[00:01.310 --> 00:02.970]  My name is Mark Tobias.
[00:03.290 --> 00:14.390]  For the last 25 years, myself and my partner have worked for the largest lock manufacturers in the world, figuring out how to open their locks when they could not be opened.
[00:14.830 --> 00:26.130]  So I decided during the pandemic, when I couldn't be back and forth to Europe as usual, to write a book that I coined the phrase insecurity engineering.
[00:26.910 --> 00:34.070]  This is what the lock manufacturers are doing in the locks and access control systems that they design.
[00:34.370 --> 00:40.090]  That's why they can be opened generally without keys and often in seconds.
[00:40.450 --> 00:43.090]  So I took my experience.
[00:43.490 --> 00:47.770]  I did a 700 page book about my experience.
[00:48.110 --> 00:56.130]  The lock industry is incredibly complicated, legally, technically, security, design-wise.
[00:56.430 --> 00:59.330]  We also run a security engineering lab.
[01:00.050 --> 01:08.690]  at the University of Pittsburgh School of Engineering with senior engineering students to work on various security projects and some of the patents I have.
[01:09.010 --> 01:12.670]  So I'd like to impart what the issue is today.
[01:12.730 --> 01:17.450]  And if you all have questions at the end, I'd be glad to entertain them.
[01:17.630 --> 01:23.470]  I'm sitting today because 10 days ago I had back surgery and I'm not quite recovered yet.
[01:23.750 --> 01:25.830]  I don't recommend it to anybody.
[01:26.590 --> 01:28.030]  I had a pinched nerve.
[01:28.210 --> 01:29.470]  It's very, very painful.
[01:29.470 --> 01:31.530]  And it still is.
[01:32.450 --> 01:37.050]  So, this is the book, Tobias on Locks and Insecurity Engineering.
[01:38.510 --> 01:40.350]  So, what is it?
[01:41.250 --> 01:55.230]  The problem, insecurity engineering by lock manufacturers, locks, physical security, and access control systems are often not secure even though they meet all the standards.
[01:56.310 --> 02:03.730]  In the United States there are two standard agencies, as I'm sure many of you know for evaluating locks.
[02:04.650 --> 02:09.290]  Builders Hardware Manufacturers Association and Underwriters Laboratories.
[02:09.790 --> 02:14.090]  I've been on the UL panel for locks and safes for about 15 years.
[02:14.950 --> 02:17.010]  I'm not impressed with the standards.
[02:17.010 --> 02:18.010]  There are guidelines.
[02:18.350 --> 02:22.750]  But there's, as I point out in the book, there's a lot of problems with the standards.
[02:23.990 --> 02:33.530]  Insecurity engineering highlights the need to forecast, discover, and prevent insecure designs from reaching the end user.
[02:33.750 --> 02:41.190]  The problem is the end user, unless they have their own testing facilities, they don't have any way to judge whether something's secure or not.
[02:41.190 --> 02:56.930]  So, I went into great detail in the book about the legal aspects, design aspects, technical aspects, and I can reduce the problems in our industry worldwide as a lack of imagination.
[02:58.010 --> 03:08.930]  Design engineers, as we've discovered at the University of Pittsburgh, which is a pretty good engineering school, the engineers, especially mechanical engineers, learn how to make things work.
[03:08.930 --> 03:11.290]  But they don't learn how to break them.
[03:11.570 --> 03:13.510]  And that is really the problem.
[03:13.690 --> 03:18.190]  Today, security and designs are a 50-50 equation.
[03:18.690 --> 03:26.690]  And as I'll note in the rules we've developed as a lawyer, all security is about liability.
[03:26.690 --> 03:34.770]  If there's a design problem, and somebody is hurt, robbed, killed, or data is stolen, somebody is going to write a check.
[03:35.330 --> 03:38.230]  And at that point, everybody starts paying attention.
[03:38.610 --> 03:40.150]  So, why is it important?
[03:40.930 --> 03:44.190]  Locks and access control systems protect infrastructure.
[03:45.350 --> 03:53.290]  High security locks especially may appear to be secure, but our research, a lot of them are not.
[03:53.950 --> 04:01.270]  We wrote a book about Medico high security locks, which are the best high security lock in America, in our view.
[04:01.570 --> 04:14.150]  We wrote a book about it because we compromised their locks in many different ways, and actually received four patents for four keys that we could pick or bump most of their locks in the world.
[04:14.150 --> 04:16.850]  And they thought we were crazy.
[04:17.710 --> 04:19.590]  That may have been a separate issue.
[04:21.930 --> 04:25.290]  They could not conceive of what we did.
[04:25.630 --> 04:28.230]  It took us 18 months in a research project.
[04:28.230 --> 04:30.710]  We wrote a book called Open in 30 Seconds.
[04:31.430 --> 04:39.050]  The best time that we opened their locks at a high security facility was 23 seconds, which was very upsetting to everybody.
[04:39.930 --> 04:48.430]  And so, just because it looks secure and the manufacturers tell you it's secure, it may not be.
[04:48.430 --> 04:52.650]  In most of our experience is we have found ways to open locks.
[04:53.510 --> 04:56.670]  So, standards do not guarantee security.
[04:58.210 --> 05:05.730]  And also, patents, in our view, and I have a lot of them, don't mean anything with regard to security.
[05:07.510 --> 05:11.610]  The patent office doesn't test designs for security.
[05:11.870 --> 05:16.230]  They just test to make sure that we meet the criteria for filing a patent.
[05:16.230 --> 05:19.590]  So, as you can see up on the screen, that's my background.
[05:20.150 --> 05:27.330]  I come from a legal and law enforcement background, especially in South Dakota with the Office of Attorney General.
[05:27.910 --> 05:34.930]  But again, the relevant experience, we worked for the largest, still work for the largest lock manufacturers in the world.
[05:35.410 --> 05:38.510]  So, in security engineering, what is it?
[05:38.570 --> 05:39.690]  And what does it involve?
[05:40.330 --> 05:41.690]  Why does it occur?
[05:42.150 --> 05:44.310]  Is it anything new?
[05:44.970 --> 05:46.250]  Who does it affect?
[05:46.730 --> 05:48.010]  These are the questions.
[05:48.270 --> 05:49.090]  What is the result?
[05:49.450 --> 05:50.550]  Why is it important?
[05:50.810 --> 05:53.790]  And I'll go through examples of insecurity engineering.
[05:54.110 --> 05:59.650]  My mom, many years ago, I started this when I was 15, picking locks.
[05:59.950 --> 06:03.430]  And my dad was a mechanical engineer from Carnegie Mellon Tech.
[06:03.430 --> 06:10.390]  And I took my mom to a lock factory in Israel and she says, I don't understand this.
[06:10.570 --> 06:14.110]  What is so complicated about sticking a key in a lock?
[06:15.130 --> 06:17.790]  And that's most people's impression.
[06:18.130 --> 06:21.470]  And as I told her, it's not complicated to insert the key.
[06:21.750 --> 06:24.630]  To make it work securely is complicated.
[06:25.210 --> 06:28.110]  Locks are very, very complicated.
[06:28.790 --> 06:31.010]  So, who is this book written for?
[06:31.210 --> 06:40.590]  You guys, design engineers, risk managers, crime labs, criminal investigators, and intelligence agencies and covert entry teams.
[06:42.450 --> 06:52.710]  Nobody is... well, I coined the phrase insecurity engineering because of my friend Ross Anderson at Cambridge University, where I've lectured for many years.
[06:52.990 --> 07:01.930]  He wrote the companion book, Security Engineering, which I would highly recommend all of you read, if that's your field of endeavor.
[07:02.290 --> 07:09.290]  It is the Bible on what can go wrong with microprocessor-based systems.
