[00:00.000 --> 00:01.640]  I'm a member of the Board of Directors of TOOOL USA.
[00:02.220 --> 00:04.300]  I crack safe and mostly I pick locks.
[00:04.740 --> 00:07.460]  This talk is not going to be about this sort of thing.
[00:07.960 --> 00:09.240]  This is using a thermic lance.
[00:09.400 --> 00:11.040]  It looks really great, especially if you're in a movie.
[00:11.380 --> 00:13.980]  This is actually safe being tested at UL Labs.
[00:14.040 --> 00:24.040]  The whole idea behind a thermic lance is you have a really hot bar that's packed with iron and aluminum rods and you run oxygen through it and you basically have a thermite reaction at the tip being fed by a lot of oxygen.
[00:24.060 --> 00:25.900]  So it gets really hot and goes through just about anything.
[00:26.260 --> 00:28.640]  It tends to damage the safe when you use it.
[00:30.220 --> 00:33.680]  And occasionally damages the contents, especially if they're like paper, like money.
[00:34.000 --> 00:37.820]  Which is, you know, if you're a burglar, sometimes a good thing if you're going after the gold.
[00:38.020 --> 00:41.700]  If you're going after the securities or the money, you probably want to use a different technique.
[00:42.460 --> 00:43.640]  Which is probably why you're here.
[00:43.800 --> 00:44.120]  Not.
[00:46.220 --> 00:48.640]  What I'm going to be talking about is non-destructive entry.
[00:48.880 --> 00:53.040]  Things like manipulating the lock, playing with the dial, picking the lock.
[00:53.160 --> 01:00.260]  If you're using a lever lock, this is not something I'm going to spend a lot of time talking about because, well, go to a lockpick village and learn how to pick locks to begin with.
[01:00.500 --> 01:13.360]  And then when you figure out that lever locks are a royal pain in the ass because they've been making them really difficult to pick for the last 500 years or whatever it is that they've been around, then you'll realize that you probably want to hold off learning until you get really good at picking the basic ones first.
[01:14.740 --> 01:19.420]  Radiographic attack, which is you stick the lock in an x-ray machine and tell the doctor, well, I think my safe has a broken leg.
[01:21.920 --> 01:28.360]  Robot dialing, which is when you tell your friendly Roomba to cozy up to the robot and dial the correct combination.
[01:29.000 --> 01:32.380]  And, of course, robot manipulation, which is where you have a somewhat more intelligent Roomba.
[01:33.600 --> 01:35.600]  But the first thing I'm going to talk about is manipulation.
[01:36.280 --> 01:42.200]  The thing about manipulation is you see it a lot in movies, kind of like the more destructive entry techniques.
[01:42.780 --> 01:55.860]  You see this in the Italian job, whatever, the hero, heroine, villain, whoever walks up to a safe, pulls out his handy-dandy stethoscope, or perhaps just puts his ear to the safe, and in 30 seconds, click, click, click, the safe opens.
[01:56.840 --> 01:58.040]  Sounds really great.
[01:58.480 --> 02:00.280]  I'd truly love to know how to do that myself.
[02:00.420 --> 02:01.320]  Anybody can teach me.
[02:02.400 --> 02:04.860]  In reality, it's somewhat more difficult.
[02:05.320 --> 02:08.140]  To understand how it works, you've got to understand how the lock works.
[02:08.380 --> 02:15.180]  A combination lock is basically a box with a couple of wheels in it and a couple of little extra gadgets to make your life difficult.
[02:15.900 --> 02:18.780]  You've got, in this first case, labeled A.
[02:18.800 --> 02:25.860]  If you can read that little A down there, a combination lock with two of the wheels set so you can see the gates are aligned.
[02:26.180 --> 02:28.000]  They're, however, aligned in the wrong position.
[02:28.660 --> 02:42.040]  That's one of the important things to remember is that, you know, even if all the gates are correctly aligned, they still have to be aligned under the fence, which is the mechanical device which allows the lock to tell whether or not you dialed the right combination and whether or not you align the wheels in the correct place.
[02:42.900 --> 02:48.560]  Like in case B, the wheels are aligned, you can see all the gates lined up, but of course the lock is not going to open.
[02:49.820 --> 02:50.700]  Those are the gates.
[02:51.120 --> 02:52.460]  That's the thing called the fence.
[02:52.640 --> 02:56.300]  As I said, the fence is what the lock uses to tell whether you dialed the right combination.
[02:56.860 --> 03:00.860]  If that thing can enter the gates, the lock thinks, hey, this guy is legit.
[03:01.440 --> 03:04.660]  If that thing can't move, the lock is like, sorry, sucker.
[03:06.160 --> 03:08.680]  This is what happens when you get everything right for once.
[03:10.360 --> 03:17.540]  You'll note that compared to the upper pictures, relative to the internal components of the lock that you see in those pictures, the fence has moved.
[03:18.260 --> 03:20.500]  This is because the lock has actually been opened.
[03:21.220 --> 03:34.380]  What happens is once the fence drops into the gates that have been aligned under the fence, you actually rotate the dial just a little bit more, and the fence moves with the gates back as the lock withdraws the bolt.
[03:35.400 --> 03:42.780]  As I'm going to get to in just a sec, when the bolt has been retracted, however, the gates are never actually pulling on the bolt.
[03:43.260 --> 03:45.760]  The gates are only telling the bolt...
[03:45.760 --> 03:51.540]  No, the gates are only telling the fence, yes, you can come in, and then another component is doing the heavy lifting.
[03:53.340 --> 03:57.940]  The reason you can manipulate this kind of lock is because of imperfections in the wheels.
[03:58.460 --> 04:00.220]  This is a particularly bad lock.
[04:00.580 --> 04:02.120]  I don't know how Matt Blaze found this.
[04:02.220 --> 04:03.880]  I stole this shamelessly from his article.
[04:04.100 --> 04:06.940]  I'm going to get to that at the end, called Safe Cracking for the Computer Scientist.
[04:08.080 --> 04:14.160]  The center wheel is significantly larger in diameter, at least at that point, than all the other wheels in the lock.
[04:15.020 --> 04:28.240]  This means that if the gate in that center wheel is under the fence, and you are, say, applying pressure to the fence, you would feel the fact that that gate is moving under the fence when you turn the dial.
[04:28.520 --> 04:31.720]  You'd hear that click, click, whatever, maybe even have the whole thing stop.
[04:33.200 --> 04:36.580]  That's really great, except most locks don't make life that simple.
[04:37.100 --> 04:41.180]  The lock that I was talking about, hypothetically, is called the lock with the direct entry fence.
[04:41.660 --> 04:46.560]  This is what you saw in the old Western movies, where they were, like, cranked on the handle, and, like, listen, listen, listen, listen.
[04:47.260 --> 05:01.740]  And one of the reasons they used a stethoscope was because the wheels were manufactured to such precise tolerances that you might only hear the barest of clicks as that gate moved past and hit that fence, which you were cranking on as hard as your arm would allow.
[05:03.200 --> 05:08.640]  Some people cranked even harder by, you know, going over to the office desk and grabbing a typewriter and tying it to the handle.
[05:10.240 --> 05:11.240]  That's a whole other story.
[05:12.840 --> 05:20.020]  These days, after lock manufacturers figured out that you could do this, they introduced a little device called a cam.
[05:20.680 --> 05:23.020]  The cam is a little bit on the back.
[05:23.480 --> 05:26.740]  You'll note that there's this bit on the diagram labeled the nose.
[05:27.340 --> 05:29.360]  It's directly attached to the fence.
