[00:02.430 --> 00:05.490]  It's awkward not having the slides up, but I actually kind of prefer it because it's old school.
[00:05.750 --> 00:07.050]  It's the way I used to give presentations.
[00:07.750 --> 00:11.550]  Really, this is about telephone entry systems, which hopefully most people are familiar with.
[00:11.630 --> 00:15.290]  If you've ever seen the keypads outside a building that you touch, it's just like a phone pad.
[00:15.890 --> 00:18.170]  Has anybody not seen a keypad like that outside a door?
[00:18.890 --> 00:19.250]  Louder!
[00:20.950 --> 00:22.490]  Has anybody not seen...
[00:24.210 --> 00:24.930]  All right,
[00:28.090 --> 00:31.090]  so the question is really, is there anyone not familiar with the keypad entry system?
[00:32.390 --> 00:32.750]  Right?
[00:32.890 --> 00:33.390]  Everybody is.
[00:33.530 --> 00:33.890]  Okay, cool.
[00:35.170 --> 00:37.230]  So basically I'm going to go through four things here.
[00:37.490 --> 00:38.210]  I'm going to do an introduction.
[00:38.530 --> 00:42.350]  We're going to go over an overview of the systems I'm talking about, details.
[00:42.890 --> 00:45.910]  Then we'll talk about the exploits that I found, many of which are public.
[00:46.190 --> 00:48.170]  And I'll talk about my philosophy of the exploits as well.
[00:48.390 --> 00:49.490]  And then opportunities.
[00:51.330 --> 00:51.950]  Oh, nice.
[00:53.550 --> 00:53.910]  Okay.
[00:55.430 --> 00:56.230]  Hold one second.
[00:58.170 --> 00:59.350]  This may or may not work.
[01:13.110 --> 01:13.650]  That's it.
[01:13.830 --> 01:14.150]  All right.
[01:14.590 --> 01:15.470]  That's way less fun.
[01:17.050 --> 01:18.670]  I was going to describe to you some cool stuff.
[01:23.850 --> 01:24.470]  Does this work?
[01:25.250 --> 01:26.010]  No, this is fine.
[01:26.390 --> 01:26.570]  Okay.
[01:26.690 --> 01:27.890]  So my name is Davi Ottenheimer.
[01:28.050 --> 01:28.690]  It's just D-A-V-I.
[01:28.970 --> 01:31.450]  This is my 16th year in information security.
[01:31.650 --> 01:33.450]  So I'm pretty happy with it.
[01:33.570 --> 01:34.170]  It's what I like to do.
[01:34.430 --> 01:36.230]  And last year I went full-time independent.
[01:36.230 --> 01:37.750]  So I run a company called Flying Penguin.
[01:37.750 --> 01:39.890]  And it's been going pretty well.
[01:39.970 --> 01:41.710]  In fact, I'm probably going to start hiring here pretty soon.
[01:42.150 --> 01:43.250]  I'm kind of a contrarian.
[01:43.350 --> 01:44.370]  I think that's how I got into this.
[01:44.590 --> 01:46.230]  And I think I...
[01:46.230 --> 01:46.770]  I don't know.
[01:46.810 --> 01:47.790]  This is probably a bad thing to say.
[01:47.910 --> 01:50.390]  But I've been using Macintosh for 21 years now.
[01:50.490 --> 01:50.810]  And I just...
[01:50.810 --> 01:52.150]  This year I went totally apple free.
[01:52.330 --> 01:53.210]  That was like my big thing.
[01:54.350 --> 01:54.630]  So...
[01:56.810 --> 01:57.830]  I just got rid of it all.
[01:57.950 --> 01:59.230]  But that's kind of my philosophy.
[01:59.390 --> 02:01.730]  Like the hard road is sometimes the more interesting and fun road.
[02:01.730 --> 02:04.710]  So it's not exactly how I got into this particular case.
[02:04.910 --> 02:06.650]  But I'll talk about that later.
[02:07.530 --> 02:10.430]  One of the things I do with big companies is talk about security versus compliance.
[02:10.710 --> 02:12.210]  People ask me all the time what's the difference.
[02:12.550 --> 02:15.630]  And I just want to make this one point because I think it's pretty simple.
[02:15.790 --> 02:16.810]  Really security is personal.
[02:17.050 --> 02:20.590]  Like if you feel secure or you have a security gauge, that's your decision.
[02:20.750 --> 02:23.890]  But every time you talk about compliance, you talk about it in terms of everyone else.
[02:24.050 --> 02:26.230]  So it's like at least two people or more.
[02:26.510 --> 02:28.090]  So two people have an idea of security.
[02:28.250 --> 02:28.790]  They get together.
[02:28.970 --> 02:30.710]  That's compliance because they're agreeing with one another.
[02:30.710 --> 02:40.450]  And that's what I'm going to talk about here because in terms of locks, you know, at least buildings I lived in, I would sit inside and think there's something on the front door that protects me from people getting in.
[02:40.630 --> 02:41.710]  And I have a sense of compliance.
[02:41.910 --> 02:42.770]  It's not just security.
[02:43.010 --> 02:44.630]  I haven't gone down and tested it myself.
[02:44.970 --> 02:50.870]  I believe that there's some degree of compliance to a standard or a code of what key locks should provide.
[02:51.290 --> 02:52.430]  And I know these conferences are...
[02:52.430 --> 02:57.450]  I mean, I've seen like key lock presentations every single time I go to a hacker conference for the past however many years.
[02:57.630 --> 02:58.350]  And I know it's popular.
[02:58.350 --> 03:00.490]  And I thought, no one ever talks about these keypad systems.
[03:00.630 --> 03:01.390]  At least I haven't seen one.
[03:01.810 --> 03:02.490]  So I thought, what the heck.
[03:03.370 --> 03:05.470]  The title is easy hacks for a reason.
[03:05.790 --> 03:06.850]  These are really simple hacks.
[03:06.990 --> 03:07.690]  And I'll talk about that.
[03:07.790 --> 03:08.810]  In terms of compliance.
[03:09.110 --> 03:10.330]  Not so much in terms of security.
[03:10.630 --> 03:11.310]  But you could go either way.
[03:12.110 --> 03:15.590]  So the risk calculations, I just bring that up because I think a lot of this is risk.
[03:15.910 --> 03:17.250]  Like, it depends where you live.
[03:17.250 --> 03:20.290]  But I live in a neighborhood that actually is pretty dangerous.
[03:20.470 --> 03:22.270]  It gets broken into a lot, surprisingly.
[03:22.490 --> 03:24.090]  I actually didn't think that would be the case.
[03:24.230 --> 03:24.970]  I thought it was pretty safe.
[03:25.130 --> 03:27.090]  But as I found out, I started monitoring.
[03:27.250 --> 03:28.790]  I noticed that a lot of stuff was getting broken into.
[03:28.950 --> 03:30.230]  And that's kind of how I got involved in this.
[03:30.730 --> 03:31.530]  Somebody asked me...
[03:31.530 --> 03:33.330]  A manager asked me to take a look at some of these systems.
[03:34.250 --> 03:36.630]  So when I look at risk, I look at the assets that are protected.
[03:36.830 --> 03:39.710]  In this case, it would be somebody's apartment or somebody's business.
[03:40.390 --> 03:42.070]  The vulnerabilities, right?
[03:42.250 --> 03:43.190]  Which most people don't know.
[03:43.330 --> 03:45.770]  Like, you walk up to a building and you kind of look at those keypad systems.
[03:46.050 --> 03:48.630]  But you might not actually test them or you might not be familiar with them.
[03:48.770 --> 03:49.710]  Maybe you haven't installed them.
[03:49.830 --> 03:52.010]  That seems to be the way that most people figure out the vulnerabilities.
[03:52.390 --> 03:55.110]  Is they install one themselves and then immediately they go, Whoa!
[03:55.790 --> 03:56.870]  This is how these things are built?
[03:57.710 --> 03:58.530]  And then the threats.
[03:58.710 --> 03:59.970]  That's sort of what I talked about a little bit.
[04:00.090 --> 04:02.110]  You know, it's hard to gauge threats in neighborhoods.
[04:02.430 --> 04:03.610]  Like, you can look at certain signs.
[04:03.770 --> 04:04.530]  Graffiti is one.
[04:04.670 --> 04:07.070]  There's a whole criminal, like, study of this, right?
[04:07.250 --> 04:09.330]  Criminal behavior and the philosophy of what...
[04:09.330 --> 04:10.370]  Begets crime.
[04:10.630 --> 04:14.050]  But if you look at certain signs and things in the neighborhood, you can sort of put two and two together.
[04:14.230 --> 04:17.590]  The more keypad entry systems you see, probably the more crime that's been in that neighborhood.
[04:17.910 --> 04:21.010]  Which is ironic when we get to the rest of this presentation.
[04:21.190 --> 04:22.250]  When you see what's really going on.
[04:23.230 --> 04:25.310]  And then I have to do my little spiel about white versus black.
[04:25.470 --> 04:27.230]  Because I consider myself totally white hat.
[04:27.390 --> 04:28.890]  I don't really do a lot of black hat.
[04:29.050 --> 04:31.130]  And the difference for me is purely authorization.
[04:31.650 --> 04:33.370]  So if somebody asks me to do something, I will.
[04:33.590 --> 04:37.950]  But I won't initiate an attack on a system unless someone said, Would you please test this?
[04:37.950 --> 04:39.830]  And that's entirely what this presentation is about.
[04:40.190 --> 04:41.990]  So I do a lot of work with big companies.
[04:42.090 --> 04:43.930]  And they ask me to do tests and penetration testing.
[04:44.030 --> 04:44.790]  I've done it for a long time.
[04:45.350 --> 04:48.770]  But in this particular case, I was specifically asked to look at this box.
[04:48.890 --> 04:49.970]  I probably wouldn't have done it otherwise.
