[00:04.760 --> 00:10.540]  Alright, moving into Friday night at HOPE.
[00:12.700 --> 00:14.380]  Can you turn this up a little bit?
[00:18.080 --> 00:18.760]  Hello.
[00:21.260 --> 00:21.940]  Housekeeping!
[00:25.600 --> 00:46.980]  Just a reminder, there's all sorts of 2600 goods for sale, back issues, t-shirts, conference t-shirts, as well as strange money from other countries that was smuggled out by Emmanuel that's got Tesla on it.
[00:46.980 --> 00:53.800]  So, if you'd like to own some smuggled currency that I believe has been in Emanuel Goldstein's pants.
[00:54.520 --> 00:54.920]  Woo!
[00:56.020 --> 00:57.400]  Well, that's how you smuggle it, right?
[00:57.480 --> 00:58.100]  You crotch it.
[00:58.540 --> 01:01.680]  Unless you have one of those horrible body scanners where they can see your penis.
[01:02.080 --> 01:03.000]  Ooh, crotch money.
[01:05.200 --> 01:11.740]  So, before these gentlemen get started, I would remind you that the Hotel Pennsylvania has been very kind to us.
[01:11.920 --> 01:15.100]  So, make sure with this information that you do no harm.
[01:15.640 --> 01:20.520]  There's a lot of hotels within a few blocks that we're not associated with.
[01:20.520 --> 01:30.220]  So, as the old saying goes, don't shit where you eat.
[01:31.860 --> 01:32.960]  They don't serve food.
[01:32.980 --> 01:34.300]  Or don't shit where you hack.
[01:37.260 --> 01:43.260]  If you're not familiar with TOOOL, this organization has released some amazing videos online.
[01:43.760 --> 01:49.800]  Locks that people claim are unbreakable and unhackable in seconds are opened.
[01:49.940 --> 01:52.240]  It makes you feel really safe in your own home.
[01:52.740 --> 01:56.940]  Their website is a good peruse if you're ever looking to check that out.
[01:57.040 --> 01:59.820]  And I believe that you guys are downstairs at the Lockpicking Village.
[02:00.200 --> 02:00.840]  Yes, we are.
[02:00.920 --> 02:07.600]  So, if you want to sit down and go hands-on and try to pick a lock, they'll definitely help you out.
[02:07.700 --> 02:09.340]  Did you bring the lockpicks that you're selling?
[02:09.560 --> 02:09.720]  No, you didn't.
[02:09.780 --> 02:11.440]  Show of hands, who's been to the village already?
[02:11.820 --> 02:12.220]  Yes.
[02:12.220 --> 02:13.480]  Who is going to come later?
[02:15.320 --> 02:24.280]  I can attest to how well these work because I locked myself out drunk and I was able to pick into my own home, which worked out well.
[02:24.540 --> 02:25.700]  What was that address?
[02:26.100 --> 02:26.860]  Right, exactly.
[02:32.020 --> 02:35.300]  So, this is Lockpicking with Deviant and Babak.
[02:37.780 --> 02:38.520]  Thank you.
[02:39.800 --> 02:40.720]  Thank you, everyone.
[02:41.460 --> 02:55.220]  First and foremost, I have to put out a word to Hananbari, which unfortunately could not be here today due to, as Deviant mentioned, a variety of reasons, the main one being health-related.
[02:56.100 --> 03:01.920]  Nothing major, major enough where they couldn't be here today, but not so major where things are not going to be resolved well.
[03:03.420 --> 03:07.400]  Yeah, we look forward to seeing them soon and wish them well if you see them online.
[03:07.660 --> 03:08.100]  Absolutely.
[03:08.400 --> 03:13.360]  And we thank you guys for letting our bumbling asses come instead of the rock stars that they would have been.
[03:13.360 --> 03:13.780]  Yep.
[03:15.180 --> 03:15.740]  All right.
[03:15.940 --> 03:17.700]  So, let's just rock with this.
[03:17.800 --> 03:18.180]  Absolutely.
[03:18.180 --> 03:18.560]  Okay.
[03:18.560 --> 03:21.680]  The title of this talk is actually, you know, housekeeping.
[03:23.180 --> 03:24.660]  Hacking hotel locks.
[03:24.920 --> 03:25.200]  Indeed.
[03:25.400 --> 03:29.880]  There's a lot of lock mechanisms around hotels and all of them do really funky stuff.
[03:31.020 --> 03:33.460]  So, hotel rooms are supposed to be a nice little sanctuary.
[03:33.800 --> 03:35.980]  It's supposed to be your little place home away from home.
[03:36.140 --> 03:39.740]  This cozy little spot that you can be comfortable and you can be yourself.
[03:40.040 --> 03:42.920]  They're not always this swank when you travel as much as we do.
[03:43.520 --> 03:44.900]  But sometimes, you know...
[03:44.900 --> 03:46.180]  And this is a pretty swank hotel.
[03:46.320 --> 03:47.080]  This is, oh yeah.
[03:47.220 --> 03:47.740]  It's very swank.
[03:48.800 --> 03:51.260]  It's like the Waldorf, but you know, here in Midtown.
[03:51.680 --> 03:51.920]  Okay.
[03:52.500 --> 03:54.300]  So yeah, you know, you want to just curl up.
[03:54.420 --> 03:56.360]  You want to curl up and sleep or not sleep.
[03:56.500 --> 03:57.000]  Either way.
[03:57.860 --> 03:59.380]  Your room should be your room.
[03:59.380 --> 04:01.320]  It shouldn't be with your friends kicking the door down.
[04:01.440 --> 04:02.780]  You don't want to be this guy.
[04:04.000 --> 04:06.940]  And we're going to hopefully teach you how to not be this guy.
[04:07.120 --> 04:09.780]  Or, you know, if that's your girlfriend, how to come in on this guy.
[04:09.900 --> 04:10.260]  I don't know.
[04:11.800 --> 04:13.180]  So yeah, let's just simply...
[04:13.180 --> 04:20.480]  Let's talk about hotel room doors and some of the really cool hacking that Bari and Han had put together for this talk, which was in the program as you saw.
[04:20.620 --> 04:23.380]  If you were expecting to see their awesomeness, you're about to.
[04:23.560 --> 04:23.880]  Babak?
[04:25.960 --> 04:28.880]  So, this is an interesting tool.
[04:28.880 --> 04:32.400]  Apparently, it has been around in the intelligence community for a while.
[04:32.900 --> 04:37.900]  And it was discovered and publicized a little bit recently by Bari and Han.
[04:38.960 --> 04:43.380]  And it's, for lack of a better word, the under door tool.
[04:43.680 --> 04:45.480]  It's very aptly named, as you will see.
[04:45.780 --> 04:48.120]  And we happen to have one right here that our...
[04:48.120 --> 04:52.360]  One of the other tool directors, Eric Michaud, was able to weld together.
[04:52.640 --> 04:54.000]  It's a very fine welding, sir.
[04:54.160 --> 04:54.520]  Thank you.
[04:57.440 --> 04:59.440]  So, this is a video they had actually prepared.
[04:59.740 --> 05:01.900]  And we're just going to play it for you in their stead.
[05:02.800 --> 05:03.760]  Yeah, they were at...
[05:03.760 --> 05:04.420]  It was one of the...
[05:04.420 --> 05:05.980]  Was it the Essen security show, I think?
[05:06.580 --> 05:06.900]  Uh...
[05:06.900 --> 05:08.000]  No, it was iDefense.
[05:08.220 --> 05:08.540]  ITDefense.
[05:08.540 --> 05:09.160]  Yes, yes.
[05:09.160 --> 05:09.720]  In Brühl, Germany.
[05:10.320 --> 05:11.820]  So, yeah, they're saying the lock is nice.
[05:12.000 --> 05:12.280]  It's not shim-proof.
[05:12.280 --> 05:13.400]  It's a nice shim-proof lock.
[05:13.540 --> 05:14.480]  It's a deadbolt, right?
[05:14.620 --> 05:16.420]  Meaning so you can't just slip the latch, so to speak.
[05:16.560 --> 05:19.760]  But there are other ways of getting in without, you know, hacked key cards.
[05:22.580 --> 05:24.100]  So, he's sliding in the tool.
[05:24.600 --> 05:26.660]  And what he's doing is he's tilting it up.
[05:26.820 --> 05:30.080]  And he's going to rock it over the door handle from the inside.
[05:30.460 --> 05:32.120]  Which has that safety release, right?
[05:32.280 --> 05:33.140]  You have to...
[05:33.560 --> 05:35.060]  And oh, he's in.
[05:37.880 --> 05:38.240]  So...
[05:39.320 --> 05:40.040]  Yeah, that's...
[05:40.040 --> 05:41.080]  It's pretty simple.
[05:41.760 --> 05:43.400]  And here is the video from the inside.
[05:45.340 --> 05:47.240]  You think it's a still frame, but no, there it is.
[05:47.240 --> 05:47.860]  No, there it is.
[05:47.980 --> 05:48.620]  So, there's the tool.
[05:48.620 --> 05:49.920]  It's going to swing upward.
[05:50.500 --> 05:51.640]  And it's got a string.
[05:51.820 --> 05:54.680]  It's going to hook around the door handle and whoop!
[06:00.030 --> 06:04.090]  Isn't it awesome when, like, the best attacks are the simplest ones that anyone can come up with?
[06:04.110 --> 06:04.750]  But don't panic.
[06:04.970 --> 06:05.830]  There's a solution.
[06:06.430 --> 06:11.290]  As every geek knows, the most masteriest thing you can have is a towel.
[06:12.030 --> 06:14.030]  Thankfully, you all know where your towel is.
[06:14.150 --> 06:15.110]  It's in your restroom.
[06:15.310 --> 06:16.870]  Stick it in the door handle and bam!
[06:17.330 --> 06:19.650]  No one can now use this trick.
[06:21.650 --> 06:23.790]  So, as a result...
[06:28.730 --> 06:36.850]  As a result, we at TOOOL have decided to make Mr. Douglas Adams an honorary TOOOL member post-mortem.
[06:36.990 --> 06:38.710]  Because he really had it going on.
[06:38.870 --> 06:39.530]  In his memory.
[06:40.030 --> 06:40.350]  Yes.
[06:40.550 --> 06:41.330]  Excellent, excellent.
[06:42.210 --> 06:44.990]  Who knew Hitchhiker's Guide was also a security manual?
[06:44.990 --> 06:45.350]  Yeah.
[06:46.850 --> 06:48.870]  So, let's say you're afraid of this attack.
[06:49.090 --> 06:53.630]  Which, by the way, how many people followed that whole Mossad-Hamas assassination scandal?
[06:53.990 --> 06:58.030]  It's a lot of people who believe this was one of the tools used in the process.
[06:58.250 --> 07:00.530]  And some other trickery used that we're about to cover here.
[07:01.930 --> 07:04.170]  There's no easy way of logging this, right?
[07:04.170 --> 07:08.010]  I mean, even if you have electronic key cards, there's no access logs for this.
[07:08.390 --> 07:09.110]  Uh-huh.
[07:09.110 --> 07:15.690]  I don't think there's actually any hotel locks that record or audit, you know, doors being opened from the inside.
[07:15.850 --> 07:18.110]  Because that seems like a kind of a silly thing to log or to audit.