[05:30.060 --> 05:36.120]  The whole point of the nose is that it prevents the fence from ever touching the wheels.
[05:36.460 --> 05:38.160]  This seems kind of counterproductive.
[05:38.160 --> 05:40.840]  So they added this little thing called a gate.
[05:41.060 --> 05:42.540]  And I'll get to that in just a sec.
[05:43.540 --> 05:57.900]  The long and short of it is, unless the spindle of the dial is in one particular place, the fence doesn't touch the wheels, which means that no matter how hard you crank on the handle of the safe.
[05:58.560 --> 06:04.700]  In fact, most safes don't even have you ever touching the actual bits of the lock directly.
[06:05.300 --> 06:07.280]  It's all interlinked by mechanical linkage.
[06:08.920 --> 06:19.860]  Except for this one particular place on the dial, the fence never touches the wheels, which makes it kind of hard to figure out where the gates are in the wheels if, for most of the revolution of the dial, the fence is never actually touching the wheels.
[06:19.940 --> 06:27.960]  And so, therefore, you have no way of getting information about the state of the dials underneath the fence, except in that one particular place.
[06:29.380 --> 06:30.260]  So the solution.
[06:30.760 --> 06:34.320]  Well, locks for mechanical devices, they all have their own tolerance.
[06:34.320 --> 06:36.280]  They all have their own imperfections.
[06:36.380 --> 06:38.280]  And most importantly, they have to work.
[06:39.100 --> 06:44.620]  It kind of sucks to come to the office in the morning, dial the combination, and have the lock not work.
[06:44.800 --> 06:51.560]  Then you call a safe technician, or your buddy like me, and he charges you 200 bucks an hour to come in and open the safe.
[06:52.040 --> 06:54.180]  If this happens a lot, you try to...
[06:54.180 --> 06:56.580]  you go out and do something called buying a new safe.
[06:57.200 --> 07:00.220]  And then you tell all your buddies, don't ever buy safes from that guy again.
[07:01.100 --> 07:09.200]  In which case, that guy goes out of business, and he's very sad, and he stops buying locks from this manufacturer and tells all his friends who make safes not to buy locks from this particular manufacturer.
[07:09.520 --> 07:11.960]  And so they have to make sure their locks work every time.
[07:13.000 --> 07:17.400]  This means that they rounded the corners of the gate so that everything would work smoothly every time.
[07:18.160 --> 07:29.480]  This has the curious side effect of allowing you to measure precisely, very precisely, how far the fence has dropped inward into the wheel pack.
[07:29.800 --> 07:33.040]  That is to say, how far the fence has...
[07:33.040 --> 07:35.340]  how close the fence has gotten to the center of the spindle.
[07:35.640 --> 07:38.600]  That's the little round thing in the middle, which is turning the whole business.
[07:39.380 --> 07:49.220]  And by making these measurements, you can put the whole wheel pack at a series of different positions, and then literally measure the radius of the wheel pack at every position.
[07:49.320 --> 07:50.200]  And I'll get to that in a sec.
[07:50.780 --> 07:52.140]  How this works...
[07:52.840 --> 07:57.520]  these two points where the nose touches either end of the gate area are called contact points.
[07:57.900 --> 07:59.160]  It's a critical thing.
[08:00.240 --> 08:10.120]  The closer the nose gets to the spindle of the lock, that is to say, the further the fence can drop, the narrower the contact points seem to get.
[08:10.520 --> 08:15.460]  This is because these edges are rounded, and so as a function of distance, the gap seems to close.
[08:17.520 --> 08:27.760]  If you have a wheel pack where it's a larger diameter, at least at that particular point, because say there's no gate under the fence, then it seems to be pretty wide.
[08:27.780 --> 08:33.120]  And if you look very carefully at the graphics, some of you guys probably have to get out your binoculars or something, or look at the video online.
[08:33.820 --> 08:44.600]  You can see that in the left column, which is a relatively larger diameter wheel pack, the points where the nose touches the gate area are farther apart.
[08:45.820 --> 08:51.320]  In the right column, the points where the nose touches the gate area are closer together.
[08:53.120 --> 08:54.200]  It's pretty simple.
[08:54.960 --> 08:59.440]  To take advantage of this, you create a map of the radius of the wheel pack.
[09:00.380 --> 09:02.720]  If you're a mathematical type, then I can...
[09:03.300 --> 09:07.900]  you'd put this in the term, it's a map of the radius of the wheel pack as a function of angular position.
[09:08.860 --> 09:22.900]  What it's doing is, at every... you turn the dial three times, get all the wheels moving together, and then at every particular position, you map the radius of the wheel pack, that is, how far away the contact points are.
[09:24.140 --> 09:39.920]  These contact points, since they get further apart as the wheel pack radius at that particular point seems to go up, and get closer together as the radius goes down, means that where the contact points get further away, there probably isn't a gate in the wheel,
[09:39.960 --> 09:44.080]  and where the contact points get closer together, there may be a gate in the wheels.
[09:45.280 --> 09:47.420]  Exactly how this works is a matter of practice.
[09:47.680 --> 10:00.340]  You have to dial, depending on the lock, every couple of numbers is when you have to take your reading, and then you pop this on a piece of graph paper, go afterward and look, that's probably where there's a gate, and then you go back and do this again.
[10:01.000 --> 10:05.280]  After doing it, you know, every two numbers, you figure out there might be a gate here.
[10:05.440 --> 10:07.220]  Let's make sure that it's actually a gate shape.
[10:07.760 --> 10:09.980]  Because if it's not, then it's probably a manufacturing error.
[10:10.160 --> 10:16.940]  And the last thing you want to do is waste another 15 or 20 minutes trying to dial test combinations to figure out that, no, you just found a flaw on the wheels.
[10:17.440 --> 10:20.160]  Great if you're a quality tester, not so good if you're a safe-cracker.
[10:20.800 --> 10:24.120]  What you do here is you go back and we find, by dialing...
[10:24.120 --> 10:29.760]  by checking every half a number for that particular range, that this little aberration is, in fact, gate-shaped.
[10:30.900 --> 10:36.320]  And so we should probably include that as a number in the combination that we're slowly putting together.
[10:38.220 --> 10:42.200]  This begs the second question, and I'll take questions at the end if you don't mind.
[10:42.820 --> 10:44.280]  Which wheels gate are we seeing?
[10:45.140 --> 10:48.900]  We found one number, but this is a three-number combination.
[10:51.000 --> 10:52.120]  Is it the first number?
[10:52.220 --> 10:52.860]  Is it the second number?
[10:52.960 --> 10:53.520]  Is it the third number?
[10:53.740 --> 10:59.140]  Or, technically speaking, is this a gate in the first wheel, a gate in the second wheel, and a gate in the third wheel?
[10:59.480 --> 11:07.460]  The reason I make this clarification is because when you're manipulating, one of the most important things you want to do is be able to visualize what's going on in the lock.
[11:08.040 --> 11:14.880]  Because that's how you intuitively find solutions to problems to which there isn't an immediate textbook solution.
[11:15.720 --> 11:24.380]  To figure out which gate in the wheel we've actually found, which wheel, or what it is we're looking at, you dial three different combinations.
[11:25.080 --> 11:38.900]  You pick some number far away from the location on the dial of the gate that we found, and you take that some random number, which I'm using 22 for in this particular example.
[11:39.500 --> 11:45.420]  You set the other two wheels, which we're discarding for the moment, to that random number.
[11:46.260 --> 11:51.420]  And the test wheel, for the first combination of the first wheel, you dial that number.
[11:51.780 --> 11:56.020]  So if we go back here, it looks like this number is at 22.
