Copying Keys from Photos, Molds & More

Video Statistics and Information

Video

Captions Word Cloud

Captions

[Music] all right how is everybody whoo cool cool so hopefully you can hear me hopefully we're all in the right place you could be seeing Omar Sharif not the cool Egyptian actor but the cool other speaker over there but thankfully things are recorded so whichever talk you want to make it to hopefully your night spot I am deviant I'm gonna talk to you about keys and specifically replicating keys in ways that you might not have done it before and you might not know was even a feasible vector of attack so Who am I some of you came up and said hey some of you saw me last year some of you know me some of you don't I am part of a covert entry team my crew and I get into buildings like that is our job we do physical pentesting we do you know kind of dangerous door kicker he stuff it's a good gig if you can get it like it's absolutely a lot of fun I actually put up a blog post recently because so many people kind of write in to all of us and say man I love that gig you all do how do you do that I'm like well you know be a ten year overnight success I guess but there's there's some advice I've given online about getting into this and there's there's some advice I give to people who practice the idea of covert entry in the field just for those of you who's not this isn't quite your whole forte let's talk about covert entry here is an example of just a really really basic attack right like latch slip on so using a traveler hook to slide the latch out of the way on a door that was locked because of bad door fitment absolutely valid vector we talked about this I mentioned this in my talk last year this is a classic example of a covert entry right as opposed to and over to right so here's the use of a Halligan bar smashing exactly at the right spot on board breaking to where it's been reinforced definitely definitely not covert when you're doing this kind of thing right it's really cool though to see practitioners these are firing sponsors knowing exactly where to strike on the door to get right through it even a hardened reinforced door and you might think that like overt destructive entry is never allowed on jobs you'd be wrong like this is me in a construction outfit with my partner Rob and we're just drilling a lock out of the door as we were advised by the client to go loud because we haven't been caught yet on this job I'm like alright get the hammer girl and I'm like this is mid day no one's stopping us a security guard looked at a monitor and just like in the stock they're like oh we uh are we working on doors today and someone else was like looking through their papers like god yeah there's a lot of construction I think I think we're doing doors yeah all right but again that's overt versus covert and we'll talk about these terms the idea of overt and covert what is this kind of manipulation here this is just raking of a lock right anybody who was last night at the lock picking gunfight anybody who sulphur was teaching just teaching this out there so yeah manipulation of the pins covert entry the difference between overt and covert it's who notices that somebody got in so if you have no training whatsoever you'd probably still notice that like this is a problem right you don't have to be a physical security expert to be like huh that wasn't like that yesterday that's over entry now even something like this a little bit to a lesser degree but I would expect an average person with no specialized training couldn't notice that something happened to this door right it was forced it was you know pry bar was in there that is over entry compared to when a specialist with particular training and skills and tools can notice something happened this is forensic locksmithing this is using a borescope inside of a lock and actually looking at tool marks based around a manipulation attack so who can notice that someone got in there well not your average person but a specialist will notice so this is an example of covert entry covert doesn't mean the no evidence it just means a specialist or someone trained to look for it is the one who will find the evidence so again was this overt or covert or surreptitious we haven't talked about surreptitious but we will which one was this this is very overt I'm pretty sure that even if you don't have any training you'd be like that holes not supposed to be there how about that latch slipping that I did this is interesting when people say oh man I'd love to get in like a ghost like you Leave No Trace did we leave no trace no there's scratches on that latch this is absolutely covert a specialist trained to look for this would spot that instantly and say well this is not the strike plate of the door something was in this in this latch work that shouldn't have been there surreptitious inspection actual inspection forensic looking for covert marks can be really detailed does anyone know what this device is that this gentleman is working with yes it's an SEM scanning electron microscope we've put pins in an electron microscope to gather forensic data here's a pin with no scratches here's a pin with a lot of scratches those scratches are not from a key that is covert entry manipulation the evidence is there the last category though surreptitious entry that is the category of attack which is really a unicorn kind of technique it's very hard to achieve the idea of a surreptitious entry is when your average person won't know it happened and even a specialist looking specifically for evidence probably won't know it happened syrup chissus entries hard one of the few real achievable vectors for surreptitious physical entry is duplication of keys when you think about it even if it's a weird specialized key if you can duplicate it on the same you know blank the same stock of metal the same brand of lock if you use that key and it works that key is only gonna touch and scrape the inside of a lock the same place that the regular key would have it's going to leave the same marks that a conventional key would and even if you know someone goes in there with a scope they're like well alright something something's been in here no one can really conclusively testify to the fact that this was like an attack and this is why it's really a cool to Niq to talk about and it's one of the few ways that we can fully deniable get into a building sometimes so remember you want to not be overt you