[07:19.990 --> 07:20.710]  Right, right.
[07:20.710 --> 07:27.310]  So, it really currently is very difficult to figure out if a room was open using this attack.
[07:27.590 --> 07:30.030]  We haven't had the time to look at everything forensically.
[07:30.110 --> 07:30.290]  Right.
[07:30.390 --> 07:32.230]  We haven't had the time to do it here at all, either.
[07:32.430 --> 07:32.630]  Right.
[07:32.770 --> 07:33.290]  So, yes.
[07:35.550 --> 07:35.950]  Yes.
[07:36.390 --> 07:38.530]  So, let's say you're afraid of this attack.
[07:38.670 --> 07:40.570]  And you're like, all right, well, I don't want people just barge in.
[07:40.670 --> 07:44.090]  I'm going to use these extra, you know, the extra features that some hotel doors have.
[07:44.370 --> 07:45.870]  A little bit older is the chain.
[07:46.090 --> 07:47.110]  It's not always what you see today.
[07:47.130 --> 07:49.870]  But there's plenty of ways of breaking through this chain.
[07:49.870 --> 07:51.930]  No, this is not Johannes' sex talk.
[07:52.230 --> 07:53.670]  This is, uh...
[07:53.670 --> 07:54.730]  These are different ways.
[07:56.790 --> 08:00.590]  So, first of all, some of these chains, you would be amazed at how badly they're installed.
[08:00.830 --> 08:03.910]  And with your common criminal today being a meth head, being really skinny.
[08:04.190 --> 08:05.750]  Like, this is really possible.
[08:06.070 --> 08:07.270]  This kid is not a meth head.
[08:07.650 --> 08:08.270]  No, this is just a nice kid.
[08:08.270 --> 08:09.650]  This is just an innocent kid on YouTube.
[08:12.750 --> 08:14.210]  He had a shirt from the Midwest.
[08:14.210 --> 08:14.850]  He's a meth head.
[08:16.990 --> 08:18.410]  You're not in Iowa anymore, sir.
[08:19.870 --> 08:20.810]  Still an Iowa resident.
[08:21.050 --> 08:21.150]  Right.
[08:21.310 --> 08:25.730]  Now, this is a video that Bari put together also documenting fun things you can do with chains.
[08:25.950 --> 08:34.870]  Again, as long as you can get your hand in the door at all, you can sort of trick around and play with rubber bands and elastic and tape and all kind of things.
[08:35.010 --> 08:38.230]  Some people say this is a method for re-locking the chain.
[08:38.390 --> 08:44.350]  They think the assassination that the Mossad had pulled off might have re-locked the chain, making it look like a suicide or natural death.
[08:44.350 --> 08:47.710]  But, again, if you want to unlock the chain, the same principle applies.
[08:48.390 --> 08:50.230]  Try to reach around as best you can.
[08:51.410 --> 08:54.970]  Reaching around and rubbers together is not... you know, it doesn't work well, but...
[08:54.970 --> 09:00.470]  As we've said before, the phrase, that's what she said, works all the time.
[09:00.550 --> 09:02.250]  With every lockpicking demo you ever gave.
[09:02.250 --> 09:02.790]  Every single...
[09:02.790 --> 09:02.990]  Yes.
[09:03.610 --> 09:04.530]  Is that what he said?
[09:05.010 --> 09:05.410]  Yes.
[09:05.630 --> 09:06.990]  That is exactly what I just said.
[09:06.990 --> 09:07.330]  Thank you.
[09:07.410 --> 09:08.190]  And you pull it shut and...
[09:08.190 --> 09:09.010]  Oh, look at that!
[09:09.370 --> 09:09.730]  Blam!
[09:09.830 --> 09:10.150]  Boom.
[09:11.470 --> 09:11.830]  Whoop!
[09:17.080 --> 09:19.340]  So, yeah, I mean, the chain is pretty well unbusted.
[09:19.520 --> 09:20.440]  The chain is awful.
[09:20.440 --> 09:24.860]  If you still use one on your house, you're probably in a rent control apartment here in New York City.
[09:25.240 --> 09:26.420]  Because it's really old.
[09:27.160 --> 09:28.340]  Modern buildings don't have them.
[09:28.480 --> 09:31.020]  Modern buildings have, you know, things like this when you go out to Vegas.
[09:31.020 --> 09:32.100]  Yeah, that looks nice, right?
[09:32.240 --> 09:33.820]  I mean, this hotel has them.
[09:34.280 --> 09:34.640]  Absolutely.
[09:34.660 --> 09:35.580]  It's the new wave.
[09:35.620 --> 09:36.880]  It's the new wave, that's right.
[09:36.980 --> 09:37.640]  No, it's really not.
[09:37.640 --> 09:38.720]  Look at that, it's not a chain.
[09:38.720 --> 09:46.660]  Because if you're going to do a bunch of drugs off the back of a hooker, you might think that, like, oh, hotel security can't come in and get me because I've got this, you know, bar on my door.
[09:46.880 --> 09:50.000]  Now, every hotel security man has one of these in his arsenal.
[09:50.200 --> 09:52.520]  It's called a slapper tool, for lack of a better term.
[09:52.800 --> 09:54.700]  You just get it in place and then...
[09:57.160 --> 09:57.560]  Pow!
[09:58.360 --> 09:58.480]  Yeah.
[09:58.520 --> 10:04.140]  If it looks like just a really thin, bent piece of metal, that's because it is just a really thin, bent piece of metal.
[10:04.740 --> 10:11.480]  Now, let's say you, you know, you don't have one of those because you lost one if you're a security man in the, in the, like, oh man, who's got the slap tool?
[10:11.600 --> 10:13.800]  We've got to evict all these deadbeat guests from HOPE.
[10:14.060 --> 10:15.500]  They're all being used right now.
[10:15.640 --> 10:16.420]  I can't get in the room.
[10:16.580 --> 10:16.680]  No.
[10:17.020 --> 10:18.380]  The security man can also...
[10:18.380 --> 10:21.240]  They have to make all that room for those high dollar clients that are paying to Pennsylvania.
[10:22.440 --> 10:27.300]  You can always just take, you know, the maid, do not disturb or please make up this room sign.
[10:27.300 --> 10:31.520]  And if you do it a couple times, you'd be surprised at how effectively this works.
[10:40.160 --> 10:40.560]  Yeah.
[10:40.820 --> 10:41.760]  So, so that's all that.
[10:41.840 --> 10:46.380]  Now, it's actually not as easy as you might think to do some of these attacks here at the Hotel Pen.
[10:46.860 --> 10:51.340]  Has anyone ever noticed the doors at the Hotel Pen, much like myself, are really fat?
[10:51.700 --> 10:53.840]  They're like, they're, they're way bigger than they need to be.
[10:54.140 --> 10:55.940]  How many people have been like, what is up with this?
[10:57.020 --> 10:57.420]  Yeah.
[10:57.960 --> 11:01.840]  That's actually a really cool piece of history that I bet most of you don't know.
[11:02.100 --> 11:10.160]  These are called Statler Servidors and you don't see them except in really awesome old buildings like this that are being torn down pretty much everywhere.
[11:10.400 --> 11:13.640]  Hotel Pen is probably the only place I've seen them in New York anymore.
[11:14.040 --> 11:24.220]  Back in the days when it was, you know, everyone was business travel and everyone was a spy and you could smoke on airplanes and everyone wore suits and you have your shoes polished and they'd be left outside your door with the paper.
[11:24.220 --> 11:26.940]  The valet would clean your suit.
[11:27.720 --> 11:35.560]  If you wanted your suit returned to you without disturbing the guest, the valet could open the outside of the servidor and hang it in the door.
[11:35.760 --> 11:37.120]  That's what that compartment was for.
[11:37.280 --> 11:43.420]  And then you could open your door and get it, you know, after your mistress had left without, you know, your wife finding out and all that shit in the sixties.
[11:43.820 --> 11:44.720]  You watch Mad Men.
[11:44.860 --> 11:46.320]  It's the f*cking top rated show on cable.
[11:46.420 --> 11:46.860]  Jesus Christ.
[11:47.680 --> 11:54.280]  But yeah, I mean, you know, so these old buildings, they stink and they creak and the water's crappy and there's no power, but you know, they're quaint.
[11:54.500 --> 11:55.460]  This is one of the little...
[11:55.460 --> 11:55.940]  It's nice.
[11:56.100 --> 11:57.040]  Thumbs up hotel pen.
[11:57.300 --> 11:57.880]  It's quaint.
[11:58.060 --> 11:59.300]  The peeling paint is quaint.
[11:59.400 --> 11:59.680]  Yes.
[12:00.500 --> 12:02.140]  Pennsylvania six, 5,000.
[12:02.320 --> 12:02.520]  Okay.
[12:03.540 --> 12:05.740]  Do, do, do, do, do, do, do, do, do.
[12:06.280 --> 12:09.280]  So one more thing about, you know, common hotel doors.
[12:09.560 --> 12:11.000]  Most of them have peep holes.
[12:11.720 --> 12:12.540]  Have you noticed this?
[12:12.760 --> 12:20.660]  Again, it's how you know that it's actually the hooker coming to your room and not security who busted her in the lobby because we know what these people are up against.
[12:20.820 --> 12:21.520]  It's all true.
[12:22.660 --> 12:26.220]  So peep holes are supposed to be a security mechanism to protect you.
[12:26.380 --> 12:27.460]  You look out into the hallway.
[12:27.800 --> 12:35.240]  Well, one of our friends demonstrated amazingly at Notacon that you can really do a lot of other things with hotel doors.
[12:35.840 --> 12:39.780]  Was anyone around CP like f*cking with your room at Notacon this year?
[12:39.980 --> 12:44.080]  Did you have like laser lights being shown into your room when you were trying to sleep with somebody?
[12:44.340 --> 12:47.160]  Did you have strings looping around trying to grab the handle?
[12:47.780 --> 12:48.100]  Yeah.
[12:48.500 --> 12:52.580]  Most of these hotel dead, like, sorry, most of these peep holes are installed really badly.
[12:52.780 --> 12:54.380]  You can unscrew them from the outside.
[12:54.840 --> 12:57.300]  Constantly I will go to, constantly I will go to different hotels.
[12:57.560 --> 13:02.620]  And the first thing I, the first thing I do when I go into my room is I wonder how, you know, how loose this peep hole is.
[13:02.780 --> 13:06.440]  And most of the time from the outside, you can just grip it with your fingers and unscrew it.
[13:06.660 --> 13:06.940]  Yeah.
[13:07.000 --> 13:10.380]  Because if the outside is a nice varnish, they're not going to really do that like repeatedly.
[13:10.560 --> 13:11.520]  They're not going to treat the door.
[13:11.520 --> 13:17.180]  The inside of the door that's painted, they're going to paint it so much that the peep hole is going to kind of weld in place on that side.
[13:17.340 --> 13:19.940]  And you can just, you know, grab the front and spin it open.
[13:20.180 --> 13:23.480]  So absolutely be mindful of the peep holes for a number of reasons.
[13:24.420 --> 13:26.900]  It's also very hackerish to do this kind of shit with peep holes.
[13:27.060 --> 13:32.220]  If you call your friends who you know who are like getting stoned in the room and you're like, dude, I think the cops might be onto you.
