DEFCON 19: Key Impressioning

good day everybody I hope I'm well you can hear me and if I start mumbling a bit more please remind me of it I'm Yours liars I'm a member of two that work that works I'm a member of tulle Amsterdam I'm the current to time over impression a champion of the Netherlands I'm the German Meister current and that's actually a big big deal because I'm the second Nam German I'm the second not German whoever won that and well that's a big deal and I'm the current world record holder all right current wilt record holder on impression thank you impression that's what it's all about we're going to impression keys what what is that actually in pressuring key impression is filing blank uncut key to a working key without any prior knowledge of the biding of the of the lock that's basically it that's what we're going to try that's why I have this this this setup and I will it will include the demo and I try stuff with the microscope I hope that works so you can actually see what I should be seeing okay that's wrong okay is this a new thing well actually it's not because this guy Edward tickle use this technique in the end 70s for FBI black ops well for black ops one of the stories is that they had to go into a building that they obviously did not have a key for otherwise he would be done and what the feds did they put a big cardboard next to the door with a hole in it and add in the cardboard so he start impression in through the hole and he end up with a working key the fun part of well the neat part of oppression opposed to lock-picking is that when you're done you don't only have a open lock but you have a key which you can give to another operator who is probably not that efficient in lock picking or in freshening but that doesn't matter because he knows how to operate a key that was spread v-jump if anybody knows this guy I'd like to hook up with it because I'd really like to pick his brain but well after now we didn't find anything about it besides the documentary and that I really didn't want to show you guys because it's it is in English but it's dubbed over in German so if I read up that to English that's going to be crap okay so in the end seventies it was used in the field and the lockpick community did really well I didn't even know if there was a active community at that time but a couple of years ago a member of SS death which is - in German basically he spent quite a number of months investigating this technique and he wrote a book on it so he literally wrote the book on it this is the German covered there is an English version and that was Oliver direction and he won the championships a couple of times so yeah he knows what he's talking about and that's the URL where you can order his book he printed it it's a print on the mom thing so I don't think it can be ordered anywhere else then there it has very very explain a very clear pictures of it and if you go through that then you'll you'll know what what actually impression is because initially when I I've seen people do it and I was like I know what they're doing but well in the end they have a working key just after but after I read this book and but mainly looked at the pictures because that's that's where the most info is then then you do know oh that's what I'm looking for and I hope too good to get a tiny bit of this this body of knowledge over to you guys today and the book has even pictures from the I mean i'll technically a poof labora that's German for CSI so that they actually gave pictures up for and you probably now haven't got a clue with what you're looking at but maybe afterwards that that's going to be more explained okay the question is how long can I stand in front of your sword room of or the server room from your company or whatever without being questioned stops or arrested or whatever that probably will not happen within two seconds will that happen within one minute it depends where you work about ten minutes I think if I can spend ten minutes at your server room door then you have other problems but the neat thing about body pressuring is that if the answer to this question is either A or B you're because I get well I'm not saying that I can press in any key in a minute I mean I've done it before but that does not mean I can do it on a on a on a drop of the head but if I but two seconds is enough for one little step in impression and in contrary to lock-picking where you can open your lock and be done with it if you you can't have open a lock but you can half impression a lock you can stop and return later I'm sorry and a friend of mine is a pen tester and he works at a at the building with several levels and he worked at five so he was allowed in five it was not allowed in six and if you wanted to go to six you needed a key to override the elevator so he took a blankie into his office and every time he wrote he happened to be alone in the elevator so that's in the morning or not he he did his tiny little impression thing and worked on that key and in less than two weeks time he had a working key you could go to six level that's kind of neat so how does that actually happen well first if you want to know how to oppression you have to know how a lock works well there have been a number of security conferences and hacker conference where lock-picking is explained and probably a lot of you even tried it so I'm going to go over it very quick because we need that