want to be as covert as you can surface if possible by the way this overt entry you know the perpetrator was perpetrator was a goat always out to get you so yeah absolutely you want to be more surreptitious than a goat a feud or it comes back for more I love it it was just like pissed off with this he didn't get his loan qualified at this office apparently so yes we're gonna talk not about overt or even covert we're gonna talk about surreptitious or non related entry for those of you who didn't do any of the lock-picking stuff before want a quick refresher inside of a lock how does a lock work well you've seen a lot of lectures about this before there are pins in a lock the red ones are called the key pins the blue ones are called the driver pins if you have the correct key your key goes into the lock pushing all of those pin stacks to just the right height so that none of them are binding or blocking and that plug is able to turn now if you're not a locksmith you may not be aware that the actual bitting cuts on the blade of the key they have very specific depth values it's not like just an infinite range of possibilities that like here's this first position we can have very specific very regularly spaced intervals of cut and manufacturers have bidding charts and locksmiths can reference bidding lookup charts so you can see exactly what measurements on a key would correspond to different cuts if you have those bidding values you have the the code of the key you can reproduce a key you can go somewhere else and reproduce a copy even if you're not walking into a store like a hardware store like we normally would think of copying a key is well here's my original stick it in the stylus duplicator machine you don't need the original to make a key and that's part of what we're going to talk about there's a few scenarios for copying a key illicitly and we're gonna walk through the idea of trying all of them and I have all the gear if you want to try this afterward there's even going to be a contest at the very end well you'll do what you're gonna see right here and in a little bit of time what we have at the end of the con I guarantee you people are going to generate working keys for locks that I brought so scenario one the best possible case scenario if you want to get a copy of a key the best-case scenario is if you have even brief hands on access to that key like someone briefly as I hear go get this from the supply closet bring this key right back even going hands-on for a minute or less you are usually able to very reliably get data off of that key what's the easiest way to do it get yourself calipers every key remember has very specific values for its measurements these are the cheapest and you know decent enough calipers you can get on Amazon I was shocked when I said I was like what under 12 but okay great fine I'll buy these go for it how would this work well it would work exactly as you might imagine you stick the bidding teeth in the caliper and you measure those depths and you reference your lock chart let's look at this one right here this is a sergeant brand lock I can tell from the head of this key so I get my sergeant lock chart it shows me the actual depth values for all the possible cuts well let's compare that and let's do some math right now this first cut which value does it look like it corresponds to which bidding value shout it out I can't hear you yeah that looks like a two to me how about the next one yeah I like that for a three moving down the line looks pretty similar right we got another three how about the next cut here oh three oh is what it's another two finally some variety we got a little something different two four eight who's that yeah we're marching along down this whole key not taking a lot of time right what's the last step by the way it's a three there we go that's the whole bidding code you can use this value absolutely to generate a key later if you know the blank you know the manufacturer is a standard series of depths we have absolutely done this really quickly put the key back and gone home gone about our merry way to generate that key later now that's walking around with calipers which you kind of have to fuss and fart with and you're either really good with your memory which I'll go figure my memory is not great or you're writing things down there is kind of an even easier way to do this if you have what's called a key gage has anyone ever seen one of these in any locksmithing kit some people I'm seeing nods yeah it is literally just a pre-cut series of gage marks for different brands everything that we're about to talk about all the different tools or techniques they're all trade offs the trade-off here is that this is a lot easier to use you stick the blade of the key and slide it over till it stops bam-bam-bam you just cranking out values it's easy but the trade-off is you need to have a cut on the the key gauge that works with your brand of lock now most popular key gauges have really common popular locks on them but if you get a real obscure oddball key well back to the calipers look it up in your codebook there's one other technique that you can have this kind of in your back pocket as a tool and we have these in our field kits if you come up against something that you've never seen you're like I don't even know what brand this could possibly be but I want to take a quick imprint I want to get all the information out of this key and get it back to my home base and figure it out there because these key gauges are great for measurements but they don't capture what they don't actually capture the profile of the key if you're coming up against something you've never seen you're like I need to ask other people on my team maybe one of them knows this brand I've never heard of it what we will sometimes do is just do a clay impression have a little pocket clamshell mold you squeeze the key in it and you can even see stab straight into the end of the tip so you get the profile of the key now you have all the information about this key and you can do you can decode this later at your leisure you can take calipers to this later and measure it back at home base you can check that profile against a whole big table that I'll show you of different key profile data but you have all the information and you've done it in a way that didn't involve any metal so this can come through metal detectors you can get out of the building you've exfiltrated the entire key