[13:32.380 --> 13:33.020]  Look outside.
[13:33.500 --> 13:38.180]  If you have a nice printer, a steady hand with some scissors and some tape, you can do this.
[13:45.300 --> 13:46.900]  That is not our trick at all.
[13:47.060 --> 13:50.660]  That just came up when I did an image search for peep hole and that was too good not to include.
[13:53.600 --> 13:55.320]  So, but you don't always stay in your room, right?
[13:55.420 --> 13:56.380]  Sometimes you have to leave the room.
[13:56.480 --> 13:57.100]  No, right.
[13:57.240 --> 14:00.120]  Because, you know, you can only be entertained so much in your room.
[14:00.980 --> 14:02.800]  I can entertain myself a lot in my room.
[14:03.200 --> 14:03.380]  I know.
[14:03.580 --> 14:04.560]  Christina's not even in town yet.
[14:07.160 --> 14:07.920]  Moving on.
[14:08.760 --> 14:09.600]  The flight was delayed.
[14:09.800 --> 14:10.320]  What do you want from me?
[14:10.320 --> 14:10.720]  I'm a man.
[14:12.280 --> 14:14.460]  So let's say you decide to leave your room.
[14:15.240 --> 14:20.580]  And of course, you may take an elevator because the stairs are so awesome.
[14:20.680 --> 14:21.640]  We are not in stair shape.
[14:21.640 --> 14:27.440]  And inside the elevator, there are usually, you know, some wonderful buttons, including a door closed button.
[14:28.080 --> 14:30.420]  Now, there are a variety of myths about this button.
[14:31.000 --> 14:43.840]  Raise your hand if you've had someone tell you that either they or someone they knew was able to express, go right to their floor by holding down their floor and the door closed button.
[14:46.360 --> 14:49.920]  How many of you have actually said this works to someone and passed it?
[14:50.060 --> 14:51.340]  Is anyone going to raise their hand for this?
[14:51.460 --> 14:51.660]  All right.
[14:51.820 --> 14:52.220]  They won't admit it.
[14:52.320 --> 14:52.640]  Lies.
[14:53.660 --> 14:56.040]  I told somebody this once because I was young and naive.
[14:56.520 --> 14:58.840]  It's a total, total freaking lie.
[14:59.680 --> 15:04.540]  In fact, in many brands and models of elevators, the button's actually not even hooked up to anything.
[15:05.280 --> 15:09.980]  And the reason for that is because when you really think about it, elevators are kind of freaky, right?
[15:09.980 --> 15:16.060]  You're in a tiny enclosed metal thing that is moving up and down a very narrow shaft.
[15:16.860 --> 15:17.140]  Shaft.
[15:17.160 --> 15:17.520]  Thank you.
[15:17.800 --> 15:19.100]  I knew it was coming.
[15:19.920 --> 15:20.280]  What?
[15:21.560 --> 15:21.960]  Anyway.
[15:22.400 --> 15:23.260]  It was coming, sir.
[15:23.300 --> 15:25.700]  So, people like to have the illusion of control.
[15:25.780 --> 15:29.440]  So, the door closed button in many elevators doesn't actually do anything.
[15:29.700 --> 15:31.260]  You press it and you're like, oh, come on.
[15:31.320 --> 15:31.920]  Oh, there it goes.
[15:31.920 --> 15:32.360]  It closed.
[15:32.680 --> 15:32.960]  No.
[15:33.160 --> 15:34.160]  It was going to close anyway.
[15:34.260 --> 15:34.780]  It's on a timer.
[15:35.620 --> 15:37.020]  It's really there just for you.
[15:37.120 --> 15:39.040]  Now, the door open button does actually do something.
[15:39.040 --> 15:40.720]  But the door closed often does not.
[15:40.720 --> 15:44.160]  If you hear that myth, just punch someone in the face if they keep trying to perpetrate this myth.
[15:44.480 --> 15:47.590]  Some elevators are timer on the door.
[15:47.670 --> 15:47.830]  Yeah.
[15:47.990 --> 15:48.390]  And some.
[15:48.530 --> 15:48.870]  And some.
[15:49.030 --> 15:50.270]  And a lot they're not even hooked up.
[15:50.310 --> 15:51.550]  Like 90% it does nothing.
[15:51.670 --> 15:51.850]  Right.
[15:52.070 --> 15:52.150]  Right.
[15:54.410 --> 15:59.670]  So, there are also some elevators that have isolation mode for different floors.
[15:59.810 --> 16:02.250]  So, you can turn a floor on and off as if you would a light bulb.
[16:03.210 --> 16:09.010]  And oftentimes, these are protected by very high security, you know, wafer locks that cost all of $2 to manufacture.
[16:09.010 --> 16:12.050]  How many people have picked wafer locks down in the lockpick village?
[16:12.370 --> 16:12.430]  Yeah.
[16:13.030 --> 16:14.990]  Real top shelf security mechanism, right?
[16:15.110 --> 16:15.230]  Oh, yeah.
[16:15.530 --> 16:17.530]  It's high quality stuff that we're talking about here.
[16:17.930 --> 16:21.190]  And oftentimes, this is used as a security measure, right?
[16:21.350 --> 16:28.450]  I mean, oh, well, no one can get to this floor because you have to have a special key or a special access card in order to activate that floor.
[16:29.370 --> 16:29.690]  Yeah.
[16:29.910 --> 16:30.970]  Well, except for this one.
[16:31.170 --> 16:32.170]  That one was a Medico, right?
[16:33.130 --> 16:33.450]  Yeah.
[16:33.930 --> 16:35.550]  Occasionally, occasionally you'll see a proper lock.
[16:35.650 --> 16:35.910]  Oh, yeah.
[16:36.110 --> 16:38.370]  I'd love to know what's on floor seven of that building.
[16:38.470 --> 16:38.670]  Yeah.
[16:39.510 --> 16:40.910]  Because that's not a wafer lock there.
[16:40.910 --> 16:47.510]  And a lot of times, what you're actually going to see, if you do see a high security lock cylinder in an elevator, sometimes it's just part of a consistent security policy.
[16:47.510 --> 17:01.270]  As an example, at Iowa State University, a lot of the buildings had Medico cylinders in their elevators, not because they were protecting anything specific, but because it was just security policy to have standardized cylinders and certain types of equipment.
[17:01.710 --> 17:04.570]  So, you know, bravo to any facilities that do that.
[17:05.030 --> 17:11.230]  Speaking of more bad locks in elevators, a lot of times you'll see really bad locks on little access panels in elevators.
[17:11.370 --> 17:12.450]  Has anyone ever noticed these?
[17:13.030 --> 17:15.110]  Little tubular locks, very popular sometimes.
[17:15.170 --> 17:16.210]  Also very high security.
[17:16.430 --> 17:16.770]  Yes.
[17:16.770 --> 17:19.970]  Who's ever picked a tubular lock with a proper tool?
[17:20.130 --> 17:21.790]  Who's ever picked a tubular lock with a ballpoint pen?
[17:23.890 --> 17:24.310]  Yeah.
[17:24.810 --> 17:29.670]  So you'll find these and, you know, sometimes you get in an elevator and like, it's open.
[17:29.830 --> 17:30.910]  Who left this open?
[17:31.110 --> 17:32.690]  Certainly, we found it this way.
[17:33.450 --> 17:34.890]  And, you know, we did.
[17:35.110 --> 17:36.410]  You know, no, stop laughing.
[17:36.510 --> 17:37.230]  It's not a joke.
[17:37.330 --> 17:38.050]  We found it this way.
[17:38.110 --> 17:38.290]  Yeah, really.
[17:38.610 --> 17:39.590]  We're being serious.
[17:40.730 --> 17:43.590]  But inside there, there's fascinating stuff.
[17:44.110 --> 17:48.590]  Not just turn on and off the fan because you're all sweaty and hot and turn the lights off and be like...
[17:48.590 --> 17:49.950]  Yeah, throw elevator rave parties.
[17:50.330 --> 17:50.430]  Yeah.
[17:50.750 --> 17:54.650]  No, you can do things like what's called independent service mode.
[17:55.450 --> 18:00.650]  Independent service mode, if you turn that on, the elevator ignores all calls from other floors.
[18:00.650 --> 18:02.130]  It doesn't go to its recall floor.
[18:02.290 --> 18:05.170]  It does exactly what you say for any purpose at any time.
[18:06.290 --> 18:06.390]  Yeah.
[18:06.670 --> 18:11.110]  If there are floors you're not supposed to get to, independent service mode, you can get there.
[18:11.130 --> 18:12.710]  Would you say you're a fan of independent service?
[18:13.470 --> 18:15.990]  I am a fan with people who are not affiliated with agencies.
[18:15.990 --> 18:16.650]  That is correct.
[18:19.950 --> 18:21.350]  Joke and they're pretending not to laugh.
[18:21.530 --> 18:21.630]  Okay.
[18:23.030 --> 18:23.490]  All right.
[18:23.490 --> 18:25.950]  Now, this is another lock in an elevator.
[18:26.390 --> 18:28.970]  However, you see INS.
[18:29.050 --> 18:30.110]  No, it no es la migra.
[18:30.590 --> 18:35.970]  The other thing it's not, this is not independent service mode.
[18:36.970 --> 18:40.870]  INS is a popular abbreviation in an elevator for certain types of functions.
[18:41.150 --> 18:43.570]  Independent service is abbreviated IND.
[18:44.850 --> 18:48.830]  INS usually in most elevators means inspection service mode.
[18:49.070 --> 18:49.970]  Sounds similar.
[18:50.790 --> 18:51.990]  It's very, very different.
[18:52.270 --> 18:52.410]  Yeah.
[18:53.510 --> 18:58.690]  That's when it drops the elevator halfway in between floors and stays put with its doors open so you can get on the roof.
[19:01.650 --> 19:02.670]  Yeah, don't ever...
[19:02.670 --> 19:04.790]  This is not something you want to find out by accident.
[19:05.150 --> 19:05.370]  Yeah.
[19:06.730 --> 19:10.370]  We're like, all right, red team this company, we're going to be in, we're going to be out, we're going to get the bank records.
[19:10.510 --> 19:11.610]  No, no, sir.
[19:12.550 --> 19:14.230]  Taking the stairs on that job.
[19:14.650 --> 19:16.910]  Your audit job will take a turn for the worse.
[19:17.190 --> 19:17.550]  Absolutely.
[19:19.490 --> 19:21.170]  Oh, what else are we talking about with elevators?
[19:21.450 --> 19:26.750]  Because, you know, some of these cylinders, when you turn, a lot of them just snap back when they're picked.
[19:26.930 --> 19:29.430]  Some get locked open and you have to pick it closed.
[19:29.630 --> 19:29.670]  Yeah, they get stuck.
[19:29.670 --> 19:35.010]  And that wafer lock that was so easy to pick first a second ago is impossible to move.
[19:35.170 --> 19:37.110]  You're like, cock, f*ck, no, go back!
[19:39.790 --> 19:43.670]  And, you know, you're being, you know, as an auditor, you're being paid to do this.
[19:43.810 --> 19:47.390]  So, they're paying you big bucks because you're supposed to look slick doing it.
[19:47.450 --> 19:50.270]  And this does not look slick when, you know, you get stuck.
