Howard Payne & Deviant Ollam - This Key is Your Key, This Key is My Key

Video Statistics and Information

Video

Captions Word Cloud

Captions

you have sound for your la we do a sound did every is everybody get it do we have enough lock content at this conference it's been a lot nearly ever yeah alright then we have more Hey look at that alright let's give it up for deviant powered so right on we don't have a lot of time we have already go we got two hundred slides virtually none of which have words cuz that's our Jam so we're gonna bang right into it who's this cat right here so this is Howard this is Howard on the street where you spotted you know some elevator van right Howard is the elevator guy he's not just the elevator guy he's also a gambling badass and a terrific phone freak and you know listen to some of his prank call stuff later you'll dig it Who am I I'm deviant I'm the lock-picker and pen test guy if you don't ask me about physical penetration you're probably asking me about either cooking meat or travel because I fly all the time yeah or guns is people in the front point out yes I fly with guns that was the whole thing I talked about for many years but when I'm flying like I notice a lot of goofy things and I'll tweet funny things from planes like the internet switch or you know like people are tweeting funny stuff on planes right like the plane running Windows 98 but there's a lot of shenanigans at airports that aren't just on planes so there was a time when people said hey you know in airports there's also like these big jet ways and oh my god some walls look like so there's these Twitter photos and when these were kicking around you know like oh my god jet way has a password of one that is written down when you look at these images people would say you know occasionally it's most of the chatter is like oh that's so bad but occasionally people are like well yeah at least there's a mechanical key switch with it so there's like sits two-factor not so much that doctor it's a factor but as this is our talk our talk is about how a lot of things that have keys in this world are really not differentiated keys way more than we even got to touch on in the elevator stuff last time so simple disclaimer right we're not encouraging you to do this rule number one for lock-picking still applies don't do this to locks you don't own if you own the lock do whatever you want with it we happen to own several that you'll probably want to play with downstairs so it's me a consequence free environment come play with it there yeah so be smart about this we're going to try to drop a lot of crazy on you right now so who remembers the electronic voting Fiasco when Diebold got in a lot of hot water four years after year yes Matt who just introduced us and mouse we haven't seen mouse all con are you into your mouse god damn it we love Mouse so much yes so Mouse is a she but all right so yes when when now all that went out do you guys remember it wasn't just that oh my god there's so much bad code in these machines there was like and they published photos online on their website look at that ha ha ha Diebold catalog so yeah like you could look at these photos like oh my god you might be able to make the key but you don't really have to make the key like you could just buy the key you'll notice it doesn't say Diebold anywhere in this eBay auction right what does it say hey my jukebox cabinet key jukebox cabinet key well that's weird and a guy on reddit a locksmith said the following right any experienced locksmith like me will tell you that if they showed that key it's C 4 1 5 a this is literally the most common cabinet like bullshit key in America it's not the Diebold just like published pictures of a terrible key they used the most typical key that as the guy is like this is probably in everyone's freakin junk drawer right now in fact yeah in fact as we're doing this talk how it's like wait a minute and he goes to his bin of like spare parts totally it's there it's there like it's in his drawer so this whole like the idea of yes publishing Keys online is bad but it's really shocking that these were super reused keys to begin with and this happens all the time not just with c4 and 5a which again is a stupid common key for a lot of purposes but a lot of systems have the same key over and over and over across different platforms not not elevators oh yeah never elevators all girders are always different always secure that was our point last time so like Denis Maldonado on the left up there good friend of ours Denis does a lot of work with hacking access control systems if you saw him at Def Con or anything and the linear cabinet that he's next to right there he does a lot of linear gear and he's like oh yeah I noticed in my he mostly did code review and checked out the electronics but he's like I also noticed they all had the same key like the same cabinet key for every enclosure I've ever found and he showed me this photo and I sent it like I tweeted anything right you sent this to me and I said you got to be with Dennis yeah that was just their answer not like oh that's a yeah what key it was which I was like are you a Dennis it was just a combination of things on that keyring and I'll just leave that to you to decipher so I was like how did you know he's like well among other things you've got that a 126 key and I was like what what does that he's like oh yeah totally industry standard key like and that you notice this is not like the linear website or something this is just an industry supply site these are common keys that get reused over and over and over and over just because one vendor is using a key for a purpose it doesn't mean they came up with that bidding it doesn't mean that they own that bidding they're these keys show up everywhere case in point as was