[04:49.990 --> 04:52.410]  I just would have been really mad and known what was going on.
[04:52.530 --> 04:53.990]  But in this case, they said, Can you look inside?
[04:54.670 --> 04:58.310]  And then finally, there's this whole exploit versus like, Oh my God, it's an exploit.
[04:58.530 --> 05:00.210]  And for me, an exploit is just a flaw.
[05:00.370 --> 05:01.310]  And we find them all the time.
[05:01.310 --> 05:02.510]  You know, like a tire goes flat.
[05:03.790 --> 05:05.150]  It's maybe an exploit, right?
[05:05.270 --> 05:06.590]  It's maybe something you should know about.
[05:06.770 --> 05:07.650]  Somebody's done something to you.
[05:07.730 --> 05:10.230]  Maybe it's something you should have considered when you bought the tire.
[05:11.230 --> 05:12.410]  It always reminds me of this time.
[05:12.530 --> 05:14.730]  I did a penetration test in a company that was...
[05:14.730 --> 05:15.810]  It was a really big company.
[05:15.950 --> 05:17.230]  And they were bringing in some really big names.
[05:17.450 --> 05:19.410]  So for example, you might say it was like Apple and IBM.
[05:19.650 --> 05:22.230]  Or Microsoft and IBM were using this hosted facility.
[05:22.470 --> 05:25.770]  And we did some testing where we went in to see if they couldn't see each other's data.
[05:25.770 --> 05:29.510]  And right away, we could see, you know, A could see B, B could see A.
[05:29.650 --> 05:31.110]  And I was working with a guy who...
[05:31.110 --> 05:33.590]  I don't know how he got into security, but he used to be a tow truck driver.
[05:34.250 --> 05:35.810]  And I was talking to him about his life.
[05:35.910 --> 05:36.930]  And he was like a really cool guy.
[05:37.010 --> 05:39.410]  But as soon as we found this and I said, Look at this.
[05:39.470 --> 05:39.970]  This is ridiculous.
[05:40.170 --> 05:41.670]  You know, they can see into each other's stuff.
[05:41.830 --> 05:45.750]  He literally stood up, threw his arms up and went running down the hall like, Exploit!
[05:45.750 --> 05:46.030]  Exploit!
[05:46.270 --> 05:49.250]  And like he told everybody, you know, Your system's totally screwed.
[05:49.470 --> 05:50.090]  You're totally hacked.
[05:50.250 --> 05:52.650]  You know, and I try to avoid that like sensationalization.
[05:52.850 --> 05:54.630]  But in this case, I really...
[05:54.630 --> 06:00.710]  I'm just trying to get the word out because like I say, I've seen a lot of the physical key lock breaking And I haven't seen a lot of the keypad stuff discussed.
[06:01.930 --> 06:02.810]  Okay, so enough of that stuff.
[06:03.510 --> 06:06.190]  The overview really is going to be about telephone entry systems.
[06:06.530 --> 06:07.790]  And it's about remote entry.
[06:07.950 --> 06:19.310]  So you want to let somebody in and they're far away And you want to use the telephone system Because it has the keypad already designed And maybe you live in a multi-unit dwelling So it's convenient to have lots of people allow multiple people in.
[06:19.610 --> 06:21.310]  So that's really the whole concept here.
[06:21.490 --> 06:24.790]  And you see there an actual diagram that I pulled off of One of the vendor sites.
[06:25.110 --> 06:27.630]  Which shows you what you're getting yourself into When you buy one of these things.
[06:27.850 --> 06:28.310]  You have a display.
[06:28.910 --> 06:29.810]  You have that postal lock.
[06:29.970 --> 06:31.530]  There's a speaker so they can hear you talking.
[06:31.890 --> 06:31.950]  Right?
[06:32.150 --> 06:32.930]  This should all be familiar.
[06:33.230 --> 06:34.370]  And there's an enclosure lock.
[06:34.870 --> 06:37.110]  Now, I think before I did this research...
[06:37.910 --> 06:39.970]  Research loosely termed...
[06:39.970 --> 06:42.910]  I think before I did this, I would have looked at this And thought, yeah, it's a box.
[06:43.030 --> 06:43.090]  Right?
[06:43.150 --> 06:43.530]  There's a key.
[06:43.690 --> 06:44.590]  It's pretty familiar stuff.
[06:44.730 --> 06:46.030]  It even looks like a safe deposit box.
[06:46.130 --> 06:46.890]  They're used all the time.
[06:47.090 --> 06:50.410]  But after I went through the stuff I did And I look at this, I just go, Oh my God.
[06:50.590 --> 06:51.570]  That's what's protecting me?
[06:51.770 --> 06:54.370]  So hopefully that's the reaction you'll get At the end of this presentation.
[06:54.790 --> 06:55.750]  That's really what I'm looking for.
[06:56.330 --> 06:58.970]  And the way it usually works is you have a list of names That have been dialed...
[06:58.970 --> 06:59.950]  That have been programmed in.
[07:00.870 --> 07:03.330]  Somebody puts in the dial pad code for the name.
[07:03.690 --> 07:05.850]  So one, two, three, four might be your name code.
[07:06.370 --> 07:07.750]  So one, two, three, four answers.
[07:08.130 --> 07:08.930]  And then they press a key.
[07:09.190 --> 07:11.270]  And that key is really a number.
[07:11.490 --> 07:12.630]  So they press a six or a nine.
[07:12.750 --> 07:14.610]  Typically I found that they don't change very often.
[07:15.030 --> 07:16.210]  And they're not very unique.
[07:16.490 --> 07:20.130]  So you can already start to see the problems Because that's it for the key to be...
[07:20.130 --> 07:22.950]  The key itself is a six or a nine tone that unlocks the door.
[07:23.270 --> 07:24.510]  And there are lots of them out there.
[07:24.830 --> 07:26.770]  I did not test multiple units.
[07:26.930 --> 07:31.810]  It did occur to me to start a campaign Where I would go around the city And look at every single keypad system.
[07:32.030 --> 07:33.390]  But again, I wasn't authorized to do that.
[07:33.530 --> 07:34.250]  So I have not done that.
[07:34.350 --> 07:36.130]  I would recommend somebody get authorized to do that.
[07:36.350 --> 07:37.190]  And do a study.
[07:37.390 --> 07:38.730]  I would really like to see the results.
[07:38.990 --> 07:41.590]  But there are a lot of different systems made by a lot of different vendors.
[07:41.770 --> 07:43.990]  This one focuses on just the one that I was asked to look at.
[07:45.310 --> 07:46.450]  And that's Centex.
[07:46.590 --> 07:47.890]  Who I think is owned by Chamberlain.
[07:47.990 --> 07:51.030]  I haven't looked into it in that much detail.
[07:51.230 --> 07:56.710]  I did find from their advertisements the marketing literature they say they're committed to safety and reliability.
[07:56.910 --> 07:58.670]  Of course, you're going to say that if you sell locks.
[07:59.290 --> 08:02.810]  And they're engineered with quality machine work And rugged construction.
[08:03.050 --> 08:04.430]  Of course, and again, marketing.
[08:04.650 --> 08:05.710]  Very rugged construction.
[08:05.850 --> 08:07.610]  That's key when we get to the end of this presentation.
[08:08.130 --> 08:12.890]  And then they say they have a partnership network Of trained service technicians.
[08:13.190 --> 08:14.170]  This also is a key.
[08:14.490 --> 08:22.110]  Because I find a lot of these devices are sold From a vendor who doesn't really stand up to them Or service them or stand up to them As a company once they're in the field.
[08:22.510 --> 08:24.150]  In other words, they deploy them.
[08:24.270 --> 08:27.410]  But they rely on locksmiths and other people To basically implement them.
[08:27.650 --> 08:28.410]  And take care of them.
[08:28.610 --> 08:29.310]  And maintain them.
[08:29.810 --> 08:30.750]  And I'll talk about that later.
[08:31.150 --> 08:32.950]  But you can imagine already, you know, what happens.
[08:33.270 --> 08:34.970]  Similar situation in locks, right?
[08:35.030 --> 08:36.130]  You buy a lock from some guy.
[08:36.270 --> 08:36.990]  He doesn't make the lock.
[08:37.090 --> 08:37.710]  He just puts it in.
[08:37.790 --> 08:39.810]  But those guys know a lot about how to break the locks.
[08:39.810 --> 08:41.750]  People that put these things in, they study them.
[08:42.050 --> 08:43.730]  The same thing is happening in this field as well.
[08:44.690 --> 08:45.090]  So...
[08:45.090 --> 08:45.430]  Oops.
[08:45.950 --> 08:46.350]  Overview.
[08:46.530 --> 08:47.250]  Well, overview.
[08:47.510 --> 08:51.390]  It would be the Centex telephone entry system Spectrum DI that I'm looking at.
[08:51.570 --> 08:53.850]  DI is for the directory insert.
[08:54.010 --> 08:57.690]  So on the right side, there is a piece of paper That goes inside.
[08:58.430 --> 09:00.570]  And this is a $1500 roughly.
[09:00.750 --> 09:01.630]  It could be more or less.
[09:02.130 --> 09:04.070]  A device that someone would buy for their front door.
[09:04.530 --> 09:14.410]  Now, from a security perspective, unless you realize that you have to open this every time and put this piece of paper in, you might not think, well, what else is inside that box?
[09:14.570 --> 09:21.910]  In fact, from a security perspective, as a designer, you might say, I want to make sure you can just put that piece of paper in and lock it and take it out without affecting the internals of the box.
[09:22.370 --> 09:28.130]  So again, looking at this at face value, you might assume that someone's going to design it in a way that would be secure.
[09:28.290 --> 09:31.550]  When in reality, you have to open the entire box to put that piece of paper in.
[09:31.550 --> 09:35.170]  And that's the difference between a directory insert and a non-directory insert.
[09:35.430 --> 09:38.490]  The convenience they've just added completely exposes the inside of the box.
