
[42:32.840 --> 42:34.060]  It is a wafer lock.
[42:34.720 --> 42:35.280]  It is.
[42:35.680 --> 42:36.420]  You take it apart.
[42:36.900 --> 42:37.420]  You'll see...
[42:37.420 --> 42:38.660]  It looks like a lot of wafers in there, right?
[42:39.080 --> 42:39.240]  Look.
[42:39.340 --> 42:40.100]  Count them all up.
[42:40.200 --> 42:40.600]  Like, oh, wow.
[42:40.780 --> 42:41.640]  Two, four, six, eight.
[42:41.720 --> 42:41.860]  Wow.
[42:42.000 --> 42:42.480]  All those...
[42:42.480 --> 42:43.480]  So many wafers and biddings.
[42:44.200 --> 42:44.560]  Well...
[42:44.560 --> 42:45.120]  But...
[42:45.120 --> 42:45.840]  What's going on?
[42:45.940 --> 42:46.700]  Doesn't go all the way.
[42:46.700 --> 42:47.980]  Not all of them are the same.
[42:48.460 --> 42:52.940]  So, some of them are what you would call operating wafers, key bidding wafers.
[42:53.520 --> 42:55.940]  Others are just known as guide wafers.
[42:56.140 --> 42:57.300]  They don't move up and down.
[42:57.520 --> 42:58.960]  They don't block the cylinder from...
[42:58.960 --> 43:00.040]  They just guide the key.
[43:00.560 --> 43:02.380]  They see if the right key is...
[43:02.380 --> 43:07.680]  Because you notice, the key way on this lock is not a Yale 8 key way like you'd expect.
[43:07.900 --> 43:09.320]  Like, that's just a giant rectangle.
[43:09.320 --> 43:12.460]  It's literally a lane on the New Jersey turnpike, apparently.
[43:13.740 --> 43:15.840]  So, that's what those guide wafers are for.
[43:16.000 --> 43:19.800]  And you notice, they do a tremendous job of making the key really tightly fit in there.
[43:21.240 --> 43:26.840]  As for the actual operating wafers, there are not as many as you would think there either, though.
[43:26.840 --> 43:28.320]  So, here we have a key.
[43:28.420 --> 43:33.200]  Now, the tip of the key does not use any bidding, as we talked about in our last talk.
[43:33.360 --> 43:36.180]  Like, the tip of the key, the fifth bidding position really isn't there.
[43:36.600 --> 43:37.560]  But, look at this.
[43:37.620 --> 43:39.840]  The front of the key is clearly exposed with no...
[43:39.840 --> 43:41.440]  Like, there's empty wafer holes.
[43:41.660 --> 43:42.560]  What's going on here?
[43:43.000 --> 43:43.380]  Okay.
[43:43.660 --> 43:47.660]  You have the citywide standard key and the New York City fire key.
[43:47.760 --> 43:48.440]  These are two keys.
[43:48.640 --> 43:50.140]  The 2642 and the 1620.
[43:50.440 --> 43:53.080]  They have similar, but not exact biddings.
[43:53.080 --> 43:56.000]  Now, the tip of the key, again, like, you could ignore that.
[43:56.120 --> 43:57.060]  And the manufacturer did.
[43:57.240 --> 43:58.420]  They're like, alright, well, we don't care about that.
[43:58.520 --> 44:02.420]  But, we still have a problem that we need to make a lock that operates both of these.
[44:02.900 --> 44:05.860]  But, like, a wafer... you can't really master a wafer lock easily.
[44:06.180 --> 44:07.040]  So, what do they do?
[44:08.480 --> 44:09.260]  Take out a chamber.
[44:09.480 --> 44:10.880]  Take out a wafers from the chamber.
[44:11.040 --> 44:11.220]  Done!
[44:11.400 --> 44:12.220]  We got that one covered.
[44:12.320 --> 44:12.720]  Nailed it.
[44:12.800 --> 44:13.060]  Alright.
[44:13.840 --> 44:14.940]  That's literally what they did.
[44:15.100 --> 44:17.240]  They have three cut positions they care about.
[44:17.440 --> 44:21.500]  And they also make a lock that works in the 3502 application across four states.
[44:21.500 --> 44:24.620]  And, immediately, when we were playing with this, we noticed something odd.
[44:24.800 --> 44:26.400]  The key doesn't go in all the way.