touched who saw the talk it like almost midnight last night with Johnny Christmas and dark Sam and I out right on so the TSA Keys talked they talked about key reuse they talked about quote unquote the gas pump key and they even showed you know great example of news media like printing a key and oh my god people could maybe file the key down and what if someone was really diligent as an attacker they could get this key oh they can get it yeah you could totally get it it's it's the most popular key on Amazon yeah it's not just it's not a gas pump it's the super-universe ed if you search for key it's your go top results tools and home improvement search for key yeah the CH 751 this is your big money key right this is one of like of the keys that are everywhere including like right in the front row like there's just a bunch of them right here yeah the CH 751 that's simple like up-down up-down you'll see it on a lot of systems search for CH 751 and you will it's gas pump keys everywhere I'll tell you now of course in quotes right because you don't see a lot of results mentioning gas pumps you see them there there is a theme who sees a certain theme in these results what what do you see what kind of devices or systems are mentioned in here mostly RVs tell her about our V's in the CH 7 v 1k so look you're not going to drive off with the RV when you have a CH 7 v 1 key but the accessory locks the things that don't let you into the vehicle or start the vehicle all those little cabinets every stupid panel everywhere that locks up the luggage bays the pop outs the doors and windows if the you know kitchen cabinets lock up I'm sure there's CH seven five one two yeah everything on most RVs is a CH 7 v 1k everywhere it's so much so fat that there's a website CH 75 1.com which is just alerting like it's a guy trying to sell you tubular locks but he's like your RV is keyed like everyone else's while they are unpickable to be fair that's true tubular locks very secure of course did anybody like we people were tweeting us they'd found the in-room safe hidden key which is a tubular key which is key to like to all the ones but anyway digression see it seven five one again is just this is the super it's the super bullshit key like if you find any little prefab enclosure that has a tiny cam lock on it super huge likelihood at CH 751 we carry them on jobs when we're on a job and we just see locked stuff before we try to pick it we're going to throw our CH 7 v 1 in everything and hopefully it works and of course like what do PS wafer to protect some of the most important things right like like a building key box but this is the best part if it's huge seventy-five one locking it up you're locking up at multiple other copies of it there are other Cee 7/5 ones in this key box just from around this building that has like Chet check that way that you can check our slides later that with coward-like Howard's the kind of guy he's like wait wait let me look into that totally is on the list a few times and if you even notice that Amazon auction customers also bought like time clocks door controller door covers like what do those have in common they're all the same all the same they're all CH seven five one and we may have we may have come to hope with a few of these keys oh you're dragging yeah there we go yeah we may have been giving some of these out during the during the con if you didn't get one you probably can give us a good enough drink or something like that so Cheers so those of you who got one but let's get into even some more technical stuff this is just funny starter material right so key switches how many people as you saw some hands who sauce last time with the elevator talk cool how many of you own an elevator that gentleman does very good so you saw us talking about key switches you saw us talking about oh we lost our slides oh well you saw us talking about for example like the CH the 501 CH right yeah so we were a little bit reserved when we did our talk we were not trying to just drop a whole table of keys and what they do so this time let's use one specific example and just focus on it this is an elevator key not that you know that looking at this picture not that you know that looking at any elevator that happens to use it this just siemens keys right so what's awesome is this website has not only published a photo of the lock that it goes with what they've published a dimensional drawing of the key beautiful drawing of the kids this isn't like a photo this is like somebody illustrated it properly yeah it's like vector art right but you notice it says now this is usually in what installations it's common on Shindler's yeah yeah definitely not the escalator out there you shouldn't try to restart this fails right but it doesn't say Schindler it says Siemens but if you look further along you'd say well maybe this only works in Siemens equipment right no this mechanical key machine key switch will open like husky toolboxes it'll open job boxes on the back of trucks that have tons of you know equipment in them why because this is not a Husky key it's not a Siemens case not a Chinook it's actually a Hudson key design being sold here by ESP right well I know that one was actually Illinois but I think the reason we use this because this is another major yeah another vendor so it's vendors upon vendors and as Howard likes to say you go far enough up the food chain just like Husky isn't making the lock they put in their box like the lock factory right right the ESP is not making the zinc they dye cast them out of either right everybody gets something from somewhere and this is how this happens so these companies that are sourcing these materials all turn to the same vendors when they I need a lock that's a proud you know this much back spacing and offset and this is the hole it fits