[09:39.030 --> 09:40.610]  So that's sort of what we're talking about.
[09:40.950 --> 09:46.390]  Again, with the overview, the Spectrum guys, they market this as durable and vandal-resistant.
[09:46.570 --> 09:48.330]  They're talking about this specific box now.
[09:48.610 --> 09:51.230]  The box that it comes in is a vandal-resistant box.
[09:51.350 --> 09:53.450]  And it uses an existing telephone network.
[09:53.710 --> 09:56.710]  So you're keying it into existing wires.
[09:56.870 --> 09:57.830]  You don't have to rewire...
[09:57.830 --> 09:59.090]  They're basically trying to save you money.
[09:59.090 --> 10:03.830]  That's why they say, you can save thousands of dollars by putting this system into your environment.
[10:05.030 --> 10:09.750]  So the bottom line there is they're trying to say, spend $1,500, because think of how much money you'll save on implementation.
[10:10.390 --> 10:12.530]  What they're not saying is, this thing is...
[10:12.530 --> 10:14.850]  If you boil it down, you look at these three.
[10:15.270 --> 10:18.630]  What they're not really saying is, we'll stand behind our product if someone breaks into it.
[10:19.310 --> 10:19.450]  Right?
[10:21.150 --> 10:21.510]  So...
[10:22.070 --> 10:29.690]  Going back to the keypad and how it works, I would assume a lot of people at this conference, or maybe everybody is familiar with the DTMF, which is just...
[10:29.690 --> 10:29.770]  Right?
[10:29.870 --> 10:30.930]  That's a 2600 concept.
[10:31.210 --> 10:34.990]  So you push the button, and it gives a tone, and the tones are based on two sounds.
[10:35.450 --> 10:35.710]  Right?
[10:35.890 --> 10:42.210]  So each key that you press on these door pieces, or on the keypad when you're at the door, is going to make a tone.
[10:42.430 --> 10:45.650]  And the tone is two combined frequencies, which you can obviously replicate.
[10:46.370 --> 10:46.690]  So...
[10:47.030 --> 10:52.790]  In the old system, or the way exchanges used to work, is they would take those tones, and then they'd convert to binary, and then they could do all sorts of computer things with it.
[10:52.870 --> 10:58.130]  But in the sense that these are still analog, there's no real computer back there, they're just moving the tones around.
[10:58.630 --> 11:00.330]  And so, I'll jump right into the first exploit.
[11:00.510 --> 11:01.870]  Obviously, you can replicate the tone.
[11:02.570 --> 11:02.930]  So...
[11:03.610 --> 11:07.170]  My first thought on this actually was, well, that wouldn't work, because you'd have to dial someone's number.
[11:07.310 --> 11:10.850]  But then I realized, you just press the pound button, and it gives you a dial tone.
[11:11.050 --> 11:11.850]  So it's listening.
[11:12.050 --> 11:13.570]  And then you press the tone, and it lets you in.
[11:13.650 --> 11:14.170]  It's pretty awesome.
[11:14.870 --> 11:15.230]  So...
[11:17.070 --> 11:18.170]  It doesn't always work.
[11:18.330 --> 11:20.030]  Like, only certain systems are like this, apparently.
[11:20.030 --> 11:24.250]  But I won't go into too much detail about what worked for me and what didn't work.
[11:24.390 --> 11:27.350]  But I have found these exploits are definitely worth testing.
[11:27.590 --> 11:28.110]  I would say that.
[11:28.870 --> 11:33.130]  So, the correct frequency is all you have to do to mimic a key press, and you can get the door to open.
[11:33.890 --> 11:37.990]  Obviously, in the case where you had to dial somebody, they would have to say, you know, oh, I answered.
[11:38.130 --> 11:38.890]  And then you could press the tone.
[11:39.030 --> 11:49.890]  But if you can get to the point where, again, from a security design perspective, you can get to the point where it's giving you the same interface as they've given you, and you put that tone in, which is very easy to play back, especially with today's phones,
[11:50.410 --> 11:50.650]  you're in.
[11:50.890 --> 11:53.750]  And there are charts all over the place that tell you exactly which tones or which keys.
[11:53.930 --> 11:55.250]  It's not like this is secret stuff.
[11:56.150 --> 11:56.470]  Okay.
[11:56.610 --> 11:58.750]  So, exploit 2 has been widely discussed on the web.
[11:58.890 --> 12:00.510]  I really don't feel bad about talking about this.
[12:00.630 --> 12:03.090]  But I still find people don't know it, so I thought I'd share anyway.
[12:03.410 --> 12:05.190]  That is the vendor defaults, right?
[12:05.310 --> 12:12.590]  You go into these boxes, and a lot of apartment managers or building managers aren't really savvy or don't care about configuring these things.
[12:12.730 --> 12:14.290]  They put it in and they say, look, we're secure.
[12:14.610 --> 12:17.390]  When in reality, they haven't changed the default password, which is all zeros.
[12:17.390 --> 12:19.390]  And so, if you walk up to a box...
[12:19.390 --> 12:20.870]  This is a mini-key exploit in particular.
[12:21.270 --> 12:22.330]  If you walk up to this box...
[12:22.330 --> 12:23.750]  This is what was discussed widely on the web.
[12:23.970 --> 12:31.850]  So, you walk up to a box, you press star three times, you press the password, which is usually zeros, and then 99 pound is the command to get you in.
[12:32.170 --> 12:34.490]  So, 99 pound, after you've put in the password, opens the doors.
[12:35.490 --> 12:37.710]  A lot of people don't realize that there's all these sequence codes.
[12:37.830 --> 12:39.390]  You can program in multiple passwords.
[12:39.530 --> 12:42.330]  So, some of them have features that allow you to have key codes.
[12:42.430 --> 12:46.870]  You don't even need your key to the building anymore because you can start punching in the key codes to get in the building.
[12:48.310 --> 12:49.790]  Usually, they're not set up that way.
[12:50.150 --> 12:50.890]  Usually, they're set up...
[12:50.890 --> 12:55.470]  Or they should be set up so that one person has a password that's used to configure the system and then they lock it away securely.
[12:56.070 --> 13:04.690]  In fact, there's a way that you can verify the password has been entered properly because if you screw it up, you can't get back in the system and you have to reset it, which I'll show you here is just...
[13:06.490 --> 13:08.830]  You can just go ahead and reset the box, too, if you want.
[13:09.450 --> 13:16.630]  Some of them allow you to reset it to factory defaults and you're like, oh, I bet the password's 000000 and then I can open the door.
[13:17.610 --> 13:20.970]  So, there are definitely some strange flaws in how easy it is to program these.
[13:21.330 --> 13:24.090]  The programming interface actually is super, super simple.
[13:24.690 --> 13:28.450]  And this was probably really cool like in the early 80s or maybe even the late 70s.
[13:28.570 --> 13:34.430]  But in today's technology, you can imagine the chips you could put in, the things you could do, the interface, the programming you could do with these things.
[13:34.730 --> 13:38.050]  Even like with a touch screen that you could scroll, put a fingerprint on.
[13:38.690 --> 13:39.010]  Anyway.
[13:39.690 --> 13:41.130]  We get to the third exploit.
[13:41.790 --> 13:43.630]  And that's kind of based on the second one, right?
[13:43.770 --> 13:44.890]  So, they're so easy to program.
[13:45.070 --> 13:48.390]  They're so easy to get into a programming mode that you can go in and start messing around with them.
[13:48.510 --> 13:51.410]  And if you open them up, there's actually a program button on a lot of them.
[13:51.690 --> 13:52.870]  So, that's pretty cool.
[13:52.990 --> 13:55.050]  You push the program button and then you can just start working on them.
[13:55.550 --> 13:56.810]  There's also a keypad option.
[13:57.010 --> 14:01.550]  So, if you want to go into program mode, which you already saw, it was star, star, star, and then six zeros.
[14:02.710 --> 14:06.170]  A lot of this stuff, honestly, I pulled right out of the instruction guide, which you can download anywhere.
[14:06.690 --> 14:10.990]  You just go, I want to see a syntax and I want to see this model and I want to see how to install it.
[14:11.110 --> 14:18.690]  And then it says, here's the password and here's the program mode and here's the network, or here's the diagram inside, the circuit board and how it works, which I'll show you later.
[14:19.810 --> 14:21.330]  So, there's also an exit option.
[14:21.570 --> 14:22.170]  So, you don't want to stay...
[14:22.170 --> 14:24.890]  They warn you, don't stay in program mode because somebody might use it.
[14:24.990 --> 14:26.110]  But you're like, you know...
[14:27.110 --> 14:28.670]  Maybe I wasn't supposed to use it in the first place.
[14:28.970 --> 14:31.250]  And so, zero, zero, star, and then it has a timeout too.
[14:31.430 --> 14:33.330]  So, it'll knock you out after 60 seconds or something.
[14:35.010 --> 14:36.950]  Here you see the 10 is to verify your password.
[14:37.150 --> 14:43.150]  Because if you do go and hack one of these and take it over, you probably want to make sure you get your password right before you disconnect or it might set it back to the original.
[14:43.730 --> 14:45.670]  Another interesting thing, the feature set.
[14:45.750 --> 14:48.850]  I wanted to show the feature set for these boxes because it's so long.
[14:48.990 --> 14:53.290]  It's like amazing the things that they really can do with all this analog programming.
[14:54.490 --> 14:56.290]  This is just one example I thought would be interesting.
[14:56.510 --> 15:02.570]  So, you can remotely control the firmware and every single syntax box apparently since 1995 has had this feature.
[15:03.650 --> 15:11.110]  And if you're actually physically located you can press and hold the program button and enter 072 and that allows you remote control.
[15:11.350 --> 15:14.910]  So, now you can dial in from anywhere and you can go in and set things as you wish.
