319 118 8MB
English Pages 166 Year 2013
^
Ten Things You Should Know About Lockpicking
by Deviant Ollam Event Name XXXX-XX-XX
Deviant Ollam http:// deviating.net / lockpicking
Who am i ?
Deviant Ollam http:// deviating.net / lockpicking
Who am i ?
Deviant Ollam http:// deviating.net / lockpicking
Who am i ? auditing assessments research trainings
Deviant Ollam http:// deviating.net / lockpicking
Who am i ? auditing assessments research trainings
workshops public lectures lockpick village contests & games
Deviant Ollam http:// deviating.net / lockpicking
Things You Should Know about Lockpicking… 1. Why locks matter to IT professionals
Deviant Ollam http:// deviating.net / lockpicking
Deviant Ollam http:// deviating.net / lockpicking
Deviant Ollam http:// deviating.net / lockpicking
Deviant Ollam http:// deviating.net / lockpicking
Deviant Ollam http:// deviating.net / lockpicking
All your hard work here…
Deviant Ollam http:// deviating.net / lockpicking
All your hard work here… gets undermined here
Deviant Ollam http:// deviating.net / lockpicking
Things You Should Know about Lockpicking… 1. Why locks matter to IT professionals 2. Pin tumblers are universal
Deviant Ollam http:// deviating.net / lockpicking
Pin Tumbler Locks
Deviant Ollam http:// deviating.net / lockpicking
Pin Tumbler Locks
Deviant Ollam http:// deviating.net / lockpicking
Pin Tumbler Locks
Deviant Ollam http:// deviating.net / lockpicking
The View From Outside
Deviant Ollam http:// deviating.net / lockpicking
What’s On The Inside
Deviant Ollam http:// deviating.net / lockpicking
What’s On The Inside
Deviant Ollam http:// deviating.net / lockpicking
What’s On The Inside
Deviant Ollam http:// deviating.net / lockpicking
It’s Not Just a Single Pin Stack
Deviant Ollam http:// deviating.net / lockpicking
It’s Not Just a Single Pin Stack
Deviant Ollam http:// deviating.net / lockpicking
The Key Has To Be Just Right
Deviant Ollam http:// deviating.net / lockpicking
The Key Has To Be Just Right
Deviant Ollam http:// deviating.net / lockpicking
Things You Should Know about Lockpicking… 1. Why locks matter to IT professionals 2. Pin tumblers are universal 3. Picking is simple and fun
Deviant Ollam http:// deviating.net / lockpicking
In An Ideal World …
Deviant Ollam http:// deviating.net / lockpicking
In The Real World …
Deviant Ollam http:// deviating.net / lockpicking
In The Real World …
Deviant Ollam http:// deviating.net / lockpicking
In The Real World …
Deviant Ollam http:// deviating.net / lockpicking
Setting a Pin
Deviant Ollam http:// deviating.net / lockpicking
Setting a Pin
Deviant Ollam http:// deviating.net / lockpicking
Setting the Pins
Deviant Ollam http:// deviating.net / lockpicking
Things You Should Know about Lockpicking… 1. 2. 3. 4.
Why locks matter to IT professionals Pin tumblers are universal Picking is simple and fun Pins are pins, in any arrangement
Deviant Ollam http:// deviating.net / lockpicking
Other Ways of Arranging the Pins
Deviant Ollam http:// deviating.net / lockpicking
Other Ways of Attacking the Pins
Deviant Ollam http:// deviating.net / lockpicking
A Fun Tubular Lock Story
Deviant Ollam http:// deviating.net / lockpicking
A Fun Tubular Lock Story
Deviant Ollam http:// deviating.net / lockpicking
A Fun Tubular Lock Story
Deviant Ollam http:// deviating.net / lockpicking
A Fun Tubular Lock Story
Deviant Ollam http:// deviating.net / lockpicking
Things You Should Know about Lockpicking… 1. 2. 3. 4. 5.