[07:09.290 --> 07:18.290]  So, I decided one year when I was lecturing at Cambridge, I might as well write the reverse of that book, which is insecurity engineering.
[07:18.590 --> 07:20.910]  It's the flip side of what Ross wrote.
[07:21.230 --> 07:23.910]  So, now Wiley is offering both of the books.
[07:25.830 --> 07:27.950]  Okay, so why I chose the title.
[07:29.890 --> 07:32.790]  Locks that have design flaws and vulnerabilities.
[07:33.290 --> 07:34.170]  That helps.
[07:36.370 --> 07:41.290]  Engineers do not understand... is that a message?
[07:46.260 --> 07:46.820]  Exactly.
[07:47.800 --> 07:50.720]  Either some... or that or a 10-year-old kid is messing with it.
[07:51.900 --> 07:54.260]  So, engineers don't... yeah.
[07:55.200 --> 07:57.760]  Engineers don't understand different methods of compromise.
[07:58.580 --> 08:05.980]  Engineers, as I said, are taught how to make things work, not how to break them, and how a lock could be compromised.
[08:06.380 --> 08:10.660]  One of my major clients had a worldwide meeting for me.
[08:10.940 --> 08:13.560]  And they had 25 engineers assembled.
[08:13.980 --> 08:17.220]  And I asked all of them, how many of you guys know how to pick locks?
[08:17.580 --> 08:17.960]  Three.
[08:18.720 --> 08:20.680]  That really doesn't make it.
[08:20.680 --> 08:28.180]  And so... and actually, this was one of the companies that was involved in the Kryptonite bike lock fiasco.
[08:28.460 --> 08:30.260]  How many of you guys ride bikes?
[08:31.360 --> 08:31.880]  Lots?
[08:32.280 --> 08:33.900]  You have Kryptonite bike locks?
[08:34.860 --> 08:37.100]  I'll go through that in the slides in a minute.
[08:38.180 --> 08:46.120]  I was bored on a Sunday afternoon, and it cost them $10 million in recalls, because we figured out how to open their locks with a ballpoint pen.
[08:47.100 --> 08:48.900]  And I'll go through that.
[08:49.040 --> 08:50.380]  And it's also detailed in the book.
[08:50.560 --> 08:54.480]  It's a classic example of failure to connect the dots.
[08:54.860 --> 08:57.420]  So what did I... why did I write the book?
[08:57.620 --> 09:00.080]  To identify and minimize design vulnerabilities.
[09:00.680 --> 09:12.760]  And more importantly, to provide a roadmap to design engineers and cybersecurity experts into what to look for and how to reverse engineer a system.
[09:12.760 --> 09:14.780]  So how can it help you?
[09:14.980 --> 09:18.220]  How to understand different locks could have been compromised.
[09:18.600 --> 09:20.880]  Provide ideas about target locks.
[09:21.300 --> 09:25.040]  And a way to assess whether they are secure or not.
[09:25.360 --> 09:27.100]  Don't believe the standards.
[09:27.440 --> 09:32.360]  The standards are guidelines, but they won't tell you really if the lock is secure.
[09:32.880 --> 09:36.940]  Ideas on reverse engineering of security of devices.
[09:36.940 --> 09:41.420]  And what are the different tools and techniques available to defeat locks.
[09:43.100 --> 09:47.260]  The problem is how to avoid design defects.
[09:47.800 --> 09:53.580]  First of all, you need to understand the history of lock designs and how they could be compromised a couple hundred years ago.
[09:53.840 --> 10:01.060]  I went into this a lot of detail, because the way they could be compromised then is relevant today.
[10:01.060 --> 10:03.660]  And most engineers don't understand that.
[10:03.940 --> 10:06.480]  The development of techniques of bypass.
[10:07.380 --> 10:10.180]  Choose the right design team and how to do that.
[10:10.360 --> 10:12.420]  And a summary of bypass tools.
[10:12.840 --> 10:18.280]  There are some very sophisticated bypass tools now that I describe in the book.
[10:19.540 --> 10:23.380]  How you can electronically read locks and keys.
[10:23.380 --> 10:24.860]  3D printing.
[10:25.220 --> 10:31.080]  There's all new techniques now and tools for bypassing locks that protect your infrastructure.
[10:32.240 --> 10:37.080]  So, basically you need to understand attack techniques.
[10:37.840 --> 10:40.120]  And also the leaders in the industry.
[10:40.400 --> 10:45.340]  John Fall, Madeline in France, Addie Wendt in Germany.
[10:45.340 --> 10:56.600]  These are the guys that have developed the tools over the last 50, 75 years that have really driven the manufacturers to develop higher security locks.
[10:56.940 --> 11:05.480]  The problem is every time a manufacturer adds complexity to a lock design, they give us more opportunities to defeat it.
[11:05.940 --> 11:08.480]  So, I'll just go through a few of these.
[11:08.860 --> 11:10.960]  I think the PowerPoint will be online.
[11:12.860 --> 11:16.360]  All of our lectures over the years, we've developed a lot of rules.
[11:16.680 --> 11:18.940]  Not only at HOPE, but at DEFCON.
[11:19.940 --> 11:22.680]  All security, as I note, is about liability.
[11:23.700 --> 11:25.720]  Always believe you can defeat a lock.
[11:26.400 --> 11:30.340]  Look for simple solutions to solve what appear to be complex problems.
[11:30.840 --> 11:37.220]  A lot of the really high security locks that we've broken or defeated, we opened really simply.
[11:38.120 --> 11:40.820]  And it was really a shock to the manufacturers.
[11:42.540 --> 11:49.180]  Look for exploiting a design or combination of designs in simple or hybrid attacks.
[11:49.480 --> 11:54.320]  I go into great detail about hybrid attacks.
[11:54.580 --> 12:01.060]  That is combining more than one type of attack to defeat a lock or access control system.
[12:01.060 --> 12:07.880]  This is really important, especially now with the advent of 3D printing.
[12:08.240 --> 12:14.540]  A lot of lock manufacturers have advertised in the media that their locks could not be bumped open.
[12:14.720 --> 12:17.200]  I assume most of you know what lock bumping is?
[12:19.220 --> 12:19.780]  Yes?
[12:20.040 --> 12:20.500]  Yes.
[12:20.880 --> 12:21.160]  Yeah.
[12:21.340 --> 12:21.680]  Have you?
[12:22.220 --> 12:22.660]  Okay.
[12:22.660 --> 12:22.740]  Okay.
[12:23.420 --> 12:27.420]  So, this is a real problem in the industry still.
[12:28.040 --> 12:33.880]  A lot of locks, both conventional and high security, can be bumped open in seconds.
[12:34.480 --> 12:37.460]  Some with regular keys that you can get at the hardware store.
[12:38.200 --> 12:41.700]  95% of the pin tumbler locks in America can be bumped open.
[12:41.700 --> 12:44.120]  So, it's a problem.
[12:44.400 --> 12:46.800]  The lock industry at first denied it.
[12:47.560 --> 12:52.060]  Lock bumping, actually the first bump key was patented in 1925 in England.
[12:52.360 --> 12:54.280]  And then everybody forgot about it.
[12:55.540 --> 12:57.580]  So, I have a lot of rules.
[12:57.820 --> 12:58.940]  Here's the best one.
[12:59.160 --> 13:01.240]  The key never unlocks the lock.
[13:01.240 --> 13:05.880]  And everybody looks at me and says, what does that mean?
[13:06.380 --> 13:10.440]  So, what it means is the key doesn't actually unlock the lock.
[13:10.640 --> 13:13.900]  It actuates the mechanism that unlocks the lock.
[13:14.240 --> 13:19.760]  So, just because it is patented, it doesn't mean it's secure.
