[00:10.100 --> 00:12.680]  Okay, it's good to be back in New York.
[00:13.140 --> 00:17.220]  After all, this is where, for me, a lot of things started.
[00:18.800 --> 00:20.940]  It's always good to be here, always friendly people.
[00:21.360 --> 00:31.440]  And I'm going to tell you about some exploits for mechanical and even some electronical locks that we've been found out over the last two years that it took since I was here.
[00:33.720 --> 00:36.800]  On my right side is Mark Weber-Tobias.
[00:36.980 --> 00:41.300]  He's the author of the big book we lock pickers call The Bible.
[00:42.280 --> 00:44.740]  It's really a very nice piece of work.
[00:44.900 --> 00:47.800]  And he's been, you know, playing with locks when I was in diapers.
[00:49.040 --> 00:50.020]  Sorry about that.
[00:50.940 --> 00:51.540]  Yes.
[00:51.900 --> 00:52.240]  Okay.
[00:52.560 --> 00:55.600]  But anyway, he will introduce himself later on.
[00:55.700 --> 00:57.140]  And let's get it started.
[00:58.740 --> 01:02.400]  As I said, a lot has happened since the last time I was here.
[01:02.960 --> 01:05.740]  It's almost been, only been two years ago.
[01:06.260 --> 01:09.140]  But a lot of things were happening.
[01:09.400 --> 01:19.500]  One of the things is that our lock pick club tool, which is just, you know, nothing more than a bunch of amateur lock pickers, lock enthusiast people, really has become a name in the industry.
[01:20.640 --> 01:26.180]  As Mark says, you know, there's no single lock manufacturer in the world that doesn't know about us.
[01:26.380 --> 01:34.940]  And that's because some exploit that we brought to the attention of the public and the media, that we will talk at the end of this presentation.
[01:36.680 --> 01:38.640]  This makes life easier for us.
[01:38.780 --> 01:47.440]  Because, you know, if I'm at a conference or anywhere, people just hand me cut away locks and please test this before we put it in production.
[01:48.640 --> 01:51.740]  Yes, there's a lot of advantages on it.
[01:52.800 --> 01:56.560]  Some other things have also happened during the last time.
[01:56.720 --> 01:59.020]  And that is that lock sports is growing rapidly.
[02:00.220 --> 02:04.720]  You know, six or eight years ago, I was here talking about lock sports.
[02:04.720 --> 02:06.680]  And some people really picked it up.
[02:07.220 --> 02:14.440]  And this all started in Germany, where people started to pick locks as a hobby in a sport.
[02:15.940 --> 02:18.080]  And then it went through the Netherlands.
[02:18.300 --> 02:20.360]  And now it's spreading all over the world.
[02:21.440 --> 02:26.300]  There's a sports group set up in Canada, in the U.S.
[02:26.640 --> 02:27.880]  It's really getting somewhere.
[02:28.400 --> 02:36.080]  Also, there's some online communities that have information that, you know, you couldn't dream of having two years ago.
[02:36.680 --> 02:40.140]  One of the best examples of that is lockpicking101.com.
[02:40.740 --> 02:46.000]  As far as I understand, it's run by just a couple of kids who just did it for the fun.
[02:46.200 --> 02:55.260]  And now there is, I don't know exactly how many thousands of 10,000 of messages on there, which a lot of them are really poor quality.
[02:55.540 --> 02:58.200]  But if you sip through them... No, really, they are.
[02:58.320 --> 03:07.320]  But if you sip through them, there's information there you will find that you will find nowhere else on the planet, except maybe behind some closed doors at agencies.
[03:08.260 --> 03:14.000]  And if you sip through it, you will really find some very valuable things.
[03:14.160 --> 03:21.940]  And I think Lockpicking 101 is one of the most interesting things that have happened in the last two years.
[03:21.980 --> 03:23.540]  And it's really getting somewhere.
[03:23.540 --> 03:32.980]  And also, you know, there's this whole next generation of young people who start an interest in locks and lockpicking and physical security.
[03:33.360 --> 03:41.660]  And, you know, there's some really, really bright kids just thinking about locks and how to exploit them and doing nothing else.
[03:41.820 --> 03:47.320]  You know, they sit there in this small village and I don't know what's wrong with them, but they can only think about locks.
[03:47.960 --> 03:50.420]  Just, you know, just like I was.
[03:51.100 --> 03:57.040]  And one of the examples, and I'm not sure if the last part is... It's a guy, Deviant.
[03:57.260 --> 04:00.460]  He also does presentations at DEFCON.
[04:00.900 --> 04:03.700]  And he's, yeah, he's really a talented guy.
[04:04.100 --> 04:08.080]  He knows his stuff and does excellent presentations.
[04:08.440 --> 04:11.180]  And one of the things he's also good at is making graphics.
[04:11.520 --> 04:22.860]  And thanks to him, I will be able to explain some of the things and the hacks more clearly, because a lot of his graphics, animated GIFs, he let me borrow it.
[04:22.980 --> 04:24.360]  So it works both ways.
[04:24.540 --> 04:28.060]  You know, if I have some information, he uses it in his presentations.
[04:28.180 --> 04:30.840]  And if he makes nice graphics, I can show you.
[04:33.400 --> 04:35.120]  Well, mechanical locks are not safe.
[04:36.840 --> 04:42.540]  Maybe this is not completely true, because there are some damn good mechanical locks on the market that even I cannot bypass.
[04:43.680 --> 04:49.580]  But at the end of the day, mechanical locks just, you know, they have some fundamental problems.
[04:50.380 --> 04:55.700]  And there's many ways that you can bypass or exploit these locks.
[04:56.320 --> 04:57.700]  There's a number of techniques.
[04:58.000 --> 04:58.880]  There's lockpicking.
[04:59.980 --> 05:01.160]  There's bypassing.
[05:01.560 --> 05:05.920]  And Mark told me to remove the strife, is that what it's called?
[05:06.480 --> 05:06.900]  Hyphen.
[05:07.160 --> 05:07.580]  Hyphen.
[05:08.360 --> 05:09.400]  So I'm sorry about that.
[05:09.940 --> 05:12.940]  Impressioning and self-impressioning, which is really something I like.
[05:13.840 --> 05:14.980]  Then there's decoding.
[05:15.120 --> 05:16.880]  I don't know if I spoke about that before.
[05:17.440 --> 05:19.840]  And there's something new on the blog called bumping.
[05:20.140 --> 05:22.660]  And, you know, some people already know about bumping.
[05:23.000 --> 05:28.000]  And if you haven't known, if you haven't heard about bumping, you know, this is going to be an interesting lecture for you, I think.
[05:29.800 --> 05:30.280]  Okay.
[05:30.420 --> 05:30.900]  Lockpicking.
[05:31.160 --> 05:34.560]  As the people in Germany say, lockpicking is fun, fun, fun.
[05:35.480 --> 05:37.240]  Do you want this displayed on the screen?
[05:37.480 --> 05:37.720]  Yes.
[05:38.020 --> 05:38.900]  Oh, it's not?
[05:39.220 --> 05:39.680]  Oh, no.
[05:41.160 --> 05:42.620]  Oh, there goes my presentation.
[05:42.860 --> 05:43.020]  Great.
[05:44.220 --> 05:44.700]  Wonderful.
[05:45.360 --> 05:46.540]  I shouldn't have said anything.
[05:48.700 --> 05:49.180]  Okay.
[05:49.400 --> 05:50.780]  Well, here's a lot has happened.
[05:58.360 --> 05:59.600]  Mechanical locks are not safe.
[06:02.180 --> 06:02.540]  Okay.
[06:02.720 --> 06:03.220]  Fun, fun, fun.
[06:05.700 --> 06:06.060]  Okay.
[06:06.360 --> 06:09.800]  Well, you know, lockpicking really got me hooked into learning about locks.
[06:09.920 --> 06:13.000]  Because you can only pick a lock if you know how it works.
[06:13.120 --> 06:16.800]  If you don't know how a lock works, it's going to be damn difficult to open it.
[06:16.880 --> 06:17.460]  It can be done.
[06:17.780 --> 06:23.020]  But, you know, if you want to get somewhere, you really need to take locks apart and understand about them.
[06:23.600 --> 06:28.520]  As I said, locksport groups have formed worldwide.
[06:30.440 --> 06:33.720]  At TOOOL, we have a new style game.
[06:34.020 --> 06:38.700]  It's some sort of competition where we have a box of 26 locks.
[06:39.540 --> 06:43.900]  And everybody at TOOOL can try to pick these locks as fast as they can.
[06:44.040 --> 06:46.160]  And they can try as many times as they can.
[06:46.280 --> 06:51.620]  So, for instance, the number one lock might be a Schlage, for instance.
[06:52.200 --> 06:58.320]  And, you know, when I first start to try to pick the number one lock, it takes me ten minutes and five seconds.
[06:58.580 --> 07:00.920]  And then I think, okay, now I understand it a little bit better.
[07:01.100 --> 07:03.340]  So, I pick the number two or I pick it again.
[07:03.520 --> 07:05.680]  And now I can pick it in eight minutes.
[07:06.060 --> 07:10.960]  And then when I'm looking to my right, I see that somebody else picked that same lock in 25 seconds.
[07:10.960 --> 07:13.300]  And I'm like, okay, how did you do it?
[07:13.460 --> 07:18.880]  And then, you know, this brings a level of knowledge transfer between people.
[07:19.100 --> 07:24.160]  Like, how is it possible that you can do it in 25 seconds while I can do it only in eight minutes?
[07:24.500 --> 07:30.400]  And this really gets people to think about locks and to copy techniques from each other that are successful.
[07:30.600 --> 07:36.560]  And this really is something that I'm proud of that we came up with it.
[07:37.620 --> 07:42.460]  And the fun thing about lock picking is that you can help people when they are locked out.
[07:42.700 --> 07:44.860]  This happens to me approximately one time a month.
[07:45.600 --> 07:48.160]  And, yeah, they know how to find me.
[07:50.260 --> 07:53.020]  And, you know, it really is rewarding if you open the lock.
[07:53.300 --> 07:57.080]  Once in a while, you know, you're on your knees for 15 minutes picking and it doesn't work.
[07:57.500 --> 08:01.930]  And, you know, they think that guy, you know, I should have only watched his video and not ask him to open the...
[08:03.380 --> 08:03.840]  What's that?
[08:03.920 --> 08:05.200]  I think it's a rotary pick out.
[08:05.200 --> 08:06.000]  Yeah, sure.
[08:07.000 --> 08:10.260]  But anyway, most of the time the door opens.
[08:10.700 --> 08:17.520]  But it's really rewarding if you can use your talents and your skills for something to help out other people.
[08:18.760 --> 08:23.560]  Now, as I said, locks are... have vulnerabilities.
[08:24.220 --> 08:32.520]  And the main reason why locks are vulnerable, if I need to go into that, first I need to explain how does a lock work.
[08:32.520 --> 08:38.400]  Can everybody raise his hand if they know how a lock works in detail?
[08:40.060 --> 08:42.180]  Okay, that's about 60, 70 percent.
[08:42.460 --> 08:43.040]  That's very good.
[08:44.200 --> 08:45.520]  Do we have a laser pointer?
[08:47.200 --> 08:48.640]  I can get one just a little bit.
[08:48.860 --> 08:49.220]  I've got one.
[08:49.220 --> 08:49.900]  I've got one just a little bit.
[08:49.980 --> 08:50.140]  Okay.
[08:50.220 --> 08:50.940]  Mark has got one.
[08:52.000 --> 08:52.440]  Okay.
[08:52.540 --> 08:57.360]  Well, as you can see, what I always consider the most important part of a lock is the plug.
[08:57.740 --> 09:03.740]  It's that round thing in the center of the lock that at the end, you know, we would like that to rotate.
[09:04.360 --> 09:09.060]  And the question is... the question you have to ask yourself if you want to... thank you, Cindy.
[09:10.380 --> 09:11.220]  I got it, Mark.
[09:11.380 --> 09:11.540]  Thanks.
[09:11.700 --> 09:11.840]  Okay.
[09:11.840 --> 09:12.660]  Okay.
[09:12.680 --> 09:18.780]  The question you need to ask yourself is, why does the plug only turn with the correct key?
[09:18.940 --> 09:21.420]  So I can insert a wrong key and the plug won't turn.
[09:21.560 --> 09:23.620]  And why does it turn when I insert the correct key?
[09:25.820 --> 09:26.340]  Okay.
[09:26.840 --> 09:28.380]  There we have the plug.
[09:28.600 --> 09:31.120]  And there's actually holes drilled into the plug.
[09:32.020 --> 09:34.380]  And it's too bad we can't see the house.
[09:34.780 --> 09:37.140]  But the house also has got these holes.
[09:37.600 --> 09:40.800]  And this should, you know, this is the house of the lock, this part.
[09:41.540 --> 09:46.240]  And you see that there's two stacks or two pins on top of each other with the spring.
[09:46.460 --> 09:47.020]  That's the spring.
[09:47.560 --> 09:58.940]  And you see that if the key is inserted into the lock, and it lifts the point where these two pins are on top of each other, exactly at the point where the house and the plug meet each other, then it can turn.
[09:59.160 --> 10:01.980]  If it's in this position, it's not blocking.
[10:02.280 --> 10:05.620]  If it's now in this position, it's blocked because it can turn.
[10:05.900 --> 10:07.460]  Is that clear to everybody?
[10:08.460 --> 10:09.460]  Okay, thanks.
[10:11.800 --> 10:15.300]  Once we know this, then is the question, how can a lock be picked?
[10:16.700 --> 10:28.500]  It's nice that a key lifts these pins to a specific height where the brake line of these pins are exactly in the right place, but how can that be exploited by lockpicking?
[10:29.720 --> 10:33.740]  That's because mechanical imperfections add up.
[10:34.320 --> 10:53.720]  I've been, due to the success of TOOOL, I visited many lock factories already, and, you know, I see how these locks are made, and this really helps me to clearly see what happens, is that normally, if you look on top of this plug, there is four holes, or actually,
[10:53.720 --> 10:56.240]  most of the time, it's five, but in this drawing, it's four.
[10:57.620 --> 11:04.460]  And these holes, in the perfect world, are drilled exactly in the center of the round plug.
[11:05.760 --> 11:19.560]  But what I've seen is that there's a machine that actually has five drills, and, you know, just drills into this core, with five drills at the same time, or there's a drill that, you know, drills bzzz, bzzz, bzzz, and makes five holes in a row.
[11:19.560 --> 11:28.520]  Now, what's going to happen, that if you drill a million of these plugs in a row, the drills will get out of alignment a little bit.
[11:28.780 --> 11:29.620]  It's not much.
[11:29.800 --> 11:36.560]  I mean, this is highly exaggerated, but, for instance, the first one is off to the left, the second one way off to the right.
[11:36.560 --> 11:44.840]  This is reasonably centered, but these two, you know, are clear to, yeah, to be out of the center.
[11:46.200 --> 11:48.560]  Another thing is that the shape of the pins.
[11:49.120 --> 11:51.060]  I've also seen these pins made.
[11:51.160 --> 11:59.940]  They're made out of thick wire, and there's a machine that does nothing else than, you know, takes wire and cuts it into these very hard metal pins.
[11:59.940 --> 12:11.540]  And, as you can understand, that the first pin that comes off the machine line is just a little bit different, thicker or thinner, than the one millionth pin that comes off that line.
[12:11.780 --> 12:14.680]  So, these pins, you know, they vary in thickness.