[19:50.390 --> 19:56.230]  Yeah, any photos you see that are questioned, it's not us with TOOOL, it's us with our company, the core group, taking these photos on, like, jobs at night.
[19:58.290 --> 19:59.610]  The fire service mode?
[19:59.750 --> 20:00.510]  We'll get there.
[20:00.570 --> 20:01.990]  The class is jumping ahead of the game.
[20:02.150 --> 20:02.330]  Yep.
[20:02.830 --> 20:05.130]  When they bring in cookies for that girl's birthday, you don't get one.
[20:05.250 --> 20:05.930]  Sit down and stay.
[20:06.090 --> 20:06.270]  Wait.
[20:06.510 --> 20:07.450]  No, it's because you're too smart.
[20:07.570 --> 20:08.710]  You should be in the AP program.
[20:10.230 --> 20:11.330]  No, we're going to get to that.
[20:11.410 --> 20:11.730]  I promise.
[20:16.320 --> 20:19.660]  Wow, that's awful and scary and don't tell anyone where you live.
[20:21.060 --> 20:27.300]  So, I love this particular panel that I saw once because what we just told you about the whole independent, you know, inspection.
[20:28.120 --> 20:30.940]  This is like the panel that just pops open with the emergency phone.
[20:31.080 --> 20:31.280]  Hey.
[20:31.440 --> 20:32.320]  Oh, thank you.
[20:35.530 --> 20:36.310]  Can you hold this?
[20:39.190 --> 20:40.070]  Yeah, hold it up.
[20:40.150 --> 20:40.450]  There you go.
[20:40.670 --> 20:41.070]  So, yeah.
[20:41.470 --> 20:44.450]  So, inside the regular panel, there's a lockable panel.
[20:45.430 --> 20:48.870]  That lockable panel has other type of equipment in it and switches and the like.
[20:49.930 --> 20:51.970]  It's a whole sea of awesome goodness.
[20:52.190 --> 20:58.230]  Again, you know, turn on and off the fan, turn on and off the lights, independent mode is in there, inspection mode is in there.
[20:58.230 --> 21:04.630]  Do you notice, however, that, like a set of circuit breakers, the labels are in between each switch?
[21:05.230 --> 21:12.070]  And if, you know, you're not really closely paying attention, I, when I first looked at this photo, I was like, damn, I don't know which switch is actually which.
[21:12.070 --> 21:22.090]  I swear, I think someone probably f*cked up and dropped the elevator, stuck in it between floors, because someone went around with a Dymo labeler and clarified which switch is which.
[21:25.220 --> 21:27.540]  You see that with circuit breakers, too, sometimes.
[21:27.880 --> 21:28.040]  Yeah.
[21:28.040 --> 21:32.160]  You have it on the breaker itself, but then you also have the key next to it.
[21:32.160 --> 21:32.940]  This is a good career.
[21:33.080 --> 21:34.360]  You never know what you're going to come across.
[21:34.780 --> 21:39.480]  So now, for the gentleman and anyone who's been curious, are you going to tell them a little bit about how fire mode can go?
[21:39.980 --> 21:40.340]  Yeah.
[21:40.620 --> 21:48.620]  So, fire service mode, and this is actually almost a whole talk unto itself, but we're going to do an elevator hacking talk one day.
[21:48.760 --> 21:54.600]  We had like 17 hours to put a replacement talk together, so we did this and borrowed from some of our other material.
[21:55.540 --> 21:58.660]  But fire mode is interesting in that...
[22:00.700 --> 22:03.440]  It's like independent service, but...
[22:03.440 --> 22:03.680]  Not quite.
[22:04.060 --> 22:06.820]  Yeah, it'll actually override other security protocols.
[22:07.000 --> 22:15.140]  Sometimes in a really high-tech, you know, high-secure building, independent mode still will not respond to certain floors if there's a lot of lockouts engaged.
[22:15.760 --> 22:21.120]  If fire mode is enabled, again, that's a, you know, risk of life, safety of life issue.
[22:21.440 --> 22:27.840]  Fire mode can do a lot of things that you're not supposed to be able to do, including roofs, basements, ignoring car readers.
[22:28.200 --> 22:33.120]  Now, it is not true that you can just engage fire mode from the cab.
[22:33.300 --> 22:36.980]  This key in the elevator cab will not turn on fire mode in the cab.
[22:37.360 --> 22:38.840]  That's called fire mode 2.
[22:39.140 --> 22:39.420]  Right.
[22:39.880 --> 22:40.780]  But down in the lobby...
[22:41.560 --> 22:50.920]  So, everyone has probably seen in the lobby of most facilities another wafer lock in the lobby that says fire...
[22:50.920 --> 22:54.580]  You know, it's got a little fireman logo on it, or fire key, or just fire on it.
[22:54.940 --> 23:01.280]  And that is kind of a master control that puts the whole system into fire service mode 1.
[23:01.620 --> 23:15.060]  So, when firefighters have to enter the building for whatever reason, and they insert their key and flip it to on, it'll recall all the elevator cars, all the cabs down to their home floors, which is usually lobby, and have them open.
[23:15.400 --> 23:19.340]  Now, all the elevators are on their home floor with all the doors open.
[23:19.520 --> 23:37.200]  And now the fireman enters the cab, takes a different key ring, because this key usually has to stay in the original cylinder, takes a different key ring, engages the other lock cylinder for fire mode, and now they're in mode 2, and now they can go to any floor overriding any security protocols.
[23:37.680 --> 23:38.460]  Yeah, it's...
[23:39.240 --> 23:40.500]  What about the elevator, what happens?
[23:42.280 --> 23:42.540]  Nothing.
[23:43.420 --> 23:44.180]  Right, yeah.
[23:45.900 --> 23:46.840]  Usually it's nothing.
[23:46.900 --> 23:47.920]  Unless it's program wrong.
[23:48.540 --> 23:52.220]  I've found elevators where I've engaged fire mode 2 for no reason whatsoever.
[23:52.740 --> 23:54.420]  That was never supposed to happen.
[23:54.840 --> 23:58.600]  But yeah, so if you're really interested in elevator hacking, talk to us some more.
[23:58.800 --> 23:59.720]  Who's shouting over there?
[23:59.860 --> 24:00.460]  You're drunk.
[24:00.780 --> 24:01.880]  Tuna, what do you need, Tuna?
[24:03.540 --> 24:04.780]  Yes, I know, sir.
[24:04.920 --> 24:06.940]  It's my force, my aura, just commands.
[24:07.960 --> 24:09.840]  No, it really is just simple, cheap keys.
[24:10.020 --> 24:12.860]  Keys that are standardized across a lot of manufacturers.
[24:13.500 --> 24:16.160]  Keys that, you know, we have, actually.
[24:17.920 --> 24:20.700]  If you try to buy them through legitimate channels, you'll be told no.
[24:20.940 --> 24:23.840]  If you try to buy them with fake fire department letterhead, you can.
[24:24.160 --> 24:25.840]  But they cost like $250.
[24:26.880 --> 24:28.860]  They don't cost that much if you talk to us later.
[24:28.860 --> 24:31.660]  If you actually are a proper pen-tester and we speak to you.
[24:31.780 --> 24:34.500]  I mean, if this is really your career, talk to us about it.
[24:34.580 --> 24:35.760]  Maybe we'll set you up.
[24:35.900 --> 24:48.060]  Now this keyring, as you imagine, is only as universal because when they ship the elevators, you know, via UPS, they have to come with a lock cylinder already installed.
[24:48.060 --> 24:50.040]  So this is generally the cylinder that's installed.
[24:50.220 --> 24:54.040]  So this keyring has a bunch of different keys for different makes and models and such.
[24:54.180 --> 24:59.720]  And as long as the facility hasn't swapped out the cylinder, then one of these keys will very likely work.
[24:59.820 --> 25:03.000]  This is actually a mini version of the universal key set.
[25:03.100 --> 25:23.640]  There's like a master version, if I recall correctly, that has about three times as many keys for, you know, but any facility should have a small panel somewhere in the building that has the master elevator key, usually the service pump, like the pneumatic pump room or elevator electric room key.
[25:24.120 --> 25:26.440]  Usually this panel is controlled by a Medico lock.
[25:26.580 --> 25:27.620]  That lock is standardized.
[25:27.900 --> 25:28.880]  There's one for every state.
[25:29.040 --> 25:33.560]  You can get a ring of 50 Medico keys, which I've never been able to get, too much I try.
[25:34.120 --> 25:36.980]  And that will just completely, you know, pwnzor the universe.
[25:39.760 --> 25:46.300]  So, fire service keys not only open interesting panels, you know, in the elevator, enact switches in the elevator.
[25:47.200 --> 25:47.640]  Occasionally...
[25:47.640 --> 25:48.980]  They can get you to interesting places.
[25:48.980 --> 25:51.220]  They will get you to places they're never supposed to go.
[25:51.220 --> 25:58.820]  Remember a couple slides ago we talked about how, you know, it kind of overrides the default security protocols and takes you to floors that most people shouldn't be in?
[26:00.620 --> 26:02.740]  So, sometimes they also do strange things.
[26:04.520 --> 26:10.480]  Now, normally there is, you know, a hatch on top of the cab for maintenance purposes.
[26:10.780 --> 26:11.740]  And they're actually...
[26:11.740 --> 26:13.120]  It's usually locked from the outside.
[26:13.420 --> 26:13.620]  Yeah.
[26:13.760 --> 26:16.180]  It's not like in the movies where you're like, oh, the elevator stopped.
[26:16.260 --> 26:17.320]  I'm going to climb up the top.
[26:17.420 --> 26:17.600]  Right.
[26:17.740 --> 26:17.960]  No.
[26:18.180 --> 26:18.380]  No.
[26:18.440 --> 26:20.940]  If you're actually stuck in an elevator, chances are there's...
[26:21.380 --> 26:22.540]  You're stuck in the elevator.
[26:22.540 --> 26:26.460]  I saw the video of that guy who was stuck in an elevator for like two weeks or not too...
[26:26.460 --> 26:27.280]  It was like almost two days.
[26:27.540 --> 26:28.480]  It was pretty serious.
[26:28.740 --> 26:28.880]  Yeah.
[26:29.780 --> 26:30.060]  No.
[26:30.260 --> 26:30.720]  Oh, okay.
[26:30.720 --> 26:31.300]  Sorry.
[26:31.300 --> 26:31.820]  He saw the guy.
[26:31.980 --> 26:32.160]  Yes.
[26:32.280 --> 26:34.140]  He watches too much YouTube like the rest of us.
[26:35.540 --> 26:38.920]  So, this one actually had a lock on the bottom for some reason.
[26:39.880 --> 26:41.520]  Unless you get to the top of the cab.
[26:43.180 --> 26:47.200]  And you can also, you know, go to certain maintenance elevators.
[26:47.360 --> 26:48.700]  And they'll take you to interesting places.
[26:48.860 --> 26:51.460]  Now, you really don't want to be messing around in here.
[26:51.820 --> 26:55.920]  There's a lot of equipment that does things that, you know, one is not familiar with.
[26:56.000 --> 26:57.400]  And you can easily get hurt and such.
[26:57.860 --> 27:00.560]  But, you know, you also...