[13:21.020 --> 13:23.060]  Every lock has vulnerabilities.
[13:24.320 --> 13:29.520]  R&D costs are often skirted, which gives us an opening.
[13:29.520 --> 13:41.660]  Any opening, no matter if it's ten thousandths of an inch in a lock cylinder or system, we can exploit with special wires to open locks.
[13:42.840 --> 13:48.720]  Like Donald Rumsfeld said a few years ago, you don't know what you don't know.
[13:48.920 --> 13:51.560]  And this is really true about lock designs.
[13:51.880 --> 13:57.700]  And again, the use of imagination, the lack of imagination is a huge problem.
[13:57.700 --> 14:01.580]  So, and here's one other rule that I like.
[14:01.960 --> 14:04.680]  Electrons don't open doors, mechanics do.
[14:05.480 --> 14:18.940]  So, all of the encryption that a lot of you work with, it doesn't mean anything to us, because we always attack the interface between hardware and software.
[14:18.940 --> 14:22.480]  That's where the vulnerability always is.
[14:22.740 --> 14:26.540]  In electronic locks, which we're working with more and more.
[14:27.000 --> 14:31.180]  So, let me go, I'm going to go bypass these rules.
[14:31.580 --> 14:34.980]  And by the way, clever does not mean secure.
[14:36.440 --> 14:40.680]  Our students at the University of Pittsburgh, I need to constantly explain this to them.
[14:40.840 --> 14:46.580]  They all think they come up with clever designs until we point out, how do we defeat it?
[14:46.940 --> 14:48.980]  Isn't it simple to do this, this, and this?
[14:49.060 --> 14:51.180]  And they say, oh, we never thought of that.
[14:51.400 --> 14:54.320]  Well, this is the problem with lock manufacturers as well.
[14:54.660 --> 14:57.360]  And you cannot get around the laws of physics.
[14:57.360 --> 15:03.380]  We use Newton's Laws of Motion to open a lot of locks.
[15:04.000 --> 15:12.580]  So, and also, we look at critical as well as non-critical components, especially to open high-security locks.
[15:12.980 --> 15:15.720]  Every component in a lock is relevant.
[15:16.160 --> 15:18.840]  So, everything is suspect.
[15:19.940 --> 15:22.480]  So, we're going to go through some case examples.
[15:22.480 --> 15:25.740]  And then, I really hope you guys ask some questions.
[15:26.620 --> 15:29.360]  We're going to talk about our Medico code-setting keys.
[15:29.520 --> 15:31.000]  And I'm not picking on Medico.
[15:31.100 --> 15:31.980]  We love the company.
[15:34.500 --> 15:36.540]  In fact, they have them on campus here.
[15:36.900 --> 15:38.960]  They're really the top lock.
[15:39.620 --> 15:48.000]  Since we wrote our book 15 years ago, and the nightmare they had in Wired Magazine, they've come out with a new design called the M4.
[15:48.360 --> 15:50.300]  It's really, really a good lock.
[15:51.140 --> 15:52.120]  Is it perfect?
[15:52.420 --> 15:52.920]  No.
[15:52.920 --> 15:55.500]  Well, but it's very, very good.
[15:56.640 --> 16:00.280]  We also use a lot of magnetics to open locks.
[16:00.560 --> 16:03.240]  Lock manufacturers have discovered magnets again.
[16:03.680 --> 16:05.600]  For a while, they didn't like them.
[16:06.100 --> 16:09.420]  Now, they've figured out they're really cool to integrate into keys.
[16:10.100 --> 16:14.600]  The Kaba Simplex 1,050-300, I'll talk about.
[16:15.340 --> 16:19.860]  And then the magnetic ring that defeated a lot of electronic locks.
[16:20.340 --> 16:22.460]  And the iLock system out of Finland.
[16:23.140 --> 16:26.240]  So, how many of you guys know what a worm gear is?
[16:27.060 --> 16:28.700]  And it's not for fishing.
[16:29.920 --> 16:30.620]  Okay.
[16:31.400 --> 16:37.420]  A worm gear, as you see in the image, it's a motor-driven little screw gear.
[16:37.600 --> 16:51.100]  And that little wire, as the motor turns the gear when the correct credentials are applied, the little wire moves to a locked or unlocked state of a rotor, or whatever the blocking element is.
[16:52.760 --> 17:01.580]  So, many of the lock manufacturers in Europe and the Middle East have electronic cylinders with a free-spinning knob on the outside.
[17:01.900 --> 17:11.540]  And the way they tested that for defeat capability is to put a drill motor and spin it at high speed, low speed, whatever they thought would work.
[17:11.700 --> 17:13.760]  And they couldn't open it that way.
[17:13.940 --> 17:18.540]  So, one of our clients gave us a prototype, and they were ready to go into production.
[17:19.140 --> 17:23.640]  And they said, listen, we'd like you guys to look at this, but we're not worried about it.
[17:23.740 --> 17:24.540]  It's very secure.
[17:24.780 --> 17:25.980]  The electronics are great.
[17:26.200 --> 17:27.540]  The encryption is great.
[17:28.080 --> 17:28.960]  Everything's okay.
[17:29.940 --> 17:34.120]  So, my partner, Tobias Bluzmanis, and I took a look at it.
[17:35.100 --> 17:36.860]  And here was the result.
[17:46.100 --> 17:58.800]  So, I just want to tell you, we made a jig out of basically a screwdriver and a little hose clamp that we put on the front of the lock.
[17:59.320 --> 18:00.920]  And then you'll see what happens.
[18:01.080 --> 18:02.460]  It's about 30, 40 seconds.
[18:02.460 --> 18:04.240]  The lock is open with no audit trail.
[18:05.060 --> 18:06.360]  I don't know how many...
[18:06.360 --> 18:07.380]  I think it's about 11.
[18:07.700 --> 18:07.920]  Really?
[18:08.180 --> 18:09.120]  I think maybe 11.
[18:15.000 --> 18:21.360]  But you're going to slowly see that piece move forward, which is obviously the critical issue here.
[18:37.600 --> 18:38.840]  Watch my hands.
[18:53.940 --> 19:01.140]  You actually can see from the top camera, the two prongs already extended.
[19:03.360 --> 19:08.260]  And you can see that pin is moving forward as Toby is spinning.
[19:08.260 --> 19:09.200]  Okay?
[19:09.840 --> 19:11.400]  And when the pin is moved forward...
[19:11.400 --> 19:12.280]  Is that a little how many...?
[19:12.280 --> 19:13.220]  I think it's about 11.
[19:13.620 --> 19:13.820]  Hmm?
[19:14.060 --> 19:14.960]  I think maybe 11.
[19:20.870 --> 19:27.230]  But you're going to slowly see that piece move forward, which is obviously the critical issue here.
[19:43.440 --> 19:44.720]  Watch my hands.
[19:45.660 --> 19:46.440]  Sit down.
[19:59.880 --> 20:07.020]  You actually can see from the top camera, the two prongs already extended.
[20:07.980 --> 20:08.460]  Yep.
[20:08.880 --> 20:12.260]  It's extended as much as we can.
[20:12.520 --> 20:14.880]  So, actually...
[20:15.560 --> 20:16.400]  Right there.
[20:17.300 --> 20:18.580]  And it's open.
[20:18.780 --> 20:19.640]  And the lock is open.
[20:19.660 --> 20:22.000]  And so this is precisely...
[20:22.000 --> 20:26.460]  Okay, and the problem with that is there's no audit trail.
[20:27.300 --> 20:29.540]  And we can do this very quietly.
[20:30.200 --> 20:31.580]  It's a lot noisier on the video.
[20:31.800 --> 20:33.620]  We can do this very quietly.