[15:15.130 --> 15:19.270]  Again, how convenient that they're using standard pots or plain old telephone.
[15:19.910 --> 15:21.330]  So, you can...
[15:21.330 --> 15:27.010]  I guess once you set that up for yourself as an attacker you can come back and make changes, add in key codes, right?
[15:27.010 --> 15:28.490]  So, you can get in without anyone noticing.
[15:30.510 --> 15:30.870]  Alright.
[15:31.090 --> 15:31.490]  Number four.
[15:32.050 --> 15:32.690]  Silent keys.
[15:33.190 --> 15:34.470]  Which is basically just picking the lock.
[15:34.750 --> 15:39.030]  But the difference here is that when you pick the lock there's a postman key first of all.
[15:39.190 --> 15:43.790]  And the postman key can be programmed so that it only allows them into a specific...
[15:43.790 --> 15:44.450]  well, the mail area.
[15:44.930 --> 15:46.430]  You know, you have the man trap essentially.
[15:46.630 --> 15:47.610]  So, they come in the first door.
[15:47.730 --> 15:49.750]  The mailboxes are there but they can't get in the second door.
[15:50.690 --> 15:51.410]  My study...
[15:51.410 --> 15:52.890]  Again, I did a very limited look.
[15:52.890 --> 16:00.950]  But my study found that nobody bothers to set up the two doors because it involves different relays it involves different wires much easier to just pull everything back plug it in, right?
[16:01.070 --> 16:01.510]  Save money.
[16:01.910 --> 16:07.610]  So, the postman comes in and it buzzes and usually he or she doesn't know if they're getting into both doors or one door.
[16:07.730 --> 16:08.810]  Sometimes they can tell, I suppose.
[16:09.010 --> 16:12.070]  But what I found is that very rarely are they set up properly.
[16:12.250 --> 16:14.510]  And the control relay this is going to be key later.
[16:14.790 --> 16:26.210]  The control relay is known to be just a simple way of when they put their key in and they turn it it just sends a signal it basically jumps to pieces of metal and then, boom, they're inside the building.
[16:26.490 --> 16:28.550]  The auxiliary is the same concept.
[16:28.770 --> 16:31.310]  You might have seen buttons that you have to punch to get out of a building.
[16:31.570 --> 16:32.230]  Sometimes magnets.
[16:32.430 --> 16:34.870]  You have to touch the magnet so it has to be like an actual person's hand.
[16:35.270 --> 16:35.810]  Same thing.
[16:35.990 --> 16:37.990]  So you can wire in those and then you can have an override.
[16:38.490 --> 16:42.650]  Both of these exploits are very easy, obviously, to interface with.
[16:42.790 --> 16:48.170]  Like you pull apart that button, you know, or you get something else that would be able to give you access somewhere else.
[16:48.250 --> 16:52.650]  You could run wires, you could splice and run it somewhere else and push that button on the outside, for example.
[16:53.530 --> 16:58.290]  So the postman and the auxiliary give you quite a few options if you want to do some wiring or you want to do a pick.
[16:58.590 --> 16:59.570]  You want to pick the lock.
[17:00.730 --> 17:01.710]  Okay, so number five.
[17:01.870 --> 17:03.770]  This is really what the presentation boils down to.
[17:04.270 --> 17:07.170]  So there was an epidemic of break-ins in San Francisco.
[17:07.390 --> 17:08.690]  Well, all over the city, of course.
[17:08.830 --> 17:15.450]  And this map, which you see on the right, is an actual topographical chart of crime, which some guys did.
[17:15.930 --> 17:21.970]  I keep a blog and I wrote about this a while back, but that stuff over on the right that's really tall is the highest amount of crime.
[17:22.150 --> 17:24.050]  So you have vandalism and assaults, right?
[17:24.250 --> 17:25.790]  Narcotics in certain parts of town.
[17:26.290 --> 17:31.350]  So there was this big epidemic, not in that mountainous part, but actually a little bit over where it's sort of a valley.
[17:31.490 --> 17:32.070]  We're kind of flat.
[17:32.610 --> 17:39.510]  And two people were arrested in March of this year and they apparently had been running a circuit for six to eight months at least.
[17:39.730 --> 17:45.990]  So when the police busted them, and they busted them based on fingerprints because they left their fingerprints at a scene of a crime and there was a surveillance camera.
[17:46.430 --> 17:54.250]  So they had a suspect who was this Gandhi person, ironically, and they went and they found five truckloads of stuff in this apartment.
[17:54.550 --> 18:00.030]  So it took them five full police giant, you know, semi-trucks to clean out the apartment of stolen goods.
[18:00.330 --> 18:03.450]  And it sort of started people wondering, like, how are they getting into all these places?
[18:03.590 --> 18:06.270]  Because there was a rash of break-ins, you know, broken windows and stuff.
[18:06.430 --> 18:15.450]  There were a lot of empty buildings they were going into, but there were also a lot of reports of people getting stuff stolen almost in broad daylight or at random times with no damage to the buildings.
[18:15.750 --> 18:15.770]  Right?
[18:15.930 --> 18:18.090]  Stuff was just getting, like, lifted right out of the hallways.
[18:18.270 --> 18:20.650]  And this is where a manager of a building contacted me.
[18:20.770 --> 18:25.430]  Because they had stuff on the walls in their, sort of, interior space that was just being taken.
[18:25.610 --> 18:30.690]  So art, mirrors, furniture, anything in, like, the secure garages, all this stuff was disappearing.
[18:31.110 --> 18:32.950]  Yet, there was no evidence of any break-in.
[18:33.130 --> 18:33.210]  Right?
[18:33.270 --> 18:35.430]  Nobody could figure out how they were coming in and where they were going.
[18:36.550 --> 18:40.910]  So one day, when they contacted me, they said, you know, now our box is broken too.
[18:41.050 --> 18:41.910]  It's like it's not even working.
[18:41.910 --> 18:43.270]  They must have messed with it.
[18:43.610 --> 18:44.490]  The postman can't get in.
[18:44.570 --> 18:45.390]  Our mail's not getting delivered.
[18:46.430 --> 18:47.430]  So I went and took a look.
[18:47.730 --> 18:48.690]  And I noticed...
[18:48.690 --> 18:49.490]  I don't know if you can see this.
[18:49.590 --> 18:50.510]  I tried to make it really clear.
[18:50.650 --> 18:51.010]  But the top...
[18:51.450 --> 18:52.270]  You see my hand there?
[18:52.830 --> 18:53.010]  Yeah.
[18:53.170 --> 18:55.910]  So the top, there's a little tiny lip that's been bent up.
[18:56.610 --> 18:58.790]  Just strategically placed right above that key lock.
[18:59.650 --> 19:02.130]  If you notice in the lower left, there's the postman key too.
[19:02.290 --> 19:02.430]  Right?
[19:02.510 --> 19:03.370]  They have their own separate key.
[19:03.450 --> 19:04.070]  Very secure looking.
[19:04.570 --> 19:06.890]  But at the top, there's that just tiny little lip.
[19:07.030 --> 19:09.170]  So you start to ask, like, how vandal resistant is this?
[19:09.230 --> 19:10.290]  Look how thin that metal is.
[19:10.290 --> 19:10.470]  Right?
[19:10.890 --> 19:11.610]  That's like tiny.
[19:11.790 --> 19:12.830]  Like a 32nd of an inch.
[19:14.770 --> 19:15.090]  So...
[19:15.630 --> 19:17.310]  I did a quick assessment just by looking at it.
[19:17.410 --> 19:19.070]  By, you know, taking it with my hand and opening it.
[19:19.170 --> 19:20.750]  And I was like, wow, this has a single lever.
[19:21.110 --> 19:25.310]  Like, the key that you turn sometimes puts bolts through the side.
[19:25.550 --> 19:25.750]  Right?
[19:25.890 --> 19:28.650]  You turn the key and it has two bolts that go through holes, for example.
[19:28.810 --> 19:29.830]  So it has much more resistance.
[19:30.010 --> 19:32.230]  This has a tiny little finger basically that moves up and down.
[19:32.550 --> 19:34.070]  So by prying that up, you're just...
[19:34.070 --> 19:36.430]  You're prying an eighth of an inch maybe, or less.
[19:36.630 --> 19:37.650]  You could do it with your key.
[19:37.810 --> 19:38.930]  You could do it with your screwdriver.
[19:39.730 --> 19:41.370]  So that was the first problem I noticed.
[19:41.610 --> 19:43.570]  Very thin construction on a lot of these boxes.
[19:43.830 --> 19:45.350]  And I started walking around and looking at other boxes.
[19:45.490 --> 19:46.530]  And again, I wasn't doing an assessment.
[19:46.710 --> 19:47.950]  But I just wanted to know is this typical?
[19:48.170 --> 19:48.790]  And pretty much, yeah.
[19:48.910 --> 19:50.970]  A lot of them have this very thin metal box.
[19:52.430 --> 19:57.390]  I don't think it would matter if it was flush because you'd still be able to pry in some cases to get in...
[19:57.390 --> 19:57.770]  It just...
[19:57.770 --> 19:59.930]  It matters how that lock is configured.
[20:00.230 --> 20:01.310]  Like, how that lip is.
[20:01.630 --> 20:03.550]  How much purchase it gets when it's locked.
[20:03.810 --> 20:07.210]  And so the second thing I noticed here is that it was closed but it was unlocked.
[20:07.450 --> 20:12.750]  So this was in an unlocked state like this with the lock actually turned to a locked state.
[20:12.910 --> 20:17.670]  And that's because they had bent it just enough so you could take your hand and pull and it was just barely touching it.
[20:17.810 --> 20:18.590]  So the resistance...
[20:18.590 --> 20:22.790]  In other words, somebody could walk up to this at any time of day and just sort of pry it open.
[20:23.050 --> 20:24.430]  And that really matters.
[20:25.470 --> 20:26.850]  This is what it looks like when you open it.