Why locks matter to IT professionals Pin tumblers are universal Picking is simple and fun Pins are pins, in any arrangement Other everyday designs are often weak, too
Deviant Ollam http:// deviating.net / lockpicking
Wafer Locks
Deviant Ollam http:// deviating.net / lockpicking
Wafer Locks
Deviant Ollam http:// deviating.net / lockpicking
Wafer Locks
Deviant Ollam http:// deviating.net / lockpicking
Wafer Locks
Deviant Ollam http:// deviating.net / lockpicking
Raking & Jiggling
Deviant Ollam http:// deviating.net / lockpicking
Wafer Lock Usage
Deviant Ollam http:// deviating.net / lockpicking
Wafer Lock Usage
Deviant Ollam http:// deviating.net / lockpicking
Wafer Lock Usage
Deviant Ollam http:// deviating.net / lockpicking
Wafer Lock Usage
Deviant Ollam http:// deviating.net / lockpicking
Wafer Lock Usage
Deviant Ollam http:// deviating.net / lockpicking
Wafer Lock Usage
Deviant Ollam http:// deviating.net / lockpicking
Wafer Lock Usage
Deviant Ollam http:// deviating.net / lockpicking
Wafer Lock Usage
Deviant Ollam http:// deviating.net / lockpicking
Wafer Lock Usage
Deviant Ollam http:// deviating.net / lockpicking
Wafer Lock Usage
Deviant Ollam http:// deviating.net / lockpicking
Warded Locks
Deviant Ollam http:// deviating.net / lockpicking
Warded Locks
Deviant Ollam http:// deviating.net / lockpicking
Warded Locks
Deviant Ollam http:// deviating.net / lockpicking
Warded Lock Usage
Deviant Ollam http:// deviating.net / lockpicking
Warded Lock Usage
Deviant Ollam http:// deviating.net / lockpicking
Warded Lock Usage
Deviant Ollam http:// deviating.net / lockpicking
Warded Lock Usage
Deviant Ollam http:// deviating.net / lockpicking
Warded Lock Usage
Deviant Ollam http:// deviating.net / lockpicking
Warded Lock Usage
Deviant Ollam http:// deviating.net / lockpicking
Warded Lock Usage
Deviant Ollam http:// deviating.net / lockpicking
Warded Lock Usage
Deviant Ollam http:// deviating.net / lockpicking
Warded Lock Usage
Deviant Ollam http:// deviating.net / lockpicking
Warded Lock Usage
Deviant Ollam http:// deviating.net / lockpicking
Things You Should Know about Lockpicking… 1. 2. 3. 4. 5. 6.
Why locks matter to IT professionals Pin tumblers are universal Picking is simple and fun Pins are pins, in any arrangement Other everyday designs are often weak, too You can open locks with beer and beatings
Deviant Ollam http:// deviating.net / lockpicking
Popular Padlocks
Deviant Ollam http:// deviating.net / lockpicking
Terrible Padlocks
Deviant Ollam http:// deviating.net / lockpicking
Padlock Shims
Deviant Ollam http:// deviating.net / lockpicking
Padlock Shims… From a Catalog
Deviant Ollam http:// deviating.net / lockpicking
Padlock Shims… From a Beer Can
Deviant Ollam http:// deviating.net / lockpicking
Padlock Shims
Deviant Ollam http:// deviating.net / lockpicking
Padlock Shims
Deviant Ollam http:// deviating.net / lockpicking
Padlock Shims
Deviant Ollam http:// deviating.net / lockpicking
Padlock Shims
Deviant Ollam http:// deviating.net / lockpicking
Padlock Shims
Deviant Ollam http:// deviating.net / lockpicking
Padlock Shims
Deviant Ollam http:// deviating.net / lockpicking
Padlock Shim Prevention Double Ball Mechanism
Deviant Ollam http:// deviating.net / lockpicking
Padlock Shim Prevention Which Padlocks are Protected ?
Deviant Ollam http:// deviating.net / lockpicking
Padlock Shim Prevention
Deviant Ollam http:// deviating.net / lockpicking
Padlock Shim Prevention
Deviant Ollam http:// deviating.net / lockpicking
Bumping
Deviant Ollam http:// deviating.net / lockpicking
Bumping
Deviant Ollam http:// deviating.net / lockpicking
Bumping
Deviant Ollam http:// deviating.net / lockpicking
Bumping
Deviant Ollam http:// deviating.net / lockpicking
Bumping
Deviant Ollam http:// deviating.net / lockpicking
Things You Should Know about Lockpicking… 1. 2. 3. 4. 5. 6. 7.