[20:33.920 --> 20:35.480]  And we can do it in stages.
[20:36.120 --> 20:38.800]  And so this is a really deadly attack.
[20:39.100 --> 20:43.180]  It took some of our clients in Europe four years to fix this problem.
[20:45.020 --> 20:46.000]  They were happy.
[20:46.200 --> 20:47.600]  They couldn't believe we found it.
[20:47.820 --> 20:48.620]  They were happy.
[20:48.680 --> 20:51.500]  And they weren't happy because they had to do a lot of design work.
[20:51.800 --> 20:53.720]  Okay, this is the Medeco.
[20:53.900 --> 20:55.300]  This is the way Medeco works.
[20:55.300 --> 20:57.360]  How many of you all know how Medeco works?
[20:58.180 --> 20:59.240]  Not very many?
[21:00.280 --> 21:00.460]  Okay.
[21:01.120 --> 21:12.620]  A couple of geniuses in 1968 in Virginia figured out how to modify pin tumbler locks to rotate the pins as well as lift them.
[21:12.820 --> 21:15.860]  So that's what that top diagram looks like that I did.
[21:15.860 --> 21:19.440]  There's three different angles that the pins can rotate to.
[21:19.780 --> 21:21.440]  There's sidebar locks.
[21:21.840 --> 21:23.460]  Do you all know what sidebar locks are?
[21:24.200 --> 21:24.500]  Yeah?
[21:25.200 --> 21:25.680]  Okay.
[21:25.820 --> 21:27.420]  Well, it's a special way of locking.
[21:28.380 --> 21:31.820]  It's much more secure than conventional pin tumbler locks.
[21:32.340 --> 21:33.780]  The sidebar is shown here.
[21:33.780 --> 21:41.620]  So basically for Medeco keys to work, they have to lift all the pins to shear line, which you see in the lower image.
[21:42.420 --> 21:45.220]  And they have to rotate the pins to the right position.
[21:45.860 --> 21:48.040]  Like I said, we did a project.
[21:48.040 --> 21:50.140]  We wrote a book about this.
[21:50.660 --> 21:52.380]  Much to Medeco's chagrin.
[21:53.120 --> 21:54.560]  But everybody got the message.
[21:55.200 --> 22:02.560]  So there's a total of 729 angle combinations that Medeco can provide in a system.
[22:02.720 --> 22:04.350]  So it's very, very high security.
[22:05.000 --> 22:17.080]  We figured out these four keys would allow us to pick or bump virtually all of the non-master keyed systems in the world that Medeco has.
[22:18.120 --> 22:20.040]  That was a big shock for them.
[22:20.960 --> 22:25.760]  It was a very complicated project, but it became very simple to do.
[22:26.000 --> 22:30.000]  We could make these to bump and pick open their logs.
[22:30.340 --> 22:34.640]  So we did a deal for Wired Magazine.
[22:34.640 --> 22:38.040]  This is about a four-minute video that I'll play that's very instructive.
[22:38.500 --> 22:43.280]  My friend Charlie Graber wrote the article in Wired in 2009.
[22:44.460 --> 22:47.780]  They brought in six sealed Medeco locks.
[22:48.000 --> 22:49.660]  We had no prior intelligence.
[22:50.060 --> 22:51.580]  They took them out of the box.
[22:51.760 --> 22:54.400]  Handed them to them and said, use your magic keys.
[22:54.560 --> 22:56.380]  Open them and we'll publish the article.
[22:56.660 --> 22:57.460]  Don't open them.
[22:57.520 --> 23:02.260]  Medeco is going to sue you for a really lot of money for libel and slander.
[23:02.720 --> 23:05.540]  So it wasn't that there wasn't a lot of pressure.
[23:05.540 --> 23:06.920]  So here we go.
[23:07.800 --> 23:08.240]  Yeah.
[23:08.860 --> 23:17.580]  In fact, I told my partner the night before at dinner, before we went in with the lawyers, the editors, the videographers, everything.
[23:17.760 --> 23:21.740]  I said, Toby, if we don't open those locks, I brought a nail gun.
[23:21.940 --> 23:23.800]  I'm going to put it up to your head and pull the trigger.
[23:26.620 --> 23:29.200]  And he says, yeah, we'll open the locks.
[23:29.260 --> 23:30.160]  Okay, here we go.
[23:45.880 --> 23:47.900]  Hi, I'm Charles Graber with Wired Magazine.
[23:47.900 --> 23:51.140]  We're in the Wired offices here in the Condé Nast building in New York.
[23:51.480 --> 23:53.320]  It's the 12th of February, 2009.
[23:53.580 --> 23:56.960]  And I've got a box of Medeco cylinders that we're going to be testing.
[23:57.280 --> 24:01.800]  We've got Tobias Bosmanis and Mark Tobias here, who are going to be opening these cylinders.
[24:01.800 --> 24:03.680]  We're going to take them one by one without showing them.
[24:03.820 --> 24:04.880]  Put them into the vise.
[24:05.140 --> 24:10.440]  They're going to use their tools and technology to try and crack them open in less than 10 minutes each.
[24:10.860 --> 24:11.800]  So let's get started.
[24:13.720 --> 24:14.200]  Go.
[24:16.500 --> 24:20.000]  I'm using code setting keys with six pins.
[24:21.320 --> 24:25.320]  There's no help in the devices slipping a little bit on there.
[24:25.620 --> 24:26.080]  But let's see.
[24:33.000 --> 24:35.420]  Here's the highest security locks in the country.
[24:40.760 --> 24:42.240]  One or two more pins.
[24:42.240 --> 24:42.340]  One or two more pins.
[24:42.440 --> 24:44.500]  I'm better at bumping than he is.
[24:45.900 --> 24:47.180]  We make a great thing.
[24:47.540 --> 24:48.020]  This one.
[24:48.160 --> 24:48.360]  Open.
[24:50.740 --> 24:51.220]  And...
[24:51.220 --> 24:51.720]  Go.
[25:01.730 --> 25:02.550]  So you don't...
[25:03.390 --> 25:04.750]  This is a five pins.
[25:04.910 --> 25:05.690]  This is how it's done.
[25:07.230 --> 25:08.190]  Medical M3.
[25:11.170 --> 25:11.650]  Open.
[25:13.650 --> 25:14.250]  Okay.
[25:31.370 --> 25:31.770]  Okay.
[25:36.740 --> 25:39.920]  Those are our code setting keys that we use to open these locks.
[25:40.860 --> 25:41.860]  To set the pins.
[25:42.080 --> 25:42.160]  Four.
[25:48.580 --> 25:49.180]  Five.
[25:52.100 --> 25:52.700]  Open.
[26:05.720 --> 26:06.020]  Open.
[26:25.550 --> 26:26.470]  Open.
[26:28.010 --> 26:28.790]  Okay.
[26:29.030 --> 26:29.690]  So...
[26:29.690 --> 26:31.210]  That's six locks.
[26:31.630 --> 26:32.870]  We went through...
[26:33.790 --> 26:37.510]  The fastest time was a minute 55.
[26:37.810 --> 26:38.310]  That was lock five.
[26:38.310 --> 26:42.970]  The slowest time for picking was eight minutes, thirteen seconds.
[26:43.230 --> 26:46.130]  All of them were below the ten minute threshold.
[26:46.450 --> 26:47.770]  That's the absolute minimum.
[26:49.330 --> 26:53.590]  The most stringent threshold for high security locks.
[26:53.590 --> 26:54.990]  That's the UL standard.
[26:55.190 --> 26:55.590]  The BMHA.
[26:57.110 --> 26:58.310]  Is the most stringent.
[26:58.310 --> 26:59.170]  Is more stringent.