[12:14.900 --> 12:16.480]  And it's not much.
[12:16.620 --> 12:19.700]  I mean, if you look at it with the naked eye, you're probably not going to see it.
[12:19.760 --> 12:24.160]  And if you measure it, you know, it just depends on how good the lock company is.
[12:25.420 --> 12:32.820]  But at the end of the day, these pins vary in thickness, and these holes are not completely in alignment.
[12:33.040 --> 12:36.520]  And that actually is what makes locks vulnerable and pickable.
[12:36.940 --> 12:48.880]  Because what happens is that if you assemble a lock, and you start to pick the lock, the first thing you do is you insert a tensioner into the lock.
[12:48.880 --> 12:56.900]  And the tensioner is nothing more than a piece of flat metal that, you know, you want to rotate this plug with.
[12:57.340 --> 13:00.960]  And what happens now is if you put the tensioner in the lock...
[13:00.960 --> 13:01.660]  Let's see.
[13:02.380 --> 13:02.520]  Oh.
[13:03.740 --> 13:17.000]  If you put the tensioner in the lock, because of the difference in thickness of the pins and because of the difference in the holes, not all pins are going to prevent that lock from turning.
[13:17.820 --> 13:23.520]  So what you do with picking is you one by one lift the pins, and you go for the thickest pin.
[13:24.120 --> 13:34.020]  Because the thickest pin will bind, and pins that are more thin will just be lifted up and fall back again, because they're not the one preventing the lock from turning.
[13:34.540 --> 13:41.020]  What I try to say is that only one or two pins in a lock at the same time will prevent the lock from turning.
[13:41.200 --> 13:43.940]  And as you see, it wasn't this one, it wasn't this one.
[13:44.040 --> 13:45.460]  So it has to be this one now.
[13:46.680 --> 13:49.160]  That's just, you know, a little bit thicker.
[13:49.320 --> 13:53.360]  And that's the one actually preventing the lock from turning with your tensioner.
[13:53.720 --> 13:55.060]  And I will pick a lock.
[13:55.980 --> 13:59.120]  I'll try to pick one here on the screen so I can show you.
[14:00.500 --> 14:04.940]  But with the so-called finger pick, you enter the lock and you lift the pins.
[14:06.600 --> 14:10.760]  And if the pin is thick, is the thickest one, then it will bind.
[14:11.280 --> 14:16.580]  And, you know, it will stay, it will rest on the core while the core itself turns a little bit.
[14:17.200 --> 14:20.820]  And now there's only one pin blocking this lock from turning.
[14:20.820 --> 14:26.860]  And you'll see that, slowly but surely, the
[14:31.760 --> 14:32.540]  lock should turn.
[14:35.970 --> 14:36.570]  Yes.
[14:37.290 --> 14:38.730]  You know, your computer is slow.
[14:40.770 --> 14:42.450]  I don't think so.
[14:43.950 --> 14:45.530]  Well, it's maybe viruses or whatever.
[14:45.930 --> 14:46.130]  Anyway.
[14:46.470 --> 14:47.490]  Yeah, maybe.
[14:48.690 --> 14:49.290]  Okay.
[14:49.650 --> 14:51.330]  So this is lockpicking in theory.
[14:51.330 --> 14:54.530]  I will try to show you with the document camera.
[14:54.530 --> 14:55.110]  Anyway.
[14:57.110 --> 14:57.530]  Okay.
[14:57.710 --> 15:06.050]  Now, people, when they see my pic set, you know, they are always really impressed saying, how can I play video here?
[15:06.330 --> 15:07.050]  Click on it.
[15:07.510 --> 15:08.790]  Just put the cursor on it.
[15:10.270 --> 15:11.810]  Just put the cursor in the middle.
[15:12.670 --> 15:13.310]  You know what?
[15:13.470 --> 15:18.230]  I will just switch to the document camera and show it.
[15:18.830 --> 15:18.890]  Okay.
[15:38.430 --> 15:38.830]  Okay.
[15:39.050 --> 15:44.570]  Now, people, you know, when they see that, they think, wow, you know, if I had a big toolset like that, I could open a lot of locks.
[15:44.750 --> 15:47.210]  But actually, you only need a couple of pics.
[15:47.650 --> 15:54.370]  It's very nice that you have a thousand different pics and you buy these pick sets on the Internet that have 125 different tools.
[15:54.710 --> 15:57.690]  But at the end of the day, you will only use a few.
[15:57.690 --> 15:59.210]  Can we switch back to my laptop?
[16:00.010 --> 16:00.090]  Yep.
[16:05.240 --> 16:06.220]  Oh, which one is it?
[16:06.440 --> 16:06.580]  Is it?
[16:06.640 --> 16:07.160]  Yeah, there you go.
[16:07.860 --> 16:08.100]  Okay.
[16:10.220 --> 16:10.620]  Oh.
[16:12.080 --> 16:12.480]  Okay.
[16:12.580 --> 16:14.240]  At the end of the day, you only need a few pics.
[16:14.660 --> 16:20.260]  What's most important about a good pic set is that you have a wide variety of hook pics.
[16:20.780 --> 16:23.380]  And as you can see, these are the hook pics, the finger pics.
[16:23.380 --> 16:28.580]  And this is a pic set we have specially made for HOPE Number Six.
[16:28.980 --> 16:31.480]  So, you know, you really should try to get one.
[16:33.620 --> 16:35.360]  And these are two rakes.
[16:35.780 --> 16:39.920]  And later on, we'll be at the second floor where there's a lockpick village.
[16:39.980 --> 16:45.500]  And we'll train people, you know, and explain how the lock works and how to pick locks yourself.
[16:45.720 --> 16:51.260]  So, you should really try to visit us and experience the joys of lockpicking yourself.
[16:51.260 --> 16:53.760]  It's not that difficult on most locks.
[16:54.040 --> 16:55.640]  And, you know, the more difficult the locks become.
[16:56.860 --> 16:57.900]  But, yeah.
[16:58.080 --> 17:03.820]  And what's also important is that the tensioners in the kit have different sizes.
[17:04.060 --> 17:07.040]  Because it's nice if you have 20 the same size tensioners.
[17:07.250 --> 17:10.600]  But these tensioners is what actually is turning the lock.
[17:10.990 --> 17:19.180]  And with this simple but elegant pic set that we made, we have four different size of tensioners.
[17:19.270 --> 17:21.230]  So, they will fit practically any lock.
[17:21.250 --> 17:27.420]  And I'm really proud of this pic set because we sat down together with somebody with a cat cam program.
[17:27.700 --> 17:28.840]  And we drew it ourselves.
[17:29.210 --> 17:32.470]  So, this really is what I consider one of the best pic sets.
[17:32.700 --> 17:34.230]  And it's not that expensive either.
[17:34.970 --> 17:35.490]  So...
[17:35.490 --> 17:36.160]  It's 30 bucks.
[17:38.250 --> 17:38.770]  So...
[17:38.770 --> 17:39.730]  Okay.
[17:39.880 --> 17:45.100]  Now, we now see how lockpicking works.
[17:45.100 --> 17:49.380]  So, what did the industry try to prevent picking?
[17:49.860 --> 17:53.780]  Now, here's where Deviant's moving GIFs come in.
[17:54.100 --> 17:57.210]  For instance, they have designed the so-called mushroom shape.
[17:57.600 --> 18:02.960]  It's a special pin that if you put tension on the plug, it will go already a little bit.
[18:02.960 --> 18:06.860]  And the head is much thicker than the rest of the pin.
[18:07.140 --> 18:09.600]  And it will actually be caught there.
[18:09.840 --> 18:12.780]  And this is what makes life difficult for a lockpicker.
[18:12.980 --> 18:15.260]  But on the other side, it keeps it interesting.
[18:17.060 --> 18:19.740]  They also made very narrow keyways.
[18:19.740 --> 18:22.260]  If you can see, this is a European EVA lock.
[18:22.480 --> 18:26.860]  It's got an extremely narrow keyway that goes from left to right, zigzagging all the way up.
[18:27.060 --> 18:31.780]  So, the tools are almost impossible to fit in this keyway.
[18:31.800 --> 18:32.920]  While the key, of course, can.
[18:33.060 --> 18:33.800]  There's no problem for that.
[18:34.540 --> 18:38.520]  They also designed dimple locks.
[18:39.100 --> 18:43.260]  You know, that have small holes instead of V-shaped cuts.
[18:44.200 --> 18:47.280]  Yeah, these can also be picked but require special tools.
[18:51.290 --> 18:55.160]  Is there an interest that I pick a lock on stage to show you how it works?
[18:55.160 --> 18:56.400]  Or shall we do that to the second floor?
[18:59.700 --> 19:00.220]  You want to see it?
[19:00.380 --> 19:00.400]  Okay.
[19:02.480 --> 19:03.520]  Yeah, just do it.
[19:07.080 --> 19:07.780]  Okay, cool.
[19:14.180 --> 19:15.400]  We get to choose the lock.
[19:17.740 --> 19:18.940]  Downstairs, you can choose the lock.
[19:19.040 --> 19:19.400]  It's no problem.
[19:19.540 --> 19:23.880]  But here, I'll take my simplest lock because it's not easy picking for all these people.
[19:25.940 --> 19:29.060]  Okay, what you have here is the tensioner.
[19:29.160 --> 19:30.560]  I'm not sure if you can see it.
[19:31.000 --> 19:31.160]  Can you?
[19:32.080 --> 19:43.000]  And you insert it strategically into the lock in a place where you still have room to insert the other tool.
[19:43.000 --> 19:44.640]  Can this be seen clearly?
[19:44.820 --> 19:44.980]  Yes.
[19:45.420 --> 19:45.700]  Okay.
[19:46.600 --> 19:54.060]  So, I now will enter the lock with the hook pick and I will go in as deep as I can and feel for pins that are binding.
[19:55.210 --> 19:58.540]  And by the time I'm out, I've already set two pins.
[20:03.850 --> 20:04.950]  There's two more.
[20:09.300 --> 20:10.240]  And open.
[20:10.900 --> 20:11.240]  Okay.
[20:11.500 --> 20:13.180]  Now, this is a very simple lock.
[20:14.500 --> 20:15.460]  But it's picked.
[20:15.880 --> 20:20.680]  And, you know, this is actually all there is to it with picking locks.
[20:21.100 --> 20:27.960]  So, really, come down to the second floor later after this presentation and we'll show you how it works.
[20:41.310 --> 20:43.790]  Okay, as I said, there's a tool for every lock.
[20:44.150 --> 20:46.910]  It just depends on if it's available for the public or not.
[20:48.730 --> 20:50.010]  Dimple locks can be picked too.
[20:50.190 --> 20:51.990]  The more difficult the lock, the greater the challenge.
[20:52.270 --> 20:55.950]  I mean, I've picked some locks that other people thought were really, you know, not pickable.
[20:56.150 --> 20:58.350]  And even the manufacturer thinks I'm cheating.
[20:58.350 --> 21:02.130]  But we spoke at the lockpick conference, Aloha, in Las Vegas.
[21:02.450 --> 21:04.710]  And I convinced him that, you know, I could do it.
[21:06.630 --> 21:09.090]  And there's no such thing as an unpickable lock.
[21:09.190 --> 21:11.010]  It sometimes just takes forever to open.
[21:11.750 --> 21:13.870]  Which is also more or less unpickable.
[21:14.030 --> 21:17.690]  But it's like with cryptography, you know.
[21:17.770 --> 21:19.870]  If you have long enough time, anything will fall.
[21:22.870 --> 21:26.150]  Well, there's, you know, besides picking, there's other methods.
[21:26.150 --> 21:29.470]  And one of the methods I really like is the bypass.
[21:30.690 --> 21:33.310]  When you bypass a lock, you don't pick it.
[21:33.410 --> 21:36.530]  You just go for whatever keeps the lock locked.
[21:36.730 --> 21:40.690]  And you don't mind for combination or you don't mind for a key or whatever.
[21:40.910 --> 21:47.350]  You just, with a wire or with some cleverness, go into the lock and try to open it.
[21:47.470 --> 21:53.770]  And I brought a cutaway model of a popular master combination padlock that I'll show.
[22:06.940 --> 22:08.100]  And that's terrible.
[22:08.480 --> 22:09.680]  Don't zoom in too much.
[22:09.780 --> 22:10.200]  No, no, no.
[22:10.260 --> 22:11.180]  It's just terrible light.
[22:16.470 --> 22:16.990]  Okay.
[22:17.150 --> 22:21.790]  As you can see, it's a master padlock.
[22:25.270 --> 22:31.070]  The nice thing about it is that it's a cutaway model.
[22:31.070 --> 22:34.150]  So you can actually see what I'm doing.
[22:34.670 --> 22:42.930]  And what I'm doing is I will use this shim to go into the combination.
[22:43.650 --> 22:46.370]  So, I'm not sure if you can see it.
[22:52.050 --> 22:54.650]  And I'll just insert it deep into the lock.
[22:55.770 --> 22:57.130]  Then press the shackle.
[22:59.250 --> 23:00.050]  Lift the shim.
[23:00.250 --> 23:01.490]  I don't know if you can see it lift.
[23:01.710 --> 23:02.210]  Can you see that?
[23:04.130 --> 23:07.810]  Can you see when the lock opens?
[23:23.620 --> 23:27.840]  The problem is everybody thinks this is a secure padlock as many others.
[23:28.460 --> 23:30.120]  And in reality, they aren't.
[23:36.190 --> 23:36.710]  Okay.
[23:37.770 --> 23:39.590]  And here's his little brother.
[23:40.650 --> 23:42.290]  Oh, somebody's phoning me.
[23:42.550 --> 23:43.470]  It's a wonderful timing.
[23:47.290 --> 23:48.110]  Sorry about that.
[23:50.980 --> 23:52.420]  Yeah, that's the way to do it.
[23:58.940 --> 23:59.380]  Okay.
[23:59.500 --> 24:01.660]  Here's his little brother.
[24:01.900 --> 24:06.420]  And I found that it's actually a little bit more tight to enter the tool.
[24:06.640 --> 24:08.400]  So, I really hope it works.
[24:09.120 --> 24:10.100]  Can you zoom in a little?
[24:14.510 --> 24:15.110]  Go ahead.
[24:18.990 --> 24:19.410]  Yeah.
[24:20.350 --> 24:20.730]  Yeah.
[24:21.310 --> 24:22.410]  Let me first try it.
[24:22.490 --> 24:22.710]  Hold on.
[24:22.930 --> 24:23.510]  I'm not going to see it.
[24:36.510 --> 24:36.950]  Okay.
[24:37.110 --> 24:37.310]  It's over.
[24:43.610 --> 24:47.070]  The problem is these are $20, $30, $35 locks.
[24:47.270 --> 24:49.310]  And they're represented as secure by the manufacturers.
[24:49.390 --> 24:50.790]  And in a lot of cases, they are not.
[24:50.930 --> 24:51.770]  And you need to know that.
[24:52.230 --> 24:52.670]  Sure.
[24:52.990 --> 24:57.990]  The thing is, everybody thinks this is a secure lock because it's got a fortified shackle.
[24:58.550 --> 25:02.950]  You know, if you start clubbing it with a hammer, it probably will last quite long.
[25:03.610 --> 25:06.730]  But not if you have this thin shim wire thingy.
[25:24.150 --> 25:27.970]  Now, there's other ways to bypass security.
[25:28.310 --> 25:34.810]  And what I'm going to show you now is something that is actually from the gray area of NDE teams.