[27:00.560 --> 27:03.680]  This is something that you want protected because, you know, it can be a liability.
[27:03.680 --> 27:07.860]  You don't want people, you know, screwing around in here potentially creating issues.
[27:08.800 --> 27:09.180]  It'll go.
[27:09.340 --> 27:09.820]  So, yeah.
[27:10.000 --> 27:12.180]  Like this equipment, it's dangerous, dodgy stuff.
[27:12.560 --> 27:13.840]  You don't want to be around it.
[27:13.980 --> 27:19.840]  You don't want to be in the frame of the video if you're a subcontractor on a red team job who wasn't, you know, officially hired by the company.
[27:22.480 --> 27:23.520]  It's actually legal.
[27:23.680 --> 27:24.840]  We 1099'd him and everything.
[27:24.880 --> 27:25.440]  It was fine.
[27:25.820 --> 27:26.200]  But...
[27:27.720 --> 27:28.160]  Yeah.
[27:28.720 --> 27:32.700]  So, our lovely Photoshop work so you can't see who actually works for us.
[27:33.120 --> 27:35.800]  But keep telling the story when you were in the maintenance area, right?
[27:35.920 --> 27:36.160]  Or, no.
[27:36.700 --> 27:37.140]  Our...
[27:37.660 --> 27:40.160]  A guy was in a maintenance area somewhere.
[27:40.640 --> 27:41.400]  I don't know where.
[27:41.460 --> 27:47.980]  And there was found a set of keys that...
[27:50.120 --> 27:51.000]  You couldn't...
[27:51.000 --> 27:51.340]  By the...
[27:51.340 --> 27:52.100]  Who's seen this show?
[27:52.180 --> 27:53.060]  Life and Times of Tim.
[27:53.820 --> 27:54.640]  It's delicious.
[27:55.060 --> 27:55.080]  Nobody?
[27:56.240 --> 27:58.720]  So, there was found a set of keys...
[27:58.720 --> 27:59.500]  I had to cover the faces with something.
[27:59.680 --> 27:59.860]  Come on.
[28:00.080 --> 28:00.220]  Yeah.
[28:00.460 --> 28:02.480]  That started, you know...
[28:02.920 --> 28:04.520]  You just try it in different cylinders.
[28:05.120 --> 28:06.540]  And eventually, you know...
[28:06.540 --> 28:08.180]  By the way, behind...
[28:08.180 --> 28:13.640]  In the background of the photo here, you see the access control panel and mechanism for the elevator.
[28:13.640 --> 28:14.940]  It's actually a pretty modern system.
[28:15.820 --> 28:16.400]  Very modern.
[28:16.500 --> 28:17.380]  Were the keys hanging in that panel?
[28:17.500 --> 28:17.700]  Yeah.
[28:17.900 --> 28:18.880]  The keys were hanging in the panel.
[28:19.140 --> 28:20.140]  Maintenance areas, if you do...
[28:20.140 --> 28:22.920]  They are a sea of f*cking keys.
[28:23.400 --> 28:26.380]  Like, you know, once you're in that door, it's a step only.
[28:26.380 --> 28:26.540]  Right.
[28:26.540 --> 28:28.160]  And so what do you do with all these keys, right?
[28:28.180 --> 28:29.980]  If you're maintenance, I mean, you gotta put them somewhere.
[28:30.280 --> 28:35.840]  And one would think you'd get like a key cab to organize the keys or have some sort of...
[28:35.840 --> 28:36.100]  A different system.
[28:36.360 --> 28:36.780]  Right, right.
[28:37.760 --> 28:39.180]  But no, they had a different system.
[28:39.340 --> 28:42.440]  They stuffed them all in a drawer and locked the desk drawer.
[28:42.700 --> 28:43.420]  With one of those keys.
[28:43.560 --> 28:43.780]  Right.
[28:44.100 --> 28:51.640]  And as if the desk drawer full of keys wasn't disorganized enough, they decided to add a little bit of organization of their own.
[28:51.800 --> 28:55.820]  There's actually an Altoids tent on the far right that's labeled keys.
[29:01.250 --> 29:03.410]  So one of these keys led further up, right?
[29:03.810 --> 29:03.950]  Good.
[29:04.070 --> 29:05.650]  Because I was looking for all these other keys.
[29:05.910 --> 29:06.530]  It's good.
[29:06.670 --> 29:07.590]  It's not mints.
[29:07.830 --> 29:08.410]  It's keys.
[29:10.330 --> 29:11.790]  So where was that other door?
[29:12.430 --> 29:12.570]  Yeah.
[29:14.670 --> 29:15.730]  More audit photos.
[29:16.030 --> 29:16.250]  Yeah.
[29:16.710 --> 29:20.050]  That eventually led to, you know, also more places.
[29:22.750 --> 29:24.590]  The Photoshop jobs are killing me.
[29:25.830 --> 29:27.690]  The people who know who that is laugh.
[29:27.690 --> 29:29.390]  The people who don't, don't want to know.
[29:29.650 --> 29:36.870]  Now, in some facilities, you know, sometimes they're down on their financials.
[29:36.890 --> 29:40.630]  They need to get some extra in a room with a grill in the door, which is kind of an odd thing.
[29:42.650 --> 29:48.930]  And you kind of put the camera up to the grill and you can start seeing some of the equipment are actually like, oh, that looks interesting.
[29:50.410 --> 29:50.930]  I wonder...
[29:50.930 --> 29:51.410]  Trying those keys.
[29:51.710 --> 29:51.890]  Right.
[29:52.090 --> 29:58.510]  And so you go to try the keys and it appears that someone probably couldn't find the key in the drawer.
[29:59.950 --> 30:06.450]  And they decided, you know, next time I'm just going to kind of put tape on the door latch, which is the state that we found this door in.
[30:09.330 --> 30:14.270]  And now you are in a telco room with a lot of equipment that you should not be near.
[30:18.150 --> 30:20.970]  With, you know, work logs of people who had been there and everything.
[30:20.970 --> 30:22.390]  You can add your own little spin.
[30:22.570 --> 30:22.950]  Yeah, absolutely.
[30:23.110 --> 30:23.310]  You know.
[30:32.750 --> 30:33.610]  They'll never know.
[30:36.650 --> 30:37.950]  So let's get back to the room.
[30:38.030 --> 30:38.390]  Yeah, I know.
[30:38.490 --> 30:39.330]  We've gone around the...
[30:39.710 --> 30:40.030]  You...
[30:40.030 --> 30:41.290]  No, not them either because they won't do this.
[30:41.450 --> 30:43.050]  Someone has gone around the hotel enough.
[30:43.410 --> 30:43.730]  Let's...
[30:43.730 --> 30:52.310]  You can only, you know, when you're pen-testing, you always carry the ice bucket because, you know, depending on where you are, you'd be like, oh, this isn't the ice machine.
[30:52.310 --> 30:53.790]  That only takes you so far.
[30:55.290 --> 30:58.130]  That'll work when you're looking for extra towels and stuff.
[30:58.290 --> 30:58.490]  Yeah.
[30:58.630 --> 31:00.010]  It may not work when you're in...
[31:00.010 --> 31:00.870]  When you're in the telco room.
[31:00.970 --> 31:02.270]  At the f*cking top of a hotel.
[31:02.430 --> 31:02.890]  It's like, what?
[31:04.590 --> 31:06.170]  This isn't wood shop class?
[31:08.970 --> 31:09.550]  So, all right.
[31:09.650 --> 31:10.770]  Back to your room.
[31:10.910 --> 31:11.910]  Take the elevator back down.
[31:12.810 --> 31:16.170]  Some of you may notice a lot of elevators in swanky hotels.
[31:16.770 --> 31:18.330]  You know, kind of unlike this one.
[31:18.810 --> 31:21.010]  Although this one, they have these in this hotel.
[31:21.150 --> 31:22.090]  They just, you know, they don't use them.
[31:22.090 --> 31:26.210]  Some hotels will have key card readers that only let you to certain floors.
[31:26.910 --> 31:28.630]  How many of you have been in a hotel like that?
[31:29.230 --> 31:29.350]  Exactly.
[31:29.570 --> 31:32.530]  Doesn't it suck when someone's like, yeah, man, party's in 4915.
[31:33.050 --> 31:34.130]  And you're like, f*ck, dude.
[31:34.230 --> 31:35.790]  No one told us that 49...
[31:35.790 --> 31:36.990]  I don't have a key that gets me there.
[31:38.070 --> 31:38.730]  Driver's license.
[31:39.290 --> 31:41.990]  Well, sometimes it's just a little override like that.
[31:42.090 --> 31:42.230]  Yes.
[31:42.350 --> 31:43.890]  Just slipping anything in there.
[31:44.010 --> 31:45.470]  Sometimes it's a mechanical read switch.
[31:46.370 --> 31:47.330]  Don't discount that.
[31:47.470 --> 31:47.850]  Try it.
[31:47.970 --> 31:48.570]  It might get you.
[31:48.830 --> 31:49.290]  You know.
[31:49.490 --> 31:51.450]  But a lot of times it is a proper card reader.
[31:51.450 --> 31:54.410]  You can bypass those in a number of ways we're about to talk about.
[31:54.710 --> 31:54.870]  Yeah.
[31:55.350 --> 31:56.790]  For instance, you know, the switches.
[31:57.090 --> 31:57.870]  Don't forget the switches.
[31:58.010 --> 31:59.790]  There is one that just, you know, turns it off.
[32:05.480 --> 32:10.160]  This is almost a Hollywood level of, you know, insecurity, right?
[32:10.260 --> 32:11.240]  Because there's always override.
[32:11.240 --> 32:18.220]  No matter how many bits of encryption there are in the master security system, there's always an override.
[32:18.640 --> 32:20.820]  Usually you just type in override, if I recall correctly.
[32:21.060 --> 32:21.560]  Or crash.
[32:21.680 --> 32:22.140]  Crash override.
[32:22.300 --> 32:23.600]  But here you can...
[32:25.840 --> 32:26.720]  Turn it on me.
[32:26.720 --> 32:27.880]  You can just turn it off.
[32:28.820 --> 32:29.180]  What?
[32:29.380 --> 32:29.660]  Card reader.
[32:30.220 --> 32:30.400]  Yes.
[32:31.080 --> 32:31.620]  So, yeah.
[32:31.700 --> 32:32.100]  There's that.
[32:32.640 --> 32:34.280]  There's other ways to mess with the card reader too.
[32:34.360 --> 32:37.120]  We're going to come back to this when we talk about mag stripe cards in a little bit.
[32:37.600 --> 32:38.640]  Also, I don't know if you noticed.
[32:38.820 --> 32:40.960]  This is from a black hat at the Caesars.
[32:41.240 --> 32:43.460]  Can anyone do a little math on this elevator here?
[32:43.980 --> 32:49.700]  This elevator is estimating that the average person in Las Vegas in a nice swanky casino weighs 150 pounds.
[32:50.740 --> 32:51.740]  I don't think so.
[32:51.860 --> 32:53.220]  Have you seen the people at the slot machines?
[32:53.440 --> 32:53.680]  No.
[32:54.180 --> 32:54.560]  No, no, no.
[32:57.040 --> 32:58.320]  It's like a car warranty.
[32:58.480 --> 32:59.480]  Whichever you hit first.