[26:59.310 --> 27:00.750]  That's up to 15 minutes.
[27:00.930 --> 27:01.150]  Correct.
[27:02.330 --> 27:02.870]  And...
[27:03.490 --> 27:04.110]  So...
[27:04.110 --> 27:05.490]  Essentially all these locks failed.
[27:06.010 --> 27:09.730]  At least according to the standards set by the industry.
[27:10.070 --> 27:11.810]  All these locks fail to be high security.
[27:16.920 --> 27:18.820]  Is it perfectly okay or like that?
[27:19.220 --> 27:19.580]  Yeah.
[27:19.900 --> 27:20.980]  Not really, but...
[27:22.760 --> 27:23.660]  It's open.
[27:25.040 --> 27:25.840]  They're done.
[27:27.460 --> 27:27.940]  Phew!
[27:29.140 --> 27:29.380]  And...
[27:31.260 --> 27:34.120]  And that lives on forever on the Internet.
[27:34.520 --> 27:35.760]  And I gotta tell ya.
[27:36.520 --> 27:39.640]  My mom read the article in the Wired magazine.
[27:39.680 --> 27:41.500]  It was a really large piece.
[27:41.980 --> 27:43.500]  And at the end of the...
[27:43.500 --> 27:46.040]  We went down to the deli in the bottom of the building.
[27:46.280 --> 27:48.480]  Where we were at Condé Nast Headquarters.
[27:48.800 --> 27:50.360]  And I had this big pickle.
[27:50.600 --> 27:51.520]  We were at the deli.
[27:51.700 --> 27:53.320]  And I was using it as a pointer.
[27:53.500 --> 27:55.940]  And Charlie Graber says, What are you gonna do next?
[27:55.940 --> 27:59.740]  I says, We're gonna write a book about how to attack locks.
[28:00.280 --> 28:01.200]  Electronic locks.
[28:01.360 --> 28:02.260]  And I'm using this pickle.
[28:02.480 --> 28:06.540]  My mom, she reads the article and says, Why are you eating pickles?
[28:06.700 --> 28:07.560]  They're full of salt.
[28:10.740 --> 28:11.200]  Okay.
[28:11.200 --> 28:12.300]  So next video...
[28:13.560 --> 28:17.480]  And by the way, that's the book we wrote about medical.
[28:18.740 --> 28:21.480]  And the picture is self-explanatory.
[28:22.240 --> 28:24.700]  That picture with that lock cannot happen.
[28:25.080 --> 28:26.440]  Unless it's picked open.
[28:26.740 --> 28:28.980]  So we decided to use that for the cover.
[28:28.980 --> 28:30.680]  So this is a lock.
[28:30.800 --> 28:32.160]  I'll talk about this for a couple of minutes.
[28:32.360 --> 28:34.640]  This is a really cool lock out of Finland.
[28:35.740 --> 28:37.160]  Made by iLock.
[28:37.340 --> 28:38.820]  It's very sophisticated.
[28:39.440 --> 28:40.560]  There's no batteries.
[28:40.820 --> 28:42.340]  It's an energy harvesting lock.
[28:42.340 --> 28:45.440]  You insert one key worldwide.
[28:45.440 --> 28:46.680]  It's the same design.
[28:46.880 --> 28:49.740]  But it has different electronic credentials in the head.
[28:50.060 --> 28:51.080]  You put it in.
[28:51.520 --> 28:53.860]  It winds up a little motor.
[28:54.140 --> 28:55.200]  Generates electricity.
[28:55.660 --> 28:57.140]  Powers up the processor.
[28:58.260 --> 28:59.420]  Validates the key.
[28:59.700 --> 29:04.400]  And if the key is valid, it moves a little pin.
[29:04.400 --> 29:06.860]  And releases a one pin.
[29:07.400 --> 29:09.440]  Basically a one pin tumbler lock.
[29:09.660 --> 29:10.840]  And you can open the lock.
[29:11.140 --> 29:13.880]  So we figured out how to open it a couple different ways.
[29:15.240 --> 29:16.780]  They finally improved it.
[29:16.860 --> 29:18.860]  These are really cool locks now out of Finland.
[29:19.240 --> 29:21.500]  You will see them now in North America.
[29:21.940 --> 29:25.500]  But we figured out how to defeat these locks.
[29:25.680 --> 29:27.160]  It's a very clever mechanism.
[29:27.380 --> 29:29.020]  In our view, it's way too complicated.
[29:29.640 --> 29:30.900]  They have patents.
[29:31.120 --> 29:33.500]  They had presidential awards in Finland.
[29:33.500 --> 29:34.920]  It didn't mean anything.
[29:35.280 --> 29:38.200]  So we figured out how to defeat their locks.
[29:38.520 --> 29:42.040]  Actually, in 2012, we were in Norway.
[29:43.040 --> 29:48.960]  And the High Security Finnish Locksmith Association brought some locks.
[29:49.420 --> 29:51.880]  We brought one key and opened all their locks.
[29:52.480 --> 29:55.560]  So iLock really... they were all software guys.
[29:55.860 --> 29:57.440]  They got their act cleaned up.
[29:57.440 --> 29:59.260]  And now they have a really cool product.
[29:59.260 --> 30:08.500]  And basically, we also figured out, as we see here, the normal key with the green circle, the little tip resets the whole mechanism.
[30:08.900 --> 30:21.900]  We figured out if we took one 32nd inch off that key, either on the front of the lock outside with a little Dremel tool or on a key that we had access to, we could set the lock so any key...
[30:21.900 --> 30:23.080]  we could open it with a screwdriver.
[30:23.580 --> 30:27.880]  And nobody would know it until the valid key came and reset it.
[30:28.160 --> 30:28.880]  Big problem.
[30:29.320 --> 30:30.900]  And that's... you can see the difference.
[30:32.260 --> 30:32.820]  Okay.
[30:32.820 --> 30:32.960]  Okay.
[30:33.580 --> 30:39.400]  So then, I went to China to a factory that made high security padlocks.
[30:40.240 --> 30:43.800]  A company called Access Control Systems.
[30:44.440 --> 30:45.640]  Here's what happened.
[30:45.760 --> 30:49.680]  My partner Toby is holding one of their high security padlocks.
[30:50.240 --> 30:52.820]  The position is...
[31:11.180 --> 31:13.060]  Not very good.
[31:14.400 --> 31:20.940]  And the problem with this design is they had a floating piece that was not spring biased.
[31:21.140 --> 31:23.240]  They should have understood what would happen.
[31:23.540 --> 31:29.920]  We did the same thing on a padlock on the fence in Toby's backyard in Florida.
[31:30.580 --> 31:32.680]  I won't use up the time to do that.
[31:32.900 --> 31:33.980]  Same problem.
[31:36.260 --> 31:36.880]  Okay.
[31:37.200 --> 31:41.780]  This is an electronic lock in Europe that they said couldn't be broken.
[31:42.040 --> 31:43.920]  Couldn't be defeated by Isaiah.
[31:44.980 --> 31:46.980]  I think it's an Italian lock.
[31:47.180 --> 31:52.260]  So, I shot a really quick video for one of our clients in my office.
[31:52.480 --> 31:55.260]  So, this is not our normal video.
[31:55.720 --> 32:01.900]  We took out the battery from the electronic key so there's nothing to power the processor.
[32:01.900 --> 32:04.260]  This is a purely mechanical attack.
[32:05.340 --> 32:06.260]  Okay.
[32:06.840 --> 32:09.160]  This is an Isaiah lock.
[32:09.740 --> 32:14.360]  This is going to be a very rudimentary video.
[32:14.960 --> 32:17.500]  We just received this for analysis.
[32:17.500 --> 32:18.940]  It's an electronic cylinder.