[25:34.990 --> 25:42.050]  That means non-destructive entry teams that the police and intelligence agencies, they have these special teams that, you know, you can only dream of entering.
[25:43.530 --> 25:48.630]  And what they do is, you know, they open doors for people who place bugs or look for evidence or whatever.
[25:50.210 --> 26:02.510]  And what low-skilled NDE teams will do is that they will just rip the lock out of your door, which is not really non-destructive entry, using the court screw method.
[26:02.770 --> 26:12.230]  There's a vulnerability in European locks that, with a special way, you can easily rip it out, just like you unscrew a bottle of wine.
[26:12.390 --> 26:18.950]  You know, you drill a screw into the lock and then you place force with a special tool and then the complete lock comes out.
[26:20.530 --> 26:22.130]  But then, you know, the lock is destroyed.
[26:22.350 --> 26:25.410]  I mean, they can enter, but the lock is destroyed, so people are going to see it.
[26:25.630 --> 26:39.290]  And what they will do is, if the pins in the lock are still intact, if they're not broken, they will put the pins from your original lock into a new lock that they brought, that is the same brand and model, and they'll replace it for you.
[26:39.310 --> 26:40.890]  So you'll get your free lock, you know.
[26:42.770 --> 26:52.090]  On the other hand, sometimes these pins are destroyed, or there just is no time for them to actually exchange these pins.
[26:52.350 --> 26:56.490]  So they'll throw you in a so-called, it's translated from Dutch, zero lock.
[26:56.710 --> 27:01.730]  And a zero lock is a lock with much more than one or two pins on top of each other.
[27:01.930 --> 27:05.830]  That locks with 11 or 12 pins on top of each other.
[27:06.070 --> 27:07.350]  Very thin waivers.
[27:07.350 --> 27:12.050]  And that creates much more combinations that the lock will open with.
[27:12.190 --> 27:14.150]  As a matter of fact, it will open with any key.
[27:14.350 --> 27:17.430]  Because there's so many breakpoints in this lock.
[27:18.690 --> 27:21.350]  This is actually a video of one of these zero locks.
[27:21.710 --> 27:22.710]  Let me show you.
[27:27.840 --> 27:32.280]  Okay, as you can see, there's two parts remaining in the core.
[27:32.760 --> 27:34.480]  Two, one, three.
[27:34.780 --> 27:37.360]  What I'll now do is, I will insert another key.
[27:37.360 --> 27:39.320]  I'm sorry about this being so dark.
[27:40.020 --> 27:43.050]  But here are all the disks, all the stacks.
[27:44.090 --> 27:46.960]  And you see three, one, one, two, zero.
[27:47.400 --> 27:51.920]  Is what, you know, is the combination extra of this key.
[27:52.420 --> 27:57.400]  And I will do one other key that will have yet another combination.
[27:57.400 --> 28:03.440]  And this lock will actually open with any key that fits the lock.
[28:03.920 --> 28:07.300]  And, you know, it's also a way of bypassing security.
[28:07.590 --> 28:11.960]  It's taking advantage of, you know, how locks are made.
[28:12.180 --> 28:14.340]  And we only care if our key fits.
[28:14.420 --> 28:16.740]  And we think if our key fits, that's the only thing that fits.
[28:18.880 --> 28:21.360]  Will you work with a screwdriver, no key at all?
[28:21.460 --> 28:21.700]  Oh, yeah.
[28:21.920 --> 28:23.740]  It will work with a screwdriver, no key at all.
[28:24.740 --> 28:28.200]  As long as you lift the lower pins.
[28:28.520 --> 28:31.000]  You know, it won't work at this time.
[28:31.520 --> 28:35.110]  The pins need to be at least pushed down a little bit.
[28:35.820 --> 28:36.820]  But, yeah.
[28:41.420 --> 28:43.720]  Then there's impressioning.
[28:44.020 --> 28:50.060]  And impressioning is really one of the things that I really like about opening techniques.
[28:50.580 --> 28:53.860]  Impressioning is where you put tension on the lock.
[28:54.280 --> 28:56.900]  And by doing that, the pins bind.
[28:57.100 --> 29:04.320]  And then you have these binding pins either scratch, make a dent into metal, into your key.
[29:04.580 --> 29:06.840]  Or push a pin down.
[29:06.840 --> 29:09.740]  And this is actually what I'm going to do.
[29:10.680 --> 29:14.020]  As a matter of fact, impressioning can also be done with very simple tools.
[29:14.560 --> 29:16.280]  Like a roll of toilet paper.
[29:16.700 --> 29:19.800]  And some people already know about, you know, where this is heading to.
[29:20.000 --> 29:20.740]  Others will not.
[29:22.100 --> 29:26.080]  So, we'll go back to the document camera and I'll show you something.
[29:44.750 --> 29:46.830]  Okay, this is a tubular pick.
[29:47.550 --> 29:51.170]  And it's used for picking so-called tubular locks.
[29:54.680 --> 29:58.780]  And what we have here is a nice piece of art.
[29:58.980 --> 30:01.440]  It's a plastic tubular lock.
[30:01.540 --> 30:02.400]  I hope you can see it.
[30:10.060 --> 30:11.020]  Hmm, okay.
[30:11.220 --> 30:13.500]  This doesn't come out as nice as I had hoped.
[30:14.960 --> 30:16.440]  Maybe we can zoom in more, Mark?
[30:22.710 --> 30:23.090]  Okay.
[30:23.090 --> 30:24.450]  This is a real quality camera.
[30:28.080 --> 30:28.460]  No.
[30:33.700 --> 30:34.840]  It's not going to do it.
[30:36.400 --> 30:36.780]  No.
[30:37.020 --> 30:37.320]  No.
[30:37.560 --> 30:38.420]  It's not going to do it.
[30:39.380 --> 30:41.600]  I think they had a problem with their regular camera.
[30:42.360 --> 30:42.800]  Okay.
[30:45.980 --> 30:50.520]  Well, these tubular locks, I think you've all seen them before.
[30:51.440 --> 30:52.680]  Could we move up a little then?
[30:52.880 --> 30:54.200]  Because then it is in focus, at least.
[31:00.620 --> 31:01.060]  Okay.
[31:03.800 --> 31:05.260]  Yes, these are tubular locks.
[31:05.260 --> 31:11.980]  They are very popular with bikes, laptop security locks, all sorts of locks.
[31:12.120 --> 31:12.920]  I think we all know them.
[31:13.440 --> 31:18.380]  And the nice thing about impressioning tools like this is that they will self-impression.
[31:18.840 --> 31:28.740]  And what actually will happen is that these black wires you see here are going to be pushed out by pins that are binding.
[31:29.540 --> 31:34.580]  And if I just wiggle it time and time again, here, it already goes.
[31:34.920 --> 31:36.740]  I don't know if you can see it, but it's already picked.
[31:37.620 --> 31:39.980]  It really can go really quick.
[31:40.980 --> 31:45.700]  This is by itself, you know, quite a high-tech lock.
[31:45.940 --> 31:57.260]  And if you can see here, I don't know if you can see it on the camera, but the pins actually push back these black pieces of metal because they are bound.
[31:57.260 --> 32:02.300]  And when that happens, you know, the lock creates the key for you.
[32:02.460 --> 32:04.320]  And it's really a very nice technique.
[32:06.000 --> 32:06.460]  Okay.
[32:10.640 --> 32:14.500]  Do you want me to show you the one with the toilet paper roll, or...?
[32:14.500 --> 32:15.000]  Yes!
[32:15.840 --> 32:16.400]  Are you sure?
[32:16.780 --> 32:17.340]  Yes!
[32:17.980 --> 32:18.280]  Okay.
[32:47.650 --> 32:53.750]  Now, Mark issued a security alert on these Kensington laptop locks.
[32:53.750 --> 32:58.430]  He was on security.org, his secure security website.
[33:01.090 --> 33:03.590]  And I visited a conference.
[33:03.870 --> 33:12.610]  And at this conference, some people asked me, you know, can you show us how to open these Kensington locks with the so-called pen trick?
[33:12.930 --> 33:18.930]  So instead of this impressioning tool I showed you, you could use a specific pen by the big brand.
[33:19.870 --> 33:24.170]  But, you know, these pens were not available in Europe where this conference was.
[33:24.430 --> 33:39.050]  So I really tried hard finding material that would be hard enough to push the pins in, but be soft enough to have dents made in them.
[33:39.050 --> 33:41.030]  And I tried everything.
[33:41.250 --> 33:48.110]  I tried cards from the hotel, business cards.
[33:48.470 --> 33:49.450]  I tried a lot of things.
[33:49.710 --> 33:54.690]  And I was really, you know, at one moment thinking, okay, what material should I use?
[33:54.690 --> 34:00.970]  And then I was at one place, and I'm not going to tell you where it was, and I saw this roll of toilet paper.
[34:03.170 --> 34:05.750]  And as you can see, the lock is open now.
[34:06.110 --> 34:08.450]  I don't know if you can see that.
[34:08.450 --> 34:16.110]  And if you insert the toilet paper roll I made, like this, and wiggle it.
[34:18.350 --> 34:19.490]  Now bear with me.
[34:27.050 --> 34:28.910]  This is called the demonstration effect.
[34:29.670 --> 34:30.670]  Okay, there it goes.
[34:30.790 --> 34:31.710]  Now it's locked.
[34:32.230 --> 34:32.990]  You see it?
[34:37.140 --> 34:38.460]  It only worked once.
[34:40.720 --> 34:41.840]  Well, at least it worked.
[34:48.490 --> 34:51.270]  Well, at least I made my point and the thing worked.
[34:58.020 --> 34:59.920]  A couple of comments are in order.
[35:00.180 --> 35:04.000]  This is an old model of this lock.
[35:04.360 --> 35:07.740]  We did release a security alert two years ago, August.
[35:08.960 --> 35:19.240]  As a result of that, a couple of the leading manufacturers have drastically increased the security on their laptop locks.
[35:19.400 --> 35:21.060]  They took this very seriously.
[35:21.420 --> 35:23.380]  We obviously got a lot of feedback.
[35:23.380 --> 35:25.160]  I've provided feedback to them.
[35:25.860 --> 35:30.240]  The new revision... I don't think you're going to do this.
[35:31.220 --> 35:35.100]  Everybody's figured out that it's not the computer you're stealing it or protecting.
[35:35.420 --> 35:36.900]  It's the data within it.
[35:37.040 --> 35:40.600]  The hardware is irrelevant compared to the information.
[35:42.060 --> 35:54.340]  I have brought with me for the village some of the new Kensington tubular locks that you'll find incredibly more secure.
[35:54.340 --> 35:59.100]  This is not to say that they can't ultimately be opened either.
[35:59.280 --> 36:00.900]  They're not a high security lock.
[36:01.060 --> 36:03.560]  But they are designed to act as a deterrent.
[36:03.720 --> 36:09.200]  And I'm assured now, from first-hand knowledge, they will do that.
[36:09.200 --> 36:15.460]  That both Kensington and PC Guardian have paid attention to all you and all the IT people that raised hell with them.
[36:16.000 --> 36:20.220]  And so you'll find much greater security and peace of mind now for your laptops.
[36:20.660 --> 36:22.360]  As I said, this is an old design.
[36:22.540 --> 36:24.280]  The new designs are drastically different.
[36:25.200 --> 36:27.140]  Barry, do you want your computer back?
[36:27.140 --> 36:27.280]  Yes.
[36:27.460 --> 36:27.760]  Okay.
[36:29.520 --> 36:30.040]  Okay.
[36:34.120 --> 36:34.640]  Yes.
[36:34.800 --> 36:36.720]  And then there's a thing called decoding.
[36:37.080 --> 36:39.780]  And decoding is also an interesting technique.
[36:40.000 --> 36:43.340]  Because with decoding, you don't open the lock with the tool.
[36:44.180 --> 36:48.000]  Decoding will just, you know, reveal the combination of the lock to you.
[36:48.420 --> 36:50.380]  And then you can make a key afterward.
[36:50.940 --> 36:54.500]  This has been used in lots of fields.
[36:54.500 --> 36:58.260]  And, of course, the non-destructive entry teams use it a lot.
[36:58.340 --> 37:01.480]  Because they only need assistance once.
[37:01.660 --> 37:02.340]  And then they have a key.
[37:02.540 --> 37:05.780]  And they can give it to the people in the field to do their job.
[37:07.780 --> 37:12.540]  One of the decoders that I brought is actually a very nice piece of equipment.
[37:12.980 --> 37:15.200]  It's a BMW two-track decoder.
[37:15.900 --> 37:18.280]  It's used for BMW.
[37:18.280 --> 37:25.280]  But there's also, you know, these tools are also available for Mercedes, for many different types of locks.
[37:25.640 --> 37:29.940]  And they actually exploit another weakness in these systems.
[37:30.120 --> 37:33.340]  And that is that these locks don't have pins.
[37:33.540 --> 37:34.360]  They have wafers.
[37:34.580 --> 37:37.740]  So it's made out of one piece of metal.
[37:38.120 --> 37:39.760]  And the metal has a hole in it.
[37:39.760 --> 37:41.360]  And I'll come back to that to the next sheet.
[37:42.580 --> 37:46.540]  You can measure the depths by pushing up the wafers as high as you can.
[37:47.100 --> 37:48.080]  This is the flaw.
[37:48.340 --> 37:49.300]  And I'll show you.
[37:50.020 --> 37:53.320]  Also, another thing is that these wafers, they don't have close tolerances.
[37:53.360 --> 37:59.400]  Meaning that if you could stick something in that's approximately the key, that would be good enough.
[37:59.400 --> 38:06.120]  This container also, this set also contains make-up keys.
[38:07.040 --> 38:10.700]  So after you decode it, you can make your own key.
[38:12.440 --> 38:15.780]  This decoder works perfectly on models till 2004.
[38:16.220 --> 38:19.560]  Newer models, they made a small change that make it a little bit more difficult.
[38:19.840 --> 38:21.420]  But I've been told that it still can be done.
[38:21.420 --> 38:22.600]  It just takes a little bit longer.
[38:24.060 --> 38:26.980]  Now, this is what a wafer lock looks like.
[38:27.220 --> 38:29.420]  And I will get a laser pointer.
[38:29.620 --> 38:29.740]  Hold on.
[38:46.790 --> 38:47.350]  Okay.
[38:48.080 --> 38:50.660]  Yeah, this is what a wafer lock looks like.
[38:50.700 --> 39:00.020]  As you can see, in the zero position, if there's no key in, the little knob will just stick out of the core.
[39:00.410 --> 39:02.220]  And it will prevent it from turning.
[39:02.740 --> 39:06.810]  In real life, there's the same notch you see here.
[39:06.960 --> 39:08.120]  It's also on the upper side.
[39:08.260 --> 39:10.460]  So I don't know why Debian didn't draw that.
[39:10.910 --> 39:13.220]  But I think he should have.
[39:14.700 --> 39:15.240]  What's that?
[39:15.700 --> 39:16.680]  I have another slide.
[39:17.350 --> 39:18.160]  Ah, okay.
[39:18.450 --> 39:21.370]  Well, this is version 0.9, I heard.
[39:22.640 --> 39:27.890]  Anyway, there is, with this BMW lock, there is actually four combinations.
[39:27.890 --> 39:32.830]  So the wafer can either be a wafer one, two, three, or four.
[39:33.000 --> 39:40.310]  And the only difference is that the distance between the gap and the top is different.
[39:40.640 --> 39:42.180]  So they're all identical.