[32:59.820 --> 33:01.600]  That many people or that many pounds.
[33:02.620 --> 33:04.600]  Speaking of elevator maximum weights.
[33:04.860 --> 33:09.140]  The elevator, the express one that goes from Mez to 18.
[33:10.060 --> 33:12.820]  Next time you're in there, just look at the maximum weight limit and...
[33:12.820 --> 33:13.760]  And look at the people around you.
[33:13.880 --> 33:16.840]  And decide if that elevator can actually handle that.
[33:16.960 --> 33:18.380]  Because I'm pretty sure it can't.
[33:21.080 --> 33:23.580]  Yeah, I can handle it going down.
[33:23.820 --> 33:24.660]  That's correct, sir.
[33:25.920 --> 33:27.560]  You're not gonna get here that fast.
[33:27.960 --> 33:29.040]  Take a stopwatch.
[33:30.920 --> 33:31.580]  So, alright.
[33:31.780 --> 33:32.840]  Now back on the floors.
[33:32.940 --> 33:34.840]  We're gonna talk about room keys towards the end.
[33:34.940 --> 33:36.400]  What, we've got like 20 minutes left maybe?
[33:36.500 --> 33:36.820]  25?
[33:37.240 --> 33:38.220]  Leave some time for questions?
[33:38.360 --> 33:39.400]  Yeah, we're doing pretty good.
[33:39.680 --> 33:42.740]  For a talk we threw together without sleeping in 17 hours.
[33:42.900 --> 33:43.420]  This is...
[33:43.420 --> 33:44.680]  Who's liking it so far?
[33:48.390 --> 33:49.310]  It's all for you.
[33:49.310 --> 33:50.230]  We deliver for you.
[33:53.390 --> 33:54.710]  So you don't see these as much.
[33:54.840 --> 33:56.240]  What are called pin matrix cards.
[33:56.410 --> 33:57.260]  Has anyone ever seen one?
[33:57.340 --> 33:58.670]  Anyone get to the European events?
[33:58.910 --> 33:59.260]  Yes.
[33:59.650 --> 34:00.650]  Very happy to see them.
[34:00.690 --> 34:01.390]  They are world travelers.
[34:01.670 --> 34:02.600]  They are not normal Americans.
[34:02.890 --> 34:05.620]  Deviant was adamant that these don't exist anywhere in the U.S. anymore.
[34:05.800 --> 34:08.460]  But I told him that I had actually stayed in a hotel that still use these.
[34:08.930 --> 34:12.520]  And to further show my point, who has stayed in a hotel in the U.S. that uses one of these?
[34:13.360 --> 34:14.740]  I kind of fail.
[34:15.960 --> 34:18.500]  Because I'm, you know, I'm staying in swanky places.
[34:18.980 --> 34:20.950]  Places I'm not embarrassed to bring a lady back to.
[34:22.390 --> 34:25.390]  Because these cards came out in the very, very early 80s.
[34:25.460 --> 34:29.060]  They were popular in the 80s and through the 90s and they've mostly been phased out in the U.S.
[34:29.060 --> 34:32.860]  They are still really popular in parts of Europe because that's where they originated.
[34:34.160 --> 34:40.410]  The Tria Ving company or Ving card division of the Tria Ving company, which is a Scandinavian country, makes this.
[34:40.890 --> 34:43.060]  And it's a really, really neat design.
[34:43.740 --> 34:46.860]  Just from a sort of a lock picking, mechanical picking perspective.
[34:48.080 --> 34:52.740]  The design involves pin stacks, like you've seen in a lot of locks.
[34:52.860 --> 34:54.060]  A lot of pin tumbler locks.
[34:54.410 --> 34:57.840]  The whole thing, the whole affair has what I would call a drawer.
[34:58.280 --> 35:02.890]  And this drawer has to slide out to engage.
[35:03.080 --> 35:06.540]  You know, there's a tailpiece that has to engage the proper handle or else the handle does nothing.
[35:07.330 --> 35:13.450]  But if you notice, I didn't just sort of, you know, skimp because I made this animation at 5am a couple days ago.
[35:13.660 --> 35:16.040]  I actually, you know, I'm representing this properly.
[35:16.120 --> 35:19.100]  It's actually the same size pins in every chamber.
[35:19.240 --> 35:22.600]  It's the same driver pin, the same key pin, a ball bearing on top of that.
[35:23.640 --> 35:32.850]  Because the pins, when they are at rest, require the insertion of one thickness of, you know, room key card in order to be set at the proper position.
[35:33.580 --> 35:34.700]  So how does this work?
[35:34.950 --> 35:39.270]  As many of you know, most hotels have moved away from the old fashioned metal keys.
[35:39.500 --> 35:40.480]  And isn't it cool when you get them?
[35:40.480 --> 35:43.520]  How many people have traveled in Italy and we actually get a metal room key?
[35:43.620 --> 35:44.430]  It's nice, isn't it?
[35:45.480 --> 35:50.770]  But if you lose the key, if they need to make more keys, they need to recombinate the locks, there's really no effective way to do that.
[35:50.950 --> 35:56.620]  So hotels needed a way of quickly and economically changing the locks out without, you know, taking the door apart.
[35:56.620 --> 35:59.700]  That's where Vincard became one of the first systems to do this.
[36:00.330 --> 36:06.160]  The way the system works is a control card is inserted in the back of the lock.
[36:06.460 --> 36:11.390]  So inside the room, you can usually pop the panel open with a hex nut or a special little security hex nut.
[36:11.500 --> 36:14.520]  And you insert it in the back of the lock.
[36:15.370 --> 36:18.430]  So here we have a control card being installed.
[36:18.720 --> 36:19.540]  Click, click, click.
[36:19.700 --> 36:21.790]  My animated GIF skill serves me well.
[36:21.790 --> 36:28.890]  If anyone doesn't really fully appreciate how awesome some of these animations are, Deviant animates these frame by frame.
[36:29.080 --> 36:31.310]  I have no foo in flash.
[36:32.220 --> 36:32.830]  F*ck flash.
[36:34.310 --> 36:35.180]  Blows me away.
[36:35.370 --> 36:36.870]  And the speed at which she pulls...
[36:36.870 --> 36:39.390]  All these animations were done in one night.
[36:39.700 --> 36:41.240]  It just... go on.
[36:41.600 --> 36:42.680]  Yeah, thank you, sir.
[36:42.850 --> 36:43.410]  It's fun.
[36:43.620 --> 36:47.700]  I like the looks on their faces when you just get it, you know?
[36:48.060 --> 36:51.000]  Sometimes it's hard to talk about this stuff, but we like to make it simple.
[36:51.000 --> 36:51.790]  That's our job.
[36:51.980 --> 36:53.620]  That's what we're tool... that's what we're about.
[36:54.060 --> 36:56.600]  So you have this lock... you have this control card in the lock.
[36:57.330 --> 37:01.270]  Now, notice some of the pin stacks are at the proper position now.
[37:01.500 --> 37:04.290]  So these two pin stacks are at the proper position.
[37:05.370 --> 37:07.660]  And the card itself can... can wiggle.
[37:08.020 --> 37:09.330]  The card has to be...
[37:10.240 --> 37:20.060]  Because in order to put a key card in the front of the lock, the ball bearings need to be able to move, including ball bearings that are now blocked because they're sitting atop the control card.
[37:20.160 --> 37:20.680]  Does that make sense?
[37:21.600 --> 37:25.200]  So imagine a pass card, the room key that you're actually issued.
[37:25.600 --> 37:32.100]  That slides in, completes the rest of the bearings that need to be pushed down, the stacks.
[37:32.430 --> 37:34.450]  Now the drawer can slide back.
[37:34.720 --> 37:40.000]  Because every stack has exactly one thickness of card added into the situation.
[37:40.100 --> 37:44.680]  Whether it was the control card making that thickness or the pass card, that'll work.
[37:44.680 --> 37:48.000]  If you've ever tried... It's like parody, you know, it's a lock that has parody.
[37:48.240 --> 37:49.290]  Yeah, it's pretty neat.
[37:49.520 --> 37:56.120]  If you've ever tried a Ving card, like, you know, you stagger home late at night, you're not sure and everything looks the same in this hotel in Oslo.
[37:56.270 --> 37:58.810]  It's so stoic and very, very Scandinavian.
[37:58.960 --> 38:00.520]  And you try to stick it in the wrong door.
[38:00.720 --> 38:03.100]  It almost seems like your card won't go in all the way.
[38:03.720 --> 38:06.450]  What's actually happening is your card will go in all the way.
[38:06.600 --> 38:08.930]  You can't engage the drawer.
[38:09.180 --> 38:11.600]  The drawer won't slide back that extra little bit.
[38:11.790 --> 38:13.060]  That's what you're bumping up against.
[38:14.080 --> 38:15.480]  So that's how these work.
[38:15.620 --> 38:16.910]  It's a really neat notion.
[38:17.200 --> 38:20.180]  Now, it's not just a simple array on the side like that.
[38:20.640 --> 38:25.290]  Of course, if you pull that out and you put a new pass card in, now the old room key won't work.
[38:25.770 --> 38:29.700]  But the next room key that was issued paired with this card will work.
[38:29.890 --> 38:30.580]  Bang, it works.
[38:30.720 --> 38:31.100]  Boop, boop.
[38:31.350 --> 38:31.930]  Makes sense?
[38:32.830 --> 38:36.950]  Now, it looks simplistic, but what's actually going on is the pin matrix is huge.
[38:37.330 --> 38:40.350]  It's even bigger than I could fit in this, you know, artwork here.
[38:40.350 --> 38:43.180]  It's a whole array of pins all together.
[38:43.580 --> 38:45.480]  They actually go up one more row.
[38:45.660 --> 38:48.540]  So there are 32 pins laid out together here.
[38:49.040 --> 38:56.410]  Now, the control card that slips in and interacts with these has to engage these two.
[38:56.500 --> 39:00.460]  What you see still in red, those two key pins do not have ball bearings.
[39:00.540 --> 39:02.180]  Those are called control pins.
[39:02.180 --> 39:04.480]  And we'll get into that in a second, what I mean by that.
[39:05.520 --> 39:07.480]  So, see these big fat control pins?
[39:07.640 --> 39:09.950]  They don't even have a pin chamber up here.
[39:10.810 --> 39:16.390]  Imagine, if you will, a room that's been cleaned by a maid, it's been vacated, and they have no control card at all.
[39:16.950 --> 39:18.870]  With no control card at all...
[39:18.870 --> 39:19.770]  What does that say?
[39:19.850 --> 39:20.310]  How many minutes?
[39:20.430 --> 39:20.680]  15?
[39:20.790 --> 39:21.200]  Oh, we're good.
[39:21.310 --> 39:21.950]  Yeah, we're sweet.
[39:22.640 --> 39:24.140]  I can't believe this is working so well.
[39:25.310 --> 39:32.080]  So, with no control card at all, knock on wood, you could just slip like a credit card, and then that's the right thickness everywhere.
[39:32.310 --> 39:32.480]  Boom.
[39:32.660 --> 39:33.180]  It would work.
[39:33.460 --> 39:39.520]  So, to prevent that, these control pins have to be acted upon by a control card.
[39:39.520 --> 39:41.240]  So, you at least have to press them down.