[32:19.440 --> 32:23.000]  You can see that the key works.
[32:23.280 --> 32:24.180]  Let's see here.
[32:24.760 --> 32:28.740]  Key works on the non-electronic side.
[32:29.880 --> 32:33.220]  So, let's do it this way.
[32:33.800 --> 32:35.440]  I removed the battery.
[32:35.840 --> 32:40.240]  So, you can see that the lock will not open.
[32:40.560 --> 32:44.240]  So, now we... if I can do this...
[32:44.240 --> 32:44.660]  This is...
[32:44.660 --> 32:45.340]  A little difficult.
[32:45.740 --> 32:46.200]  Handheld.
[32:49.840 --> 32:51.400]  Here, let's do it this way.
[32:54.580 --> 32:55.820]  Hold on one second.
[33:06.350 --> 33:06.910]  Okay.
[33:06.910 --> 33:07.470]  It's open.
[33:08.430 --> 33:08.990]  Okay.
[33:09.270 --> 33:10.190]  Lock is open.
[33:10.750 --> 33:12.530]  That is a real problem.
[33:12.770 --> 33:14.070]  No audit trail.
[33:15.030 --> 33:17.310]  So, that means you could have access.
[33:17.690 --> 33:20.350]  Nobody would know how you got in or if you got in.
[33:20.710 --> 33:23.290]  So, this next one is safe lock.
[33:23.290 --> 33:26.510]  That's put out by Caba.
[33:26.650 --> 33:27.410]  Dorma Caba.
[33:28.270 --> 33:31.330]  And again, this shows a lack of understanding.
[33:31.710 --> 33:34.610]  This is an RFID based lock.
[33:35.170 --> 33:36.290]  Deadbolt lock.
[33:36.630 --> 33:40.270]  There's a data port at the bottom of this lock.
[33:40.530 --> 33:44.750]  They never ever conceived of how we open this lock.
[33:45.770 --> 33:47.950]  Inside, there is a locking bar.
[33:48.370 --> 33:49.790]  That blocks the plug.
[33:49.790 --> 33:59.150]  We're going to be using a small wire to push that locking bar away so we can turn the plug.
[34:00.090 --> 34:10.330]  We're going to do that by inserting a very small wire through the communication port that is on the bottom of the lock.
[34:10.730 --> 34:12.810]  This is in security engineering.
[34:13.110 --> 34:17.030]  Now, use...
[34:17.030 --> 34:19.430]  And then we just use a bar to open it.
[34:21.990 --> 34:24.610]  The wire to unlock the deadbolt.
[34:25.710 --> 34:26.630]  You can laugh.
[34:26.850 --> 34:27.670]  Caba wasn't laughing.
[34:28.010 --> 34:29.170]  We can also lock it back.
[34:30.350 --> 34:32.650]  So, I'll show you how we defeated it.
[34:32.730 --> 34:34.010]  This will flip around to the back.
[34:51.640 --> 34:54.380]  This is the inside of the softlock deadbolt.
[34:55.120 --> 35:00.400]  This is the locking bar that blocks the plug.
[35:01.840 --> 35:05.920]  There is a small motor that moves that pin up and down.
[35:07.920 --> 35:12.960]  We're moving that bar using that small wire through the communication port.
[35:12.960 --> 35:15.500]  We're just reaching to that bar.
[35:16.920 --> 35:21.380]  Moving up to clear the fence.
[35:22.440 --> 35:27.120]  So, we can turn...
[35:27.120 --> 35:29.600]  And that's the security of that lock.
[35:30.180 --> 35:32.580]  This is what the book's about.
[35:32.760 --> 35:33.820]  In security engineering.
[35:33.820 --> 35:35.460]  This is the problem.
[35:36.040 --> 35:38.080]  Again, it's a lack of imagination.
[35:38.960 --> 35:43.820]  The engineers should have thought, How can we open that lock without a key?
[35:44.520 --> 35:46.740]  Okay, these are the geniuses in Canada.
[35:47.120 --> 35:50.840]  They knocked off a high security deadbolt in America.
[35:52.800 --> 35:54.260]  Let's see if we have time.
[35:55.980 --> 35:58.840]  This is really stupid engineering.
[36:02.940 --> 36:05.480]  See, everybody laughs but the manufacturers.
[36:10.970 --> 36:12.710]  This is a complex key.
[36:27.420 --> 36:28.060]  Perfect.
[36:31.170 --> 36:31.810]  Yeah.
[36:32.670 --> 36:33.310]  Perfect.
[36:34.150 --> 36:34.650]  Okay.
[36:34.970 --> 36:38.850]  This is one of the highest security deadbolts in the United States.
[36:39.930 --> 36:41.770]  This was a medical maxim.
[36:41.970 --> 36:43.230]  This has since been fixed.
[36:43.450 --> 36:44.990]  This was 15 years ago.
[36:45.230 --> 36:47.990]  This is really scary that we figured this out.
[36:49.370 --> 36:51.130]  Actually, let me just tell you.
[36:51.470 --> 36:54.610]  This deadbolt is probably one of the best in the country.
[36:55.330 --> 36:58.630]  Everybody that makes deadbolts forget what keeps them together.
[36:58.930 --> 37:03.150]  Which is basically two retaining screws at the back of the plug.
[37:03.450 --> 37:04.590]  To hold it all together.
[37:05.510 --> 37:08.810]  Two of these screws, 83,000 inch diameter.
[37:08.930 --> 37:11.950]  Which is all the security that was in this lock.
[37:12.950 --> 37:13.850]  The medical deadbolt.
[37:13.850 --> 37:16.350]  Now, we are going to use first this tool.
[37:16.670 --> 37:17.410]  Right here.
[37:18.650 --> 37:21.270]  Notice the lower portion.
[37:24.640 --> 37:27.880]  Because we are going to introduce this tool like this.
[37:29.460 --> 37:33.780]  And then we are going to put the tool straight.
[37:36.120 --> 37:38.140]  Break the back cover.
[37:39.660 --> 37:40.820]  Remove the tool.
[37:42.840 --> 37:44.520]  And then using this one.
[37:45.340 --> 37:45.900]  Three dollar screws.
[37:45.900 --> 37:48.520]  From the lower part of the cylinder.
[37:49.480 --> 37:52.820]  Then you are going to raise it all the way.
[37:53.760 --> 37:55.100]  You can see the bolt.
[37:55.700 --> 37:56.280]  Raise it.
[37:56.820 --> 37:57.840]  Push it in.
[37:58.240 --> 37:59.000]  And turn.
[37:59.240 --> 37:59.780]  We are done.
[37:59.780 --> 37:59.840]  All right.
[38:01.260 --> 38:02.380]  Really scary.
[38:02.740 --> 38:04.160]  And very easy to execute.
[38:04.560 --> 38:05.900]  There is where the two screws are.
[38:08.570 --> 38:10.680]  This was one of our better defeats.
[38:10.800 --> 38:13.200]  This is a very high security electronic cylinder.
[38:14.720 --> 38:16.700]  The engineers made a mistake.
[38:17.220 --> 38:24.420]  We figured out how to push a wire through the feed through holes on both sides of the printed circuit board.
[38:24.420 --> 38:25.960]  And get to the element.
[38:26.160 --> 38:27.900]  The element that sticks up right now.
[38:28.160 --> 38:28.940]  Locks the lock.
[38:29.500 --> 38:30.720]  Now it is pressed in.
[38:31.100 --> 38:32.740]  We figured out how to get to that.
[38:33.120 --> 38:35.740]  And open a very high security electronic cylinder.
[38:36.260 --> 38:37.660]  Again, this has been fixed.
[38:38.760 --> 38:42.620]  But it was a really classic engineering problem.