[11:56.740 --> 11:59.260]  And the example I wrote up here is the other way of doing it.
[11:59.340 --> 12:04.700]  So I'll switch over and bear with me for a sec, as I realize that I completely forgot how I wrote this particular presentation.
[12:08.320 --> 12:14.220]  Basically, the number of the combination is somewhere around 22, plus or minus a half a number, which is irrelevant.
[12:15.000 --> 12:16.640]  So we used number 22.
[12:16.780 --> 12:18.280]  We set the other wheels at, you know, 67.
[12:18.880 --> 12:21.760]  We set the first wheel at 67, other two wheels at 22.
[12:22.960 --> 12:24.420]  Check, make our measurements again.
[12:26.100 --> 12:33.400]  Second time around, we set the second wheel at 67, and the first and the third wheels at 22.
[12:34.580 --> 12:39.940]  Do this again, setting the third wheel to that some random number, and the first wheels at 22.
[12:40.200 --> 12:51.920]  The upshot of all this, trying three different combinations, is that when we make our measurements, we will see that for two of these cases, the measurements stay the same.
[12:53.000 --> 13:01.840]  Because if you remember back here, this first picture I showed you, one wheel is the one that we're riding on.
[13:02.500 --> 13:05.440]  The other two wheels, no matter where those other two wheels are, it doesn't matter.
[13:05.780 --> 13:07.320]  It's not going to figure into the calculations.
[13:07.480 --> 13:08.460]  It's not going to figure into the measurements.
[13:08.460 --> 13:15.820]  So the instant we get the gate in that one wheel out from under the fence, the measurements are going to change.
[13:17.480 --> 13:24.860]  Once those measurements change, then we know exactly which wheel has that gate in it at that position.
[13:25.460 --> 13:26.740]  And we're a third of the way there.
[13:28.780 --> 13:31.500]  Some of you guys have probably figured out the next two steps.
[13:32.540 --> 13:33.740]  Wash and repeat.
[13:35.840 --> 13:37.200]  Never mind about the wash part.
[13:37.720 --> 13:38.840]  What you do is you repeat.
[13:39.020 --> 13:47.680]  Knowing this thing for this one wheel, for the rest of the manipulation procedure, you leave that one wheel with that one gate in that one position.
[13:47.860 --> 13:51.460]  In this case, we say that the first wheel had the gate in it.
[13:51.460 --> 13:57.040]  We would leave the first wheel at 22, and then just play with the second and third wheels.
[13:57.840 --> 14:00.360]  And then do this again for the second and third wheels.
[14:00.900 --> 14:08.640]  Once we figure out where the gate is in those wheels, we do this again for the last remaining wheel, and we have the combination, and we have the safe open.
[14:10.880 --> 14:15.840]  Now, this is all very complicated, and some of you guys are probably wishing you'd brought your hip flask to the presentation.
[14:16.120 --> 14:17.700]  The rest of you guys are probably asleep.
[14:18.440 --> 14:21.640]  And some small fraction of you guys are saying, Hey, this is really cool.
[14:21.760 --> 14:22.760]  How can I learn how to do this?
[14:23.500 --> 14:25.420]  There's a couple of things which make learning it easier.
[14:25.700 --> 14:28.120]  First of all, get yourself a practice lock.
[14:28.600 --> 14:31.900]  A cutaway designed for learning to manipulate.
[14:32.620 --> 14:33.800]  And I've got one right here.
[14:34.600 --> 14:35.880]  I mean, you can buy them on eBay.
[14:36.020 --> 14:38.340]  I got this thing for 40 bucks some while ago.
[14:39.800 --> 14:44.220]  It's a safe lock mounted to a stand so you can leave it on your desk and your boss thinks you're all badass.
[14:45.700 --> 14:48.860]  And on the back, it's cutaway so you can see the inner workings of the lock.
[14:49.980 --> 14:55.420]  Now, nobody except for the couple of guys here in the front can see what I'm doing, but I'm going to do it anyway just for their benefit.
[14:55.960 --> 14:59.920]  When you twirl it, you can watch the gates move under the fence.
[15:01.080 --> 15:11.520]  And by just sitting and playing with it for a couple of hours, you'll have a very intuitive sense of how the lock is working, which is going to help you when you're spending five hours at the door wondering what the heck is going on because the safe isn't opening.
[15:12.800 --> 15:15.660]  The first time you open the safe, it'll take you quite a while.
[15:16.040 --> 15:23.880]  It took me, I think, six hours or so because you're going back, you're charting, you're trying to figure out where you made the mistake and then made the other mistake and realizing, oh man, I screwed up way back at the beginning.
[15:23.980 --> 15:24.980]  You have to start all over again.
[15:25.960 --> 15:33.220]  But then once you get a feel for it, once you get an intuitive sense of it, then you stop making mistakes and you start getting it right.
[15:33.300 --> 15:40.520]  And you get your time down to like three hours, maybe two hours, which is about what most safe technicians will take to actually open a lock by manipulation.
[15:40.520 --> 15:42.240]  This is why many of them carry drills.
[15:44.580 --> 15:51.680]  Now, if you're storing classified data, and I'm not talking about the kind of data like, you know, the kind of porn you watch on the web.
[15:51.960 --> 15:56.880]  I'm talking the kind of data of, you know, where your spies are in Soviet Russia or Iran these days.
[15:57.640 --> 16:06.820]  If the Iranians get at this data, you know, they only have to take a picture of it or even remember who the names the spies are in their interior ministry so they can go back and shoot the guys.
[16:08.820 --> 16:15.160]  They don't have to steal it and they're not going to steal it because the minute you realize it's gone, you realize you're going to call the guys back before they get shot.
[16:16.000 --> 16:23.580]  So you want to make sure that not only can nobody steal what's in the safe, nobody can even ever look at it without you knowing about it.
[16:24.260 --> 16:28.340]  Because the minute you notice, you can take steps to make that information useless.
[16:28.860 --> 16:31.540]  But if you don't find out about it, then you're up shit creek.
[16:33.620 --> 16:41.220]  So the U.S. government realized this problem back in the 20s or 30s when a crooked locksmith went around robbing jewelry stores.
[16:41.580 --> 16:53.960]  And this guy had been a locksmith long enough to know all the little secrets of the industry because back then, and even up until like very recently, a lot of this safe stuff was considered, you know, super top secret among the locksmith community.
[16:54.180 --> 17:01.200]  The definitive work on safe manipulation, remember the stuff I just told you about, was marked destroy this after reading it.
[17:02.640 --> 17:05.400]  The idea being that it would never get out of the locksmith community.
[17:05.620 --> 17:07.320]  Well, you guys are all locksmiths, right?
[17:11.760 --> 17:20.640]  In any case, there was this rather unscrupulous guy who figured he could make more money stealing jewelry than opening locks back in the 20s in New York City.
[17:21.200 --> 17:29.180]  And he went around, he would pick the front door lock in the jewelry store, disable the alarm if they had any, they usually didn't, and then manipulate open the safe.
[17:29.960 --> 17:36.560]  Next morning, or next Monday morning, the jeweler would come in, find all his jewelry missing, call his insurance company, being like, I got robbed.
[17:37.440 --> 17:40.980]  They would, you know, come in and take a look around and say, well, they didn't bust down the door.
[17:41.620 --> 17:43.160]  You know, your safe's totally intact.
[17:43.160 --> 17:44.720]  And we all know those locks are totally secure.
[17:46.020 --> 17:54.880]  And, you know, so they were very, very unhappy about having to pay out awards on these things where obviously the locksmith, the jeweler, was stealing his own stuff.