[44:26.440 --> 44:26.880]  Doesn't go in all the way.
[44:27.020 --> 44:28.000]  So, let's take that one apart.
[44:28.200 --> 44:29.320]  Well, they have a lot of wafers.
[44:29.520 --> 44:32.440]  But, again, only four of them are real operating wafers.
[44:32.940 --> 44:35.920]  They also use guide wafers that don't fit very well.
[44:36.700 --> 44:39.400]  By the way, none of you have even noticed this isn't even a Yale key.
[44:39.680 --> 44:42.600]  This is a freaking Kwikset key just jammed into that guide wafer.
[44:42.700 --> 44:43.520]  It works just fine.
[44:44.000 --> 44:50.240]  And, if you take this, if you slip the right key into a New York lock, you can see this is the New York City key.
[44:50.860 --> 44:53.000]  This is a Kwikset key, like we saw.
[44:53.200 --> 44:55.300]  And, sure enough, those wafers are lined up.
[44:55.400 --> 44:56.500]  Well, how is that possible?
[44:56.500 --> 44:59.100]  So, we bust out our TI-86.
[44:59.580 --> 45:02.120]  Do a little math on the Yale biddings.
[45:02.300 --> 45:06.620]  You'll find so many Kwikset biddings that are close enough to the Yale.
[45:07.000 --> 45:10.340]  Not only does a key that somebody found work.
[45:10.800 --> 45:16.140]  This system is actually exploitable and can be accessed by any of these Kwikset keys at all.
[45:16.320 --> 45:17.520]  Everybody check your pockets.
[45:17.860 --> 45:18.320]  We'll give you a second.
[45:18.340 --> 45:19.460]  Check your pockets if you have these keys.
[45:19.640 --> 45:21.220]  Because, again, it's only three biddings.
[45:21.240 --> 45:23.460]  So, you can jiggle a key in or out.
[45:23.700 --> 45:25.460]  In the end, we went to Home Depot.
[45:25.460 --> 45:29.600]  We actually looked at packages because you can look at the locks through the package, right?
[45:29.940 --> 45:38.860]  And we found an actual lock on the shelf that has, like right off the shelf, has a key that you could stick into these cam locks and completely make it work.
[45:39.480 --> 45:42.600]  Now, you can ask us later what this was replacing.
[45:42.900 --> 45:46.540]  There is a very valid reason that this was engineered this way.
[45:46.560 --> 45:51.860]  And it has to do with pin tumbler locks and what's going on with fire service on elevators.
[45:51.960 --> 45:52.760]  And it's all very technical.
[45:52.880 --> 45:55.300]  And we're going to skip past it because we're running out of time.
[45:55.300 --> 45:55.540]  Yeah.
[45:55.700 --> 45:56.280]  But ask us later.
[45:56.420 --> 45:58.260]  You have to be able to pull the key in multiple positions.
[45:58.540 --> 46:06.020]  So, to cheapen the process, to make it easier, you can either find any one of many Kwikset keys that Howard just started spitting out.
[46:06.080 --> 46:07.040]  He's like, oh my God, this works.
[46:07.140 --> 46:07.920]  Oh my God, this works.
[46:08.380 --> 46:10.260]  Then he started getting really ridiculous.
[46:10.500 --> 46:11.740]  Like, you have some keys right here.
[46:11.840 --> 46:12.880]  You want to try some of them right here?
[46:12.980 --> 46:13.160]  Sure.
[46:13.260 --> 46:13.600]  Hold them up.
[46:14.640 --> 46:19.180]  So, he has these regular Kwikset keys that are just... these are all within code.
[46:19.360 --> 46:22.640]  These are totally valid that you could have found on a store shelf.
[46:22.800 --> 46:24.000]  This is 2642.
[46:24.360 --> 46:25.280]  Regular cam lock.
[46:25.420 --> 46:26.340]  Operates nice and smooth.
[46:26.880 --> 46:30.420]  This is a whole ring of random Kwikset keys that happen to work it.
[46:32.240 --> 46:34.380]  It does not always work so smoothly.
[46:34.380 --> 46:36.580]  This one actually happens to work exceptionally smoothly.
[46:36.800 --> 46:37.040]  Mm-hmm.
[46:37.140 --> 46:40.360]  But a little bit of jiggling is required and the lock will still operate.
[46:40.360 --> 46:43.100]  Because Kwikset biddings are in between Yale biddings.