[39:42.500 --> 39:46.460]  But this distance, you know, the four has got a very small notch.
[39:46.600 --> 39:48.260]  The one has got the biggest notch.
[39:48.910 --> 39:54.290]  And that's actually the only thing that's different of these four levers.
[39:54.660 --> 39:56.140]  Four different levers in the lock.
[39:56.600 --> 39:58.080]  There's eight of these levers in the lock.
[39:58.540 --> 40:01.240]  And, as I said, the tolerances are sloppy.
[40:02.200 --> 40:02.810]  Let's see.
[40:03.560 --> 40:05.350]  This is the decoder tool.
[40:05.870 --> 40:08.430]  And it's a really nice, high-quality tool.
[40:08.930 --> 40:12.200]  It's made in Germany by a company called Zfix.
[40:13.080 --> 40:16.640]  They also sell, you know, lots of great and interesting tools.
[40:17.450 --> 40:21.350]  And what you see on the side are the so-called make-up keys or set-up keys.
[40:21.660 --> 40:31.060]  And the weakness of this lock is also that if you have a set-up key, and, for instance, the combination should be one, two, three, four.
[40:31.200 --> 40:34.450]  You know, there's a lock that contains every wave of one, two, three, and four.
[40:35.560 --> 40:42.980]  If you use the set-up key, you should only have to use the set-up key with the difference between one and two.
[40:43.410 --> 40:44.600]  So we call that one.
[40:44.830 --> 40:47.520]  And the difference between three and four, we call that two.
[40:47.790 --> 40:51.890]  So they converted it to half-step keys.
[40:51.890 --> 41:00.680]  So a one-and-a-half, one-and-a-half, two-and-a-half, two-and-a-half, will also open, or three-and-a-half, three-and-a-half, will also open this lock.
[41:01.830 --> 41:02.180]  So...
[41:02.880 --> 41:05.390]  And I'll show you...
[41:05.390 --> 41:05.740]  Let's see.
[41:06.350 --> 41:06.600]  Yes.
[41:07.960 --> 41:13.660]  If you want, I can show you the tool on the crappy display, if people find that interesting.
[41:14.100 --> 41:14.520]  What's that?
[41:14.580 --> 41:15.480]  I don't know if I'll see it.
[41:15.930 --> 41:16.700]  Yeah, let's see.
[41:28.460 --> 41:29.480]  Can you see it?
[41:29.820 --> 41:30.060]  Yeah.
[41:36.280 --> 41:37.980]  Now here's the tool.
[41:40.560 --> 41:42.800]  And it's got a little needle.
[41:43.280 --> 41:46.000]  And I don't know if you can see that sticks out.
[41:47.840 --> 41:48.440]  Here.
[41:56.640 --> 41:57.820]  You see it come up?
[41:58.480 --> 41:59.040]  Yeah.
[42:01.080 --> 42:02.120]  Can you laser point it?
[42:03.000 --> 42:03.360]  Yeah.
[42:07.910 --> 42:13.950]  Actually, if you look there, you'll see something move.
[42:16.230 --> 42:18.750]  And this is what lifts the levers.
[42:19.130 --> 42:25.230]  And you can adjust it with this slider to set which lever you want to decode.
[42:25.670 --> 42:27.890]  And then if you insert it into the lock,
[42:38.000 --> 42:43.260]  like this, we're now decoding lever number six.
[42:43.900 --> 42:55.890]  And if you turn it and you feel, you know, that can go beyond two, then, you know, you just decoded your lever that it's...
[42:55.890 --> 43:04.910]  And then later you can use the setup key to actually make a key that fits the lock.
[43:05.410 --> 43:06.830]  But, you know, I'm going to spare you that.
[43:07.050 --> 43:12.750]  It's just to show you what's available on the market for really high-tech tools.
[43:12.970 --> 43:14.990]  And as I said, there's a tool for every lock.
[43:14.990 --> 43:20.270]  And, yeah, this really is, you know, very high-quality.
[43:31.220 --> 43:31.820]  Okay.
[43:40.000 --> 43:40.600]  Lights.
[43:41.240 --> 43:41.600]  You ready?
[43:44.810 --> 43:47.370]  Now, these lever locks can also be picked.
[43:47.370 --> 43:52.710]  And, yeah, I just saw a great pick from somebody in Korea who designed this.
[43:52.910 --> 44:01.410]  And what he actually did was he take an existing key, mill out everything there is except the edges remain.
[44:01.670 --> 44:05.630]  And he drilled little holes exactly on the position of the levers.
[44:05.890 --> 44:09.050]  And with this tool, you can actually lift the levers one by one.
[44:09.230 --> 44:11.310]  And you can relatively easy pick it.
[44:11.650 --> 44:13.110]  And it's really a neat design.
[44:13.230 --> 44:15.290]  And I haven't seen anything like this before.
[44:15.290 --> 44:17.570]  And I really wanted to share it with you.
[44:17.690 --> 44:21.310]  And I assume that there's lots of people who really value this idea.
[44:22.770 --> 44:25.830]  And, yeah, his website is also listed.
[44:26.050 --> 44:31.370]  So, now, something real special is the full pin decoder.
[44:32.050 --> 44:36.470]  It was exclusive design for special intelligence operations for a long time.
[44:36.730 --> 44:39.850]  It's been released for locksmiths for a very short time.
[44:40.550 --> 44:43.910]  This is where I, you know, managed to collect it.
[44:43.910 --> 44:50.350]  And what it does is it slips an extremely thin wire between the pin and the housing of the core.
[44:50.570 --> 44:52.190]  So, there always has to be some play.
[44:52.490 --> 44:56.350]  And what this thing does is...
[44:56.350 --> 44:57.270]  Here's the tool.
[44:57.830 --> 45:00.190]  And there's an extremely thin wire.
[45:00.990 --> 45:02.930]  And the thin wire comes out.
[45:02.990 --> 45:03.770]  I hope you can see it.
[45:03.770 --> 45:08.970]  And that wire is so thin that it will slide between the house and the pins.
[45:09.270 --> 45:13.130]  And there's an angle on the tip of this wire.
[45:13.310 --> 45:21.290]  So, as soon as this wire reaches the point where these two pins are on top of each other, it wants to creep in this small crack.
[45:21.430 --> 45:22.430]  And you will feel it.
[45:22.430 --> 45:26.810]  So, you know, you can feel how much wire you need to insert into the lock.
[45:27.150 --> 45:32.610]  And if it's 5.6 millimeters, then you know that the pin is a pin 6, for instance.
[45:33.310 --> 45:39.630]  And if the wire is less or more, you know, you can identify the length of the pins with this piece of wire.
[45:39.630 --> 45:44.390]  And this actually is one of the most clever tools that I've seen in a long time.
[45:45.210 --> 45:48.690]  And, yeah, I'm happy that I have it in my collection.
[45:52.450 --> 45:53.670]  So, let's see.
[45:53.830 --> 45:54.610]  What more do we got?
[45:55.950 --> 45:58.790]  Yes, there's the snapper tool and the pick gun.
[45:59.810 --> 46:02.510]  I think people have seen this already before.
[46:04.390 --> 46:07.670]  Works with the transfer of impact energy.
[46:09.230 --> 46:13.570]  You all know Newton's Cradle, I think, the
[46:17.440 --> 46:18.320]  device here.
[46:18.580 --> 46:23.100]  If you take the first ball and you let it drop, then only the last ball will go.
[46:23.520 --> 46:26.420]  And it's the same here with these two pull balls.
[46:27.800 --> 46:34.060]  If you take the white one and you shoot it as fast as you can onto these two, only the last one will go.
[46:34.360 --> 46:38.500]  And this is exactly how the snapper gun works, or the pick gun.
[46:41.260 --> 46:43.880]  The needle will be inserted into the lock.
[46:44.060 --> 46:47.360]  It will strike an impulse energy pulse.
[46:47.820 --> 46:50.300]  And it will bounce up only the top pins.
[46:50.520 --> 46:55.600]  And there's a very quick moment where the shear line is open and free.
[46:55.900 --> 46:58.040]  And the core can actually rotate.
[46:58.360 --> 46:59.960]  And, you know, that's the end of the story.
[46:59.960 --> 47:03.580]  And it's a very effective method of opening.
[47:05.260 --> 47:14.420]  What they did try to prevent is, you know, making keyways more narrow that the key won't go in.
[47:14.560 --> 47:17.720]  Or the needle of the snapper pick can't go in.
[47:18.920 --> 47:20.460]  And then we come to bumping.
[47:20.940 --> 47:25.840]  And bumping is actually what kept me busy for the last two years.
[47:26.100 --> 47:32.900]  And also what made us known in the lock industry and in the security industry also.
[47:34.080 --> 47:38.580]  I first learned about bumping in Germany at the German sport group.
[47:38.840 --> 47:43.600]  Where they had some gentleman by the name of Klaus Noch who demonstrated this.
[47:44.360 --> 47:45.680]  And it really blew my mind.
[47:46.040 --> 47:51.980]  It exploits a vulnerability in pin tumbler locks that, you know, is relevant to almost any pin tumbler lock in the world.
[47:52.440 --> 47:55.760]  With this technique, you can open the lock without damaging it.
[47:55.880 --> 47:59.200]  In very little time, with little training, inexpensive tools.
[47:59.200 --> 48:01.800]  And I brought some bump keys and locks.
[48:01.960 --> 48:03.840]  And you can try it yourself in the lockpick village.
[48:04.320 --> 48:05.660]  And I'm sure that you will like it.
[48:07.240 --> 48:11.460]  We tested a hundred of locks to see if they were vulnerable for this technique.
[48:12.260 --> 48:17.000]  And it all started with a white paper that Rop Gonggrijp and myself wrote.
[48:18.320 --> 48:20.900]  We've been on national television in the Netherlands with it.
[48:21.640 --> 48:24.120]  If you have time, you really should want to see that episode.
[48:24.340 --> 48:24.920]  It's amusing.
[48:26.100 --> 48:33.740]  There are some videos on the WAG server that, you know, explain more on the technical details of bumping.
[48:34.540 --> 48:37.720]  And we just did a test for the Dutch Consumer Reports.
[48:38.000 --> 48:44.060]  Testing about almost any security lock in the industry against bumping.
[48:44.140 --> 48:49.240]  To see if it really is as threatening as we think it is.
[48:50.500 --> 48:53.500]  We also seem to have a Russian fan club by now.
[48:55.040 --> 48:55.920]  Locks.ru.
[48:56.240 --> 48:58.400]  And I don't know what mafia guys are behind it.
[48:58.500 --> 48:59.700]  But, you know, they scared the hell out of me.
[49:00.740 --> 49:01.960]  But it's really scary.
[49:02.280 --> 49:10.580]  Whatever I do, you know, if I publish something on this locks.ru, everything I do is being translated to German within hours.
[49:11.380 --> 49:13.240]  Added by comment that I don't understand.
[49:13.800 --> 49:15.700]  And I don't know what these people are up to.
[49:15.700 --> 49:17.120]  But it's scary.
[49:18.540 --> 49:21.680]  And then there's security.org by Mark Tobias.
[49:21.780 --> 49:22.660]  It's a little less scary.
[49:23.500 --> 49:24.340]  But it's good.
[49:24.620 --> 49:28.620]  It's got high-quality articles on the U.S. story on bumping.
[49:29.020 --> 49:31.120]  But enough about bumping.
[49:31.200 --> 49:32.560]  Let's tell you what bumping is about.
[49:33.820 --> 49:40.060]  Now, if you want to bump open a lock, what you're going to need is a bump key.
[49:40.060 --> 49:43.160]  And a bump key is any key that will fit the lock.
[49:44.220 --> 49:48.220]  And you have to cut all the cuts in the lock as deep as you can.
[49:48.440 --> 49:50.760]  So, normally, there are ten steps in a lock.
[49:51.000 --> 49:54.060]  If there's a code zero, that means that no material...
[49:55.000 --> 49:57.240]  For instance, this could be a code zero.
[49:58.800 --> 50:01.620]  It means that there's no material taken...
[50:01.620 --> 50:02.420]  No?
[50:03.040 --> 50:03.580]  Hold on.
[50:05.120 --> 50:05.920]  I think...
[50:05.920 --> 50:06.020]  Yeah.
[50:06.180 --> 50:07.840]  This could be a code zero, for instance.
[50:08.120 --> 50:09.600]  No material is taken off.
[50:09.800 --> 50:13.260]  And then it goes down in steps from, you know, one, two, three, four.
[50:13.440 --> 50:16.160]  And then nine, for instance, is the deepest position.
[50:16.160 --> 50:19.760]  Now, what you do with bumping is you take a key or you take a blank.
[50:19.900 --> 50:20.300]  It doesn't matter.
[50:20.860 --> 50:23.800]  And you cut every cut there is to the deepest position.
[50:24.000 --> 50:25.060]  That's the first step.
[50:26.560 --> 50:31.420]  Then, you remove a small fraction of the shoulder of the key and the tip of the key.
[50:32.600 --> 50:34.660]  This is, you know, like a quarter of a millimeter.
[50:34.880 --> 50:39.720]  I don't know exactly what that translates to in inches or whatever.
[50:41.140 --> 50:49.660]  And then, step number three is, if you've taken off some of the tip and the shoulder, you insert the key into the lock and you push it with your thumb.
[50:50.140 --> 50:52.320]  And you feel if it comes back a little bit.
[50:52.440 --> 50:53.600]  So, there is springs here.
[50:53.900 --> 50:57.500]  And these springs will actually try to push the key back out again.
[50:59.700 --> 51:01.160]  Step four, the tomahawk.
[51:01.380 --> 51:07.500]  There was a gentleman in Germany, Kurt Schulke, who designed this impact energy tool.
[51:08.080 --> 51:10.400]  And it's nothing more than a small mallet.
[51:10.620 --> 51:15.180]  But he really thought about it for a long time before he finalized his thing.
[51:15.180 --> 51:19.660]  And this really is what you need to open locks with the bumping method.
[51:21.160 --> 51:25.260]  Although, as we speak, you know, bumping is gaining popularity.
[51:25.620 --> 51:28.260]  And there's other people making these hammers too.
[51:28.460 --> 51:32.400]  Because Kurt is 92 or 93 years old and he doesn't make a whole lot of these hammers.
[51:32.900 --> 51:37.560]  And the more conferences we do, the more demand there is for these hammers.
[51:37.560 --> 51:44.600]  So, there's actually a hammer made by Peterson in the U.S. that's got holes in it.
[51:44.760 --> 51:49.920]  And you can use lead weight or other stuff to make it more heavy.
[51:50.360 --> 51:56.220]  This is a hammer made from shoe sole by Jens Andrews from Germany.
[51:56.860 --> 52:00.980]  He's a locksmith and also does shoe repairs.
[52:01.240 --> 52:02.200]  And he made a hammer.
[52:03.780 --> 52:05.580]  No, but the hammer is really effective.
[52:05.800 --> 52:06.980]  And it's called the power hammer.
[52:07.260 --> 52:10.400]  And, you know, if you need a little more power, then you can take that hammer.
[52:11.600 --> 52:12.860]  And then you open the lock.
[52:13.080 --> 52:18.940]  As we've seen with the pick gun, you have this impact energy.
[52:19.220 --> 52:22.260]  Now, what you do with the 999 key is you insert it into the lock.
[52:22.520 --> 52:24.140]  You make sure it wiggles a little bit.
[52:24.320 --> 52:28.880]  You hit with a hammer or with a tomahawk at the head of the key.