in oh yeah we got those everyone wants one of those we can sell you 10,000 right now and they're all the same effing key and nobody knows this nobody talks about this so what about other things what about we talked about machine switches what about larger machines what about like cabinets that have machines in them what about maybe you went to the retro gaming downstairs arcade cabinets do you know that arcade cabinets were most instances they were key to like if you go on retro forums enthusiast forums where people are restoring old hardware you'll see the occasional post where people like oh yeah Midway USA every miss pac-man yeah that was the standard key this was the standard key for those game series this is not an uncommon thing and these are machines that handle money right yeah this is the thing though right like games are for kids can you think of any other machines that handle money that aren't for kids I can yeah so yeah so yeah so slot machines have this kind of interesting feature there was obviously separation of the cash management you're not going to jackpot a machine just by having what we're about to show you so I need to preface it by saying nothing about what about to show you enables you to take money from the machine but not physically but it takes you can take it edge on the machine maybe possibly because new story happened when you win a jackpot and you win more than say 600 or 1200 dollars depending on the game that you're playing you get what's called a 1099 G you've won money and the IRS wants their cut so the attendant has to come over get your social security number on the floor which of course you say out loud and then give you the tax paperwork while they give you the cash once they're done they insert a key oh it's that one right there right there the two three four one and then it resets the jackpot it's it allows the machine to start playing again but here's what's fascinating so when that happens the attendant is also presented with information about how the game has been played and about how the games been paying out because of course they want to make sure that it's not paying out above the expect value or at least not outside of the statistical expectation so in addition to being a reset key it's a diagnostic key right it shows you very specific parameters about the machines operation what happened was actually there was a casino in Reno the pepper mill and a zealous employee decided to walk to the casino across the street insert his attendant key turn it record all the holder works return to his employer and show them all the information he'd gathered this became a thing yeah is industrial espionage due to key to like freaking casino machines what's fascinating was the response from the regulator as he was caught right by see where he was filing the regulator's response was that it doesn't actually affect the integrity of the game it's just an internal security issue and so the Nevada Gaming Commission is actually on the record saying it's okay to have this walk into a casino with it and turn it and it's up to the casino to stop you yeah the Gaming Commission's position was lulz ketta like that's problem dumbasses like so when we talk about you can get things kita like you can the whole thing our jokey name of this talk was like can you get your neighbors key well there's a lot of ways to do that you can become aware of the problem in instances like this let's talk about actually getting someone else's key or some other systems key right well just buying whatever they have is usually a super low entry like barrier so if you know this little fire alarm pull station if I want this key I don't have to sit there like impression it I can look in the simplex catalog find this part and just order one and it's probably going to be way less time and money and effort and resources for me because it'll just get delivered with a key probably 2 and 90% of the time they're just going to freaking match now how much shenanigans I could do with like a fire pull station not not not much you're just going to set off the alarm or reset it yeah but simplex another you know industrial hardware control systems they make a lot of gear they make like exit alarms right so this is kind of neat right there's a rim cylinder right there or excuse me a mortise cylinder I suppose and above that though there's a wafer lock these are those push to exit alarm will sound systems unlike the back doors of establishments right the big red pushed alarm will sound so that the main key the the on-site key unique to them this is what will reset or disable the alarm right this key however which again comes with the unit do you know what it does sort of ah here it battery door yeah is the battery door because it has to sound that piezo alarm right so yeah you can just buy any of these detects or simplex products get the battery door cover key and then this alarm thing is doing nothing there's about 20 or 30 I think in that series but even still yeah there's there's 20 or 30 that's your key space so the idea in the idea of like oh I wonder if we could you know break into this unit here oh I'm gonna measure them sometimes like in movies they'll say like we bought the exact same one that the target facility has so you can practice on it no you probably like to just buy the one and get like the key like the drug storage containers like this company making drug storage containers for medical use like I'm sure they're not keying these differently MMF yes also cash boxes and other like cash register II kind of thing yeah so many of pieces of these hardware like equipments oh my god just I'm sure they ship with the same keys be aware that someone could just buy the same one you've got not to practice on it quote/unquote unless they're practicing like so the key goes