[39:42.140 --> 39:43.640]  So, this would like never work.
[39:43.700 --> 39:44.930]  This control card doesn't...
[39:44.930 --> 39:48.140]  Well, first of all, it would be stupid to have this many control pins, the control card cuts.
[39:48.350 --> 39:51.350]  But at least you have to trip the control pins on the sides.
[39:51.680 --> 39:54.580]  So, this, at a minimum, would be a control card.
[39:54.580 --> 39:55.870]  Again, it would be stupid.
[39:56.450 --> 40:00.330]  Because now, every pin stack is waiting to be pressed down.
[40:01.180 --> 40:03.080]  There's, you know, they're just, they're all waiting for position.
[40:03.220 --> 40:04.310]  The bearings are free to move.
[40:04.620 --> 40:05.740]  This would be your room key.
[40:06.120 --> 40:06.930]  Or a credit card.
[40:07.040 --> 40:07.790]  Like, that would not work.
[40:07.910 --> 40:09.080]  So, of course, they don't issue that.
[40:09.270 --> 40:10.500]  But, you know, boop, it opens the door.
[40:12.120 --> 40:16.850]  Similarly, this would work as a control card, because it would push down the control pins and every other pin.
[40:17.580 --> 40:22.120]  Now, all you need to do is stick something in there that doesn't mess with any ball bearing.
[40:22.120 --> 40:25.640]  Because if you push any ball bearing, it'll push the whole affair down and it'll f*ck it up.
[40:26.020 --> 40:29.240]  So, you know, if this were your room, this would be your room key.
[40:29.430 --> 40:33.850]  So, that equally, I mean, you understand how it works, but that wouldn't make any sense to issue somebody that.
[40:34.910 --> 40:38.740]  What actually works in practice is a card kind of like this.
[40:38.980 --> 40:41.640]  A control card will have some of the holes cut.
[40:42.830 --> 40:44.790]  Other holes, you know, these are not cut.
[40:44.980 --> 40:47.290]  So, these pin stacks have been pushed into position.
[40:47.430 --> 40:48.040]  They are fine.
[40:48.270 --> 40:49.480]  Don't mess with them any further.
[40:49.700 --> 40:50.620]  Don't touch them any further.
[40:51.410 --> 40:54.500]  All the ball... all the... you know, those pins are in position because they're blocked.
[40:55.140 --> 41:01.390]  All the ball bearings now, the ball bearing should be pushed down except for the ones that have arrows.
[41:01.580 --> 41:03.290]  Because remember, those are already in position.
[41:03.830 --> 41:06.200]  So, that's where you don't want cuts.
[41:06.370 --> 41:09.220]  I'm sorry, that's where you do want cuts in the key.
[41:09.620 --> 41:13.240]  So, the key is actually perfectly complementary to the control card.
[41:13.540 --> 41:17.020]  It's a really elegantly simple system when you think about it.
[41:17.020 --> 41:21.810]  Take out those two control pins, and you have 30 effective pins in the matrix.
[41:22.350 --> 41:26.140]  Even though they can only be high or low, that's enough differs to have, what, a billion cut?
[41:26.220 --> 41:27.200]  What is two to the 30th?
[41:27.290 --> 41:28.120]  It's over a billion, right?
[41:29.120 --> 41:31.290]  Yeah, it's a really, really neat system.
[41:31.290 --> 41:33.830]  It'll work for most things.
[41:34.160 --> 41:35.560]  Although, we keep...
[41:35.560 --> 41:38.700]  I'd love to find more of these because I think we could find ways to attack them.
[41:39.000 --> 41:51.700]  If anyone, just out of curiosity, putting it out there, if anyone runs into some place that is getting rid of these, hotels being decommissioned, whatever, send us an email because we really would like to have a couple of these to look at further, just putting it out there.
[41:51.980 --> 41:52.310]  Absolutely.
[41:54.720 --> 41:55.810]  We'll do questions at the end.
[41:55.910 --> 41:56.410]  Questions at the end.
[41:57.120 --> 42:05.580]  So, my first thought, when I first saw how the system worked, I was like, oh, shit, like if the maid is cleaning the room and the door is open, could you like slip a solid control card in there?
[42:05.660 --> 42:07.410]  Because then everything's in position, everything works.
[42:07.950 --> 42:13.930]  But of course, that's wrong because anything that touches the ball bearings at that point will then screw it up and it won't work.
[42:14.240 --> 42:18.850]  But the idea of attacking through the control card could work if you had like a dimpled control card.
[42:19.240 --> 42:26.460]  So it would set everything at the right position, the ball bearings would not be in the way, and now any room key technically would work.
[42:26.600 --> 42:35.310]  It wouldn't like click, but I'm betting if you had to like, you know, let's come back to this guy's room later when, you know, whoever, f*cking Norwegian name lady is in there cleaning the bathroom.
[42:35.450 --> 42:36.660]  Ah, okay, boom.
[42:37.160 --> 42:38.660]  You know, Gru is in there cleaning the bathroom.
[42:39.580 --> 42:40.520]  Hakon, Hakon.
[42:40.870 --> 42:41.350]  What's Hakon?
[42:41.410 --> 42:41.740]  Who do you meet?
[42:41.870 --> 42:43.080]  You weren't in Oslo with me, never mind.
[42:43.220 --> 42:44.160]  I'm a little tuned up.
[42:45.100 --> 42:48.330]  All right, so you could make this just by dimpling a regular control card.
[42:48.740 --> 42:55.960]  If you had access to like a milling machine, a CNC milling machine, you could probably make a control card that's just like a cookie tray, if you will, a depression.
[42:56.310 --> 42:59.330]  Again, the ball bearings hang low, everything would work.
[42:59.430 --> 43:01.640]  It'd be like the door that everything opens.
[43:01.810 --> 43:09.310]  So the person whose room key really belongs in it, it still works for them, but you could come in later and, you know, ponzor their wares or whatever it is you kids today do.
[43:10.720 --> 43:13.000]  You know, pass card A works, pass card B works.
[43:13.120 --> 43:13.700]  Everything works.
[43:13.830 --> 43:14.580]  Everybody happy.
[43:15.720 --> 43:24.270]  We, however, thought that there might be ways of decoding and picking because of the different pressures that can happen because of the control card and the pin matrix.
[43:24.640 --> 43:30.330]  A pin stack that's totally free floating only has the pressure of one spring underneath it.
[43:31.000 --> 43:34.240]  A pin stack that is supported by a control card.
[43:34.350 --> 43:38.790]  So technically a ball bearing is supported by multiple springs in the stack.
[43:39.000 --> 43:40.770]  That would have a lot more pressure.
[43:40.890 --> 43:42.320]  It would almost bind up against you.
[43:42.680 --> 43:48.840]  So the idea of either putting carbon paper in there with a piece of paper and scraping a credit card in and out to try to make an impression.
[43:49.200 --> 43:58.120]  Babak had a really cool, really, really Lito awesome diagram of like a sensitive spring card thing that I had no time to animate at like 6 30 in the morning.
[43:58.860 --> 44:06.840]  But yeah, so if you have us back or if you want to visit us at another, maybe a European con when we're going to try to do more about this, we want to explore this further.
[44:07.000 --> 44:08.500]  I think there's a lot more potential there.
[44:09.340 --> 44:20.100]  Even just the idea of, you know, you said raking, like right, if you could push on the drawer and just scrape something in and out, unless these pins are security pins, you could probably rake them into position with a couple of passes.
[44:20.380 --> 44:23.900]  Yeah, we'd probably have to make a custom tensioner to tension the drawer.
[44:24.640 --> 44:28.680]  But yeah, you could probably you could probably easily rake the lock.
[44:29.300 --> 44:30.960]  Impressioning is going to be a lot easier on this.
[44:31.200 --> 44:31.200]  Yeah.
[44:31.660 --> 44:33.290]  So yeah, we're going to play with this some more.
[44:33.400 --> 44:34.920]  Again, if you have any of these, let us know.
[44:35.040 --> 44:36.420]  We really want to mess with these.
[44:36.820 --> 44:41.620]  But of course, you know, you might also realize there's no easy way to master key a system like this.
[44:42.120 --> 44:48.620]  Most of these VIN card systems, especially the old pin matrix, they do have a master key just override for the maid and everyone else.
[44:49.000 --> 44:51.290]  You can see them on the lock usually.
[44:51.540 --> 44:53.380]  Sometimes they're hidden by a logo or something.
[44:53.520 --> 44:54.220]  They're still there.
[44:54.880 --> 44:56.580]  Sometimes they're installed really badly.
[44:56.770 --> 44:57.820]  They're not even screwed in right.
[44:57.940 --> 44:59.000]  You can just kind of screw them out.
[44:59.120 --> 44:59.980]  And we found that out.
[45:01.020 --> 45:05.000]  So if you take the lock apart, you wind up being able to just get the pin cuts and make your own master key.
[45:05.000 --> 45:07.200]  Much like the peephole with no tools.
[45:07.940 --> 45:09.790]  Yeah, that was bare fingers doing this.
[45:10.000 --> 45:10.770]  But not us, though.
[45:10.840 --> 45:11.500]  We didn't do this.
[45:11.680 --> 45:12.620]  No, there was no.
[45:13.020 --> 45:13.790]  It was somebody.
[45:13.790 --> 45:14.480]  I don't know who did this.
[45:14.600 --> 45:15.240]  It was on the inner tubes.
[45:15.380 --> 45:15.800]  I saw it.
[45:15.940 --> 45:16.740]  It's real on the Internet.
[45:17.920 --> 45:23.290]  So lastly, though, another place you'll see these override keys are not pin matrix locks.
[45:23.640 --> 45:24.880]  They are MagCard locks.
[45:25.420 --> 45:28.100]  Magstripe locks have largely replaced pin matrix.
[45:28.400 --> 45:29.340]  Vincard makes them.
[45:29.420 --> 45:30.640]  A lot of companies make them.
[45:30.900 --> 45:32.040]  You guys have all seen these.
[45:32.180 --> 45:33.720]  You know, it's a magstripe card.
[45:34.120 --> 45:36.560]  Now, the tracks are usually non-standard.
[45:36.700 --> 45:40.000]  It's not something that will always read perfectly in a basic reader.
[45:40.100 --> 45:43.080]  You need to get an expensive reader that'll do raw dump data.
[45:43.270 --> 45:45.420]  That'll just show you whatever's on the card.
[45:45.580 --> 45:47.540]  It doesn't worry about timing, spacing, track density.
[45:47.740 --> 45:47.900]  Or a really cheap one.
[45:48.360 --> 45:49.420]  Usually that's how it works.
[45:49.540 --> 45:50.290]  Yeah, exactly.
[45:50.540 --> 45:51.380]  If they break standard.
[45:51.920 --> 45:56.000]  Yeah, if the really cheap stuff, right, they can't do all the decoding and hardware.
[45:56.140 --> 45:58.800]  So they just dump the raw data to software and they do it in software.
[45:59.270 --> 46:01.840]  And you want raw, you know, to do this kind of stuff.
[46:02.300 --> 46:06.420]  And then there's the really expensive stuff that does all the decoding and... thank you.
[46:07.140 --> 46:08.560]  It does all the decoding and hardware.