[20:27.170 --> 20:29.370]  Because when you pop it open it's just an empty box.
[20:29.590 --> 20:30.150]  It's ridiculous.
[20:30.450 --> 20:30.730]  It's...
[20:30.730 --> 20:32.630]  There's no protection at all of the circuit board.
[20:32.870 --> 20:34.910]  And incidentally, this is how you replace...
[20:34.910 --> 20:36.430]  Remember in the beginning I was talking about the paper.
[20:36.630 --> 20:41.330]  So if you want to be an apartment manager and people move in and move out and you're like, Oh my God, I have to replace this.
[20:41.430 --> 20:45.090]  You're constantly opening this box and closing this box and looking at the circuit board.
[20:45.330 --> 20:48.130]  And what you see are cables, jumpers, and labels.
[20:48.850 --> 20:49.830]  So why are those important?
[20:50.070 --> 20:53.330]  Well, first of all, you can tell from cables if you're familiar with circuit boards.
[20:53.450 --> 20:56.610]  If you've messed around with computers or you've messed around at all with any sort of electronics.
[20:56.890 --> 20:58.390]  You can tell what the cables essentially do.
[20:58.570 --> 20:59.590]  Some are meant to be pulled off.
[20:59.670 --> 21:00.490]  Some are meant to be put on.
[21:00.490 --> 21:03.410]  Some connect circuit boards together, for example.
[21:03.550 --> 21:05.270]  So you know that's where the communication channels are going.
[21:05.590 --> 21:08.530]  It's just really easy to figure out what's going on in these boards because they're really simple.
[21:08.810 --> 21:10.110]  And the second is the jumpers.
[21:10.210 --> 21:11.910]  Well, that means there's signal that's being jumped.
[21:12.050 --> 21:17.730]  So you're obviously going to do something if you start jumping them manually instead of having the computer or have these things do it from a signal.
[21:18.010 --> 21:19.290]  And the labels, of course, will.
[21:19.730 --> 21:21.430]  You know, if it says touch here to break in.
[21:23.190 --> 21:24.510]  And that's exactly what it says.
[21:24.510 --> 21:27.310]  So this little arrow, you know, it's pointing here.
[21:27.750 --> 21:31.730]  I noticed the board has a little statement there.
[21:31.850 --> 21:32.510]  It's a little printed word.
[21:33.810 --> 21:35.770]  And at first I was like, wow, what does that say?
[21:36.090 --> 21:37.670]  And then I thought, does this really matter?
[21:37.810 --> 21:42.690]  Because when I looked at the board a little closer, I realized there aren't a lot of jumpers that I would mess with anyway.
[21:43.510 --> 21:45.090]  And I'm not going to tell you where all the faults are.
[21:45.230 --> 21:46.210]  I mean, you can figure it out yourself.
[21:46.410 --> 21:49.510]  But I'll point this one out because it's in the instructions I downloaded.
[21:50.130 --> 21:50.990]  I'll tell you that, right?
[21:51.090 --> 21:55.970]  So we already talked about the postal lock and how they have to get in and they turn their key and they get a signal.
[21:56.250 --> 22:00.110]  Well, on the board it says postal lock and it has a very simple jumper.
[22:00.490 --> 22:02.210]  Like the most simple jumper you can imagine.
[22:02.350 --> 22:02.890]  Here's a highlight.
[22:03.390 --> 22:03.450]  Right?
[22:03.970 --> 22:04.910]  You pull that guy off.
[22:05.870 --> 22:06.870]  It says postal lock.
[22:06.970 --> 22:09.110]  You pull that guy off and you touch it with anything metal.
[22:10.910 --> 22:11.230]  Yeah.
[22:11.450 --> 22:16.790]  So if you have a screwdriver and you want to break in one that's never been broken into, you pop it and touch it and then you walk away.
[22:16.990 --> 22:18.430]  And it takes less than ten seconds.
[22:18.550 --> 22:19.710]  I would say less than five seconds.
[22:19.930 --> 22:23.090]  If one's already been broken into, of course, you don't have to bring a screwdriver.
[22:23.090 --> 22:25.050]  You can just pry it open and use your key.
[22:25.330 --> 22:28.410]  Like, I'm going to open my door with my key and touch the postal lock.
[22:28.550 --> 22:30.590]  It doesn't have to fit the lock because it will open up.
[22:31.670 --> 22:39.230]  And in this particular case, the reason that the system was broken and they asked me to look at it was because they had put that jumper back on incorrectly.
[22:39.450 --> 22:42.010]  So they pulled it off and put it back on to hide their tracks.
[22:42.230 --> 22:45.290]  And I found it in a way that was like just hanging off.
[22:45.390 --> 22:46.390]  I guess they're in a rush or something.
[22:47.110 --> 22:49.010]  But still, they're covering their tracks.
[22:49.950 --> 22:51.750]  And this goes back to my discussion earlier.
[22:51.970 --> 22:52.950]  That's why I bring up the risk.
[22:53.590 --> 22:59.370]  It's interesting to me that they were breaking in and stealing stuff that was just in the hallway, but they weren't actually breaking into the apartments.
[22:59.510 --> 23:02.610]  When I spoke to the police about this, they sort of said, oh, yeah, shrug their shoulders.
[23:02.870 --> 23:04.210]  You know, they didn't do real trespass.
[23:04.310 --> 23:12.610]  They just kind of like walked into the hallway, which I guess in prosecution, I guess if you're actually breaking the law, there's this whole concept of motive, means and opportunity.
[23:12.610 --> 23:16.290]  And there's this whole concept of how people rationalize the motive aspect of it.
[23:16.550 --> 23:25.470]  I think some people who work with these systems on a regular basis, and I mean criminals by that, people who are breaking in, might actually see this as not breaking in.
[23:25.610 --> 23:27.830]  At some point, they say, this thing is so easy to get into.
[23:28.070 --> 23:31.990]  I'm just walking in a public space and I'm taking what's just being left around by people.
[23:32.110 --> 23:34.190]  Almost like leaving stuff on the street, on the sidewalk.
[23:34.510 --> 23:36.970]  So you might see stuff outside on the sidewalk that's being dumped.
[23:37.110 --> 23:40.830]  They're looking inside your building and saying, well, you know, it's just protected by this keypad system.
[23:40.990 --> 23:42.350]  They must not really want to keep that.
[23:45.030 --> 23:46.630]  So here's what I downloaded off the web.
[23:46.890 --> 23:49.270]  You know, you can pull these for any one of the...
[23:49.270 --> 23:54.450]  I didn't put the full URL, but basically, if you want to search for one, let's say you're looking at the spectrum.
[23:54.790 --> 23:59.770]  So you would look for centex slash spectrum and then some combination dot pdf.
[23:59.950 --> 24:05.310]  And you will find the install guides which all of the vendors that sell these will give you.
[24:05.410 --> 24:07.610]  And in this case, you can see right there, it says postal lock.
[24:07.750 --> 24:09.070]  It tells you where on the circuit board it is.
[24:09.290 --> 24:21.870]  So if you want to prep yourself, you know, you first figure out what the box is, then you download the circuit diagram and then you know exactly, pop the box, go in, touch the postal lock, and you've entered the building.
[24:24.210 --> 24:28.610]  So, I'm moving a bit fast, but that leaves me with some opportunities.
[24:29.770 --> 24:31.970]  Obviously, the design of the box was the first thing that shocked me.
[24:32.150 --> 24:38.730]  When I saw how easy it was to break that lip open and just open the box and get in, I thought, well, you know, obviously, we should get a bigger box for this thing.
[24:38.870 --> 24:42.930]  You know, people should be out there selling safe, you know, really thick boxes, safe quality boxes.
[24:43.750 --> 24:48.250]  But when I spoke to the guys that sell these things, they actually told me, no, no, no.
[24:48.550 --> 24:50.170]  That's, you know, we see this all the time.
[24:50.310 --> 24:51.170]  People break in these things.
[24:51.290 --> 24:52.410]  I guess you guys haven't been updated.
[24:52.610 --> 25:02.270]  And when they say updated, they don't mean like we're going to bring in a new unit that's been updated to be more camper resistant or something that doesn't have postal lock printed on it or something that, you know, I don't know, can't be programmed,
[25:02.490 --> 25:04.490]  doesn't have zeros for its default.
[25:04.770 --> 25:05.910]  They don't change any of that stuff.
[25:06.030 --> 25:13.790]  When they say updated, they mean they're going to bring in a drill and drill three big holes and then put in these giant permanent screws that have a fancy head on them, right?
[25:13.870 --> 25:15.970]  The security screws designed by GM.
[25:16.090 --> 25:16.810]  Now they have a pin in them.
[25:16.890 --> 25:17.790]  They change them every few years.
[25:17.950 --> 25:25.190]  So you need a fancy screwdriver, which when I thought about it at first, I was like, that doesn't make sense because it defeats the whole purpose of the convenience.
[25:25.390 --> 25:28.690]  You no longer have a key to open, you know, the manager's going to be there for 10 minutes.
[25:28.690 --> 25:34.890]  But when you think about it from the attacker perspective, if a minute is too long for them and they move on, that's all we need, right?
[25:35.170 --> 25:40.570]  And I know for a fact, actually, after this box was fixed, they put three screws in the top.
[25:40.690 --> 25:45.610]  On that very top lip, they literally just drilled a hole in three spots and then put these security screws in.
[25:45.750 --> 25:51.230]  They were really long, like two inches long, even though that metal was only, you know, 32nd of an inch or maybe 16th of an inch thick.
[25:51.570 --> 25:54.350]  So they put these screws in and the building next door got broken into.
[25:56.590 --> 25:57.390]  That's pretty funny.
[25:58.850 --> 26:03.370]  So, I mean, there are a lot of famous security people that talk about that, how it's bad because you're just moving security.
[26:03.550 --> 26:05.790]  But when you think about it, that's kind of what you have to do, right?