[38:43.140 --> 38:45.540]  This is the use of a magnetic ring.
[38:47.280 --> 38:48.780]  This is magnetism.
[39:00.590 --> 39:01.630]  No electronics.
[39:02.550 --> 39:04.110]  The battery has been removed.
[39:06.610 --> 39:08.330]  So the key will not work.
[39:11.310 --> 39:13.090]  This is a magnetic ring.
[39:13.330 --> 39:15.030]  Developed by my friend in Germany.
[39:16.450 --> 39:17.950]  It is full of magnetism.
[39:29.820 --> 39:32.240]  Again, they forgot about Mr. Magnetism.
[39:40.700 --> 39:45.160]  And, as Robert De Niro said, and that was that.
[39:46.160 --> 39:49.720]  This was the Kryptonite bike lock fiasco.
[39:51.800 --> 39:54.580]  Basically, the engineers forgot.
[39:55.140 --> 39:57.380]  They didn't connect the dots.
[39:57.600 --> 40:04.880]  The diameter on these axial pin tumbler locks was the same as the diameter on a lot of ballpoint pens.
[40:04.880 --> 40:06.240]  Plastic pens.
[40:06.460 --> 40:08.680]  And they didn't understand impressioning.
[40:08.880 --> 40:12.600]  So, if you inserted the plastic into the lock.
[40:12.740 --> 40:14.820]  And you manipulated it back and forth.
[40:15.040 --> 40:19.000]  You can basically produce a key in about 15, 20 seconds.
[40:19.480 --> 40:23.540]  And open this $125, $150 bike lock.
[40:23.760 --> 40:25.340]  And steal the $1,000 bike.
[40:25.340 --> 40:27.980]  This created a huge problem.
[40:28.120 --> 40:32.000]  Ten million dollars in damages for the manufacturer.
[40:32.660 --> 40:34.680]  Okay, this is a classic example.
[40:35.000 --> 40:39.260]  This is a $100 safe that a lot of people buy.
[40:40.660 --> 40:44.220]  Basically, there's a reset button inside the safe.
[40:44.540 --> 40:48.740]  We figured out how to insert a little piece of wire.
[40:49.080 --> 40:52.200]  Get to the reset button and reset the combination.
[40:53.520 --> 40:54.760]  Really stupid.
[40:55.120 --> 40:58.000]  This is a high security push button lock.
[40:58.420 --> 41:00.060]  This is really cool.
[41:03.360 --> 41:12.510]  For guard posts, there's a remote opening system so that the dispatcher, the guard, whatever, can push a button and open the lock remotely.
[41:13.590 --> 41:19.910]  Unfortunately, the printed circuit board is right behind one of the LEDs, which is a status LED.
[41:20.890 --> 41:24.430]  So we figured out how to go through with a pick or a pin.
[41:25.050 --> 41:31.870]  And communicate a ground to the printed circuit board right behind the LED grommet.
[41:32.270 --> 41:35.350]  Again, really, really poor design.
[41:37.610 --> 41:41.370]  This is the... I'm sure a lot of you have seen this lock.
[41:41.550 --> 41:43.230]  This is the Kaba Simplex.
[41:44.730 --> 41:47.590]  So this was developed first in 1965.
[41:48.330 --> 41:52.770]  There's millions of them in the world, in banks, government facilities.
[41:52.910 --> 41:53.890]  I mean everywhere.
[41:54.530 --> 41:58.410]  So the problem is that they forgot about magnetics.
[41:59.030 --> 42:01.770]  Rare Earth magnets came out in about 1980.
[42:01.770 --> 42:03.810]  They didn't change their design.
[42:04.010 --> 42:04.860]  There's a critical component.
[42:05.650 --> 42:07.050]  And again, this has been fixed.
[42:07.210 --> 42:08.410]  They've upgraded them.
[42:08.610 --> 42:09.670]  Hopefully, everywhere.
[42:09.990 --> 42:11.110]  This is what happened.
[42:12.790 --> 42:15.730]  Well, normal use lock is...
[42:15.730 --> 42:17.050]  It's a clutch lock.
[42:17.450 --> 42:21.830]  We have to put the right combination factories, two and four at the same time.
[42:22.230 --> 42:22.490]  Three.
[42:23.250 --> 42:24.470]  We can open the lock.
[42:26.210 --> 42:26.710]  Once...
[42:26.710 --> 42:30.890]  If we're making a mistake, every time that we depress the lever, it resets.
[42:30.890 --> 42:33.790]  So we can enter the right combination again.
[42:35.630 --> 42:36.150]  Okay.
[42:36.830 --> 42:41.170]  So on this lock, as we said, it's easily bypassed using the magnet.
[42:41.370 --> 42:44.870]  I have the magnet just wrapped in the bag.
[42:45.670 --> 42:47.330]  Just gonna depress the lever.
[42:47.530 --> 42:48.330]  The lock is open.
[42:48.550 --> 42:49.650]  The lock is open.
[42:49.830 --> 42:50.530]  And that's it.
[42:50.790 --> 42:52.930]  This caused Kaba a lot of trouble.
[42:53.490 --> 42:55.050]  Okay, this was...
[42:55.050 --> 42:58.310]  This will be the last one I show.
[42:59.410 --> 43:03.570]  This was a bunch of software guys in Europe who designed a lock.
[43:03.690 --> 43:06.570]  They thought it was really cool using nitinol wire.
[43:07.110 --> 43:08.510]  How many of you guys know what that is?
[43:09.150 --> 43:10.410]  Okay, it's a...
[43:10.410 --> 43:11.990]  It's a memory wire.
[43:12.170 --> 43:13.170]  They put current through it.
[43:13.430 --> 43:13.910]  It'll...
[43:13.910 --> 43:14.930]  It'll change shape.
[43:15.210 --> 43:16.190]  It's very cool.
[43:16.550 --> 43:19.430]  They thought it would be a really neat design to make a lock.
[43:20.230 --> 43:22.110]  They forgot about heat.
[43:22.510 --> 43:26.110]  And so we figured out how to open this design with a hair dryer.
[43:28.810 --> 43:30.930]  Again, no imagination.
[43:31.930 --> 43:36.650]  So basically, the bottom line of all these examples, it's a lack of imagination.
[43:36.670 --> 43:38.270]  Lack of proper testing.
[43:38.650 --> 43:40.910]  Failure to understand hybrid attacks.
[43:41.710 --> 43:43.770]  Improper reliance on standards.
[43:45.110 --> 43:47.910]  Manufacturers do not understand bypass techniques.
[43:49.070 --> 43:51.130]  And there's an appearance of security.
[43:51.890 --> 43:52.710]  So, and this...
[43:52.710 --> 43:53.590]  This is a demo...
[43:53.590 --> 43:54.530]  Oh, yeah.
[43:55.170 --> 43:57.290]  This one, because we don't have time to go through it.
[43:57.650 --> 44:09.530]  This is a printed circuit board that we figured out how to drill a tiny hole in the front of the lock and feed a wire and feed voltage to the contact in the upper right corner and open the lock.
[44:10.360 --> 44:11.930]  Again, they never thought about it.
[44:13.070 --> 44:16.110]  So, these are the two books that you all might want to look at.
[44:16.530 --> 44:21.670]  Ross Anderson's book is the best in the industry called Security Engineering.
[44:22.810 --> 44:25.090]  And mine is the reverse of that.
[44:25.510 --> 44:29.930]  Thanks to Ross who passed away unfortunately a couple of months ago.
[44:30.730 --> 44:32.490]  Brilliant, brilliant guy at Cambridge.
[44:33.890 --> 44:35.390]  So, that's about it.
[44:35.590 --> 44:37.010]  This is my contact information.