[46:08.980 --> 46:13.360]  But as an extra feature, then they'll, you know, add a little raw dump option.
[46:13.790 --> 46:18.000]  But... Yeah, Deal Extreme might be your source if you want to f*ck magstripe cards, by all means.
[46:18.700 --> 46:21.270]  Crying A's and children will help you pwn Zor the world.
[46:22.860 --> 46:25.460]  So yeah, what's going on with magcards?
[46:25.960 --> 46:30.580]  Really quickly, we have to give a really big thanks to Major Malfunction.
[46:30.700 --> 46:33.790]  Has anyone ever seen MagStripe Madness or Old School Hacking?
[46:33.940 --> 46:34.540]  A couple hands.
[46:35.180 --> 46:39.200]  Major Malfunction's talks about this were an inspiration for us to look into this further.
[46:39.620 --> 46:42.720]  Every room key we've ever inspected is like this.
[46:42.860 --> 46:44.440]  The formatting is very similar.
[46:45.180 --> 46:47.240]  You'll have some kind of start sentinel.
[46:47.500 --> 46:48.920]  Many people don't know this.
[46:49.240 --> 46:51.600]  It's really how most magstripe systems work.
[46:51.840 --> 46:53.920]  The card will clock itself.
[46:54.220 --> 47:00.160]  So each, like, bit that it ticks, the timing establishes what it expects for the next timing.
[47:00.360 --> 47:05.300]  So he could be, you know, really, really fast, and I could be really slow and long and drawn out.
[47:06.240 --> 47:06.640]  Nobody?
[47:07.180 --> 47:08.200]  That's what she said.
[47:08.320 --> 47:08.840]  There you go.
[47:09.220 --> 47:10.020]  That was a push.
[47:10.220 --> 47:10.340]  That was a push.
[47:10.340 --> 47:11.460]  I set that one up.
[47:11.520 --> 47:12.560]  It's an easy pitch to hit.
[47:12.740 --> 47:13.400]  But no...
[47:13.400 --> 47:14.500]  But the clock will expect it.
[47:14.620 --> 47:16.800]  It'll expect the bits in the speed that it's been shooting.
[47:17.120 --> 47:18.700]  Consistent motion is what makes it work.
[47:18.790 --> 47:23.000]  If you change the speed of the swipe, then it's going to give you an error.
[47:23.200 --> 47:26.340]  So the site that has been issued this system will have its own code.
[47:26.790 --> 47:28.200]  Every hotel, you know, gets their own.
[47:28.520 --> 47:30.380]  But, you know, then it's all just in the clear.
[47:30.480 --> 47:31.360]  You have a room number.
[47:31.640 --> 47:32.880]  You have a key number.
[47:33.270 --> 47:35.060]  You have what's called a magic number.
[47:35.060 --> 47:35.880]  We'll get into that.
[47:36.040 --> 47:39.320]  And then when it expires and some checksum and ending data at the end.
[47:39.540 --> 47:43.640]  So if you go downstairs to the desk and you say, hey, you know, my wife checked in now.
[47:43.740 --> 47:44.980]  Her flight finally arrived.
[47:45.120 --> 47:47.320]  Can we have another key to our room?
[47:47.720 --> 47:49.400]  And they're like, okay, so you have your key.
[47:49.580 --> 47:50.820]  Your key will still work, sir.
[47:51.020 --> 47:51.660]  Okay, here you go.
[47:51.700 --> 47:52.480]  Here's the next key.
[47:52.700 --> 47:54.220]  What they'll give you is usually this.
[47:54.500 --> 47:55.560]  It's the same key.
[47:55.720 --> 47:56.740]  It just increments the number.
[47:57.480 --> 47:59.680]  The locks are usually passive locks.
[47:59.840 --> 48:02.440]  They just expect what they've been trained to expect.
[48:02.640 --> 48:04.290]  We'll tell you what that means in a second.
[48:05.180 --> 48:07.980]  How many people, however, have ever been given a new key?
[48:08.080 --> 48:09.140]  Like, I need a second key.
[48:09.360 --> 48:11.080]  And then all the old keys f*cking don't work anymore.
[48:11.220 --> 48:11.980]  How does that happen to you?
[48:12.040 --> 48:12.300]  Yes.
[48:12.540 --> 48:16.900]  Or you try to be sneaky, like, oh, I only have double occupancy, but I want more people.
[48:16.900 --> 48:19.790]  So I'll just say that I forgot, lost my keys and it'll give me more keys.
[48:20.160 --> 48:21.270]  No, it doesn't work.
[48:21.440 --> 48:28.980]  What they actually do in that instance, they will issue you a brand new, you know, here's key number one, but they'll change the magic number.
[48:29.420 --> 48:37.520]  Now, the algorithm for incrementing the magic number can be really simple, like walking a bit, or it can be really complicated.
[48:37.520 --> 48:42.660]  But all the lock in the door knows is, hey, this is a new magic number.
[48:42.980 --> 48:47.900]  I have to respect this number, knock out every key that I saw before.
[48:48.320 --> 48:52.060]  And as long as the checksum works, the key is valid.
[48:52.560 --> 48:56.720]  So the lock will usually store the last, let's say, 100 magic numbers.
[48:57.020 --> 48:58.520]  You can brute force these.
[48:58.660 --> 49:00.220]  You can just keep trying magic numbers.
[49:00.400 --> 49:03.340]  It'll disable the old keys and all of a sudden the door opens.
[49:03.980 --> 49:10.940]  It's really, really easy to do if you have one of those raw, write, raw, you know, raw read, raw write track, track stripe readers, man.
[49:11.040 --> 49:12.020]  It's really, really fabulous.
[49:12.740 --> 49:16.420]  And you know, most systems, as you said, they're passive.
[49:16.620 --> 49:18.080]  They're actually not centrally wired.
[49:18.500 --> 49:23.320]  There's no big computer that they tie into at the front desk where they, you know, kill all the old cards.
[49:23.480 --> 49:24.140]  It's just this.
[49:24.840 --> 49:29.000]  Although, on occasion, there are, you know, systems that are wired in.
[49:29.000 --> 49:31.300]  There is a wire running through the door jamb.
[49:31.440 --> 49:32.800]  You can see it when the door is open.
[49:33.040 --> 49:33.200]  Right.
[49:34.240 --> 49:39.240]  And yeah, if you keep trying this over and over, every now and then you're like, all right, let's try to reprogram this card.
[49:39.320 --> 49:39.960]  I wonder what it's doing.
[49:40.160 --> 49:43.000]  And then you come back, you have another slice of pizza, sip of beer, reprogram the card.
[49:43.120 --> 49:43.800]  Let's see what it's doing.
[49:44.140 --> 49:47.140]  And then enough times doing that, you open your door to try it again.
[49:47.360 --> 49:50.580]  And as Major Malfunction tells the story, you say, oh, oh, hello.
[49:50.840 --> 49:51.320]  Hello, sir.
[49:51.980 --> 49:52.980]  Mr. Security, sir.
[49:53.120 --> 49:53.560]  How are you doing?
[49:54.540 --> 49:55.940]  Did you, did they send you up?
[49:56.020 --> 49:57.460]  Because we're having trouble with this room key.
[49:57.580 --> 49:58.700]  I don't know what's been going on.
[49:59.200 --> 50:01.540]  I'm going to go downstairs and sort that out.
[50:03.290 --> 50:07.920]  So yeah, sometimes it will set off an audit event, but usually no, usually it's all passive.
[50:08.460 --> 50:10.600]  And it's really, really easy to do this.
[50:10.700 --> 50:16.680]  Now, there are other special modes that we don't have time and we don't, well, trust these nefarious people to talk about a lot.
[50:16.800 --> 50:23.880]  There are other modes that have to do with changing the magic number, changing the room number to either null or to nines.
[50:23.880 --> 50:34.000]  We have some police buddies who hotels in the area will issue them a key and it'll get them to the elevators and it'll get them around the outer doors for like, let's say a whole month.
[50:34.290 --> 50:36.320]  If there's a disturbance here, use this key.
[50:36.800 --> 50:41.600]  Blanking out the room number or doing funny things to the room number will sometimes give you access.
[50:41.960 --> 50:47.120]  So if you want to be a delivery man, a food delivery service, and you're like, oh, this hotel doesn't allow outside food.
[50:47.940 --> 50:51.580]  Sometimes a key like this will let you get up and down the elevators just fine.
[50:51.770 --> 50:53.540]  Get in the outside doors just fine.
[50:53.680 --> 51:04.960]  If you want to deliver, you know, the Kung Pao chicken, or if you want to run like really high-class whores that knock on the door and they don't have to call the concierge, it's really embarrassing when they're like, Mr. Michaud, your guests have arrived.
[51:05.940 --> 51:08.660]  They know, they all know in the lobby what's going on.
[51:09.480 --> 51:11.240]  So, you know, you make a key like this.
[51:11.790 --> 51:16.240]  There are also special modes that, oh, they're turning on me again.
[51:16.440 --> 51:16.600]  Yes.
[51:17.460 --> 51:25.400]  There are also special modes of obviously that security has, that maids have, that will let the door open, but will not knock out previous keys from working.
[51:25.600 --> 51:28.580]  That has to do with playing with the magic number and the room number as well.
[51:28.740 --> 51:29.860]  We're not going to get into that here.
[51:30.660 --> 51:38.320]  Really interesting that we're so not going to get into is crime scene mode, which Major Malfunction insists will totally DOS the door.
[51:38.520 --> 51:48.360]  Like if there's evidence that has to be preserved or they don't want some maid coming in and vacuuming up the blood before the CSI team gets there, it'll just pwn the lock and no one can get in at all ever for any purpose.
[51:49.660 --> 51:54.140]  But yeah, if you want to know more about that, please tell Major Malfunction how awesome he is.
[51:54.240 --> 51:55.640]  Tell him you want to see more of his talks.
[51:56.060 --> 52:01.420]  He's always a treat to be around and it was able to help us pad this out a little bit more to entertain the guests today.
[52:01.980 --> 52:03.960]  That's ultimately what we wanted you to see.
[52:04.080 --> 52:06.270]  There's a lot of fun with hotel locks.
[52:06.540 --> 52:12.740]  We're not going to tell you how to do really, really wicked shit, but hopefully, you know, we peppered their brains enough that they understand how it works.
[52:12.740 --> 52:15.320]  We're throwing together talk and I hope everyone enjoyed it.
[52:15.620 --> 52:17.680]  Yeah, come visit the lockpick village.
[52:21.340 --> 52:31.020]  We have just to let just to let everyone know we have a couple of four really, really awesome contests running in the lockpick village.
[52:31.300 --> 52:33.900]  We have games, we have tools, we have lessons, we have everything down there.
[52:33.900 --> 52:35.180]  Please come have fun.
[52:35.180 --> 52:36.880]  You will look awesome in front of your friends.
[52:38.140 --> 52:41.440]  There are prizes, there are awesomeness, there are blowjobs and fun and beer.
[52:41.600 --> 52:42.480]  Thank you very much.
[52:42.560 --> 52:43.320]  We'll take questions.
[52:50.120 --> 52:50.660]  we're welcome.
[52:50.660 --> 52:50.940]  All right.
[52:54.390 --> 52:56.170]  All right, Alright, coming up next...