[46:43.300 --> 46:45.720]  So, you have high, slightly too high, slightly too low.
[46:45.880 --> 46:48.040]  But again, the lock has so much slop, it doesn't matter.
[46:48.420 --> 46:49.680]  As long as you...
[46:49.680 --> 46:50.920]  But here's the thing, right?
[46:51.980 --> 46:56.680]  When you pick a wafer lock, you're not attacking it the way you attack a pin tumbler lock.
[46:57.220 --> 47:00.300]  Jiggling is a very effective strategy for picking wafer locks.
[47:00.300 --> 47:07.540]  Now, with that being said, if 642 is your bidding code, you've created a separate issue.
[47:07.920 --> 47:09.500]  You've created a staircase pattern.
[47:10.080 --> 47:11.940]  It's something you try to avoid.
[47:12.140 --> 47:17.600]  You don't want to key your Kwikset key to 1, 2, 3, 4, 5, because it's all in one direction.
[47:17.780 --> 47:18.000]  It's flat.
[47:18.000 --> 47:18.260]  It's all in a slope.
[47:18.500 --> 47:18.800]  Yeah.
[47:18.980 --> 47:22.560]  It's something that is not containing variation.
[47:22.780 --> 47:23.300]  So, Howard eventually...
[47:23.300 --> 47:23.840]  A key should have variation.
[47:24.120 --> 47:25.360]  He just took a bump key.
[47:25.480 --> 47:26.500]  Literally, a Kwikset bump key.
[47:27.160 --> 47:31.580]  You trimmed it down, and you were able to just slam that in there at an angle, right?
[47:31.580 --> 47:32.880]  But we didn't stop there.
[47:32.920 --> 47:33.540]  Yeah, he's not...
[47:33.540 --> 47:38.080]  Yeah, you can't bump a wafer lock, but you can just angle and scrub it around and jiggle it, and it works.
[47:38.260 --> 47:43.120]  Do you guys remember the lockpicking in Hollywood talk, and people are sticking the wrong things in the lock?
[47:43.220 --> 47:43.360]  Yeah.
[47:43.500 --> 47:43.940]  Watch this.
[47:44.000 --> 47:47.220]  Is it universally understood you need two tools to pick a lock?
[47:48.920 --> 47:49.280]  Okay.
[47:49.620 --> 47:51.220]  I've got a turning tool here.
[47:51.900 --> 47:52.180]  All right.
[47:52.240 --> 47:53.560]  Howard's going to have a turning tool.
[47:54.560 --> 47:55.920]  Literally, just a turning tool.
[47:55.920 --> 47:59.260]  But remember, it's a staircase pattern, so this should make sense.
[48:00.180 --> 48:02.080]  Insert it, and twist.
[48:03.600 --> 48:04.040]  Boom.
[48:12.430 --> 48:15.330]  So again, you might think, well, it does its job.
[48:15.330 --> 48:17.830]  It still works with both keys it's supposed to work with.
[48:18.350 --> 48:20.010]  Okay, now we get real for a second.
[48:20.150 --> 48:20.310]  All right.
[48:21.130 --> 48:25.310]  We disclose this to the vendor, and we'll get into the response in a second.
[48:25.450 --> 48:30.510]  But the vendor's response was basically, well, people are buying it because it's approved.
[48:30.510 --> 48:31.090]  Yeah.
[48:32.410 --> 48:33.050]  And so...
[48:33.050 --> 48:33.790]  Yeah, it works, right?
[48:33.790 --> 48:34.490]  We just sell locks.
[48:34.630 --> 48:35.350]  If you check the code.
[48:35.350 --> 48:35.910]  Who cares?
[48:36.090 --> 48:36.790]  What are you talking about?
[48:36.950 --> 48:38.270]  It's only supposed to...
[48:38.270 --> 48:40.210]  This shouldn't even have to be in the code.
[48:40.310 --> 48:42.650]  A lock's only supposed to work with the right freaking key.
[48:42.930 --> 48:43.030]  Right.
[48:43.030 --> 48:45.990]  You couldn't tell someone, oh yeah, this is the key for your car.
[48:46.090 --> 48:46.610]  It's totally great.
[48:46.770 --> 48:48.790]  Everyone else's key works too, but don't worry about that.
[48:48.910 --> 48:49.990]  Your car works with your key.
[48:50.070 --> 48:50.430]  You're fine.