basic info in order to understand depression well this is a euro cylinder luck and me being from Europe and this being a European luck it's configured the European Way for bulk of this graph that would be upside down well that's correct we're all the way of that fact thanks right you're late he's actually the first guy the first non-german who actually well he's the first non German whoever won that the German master chef so he still he's the first one everyone and the lights go out so back again euro codfish euro profile so all these initial pictures are for the most of the of this graph upside down but same book it's the same lost for words here sorry and if we take come on if we look at a schematic view of a lock you see a big round yellow thing that actually needs to turn and if it turns we call it open but for some reason it doesn't and you see a other metal bit which is called red in this picture that's probably has something to do with it but we can't really tell that much now so we go one layer deeper these schematics are actually done by deviant and well hi with permission dictum and I like to use them cuz they're they're very clear they're very informative and I can't draw for so this picture you see a bit more material in the red and there is a blue piece of metal in play all of sudden and there's a spring underneath it and we can now see why the yellow bit can't turn because there's blue stuff in the way if you have wrong way they look so it's in the way so if we have a means of getting that out of the way and I wouldn't mind that habit now then you can actually open the lock no rocket science at this point but normally a lock is has more than one pin stack 5 is a very used number 6 7 15 everything is possible depends what you willing to pay in well basically that and to open this in a way that all 5 a pin stacks are at the correct height you need a special customized tool that we call a key and then we could third cost all the blue where the blue stops at the red begins that's exactly on the share line so the big yellow thing in turn if you put the wrong key in there wrong you see that v is now too deep and now it's too high and it won't turn in the perfect world if you put nothing in there and try to turn your cylinder then it won't open like we all know and that won't open because there's several black blue bits of pieces preventing it um but we're not in the perfect world we use stuff like this I mean senator gets drilled in a machine that's mass-produced drills they have wear and tear they're not aligned correctly pins the ball these are actually from Korea and they're really crap but I mean just just to get the idea I mean is there's there's tolerances and they're there they're never the same so why is that useful because you can't really make a perfect Locker and even if you could it would be way too expensive and not that useful I mean for a normal lock to operate that's that's enough for a program of for most people so what we try to envision is you see that the five dots on the left side that's actually up view so that that that if you turn it that actually not five of these blue bits are preventing it from turning but one of the blue bits is the first to prevent it from turning so if I would be able to to take the second pin stack and put it down to the correct level then another blue bit would be preventing it so basically we try to look at a five pin lock at as five locks concerning just containing one pin stack that's basically because if constants not turn it because the blue bits is no way and if we do yes sorry yeah if we do put that pin stack down then the cylinder will turn just a very slight angle and until the next blue bit starts preventing it from turning but the neat part is that now this blue bit won't be when we push back by the spring because there's bits of yellow in the way so that's cool so what we can do with that is picking a lock after this is done with a lock pick an emigrant impression so you going to feel a wiggle and to see which bits are half more later give less of a sorry-sorry have a different gift than the other ones so you can feel which is stuck on which it isn't and that's lock picking you can use basic tools for that you can get a bit of a quick village and oh cool stuff so this is lock picking and it also works on different keys because this is still pin stacks it's the same just just they're arranged in a different way now yeah let's skip that doesn't want to skip that That's not me yeah impression Inge come on there you go impression well now you see that's in non-european config all of a sudden because that's the way I'd like to impression it's not that I was too lazy to flip the picture no I'm not well I am that lazy but in this case this is the way I'd like to impression and because this if I mounted the the Eli the lock like that that takes about four seconds off of my opening time and during some competitions four seconds is a lot and yes because what you do with impression is you start off with a non cut blank so the same blank that would be hey that would hang at a locksmith that you need several of but one thing is the key has to fit into the lock not turn it because that would be a key but you yeah then you're done not used to yelling so what you do now is if you apply the same that we learned during the lock picking bit if you turn this lock it won't open because there's a different way because