[26:05.930 --> 26:08.350]  You just raise the bar enough and then they break into something else.
[26:08.510 --> 26:13.530]  And that's right now what I see as the solution offered by these companies that know that there's a problem.
[26:15.190 --> 26:15.570]  All right.
[26:15.630 --> 26:18.670]  So another thing that's an opportunity here is to change the codes and regularly test.
[26:18.670 --> 26:21.570]  And these boxes are not set up to have their codes change regularly.
[26:21.890 --> 26:31.210]  So there's definitely an opportunity for someone to come up with a box that has some programming language in it that has, like, expiration, for example, and requires you to update the codes.
[26:32.190 --> 26:36.070]  Maybe it has the ability to expire things that haven't been used in such a long time.
[26:36.210 --> 26:44.930]  So if no one's dialed an apartment or no one's dialed an office in 60 days or, you know, 360 days, something ridiculously high like that, well, then erase it, right?
[26:44.990 --> 26:45.710]  Get rid of those codes.
[26:46.430 --> 26:51.370]  So there's a lot of opportunity in just how the interface is set up or how the programming is done on these boxes.
[26:52.270 --> 26:54.990]  And then the last one, where I talked about upgrades, they don't really do it.
[26:55.150 --> 26:56.090]  That would be another opportunity.
[26:56.290 --> 26:58.930]  You could probably go to people and show them these exploits.
[26:59.430 --> 27:03.190]  For example, if you're selling boxes and you say, do you think that really is hard to get into?
[27:04.270 --> 27:08.290]  I mean, it's kind of sleazy, but at the same time, it would be good for the communities to know how bad they are.
[27:08.370 --> 27:10.910]  I don't think people realize how bad these are, managers and so forth.
[27:11.510 --> 27:15.690]  A flip side of that is, if you talk to insurance companies about this, they're the ones who are paying out.
[27:15.690 --> 27:19.130]  Especially when apartments are claiming on their manager's insurance.
[27:19.590 --> 27:21.750]  So they're going back and saying, I keep getting broken into.
[27:22.230 --> 27:24.210]  And they could say, well, what kind of box do you have?
[27:24.370 --> 27:29.250]  If the box isn't up to snuff, insurance companies could put some leverage on these guys to say, you're not upgrading them properly.
[27:29.390 --> 27:30.410]  You're not maintaining them properly.
[27:30.630 --> 27:32.710]  So I think there's a whole economics argument there as well.
[27:33.050 --> 27:40.930]  But I definitely encourage people to look at their boxes, figure out how old they are and how many people are moving in and out, whether the codes are changed, whether the thing can be opened up easily.
[27:41.390 --> 27:46.710]  So they have a better sense of what their true risk is, how vulnerable it is, and then how many threats there are in the neighborhood.
[27:48.010 --> 27:49.970]  So then I get into the more sophisticated opportunities.
[27:50.110 --> 27:52.130]  This is where I really get excited because I do a lot of this stuff.
[27:52.330 --> 27:55.010]  I've done video surveillance for a while for a lot of different reasons.
[27:55.270 --> 27:56.870]  And it's pretty interesting stuff.
[27:57.010 --> 27:58.710]  I'm a big fan of it as a detective control.
[27:58.870 --> 28:01.310]  I do not believe it's a very good preventive one.
[28:01.490 --> 28:04.510]  In fact, I've been asked to put up fake cameras and blinking lights and stuff like that.
[28:04.590 --> 28:05.930]  And I just say, you know, find somebody else.
[28:06.150 --> 28:07.470]  Because I don't believe in that philosophy.
[28:07.710 --> 28:09.550]  I think they can be preventive.
[28:09.830 --> 28:11.630]  Like, people can be deterred.
[28:11.630 --> 28:13.370]  But it's like locks can deter people.
[28:13.590 --> 28:15.710]  So you're just trying to keep the honest people out at that point.
[28:15.790 --> 28:16.750]  And that's not what they're good for.
[28:16.970 --> 28:19.090]  Like, you don't put locks on everything just to scare people.
[28:19.410 --> 28:21.150]  Like, you really are trying to prevent them with a lock.
[28:21.570 --> 28:23.570]  And with a camera, you're not really trying to prevent them.
[28:23.670 --> 28:25.990]  You're actually trying to detect stuff and look at it later.
[28:25.990 --> 28:32.510]  So the best way, in my opinion, to use these is to put opposing cameras up that would be looking at one of these boxes so you get a really clear view.
[28:32.790 --> 28:35.530]  And never look at the data unless the thing gets broken into.
[28:35.710 --> 28:37.810]  Which, of course, requires you to know that you've been broken into.
[28:37.930 --> 28:41.250]  Either by something being stolen or, as I talk about later, the tamper evidence.
[28:41.650 --> 28:47.810]  But the bottom line here is that the cameras, I think, are the real answer because these things are so weak.
[28:47.970 --> 28:50.910]  I don't think anyone's going to come out with a really, like, cheap, really sophisticated...
[28:50.910 --> 28:52.570]  Well, that's not entirely true.
[28:52.650 --> 28:55.690]  I mean, with Arduino and some other stuff, you could probably whip up a really cool system.
[28:55.690 --> 28:59.350]  But, that being said, the cameras are really, really useful.
[28:59.630 --> 29:02.690]  And not just from the opposing ones that are looking at the people coming in the building.
[29:03.070 --> 29:06.490]  I've been doing a lot of stuff lately with trying to see who's using the box when they dial in.
[29:06.950 --> 29:08.990]  So then I started thinking, why not put a camera in the box?
[29:09.130 --> 29:10.290]  Did you see how big that box was?
[29:10.570 --> 29:12.150]  That circuit board was so small.
[29:12.430 --> 29:16.530]  Like, you could put a really nice camera inside the thing that just records who comes up and punches it.
[29:17.750 --> 29:19.910]  Simple, simple opportunity to have something that's recording.
[29:20.050 --> 29:22.690]  Every time there's a signal somebody's touching it, it would record their face.
[29:23.850 --> 29:26.690]  So, wireless surveillance is another sort of freakish idea I had.
[29:26.990 --> 29:31.190]  I know for a fact that Bluetooth is being monitored and Macs are being monitored right now.
[29:31.410 --> 29:34.790]  So, everywhere you go with Bluetooth, right, people are picking up your signal and tracking your whereabouts.
[29:35.090 --> 29:42.470]  So, I started to think, it's unlikely that attackers are going to come with any kind of WiFi signal or radio signal, but they are generally wearing those ear pieces.
[29:42.670 --> 29:47.310]  I don't know why, but I see a lot of these guys that walk, you know, long black coats and they've got the ear pieces.
[29:47.430 --> 29:50.170]  Not like profiling, but we did actually catch one of these dudes.
[29:50.830 --> 29:53.570]  And so, I did get a profile of somebody who was part of this operation.
[29:53.770 --> 30:04.630]  But anyway, if you're profiling Mac addresses and then you have the timestamp of somebody getting into the building, a log maybe even, of when somebody entered the building, you would have pretty good evidence that it was that person because you could tie the Mac back to them.
[30:05.570 --> 30:10.630]  It can be hard to do, but there are databases of Macs and I'm not going to tell you where they are, but they exist.
[30:10.850 --> 30:12.370]  So, maybe that's another public service announcement.
[30:12.610 --> 30:14.250]  Like, if you use Bluetooth, they're being tracked.
[30:17.350 --> 30:21.650]  And the tamper evidence, I put that last because I really think that's like probably impossible.
[30:21.970 --> 30:31.970]  I don't know if anyone's going to bother doing that, but it would be really cool if the keypad wasn't supposed to be like giving out the open sesame commands or it wasn't supposed to be giving the like reprogram me commands.
[30:32.370 --> 30:38.010]  So, since it is a telephone system, I thought it would be really cool if it would just dial you and be like, hello, I just want to leave you a message.
[30:38.130 --> 30:38.950]  Somebody opened me today.
[30:39.590 --> 30:39.690]  Right?
[30:40.630 --> 30:42.690]  Are you sure you wanted to reprogram the password?
[30:44.210 --> 30:46.430]  Just want to let you know that the password's changed today.
[30:46.550 --> 30:47.070]  Something like that.
[30:47.190 --> 30:51.430]  And that would make it really, really easy for managers who don't want to be technical because they would just get a message.
[30:51.590 --> 30:52.930]  It would be like, hey, the box was opened.
[30:53.070 --> 30:54.370]  Hey, the password changed.
[30:54.890 --> 31:01.070]  You know, hey, there were like 69 failed attempts on this one, you know, one number, one tone.
[31:01.950 --> 31:03.250]  And then, of course, the PBX.
[31:03.390 --> 31:11.670]  I mean, that box is still, it's like the size of a PC almost when you start messing with it like a small desktop and you could probably put a nice PBX inside that thing and you could have it, you know, send mail.
[31:11.670 --> 31:14.130]  It's all on regular old wires.
[31:14.530 --> 31:19.830]  So you could use Ethernet, you could use plain old telephone and you could have it run in a small PBX that would do all sorts of cool stuff.
[31:20.010 --> 31:21.930]  Send mail and it would be pretty awesome.
[31:22.150 --> 31:33.050]  So I think there's a ton of opportunities in these things and it just started getting me, you know, thinking about them because I realized how simplistic they are and how there's this like veil of security that's being put on them that really doesn't exist at all.
[31:33.290 --> 31:37.230]  Like I figured out, and again, I'm not really telling you the full story here.
[31:37.330 --> 31:39.130]  I'm just giving you the parts that I think are public knowledge.
[31:39.530 --> 31:46.670]  But once I figured out that this is known, like when I talked to the security guys, when I talked to the police and they were like, oh, yeah, that happens.
[31:46.930 --> 31:49.350]  Or the security guy was like, oh, yeah, you haven't been upgraded with the screws.