detail and you did it just in like 10 seconds or 15 seconds of someone handing you a key well that's great if someone hands you a key with the expectation that you're gonna be out of their sight even briefly what if there is no expectation that you're out of their sight what if you're near their key or maybe they're just slightly distracted like the keys are on the table and they're on a phone call over here and you're not really taking the key away from this person his options our favorite option take photo of the key this is not weird spy stuff this is absolutely a hundred percent feasible because again remember those bidding depths are very specific predictable depth patterns I have made a bunch of little chart lines that I can just superimpose in Photoshop or GIMP or any image editor and I can just look down the lines and say okay boom boom boom boom that okay this this lines up this is great now the best way to go about this if you're gonna take a photo of a key it makes your life easier if you could put it on a piece of graph paper because then even later on in Photoshop you can kind of straighten it out if it's not perfect you can make it more perfect or at least a little more gooder now again are you walking around with a giant thing of graph paper know what I brought for a bunch of you is I keep these around these are just I so credit card-sized i laser them out you can stick them in your wallet so if someone has just barely distracted for a minute we've done this literally at like security guard desks one time it's great we walk in a building and like you know you know Babak is just right deadpan Babak just wants to get a guard away from desk and rob is standing in the desk Bobby just walks away comes back he's like your elevators broken and just kind of walks back to the elevator extend this guard it's like what damn it and like walks over the elevator and Rob just kind of boom boom take some photos of the guards desk takes the photos the keys some other information five seconds doesn't really touch much and the guard is like buddy you're crazy you just it bob is like oh it is must not have pressed it right okay thanks yeah getting a photo and then using these little lines which by the way love you here you go they're all for free we used to just give them to our students but I just throw them online for you if you know anything about Photoshop or image editing absolutely lay these over top of a photo Wow how come the phones it's like I'm at a concert ruin that for the person behind you and all your concerts that's it that's right your kid will look blurry and over sampled audio forever that school play all right no it's okay that's yeah capture this the author oh the links up later but yeah taking a quick photo and putting the gridlines over it absolutely feasible how shitty can your photo be this is kind of fun so let's say the person is literally right there still next to you just you know their keys are just sitting down on a table well many of you are good with like the kind of covert cell phone photo operation right you take some covert photos you can absolutely do a photo just even shitty and off angle and correct it out in Photoshop so for example I was invited to be somewhere and I was consulting on some project and there was like a Kino they let me into the room and I think there was an AV closet because I was presenting a thing later to a board of people and like okay well here's our network equipment closet we'll turn on the speakers and they just plonk this key down right next to my laptop oh my god this will be fun flip and I wanted to show them later that I could decode their key really easily so this is a terrible photo like this is zoomed in digitally right now it's in an off a goal there's shadows but again if I throw this into Photoshop use the grid lines and just twist and fart around with it you can straighten this out and the way I've made if this will click it a little more closely all the grid lines I threw up there for you the black lines are the actual bounded edges of the blade of the key the bottom and top of an uncut key and there's always some part of that blade usually right up near the bow with a head that's uncut so you've got enough to spent to figure that out and then the blue and gray lines those are evens and odds so all the blue lines are evens the gray lines are odds this is a Schlage so it actually starts with 0 so it goes down from there is this is 0 no 1 2 3 what is this first cut yeah it's a 5 what's the next cut is it blue or grey it's blue so it's even what's the next cut to write on if the bottom bottom gray line is 9 what's the next cut below it below that what's the next cut over shout it out yeah 7 what's the one beyond that just one more above it than that right we got a six this is feasible shit that any one of you can do and you can crank out a key again from a terrible photo we can then take this bidding data and generate a key because we know the brand of lock Schlage is super common we know we have the blank and you can generate this key which we did we did it in the same classroom while we were addressing these people giving a report and it was really fun for us and it was kind of eye-opening for them so nowadays when I go around places in life if I just see keys hanging out I will always try to take photos because it's really funny this is a Medeco key I could decode this key this is a key hanging off the belt of a guard while I'm standing there getting checked into a building absolutely that is completely decodable right there again it doesn't have to be perfect but I can absolutely do this it freaks me out that I'm in a lot of lifts and vehicles like that where people have their own personal keys and like people coming in and out of their car day in and day out I mean this is the way I think because my brain is insane but like a lot of people are leaking a lot of personal key data if you want to protect your keys by the way from kind of casual observation either a keep them in your pocket or if you're like me like I use a carabiner for my keys I do have this extra little tool that I found online and it slips over the head of a key now it's a useful tool it's a little wire stripper and screwdriver and bottle opener but the idea is most of the time when your keys are hanging out somewhere this little tool is covering them up so it's an added bonus it's a little extra protection and you can kind of guard your privacy a little