we now have filled up the whole space where the key belongs it's no longer the blue parts but the red parts but the idea is the same but now because there's a big chunk of metal where your key is supposed to be you can turn it left and right so now it's one bit in a way but if you turn the other way hopefully it's another so we have two places where a pins are preventing the lock from turning and that's good yep because if we turn it ever so slightly and try to wiggle the key up or down and you don't have that much give but I mean you can move it a bit because if it would fit perfectly there's no way you can get your key in I mean especially not after few drinks so there is there is a give and so if you look at this picture and once in a while it moves then you see that the pins are not stuck they just get moved up and down because the only thing that's holding them down is the springs and gravity and the other two so now it's the pin - and now it's a pin for they get stuck so if you put a key under it and apply some force you're pushing at a point now if you afterwards if you take it out and examine it very closely I mean with microscope or magnifier special lights or normal light then you might if you're lucky see little scratches dents impressionnant marks on that black I don't know if not sure if you can all see it but you see there that they it's two bits have been drawn at and is this any is this viewable for anyone okay cool so you're looking for very tiny marks and the first time you see them doesn't make sense but you eventually to get used to well to recognize them so what we do then at that spot where we see marks we take away a bit of material the key is a bit and key was not pun intended it wasn't and because if you know your brand of luck then you know what the the nobel key depths what the possible key depths are and you can start off with the the highest in this coefficient the highest the highest possible biting if you file your key off to that biting then you know you have to go one step down and that speeds up the process considerably in Europe all the impression in games currently done on a particular abbess cylinder so we know that lock we know what steps are and we develop muscle memory for just that luck so if I have to impression an American lock that I haven't tried yet and I probably won't be that fast but well I know the technique so we'll see what happens so that's not a working key at all so it's rinse and repeat so we do that again so go left go right and there's a mark after the valleys we just created so we're going to take even more off yes it's probably something in the way because it's silly yes so we make it even deeper well you guess what's what's what's going to happen now we're going to do it again but if you look at the fourth pin and we start normally counting from the shoulder to to the nose that pin is on the correct height which means that if we turn this lock and consider the lock as not one lock with five pins but five locks with one pin then lock number four is open already that would turn so you probably can't feel it when you turn it but it does turn a bit further because that one was preventing it for locking and now it's another one that'll stay in place so if you start wiggling now well up in number two there's still be a mark because that was the first one preventing it from turning but at number four is now out of play so another position will start giving dents that's the one that's correct yep so other places there we dance and in the end you will come up with a awful-looking thing like this but that's working here if you look at this one the the lower one is impressioned well don't it looks like a shark bite but if you look at the actual heights between the top key and the bottom one that one works it might feel a bit funny but it turns so that's it and if you're if you're good at it you win prices and now it's time to go demo so I can shut up hey throat is killing me okay I actually want to do two demos I hope well you guys going to see my back - most of the time there sorry about that because I'm going to sit down for this and that I'm going to do this same demo again but step by step and explain what I'm doing so this one is just both on speed oh it's good to not talk for a second Oh different voice what that's correct it's me demoing here so that's why I'm going to do it again well whoa steady that you care open work again okay so now I'm going to do the same lock again and at every step I'm going to tell what I'm doing I'm going to try to show what I'm looking at and well if I hope that's sleeve then so first I need to put in a new blank I'm going to switch this that looks wait now but that'll be better once I put a key on it that's an abuse normally if you see me impression a head centavos okay I put a cheapo cheapo handle on your or your key so I can turn it a bit then I'm going to use this special tool that that will be later in the slides also that just makes tiny scratches on it so I know where I start file where I need to start filing um well a blank key looks like this so it's not completely is that anything yep okay so that's without the tool and after I yank the tool over it you look look like this you see a dot as one over there and if you go a bit further there's one this next allows you can work even better see so at that point I haven't touched luck yet at that point I know where to start