[17:55.560 --> 17:59.380]  Well, this became known that there was a possibility to manipulate these safes open.
[17:59.700 --> 18:03.220]  The U.S. government heard about this and went to...
[18:03.220 --> 18:07.660]  The only other people who knew how to keep stuff safe, which were the banks.
[18:08.040 --> 18:17.660]  And for the longest time, they had been using time locks on their safes, which meant that if you came in on Sunday, you couldn't get the safe open, even if you had the combination.
[18:18.160 --> 18:34.180]  If you came in during working business hours, the only way you could get into the safe, even if you had the combination, was to use a special Dropbox slot, which would only allow you to deposit things in and not take things out, which is very useful in discouraging people from sticking guns in the faces of your tellers and telling them to open the safe and give them all the money,
[18:34.200 --> 18:40.220]  because they can't for the next X number of hours, by which time the cops will almost certainly be there.
[18:41.060 --> 18:42.480]  The U.S. government said, Aha!
[18:43.560 --> 18:50.500]  We don't have to worry about those pesky Germans or Italians or whoever it was they were afraid of getting into our safes and stealing our secret information.
[18:50.740 --> 18:52.140]  We'll just put time locks on.
[18:52.500 --> 18:56.720]  There's somebody in the office from nine to five during the week, every day during the week.
[18:57.320 --> 19:00.420]  So they're not going to come in during then, but they could break in during the weekends.
[19:01.140 --> 19:10.000]  So they put time locks on all their safes with the idea that from five o'clock in the evening on Friday to nine in the morning on Sunday, nobody could open the safe.
[19:10.940 --> 19:15.480]  Because, you know, whatever would happen, they could get to it on Monday, it would all be good.
[19:15.480 --> 19:21.240]  But anybody coming in on the weekends was probably a burglar or a spy who shouldn't have access.
[19:21.820 --> 19:22.960]  Great idea in theory.
[19:23.660 --> 19:25.520]  Unfortunately, Pearl Harbor happened on a Sunday.
[19:26.420 --> 19:30.320]  And so you had all these generals running around their offices being like, Our war plans!
[19:30.420 --> 19:30.980]  Our war plans!
[19:31.080 --> 19:31.680]  Our war plans!
[19:32.560 --> 19:33.500]  Where are they?
[19:33.500 --> 19:36.920]  And these aides being like, Uh...
[19:38.300 --> 19:38.820]  Uh...
[19:38.820 --> 19:40.620]  Looking really uncomfortable.
[19:41.400 --> 19:43.340]  And they realized they needed a better idea.
[19:44.040 --> 19:46.260]  So they got rid of the time locks and posted cards.
[19:46.800 --> 20:00.340]  And went to a guy named Harry Miller, who at the time was the head of Sargent and Greenleaf, the biggest safe lock manufacturing and design company in the country, being like, Make us a lock that can't be manipulated open, but doesn't need those time locks.
[20:01.100 --> 20:12.500]  And so he came up with the Sargent and Greenleaf 6730 MP, which is now known as the 8400 MP, or, sorry, 8400, with some modifications.
[20:13.020 --> 20:18.340]  The 6730 MP had a small flaw, which meant you could actually manipulate it open, despite all the clever design.
[20:18.600 --> 20:22.240]  The 8400 is a little more clever, and you can't get this thing open by manipulation.
[20:23.180 --> 20:24.220]  Why is this?
[20:25.320 --> 20:30.820]  Well, if you look at the cam on the back, you'll note that it doesn't have a gate area.
[20:31.660 --> 20:36.460]  Remember how I told you that the gate area is what allows you to map the wheel pack and manipulate open the lock?
[20:37.300 --> 20:40.120]  Well, without that gate area, you can't manipulate the lock.
[20:40.540 --> 20:42.800]  The problem is you also can't open the lock.
[20:43.160 --> 20:43.600]  Period.
[20:44.180 --> 20:45.920]  Which is kind of a problem if you want to use a safe.
[20:46.680 --> 20:55.640]  So the trick is that the cam is a clever little mechanical spring-loaded device, which has this little spring-loaded slider.
[20:56.740 --> 21:06.600]  The idea being that the slider, because the design of the lock casing, can only slide away from the gate area at one particular point on the dial.
[21:06.820 --> 21:10.160]  And when it does this, the dial is very firmly locked in place.
[21:10.660 --> 21:15.420]  As in, you can't move it even enough to reach the ends of the gate area.
[21:15.420 --> 21:22.520]  You can only move it enough to retract the bolt, which has been cleverly designed to retract in less area than it takes to reach the ends of the gate area.
[21:24.580 --> 21:33.100]  You can't play with the slider because it's spring-loaded such that when it's triggered, it snaps out of place.
[21:33.260 --> 21:35.300]  It doesn't move gradually, it just snaps.
[21:36.120 --> 21:39.680]  And the thing that causes it to snap is a little fly on the center of the dial.
[21:39.860 --> 21:41.560]  That is, that thing.
[21:42.260 --> 21:48.260]  If you take a look at this and compare this to most safe dials you've seen in movies or perhaps in person, you'll notice a critical difference.
[21:48.400 --> 21:51.500]  There's this little arrow-shaped thing in the middle of the dial which actually rotates.
[21:52.100 --> 22:07.420]  That thing will only rotate at that one particular place in the dial and will trigger that slider to zip out of place and lock the dial in place just enough that you can't ever reach the contact points and you can't ever get information about the wheel pack.
[22:09.020 --> 22:09.580]  There's no...
[22:09.580 --> 22:10.100]  So what do you do?
[22:11.160 --> 22:17.360]  Well, if you're a Russian agent who's confounded with these things in the early 50s, you know, you get yourself...
[22:18.180 --> 22:18.440]  There's no...
[22:18.440 --> 22:19.400]  And I don't know why this isn't playing.
[22:19.600 --> 22:19.740]  Come on.
[22:21.060 --> 22:21.460]  Okay.
[22:22.360 --> 22:22.900]  Never mind.
[22:22.940 --> 22:24.260]  It was a frivolous movie clip anyway.
[22:26.520 --> 22:39.700]  You get yourself an x-ray machine or a little canister full of radiographic material and you tell your buddy who thinks you're, you know, his friendly bar buddy but, you know, needs some safe place to store your canister of undeveloped film, you tell him,
[22:39.780 --> 22:44.080]  you know, put this canister in in somewhere safe, which you happen to know is the only place he has a safe is the embassy.
[22:45.120 --> 22:47.500]  And he puts this canister in there without opening it.
[22:47.820 --> 22:55.180]  And you come in during the night and because this thing is emitting radiation all the time and probably eliminated his chances of ever having kids, but who cares?
[22:55.280 --> 22:56.080]  He's just disposable.
[22:57.700 --> 23:02.680]  You go in there in the middle of the night and you take out your handy radiographic film and you paste it to the front of the safe.
[23:03.300 --> 23:11.320]  And you count off your exposure time, pull it off, go home and develop it, and bada bing, you have a very clear picture of the safe lock, including where the gates are.
[23:12.720 --> 23:16.920]  Nowadays, of course, you can use these handy dandy portable package inspection x-ray machines.
[23:17.460 --> 23:19.440]  And you don't have to worry about getting someone to stick it inside.
[23:19.580 --> 23:22.880]  You just put the source on one end and the reader on the other and you're good to go.
[23:25.300 --> 23:30.060]  So, U.S. government found out about this and so did the British government and they originally had this brilliant idea.
[23:30.160 --> 23:36.360]  Well, these locks are encased to keep people from drilling into the sides of them in like hardened steel boxes.
[23:36.360 --> 23:39.220]  So we'll just fill the boxes with lead ball bearings.