Why locks matter to IT professionals Pin tumblers are universal Picking is simple and fun Pins are pins, in any arrangement Other everyday designs are often weak, too You can open locks with beer and beatings Many locks are pick resistant
Deviant Ollam http:// deviating.net / lockpicking
Pick-Resistant Keyways
Deviant Ollam http:// deviating.net / lockpicking
Pick-Resistant Keyways
Deviant Ollam http:// deviating.net / lockpicking
Pick-Resistant Keyways
Deviant Ollam http:// deviating.net / lockpicking
Pick-Resistant Keyways
Deviant Ollam http:// deviating.net / lockpicking
Pick-Resistant Keyways
Deviant Ollam http:// deviating.net / lockpicking
Pick-Resistant Pins
Deviant Ollam http:// deviating.net / lockpicking
Pick-Resistant Pins
Deviant Ollam http:// deviating.net / lockpicking
Pick-Resistant Pins
Deviant Ollam http:// deviating.net / lockpicking
Pick-Resistant Pins
Deviant Ollam http:// deviating.net / lockpicking
Pick-Resistant Pins
Deviant Ollam http:// deviating.net / lockpicking
Things You Should Know about Lockpicking… 1. 2. 3. 4. 5. 6. 7. 8.
Why locks matter to IT professionals Pin tumblers are universal Picking is simple and fun Pins are pins, in any arrangement Other everyday designs are often weak, too You can open locks with beer and beatings Many locks are pick resistant Some locks are wickedly secure
Deviant Ollam http:// deviating.net / lockpicking
Side Bars Similar to side pins Restrict plug movement Harder to pick than pin stacks
Deviant Ollam http:// deviating.net / lockpicking
Side Bars Finger Pins
Deviant Ollam http:// deviating.net / lockpicking
Side Bars Finger Pins
Deviant Ollam http:// deviating.net / lockpicking
Side Bars Finger Pins Schlage Primus
Deviant Ollam http:// deviating.net / lockpicking
Side Bars Sliders
Deviant Ollam http:// deviating.net / lockpicking
Side Bars Sliders
Deviant Ollam http:// deviating.net / lockpicking
Side Bars Rotating Pins
Deviant Ollam http:// deviating.net / lockpicking
Side Bars Rotating Pins
Deviant Ollam http:// deviating.net / lockpicking
Rotating Pins Medeco Locks
Medeco plug exposed, key pins rotating to align sidebar cuts Top View
Side View Deviant Ollam http:// deviating.net / lockpicking
Rotating Pins Medeco Locks Totally shot now Can be picked Can be bumped Numerous weaknesses “Open in 30 Seconds” Marc Tobias Tobias Bluzmanis
Deviant Ollam http:// deviating.net / lockpicking
Rotating Disks Tremendous Security Mimics a safe lock Very Difficult To Pick Takes much time and great skill Specialized tools required
Deviant Ollam http:// deviating.net / lockpicking
Rotating Disks Tremendous Security Mimics a safe lock Very Difficult To Pick Takes much time and great skill Specialized tools required Two-in-One Tool Manipulates disks individually Decodes cut positions Barry Wels picking a rotating disk lock with Mike Glasser
Deviant Ollam http:// deviating.net / lockpicking
Specialized Rotating Disks Abloy Protec Not just rotating disks Disk blocking mechanism False cuts everywhere
“Unpickable?” Closest I ever come to using that word Two-in-one tools cannot be used
Deviant Ollam http:// deviating.net / lockpicking
Magnetic Locks Miwa Japanese company Array of magnetic pins Simple North / South Evva MCS Austrian company Axial-rotated magnets Interaction with sidebar
Deviant Ollam http:// deviating.net / lockpicking
Miwa Magnetic Locks
Deviant Ollam http:// deviating.net / lockpicking
Miwa Magnetic Locks
Deviant Ollam http:// deviating.net / lockpicking
Miwa Magnetic Locks
Deviant Ollam http:// deviating.net / lockpicking
Evva Magnetic Code System Possibly most duplication-resistant lock out there
Deviant Ollam http:// deviating.net / lockpicking
Mul-T-Lock
Deviant Ollam http:// deviating.net / lockpicking
Mul-T-Lock
Deviant Ollam http:// deviating.net / lockpicking
Mul-T-Lock
Deviant Ollam http:// deviating.net / lockpicking
No Known Attack or Bypass
Protec
MCS
Deviant Ollam http:// deviating.net / lockpicking
Things You Should Know about Lockpicking… 1. 2. 3. 4. 5. 6. 7. 8. 9.