filing because I know this brand of lock so I know what the highest possible cut is well if I'm done with it yes if they're out of the box they're not they're bit higher okay so now it looks like this you see that we're a filed it's less rough it's way finer which is actually good because it's easier to see marks on that smooth area let's see let's try to make a good one I'm a bit off but that's okay I see on whoops where are we there is a spot there I'll try to get the focus but it's where my cursor is now now you see it you see okay so at that point I take off one death and I know how to take up what that normally you can use calipers to actually check how deep you are so now with the repeat do it again again on number two okay okay will do you see there's a spot there there now you see it yep it's leo so within turn it left up down up down up down turn the right I've done a blob that I've done that's it I mean it's it's training no rocket sighs that's your position on the one that's position number two where again we see a dot there is and I saw on the last position I still saw one that's not that clear well actually more clear here than there so I'm going to take off one step at number five and one step at number two and we have an overlock well you this doesn't get amplified but it doesn't want to and if you look at it closely you'll see that the pins are actually jammed so that one that's a we call that the cradle mark for obvious reasons so if I clean it up to take your chest TMG bids off company well better were kinky so now if this would have been a black op I just give a blowhard okay and when I submitted this slide deck to DEFCON 4 well to put on the CD I didn't have the I can sorry yeah fairly and lost that that leg you go I didn't have this slide egg ready but there is a slight egg on there that's that's quite it looks like this but it's not complete because last night in motel room I added quite a lot of slides I yeah you get stupid sometimes and what I did is to do the depression and to get some footage that you just saw but took stills of it and there at the back of my presentation so if you download it afterwards then that should be viewable okay over the years because there has been well that there has been competitions longer than well there have been a couple of years competitions in Germany and in the disability that's the reason that there have a competition in Germany and in Holland and if you look at the opening times the best opening times during those competitions you see a drop so how is that possible and that's not just because I started competing we have better gear and we learned and train more and what's the gear that you need actually it's it's not that fancy what you need is as a training edit caliper but for that to be useful you need to know your possible levels can be found online all this book has a hole chart of it and well mostly club they should be like XO it can be found online I like the copeland on the right because you can do it quite fast and you can put marks on it that are not as useful on a normal caliper but you can go with a normal one I mean to to keep the budget low because that coupling is quite expensive oops they need file and we used several files for this and it's a it I'm going to I think this is less feedback less comes even we use both the guys that I know that that normally use it is a Kirkland cut number for Swiss file and you can have several sizes of it because size does matter yes it does it also is useful I mean two trainings training is key but such sides also so what would we use this but I use this I use a red tail which means that it's shaped like that you have also peppered files and if they they are more drop shape I personally don't like them but I know a lot of locksmith who swear by them I mean that they they really want that one it's it's perfect personal preferences I mean I go with mine and a good file is not cheap but if you treat it well that'll get you well the years and years of fun yeah I had once that a a key broke off during a game and that's weird you don't want to have that that booth nope still are like you need a vise to hold your luck probably a door will do also but it's what it's there for it didn't do nothing oh my god ah you can use any other vice that you like as long as it doesn't delay and well any fights will do but I use my photo super clamps that that's the one on the right and well they work for me perfect they can swivel the way I want it and well basically they look the part so that's why I have LED lights so if you want to take the left one to a conference you can't have any other luggage but yeah you need a shitload of blanks because the first time you're going to try this you will break blanks if you're not you're not doing it correctly aggressive training will cost you blanks a ton of them so get them somewhere cheap I mean your local locksmith will have this with your local locksmith will have will have blanks but they're probably going to sell into you for the normal rate that he sells cut blanks so if you need 200 of them it's going to be expensive so make sure to get from somewhere else or at least in bulk brass keys are seem to be the best because they make nice markings on the steel key so some some are made of steel and you don't get markings and if you switch to aluminum or any other lighter materials they tend to break so the the middle of the road