[44:38.070 --> 44:42.030]  If you all have any questions, feel free to get a hold of me.
[44:42.130 --> 44:44.610]  There's many ways to do it.
[44:44.890 --> 44:46.550]  Does anybody have any questions?
[44:46.850 --> 44:48.170]  While we have a couple of minutes?
[44:53.580 --> 44:54.240]  Thank you.
[44:59.410 --> 45:00.310]  No questions?
[45:01.010 --> 45:04.050]  Do you ever mind stupid or threat to be stupid by his manufacturer?
[45:04.350 --> 45:05.850]  Oh, all the time.
[45:07.090 --> 45:07.790]  You know what?
[45:07.890 --> 45:10.510]  As a lawyer, I tell them, I'll meet you at the courthouse.
[45:10.890 --> 45:15.510]  I'd love the publicity because we always have video to back up what we're doing.
[45:15.870 --> 45:16.770]  Next question.
[45:17.850 --> 45:18.450]  All right.
[45:18.630 --> 45:22.770]  So, the Marriott Hotels, they use safe locks.
[45:23.550 --> 45:25.010]  It's a battery operated.
[45:25.010 --> 45:26.810]  It's like a 4AA cell.
[45:27.070 --> 45:28.530]  It's not connected to a system.
[45:28.710 --> 45:29.510]  It's a card lock.
[45:29.650 --> 45:31.090]  It goes into a mortise cassette.
[45:31.090 --> 45:35.050]  The back side has the one torque screw.
[45:35.970 --> 45:36.610]  Right?
[45:36.890 --> 45:38.170]  Have you ever cracked those?
[45:38.630 --> 45:42.130]  Well, there's a different... there's several different versions.
[45:42.690 --> 45:42.890]  Right.
[45:43.250 --> 45:46.550]  There was a huge problem in Denver with Y2K.
[45:46.550 --> 45:47.610]  Uh-huh.
[45:47.770 --> 45:53.410]  Where they had a riot at the Marriott because the programmers didn't understand how Y2K would work.
[45:53.750 --> 45:58.230]  And so, the locks wouldn't open at 10 o'clock on New Year's Eve.
[45:58.230 --> 45:59.370]  Yeah, these weren't timed.
[45:59.590 --> 46:01.930]  They were completely disconnected from a network.
[46:02.170 --> 46:02.570]  Yeah.
[46:02.570 --> 46:05.990]  And the only way we could get through them is to measure down with the millimeters.
[46:06.730 --> 46:11.570]  And then cross over and hit that one spot so we could get in and then twist it.
[46:11.690 --> 46:13.590]  And that was only because the battery died.
[46:13.930 --> 46:18.910]  Whenever the battery died because you can't get in the room and you can't get to that torque screw to pull it all apart again.
[46:19.070 --> 46:24.850]  Well, I think safe lock just had a major, major problem that involved millions of hotel locks.
[46:24.850 --> 46:25.330]  Sure.
[46:25.550 --> 46:29.030]  I was just in Europe reading about it but I don't know exactly what the problem was.
[46:29.430 --> 46:29.550]  Okay.
[46:29.950 --> 46:31.390]  This is back in the aughts.
[46:31.570 --> 46:31.730]  Yeah.
[46:31.930 --> 46:33.330]  When we were renovating Marriott's.
[46:33.990 --> 46:34.350]  Right.
[46:34.350 --> 46:34.510]  Right.
[46:34.690 --> 46:37.250]  So, I really can't answer your question adequately.
[46:38.110 --> 46:38.290]  Okay.
[46:38.870 --> 46:39.470]  Well, thank you.
[46:39.970 --> 46:41.030]  Any other questions?
[46:41.170 --> 46:41.410]  Yes, sir.
[46:41.670 --> 46:42.310]  Yeah, quick question.
[46:42.890 --> 46:52.350]  What do you think about those systems that looks like a little gun and it's like a lock picking device that it basically tumbles automatically the lock.
[46:52.350 --> 46:53.930]  Used for very quick entry.
[46:54.230 --> 46:56.730]  Looks like a gun and you squeeze, you squeeze, you squeeze.
[46:56.830 --> 47:00.190]  It's like actually, effectively, fuzzing, fuzzing the lock.
[47:00.470 --> 47:01.230]  What is it?
[47:01.810 --> 47:02.690]  Have you ever seen those?
[47:02.850 --> 47:03.250]  I don't know.
[47:03.350 --> 47:04.090]  Oh, oh, oh.
[47:04.150 --> 47:05.210]  I don't know how you call it America.
[47:05.210 --> 47:07.350]  Are you talking about the snap pick?
[47:09.150 --> 47:11.230]  Yeah, it's just a mechanical...
[47:11.710 --> 47:12.770]  I don't like them.
[47:12.770 --> 47:13.190]  Yeah.
[47:13.430 --> 47:13.470]  Yeah.
[47:14.350 --> 47:19.410]  You know, I have electronic pick guns that go buzz, buzz, buzz and open locks.
[47:20.170 --> 47:20.350]  All right.
[47:21.730 --> 47:22.050]  Those...
[47:22.050 --> 47:23.610]  That's all technology.
[47:25.590 --> 47:26.530]  I've seen them around.
[47:26.670 --> 47:27.250]  They still work.
[47:27.330 --> 47:28.610]  But yeah, I was wondering what you think.
[47:28.710 --> 47:29.890]  I mean, you are an expert, of course.
[47:29.950 --> 47:29.990]  Yeah, thank you.
[47:29.990 --> 47:31.610]  So, you don't even need that, but...
[47:31.610 --> 47:31.810]  Right.
[47:32.150 --> 47:32.470]  Exactly.
[47:33.050 --> 47:33.670]  No, no, no.
[47:34.250 --> 47:38.650]  The old pick guns, you know, a lot of this stuff has been around.
[47:38.650 --> 47:45.250]  I noted in the book, but there's a lot better ways of opening locks now, including electronic ways.
[47:45.710 --> 47:45.830]  Okay.
[47:46.650 --> 47:46.910]  Thanks.
[47:47.050 --> 47:47.390]  Thank you.
[47:47.530 --> 47:48.210]  Any other questions?
[47:49.750 --> 47:52.950]  In your book, open in 30 seconds?
[47:53.310 --> 47:53.430]  Yeah.
[47:54.570 --> 47:57.370]  You didn't publish the cuts of those three keys, did you?
[47:57.750 --> 47:58.210]  The what?
[47:58.390 --> 47:59.750]  The cuts of the three keys?
[48:00.410 --> 48:01.170]  Four keys.
[48:01.410 --> 48:01.690]  Four keys.
[48:01.810 --> 48:02.630]  Did you publish the cuts?
[48:02.690 --> 48:03.410]  I don't remember seeing them in the book.
[48:03.410 --> 48:04.710]  I did not publish the codes.
[48:04.790 --> 48:04.970]  How did you publish that house?
[48:05.770 --> 48:08.050]  Because it involved government facilities.
[48:08.630 --> 48:14.010]  But a 17 year old kid in Fort Collins called me that was working for a medical lock shop.
[48:14.250 --> 48:15.290]  He bought the book.
[48:15.390 --> 48:17.310]  He called me and says, I got your keys.
[48:17.310 --> 48:18.450]  I figured out the codes.
[48:19.290 --> 48:21.130]  And so, they can be figured out.
[48:21.470 --> 48:26.450]  They fixed the problem, but there's a huge number of locks out there that can still be compromised.
[48:26.970 --> 48:27.550]  Thank you.
[48:27.850 --> 48:28.490]  You got it.
[48:28.790 --> 48:30.330]  Thank you very much.
[48:30.330 --> 48:30.730]  Thank you very much.
[48:30.750 --> 48:31.310]  Thank you.