[52:29.160 --> 52:32.920]  And what will happen is that the energy that goes into the lock needs to go somewhere.
[52:33.160 --> 52:35.720]  And the top pins will just move up.
[52:35.900 --> 52:36.700]  And that's it.
[52:36.800 --> 52:38.580]  At that moment, you can turn the lock.
[52:38.580 --> 52:40.300]  Now, there's a little timing issue.
[52:40.840 --> 52:46.620]  But once you master that, you know, with this technique, you can open any lock of that brand.
[52:46.780 --> 52:47.500]  Or almost, you know.
[52:47.580 --> 52:48.740]  You should always be a little bit careful.
[52:49.200 --> 52:52.440]  So, it doesn't matter if it has these spool pins or mushroom pins or whatever.
[52:52.980 --> 52:56.760]  You know, if it's a standard lock and you have a key that fits it.
[52:56.980 --> 52:58.160]  You cut the key down.
[52:58.300 --> 52:59.600]  You take off a little bit of the shoulder.
[52:59.780 --> 53:01.100]  And you hit it with the right equipment.
[53:01.300 --> 53:03.640]  And you turn it at the right exact moment.
[53:03.960 --> 53:04.900]  The lock will open.
[53:05.620 --> 53:05.860]  Ooh.
[53:06.620 --> 53:08.180]  There's thunder as the moment I say it.
[53:10.880 --> 53:15.240]  No, but this really, you know, has high impact on security.
[53:15.760 --> 53:18.340]  And Mark will tell you all about it.
[53:20.840 --> 53:22.440]  He will also tell you what we learned.
[53:22.460 --> 53:24.320]  Because I think we're running a little bit out of time.
[53:24.700 --> 53:28.620]  So, sometimes it can damage the lock a little bit.
[53:31.480 --> 53:35.800]  There's a glue gun shoulder that will prevent the lock from denting.
[53:36.220 --> 53:40.260]  So, I don't know if you can see it, but these are actually glue gun sticks.
[53:40.260 --> 53:48.340]  And if you cut them in half and you glue them, that will prevent the lock from denting.
[53:48.500 --> 53:56.980]  Especially if the shoulder that's here is completely removed and only the plastic of the glue gun shoulder is there.
[53:58.320 --> 54:02.360]  If you become friends with your locksmith, they can cut you 999 keys.
[54:02.620 --> 54:04.140]  That's what they are called, or bump keys.
[54:06.120 --> 54:10.680]  You can also, you know, take an existing key and just file it down yourself.
[54:10.680 --> 54:16.880]  You know, just put the key in a vice, go down, just estimate how deep you need to go.
[54:17.440 --> 54:23.180]  The problem that you think you would run into is that you get out of alignment a little bit to the left or to the right.
[54:23.760 --> 54:26.280]  That's not necessary because these keys self-align.
[54:26.680 --> 54:29.180]  The pins in the lock are really hard.
[54:29.520 --> 54:31.580]  The metal of the key is very soft.
[54:31.760 --> 54:39.740]  So, if you hit it a few times and you're not completely aligned, the pins will make an impression in the key.
[54:39.740 --> 54:41.720]  And the key will align itself.
[54:42.120 --> 54:46.160]  And, you know, it's relatively simple to do it.
[54:47.460 --> 54:50.500]  The industry tried to come up with some things.
[54:52.420 --> 54:53.280]  What do you think, Mike?
[54:53.380 --> 54:55.860]  Should I bump some locks on stage to show to people?
[54:55.980 --> 54:57.740]  Yeah, just do one or two and then I'll get into the...
[54:58.640 --> 55:03.080]  Yes, I'll just show you what bumping looks like in the real world on the document camera.
[55:24.400 --> 55:25.640]  How many locks do you need?
[55:26.020 --> 55:26.960]  I just want to...
[55:39.300 --> 55:42.360]  Okay, well, here's our first 999 key.
[55:42.740 --> 55:47.660]  It's from a lock that has a difficult keyway, as you might be able to see.
[55:49.060 --> 55:49.940]  It's a...
[55:49.940 --> 55:51.640]  Yeah, trust me when I say it's a keyway.
[55:51.760 --> 55:52.840]  Now, the zoom doesn't work.
[55:53.040 --> 55:53.940]  No, it doesn't work.
[55:55.500 --> 56:00.880]  But you can see by the key itself that there's many grooves on that key, making it very difficult.
[56:02.720 --> 56:04.320]  Now, I insert it into the lock.
[56:06.960 --> 56:09.220]  And I hope you can see that there still is some play.
[56:09.380 --> 56:10.420]  You know, if I push it in...
[56:11.920 --> 56:12.600]  Can you see that?
[56:13.600 --> 56:13.960]  Okay.
[56:15.240 --> 56:19.740]  Now, I take the tomahawk and I'm going to hit it and it's open.
[56:31.780 --> 56:39.080]  I think by now you understand what got the industry to, you know, note this tool.
[56:39.360 --> 56:44.480]  Because this actually applies to a very wide range of locks.
[56:44.480 --> 56:46.840]  I'm going to try one more.
[56:48.260 --> 56:53.100]  For instance, here's a dimple lock.
[56:53.260 --> 56:55.440]  It's got 15 pins.
[56:55.680 --> 56:58.220]  So it's got five pins from three different sides.
[57:00.500 --> 57:03.420]  And in theory, it should go just as easy, I hope.
[57:04.280 --> 57:04.500]  Let's see.
[57:07.740 --> 57:08.280]  Open.
[57:10.360 --> 57:13.880]  So, you know, this is a 15-pin dimple lock.
[57:14.540 --> 57:15.040]  And...
[57:22.020 --> 57:24.920]  Now, Mark is going to talk about other locks.
[57:26.780 --> 57:32.360]  Also locks with, you know, have multiple locking mechanisms.
[57:32.580 --> 57:37.360]  For instance, this lock has got five or six straight pins.
[57:37.540 --> 57:40.800]  But it's also got a very simple sidebar mechanism.
[57:41.120 --> 57:43.140]  By the way, this is a very old lock.
[57:43.240 --> 57:44.440]  It's not being produced anymore.
[57:44.820 --> 57:48.360]  The people upgraded the lock a long time ago.
[57:48.360 --> 57:55.960]  But it's a good example on, you know, why it is good that they actually upgraded this lock.
[57:56.200 --> 58:01.680]  Now, if you want to learn about bumping, you know, go down to the lock center, to the lockpick village.
[58:01.980 --> 58:06.520]  And I'll gladly, you know, let you bump your own locks and you can test it yourself.
[58:06.520 --> 58:11.080]  But this is, yeah, I think this is as far as my presentation goes now.
[58:12.280 --> 58:12.720]  And...
[58:25.610 --> 58:26.050]  Okay.
[58:26.390 --> 58:28.250]  Hopefully we'll not have computer problems.
[58:28.890 --> 58:30.610]  I'd like to make a few comments.
[58:33.030 --> 58:36.210]  First of all, I'm really here to talk to you.
[58:36.210 --> 58:41.950]  I'm, as I think the bio says, I'm a lawyer, but I also do a lot of security work around the world.
[58:42.150 --> 58:46.390]  And I deal with the covert methods of entry.
[58:46.930 --> 58:51.310]  I work with several manufacturers and government organizations.
[58:52.210 --> 58:53.970]  And I do a lot of training.
[58:54.110 --> 58:57.010]  And I deal with the legal aspects of all of this.
[58:57.350 --> 59:02.030]  And at the end of the day, this all looks good.
[59:02.130 --> 59:06.750]  I'm here to bring a little reality to this as far as what the real threat level is.
[59:07.390 --> 59:09.890]  You may wish to go to our website.
[59:10.310 --> 59:11.950]  And it's also...
[59:11.950 --> 59:15.170]  We have all of Barry's white papers on our website.
[59:15.170 --> 59:25.250]  But also, I decided when I was in Cologne in March to sit down and really analyze the threat level that bumping presents.
[59:26.790 --> 59:33.050]  This, as I'll point out, is affecting about 95% of the pin tumbler locks in the world.
[59:34.010 --> 59:37.370]  Some high security locks, but we'll talk about that.
[59:37.850 --> 59:39.870]  The industry is paying attention.
[59:40.110 --> 59:42.550]  This has not been a big issue in the United States yet.
[59:42.550 --> 59:43.850]  It will be, I think.
[59:44.410 --> 59:46.510]  And during my presentation...
[59:46.510 --> 59:48.830]  Here, you want to...
[59:50.680 --> 01:00:02.340]  During my presentation, I'll tell you why that this bumping problem affects millions of people in America directly as to their information security.
[01:00:04.920 --> 01:00:06.120]  The more...
[01:00:06.120 --> 01:00:09.280]  Larry talked... or Barry talked about sports lockpicking groups.
[01:00:09.420 --> 01:00:11.380]  They really haven't taken off in America yet.
[01:00:11.540 --> 01:00:15.440]  And I get interviewed in the media quite a bit and asked about this.
[01:00:16.520 --> 01:00:21.340]  My attitude is much different from most of the locksmith profession.
[01:00:22.260 --> 01:00:30.880]  And that is, I believe that the more diverse groups of people are looking at mechanical locks as well as software, the better.
[01:00:31.520 --> 01:00:34.720]  It can only help improve the products.
[01:00:35.220 --> 01:00:44.100]  The manufacturers that are making poor locks or easy to open locks, they should either be forced to fix them or the public should respond by not buying them.
[01:00:44.100 --> 01:00:49.040]  Everybody needs to understand, and that's really why I'm up here today.
[01:00:50.020 --> 01:01:10.120]  You folks, especially those of you that have IT responsibility, which is going over into the physical security area, you need to understand the risks so that you can make your own risk assessment and decision whether these locks offer or provide enough security for your environment.
[01:01:10.120 --> 01:01:12.280]  And that's really what all this is about.
[01:01:12.400 --> 01:01:16.420]  All these demonstrations are great, but you should carry away one thing.
[01:01:16.980 --> 01:01:21.720]  Most of these locks, the lower level locks, are really not secure.
[01:01:21.980 --> 01:01:25.440]  And so if you understand that, we'll have done our job today.
[01:01:25.760 --> 01:01:31.100]  So today, we're going to talk briefly about bumping technique, the background and theory.
[01:01:31.440 --> 01:01:33.940]  What is the threat to security?
[01:01:34.920 --> 01:01:37.200]  This is not an obscure issue.
[01:01:37.200 --> 01:01:40.280]  This is not a theoretical or a laboratory issue.
[01:01:40.460 --> 01:01:41.360]  It is real world.
[01:01:41.480 --> 01:01:43.260]  In Europe, it's attracted a lot of attention.
[01:01:43.280 --> 01:01:44.960]  I suspect it will in America.
[01:01:45.800 --> 01:01:46.740]  What's secure?
[01:01:46.760 --> 01:01:47.500]  What is not?
[01:01:47.680 --> 01:01:53.280]  The legal issues I'll address briefly and a real world case example that may surprise everyone.
[01:01:54.480 --> 01:01:58.060]  Bumping is what I term a new old threat.
[01:01:58.900 --> 01:02:01.980]  It's been known for at least 25 years.
[01:02:01.980 --> 01:02:05.400]  I learned bumping up in Denmark many years ago.
[01:02:05.880 --> 01:02:08.340]  A lot of the locksmiths up there used it.
[01:02:08.660 --> 01:02:12.380]  But they used it in a different procedure at first and it was called wrapping.
[01:02:12.760 --> 01:02:22.120]  And what that meant is the locksmith would take a lock on his workbench and slam it on the bench while putting a little bit of tension on the back of the plug and he'd open it.
[01:02:22.120 --> 01:02:33.840]  And so from that, the locksmiths in Denmark figured out that if they put a key in with all the cuts cut as low as they can be, which translated to a code 9.
[01:02:34.160 --> 01:02:42.780]  You have to understand every manufacturer assigns depth coding to each of the different pin lengths that are available that make up what your key looks like.
[01:02:42.780 --> 01:02:50.580]  So the deepest code on the primary lock in Denmark was a 9, hence the term 999 key.
[01:02:50.960 --> 01:02:58.240]  So this for 25 years in Denmark was known, but nobody really paid the attention to it, including myself.
[01:02:58.240 --> 01:03:02.940]  And in the first edition, second edition of my book, it had very short mention.
[01:03:03.100 --> 01:03:04.520]  It was detailed, but not a lot.
[01:03:04.780 --> 01:03:09.860]  Then came the folks in Germany and the Netherlands in about 2004.
[01:03:09.860 --> 01:03:12.720]  And all of a sudden this took off.
[01:03:12.860 --> 01:03:21.380]  I think first it was on television in Germany and then Barry Wells and TOOOL picked up on it and really started looking at this issue.
[01:03:21.620 --> 01:03:29.280]  What came out of that is a new serious threat based on about a 350-year-old law of physics.
[01:03:29.920 --> 01:03:33.280]  And as I said, it's not popular in the U.S., but it's getting there.
[01:03:33.280 --> 01:03:51.680]  The Netherlands test, as Barry said, the consumer reporting agency in the Netherlands, the most popular, decided finally last year to test about 70 different manufacturers and locks in the Netherlands to see how secure or how insecure they were.
[01:03:51.680 --> 01:03:55.100]  Well, and I looked at the tests they ran.
[01:03:55.300 --> 01:03:57.520]  They were valid and they were comprehensive.
[01:03:58.780 --> 01:04:00.720]  And they were very systematic.
[01:04:00.720 --> 01:04:02.200]  They weren't skewed.
[01:04:02.320 --> 01:04:02.980]  They weren't weighted.
[01:04:03.160 --> 01:04:04.800]  They bought locks that were off the shelf.
[01:04:04.860 --> 01:04:06.420]  They didn't get them from the manufacturers.
[01:04:06.600 --> 01:04:10.020]  So they were sure they were dealing with what the public was dealing with.
[01:04:10.020 --> 01:04:12.420]  In March, their report was released.
[01:04:12.680 --> 01:04:20.560]  And then subsequent to that, we released our white paper as far as detailing the real security threat from the legal and technical standpoint.
[01:04:21.260 --> 01:04:27.360]  The Netherlands tests really validated bumping as a security threat.
[01:04:27.360 --> 01:04:40.460]  And you all need to understand that this is in large measure due to the work that TOOOL, Barry Wells, Han Faye, and a number of others, folks that I've dealt with overseas, they really promoted this issue.
[01:04:40.560 --> 01:04:41.880]  They went to the manufacturers.
[01:04:42.160 --> 01:04:45.580]  A lot of the manufacturers really didn't get it.
[01:04:45.700 --> 01:04:46.720]  They didn't believe it.
[01:04:46.760 --> 01:04:47.940]  They didn't understand it.
[01:04:48.000 --> 01:04:49.220]  They didn't think it was a problem.
[01:04:49.240 --> 01:04:50.280]  They do now.
[01:04:51.760 --> 01:04:55.080]  Bumping poses a serious threat to security in the United States.
[01:04:55.080 --> 01:04:57.080]  It affects millions of locks.
[01:04:57.240 --> 01:05:03.160]  It affects critical infrastructure locks that are often protected by insecure locks.
[01:05:04.800 --> 01:05:22.460]  I would venture to say the handbook that Homeland Security just released with about 70,000 locations that they deem as prime targets, most of these are protected by inexpensive five or six pin tumbler locks that can be bumped open.
[01:05:22.660 --> 01:05:24.620]  This really needs to get fixed.