clockwise all right I got I remember clockwise commit that I'm good for the job man let's go but you also get the blank potentially right yeah it's gonna be the same lock even if it's not the same code you're gonna get the blank and that's a big step so what about what about funnier stuff what about like vehicles vehicles could never be key to like right well maybe like rinky-dink vehicles maybe like golf carts and electric carts maybe you have a really long connection at the airport you want to get there faster right well it will maybe not shock you that most little electric carts are all keyed alike like again the CC 1 Gulf car key the club car key which is a clearly which you definitely couldn't pick bay bay that so yeah also 275 free shipping damn yeah how do you even make money right so like this again if you're the kind of Jackass who can just find a golf cart be aware that somebody like me or someone else could just maybe turn it on now you always want to be careful when you turn on a golf cart make sure that somebody hasn't left like a pile of equipment on the pedals because that could be bad and it might run away from you and some almost controls it he's like I got it I got it I don't got it yeah so like don't f around with things you don't know what you're doing you certainly shouldn't screw around with bigger equipment right so yeah um we don't actually have a photo of the book I'm gonna reference but it's online and I'm sure it won't be for very long but the Elco equipment key reference book is this PDF file that actually tells you the direct bidding for all kinds of equipment based on who made it and what the equipment is so it's like oh I have a John Deere tractor you look up John Deere tractor in the Elco equipment reference book and it'll be like D 1098 JD whatever yeah like that's just what you do just look it up in the book yeah there's your key and you look up some of the most popular like first versions that like here's the entering the code series they're the ones that get used the most so like caterpillar equipment right this is the most common caterpillar key and again like damn on that price 395 for this key which allowed now we're not saying that people are going to run out and just steal a bunch of bulldozers as hilarious as that could be depending on the context but think about simpler simpler bits of like security risk so what do a lot of equipment sites do at night with their expensive stuff their compressors their generators been elevated they elevate them they just hoist them up on the crane leave them in the air imagine just being able somebody walks up to that crane go yeah it's the key I bought for four dollars lower that alright guess we eating tonight family driving off with a soul air compressor yeah just walk away with that thousand dollar compressor machine so when we set vehicles though we didn't mean small or large we kind of met regular vehicles but that's it that's another topic right yeah I mean automotive doesn't really get a whole lot of love from a lot like the lock-picking community in general yes but there's still a little bit of applicability to what we're talking about here so yeah we were joking on Twitter and you saw maybe some of us some of you follow us they saw this conversation we're like ah walls no fleet keys well what pictures were we laughing at we were laughing it you know this kind of these officers are stuck out of their car not as elite as their plate would lead you to believe and not chopped yeah photoshopped and they're they're doing what they're trying to slim jim they're trying to get into the car they obviously have locked their keys in the car well when we're laughing about all know fleet keys do you know that a lot and I mean a lot of city's municipal fleets including the police and other you know official vehicles are key to like we'll give the feds in the audience a moment to check that this is their key yeah 1284 ex everyone go ahead and put 1284 x into google for the lulz you're going to see like this image search turns up a lot of pictures of what kind of car Crown Victoria yeah these are all Ford crown vics right if a police department or other official agency wants to order a bunch of vehicles and they want them key to like it's almost always going to be a 1280 for X now the real funny thing is what happens to a lot of police cars in big cities when they're out of service like they've had enough duty cycles they get sold to do what yes taxis by the way this is a taxi right that's taxi what's this not a taxi not a taxi don't get in there yeah B can anyone like when Howard showed me this I didn't catch most of it I saw really what there's a cup can anyone shout out anything they'd notice that all right so yeah we got that's one the what oh I didn't notice he I I actually don't know that oh who said trim Oh real um is the panel trim but yeah the panel trim taxis at least in the city are yellow panel trim black big sign and also it's hard to see this angle so it's wrong you couldn't just paint over the trim the wrong wheelbase so that's just your little New York tip when you're walking around the city what is it it's car its police car yeah it's a police interceptor but speaking of police and taxis though you got a pretty good story about this one right yeah so this this has actually been a useful thing in fact this is a bit apocryphal so I apologize because I can't properly articulate it but there was a police department that was arresting a taxi driver in fact he was pulled over he suspended license yeah basically so you you get cuffed you can't drive home you know do not pass go do not collect inner dollars they put him in the back of the car and the officer I was making the arrest drops his keys into a storm drain he doesn't want to get in trouble so he calls one of his buddies on