[23:39.620 --> 23:42.240]  The lead will keep the radiation out and we're all good.
[23:42.820 --> 23:50.440]  Russians came back being like, aha, we know computer science and image processing and worked out a way to process their images and still get useful information.
[23:50.800 --> 23:55.200]  So the U.S. government came back with plastic wheels, which of course don't show up in x-ray machines.
[23:55.700 --> 24:00.560]  And rumor has it that the Russians came back with even better computers and even better image processing and still get in.
[24:00.660 --> 24:02.360]  So now they just try to keep the Russians out entirely.
[24:04.300 --> 24:05.900]  Now, of course, Hollywood is Hollywood.
[24:06.040 --> 24:08.980]  This is only relevant to the clip that didn't work, so I'm going to skip it.
[24:11.180 --> 24:12.280]  The robot dialer.
[24:12.400 --> 24:16.260]  This is... you're confounded with this lock you can't get into or can't manipulate.
[24:17.920 --> 24:25.800]  So you're a safe technician sitting at a door and, you know, you aren't bright enough because you spend too much drinking, too much time drinking with your buddies and your brain's all fried.
[24:25.800 --> 24:29.020]  You can't comprehend the whole manipulation thing.
[24:29.640 --> 24:33.060]  And, you know, your drill doesn't work because the safe is a really high security design.
[24:33.600 --> 24:35.620]  So you pull out a robot dialer.
[24:35.780 --> 24:40.300]  This is a device which is programmed to try every possible combination on the dial.
[24:41.540 --> 24:47.180]  This is not like it seems the full 1 million combinations or 100 to the third power.
[24:47.480 --> 24:53.500]  This is more on the order of 200, maybe 400,000 combinations because of tolerances in the lock.
[24:54.020 --> 24:56.880]  So if you're lucky, the lock will open in about four hours.
[24:57.020 --> 24:59.060]  But on average, it'll probably open in about a weekend.
[25:02.480 --> 25:05.320]  As it so happens, and before I get to the next slide, I should mention this.
[25:05.600 --> 25:12.900]  Some friends of mine at MIT figured out the fact that, well, these group 1 are the manipulation proof locks for the little fly inside of the dial.
[25:13.280 --> 25:19.180]  They don't work with most robot manipulators because the robot manipulator gets stuck at the little twiddle the fly part.
[25:20.080 --> 25:22.840]  So they built a robot dialer which could twiddle the fly.
[25:24.200 --> 25:28.420]  Which happened to be that this is only the second time anybody in the world has ever done this, as far as I know.
[25:28.480 --> 25:36.180]  And the first time, the U.S. government kindly asked them, you know, please don't ever tell anybody about this or we won't buy your products ever again.
[25:37.080 --> 25:42.800]  So this is the only publicly available robot dialer that exists, that can do this.
[25:42.920 --> 25:44.460]  And if you check Google, you can find it.
[25:46.140 --> 25:49.260]  If you're a little more intelligent, you build a more intelligent robot.
[25:49.760 --> 25:56.860]  This was actually built by the same company that built that very first auto dialer capable of doing manipulation proof locks.
[25:57.720 --> 26:01.540]  This is a robot dialer with a brain and ears.
[26:03.040 --> 26:14.480]  It has a little piezo microphone which attaches to the front of the safe and using precisely the same rules of manipulation that I explained to you earlier, automates the manipulation process.
[26:15.500 --> 26:18.560]  It'll open the lock in, I don't know, 22 minutes.
[26:20.800 --> 26:22.780]  And I really hope this video works.
[26:22.780 --> 26:29.780]  S&G 6730, the software on my laptop here is an earlier, actually a prototype version of the software.
[26:31.660 --> 26:35.220]  But two of the locks I have on here are S&G and Lagarde.
[26:35.380 --> 26:37.520]  This is before they developed software for ILCO.
[26:39.200 --> 26:46.040]  And I have two different indications, S&G 6730M1 and 6730M2.
[26:46.040 --> 26:48.240]  That stands for Method 1 and Method 2.
[26:48.500 --> 26:52.740]  Method 1 is my preference for manipulation, find wheel 3, 2, 1.
[26:53.720 --> 26:56.100]  That works 80% of the time.
[26:56.480 --> 27:03.760]  If Method 1 fails or I determine that I have a lock that is going to be difficult to manipulate, I can go to Method 2.
[27:03.940 --> 27:07.860]  In this case, the soft wheel searches the entire wheel pack.
[27:08.500 --> 27:11.640]  And it might look for Wheel 2 first, then 1, then 3.
[27:12.660 --> 27:14.360]  It's a longer process.
[27:14.800 --> 27:18.360]  But between these two, it's just about guaranteed to get the lock open.
[27:19.100 --> 27:21.240]  So, let's see if we can get a go of it here.
[27:21.360 --> 27:22.980]  I'll just...
[27:22.980 --> 27:26.120]  Oh, I have two choices here also.
[27:26.500 --> 27:30.520]  I can select automatic or automatic with review setup.
[27:31.980 --> 27:36.080]  What I'm going to do is click on automatic with review.
[27:37.880 --> 27:44.850]  And what's going to happen is my soft wheel is going to go in
[27:47.970 --> 27:50.690]  and check some of the characteristics of this lock.
[27:51.990 --> 27:54.690]  The sound characteristics of the contact points.
[27:58.710 --> 28:02.350]  Close to the same thing I would do when I'm first turning a dial and listening.
[28:03.170 --> 28:03.610]  Only...
[28:05.050 --> 28:09.870]  What the software will do is throw up a graphic representation of what it's hearing on the screen.
[28:14.990 --> 28:19.370]  And what I have here is actually just about as perfect as I could have hoped for.
[28:21.310 --> 28:27.830]  I have an indication of the noise, the sound that the soft wheel is hearing approaching the contact point.
[28:28.110 --> 28:32.510]  And this resounding crash of a wall here is the noise it hears at the contact point.
[28:32.510 --> 28:35.790]  And that's almost a perfect setup.
[28:35.930 --> 28:36.830]  We got fortunate here.
[28:37.890 --> 28:45.690]  What I want to see is about the right third of my screen black would be perfect in an absolute perfect world.
[28:45.710 --> 28:51.030]  I want to see the sound lines go all the way to the top and bottom of the graph and be as dark as can be.
[28:51.190 --> 28:55.810]  And I want as little noise as possible to the left of that filling up about two thirds of the screen.
[28:55.810 --> 28:56.970]  That's a good setup.
[28:57.950 --> 29:00.670]  If I get a poor setup, I have a few options.
[29:00.670 --> 29:05.010]  I can move the microphone and try different areas on the safe.
[29:05.190 --> 29:16.290]  Or I can actually adjust my gain, decrease the position that the drive cam is hearing the contact point.
[29:16.350 --> 29:17.650]  I can make some changes here.
[29:17.870 --> 29:20.290]  But I find that generally I don't have to do anything.
[29:22.690 --> 29:25.830]  So I will click on continue test here.
[29:34.520 --> 29:42.040]  Next thing the software will do is run through a short series of pre-programmed common combinations.
[29:42.360 --> 29:47.220]  50-25-50, 10-20-30, 25-50-75.
[29:49.140 --> 29:56.500]  And even though a good manipulator would try these combinations first, you'd be surprised that you still run into safes that are set on these simple combinations.
[29:57.840 --> 30:02.340]  So it'll spend just maybe a minute doing that and then go on to its manipulation.
[30:04.320 --> 30:07.700]  I can wait until he gets the manipulation part.