[31:49.570 --> 31:51.790]  I was thinking, how many people really know this?
[31:51.910 --> 31:53.470]  You know, I haven't seen anyone talking about this.
[31:53.570 --> 31:55.410]  So I thought, well, maybe I would give it a shot.
[31:56.930 --> 31:58.210]  So that's it for my presentation.
[31:58.390 --> 31:58.630]  Thank you.
[32:10.780 --> 32:11.680]  Anybody have questions?
[32:13.660 --> 32:14.500]  I can't see.
[32:15.120 --> 32:15.320]  Yeah?
[32:15.540 --> 32:18.200]  You were mentioning one particular Centex system.
[32:18.440 --> 32:21.320]  Are you familiar with the Centex Ovation system?
[32:21.620 --> 32:22.720]  No, not the Ovation.
[32:23.060 --> 32:23.700]  I'm not.
[32:23.880 --> 32:25.040]  It's quite sophisticated.
[32:25.480 --> 32:33.100]  I've seen installation where they have the controller board controlling several buildings because they're too cheap to buy a board for every building.
[32:33.320 --> 32:40.340]  And one building, someone can go to the door and buzz someone in the other building and have someone in the other building venom into the first building.
[32:40.900 --> 32:47.360]  Well, one of the cool things about a lot of the higher end boxes and a lot of the badge systems is that you can do really cool, sophisticated things with them.
[32:47.480 --> 32:49.860]  But my experience has always been there's a human failure element.
[32:49.960 --> 32:52.880]  So I think that's another factor I didn't even talk about in this.
[32:52.980 --> 33:00.280]  So when you get to a level where you have these people who are involved, authenticating people who are asking for access is very, very difficult, I find.
[33:00.480 --> 33:01.760]  So the old pizza box, right?
[33:01.820 --> 33:05.040]  I'm here to deliver a pizza for somebody you don't know, but I swear they live here.
[33:05.180 --> 33:06.860]  That sort of thing works typically.
[33:07.100 --> 33:08.460]  So those are still vulnerable.
[33:08.460 --> 33:10.500]  But what I try to focus on here is the easy hacks.
[33:10.960 --> 33:16.480]  Like, I think if you put this into just a box that was a little bit better, I wouldn't have a presentation, right?
[33:16.800 --> 33:22.080]  I'm talking about how easy it is because these things have been deployed for at least two decades, maybe longer.
[33:22.260 --> 33:26.920]  And they're out there all over the place on people's buildings and no one's talking about them and no one's really fixing them or upgrading them.
[33:27.360 --> 33:28.720]  Probably not putting the screws in even.
[33:30.240 --> 33:33.700]  The system I'm familiar with is very tamper resistant.
[33:33.960 --> 33:35.020]  It's in a housing project.
[33:35.420 --> 33:35.560]  Yeah.
[33:35.920 --> 33:38.660]  Very, I mean you need a sledgehammer to break open the boxes.
[33:38.860 --> 33:40.040]  Yeah, they're definitely good examples.
[33:40.300 --> 33:43.040]  But unfortunately there's so many bad ones, that's the real issue.
[33:43.340 --> 33:53.900]  And if they wished, they could hook up other stuff so they would know at what time someone let somebody in and what apartment buzzed the lock open.
[33:54.060 --> 33:57.900]  Yeah, there's a whole other side to that argument which I audit data centers all the time.
[33:58.160 --> 34:00.200]  And I went into some like military-grade data centers.
[34:00.900 --> 34:07.260]  And the point at which you get so much information coming from these systems that people just gloss over is a problem as well.
[34:07.380 --> 34:13.100]  I've seen actually two data centers from the same company where one of them had a door that was failing and they couldn't fix it.
[34:13.180 --> 34:20.500]  And their level of frustration got to the point where they were just like, yeah, we get like three, four hundred alarms an hour and we just can't deal with it because the thing is open and we can't turn it off.
[34:20.840 --> 34:26.520]  And so they started ignoring all the alarms which obviously made them fail the audit because I went and alarmed another door and they didn't see it.
[34:26.520 --> 34:29.980]  But the other facility was like fixing things instantly.
[34:30.320 --> 34:34.340]  So you get outside the technology at some point and you just go, how are you managing the feedback?
[34:34.540 --> 34:35.520]  How are you managing the input?
[34:35.720 --> 34:36.500]  Who's paying attention?
[34:36.920 --> 34:38.060]  You know, who's keeping things clean?
[34:38.280 --> 34:42.300]  It really becomes a practice of managing things in a secure manner more than the technology.
[34:42.560 --> 34:50.840]  And that's where at the heart of this presentation is we're managing a lot of our buildings thinking that we've put some technology in place that is secure and it's not at all.
[34:50.960 --> 34:52.920]  So it's almost our fault for managing them that way.
[34:53.040 --> 34:56.400]  Or the managers who own those buildings or the people who are buying these systems and thinking they're
[35:02.560 --> 35:10.340]  Just wanted to add, there's another social engineering privacy attack vector, I guess, element of stupidity with the directory itself.
[35:11.160 --> 35:13.780]  I lived in an apartment and I had to fight with the manager.
[35:13.980 --> 35:16.440]  She didn't understand why I didn't want my name in the directory.
[35:16.660 --> 35:19.640]  Oh, no one will be able to, you know, get to your apartment.
[35:19.880 --> 35:22.300]  Well, it wasn't a code next to my name.
[35:22.420 --> 35:23.720]  It was my actual apartment number.
[35:24.300 --> 35:26.120]  So, great way to get to know your neighbors.
[35:26.520 --> 35:27.380]  Yeah, that's true.
[35:28.080 --> 35:30.860]  Yeah, I guess the good thing about breaking these boxes is you could go change that.
[35:31.060 --> 35:31.240]  Yeah.
[35:34.840 --> 35:39.300]  And also, I found just punching in codes 9-1-1 automatically buzzes you in.
[35:39.800 --> 35:40.200]  Oh, does it?
[35:40.240 --> 35:40.860]  I hadn't heard that.
[35:41.040 --> 35:41.100]  Yeah.
[35:42.840 --> 35:47.660]  I noticed on some of the newer systems, you push a button and it rings their phone.
[35:47.860 --> 35:50.420]  And when they answer the phone, they say, who is it?
[35:50.480 --> 35:51.960]  And then you'll say, it's whoever.
[35:52.240 --> 35:54.920]  Then they'll push three digits or two digits.
[35:54.960 --> 35:55.700]  You won't hear it.
[35:55.700 --> 35:56.960]  And then it'll let you in.
[35:57.140 --> 36:01.180]  Now, if you can social engineer what they're dialing, take your cell phone.
[36:01.300 --> 36:02.220]  When they say, who is it?
[36:02.280 --> 36:03.920]  Or maybe it's an answering machine.
[36:04.560 --> 36:06.360]  When they say, who is it?
[36:06.420 --> 36:08.840]  Take your cell phone and enter those numbers.
[36:08.960 --> 36:09.580]  Would that work?
[36:09.840 --> 36:10.660]  Yeah, that works.
[36:10.880 --> 36:11.660]  Well, some systems.
[36:11.820 --> 36:12.920]  Again, the technology depends.
[36:13.180 --> 36:19.020]  But a system that's just in a state that's listening for the tone and you replicate the tone, you wouldn't have to dial your phone.
[36:19.020 --> 36:21.740]  You could just have an MP3 file that has the right tone frequencies, right?
[36:21.820 --> 36:22.620]  The plays of the right tone.
[36:22.800 --> 36:24.460]  If you can get it to work, it would play it and it would...
[36:24.980 --> 36:27.440]  But you have to play it as...
[36:27.440 --> 36:28.740]  The tone has to be correct.
[36:29.040 --> 36:30.540]  You basically have to ring anyone.
[36:30.820 --> 36:31.880]  And when they say, who is it?
[36:31.900 --> 36:33.020]  You just enter whatever...
[36:33.640 --> 36:33.900]  Right.
[36:33.900 --> 36:40.700]  And that's why I said earlier on that if you just press the pound key on some of these systems, it gives you that tone that allows you to push the command in.
[36:40.700 --> 36:42.720]  So, right, if it's just one key.
[36:43.000 --> 36:44.460]  So, it depends on the system.
[36:44.600 --> 36:45.440]  But yeah, some of them are vulnerable.
[36:45.540 --> 36:48.300]  Well, if you don't know the code, then you're going to have...
[36:48.300 --> 36:54.380]  I found that a lot of them... I mean, I can't say too much, but I think a lot of them have very simple codes that aren't changed.
[36:55.100 --> 36:56.300]  You know, default codes.
[36:56.820 --> 36:57.040]  Yeah.
[36:59.000 --> 37:06.120]  During the course of your field study, what was the average compromise time for someone approaching a box to having entry into the building?
[37:06.680 --> 37:13.680]  Well, I did a very small study, but I mean, that was the shocking thing was this didn't take longer than it would take you to touch a circuit board.
[37:13.980 --> 37:16.480]  So, the box is open and it swings open freely.
[37:16.680 --> 37:18.440]  So, it was just precariously closed.
[37:18.740 --> 37:23.900]  So, it looked like it was in a closed state, but in fact, you could just open it and touch and the doors would open.
[37:24.040 --> 37:26.140]  So, less than five seconds, ten seconds, I don't know.
[37:26.320 --> 37:36.080]  I guess my point there really is that for a criminal who has a motive of going in some place that's easy to get into, this is like having a big button on your door that you press and it opens.
[37:36.460 --> 37:38.560]  I mean, it's just wide open to them at that point.
[37:38.740 --> 37:45.480]  So, I think it would be hard to say to that person, how dare you come into this building when it's so obvious and so easy to them because they know.
[37:45.800 --> 37:51.320]  It's the people who don't know and think, gosh, you know, this is a really secure system that we're being fooled.
[37:55.650 --> 37:56.390]  Any other questions?