his phone his buddy comes out with a coat hanger and tries to fish it out of the storm drain can I do it and they really work and acceptin beaten yeah and they call their supervisor while this is happening the guy in the back is going just use my key just use my key and they're like come on settle down back there hype down back there just use my key that finally they're like what are you talking about and they use this key yeah totally unlocks the door totally starts the cruiser totally can drive home so like many many cities not New York incidentally many cities have the fleets of police cars ketta like and because of local municipal turnover have taxis in the very same city with the same key to the police cars that are driving around and in fact this specific department did rekey their entire fleet yeah I found out today because it's not weren't even aware that this was a thing yeah this is not just the doors like it's the ignition to the trunk is not there's nothing interesting in like a police cars trunk right nothing she would so be aware of that be aware that this this happens all the time now when you tell people this and you say like oh yeah this is a huge problem well how does this happen we're going to illustrate for you through theater and seeing how this happens I am a police car factory and Howard is my supplier okay shady lot Corp hey yeah man how's it going I got another order of those police cars from any town USA I got this P oh here it says says they need 17 more units but I got this it's weird notice says high security transports special purpose 1280 for X not acceptable key to like I working all the time kita like 1280 for X means kita like though right they don't want that what do you do uh how about 1290 for X does that work for you I didn't know there even was that thing yeah sure 1290 for X does it does it cost different is it take longer yeah it's 200 bucks more and it'll be a four-week delay two hundred bucks the 1280 4x that only costs fifty bucks I know because I'm looking at a sticker from one of those cars that I totally didn't find on the internet with police data on it it says $50 and what how much how much longer - three weeks longer hey man I don't have a bunch of locks sitting on a shelf the way you want him I got to make them just for you oh Jesus I guess they're getting 1284 x and c so that's how this happens the idea of even if there's some application where somebody somewhere in the chain is like trying to do the right thing or trying to say man I really Jesus these are like drug shipments we should really use a different key they're gonna call our supplier who isn't variably going to say oh you don't want the ones you usually get we're going to be super backordered on that then no one ever buys those it's really common for multiple week lead times for these types of products if you actually want to even just have a bidding code that's just not the one they want to give you and that should be a red flag to anybody buying it that the bidding code that you get is probably not specific or unique it's just what's on the shelf yeah so speaking of bidding codes talking about looking up key codes right you can always try to look up the key to a lock you're targeting if there's any information about it let's let's look at this photo right here of a vending machine okay can anybody tell me anything about the lock they see on that vending what kind of lock is it to your lock you might be able to pick it do you see anything else that you might be able to do on that lock though what else do you see Angie drill pin I'll answer you open you say yeah there is somebody said something up front I heard of her was it this yeah but not not physical damage attack though I heard somebody say that somebody said you can see the key code right it is a code it's hard to see on the slide there's numbers stamped on there right for decades and decades locksmiths have turned to their reference books their code books these are publications that have existed they have been in trade you know usage forever if you have a system that you need a new key for you need to look up what is this this system leads this leads to this and you look it up in the table these are all examples of code books that Howard owns that he has reference for and like what's fascinating is in terms of looking backwards you know locksmiths used to have just shelves full of books that would be references like this actually if you could go back to the last one the tubular one yeah this is fascinating so randomness I guess wasn't so random when people didn't have computers so rather than actually jumble the codes there is definitely a discernible pattern my has actually been created it's not necessarily so obvious if you're not going to sit there and study it but you can see a lot of the same numbers if you're just glancing at it even that there's a pattern yeah so imagine you're working on a site with many locks and you say well this is clearly my key you can step through the biddings of the next few in the series and see if those were other locks that were installed in the series but the idea like these are clearly a lot of these are old and you found these on auctions and when locksmiths you knew have closed their doors not a lot of people use code books like this anymore rights are so quaint books are quaint as indeed how many people I still have a huge library in my house but I do a lot of my reading on a Kindle how many people would not be surprised that there are kind of ebook versions of this yeah how many people in this room have heard of insta code there's a couple of hands those of you who haven't boy howdy let me tell you you don't have to troll eBay like Howard we should have probably gotten a referral link or an affiliate link before we did this yeah that all the insta