Why locks matter to IT professionals Pin tumblers are universal Picking is simple and fun Pins are pins, in any arrangement Other everyday designs are often weak, too You can open locks with beer and beatings Many locks are pick resistant Some locks are wickedly secure It comes down to your attackers and defenders Deviant Ollam http:// deviating.net / lockpicking
Deviant Ollam http:// deviating.net / lockpicking
Deviant Ollam http:// deviating.net / lockpicking
Deviant Ollam http:// deviating.net / lockpicking
Deviant Ollam http:// deviating.net / lockpicking
Deviant Ollam http:// deviating.net / lockpicking
Deviant Ollam http:// deviating.net / lockpicking
Most Attacks are Brute Force
Deviant Ollam http:// deviating.net / lockpicking
Social Engineering
Deviant Ollam http:// deviating.net / lockpicking
Social Engineering
Deviant Ollam http:// deviating.net / lockpicking
Social Engineering
Deviant Ollam http:// deviating.net / lockpicking
Social Engineering Preparedness
Stop
Deviant Ollam http:// deviating.net / lockpicking
Social Engineering Preparedness
Stop
Challenge
Deviant Ollam http:// deviating.net / lockpicking
Social Engineering Preparedness
Stop
Challenge
Authenticate
Deviant Ollam http:// deviating.net / lockpicking
Social Engineering Preparedness
Stop
Challenge
Authenticate
Deviant Ollam http:// deviating.net / lockpicking
Social Engineering Preparedness
Stop
Challenge
Authenticate
… then you follow this with “Reward” Deviant Ollam http:// deviating.net / lockpicking
Social Engineering
Deviant Ollam http:// deviating.net / lockpicking
Social Engineering
Deviant Ollam http:// deviating.net / lockpicking
Things You Should Know about Lockpicking… 1. Why locks matter to IT professionals 2. Pin tumblers are universal 3. Picking is simple and fun 4. Pins are pins, in any arrangement 5. Other everyday designs are often weak, too 6. You can open locks with beer and beatings 7. Many locks are pick resistant 8. Some locks are wickedly secure 9. It comes down to your attackers and defenders 10. The truth is out there… or, rather, in there Deviant Ollam http:// deviating.net / lockpicking
Forensic Evidence
Deviant Ollam http:// deviating.net / lockpicking
Forensic Evidence
Deviant Ollam http:// deviating.net / lockpicking
Forensic Evidence
Deviant Ollam http:// deviating.net / lockpicking
Forensic Evidence – 250 uses
Deviant Ollam http:// deviating.net / lockpicking
Forensic Evidence – 1,500 uses
Deviant Ollam http:// deviating.net / lockpicking
Forensic Evidence – 5,000 uses
Deviant Ollam http:// deviating.net / lockpicking
Forensic Evidence – 250 uses
Deviant Ollam http:// deviating.net / lockpicking
Forensic Evidence – 1,500 uses
Deviant Ollam http:// deviating.net / lockpicking
Forensic Evidence – 5,000 uses
Deviant Ollam http:// deviating.net / lockpicking
Forensic Evidence
Deviant Ollam http:// deviating.net / lockpicking
Forensic Evidence
Deviant Ollam http:// deviating.net / lockpicking
Forensic Evidence
Deviant Ollam http:// deviating.net / lockpicking
Forensic Evidence
Deviant Ollam http:// deviating.net / lockpicking
Forensic Evidence – picking
Deviant Ollam http:// deviating.net / lockpicking
Forensic Evidence – raking
Deviant Ollam http:// deviating.net / lockpicking
Forensic Evidence – both
Deviant Ollam http:// deviating.net / lockpicking
Forensic Evidence – ugh
Deviant Ollam http:// deviating.net / lockpicking
Forensic Evidence – wow
Deviant Ollam http:// deviating.net / lockpicking
Forensic Evidence
Deviant Ollam http:// deviating.net / lockpicking
Forensic Evidence
Deviant Ollam http:// deviating.net / lockpicking
Forensic Evidence – bumping
Deviant Ollam http:// deviating.net / lockpicking
Forensic Evidence – bumping
Deviant Ollam http:// deviating.net / lockpicking
Security is only as effective
… as the people behind it Deviant Ollam http:// deviating.net / lockpicking
Thank you very much.
Special thanks to TOOOL, Babak, and Daisy
http://deviating.net
http://enterthecore.net
http://toool.us
Deviant Ollam this presentation is CopyLeft by Deviant Ollam. you are free to reuse any or all of this material as long as it is attributed and freedom for other s to do the same is maintainedhttp:// deviating.net / lockpicking