[01:05:25.660 --> 01:05:31.180]  Your primary privacy and communications because of bumping can be at risk.
[01:05:31.340 --> 01:05:32.720]  I'll go into that in a little while.
[01:05:33.480 --> 01:05:44.860]  And there are, for you IT people, as you know, there are federal laws regarding the protection of information and secure assets that can be violated if you don't have the right kind of locks.
[01:05:45.040 --> 01:05:49.980]  Specifically HIPAA and the Oxley-Sarbanes Act.
[01:05:50.760 --> 01:05:54.160]  Bumping critical issues that you need to take away with.
[01:05:54.300 --> 01:06:01.640]  95% of the locks in this country I think are vulnerable because we use pin tumbler locks predominantly in the United States.
[01:06:02.940 --> 01:06:08.980]  Everyone who relies on locks needs to understand so you can make your own security assessment.
[01:06:08.980 --> 01:06:14.180]  And there are legal issues of liability involved as well as obviously security issues.
[01:06:14.420 --> 01:06:16.160]  So why is bumping a threat?
[01:06:17.180 --> 01:06:19.940]  It's the simplest form of bypass.
[01:06:20.540 --> 01:06:24.720]  There are a number of methods of opening locks as Barry Wells addressed.
[01:06:24.720 --> 01:06:35.040]  The primary methods are picking, impressioning, decoding, master key extrapolation, which was delved into a couple years ago.
[01:06:35.320 --> 01:06:36.880]  And then there's bumping.
[01:06:37.000 --> 01:06:44.860]  And I just include bumping as another mode of bypass but it's more dangerous because of my 3T2R rule.
[01:06:44.860 --> 01:06:55.000]  And that is all locks and their security are assessed by the manufacturers and underwriters laboratory, VDS in Germany, all the rating organizations.
[01:06:55.320 --> 01:06:59.980]  They're really rated in terms of my 3T2R rule.
[01:07:00.100 --> 01:07:06.100]  And that is how much training time and what kind of tools are required to open the lock.
[01:07:06.120 --> 01:07:09.980]  And what's the repeatability and the reliability of the process.
[01:07:09.980 --> 01:07:17.420]  In the case of bumping, it meets all these criterias for most of the lower quality pin tumbler locks.
[01:07:17.600 --> 01:07:23.160]  And in fact, even some of the higher quality locks with prior intelligence can be opened.
[01:07:23.560 --> 01:07:27.400]  So there's two primary threat levels regarding bumping.
[01:07:27.940 --> 01:07:33.020]  One is if you have system intelligence and two, the availability of keys.
[01:07:33.240 --> 01:07:35.460]  Now let's talk about the availability of keys first.
[01:07:36.740 --> 01:07:44.780]  You want to make a bump key or, more importantly, you're worried about your facility being compromised because somebody's going to bump open the locks.
[01:07:45.020 --> 01:07:47.060]  How difficult is it to get a key?
[01:07:47.400 --> 01:07:48.360]  Not really.
[01:07:49.500 --> 01:07:53.600]  Even sometimes if it's a restricted key way, that makes it more difficult.
[01:07:53.920 --> 01:08:00.380]  But let's take a common lock like you buy at the hardware store, Quickset, Dexter, whatever.
[01:08:01.440 --> 01:08:04.560]  The problem is that these locks are sold everywhere.
[01:08:05.080 --> 01:08:15.220]  And if you can match the key way and buy locks at the hardware store from a jobber, from a locksmith, from Home Depot, you can turn any key into a bump key.
[01:08:15.520 --> 01:08:16.580]  That's the problem.
[01:08:16.780 --> 01:08:18.640]  And it's not difficult to do it.
[01:08:18.760 --> 01:08:22.940]  Barry didn't demonstrate up here today how to make bump keys.
[01:08:22.940 --> 01:08:32.300]  I just actually shot a very detailed video with Barry in Amsterdam that's on the next edition of Locks, Safes, and Security that we really went into this.
[01:08:32.400 --> 01:08:38.800]  But the bottom line is a few dollar file, the keys, and they can be modified to become a bump key.
[01:08:39.000 --> 01:08:41.040]  That becomes a serious threat.
[01:08:41.520 --> 01:08:44.900]  If you have the key, there's a real problem.
[01:08:44.900 --> 01:08:48.440]  And then we have system intelligence.
[01:08:48.680 --> 01:08:55.980]  System intelligence means do you know anything about the locks that you're going to open or are going to be opened ahead of time?
[01:08:56.220 --> 01:09:01.720]  This becomes very relevant when you're talking about some high-security locks.
[01:09:02.860 --> 01:09:13.360]  The locks that use sidebars such as Medeco, Primus, and ASSA, they all have predefined sidebar codes in the system.
[01:09:13.360 --> 01:09:22.380]  Some of these locks can be bumped open, even the higher-security locks, if you have the sidebar code.
[01:09:22.500 --> 01:09:24.520]  And I need you all to understand this.
[01:09:25.580 --> 01:09:30.480]  Medeco, it probably is the leader in the high-security lock field in America.
[01:09:30.680 --> 01:09:33.900]  They literally own about 80% of the market in this country.
[01:09:33.900 --> 01:09:36.060]  They're overseas, but America's their main market.
[01:09:36.240 --> 01:09:37.800]  They manufacture in Virginia.
[01:09:37.940 --> 01:09:39.320]  They are excellent locks.
[01:09:39.480 --> 01:09:42.880]  I'm sure most of you have heard of them or are familiar with them.
[01:09:42.880 --> 01:09:47.440]  These are the pins that lift and they rotate in order to open the lock.
[01:09:47.860 --> 01:09:57.440]  Well, some of these locks can be bumped open if you have the sidebar code or the angle cuts of the keys.
[01:09:57.660 --> 01:10:02.760]  If you do not have that prior intelligence, you will not bump open these locks.
[01:10:02.760 --> 01:10:07.660]  Now, ASSA, in some models, that's also true.
[01:10:08.340 --> 01:10:14.180]  Schlage Primus is probably the number two high-security lock vendor in the United States.
[01:10:14.400 --> 01:10:15.320]  They're a huge company.
[01:10:15.800 --> 01:10:22.800]  I have not been able to bump open the Primus because of the tolerances and the way it's manufactured.
[01:10:22.800 --> 01:10:28.820]  That doesn't mean someday they may not be bumped open, but presently we have not been able to open them.
[01:10:29.860 --> 01:10:32.160]  So, we have threat level one.
[01:10:32.320 --> 01:10:34.020]  We have no intelligence.
[01:10:34.340 --> 01:10:36.900]  We have no information about the lock.
[01:10:37.040 --> 01:10:38.500]  It's a standard pin tumbler lock.
[01:10:38.620 --> 01:10:39.500]  We walk up to it.
[01:10:39.640 --> 01:10:40.840]  We stick a key in.
[01:10:40.920 --> 01:10:41.960]  It's been cut to a bump key.
[01:10:42.100 --> 01:10:42.700]  We open it.
[01:10:42.980 --> 01:10:47.360]  With prior intelligence, you know something about the system and you may be able to get it open.
[01:10:48.320 --> 01:10:50.940]  Threat level two, producing bump keys.
[01:10:51.460 --> 01:10:53.300]  You can do it from blanks.
[01:10:53.360 --> 01:10:55.040]  You can do it from cut keys.
[01:10:55.320 --> 01:10:59.240]  Or, you can now buy pre-cut bump keys on the Internet.
[01:10:59.780 --> 01:11:06.380]  Now, my attitude about this as a lawyer and a security person, I perceive this as a real threat.
[01:11:07.660 --> 01:11:14.700]  For legitimate locksmiths, for researchers, for security analysts, for IT folks that are analyzing security, okay.
[01:11:14.700 --> 01:11:22.100]  But, the wholesale sale of bump keys that are pre-cut for specific key ways, that may become a serious problem.
[01:11:22.560 --> 01:11:25.280]  Covert methods of entry and security ratings.
[01:11:25.540 --> 01:11:31.360]  As I mentioned, we're talking about special tools, training, experience, and the time required.
[01:11:31.660 --> 01:11:36.340]  The easier that becomes, obviously, the higher the threat level.
[01:11:36.640 --> 01:11:39.700]  So, again, what is security in a lock?
[01:11:39.700 --> 01:11:44.980]  In a perfect world, no lock can be opened without the right key or code.
[01:11:45.620 --> 01:11:47.860]  Unfortunately, we don't have a perfect world.
[01:11:48.340 --> 01:11:52.820]  The reality, levels of difficulty or resistance to forced and covert entry techniques.
[01:11:53.460 --> 01:11:55.380]  It depends on the type of lock.
[01:11:55.640 --> 01:11:57.780]  It depends on secondary locking systems.
[01:11:57.960 --> 01:12:01.020]  And it depends on security enhancements, such as side bars.
[01:12:01.240 --> 01:12:02.540]  So, you need to pay attention.
[01:12:02.700 --> 01:12:05.300]  And let me tell you, you get what you pay for in locks.
[01:12:05.300 --> 01:12:11.380]  If you think you can protect assets for a $20, $30 lock, $15 lock, you're wrong.
[01:12:11.640 --> 01:12:13.900]  They can be opened and you need to understand that.
[01:12:14.360 --> 01:12:17.660]  So, as I said, bumping is a method of covert entry.
[01:12:18.160 --> 01:12:22.020]  I think this PowerPoint is going to be published online.
[01:12:22.020 --> 01:12:23.780]  And so, I'm not going to go into all of this.
[01:12:24.140 --> 01:12:26.540]  You folks can read it later that are interested in it.
[01:12:26.640 --> 01:12:30.680]  But, bumping is a very effective method of covert entry.
[01:12:30.680 --> 01:12:34.640]  And again, it was developed in Denmark about 25 years ago.
[01:12:35.280 --> 01:12:40.520]  But actually, it was developed about 350 years ago by Sir Isaac Newton.
[01:12:40.900 --> 01:12:46.580]  Who, through his third law of motion for every action, there's an equal and opposite reaction.
[01:12:46.960 --> 01:12:51.060]  Pin tumbler locks really had not been invented in 1650 or thereabouts.
[01:12:51.380 --> 01:12:54.040]  When Sir Isaac Newton came up with this theory.
[01:12:54.200 --> 01:12:56.300]  But that is what bumping is all about.
[01:12:56.300 --> 01:13:02.080]  When you apply energy to the bottom pin, the top pin moves.
[01:13:02.500 --> 01:13:09.900]  And if you time it right, the top pins and the bottom pins will split long enough for you to rotate the plug and open the lock.
[01:13:10.180 --> 01:13:12.300]  So, there's six critical elements.
[01:13:12.580 --> 01:13:14.400]  The key with the correct key way.
[01:13:14.860 --> 01:13:17.500]  All of the depths are cut to nines.
[01:13:17.780 --> 01:13:19.540]  You have a bumping technique.
[01:13:19.760 --> 01:13:24.800]  You have a method to apply energy to the pins or the tomahawk or Ken Pearson's tool.
[01:13:25.480 --> 01:13:27.340]  You have torque and timing.
[01:13:27.580 --> 01:13:32.480]  Which means you have to put torque on the plug and hit it or hit it and then put torque on the plug.
[01:13:32.600 --> 01:13:33.740]  It depends on the lock.
[01:13:34.240 --> 01:13:36.040]  And it's all about training.
[01:13:36.380 --> 01:13:40.940]  In the Netherlands experiments or tests that consumers reports did.
[01:13:41.220 --> 01:13:48.040]  They showed a video to the lay participants that opened the locks.
[01:13:48.580 --> 01:13:51.180]  The video was a short video off the Internet.
[01:13:51.520 --> 01:13:55.420]  In less than an hour and sometimes a lot less, they were opening locks.
[01:13:56.020 --> 01:13:57.760]  This is a problem.
[01:13:58.960 --> 01:13:59.100]  Okay.
[01:13:59.420 --> 01:14:00.260]  So, number one.
[01:14:00.380 --> 01:14:01.520]  Key with the correct key way.
[01:14:01.680 --> 01:14:04.460]  As I said, commercial stores, locksmiths.
[01:14:05.140 --> 01:14:07.140]  I would take issue with Barry.
[01:14:07.500 --> 01:14:18.880]  You're going to find very few, if any, locksmiths that will cut you a key by code to all nines unless they know you and you're a security person or have a need to know.
[01:14:18.880 --> 01:14:35.220]  There are guidelines for the Associated Locksmiths of America that would prohibit a locksmith, not only from knowingly cutting a bump key, but also from discussing this with you or showing you what the vulnerability is.
[01:14:35.760 --> 01:14:38.340]  I happen to disagree with some of this.
[01:14:38.480 --> 01:14:42.880]  I think that the end user, the consumer, should be making their own security decisions.
[01:14:43.120 --> 01:14:48.560]  I don't think the locksmiths ought to be in that position to be making your decisions for you.
[01:14:48.560 --> 01:14:53.600]  They ought to give you the information so you can make an intelligent and knowing decision.
[01:14:54.340 --> 01:14:54.600]  Okay.
[01:14:55.180 --> 01:14:59.940]  So, then we want to cut all the cuts to a number nine depth as shown in this key.
[01:15:00.620 --> 01:15:02.360]  These can be cut by hand.
[01:15:02.500 --> 01:15:03.920]  These can be cut by code.
[01:15:04.320 --> 01:15:07.140]  Or, again, they're being offered on the Internet now.
[01:15:07.960 --> 01:15:11.680]  These, as Barry showed you, these are little better graphics.
[01:15:12.380 --> 01:15:14.840]  These are different varieties of bump keys.
[01:15:14.980 --> 01:15:16.060]  They all open locks.
[01:15:16.060 --> 01:15:19.980]  We have a high security lock over on the left.
[01:15:20.220 --> 01:15:22.420]  We have a dimple lock right and bottom.
[01:15:23.180 --> 01:15:23.420]  Okay.
[01:15:23.680 --> 01:15:24.480]  Bumping technique.
[01:15:24.960 --> 01:15:26.880]  Two techniques for bumping.
[01:15:27.140 --> 01:15:31.080]  Either withdraw the old style that I learned up in Denmark.
[01:15:31.460 --> 01:15:38.980]  You would draw the key one cut and you put a little torque on it and you strike it and the lock will open.
[01:15:38.980 --> 01:15:49.440]  The new method that was developed in Europe by TOOOL and all the other folks, as Barry said, I call it and refer to it in my literature as the negative shoulder method.
[01:15:49.680 --> 01:15:59.000]  You trim about a quarter millimeter off the shoulder so the key can move forward slightly in the lock enough to apply energy to the sides of every pin.
[01:15:59.000 --> 01:16:06.000]  And my graphic, again, just like Barry's, this is the normal lock state.
[01:16:06.060 --> 01:16:09.300]  When energy is applied, the pins are split.
[01:16:11.200 --> 01:16:26.140]  And again, the theory of all this, this is one of my associates, Moshev Dolev in Israel, who was one of the co-founders, co-inventors of multi-lock, with very popular lock manufacturer in Europe, part of the ASSA Abloy group.
[01:16:26.140 --> 01:16:30.320]  He did a demonstration and he patented a pin that will prevent bumping.
[01:16:30.840 --> 01:16:36.280]  And basically, what this shows is how the pin splits up in the upper right-hand corner.
[01:16:36.960 --> 01:16:40.560]  And with his pin, they stay together so you can't open them.
[01:16:40.860 --> 01:16:49.100]  The method of applying energy to the key, the original Tomahawk and Ken Pearson's tool are both shown here.