code subscription is going to blow through the roof for $9.99 you too can have every code book in creation basically so insta code is a subscription service yeah the monthly fee really is that low for the basic package and again like you punch in anything and there you go there's like 1280 4x there's the fleet key there's the Ford Crown Vic in most cities the CH 75 one we talked about like the super utility cam lock like there that is that was the quote gas pump key that the guys were talking about last night like oh yeah so we got 1280 for X we got CHF everyone that's weird that J 200 that's that's totally not the elevators at the hotel pan I have no idea why that's in our slides next slide yeah let's just get by that but this is a fun like side note here so we've got a little master lock can we hand it to you guys in the front row here verify that's that's just a master lock right now you could do what you could do what to this master lock you could shimmy yes let's say you don't want to cut your fingers up on some aluminum let's say let's say you have $10 glue ten dollars that'll phone and a phone you can get some insta code right you ever noticed those little codes that are on the back of master locks yeah so you can go ahead and take that look at those numbers put them into the search box in insta code get a bunch of results but you scroll down to master lock combination there you go would anyone care to try 32 14 32 and we'll see if that works yes question so you used to be able to just call a lot of the manufacturers and say hi I'm open there we go woo yeah so calling for the lookup data or using insta cut now that we said the 999 is the basic subscription right you could pay more you can get like the auto instruction package you can get like direct you know diagrams on how to pop doors and you definitely can't just pay for one month and screenshot everything yeah cuz these aren't screenshots these are shit these aren't screenshots oh my god that works and if maybe they don't even you can't even afford a laptop but you have a smartphone yes of course it's a mobile app there's an app for that um but yet before we actually move on the other one snap decoder yes and exactly free so uh that's about to be trending on Google Play or whatever now they do verify right they verify something it's uh what is it oh it's the zip code the billing zip code of your car does you thought I was gonna say your locksmith ID oh my god no they don't find that they apparently do something what fucked if I know what it is because yeah fun to me yeah they take like 24 hours to process your order and we always thought they were verifying things but they they really don't not so much so what about even like higher security keys what about stuff that the government might be using they would never come on the government the government's not going to key everything alike in any installation ever that's not going to happen well if you saw Yosa Vegas last time at previous hope he talked about traffic cameras overseas in Europe those were all key to like and that was this big oh my god moment when the news was reporting on that my personal favorite part of this story actually was not the key to like thing even though I'm a lock guy it's that like biker gangs didn't like traffic cameras so they were apparently throwing a like old tires over the camera with lighting water fire us and that was there like das attack on the cameras that was pretty funny I thought but in the u.s. we have a very popular government key in very very common usage in different cities that's key to like if again if you saw dark Sam and Johnny and night owl who here last night saw the postal key right this is the u.s. post arrow key which the idea is opening up the mailboxes with one kind of master key in each region so you can deliver the mail now that's not the only thing that these keys open however right yeah and by the way that was on Etsy um so outside of buildings very commonly you'll see key keepers it's a way for the postman to access the vestibule of a building for the purpose of leaving packages within the vestibule where you get your mail like in your vestibule this is usually how they're doing that now the idea you might say oh wow that's crazy like a key outside of a building that lets you have the key to the building that's wild there's no such other thing that does this oh there is let's talk to you for a second about Knox boxes how many people have heard of Knox boxes or fire boxes say yeah we've we've hit on this topic in other conversations before and I'm going to preface this by simply saying nothing that we're about to say is to cast any dispersion on the physical security or the rating of the box itself yea Knox makes a robust product it's a heavy a steel box when you have a lot of videos on our website right yeah there's well I don't know how long it'll be there but there's a hammer attack test video on the Knox box website which is fascinating to watch with that being said the idea is the fire company has a high security key they can get your other building key inside of the knock box if they show up or they can do other functions right like opening gates and things like that right it's so the firefighters have one key it does things and it opens it and lets them into the building when it's on fire right now what would happen if someone were to not just compromised a Knox box and get the building key but compromised the box itself like take the box away right here's the thing building owners are so worried about their key let's step back for a second if every box is open by the same key what do you think is going to happen if someone just takes the box and no one would ever do thing right right no one will cuz monkey they're mounted in that what is the actual spec say it has to be mounted in