bit that way if crazy people like us are around you we like to say you shouldn't hold your ID up to like the camera and be like look at my ID if you don't follow sob on Twitter he has like a script that retweets people showing their IDs and stuff online like you wouldn't hold your your ID up you probably shouldn't hold your keys up to the camera this was you know somebody who got up I can't believe I got the house that I've always been dreaming of alright thank you for the key this was the head of security at some club we were at after a hacker con in Montreal and he's like oh what do you guys with these locks and stuff on the table we're like oh yeah we're super into locks and we love key we got some cool keys show buddy what are your keys man and he's just you know holding up his key so I'm like alright thanks that's awesome this is so I hope they don't go to something maybe don't tweet your keys either I understand you're proud of your first day at work if anybody saw April right stalk day one absolutely people do this sort of stuff all the time they tweet badges that this was a reporter who tweeted they're like did a pocket dump there is so much information going on in this photo all of these keys are decodable you could probably tell first of all who could tell me which keys are probably their house keys yes the quick-set why do you think it's this quick set in the Schlage because it's on the same keyring as what the car key absolutely this much much more likely to be their office keys down here I love that we also have a little key fob we got a little proxy fob with the with the card badge data on it because that's wonderful good job maybe you don't Pinterest your keys to I get it this is a cute Christmas ornament that someone made for their new apartment but you know don't put it online please so in the real world there's a lot of less-than-ideal ways to get this key data but it's totally totally feasible if in the real world you are trying these photos and the first time you do it you might be a little like nervous and I only have it was this person gonna turn around a little tip for me to you to make your life easier do anything you can spend the extra second to separate the key from other keys maybe give it some contrast like I just had a black hat that I flipped off for a second and slung it behind this key this as you can see it's a building master key stamped with the M and I just like took a quick photo now again it's kind of off angle but the contrast the black background the crispness it's gonna make my life a lot easier when I try to decode it later and get the key codes using one of those image templates speaking of key codes sometimes a quick photograph is all you need because of something called blind or direct bidding codes well let's talk about these two things first of all let's just talk about direct bidding codes some people are not aware that the numbers that may be stamped from time to time on your keys have incredible value in the keys and lock systems that you're using look at top we have eight six five five five we got a two two eight three three three do those look like they might possibly correspond to these bidding values yeah those are called direct bidding codes that that is the key information forget like using your gauge in your chain you know trying to graph paper if you can just take even a shitball photo of these keys and get that number legible you've got the key data and this happens a ton I ask people sometimes in our classes for like everyone should I mean some people now or check in their pockets I've seen people reaching like look at your keys you will find keys probably in your own key collection then have numbers on them and knowing what you know think of shallow is usually a low value the deeper you go is a high value like you're gonna be like oh god that's a direct bidding code I was in the tool slack and I was hey guys I'm about to do this presentation if anybody has a couple of photos of direct bidding codes I would love and like like my slack blew up as people are just reaching in drawers like John was like yeah I think I got some and then Brett was like yeah I think I've got a few like that too I'm gonna give the top prize to scorch when I asked for direct bidding code photographs because scourge sent me this photo and I was like no he was like nope yep yep that's one of our properties that we went to once it was an Airbnb and he's like he looked at the key he's like can't believe it so that's that's bad you don't don't be this person maybe maybe just let's try to get on board with that now in order to obfuscate or try to protect bidding data there is such a thing as a blind code so if we look at this packaging and you may see this a lot at our hardware stores if a customer wants to be able to buy multiple lock sets that are all key to like the manufacturer will sometimes you know stamp them like this on the outside of the package so says keyed alike four eight eight four nine well I can tell you just by the head of this key I know this brand this is a clone of quick-set quick set doesn't go deeper than seven right so this cannot be a proper bidding value there's eights and nines in this this is an example of an indirect or blind code now there's a master lookup table somewhere that the manufacturer has but the idea it's like a hash as long as you get multiple packages that have the same blind code you know that they're all going to be key to like and if you're installing them around a big property they'll all match well if you want to reverse this out easiest way to do it well I mean the super low-tech way is just open the package and look because the keys are stamped the keys are not stamped with four eight eight four nine they're stamped with oh that says two three two five two does that look like an indirect or a direct bidding code yeah that's the direct bidding code and the great thing about this the super poor-man's lookup table is that you can read it through the packaging so if you just want to if find like Home Depot trash outside of an install and it has a blind code they probably bought it at their local regional Home Depot or Lowe's go there look on the shelf where they probably get a shipment a pallet of all the same blind code get the direct bidding code there you go even kind of more interesting I noticed more and more I'm finding padlocks take a look at some keys for padlocks here we have a master lock a little m1 