type being brass seems to work out the best you need some form of magnification the one I had here is a cheapo cheapo nothing fancy normal life you can have the one on the left is quite fun for field work and it's a add-on to a mag light that's normally initially that was used for geologists and look at tiny rocks but it works with impression in also and there is a light box available on the bottom right that one is actually crap but I like the idea it has a magnifier on top of it and you can there are several switches where you can alter the light so it has UV normal light LEDs whatever and so it's neat but but this one isn't and there's well just yesterday I got pictures of the tool kit the kit from - and that has even another light that I never seen before and this morning I had the first opportunity play for it I like it I'm probably not going to use it in competitions because this is fast but for field work yeah I think it's it's maybe even better than the one with the mech light attached to it you need some form of gripping device because the forces you gotta put on your key you don't want to do that by hand you can't and there are several commercial products to actually do that the one on the left is quite popular I know a couple of guys who also use that I like it also it's lights and I like light you can use a normal grip and I had just had a hunk of metal with a couple of holes drilled in it there was a lot of snaggle sailed for impression handles because once I got a handle that was I don't know 80 quid something like that it failed the first time I used it I mean there is some stuff if it's over engineered at this point you don't need it I have a other tool that I did use now because it's it's a visual aid that I especially when I start a training I use a lot I used a internal core a silicon and I fouled it off the fun part is if you stick a key in there you can see where your where the marks should appear because that day would be in the middle of my phonics so because normally if you foul and you see a mark it is that a real mark did I do that is that such is that a filing mistake but if it's dead smack in the middle of where it's supposed to be and this visual aid helps you bite it to determine if that's the right spot then it's probably your mark you can file so that's also cheaper cheaper solution a this is a tool that was custom made by your club that's the tool i i additionally use to get the d markings on the key so i know where it can start filing okay now if you try this when you look at at the file key that looked like if a if a shark took a bite of it those edges are actually quite sharp you will cut yourself I mean that's got to happen especially if you're in a competition and it has to open that all that stuff goes wrong I mean one of the first competitions I entered in Germany the first lock that I had to give back to the judges that was read and it was not read when I when I got it it wasn't and the files are also quite pointy so sometimes the stuff will go wrong and on the longer term because you are making quite a weird movements so carpal tunnel is definitely on the horizon that that's that's going to happen and you guys all be in RT and me also and you know we want that doing it up doing this after a game of golf is also not funny because you need to turn wiggle and and grip that gives a lot of stress in your muscles so I spoke with an occupational therapist who happens to be my girlfriend and speak to her quite often actually and we figured out that if I take longer screws in my grip because these were initially when I got this it was nice and smooth because yes it had made another me I took the original screws out and put these long ones in so now I can use them as a lever so I take one hand for the turning action and the other hand for the up-and-down motion and that's way easier and you don't and in that way you don't grip it also which releases a lot of stress that so I think that's the best way well like I told you there is a tool set on the market it's available at the vendor area and in the lockpick village this consists 70 of the this primarily focused on the American public because this was consists of 70 blanks that are the most common and the funny part is that in America we you don't guys have that many key ways in Europe there's a bigger diversity when keep ways goes like that and in America it tends to be straight down so these property will not fit will not only fit the seven most popular brands that are used but it probably will fit way more there's a little light in there the top one it's a very tiny little light source with the magnifier in it and well I lost but I never used it in the competitions of it and it has a go bad fall which is the brand I prefer so I'm stoked about that one that's basically it for more info there's a well you can read that online also the other guy said that really helped me and well any questions

Channel: Christiaan008

Views: 186,822

Rating: 4.5373292 out of 5

Keywords: DEF, CON, 19, Hacking, Conference, Presentation, By, Jos, Weyers, Key, Impressioning, Slides

Id: e8QnG5RHyq8

Length: 39min 10sec (2350 seconds)

Published: Fri Oct 28 2011

Reddit Comments

[u/GM7RQK]

Nice practical video on how to do it yourself from Bosnian Bill https://www.youtube.com/watch?v=jciQpGdAVtc

[u/prajnadhyana]

Nice, thanks for the link.

[u/farmerjimm]

I'm loving these DEFCON videos. Quality stuff!