[30:08.080 --> 30:13.540]  That in and of itself takes about five minutes, in which case you can be staring at a screen, watching a little dial turn for five solid minutes.
[30:13.540 --> 30:18.560]  So at this point the soft rail is positioning wheels, one and two in different locations.
[30:18.560 --> 30:22.560]  I can assure you that yes, the whole thing does get opened in about the space of five minutes.
[30:23.260 --> 30:26.780]  Because that's a particularly manipulable lock.
[30:27.000 --> 30:28.400]  On average it's about 20 minutes.
[30:30.620 --> 30:34.700]  Again, the U.S. government hears about this and is like, oh crap.
[30:35.260 --> 30:38.340]  You know, our locks can be robot dialed in the space of a weekend.
[30:38.340 --> 30:45.320]  And the ones that can be manipulated can be opened by a robot.
[30:45.540 --> 30:46.440]  So what do we do?
[30:47.800 --> 31:03.420]  Well, the very same company that built the first autodialer capable of robot dialing a manipulation proof lock, as well as building the smart dialer, which could manipulate open a regular lock, built the solution to all this.
[31:03.680 --> 31:06.020]  Got to wonder whether the first two were like sales efforts or something.
[31:06.940 --> 31:08.940]  In the form of the Moss Hamilton X07.
[31:10.080 --> 31:16.800]  This is a computer controlled lock, which has an LCD display at the top and dial in the front.
[31:18.120 --> 31:21.320]  For the user, it's like dialing a regular lock.
[31:21.760 --> 31:24.260]  Because you dial and you see the numbers go past in the top.
[31:25.260 --> 31:27.040]  It has a few interesting features, though.
[31:27.640 --> 31:38.680]  For one thing, to prevent a robot dialer from working, it's got interlocks, which will destroy the lock internally if you dial too quickly, because it will blow a fuse.
[31:39.820 --> 31:45.260]  Every time you change direction, it puts you at a new position on the dial.
[31:45.580 --> 31:47.780]  Something that's physically impossible with normal locks.
[31:47.920 --> 31:52.780]  It's like changing direction at 67 and all of a sudden finding yourself at 22.
[31:53.820 --> 32:01.560]  You're transported through space and time, as it were, by the computer, to start to get a new position on the dial, which you have no idea what it's going to be.
[32:03.380 --> 32:11.800]  Of course, it has a LCD display on the top, which can only be read from a very narrow family of angles, which means that it's very hard to put a camera in place to read it.
[32:14.280 --> 32:20.500]  It has a proper one million possible combinations, because there is no leeway in terms of dialing the right or wrong number.
[32:21.360 --> 32:32.440]  And of course, it has an audit trail, so you can see how many times the lock has been opened and how many times people have failed to open the lock, which is kind of useful if somebody tries and fails to find out, so you can go asking naughty questions.
[32:34.260 --> 32:40.440]  If you dial continuously without a pause of a quarter second every one and one third turn, the lock will shut down.
[32:41.040 --> 32:42.340]  This is kind of interesting.
[32:42.780 --> 32:44.020]  Why would they do this?
[32:44.480 --> 32:47.960]  The logic is that your human arm can only twist around so far.
[32:49.560 --> 32:57.820]  And when it twists so far, you have to pick it up and put it back on the dial again and keep turning, whereas a robot can turn an infinite distance.
[32:59.700 --> 33:03.820]  So if you dial more than this, then you're probably a robot.
[33:05.020 --> 33:11.900]  If you enter a whole combination in less than 15 seconds, well, you're either Superman or a robot, and Superman doesn't actually exist in real life.
[33:12.900 --> 33:20.380]  If you dial continuously for more than five minutes without letting the lock power down, you should probably take a rest anyway so it does it for you.
[33:21.420 --> 33:27.420]  And, of course, if you try ten combinations in sequence, then you have to wait a couple of minutes and go check your notes.
[33:29.740 --> 33:32.040]  This is the internal flow chart of the lock.
[33:32.240 --> 33:41.480]  For those of you guys who are wondering how they can possibly crack it, basically what it is is it has a stepper motor slash generator which provides the position information as well as the power for the lock.
[33:41.860 --> 33:52.900]  You don't have to ever change the batteries on this lock, which is kind of useful if you're in the sub-Saharan Africa where your only source of batteries is back in the U.S., and you've got to tell your buddy to, you know, go down to the Bartell Drugs and FedEx use them.
[33:54.100 --> 34:06.620]  It has a random number generator feeding a microprocessor which it uses to encrypt the combination and all the working information, memory, you know, display unit, and a separate drive motor which integrates through the whole thing in a very clever way.
[34:06.860 --> 34:08.780]  So it requires an absolute minimum of power.
[34:08.780 --> 34:14.000]  The cool thing is the motor actually turns a little gear which then allows the main dial to engage the bolt.
[34:16.120 --> 34:17.840]  And, of course, I'm not going to go into this.
[34:18.480 --> 34:20.820]  The computer types among you can probably find this on the web.
[34:20.940 --> 34:23.380]  If you go to my web page, I'll get to that at the end.
[34:24.260 --> 34:30.220]  Basically, they put a lot of research into making this thing very resistant to differential power analysis and other fun toys like that.
[34:32.740 --> 34:47.340]  And, of course, if you decide to drill the safe open, drill into the lock, break the lock, open the safe, and then replace the lock, the lock itself is potted in a compound called DIMAX, which has these little UV fluorescent particles scattered throughout it.
[34:47.900 --> 34:55.340]  And when they install a new lock, they take a picture of these UV particles under UV light and file this away.
[34:55.980 --> 35:00.760]  And every once in a while, they'll come back and check that against the reference picture to make sure nobody's swapped out the lock.
[35:01.680 --> 35:06.480]  Because it's impossible to duplicate the position of these UV particles because they're just poured in randomly.
[35:10.020 --> 35:13.260]  Basically, and here's a long quote which you can all read for yourselves.
[35:15.980 --> 35:27.480]  As far as we know, if you don't have the combination, you're not going to get this thing open because it's going to take 190 days to dial this thing with a robotic dialer, dialing every possible combination.
[35:28.880 --> 35:35.320]  This is, of course, as far as we know, because who knows what intelligence agencies or clever hobbyists have developed.
[35:35.560 --> 35:40.740]  Some of you guys might have seen this talk at Last HOPE when I gave the preliminary version.
[35:41.000 --> 35:43.620]  If you guys came away and had a brilliant idea, by all means, come up.
[35:43.660 --> 35:44.360]  I'll give you the microphone.
[35:44.480 --> 35:45.160]  You can tell everybody.
[35:45.660 --> 35:45.920]  Anybody?
[35:50.320 --> 35:51.140]  Yeah, that's...
[35:51.140 --> 35:51.860]  The camera on the ceiling.
[35:52.080 --> 35:52.600]  I'd like to see the numbers.
[35:53.200 --> 35:53.820]  That's the thing.
[35:53.920 --> 35:57.160]  The LCD display is specifically designed to prevent that.
[35:57.620 --> 35:59.300]  Possibly empty attacks, possibly.
[35:59.840 --> 36:02.480]  But then you've broken the lock and you've got to replace it.
[36:02.600 --> 36:03.080]  That's true.
[36:05.280 --> 36:06.080]  Anyway, so...
[36:06.920 --> 36:07.320]  Pardon?
[36:08.500 --> 36:15.160]  It can only be seen from a very narrow family of angles, which is probably blocked by the guy's big fat head in the way as he's trying to dial the lock.
[36:16.680 --> 36:18.840]  Because this is a civil servant who probably can't...
[36:18.840 --> 36:19.640]  who's like trying to read it.