blank stamped three eight three one eight eight well if I turn this key sideways does that look like a direct or indirect code yeah that does not look like three one eight eight that's that's clearly a blind code but I mentioned look-up tables right look up tables master locksmith references our resources that exist so if we just punch code three eight three one eight eight okay yep series found six one three six key cuts really does that maybe look like six one three six yes it does thank you master lookup table but of course this is stamped on the key like if I have the key I could take a photo and dica I could copy I could do a lot of things it'll be much worse if it was stamped on the lot oh shit it is stamped on all the locks okay whoops so yeah look-up tables for blind codes to reverse that out to the direct bidding code absolutely useful works for combinations as well if you look on the back of most combination dialogues depending on the age and vintage a lot of times you'll either see a stamped or indelibly inked series of numbers again this is not the combination of this lock but there are resources there are police and locksmith resources there are whole code books they are all in like two scanned as PDF now that I have if you ever want them just ping me I guess they're probably out of copyright they are they're very dull if you just read through them front to back I don't recommend that but you can absolutely just scroll through find the code series there you go if you want an easier solution that doesn't involve like repping through PDFs and shit bird shit like that well there's software instakill locksmithing software what happens if we just do a code search in this instance oft where we punch in the number on the back of our master lock we say okay search and it farts out a bunch of results but we know the brand it's a master combination lock so we scroll down to that click reveal oh wow 32 14 32 there's our code oh and yeah by the way insta code is an app on your phone so nine dollars a month you two can have basically code lookups to beat the parent awesome awesome stuff today we've done all of these things on jobs it's really funny personally I think one of the coolest things and our buddy drew on our team he loves doing this if you have no access to a key at all you still can't get the bidding values of a lock you can you can reverse out and get the key values and make your own key and do it pretty surreptitiously the way you do this well you steal the lock if you can disassemble a lock which yes I understand that disassembling and taking the lock out of the door means you probably have access to that door but let that way you might be doing that at like 2:00 in the morning and you want to come back during the day and not look like a crazy person disassembling a door which yes I realize you put on your high vis and hard a hat you can do that too like you saw but if you want to be super surreptitious about it absolutely snatching a lock disassembling a lock to get the pins out it's not hard you use a very thin piece of metal it's called it's a technique called rear shimming locksmiths do this all the time with a key blank using a key blank and a thin piece of metal essentially I'll diagram it out for you it's like this if you free up the tail side of the lock so this thin shim of metal can reach in to the rear side well it's gonna bump into those pin stacks right but if I have a key blank which raises the pins as high as they can ever go and if I slowly extract this key blank those pin stacks are gonna naturally drop through a range representing all possible values they could ever have and I keep a little bit of tapping pressure on that thin shim I can slowly advance it one by one by one through those pin stacks until I've got them all separated out then I can spin the lock over I can disassemble it the lock is completely open even though I didn't have to pick it didn't have to leave forensic evidence what was the only thing touching across the bottom surface of those pins a blankie do you think a keyblade is gonna touch those pins the same way a regular key would yeah it actually is it's not going to leave marks that are anything other than ambiguous and if you can dump those pins out that is your bidding value right there you can measure these pins with the calipers just like you measured the blade of the key if you get a nice big locksmiths pin kit like here we have one on our workbench you notice all the pretty pretty pins but you also notice it has a whole big chart of resources up here this is if you're repenting a lock you need to know which values correspond to which cuts if you're building a lock system well take a look at these charts that is your decode data right there again in this case we're looking at a sergeant brand lock because we could tell that from the keyway I've got all my pins here are all of my key pin values well if I take my pins and my calipers what does this first pin look like if you remember the code you could just remember from the earlier write what was it yeah that's a two value how about the next one point two zero one zero what does that a three about the next one it's another three absolutely one night not always going to be perfect right but you get as close as you can so this is probably what it's probably a to absolutely going on down the line and within a few seconds you can reverse out and decode the full bidding value there you go you reinstall that lock you put it back where you found it you can make your own key that will then work in that door or if it's a mastered system maybe you're decoding the master key I've talked about that in other talks years ago at hope there's a talk still online about mastering master keys it's not difficult it's just math and understanding how master charts work by the way if you want to steal a lock there's a kind of the way we look at the world the idea we're looking around for candidate locks on job sites usually they are locks that aren't going to get a lot of use locked kind of on doors to nowhere so if I want to reverse out a master keyed system like this is clearly a patio that has it's like a smoker's patio with nothing on it a door that's probably never really locked a door that obviously has mounting screws on the hardware so I can pull this out really quickly because I'm on the inside of the door I've broke in through another way I just want to steal the lock and leave sometimes if you have