[48:50.590 --> 49:00.710]  No, I mean, I implore everybody who's actually responsible for this to really consider whether or not the lock itself is operable only by 1620 and 2642 if you can simply use a turning tool.
[49:00.830 --> 49:02.050]  And I would suggest that no.
[49:02.130 --> 49:05.270]  In fact, it's operable by far more than that, and it does not comply.
[49:05.270 --> 49:07.370]  So now you talk to the vendor, right?
[49:07.550 --> 49:09.450]  And of course we got hashtag won't fix.
[49:09.810 --> 49:10.250]  Yeah.
[49:10.470 --> 49:15.370]  So we call a little bit of bullshit on that because let's be honest, this is, this is kind of a problem.
[49:15.850 --> 49:27.790]  So to wrap it up, like there's a lot of situations where things are key to like, sometimes it doesn't matter and it's just funny, but in truth in critical applications and important things like this is how problems start.
[49:28.070 --> 49:28.210]  Yeah.
[49:29.730 --> 49:37.470]  And we're up here just, I mean, we're up here to give you guys some laughs, but also because you tell people there's a problem, that's the first step is talking about it.
[49:37.710 --> 49:37.830]  Yeah.
[49:37.990 --> 49:40.930]  So as a practical matter, if you're responsible for FOIA stuff, right?
[49:41.030 --> 49:45.390]  Like if somebody wrote a FOIA request and said, can I have the email password for the police chief?
[49:45.550 --> 49:46.530]  They'd be like, f*ck no.
[49:46.850 --> 49:51.350]  But it's like, can I have the vehicle bid spec for the police chief's personal car?
[49:51.550 --> 49:53.090]  And they give you the sticker.
[49:53.310 --> 49:53.450]  Yeah.
[49:53.550 --> 49:54.390]  And it says the key.
[49:54.630 --> 49:55.270]  That's crazy.
[49:55.530 --> 49:58.810]  So fixing this, like, yes, it costs money to replace cylinders.
[49:59.110 --> 50:05.910]  Ask us later about, let's say why we like interchangeable cores, why you can do a lot of these systems better than they are done.
[50:06.270 --> 50:09.110]  And it's still manageable in an industrial sense, even with key switches.
[50:09.650 --> 50:11.730]  Please think about leaks of information.
[50:12.230 --> 50:16.190]  So sealing those leaky details that are all over the place, right?
[50:16.350 --> 50:19.590]  If you're responsible for FOIA disclosures, you don't have to give this stuff away.
[50:19.910 --> 50:31.610]  Feed of information is great and transparency is great, but this is one specific instance where I think we can all agree, we don't need that level of detail to really have appropriate oversight when we're trying to do our citizen journaling or whatever.
[50:31.610 --> 50:37.670]  And in the end, like, we can all laugh at lulzy photos on the Internet of like, oh, somebody could move the jetway.
[50:37.990 --> 50:43.750]  But this should all be, all of these locks, not just the jetway key lock, they should all be part of a larger system.
[50:43.930 --> 50:46.550]  A system where many different factors are in play.
[50:46.710 --> 50:49.230]  Like hopefully there's wheel chocks under the, under the jetway.
[50:49.330 --> 50:57.670]  Hopefully an average passenger, even if they knew the key for the Siemens switch and they, they couldn't just like start driving the jetway without somebody smacking them in the head.
[50:58.130 --> 51:01.250]  Keep this in mind for all of your locks and all of your key systems.
[51:01.370 --> 51:04.830]  The same thing that all of us in tool and core and everyone have said for years.
[51:05.150 --> 51:10.890]  Locks are just one of many layers and you, they're only as good as how well they're installed, how well they're keyed.
[51:11.410 --> 51:15.050]  Think about that in the bigger picture and how adapt your policies accordingly.
[51:15.610 --> 51:18.130]  So, you know, stay safe out there and thanks for listening, guys.
[51:18.330 --> 51:18.970]  We appreciate it.
[51:27.610 --> 51:32.150]  We have time for like one short question in the form of a question.
[51:33.850 --> 51:35.890]  The question can be, can I have a scotch?
[51:36.050 --> 51:37.730]  And the answer is yes to the first three people.
[51:38.570 --> 51:39.710]  Great question, deviant.
[51:39.830 --> 51:40.290]  All right.
[51:40.550 --> 51:41.290]  See you next time.