[36:21.060 --> 36:22.340]  And like his head's in the way.
[36:22.700 --> 36:23.240]  You know?
[36:23.320 --> 36:23.680]  Probably not too.
[36:23.920 --> 36:26.520]  It's like his own belly block.
[36:26.620 --> 36:27.380]  He can't read it.
[36:27.820 --> 36:28.220]  Yeah.
[36:31.160 --> 36:31.820]  Yeah, yeah.
[36:31.960 --> 36:32.900]  Differential power analysis.
[36:33.600 --> 36:35.480]  They thought of that, I think, in most cases.
[36:35.660 --> 36:36.980]  Anyway, so...
[36:37.400 --> 36:40.700]  That's probably the easiest, the most difficult lock to open in the world.
[36:41.620 --> 36:53.860]  There are a lot of safes out there which aren't used by the U.S. government, but are used by people who really don't pay that much attention to security, and are made by manufacturers who realize their customers don't pay that much attention to security.
[36:54.260 --> 36:56.360]  And so they have, you know, minor design flaws.
[36:57.140 --> 37:00.460]  Like one particular safe where you could find the...
[37:00.460 --> 37:03.680]  what would appear to be the drop-in area, just feel for the contact points.
[37:04.560 --> 37:09.520]  Enter those particular contact points into a program that was available on the web.
[37:10.140 --> 37:11.500]  And, you know, hit go.
[37:12.540 --> 37:14.680]  And it would tell you the combination of the safe.
[37:20.190 --> 37:25.910]  And your super secure four-digit combination was, you know, took you just 30 seconds to get.
[37:27.250 --> 37:31.050]  Yeah, don't buy safes that are made by people that don't know what they're doing.
[37:32.610 --> 37:38.950]  In any case, if you want to learn more about this stuff, the definitive reference on the subject is Mark Tobias' lock, safes, and security.
[37:40.190 --> 37:43.310]  If you only buy one book, that's in fact the book to buy.
[37:43.970 --> 37:50.930]  There's an electronic version which is more expensive but has, like, cool videos, like the one I show you on the Moss Hamilton software.
[37:51.110 --> 37:54.730]  If you want to see all the intricate details of how it works, that's the place to go.
[37:55.550 --> 37:58.670]  You can also search it if you're just looking for something, because it's a gigantic book.
[37:59.870 --> 38:05.950]  If you don't have any money but you want to learn how to do this, Matt Blaze's safe tracking for the computer scientist is absolutely incredibly awesome.
[38:06.410 --> 38:12.030]  Half the graphics in this presentation were shamelessly stolen from that text because the guy's amazing when it comes to taking pictures of this stuff.
[38:14.110 --> 38:17.190]  It's free, and it does a really good job of explaining it.
[38:17.770 --> 38:23.990]  And if you want to do this professionally, there's the National Locksmith Guide to Manipulation, which talks more about things that you might encounter in the field.
[38:23.990 --> 38:28.250]  For example, if we had the money, we would be back-racking safes in the first place.
[38:28.610 --> 38:29.190]  It's a hobby.
[38:29.610 --> 38:30.170]  Yeah, it's one way.
[38:30.170 --> 38:31.190]  You know, lock sport.
[38:31.430 --> 38:32.850]  Yeah, it's one way a little bit, doesn't it?
[38:33.870 --> 38:34.850]  So, any questions?
[38:35.070 --> 38:38.790]  And you might want to go up to the microphone so everybody can hear you and the video can.
[38:38.870 --> 38:41.390]  I have a question, but could you speak to the ratings on safes?
[38:41.890 --> 38:43.850]  Do you have the difference between buyer and burglary ratings?
[38:44.150 --> 38:47.370]  Okay, good question about the ratings on safes.
[38:47.510 --> 38:49.370]  If you're buying a safe, what do you look for?
[38:50.210 --> 38:53.750]  Well, first of all, make sure it has a real lock on it, as we all saw.
[38:54.870 --> 38:58.430]  If it's a fire rated safe, it's designed to keep out fire.
[38:58.730 --> 39:00.430]  It's not designed to keep out burglars.
[39:00.670 --> 39:05.750]  This means that a burglar with, you know, a can opener may very well be able to open it.
[39:06.510 --> 39:19.150]  It may feel really solid, because they want you to think it might help against burglars, but it actually isn't designed to resist against burglars, and they save money by removing all the stuff that would help it against burglars, except for some big shiny bolts that are probably worthless.
[39:20.310 --> 39:33.590]  Burglary rated safes are correspondingly not rated to withstand fire, but they have things like thicker walls and hard plate, which is a very drill-resistant plate, which will make it a royal pain in the ass for some guy coming after it with a drill.
[39:33.870 --> 39:43.390]  They might have things like re-lockers, which are devices designed to detect somebody trying to break a safe and lock it permanently, at least until you call a safe technician who knows exactly where to drill.
[39:45.350 --> 39:51.910]  And overall, the burglary-resistant safes are rated by the UL on a certain code fashion.
[39:52.290 --> 39:58.150]  There's TL-rated safes, which are safes rated to resist burglars armed with standard tools.
[39:58.670 --> 40:06.450]  There are TX-related safes, which are rated to withstand burglars armed with torches and explosives.
[40:06.790 --> 40:10.050]  And there's one more rating just for torches and tools, and I forget what it's called.
[40:10.610 --> 40:28.650]  And these are printed in a form like TL-15, TL-30, TL-60, which means that given a safe expert who knows exactly what he's doing, it will take him at least 15 minutes to open that safe with standard hand tools or a certain amount of explosives or whatever.
[40:29.350 --> 40:34.750]  This means that if you buy a TL-15 safe, you have to make sure the cops will get there in about eight minutes.
[40:36.470 --> 40:38.450]  How much margin you want to leave is up to you.
[40:39.110 --> 40:46.230]  But it gives you a very good way of quantifying, you know, this safe will hold me because, well, the cops will be here because they're right down the road, or the cops will never be here.
[40:46.430 --> 40:56.850]  Better make it a royal pain in the ass and get a TXTL-60X6, which means it's rated to withstand this attack from all six sides for a full hour, which means that your average mortal is never going to get inside.
[40:59.050 --> 40:59.370]  Yeah?
[40:59.370 --> 41:07.770]  That example where you had the four combinations, what is it you fed in, and then what was it doing to you?
[41:08.830 --> 41:20.230]  In the interest of keeping safe the fools who are stupid enough to buy that particular safe, though it's not an American safe, it's actually European safe.
[41:20.470 --> 41:24.330]  For those of you guys who think European security is entirely 100% better than ours, it's not.
[41:25.330 --> 41:26.810]  I don't want to talk too much about that.
[41:27.210 --> 41:28.890]  I mean, just, what was going on?
[41:29.070 --> 41:32.810]  Basically, you fed in what, you know, what appeared to be the contact area.
[41:33.550 --> 41:35.270]  Am I listening to physics and so forth?
[41:35.410 --> 41:36.810]  No, you feel for it.
[41:36.890 --> 41:40.670]  You just feel where it stops, where there's a little bit of resistance.
[41:40.930 --> 41:42.770]  I think you do want sheet combination padlocking.
[41:42.850 --> 41:42.990]  Yeah.
[41:43.770 --> 41:46.870]  And you feed in the last digit, and you hit go, and it calculates out the combination.
[41:47.050 --> 41:48.070]  It's not a lot of error.
[41:48.230 --> 41:48.590]  Yeah.
[41:49.290 --> 41:51.050]  Really, really simple one, scarily so.
[41:51.050 --> 41:55.150]  And another great point about cheap safes.