a door that you cannot attack at all you search around the other parts of the building and you say well I gotta find a different lock again if it's a mastered environment you can reverse out the master key what do you think one of our favorite locks is in a building in an office environment a door that probably is on the master key ring but is probably never ever really locked during daily operation any ideas I heard it over here absolutely instead of targeting this door go to the bathroom look at how many offices you work in and operate in that have bathrooms that have locks on them and the most you'll ever see is maybe during service a janitor is in there but he or she is going to just use the thumb turn on the inside they're really not messing with the key because that's a problem right if you steal this lock first of all if you steal the lock and leave leaving a hole in the door is that a little covert or is that more over that's a little over now we've been instructed to do that on some jobs and it's funny seeing if the client will notice or report it to the right place but we want to be a little better than that what we'll usually do is have a pocket you know full of a couple of different replacement cylinders and you pulled it all right oh cool LF I see we've got one of those slap one of ours in cool no one's probably using that lock no one's really going to notice that this lock has been replaced because it looks fine the super super secret squirrel way to do this though is you swap the lock that you're stealing with what's called an any key lock or a super Maison keyed lock this is a lock I've disassembled I've dumped out the original pins and before I went on site I prepared it thusly I put a whole row of zero bidded pins and then does anyone know what these little tiny guys are they're for mastering they are single size which is out of spec for Schlage by the way there's no such thing as a single size master but I just made a whole stack of pancakes of these little thin pins that makes this lock operable with any key so if I swap this back in the door I've made off with the real buildings lock and even if someone from their company were to come along with their key their key that I haven't figured out yet it doesn't matter because this lock will work with any key that will ever exist in Schlage systems and then I can come back later after I put their lock back I have a key that works how long does it take to swap locks out not that long here's a little video of Drew and I this is outside of a data center we hit this is like the back door so we were in the building because we had tailgated in we came out of back door you'll see a ladder in the background because subject for another day we stood up and we masked out their door sensor so we applied a magnet so the door sensor wasn't going to alert we do have this door open longer than thirty seconds but not much longer here we go I've unset the mortis cylinder gonna spin that cylinder out it's a complicated lock I'm not gonna lie drew had to take a while disassembling it and measuring it's a Medeco took some time but he got to do that all off-site he did that at home back at base because I swap in a cylinder from my pocket in this case it's not an any key cylinder but it is a cylinder we have a key for so now we gave ourselves persistent access to this building because we had masked out the door sensor and now we've replaced the mechanical cylinder with one that we own so nobody from the outside unless they're highly trained would be able to notice this happened we didn't really leave weird tool marks or anything it's just a screwdriver touching screws which normally get touched by screwdrivers and in the end you're about to see this has been what like 50 seconds 25 50 seconds before you know it we're gone but nobody from the client even noticed that like that door was open and we just drove off-site and then drew had all night long to decode a really complex master keyed system and there you go now that's the ideal scenario right that's the ideal scenario where everything works smoothly and you have all your tools back on site if all you have is time like in a building and all you've got is your opportunity with like the key or the lock for one minute before you don't want to take anything off sight I made something else for you remember those key gauges that we talked about I found them to be a little bit lacking I designed this a while back the devious decoder card as we started calling it internally it looks a little different than most locksmiths key gauges a locksmith key gauge because locksmiths buy vary their nature usually measuring keys because a customer needs a key copied this card yes we'll measure keys like a locksmith key gauge that's fine that's what we use it most of the time for so I can measure this late key okay and that works just fine but the other cuts there's Kwikset Schlage and master and American the most common locks in the u.s. it also has cuts for pens so if you do a disassembly you don't need your calipers you don't need everything else just Bam Bam Bam Bam Bam where does the pin fit okay it fits in here move on move on Bam Bam Bam so I found it kind of useful maybe if you do this sort of work you might find it useful if you want one I just farted this up online to now it seems like I'm being magnanimous I will point out oh yeah a diva's releasing everything for free isn't he awesome I mean sort of but you notice I make these on a plastic so they're nonmetallic they can get through a lot more spaces they they don't really bend or warp it's surprising how well they will work as plastic you know what's not fun though is getting laser cuts just right in plastic I have done so many test runs and so many iterations and so many different types of material and lit shit on fire and like change laser power and because I'm fighting with the melting of the plastic which changes just by a little bit the cut sizes right so yes if you want to have a whole fun day at your laser cutter like doing this knock yourself out it's free I'll probably throw proper cut versions on red team tools at some point if people keep asking me I did bring a bunch here so if you're playing the game you can have one for free now because you know I'm a nice guy but hurray in general once you've gotten these bidding values that's kind of only half the battle though because you still need to produce a key when people think about creating a