[37:58.070 --> 38:07.490]  With the Centex Ovation system, of course, you push in a code to ring someone's apartment, but you can program different codes for the apartment.
[38:07.750 --> 38:13.530]  So, if someone's getting, you know, harassing people, buzzing their apartment, the number can be reprogrammed.
[38:14.050 --> 38:20.070]  And I've tried, I've got to do it again, the default passwords for programming and I didn't get any place.
[38:20.210 --> 38:23.370]  I downloaded the manual from the Internet also for the Ovation.
[38:23.650 --> 38:25.630]  Yeah, it really depends on who's managing the box.
[38:25.630 --> 38:29.890]  I mean, it comes down to, if they put a secure box in and change the codes, you're better off.
[38:30.070 --> 38:44.910]  At one time, the disconnected from the phone system, now they have a box on the wall in the apartment, but when it was working with the phone system, I recorded the Touch-Tone on my answering machine, hoping that from the outside I wouldn't need a code,
[38:45.070 --> 38:48.070]  I would just ring my apartment and the answering machine would give the code.
[38:48.250 --> 38:49.210]  That did not work.
[38:49.430 --> 38:53.590]  Yeah, I guess at that point I'd emphasize, if you're not authorized to be testing those systems, I wouldn't mess with them.
[38:53.650 --> 38:54.450]  I won't test my own apartment.
[38:54.450 --> 38:58.030]  But I still wouldn't even, I wouldn't even test my own because I don't own it.
[38:58.150 --> 39:00.930]  I mean, if I bought one of these things and I tested it, that would be different.
[39:01.090 --> 39:04.990]  And if Centex hired me to test it, which I'm happy to do, by the way, that would be different.
[39:05.150 --> 39:09.410]  But in this case, I was just asked by a manager, could I help figure out what was wrong, how people were getting in?
[39:09.470 --> 39:09.950]  So I did.
[39:09.950 --> 39:13.970]  And then I thought, other people should know about this, because it seems like public information already.
[39:14.130 --> 39:15.270]  So I might as well make it more public.
[39:16.270 --> 39:23.570]  What would you suggest to defeat, to make it so that you cannot enter?
[39:23.770 --> 39:28.570]  Like, I tried on one system where when the answer I entered, I knew what the code was.
[39:28.730 --> 39:29.830]  I entered it on my cell phone.
[39:29.930 --> 39:30.710]  It did not work.
[39:31.590 --> 39:33.350]  Well, I think this is like any product.
[39:33.530 --> 39:36.810]  You could go to the vendor and say, this is the vulnerability I'm worried about.
[39:37.030 --> 39:38.290]  Can you tell me that this isn't vulnerable?
[39:38.550 --> 39:42.250]  And you can either test it to validate it, or they can explain it to you in a way that you can see it's not vulnerable.
[39:43.730 --> 39:45.870]  Or maybe it wasn't loud enough to tell them.
[39:46.090 --> 39:46.210]  Yeah.
[39:47.230 --> 39:49.390]  I mean, if you go look at the feature set on the...
[39:49.390 --> 39:54.210]  If you download the feature set that comes with a lot of these things, it explains the security it has.
[39:54.350 --> 39:55.910]  So they keep updating that.
[39:56.110 --> 40:01.190]  But the problem is that a lot of them are deployed and they're old, and so they have a lot of the vulnerabilities that I expressed here.
[40:01.310 --> 40:03.210]  Sort of like red boxing, you know, sometimes.
[40:05.610 --> 40:08.990]  I was wondering if you could speak to how many major manufacturers...
[40:09.470 --> 40:11.090]  How many vendors are there, really?
[40:11.310 --> 40:20.270]  Or how many individual models are there deployed across, like, you know, multi-dwelling residential and commercial buildings in the U.S.?
[40:20.270 --> 40:21.850]  You know, that's an interesting question.
[40:21.890 --> 40:26.550]  I really got interested in that for a little while, and then I realized I didn't want to know, like, more than I want to know.
[40:26.550 --> 40:28.690]  Like, I think somebody should do a study, honestly.
[40:28.890 --> 40:34.150]  I think someone should go out and do a survey of urban areas and figure out how many boxes there are and what version they are.
[40:34.270 --> 40:41.290]  It's the same thing as doing a simple assessment of an environment to figure out, right, how many versions of an operating system you have, what age they are, whether they're patched or not.
[40:41.590 --> 40:42.530]  I didn't do it, no.
[40:42.970 --> 40:45.390]  And do you have any sense of whether the vendors...
[40:45.390 --> 40:49.610]  You probably wouldn't know this, but I'm also curious about whether the vendors are in the U.S.
[40:49.930 --> 40:58.690]  also tend to be, you know, deploying and selling and distributing worldwide or whether specific geographic localities have different concentrations or something like that.
[40:58.830 --> 40:59.850]  No, I didn't look into that.
[41:00.230 --> 41:00.830]  No, those are really good.
[41:00.890 --> 41:01.890]  I mean, that's what I hope to spur.
[41:02.030 --> 41:07.250]  I mean, maybe somebody's already doing this and I haven't seen it, but I think a university would be a prime place for some students to go figure this out.
[41:07.650 --> 41:10.390]  They'd have the time, the cycles, the manpower to go out and...
[41:11.250 --> 41:11.570]  Yeah.
[41:12.310 --> 41:15.890]  So what happens exactly when there's like an overload in the circuit?
[41:16.050 --> 41:18.230]  Does the lock default to a certain position?
[41:18.470 --> 41:20.470]  Because there are a whole bunch of other vulnerabilities.
[41:20.870 --> 41:22.130]  I did read about some of that.
[41:22.290 --> 41:24.250]  It actually had some stuff where...
[41:24.250 --> 41:32.850]  So I know from personal experience on other tests that a lot of stuff that gets overloaded will fail open if you're on the inside, but if you're on the outside, it will stay locked.
[41:33.070 --> 41:35.210]  So depending on which box you tamper with?
[41:35.730 --> 41:37.410]  This is a good place to talk about telecoms, right?
[41:37.410 --> 41:40.750]  The telecom used to have this problem where they had battery backups for the keys on the doors.
[41:40.750 --> 41:45.270]  And so if the battery died, you could not get back into these offices.
[41:45.730 --> 41:52.530]  Sometimes, like, CO would have a door that they had to break down to get back inside because the battery died that allowed them to fail, right?
[41:52.630 --> 41:55.430]  So if it failed and the battery wasn't there, you couldn't get back inside.
[41:55.670 --> 41:55.710]  It had to be open.
[41:55.930 --> 41:56.110]  Yeah.
[41:56.550 --> 41:57.510]  But you could get outside.
[41:57.790 --> 41:58.050]  Sure.
[41:58.210 --> 41:58.970]  A quick follow-up.
[42:00.090 --> 42:06.590]  Do you know how the circuitry is actually protected from, let's say, an attack like that if you were going to...?
[42:06.590 --> 42:10.050]  Well, the first thing that occurs to me when I open this box is that the circuit board is exposed.
[42:10.410 --> 42:10.690]  Completely.
[42:10.690 --> 42:12.850]  And I did not talk about all the different jumpers I found.
[42:12.850 --> 42:15.270]  But, I mean, you wouldn't break open the box just to short it out.
[42:15.490 --> 42:16.190]  I mean...
[42:16.190 --> 42:17.050]  Well, that's what people do.
[42:17.370 --> 42:19.230]  Conceivably, there would be some kind of way to...
[42:19.230 --> 42:19.990]  No, that's what people are doing.
[42:20.150 --> 42:21.610]  They just open the box because it's that easy.
[42:22.430 --> 42:26.250]  But assuming that you couldn't open the box, yeah, there's another way to get at it because it has a hole in the back.
[42:26.410 --> 42:28.590]  And, I mean, you can get into a lot more detail than I got into here.
[42:28.670 --> 42:31.470]  I did a lot more research and stuff, but I'm just showing you the easy stuff, right?
[42:31.790 --> 42:34.230]  Once you get into the hard stuff, well, then your motive is probably a lot higher.
[42:34.350 --> 42:35.370]  You're really trying to get in the building.
[42:35.370 --> 42:38.830]  I'm talking about people who are walking down the street and going, Oh, look, it's a Sentex, you know.
[42:38.970 --> 42:40.290]  I'm going to walk in here and grab a painting.
[42:44.510 --> 42:47.370]  Did you... have you fiddled with Altronics or Hirsch?
[42:47.790 --> 42:49.290]  No, I just looked at this one box.
[42:49.430 --> 42:49.730]  Okay, yeah.
[42:50.790 --> 42:52.490]  That was just the one system they asked me to look at.
[42:52.710 --> 42:55.370]  So, I mean, I think they're all probably going to have different issues.
[42:56.150 --> 42:58.150]  And it depends on their age, right?
[42:58.710 --> 43:00.530]  But the fact is they were so exposed.
[43:00.730 --> 43:01.530]  So, it's so easy to open.
[43:01.730 --> 43:02.990]  It's so easy to look at the circuit board.
[43:03.150 --> 43:03.570]  It's exposed.
[43:03.770 --> 43:04.490]  It's so easy to read.
[43:05.230 --> 43:06.810]  You can read online what you need to do.
[43:06.930 --> 43:08.650]  You can read on the circuit board where you need to do it.
[43:09.090 --> 43:10.370]  It's all, like, very easy.
[43:10.570 --> 43:12.510]  It's like elementary electronics.
[43:14.310 --> 43:14.630]  Okay.
[43:15.050 --> 43:15.530]  Thank you.
[43:15.530 --> 43:15.650]  Thank you.
[43:16.030 --> 43:16.230]  Thank
[43:21.500 --> 43:22.420]  you.
[43:22.420 --> 43:22.540]  Thank you.
[43:22.640 --> 43:23.520]  Thank you.
[43:23.860 --> 43:24.340]  Thank you.