[01:16:49.460 --> 01:16:50.860]  Pearson's is the blue one.
[01:16:51.800 --> 01:16:54.080]  They both work equally well.
[01:16:54.720 --> 01:16:57.080]  Frankly, a screwdriver head will work.
[01:16:57.220 --> 01:16:58.280]  That's the problem.
[01:16:58.920 --> 01:17:02.400]  You don't need a special tool to bump open locks.
[01:17:02.960 --> 01:17:10.060]  And again, torque and timing, so you apply energy to the key and you open the lock.
[01:17:10.640 --> 01:17:18.540]  I did a television interview almost two years ago on this with a reporter who knew absolutely nothing.
[01:17:18.540 --> 01:17:23.700]  I handed her a six pin lock, just a standard lock, handed her a bump tool and a key.
[01:17:23.700 --> 01:17:25.800]  She opened it in about five seconds.
[01:17:26.000 --> 01:17:29.060]  She had no clue how she did it, but she did it.
[01:17:29.340 --> 01:17:31.960]  And in my state, that got everybody's attention.
[01:17:32.160 --> 01:17:34.680]  And that is the essence of the security risk.
[01:17:35.140 --> 01:17:37.320]  Again, bumping, it's easy to learn.
[01:17:38.320 --> 01:17:40.920]  Training in less than an hour, it's very easy.
[01:17:40.920 --> 01:17:47.160]  I was just over at Cambridge, the director of the computer security lab, Ross Anderson, had never bumped a lock in his life.
[01:17:47.340 --> 01:17:52.720]  He wrote for all of you that are familiar with it, security engineering on the software side.
[01:17:52.720 --> 01:17:54.700]  He runs the lab at Cambridge.
[01:17:55.000 --> 01:17:56.500]  He had never opened a lock.
[01:17:56.500 --> 01:17:59.640]  I handed him the tool, opened it once for him, and he opened it.
[01:17:59.840 --> 01:18:00.820]  No problem.
[01:18:02.200 --> 01:18:05.720]  Bumping demonstration, Barry Wells did that, so we don't need to do that.
[01:18:06.800 --> 01:18:10.200]  Pin tumbler locks that cannot be bumped open.
[01:18:10.200 --> 01:18:19.140]  As I mentioned, some sidebar locks, some ASSA locks, the Schlage Primus, we believe.
[01:18:19.340 --> 01:18:20.240]  There are other locks.
[01:18:21.320 --> 01:18:25.280]  The EVA 3KS is an excellent example with sliders.
[01:18:25.460 --> 01:18:26.400]  It can't be opened.
[01:18:27.520 --> 01:18:32.580]  The Medeco, unless you have the sidebar code, you will not open it.
[01:18:32.660 --> 01:18:38.200]  And even with the sidebar code, I don't think it's a repeatable or reliable process.
[01:18:38.200 --> 01:18:41.860]  I get a lot of emails, just like Barry does from around the world.
[01:18:42.940 --> 01:18:45.440]  They're a prime lock to attack.
[01:18:46.300 --> 01:18:47.960]  Yes, some have been opened.
[01:18:48.100 --> 01:18:49.160]  I've opened some of them.
[01:18:49.300 --> 01:18:55.560]  But again, it's not, in my view, a repeatable or a reliable bypass technique with their cylinders.
[01:18:56.280 --> 01:18:59.200]  This is just to show you the differences.
[01:18:59.640 --> 01:19:04.900]  This is an ASSA, and basically it shows the side cuts on the pins.
[01:19:04.900 --> 01:19:12.720]  This is a second set of fingerprints, as you can see in the upper right-hand corner, that interlocks.
[01:19:12.840 --> 01:19:14.440]  So you have to engage both.
[01:19:15.120 --> 01:19:17.500]  This is the Schlage Primus.
[01:19:17.660 --> 01:19:29.420]  The difference between ASSA and Primus, although it's the same inventor, Bo Whedon in Sweden, the difference is significant for bumping, whether intended or not.
[01:19:29.740 --> 01:19:35.020]  These fingerprints on the Primus need to be both lifted and rotated.
[01:19:35.380 --> 01:19:39.860]  And so this presents a significant obstacle to bumping.
[01:19:39.960 --> 01:19:41.560]  And as I said, we haven't got them open yet.
[01:19:42.120 --> 01:19:42.580]  Maybe.
[01:19:43.160 --> 01:19:45.120]  My personal, Barry thinks yes.
[01:19:45.120 --> 01:19:46.100]  I think no.
[01:19:46.100 --> 01:19:49.700]  And I've probably done more work on Primus than he has.
[01:19:50.420 --> 01:19:52.340]  And so it's one of the more secure locks.
[01:19:52.820 --> 01:19:56.300]  The EVA 3KS out of Austria is an excellent lock.
[01:19:56.460 --> 01:20:00.500]  It's not available in the United States yet, but widely available in Europe.
[01:20:00.860 --> 01:20:04.060]  Because it's a slider design, it is bump proof.
[01:20:04.540 --> 01:20:05.820]  Guaranteed absolutely.
[01:20:06.400 --> 01:20:10.720]  It may be subject to other forms of bypass, but it's not going to be bumped open.
[01:20:11.400 --> 01:20:13.720]  Generic locks that cannot be bumped open.
[01:20:14.400 --> 01:20:17.920]  Warded, lever, wafer and disc, and combination locks.
[01:20:18.060 --> 01:20:25.560]  You're not going to bump them open because you don't have two pins in the pin stack to split using Newton's technique.
[01:20:26.000 --> 01:20:30.720]  There are complicating factors with regard to bumping.
[01:20:31.220 --> 01:20:39.360]  And I don't need to go into these, but there are several factors that may make bumping difficult, if not impossible.
[01:20:39.360 --> 01:20:45.720]  It really depends on the lock, the environmental conditions, the conditions of the pins, not so much the springs.
[01:20:46.740 --> 01:20:51.680]  There's a lot of factors, but at the end of the day, we're opening about 95% of the locks.
[01:20:51.840 --> 01:20:54.300]  So that should give everybody a cause for concern.
[01:20:54.680 --> 01:21:07.780]  If you folks have investigative responsibility and you have a mysterious disappearance, the problem with bumping is there's generally no external evidence of entry.
[01:21:08.940 --> 01:21:18.260]  It affects... if you're working a case where there are just plain old pin tumbler locks, you need to pay attention to the potential that bumping is involved.
[01:21:18.960 --> 01:21:24.200]  And there cannot be a side... or if there's a side bar on the lock, that can make bumping more difficult.
[01:21:25.700 --> 01:21:30.600]  If it's a common key way, that will increase your susceptibility to bumping.
[01:21:30.600 --> 01:21:33.000]  And what's the availability of blanks?
[01:21:33.920 --> 01:21:37.040]  Now, you may ask, what about security pins?
[01:21:37.420 --> 01:21:39.920]  What about restricted or sectional keyways?
[01:21:40.140 --> 01:21:41.540]  What about the number of pins?
[01:21:41.840 --> 01:21:45.380]  And what about removable core locks like KABA and BEST?
[01:21:45.580 --> 01:21:49.360]  They don't have any real significant impact on bumping.
[01:21:49.520 --> 01:21:57.580]  Doesn't matter whether they have security pins, restricted or sectional keyways, generally the number of pins, or if it's a removable core.
[01:21:57.760 --> 01:21:59.280]  They can all be bumped open.
[01:21:59.480 --> 01:22:03.160]  And as I said, if it's got a side bar, you need to know the side bar code.
[01:22:03.780 --> 01:22:05.200]  Was the lock bumped?
[01:22:05.680 --> 01:22:09.300]  Again, it definitely was not bumped open.
[01:22:10.280 --> 01:22:16.140]  If it was a magnetic lock such as the EVA MCS, they're not susceptible to bumping.
[01:22:16.140 --> 01:22:21.320]  Again, if it's a warded wafer, lever, tumbler, disk tumbler, you can't open them.
[01:22:22.560 --> 01:22:24.440]  Okay, other legal issues.
[01:22:26.200 --> 01:22:38.200]  If you find somebody with a bump key or if you're stopped with a key that looks like a bump key, it does not necessarily have to have all nine cuts, the deepest cut.
[01:22:38.380 --> 01:22:43.220]  You can actually have a bump key with eight cuts, nine cuts, maybe a zero cut.
[01:22:43.220 --> 01:22:46.740]  It depends where the pin tumblers are in the lock.
[01:22:47.740 --> 01:22:51.780]  It definitely won't work if it doesn't fit the key way.
[01:22:52.520 --> 01:23:00.480]  If it's an original key and the code number is different than is actually cut, you could have a problem.
[01:23:00.660 --> 01:23:13.120]  And where I'm going to is with this, bump keys are just like lock picks as far as the legal requirements of possession of a burglary tool.
[01:23:13.420 --> 01:23:18.200]  And a tomahawk would be equivalent to a torque wrench for lock picking.
[01:23:18.480 --> 01:23:30.780]  So, if you are caught in possession of a 999 key and the circumstances indicate that you're trying to open locks that you don't have authority to open, you have a problem.
[01:23:31.420 --> 01:23:36.000]  It's called possession of burglary tools in basically every jurisdiction in the country.
[01:23:36.000 --> 01:23:38.620]  And so, you need to pay attention to that.
[01:23:40.240 --> 01:23:43.980]  And a bump key is very distinguishable from most normal keys.
[01:23:44.340 --> 01:23:50.820]  Again, those statutes refer to circumstances and can intend to be inferred.
[01:23:51.740 --> 01:23:56.220]  So, the burglary statutes would apply to bump keys.
[01:23:57.400 --> 01:24:00.180]  Any regular key can be made into a bump key.
[01:24:00.180 --> 01:24:06.280]  The interesting legal issue is if you have a bump key that actually opens your door lock.
[01:24:07.420 --> 01:24:13.800]  That poses more of a complicated problem, but if it can be shown that it was not produced that way, then you have an issue.
[01:24:14.420 --> 01:24:22.880]  There are some defenses that I don't really need to go into, but there would be some defenses to these issues, but not particularly relevant today.
[01:24:23.320 --> 01:24:25.920]  Federal statutes, what everybody asks me about.
[01:24:25.920 --> 01:24:31.900]  What about sending bump keys through the mail, through interstate commerce, on FedEx, on DHL?
[01:24:32.520 --> 01:24:45.500]  There are federal postal regulations and statutes under Title 39-3002A and Title 18, which is the Federal Criminal Code.
[01:24:45.880 --> 01:24:52.660]  These statutes make it illegal to introduce bypass tools into interstate commerce.
[01:24:53.640 --> 01:24:57.280]  The statute was written about 70 years ago.
[01:24:57.500 --> 01:24:58.900]  They didn't know about bump keys.
[01:24:59.220 --> 01:25:07.620]  And as a matter of fact, the federal statute specifically exempts bump keys from introduction into interstate commerce.
[01:25:07.700 --> 01:25:16.020]  So, there is no present prohibition as to the introduction of bump keys, sending them through FedEx, DHL, the mail.
[01:25:16.020 --> 01:25:28.700]  The one postal statute covers all that, but it does not, in my view and interpretation, and I've talked to some federal prosecutors, it doesn't appear to apply at this point to bump keys.
[01:25:28.980 --> 01:25:30.060]  Will it in the future?
[01:25:30.220 --> 01:25:31.540]  I suspect it will.
[01:25:31.860 --> 01:25:40.100]  So, let's talk now for a couple minutes about the real world of bumping and how it affects you and your businesses and your privacy.
[01:25:40.980 --> 01:25:50.500]  The post office, the United States Post Office and mailboxes, et cetera, rental boxes worldwide are cheap pin tumbler locks.
[01:25:51.120 --> 01:25:58.440]  In March, we released a security alert after working with the Postal Inspection Service for four months on this issue.
[01:25:58.840 --> 01:26:08.080]  We released a security alert warning everybody that if you have a rented mailbox, it is at extreme risk of bumping.
[01:26:08.860 --> 01:26:13.060]  We estimate at least five million postal boxes.
[01:26:13.240 --> 01:26:15.760]  Now, I'm not talking about what's out on your curb side.
[01:26:15.760 --> 01:26:16.940]  That's a different issue.
[01:26:17.060 --> 01:26:21.060]  I'm talking about in the post office or in mailboxes, et cetera.
[01:26:21.380 --> 01:26:25.540]  The integrity and security of the mail in those boxes is at risk.
[01:26:25.720 --> 01:26:30.900]  And in all of those facilities, there's virtually no perimeter security.
[01:26:31.180 --> 01:26:41.360]  Some of the post offices have video cameras, but there's blind spots in mailboxes, et cetera, which was acquired by UPS about, I think, four or five years ago.
[01:26:42.100 --> 01:26:46.720]  They lock the doors at night, but then they give all their customers the keys.
[01:26:47.360 --> 01:26:51.940]  And do they use high security locks or electronic locks that have audit trails?
[01:26:52.300 --> 01:26:54.200]  No, we wouldn't want to do that.
[01:26:54.360 --> 01:26:59.420]  We use standard keys that you can take and duplicate and pass out to whoever.
[01:26:59.420 --> 01:27:01.940]  And they don't recall the keys.
[01:27:02.320 --> 01:27:10.900]  So, in Sioux Falls, where I live, I went and rented a box from mailboxes, et cetera, and then I shot a video opening it.
[01:27:11.860 --> 01:27:17.080]  Both the postal service and mailboxes, et cetera, have this problem.
[01:27:19.380 --> 01:27:22.460]  And everybody that has those boxes is at risk.
[01:27:22.600 --> 01:27:23.540]  They think they're secure.
[01:27:23.720 --> 01:27:24.860]  They are not.
[01:27:25.140 --> 01:27:34.980]  The post office is working on the problem, to my knowledge, and I just spoke with a manufacturer of mailboxes, et cetera, locks this past weekend out in Las Vegas.
[01:27:35.240 --> 01:27:37.240]  They're not concerned about the problem.
[01:27:37.660 --> 01:27:41.860]  So, this is the mailboxes, et cetera, locks.
[01:27:41.860 --> 01:27:46.500]  These locks are manufactured in China for less than a dollar.
[01:27:47.460 --> 01:27:52.560]  This is what your security is worth at mailbox, et cetera, in my view.
[01:27:52.840 --> 01:27:53.560]  A dollar.
[01:27:54.440 --> 01:27:56.760]  This is what the bump key looks like.
[01:27:56.860 --> 01:28:00.800]  They'll open the mailbox, et cetera, locks.
[01:28:01.060 --> 01:28:04.700]  This is a cheap, Chinese-manufactured lock.
[01:28:04.800 --> 01:28:05.360]  It's a U.S.
[01:28:05.480 --> 01:28:07.420]  manufacturer, but they do all their work in China.
[01:28:07.580 --> 01:28:15.900]  It's not the manufacturer's fault, because the manufacturer also makes the postal service locks, which are a lot better than these, but are still not secure.
[01:28:16.480 --> 01:28:19.500]  So, one dollar or less, made in China.
[01:28:19.740 --> 01:28:21.880]  Several manufacturers are making these locks.
[01:28:22.220 --> 01:28:25.820]  They're five-pin, really, really cheap locks.
[01:28:26.040 --> 01:28:30.420]  And mailboxes, et cetera, has 5,500 locations worldwide.
[01:28:30.940 --> 01:28:36.140]  So, the security response from mailboxes, et cetera, I spoke with their chief of security.
[01:28:36.360 --> 01:28:38.080]  He instantly got it.