key like cutting a key there's a couple bits of information you need one you do need to know what blank you're using you need to know which key way profile which brand of lock it is and profiles can get a little complicated there are a lot of really weird key way profiles out in the world fortunately not too many here in America but there are bizarre ones out there the weirdest stuff you're more likely to encounter especially in commercial environments here in North America are what are called section key ways so not really weird obscure brands just lesser-known key way profiles of well-known brands so Schlage see is probably something that everyone has in their pocket right now Schlage e you might have seen one in your life even if you didn't realize it F is rare G is super rare but on big commercial environments they have keys like this on site sometimes and there's multi section key ways like this there's multi section blanks that work in different you know different locks across the board thankfully what we usually roll around with this little bag right here contains what are called super top section keys so this is just a bag full of all of the absolute most useful do everything blanks that you can imagine they are you know like the top section of all keys they exist these are all again these are resources that locksmiths are well-known to use you might not encounter these kind of charts there's a lot of complicated key ways out there but things like the ill cokie blank directory is a free pdf it's actually multiple PDFs and you can download that it's online and I really like the printed version of the Oh Cokie catalog is real size everything is to scale so if you have a key you can lay it down in the book or you can stick it straight on the page and look at the keyway profile so you can figure out what key you're using in the real world if you don't have these resources the best thing I'll tell you is try not to make this mistake taking a photo dead-on from a key like I want to get the keyway profile this is photo is not helping you spend a few extra seconds get a black piece of paper or color a piece of paper black and shove the key through it get that contrast you will thank yourself later I know your Adrenaline's up on jobs when you're in the building and am I gonna get caught spend the extra two seconds so that when you're back with your team at night everyone's like damn you couldn't have like done any better job on this freakin key really like again just a little black piece of paper what do I do those little graph charts that I make i laser them with little grooves and I just color the back black so this is like a little shutter I can shove my key through it get really crisp photos put the key right back on the desk wherever I was and then I've got everything I need I got the profile that I know I know the blank I've decoded the values so I know the bidding values and it's time to produce a duplicate now most people when they think of making a key on a key machine originating a key like not just a little stylist cutter but if you just have a code and you want to code cut a key most people imagine that entails a big complicated machine here we have like a silica Futura there's you know cava Elko makes the ultra code like these are mini CNC machines that have all the code book values built in and you don't need an original you can just punch in numbers and this machine will just and just make you a key that's noisy it's a lot of power it's a lot of space it's heavy it's expensive what do I like to use well there's something like this this is a punch machine no electricity super small footprint and it works across tons of different brands how does it work we don't have to watch the whole clip here but there's basically a traverse and a plunge and it's too little micrometer arms that measure where the jaw which holds the blank key where it is positionally and depth wise so if you're working on one brand of lock all you do these blue cards are interchangeable HPC now HPC is a division of Hudson has been making this machine for ever and it's it's awesome it's essentially an analogue way of doing digital you know precise cuts and I think we can even show if we jump ahead a little bit to a different brand let's say we wanted to make a key by code how does that work well I've got my blank in there I line up to the depth and position punch I move over okay what's the next position on the key the next position is the second position okay move over to that what is my depth okay my depth is seven dial my needle arm over to seven it is like unscrew up a ball and it has all the same results as the much bigger much more complex like future a machine or any of the big machines that you would see in a lock shop so you can originate a brand new key right there in the field like we've done this you know in our car before if we pop the key out you'd see it's a perfect crisp key now this isn't like pocket-sized right this is this is called a pack a punch this is what drew turned us on to our buddy Joe and he like always has this in his field bag again everything's a trade-off right what's trade-off you don't see little blue cards that go in and out of this machine this is one brand only there's a nice big s on the side of it why do you think it's an S yeah Schlage and the ones we all have are all Schlage but it has two adjustments you can see this little jaw head will adjust up or down it'll traverse up or down and then there's a carriage in the front that you lock your key into and this carriage will position your key side-to-side so you can choose which position you're working on punch advance the next vision change your value punch you can knock a key out in almost no time in fact let's just let this one play for a second because I I love how well this is made I love how it's about as small as you could ever make a really precision tool it's the next to like you can manually file keys we've done this a lot you can sit there and file and if you have a key gauge you can check your cuts but this versus filing fuck a bunch of filing because this thing is incredible so we index it on the first position okay you can see coming out the other side so that someone wants in our class they were like the numbers only go one two three I'm like yeah keep going they pop out the other side it's really just a made it as compact as they possibly could so we've got our chart value here if we found the key on the job