[41:55.270 --> 41:55.510]  Mm-hmm.
[41:55.750 --> 41:59.550]  If it has an electronic lock, it's almost surely...
[42:00.250 --> 42:03.730]  Some of them just really get a 9-volt battery with a pair of wires on it.
[42:03.810 --> 42:04.650]  Yeah, no, really.
[42:04.870 --> 42:20.310]  Like, having poked around a few control panels of electronic safes, and found, like, the couple of wires hiding out under them, and then gone open and realized that the wires went directly to the solenoid, and realized that, you know, your average 9-volt battery with some alligator clips,
[42:20.310 --> 42:21.290]  clip pen open?
[42:21.850 --> 42:22.510]  At least part of the room is...
[42:22.510 --> 42:25.310]  That's why on purpose is, Steve, where you see get-in mode, you see.
[42:25.550 --> 42:25.830]  Yeah.
[42:26.010 --> 42:27.670]  But otherwise...
[42:27.670 --> 42:31.310]  I don't trust my safe manufacturer enough to do that.
[42:31.530 --> 42:37.470]  I don't want to plug the keypad, plug in another keypad that you know the combination of, because you bump the thing up and outplug the wire.
[42:37.630 --> 42:39.890]  That's really clever and really stupid at the same time.
[42:39.950 --> 42:40.310]  Exactly.
[42:40.950 --> 42:49.930]  His point was that some models, you could unplug the keypad from the safe, plug in a keypad from a safe to which you knew the combination, and then your code would work.
[42:50.130 --> 42:50.310]  Exactly.
[42:51.810 --> 42:52.470]  It's like...
[42:52.470 --> 42:53.070]  Yeah.
[42:54.410 --> 42:54.670]  Yeah.
[42:54.850 --> 42:56.210]  Use your garage door openers.
[42:56.230 --> 42:56.470]  Yeah.
[42:56.670 --> 42:56.910]  Yeah.
[42:57.150 --> 42:59.350]  I don't think garage door openers work, but...
[42:59.350 --> 43:03.370]  Anyway, I want to get to some people who are, like, actually un-lazy enough to stand up and get to the microphone.
[43:04.050 --> 43:05.870]  So, you know...
[43:06.910 --> 43:08.650]  You in the back at the microphone.
[43:08.650 --> 43:10.070]  All right.
[43:10.530 --> 43:18.010]  In general, like, in terms of locks such as padlocks and other things, how would you say combination locks compare to key locks in terms of security?
[43:19.690 --> 43:26.690]  Actually, your average master lock or padlock can be remarkably difficult to pick for what it is.
[43:26.950 --> 43:33.630]  I wouldn't trust it to secure any amount of money, but if you've looked at picking those, the procedure for doing so is somewhat involved.
[43:33.630 --> 43:35.210]  You actually have to...
[43:35.210 --> 43:36.090]  You use...
[43:36.770 --> 43:39.790]  Kind of like the program I showed you, you have to...
[43:39.790 --> 43:42.670]  You figure out the possible range of combinations, and then there's...
[43:42.670 --> 43:44.290]  Some people can manipulate them.
[43:44.370 --> 43:45.770]  Some just have to brute force it, basically.
[43:46.170 --> 43:47.070]  You can shim them.
[43:47.730 --> 43:48.950]  However, you can shim them.
[43:50.910 --> 43:52.570]  I'm talking from the manipulation perspective.
[43:52.770 --> 43:55.010]  You can pull it back off with a free compare diagonal...
[43:55.010 --> 43:55.650]  10 seconds.
[43:55.750 --> 43:56.250]  Yeah, yeah.
[43:56.350 --> 43:57.130]  Use a can opener.
[43:57.550 --> 43:59.370]  I mean, these are locker padlocks here.
[43:59.370 --> 44:04.030]  He was asking combination or key.
[44:04.470 --> 44:06.410]  Oh, in general, combination versus key.
[44:06.630 --> 44:06.950]  Yeah.
[44:10.910 --> 44:12.610]  How much are you going to pay?
[44:13.650 --> 44:29.710]  Like, there are very good, like, small padlock form combination locks, and there are very bad ones, just as there are very good small form key locks, like the little American padlocks, which are a royal, royal, royal pain in the ass to pick, because they use serrated pins,
[44:29.770 --> 44:32.350]  and some of them even have serrated pin chambers to match.
[44:33.510 --> 44:40.490]  Even though these things are dinky, and you could cut through the shackle in five seconds with a pair of bolt cutters, you're not going to pick them open anytime soon.
[44:41.050 --> 44:54.630]  But the Sargent and Greenleaf 8088, like you're talking about, you're not going to manipulate those open anytime soon, because to get those measurements, you have to measure the distance you're pulling the shackle, because there's no rounded gate area.
[44:54.630 --> 44:55.450]  It's all square.
[44:56.670 --> 44:58.430]  And, yeah, it gets really complicated.
[44:58.670 --> 45:02.450]  So, there are secure locks, and there are insecure locks.
[45:03.370 --> 45:08.930]  If you're looking for security, get ones that are designed for real security, which means they're probably not made by master lock.
[45:12.430 --> 45:17.010]  With the exception of the construction-grade locks, which can be kind of a pain to pick sometimes, if you get a good one.
[45:17.010 --> 45:18.470]  Okay, let me just go in the back.
[45:18.710 --> 45:19.950]  Go to the microphone, man.
[45:27.540 --> 45:31.500]  Not that this is really news for most people who go to these things, I would imagine.
[45:31.800 --> 45:38.660]  But, talking about Master, they have a higher security, quote-unquote, combination pallet.
[45:38.720 --> 45:41.020]  This is the one with the bigger case and the smaller dial.
[45:41.680 --> 45:43.940]  It's, they're relatively expensive.
[45:44.140 --> 45:46.060]  Well, nothing like a Sargent and Greenleaf one, mind you.
[45:46.280 --> 45:47.180]  They are better.
[45:47.320 --> 45:49.080]  They're hard to manipulate and shit like that.
[45:49.080 --> 45:59.780]  But, it still has the same basic floor, a different floor, that every single master padlock tends to have, unless you've used your head a little.
[46:00.560 --> 46:02.740]  Most of them still have the code number on the back.
[46:03.040 --> 46:10.220]  And if you know what to do, as far as picking up a telephone, you can have the combination in your hot little hands in about five minutes.
[46:10.720 --> 46:11.680]  That's all I'm going to say.
[46:11.800 --> 46:15.740]  And it's true with their key locks, you can get the key cuts, and so on.
[46:15.740 --> 46:24.100]  Yeah, yeah, that's actually my favorite way of opening a master combination padlock, is you look at the serial number on the back, and you call up your locksmith buddy, who has a big database.
[46:24.480 --> 46:27.220]  No, you can just call master, actually, if you know how to talk to them.
[46:27.360 --> 46:28.340]  You never call a locksmith.
[46:28.360 --> 46:30.500]  Yeah, if you can social engineer them, you can probably get them to get the combination.
[46:31.280 --> 46:36.920]  If I told you how ridiculously stupid and simple it is to do it, you'd fall on the floor.
[46:38.080 --> 46:40.920]  A child could get the combos from them for these things.
[46:40.920 --> 46:41.520]  Okay.
[46:42.700 --> 46:43.180]  Okay.
[46:43.340 --> 46:43.980]  Any other questions?
[46:46.200 --> 46:47.360]  Thanks for coming, everybody.
[46:55.610 --> 46:56.090]  Sure.
[46:56.610 --> 46:58.930]  I actually have a safe that it's given to me.
[46:58.930 --> 46:59.350]  Thank you.