[01:28:38.080 --> 01:28:41.360]  He said, oh, this could be a real problem.
[01:28:41.540 --> 01:28:49.340]  But when their PR people got a hold of it, after I was on television in my state, their comment was, it's not a problem.
[01:28:49.560 --> 01:28:50.900]  We know our customers.
[01:28:51.100 --> 01:28:51.980]  That works.
[01:28:52.380 --> 01:28:58.300]  And so, only those customers that they know would be opening the mailboxes and not anybody else.
[01:28:58.700 --> 01:29:04.580]  And we lock the doors at night, but, of course, we give everybody a key that anybody can copy.
[01:29:04.580 --> 01:29:08.120]  So, that was mailbox, et cetera, statement.
[01:29:08.860 --> 01:29:14.980]  If you want more security out of these mailboxes, you should demand high security locks.
[01:29:15.240 --> 01:29:18.120]  The postal service is working on it.
[01:29:18.580 --> 01:29:20.360]  It's going to cost them a lot of money.
[01:29:20.500 --> 01:29:23.540]  There's 38,000-plus post offices.
[01:29:23.800 --> 01:29:27.560]  And so, it's a real problem, but they're going to work on it.
[01:29:27.560 --> 01:29:33.740]  So, if this video runs, this is the video that we did in Sioux Falls with mailboxes, et cetera.
[01:29:34.680 --> 01:29:36.920]  And, of course, it's not going to run.
[01:29:38.040 --> 01:29:38.600]  Okay.
[01:29:38.880 --> 01:29:40.320]  Well, that's excellent.
[01:29:41.420 --> 01:29:42.260]  Uh-huh.
[01:29:43.940 --> 01:29:47.320]  Well, so much for our Lenovo laptop.
[01:29:49.940 --> 01:29:52.960]  Which, by the way, is a brand new laptop.
[01:29:52.960 --> 01:29:54.420]  Thank you very much.
[01:29:54.660 --> 01:29:54.820]  Okay.
[01:29:55.020 --> 01:29:55.900]  So, now we're frozen.
[01:29:56.920 --> 01:29:57.360]  So...
[01:30:01.900 --> 01:30:03.300]  No, I don't think so.
[01:30:03.580 --> 01:30:03.980]  I've been...
[01:30:03.980 --> 01:30:08.780]  In fact, I'm having a conference call Monday with Lenovo's chief tech support because of all the issues.
[01:30:09.340 --> 01:30:10.830]  So, maybe now they'll get it.
[01:30:11.700 --> 01:30:13.880]  At any rate, it's a nice green screen.
[01:30:13.880 --> 01:30:22.560]  Um, the bottom line is, I walked into, uh, mailboxes, et cetera, and in, um, literally two seconds, opened my mailbox.
[01:30:23.480 --> 01:30:30.240]  Um, the, the, the mailbox, the postal service, we did the same thing, uh, with a postal inspector.
[01:30:30.320 --> 01:30:36.980]  And, by the way, the, the restricted keyways for the postal service, we bought on eBay.
[01:30:38.500 --> 01:30:44.400]  Um, there's federal, there's federal prohibitions on distributing or doing anything with these keys.
[01:30:44.670 --> 01:30:49.590]  There are other keyways that are sold that'll open these locks, which complicates the problem.
[01:30:49.750 --> 01:30:52.830]  But the keys and the locks are sold on eBay.
[01:30:53.330 --> 01:30:53.800]  Why?
[01:30:54.280 --> 01:30:59.830]  Because when military bases around the world are shut down, everything is surplused.
[01:30:59.830 --> 01:31:03.940]  So, we sell the mailboxes for everybody to buy.
[01:31:04.220 --> 01:31:10.200]  And so, again, bumping, from my standpoint, is a significant threat.
[01:31:10.380 --> 01:31:11.940]  You need to pay attention to it.
[01:31:12.460 --> 01:31:18.320]  Um, I, Barry's gonna have a workshop with the folks downstairs to, so you can look at the problem yourselves.
[01:31:18.980 --> 01:31:21.700]  Um, does anybody have any questions before I give this back to Barry?
[01:31:24.020 --> 01:31:24.540]  Okay.
[01:31:24.900 --> 01:31:25.520]  All right.
[01:31:26.780 --> 01:31:27.300]  Right.
[01:31:27.460 --> 01:31:27.620]  All right.
[01:31:27.750 --> 01:31:28.090]  Questions?
[01:31:33.140 --> 01:31:36.580]  What are the legal ramifications of having a lockpicking kit?
[01:31:36.760 --> 01:31:40.760]  You said that there was legal ramifications for having the bump key, um, but...
[01:31:41.720 --> 01:31:53.780]  In some states, um, it's possession of burglary tools, but honestly, I've looked at a lot of the statutes, and I'm not giving you legal advice, but the base, the bottom line is, you have to show criminal intent.
[01:31:53.980 --> 01:31:55.600]  You don't have a crime without criminal intent.
[01:31:55.820 --> 01:32:00.860]  And so, if you're at home picking locks, you're at your office, whatever, I don't think it's a problem.
[01:32:01.920 --> 01:32:02.480]  Yes, sir?
[01:32:02.640 --> 01:32:07.460]  You were talking about restricted keyways and protecting, uh, infrastructure and, and environments.
[01:32:07.860 --> 01:32:13.620]  One, one thing that's important to watch out for is stolen keys, because they can easily be turned into bump keys.
[01:32:14.200 --> 01:32:20.240]  Uh, and companies think replacing the locks are going to, you know, are re-keying the locks is gonna solve the problem.
[01:32:20.260 --> 01:32:21.320]  That's a really good point.
[01:32:21.560 --> 01:32:29.160]  There ought to be, and, and, and I've covered it in my book, there's, there needs to be inventory control on locks and keys that are taken out of service.
[01:32:29.780 --> 01:32:34.540]  And you need to account for all your keys, because any key, and it goes, it's worse than that.
[01:32:34.880 --> 01:32:47.280]  Because any key can be turned into a bump key, but a lot of them can be used to extrapolate the top-level master key also, which is a, even a better threat, because if I have the key to your facility, I don't need to worry about anything else.
[01:32:47.280 --> 01:32:50.340]  And a quick question about the, the, uh, bump keys.
[01:32:50.820 --> 01:32:59.300]  Um, split top driver pins, uh, if they had two of them up there that never dropped down into the keyway, would it just transfer to the top one?
[01:32:59.580 --> 01:33:00.920]  It'll, it'll, they'll still split.
[01:33:01.680 --> 01:33:02.860]  They'll, they'll still split.
[01:33:03.700 --> 01:33:05.840]  Next question, quickly, because we're gonna run out of time.
[01:33:06.500 --> 01:33:16.340]  Um, with the bump method, is there any type of electronic detection in the secondary security that's being manufactured that would detect that?
[01:33:16.920 --> 01:33:18.280]  Not, no, not that.
[01:33:18.280 --> 01:33:22.480]  Like a glass break detector for, for, is there, so nothing's being manufactured?
[01:33:22.800 --> 01:33:30.060]  It'd be impossible, it'd be virtually impossible unless you put a contact mic on the lock, and then the, the, the false would be a real problem, because everybody would be setting it off.
[01:33:30.460 --> 01:33:47.440]  Um, another question for Barry is, if you ever, in Europe, or have you ever seen a lock that, when a contractor or a builder of a house has a, quote, master, and then when you, you take possession of the house, you put a key in your, quote, unquote, key,
[01:33:47.680 --> 01:33:57.260]  and you turn the key, it resets the tumblers, or is this just, uh, propaganda by the builders, where it really actually has a master key that's just floating around?
[01:33:57.640 --> 01:34:07.440]  Uh, it's not propaganda, um, it's called construction mastering, and basically you move a pin out of the way forever, and then that construction master should never work again.
[01:34:07.780 --> 01:34:08.220]  Okay.
[01:34:08.660 --> 01:34:08.780]  Thank you.
[01:34:08.780 --> 01:34:08.940]  Period.
[01:34:09.160 --> 01:34:10.020]  Yes, sir, next.
[01:34:11.160 --> 01:34:11.980]  Hi, how are you doing?
[01:34:11.980 --> 01:34:12.880]  I got two questions.
[01:34:13.160 --> 01:34:20.440]  Um, is there a commercial, uh, tool that uses the bumping method, uh, that is used by locksmiths, other than, than creating a 999 key?
[01:34:20.840 --> 01:34:21.180]  No.
[01:34:21.520 --> 01:34:22.300]  999 key.
[01:34:22.480 --> 01:34:23.120]  It's the easiest.
[01:34:23.620 --> 01:34:23.760]  Yeah.
[01:34:23.780 --> 01:34:27.020]  But aside from that, like an actual industrial tool that you can use?
[01:34:27.440 --> 01:34:27.800]  No.
[01:34:28.200 --> 01:34:28.380]  Okay.
[01:34:29.000 --> 01:34:31.020]  I mean, a 999 key is what it is.
[01:34:31.180 --> 01:34:31.200]  Sure.
[01:34:31.200 --> 01:34:31.800]  It's really simple.
[01:34:31.800 --> 01:34:32.260]  Okay.
[01:34:32.440 --> 01:34:35.200]  Well, we'll talk about that at the Village in the second off.
[01:34:35.600 --> 01:34:35.820]  Okay.
[01:34:35.820 --> 01:34:39.560]  What about if, uh, two pins are magnetized with very strong magnets?
[01:34:39.980 --> 01:34:42.400]  Uh, it kind of avoids them from separating.
[01:34:42.600 --> 01:34:43.760]  Um, I agree with you.
[01:34:43.940 --> 01:34:44.740]  We've looked at it.
[01:34:44.900 --> 01:34:46.640]  Uh, the problem is the magnetic material.
[01:34:46.640 --> 01:34:49.480]  I believe there are some locks in Europe that are doing that right now.
[01:34:49.740 --> 01:34:49.840]  Okay.
[01:34:49.980 --> 01:34:50.160]  Thank you.
[01:34:51.300 --> 01:34:51.700]  Next.
[01:34:52.040 --> 01:34:52.320]  Yeah.
[01:34:52.460 --> 01:34:52.560]  Hi.
[01:34:52.660 --> 01:34:59.520]  Is it, uh, possible to improve a lock by making a stronger spring or putting a stronger spring in...
[01:34:59.520 --> 01:35:00.700]  Doesn't seem to make a difference.
[01:35:01.000 --> 01:35:01.620]  It does...
[01:35:01.620 --> 01:35:05.880]  The question was, can you, uh, stop the lock from being opened by a stronger spring?
[01:35:06.000 --> 01:35:07.780]  It doesn't seem to make a difference.
[01:35:09.000 --> 01:35:09.780]  Next question.
[01:35:10.240 --> 01:35:19.520]  If you have a, uh, mushroom pen in there, and you use the bump technique, do you notice any difference in if it works or not?
[01:35:20.460 --> 01:35:20.900]  Not...
[01:35:20.900 --> 01:35:21.880]  Go ahead, Barry.
[01:35:23.860 --> 01:35:25.740]  Yeah, the microphone doesn't seem...
[01:35:25.740 --> 01:35:27.700]  The other microphone doesn't seem to work.
[01:35:28.340 --> 01:35:30.180]  Um, no, it's just a matter of timing.
[01:35:30.440 --> 01:35:35.840]  So, uh, if you put tension on it already and then you start bumping, then, you know, you might run into problems.
[01:35:35.840 --> 01:35:44.260]  But, um, the way that I bump and the way I teach bumping is that you hit it and a split second later, you actually try to turn it.
[01:35:44.380 --> 01:35:44.900]  So, it's...
[01:35:45.300 --> 01:35:49.220]  So, regardless whether you have a mushroom-shaped pen...
[01:35:49.220 --> 01:35:49.460]  Doesn't matter.
[01:35:49.640 --> 01:35:50.020]  Doesn't matter.
[01:35:50.020 --> 01:35:50.340]  Doesn't matter.
[01:35:50.560 --> 01:35:50.760]  Okay.
[01:35:52.660 --> 01:35:53.060]  Next.
[01:35:54.440 --> 01:35:57.180]  Maybe you've addressed this in other forums, but I'm just wondering for Barry.
[01:35:57.460 --> 01:35:58.460]  Um, when you're...
[01:35:58.460 --> 01:36:01.040]  I noticed that you just, you do the locks very quickly.
[01:36:01.200 --> 01:36:01.580]  What are you...
[01:36:01.580 --> 01:36:04.100]  Are you feeling for it or are you hearing for when it actually happens?
[01:36:04.100 --> 01:36:05.560]  And what are you listening for or feeling for?
[01:36:06.100 --> 01:36:08.160]  Um, no, it's...
[01:36:08.160 --> 01:36:10.940]  Uh, regarding to bumping, it's just a timing matter.
[01:36:11.040 --> 01:36:12.920]  Or with other lockpicking as well.
[01:36:13.240 --> 01:36:18.280]  Um, that's just, you know, uh, you get sensitive for feeling the lock.
[01:36:18.380 --> 01:36:19.300]  So, it's not hearing.
[01:36:19.600 --> 01:36:20.580]  It's just feeling.
[01:36:20.820 --> 01:36:21.560]  That's all.
[01:36:21.780 --> 01:36:22.000]  Okay.
[01:36:23.560 --> 01:36:24.040]  Next.
[01:36:24.720 --> 01:36:28.140]  Are bank safety deposit boxes vulnerable to bumping?
[01:36:28.300 --> 01:36:28.580]  No.
[01:36:29.080 --> 01:36:29.740]  They're not...
[01:36:29.740 --> 01:36:31.540]  Not, not, not if they use lever locks.
[01:36:32.660 --> 01:36:34.300]  I think this is about it, I think.
[01:36:34.520 --> 01:36:36.720]  So, we, uh...
[01:36:36.720 --> 01:36:36.980]  Yeah, okay.
[01:36:37.120 --> 01:36:38.660]  But, you know, the next person is standing.
[01:36:39.240 --> 01:36:39.680]  Okay.
[01:36:39.680 --> 01:36:41.600]  So, let's just say three more questions.
[01:36:42.080 --> 01:36:42.520]  Okay.
[01:36:42.800 --> 01:36:46.540]  Um, can you elaborate on, uh, extracting the master key?
[01:36:46.780 --> 01:36:49.840]  Uh, is that a... is there a technique to that?
[01:36:49.960 --> 01:36:51.000]  Is there some chance involved?
[01:36:51.540 --> 01:36:54.480]  Uh, there's actually a good paper written on it.
[01:36:54.900 --> 01:36:56.820]  And, um, it's online.
[01:36:56.840 --> 01:36:59.140]  So, uh, I will have to look up the address.
[01:36:59.280 --> 01:37:00.560]  But, I can show you later.
[01:37:01.000 --> 01:37:01.800]  Crypto.com.
[01:37:02.220 --> 01:37:02.640]  Okay.
[01:37:03.120 --> 01:37:03.160]  Yeah.
[01:37:04.240 --> 01:37:04.640]  Next.
[01:37:04.800 --> 01:37:05.240]  Two more.
[01:37:06.980 --> 01:37:07.400]  No.
[01:37:07.580 --> 01:37:07.720]  Yeah.
[01:37:09.640 --> 01:37:10.060]  Okay.
[01:37:10.380 --> 01:37:10.640]  Okay.
[01:37:10.900 --> 01:37:11.420]  Thank you.
[01:37:11.560 --> 01:37:12.260]  Well, thanks a lot, guys.