and we want to duplicate this key all right take our depth to four looks pretty good all right we're on four just when you use these and you can use these I've brought it free to use in the contest just hold down on that jaw head so it doesn't bounce around when you punch alright move to the next position what's the next value the next value on position two is a seven all right dial our depth to seven little red numbers on the seven and you can even see the little debris to fall right out the end of it if that little bit that you nipped off the key falls down on the carpet in the office where you're breaking in is that covert or surreptitious that is covert that is not serve dishes if you're leaving evidence behind do this shit in the car or I'm not gonna lie I've done it a bathroom stall over a toilet and just flush the brass there we go we're halfway done this key I guarantee you if this was hand filing this would not be halfway done by now and it would not be nearly as precise and nice looking all right moving along we're on the fifth position now all right the fifth value okay almost done dial it in and there we go in virtually no time we've not just duplicated we it's called originated we have originated a brand new key and comparing that to the original factory cut key that's it that's that is it you just made a key right there that's probably the best case scenario for when you've stolen a key value and you want to produce a key in the field what is the least best scenario but the coolest one in my opinion the coolest scenario is molded cast remember I mentioned that you could clay cast the key for information and take that information away that's not the only thing you can do with the clay kit and if you see on the table here I don't know if I'll have time for it during Q&A or not or over it later on I brought clay I brought the mold we can absolutely take this little cup of metal it's like it's like you're in Wild West right you you you're making like a shot for a rifle except you're not what you're doing is using a little hot cup of metal melting a little woods metal ingot you get this little metal slurry you pour it right into your clay mold pop out a fully working key it's not going to be as strong as a real key but I tell you what I want people to try this later and we're gonna set up somewhere over in the the hangout area I brought all these supplies for you to try it and if you don't mind a little bit of flame and and vapors that you shouldn't breathe definitely try this but before I let you go I got a challenge for you I have developed a little mini game a little mini contest that anyone in this room has the knowledge and ability to participate in right now for the rest of the day I will be working with people who want to try everything you just saw specifically I have two locks with me big ups to syntaxerror who prints these little lock mounts they're really awesome for contests and things so he's a good dude and he sent me a couple and I was like oh I know what I'm doing with this after my talk is done Terra is up in the next room so I'm gonna watch her but I'm gonna then tweet after that a nice crisp photo of a key on graph paper look for this photo it'll be nice and high resolution not this exact photo those of you pulling phones out right now I photoshopped it slightly but if you can take this photo that you see online again all of my stuff is up on my github I'm gonna tweet a link to it as well use that visual template use the decoding lines figure out what the bidding is if you figured out what you think the bidding is come find me you can definitely originate your own key I brought a ton of blanks see if it works if it opens lock one terrific you're partway there if it opens lock one I'm gonna ask you for a way I can reach out to you with another photo you're gonna get a photo that's slightly crappier but I guarantee you the same process will work photo decode this type of photo make a key for lock number two if you've done that you're really chugging there's only one challenge left and I want to see if anyone can get all through all three in the last few hours of the con both of these two locks together are mastered they are both mastered they both have master pins I'm not asking anyone to disassemble them but knowing what you know between two keys that work individually can you reverse out and I'll help you along a little bit like there's ways you can get hints if you can determine the top master key and produce a key that opens both locks you are the top prize winner and I'm gonna have prizes for the top three or four people to do that so ultimately I brought black I brought files if you want to use better tools and like this stuff is all free here if you want to use the pack-a-punch and stuff or you want hints well the world kind of sucks a big fucking ball of dicks right now so if you donate to any of these these charities that matter a lot to me based on what's going on in the world if you donate to the sex workers outreach project to reign to The Trevor Project I will flood you with additional help advice of by all means like thank you but even if you don't want to do that if you just want to come and get hands-on if you want to play with casts and mold we're gonna do all this stuff after Tara's talk I'm gonna be out there somewhere just in the hangout zone probably where the food used to be on those big tables if they're still there so please come by look online at 3 p.m. this Keys gonna go up and I'm gonna do this until we close and we got a minute or two for questions but other than that thank you so much [Applause] [Music]

Info

Channel: Wild West Hackin' Fest

Views: 207,867

Rating: 4.9323897 out of 5

Keywords: Wild West Hackin' Fest, decoding keys, Security, Information Security, Deviant Ollam, Physical Pentesting, Physical Penetration Test, Red Team

Id: AayXf5aRFTI

Channel Id: undefined

Length: 48min 30sec (2910 seconds)

Published: Wed Nov 28 2018

Reddit Comments

Deviant Ollam is a true security legend.

👍︎︎ 4 👤︎︎ u/misconfig_exe 📅︎︎ Mar 07 2019 🗫︎ replies

This video was absolutely fascinating.

👍︎︎ 5 👤︎︎ u/roc_lobbster 📅︎︎ Mar 08 2019 🗫︎ replies

Just spent 48 minutes learning how to do stuff I'll probably never do in my life. Thanks.

👍︎︎ 4 👤︎︎ u/thechiefusc 📅︎︎ Apr 01 2019 🗫︎ replies

This guy is so awesome. You can learn so much about keys from his talks. And it's super funny as well!

👍︎︎ 2 👤︎︎ u/TheTrueBlueTJ 📅︎︎ Mar 12 2019 🗫︎ replies