reinforced concrete hammer attack test video is hilarious they very quickly mentioned this is mounted on a reinforced concrete wall with gradient fasteners and it's 6-inch fasteners oh I mean yeah okay because that's what everyone's doing everyone's no one would just oh shoot that doesn't look like it's got a back plate no that's the thing they actually say oh if you're gonna mount it on a pole you know here's how to do it but it's not like that yeah and it's definitely definitely not like that on vinyl siding yeah vinyl siding is going to hold up just fine against a graha hammer attack and like he's really how it took these photos he's really close to this Knox box on a very interesting building we won't say where so this is the thing though right stealing a Knox box obviously it would be something that would be treated as compromising the whole system but I don't know that people process that that way right now because it's not uncommon in fact I'm on Twitter maybe some of you folks are too I saw this photo on Twitter yeah sob put this on Twitter he was like yeah there's two things to say here the first is the door is missing so some way that's that door the lock is missing which means it's probably in somebody's custody it shouldn't be and it can be reverse engineered with that being said also the tamper switch isn't wired so it was installed wrong and these these are totally grade eight fasteners right oh wait those are blue yeah sorry so the idea I loved when you said you were taking the Knox box photos on the pole and the siding right oh yeah so I came to you to scroll back so yeah so I of course and you know doing my thing taking photos of Knox boxes out in public and somebody goes can I help you I go no it's cool man I call it the Pikachu yeah yep I'm done now now as far as government keys go some keys are actually protected by code so even though like oh this is bad stuff look at the you know for example the arrow key oh my god postal keys well like it says specifically in code like no one's allowed to have this this was I found this one on Etsy I have no it must be deprecated or somebody's got balls of brass on Etsy they sell those next to the little other trinkets there's like these are my beautiful polished artisanal brass hash tag key yeah but you know keys being restricted by code is you'd think a good thing it's it's never going to be a problem except oh and it is last you remember the FE okay one last time around right the protection of law is only as strong as the punishment that is like course corresponding with it so I mean people will possess it illegally regardless it's just sort of something that's going to happen yeah and that's why the law is there to establish what happens when you possess it so we showed last time we showed in the elevator talk like Fe okay one the most universal fire key for elevators in the code it says only elevator personnel shalt possess is key also they put the direct fucking bidding code in the you know in the code document which which and to be fair since after our talk they updated the doctor coat has been updated now when that when you say up did they take the bidding code out of the document not exactly no that's still there but they they Ana doubled down and published a dimensional drawing yeah so if you have any Fe okay one keys that don't work right like double check your notes hope you work if you were cutting it to the Chicago key style yeah that explains why asked me was got cheek I was working so yeah you'd think like that's a one-off joke like keys being published by the very entities that should be protecting them but it's not so how it is is the amazing like Google dork in the ways that I wish I could be and starts showing me things he searched for he's like we'll check it out Dave you searched 1280 for X file type PDF pretty much spits out a list of municipalities all over that are using this for their police car Keithley I guess thanks for Meno yeah you can just like you were searching just file types on gov sites kita you like site gov file type PDF yeah you get a lot of interesting PDF so you got this PDF from the Department of Housing and Urban Development right this one is actually so ridiculous that we took steps to take some information out which we put some little redactions in here because it contains what it contains the HUD office keys right the full bidding code there saying we want our office keep this way with this bidding code what could possibly go wrong in like every city ever right it just goes it keeps going on yeah yeah there's this state that state data place so the idea of just publishing these are the district contractor specs these are specifications to be followed but the fact that it's online and it's all key to like for every office in the state of Maryland every office in the state of wherever that's in freaking saying does an official from Maryland need to like go to every office of the hood in Maryland before 9:00 a.m. and they just need the one key I don't know this is a great who follows there's a couple of YouTube channels I'm a big YouTube dork like I don't have TV but I enjoy my youtube I live in this little town in Montana where like scishow was produced and a bunch of other channels that I love but veritasium this guy Derek from from New Zealand he did a visit to a nuclear silo and like I love the history of America's nuclear arms and I love the whole like the control systems that were down there so it was a thrill getting to see like he does a little dry it's a museum one that's been turned into a museum so he got to do a dry run he's with the Proctor and he's like they're turning the keys man and I paused it and I was like how would I check this link out man I was thinking is key like so this is kinda interesting alright I know what kind of key it is yes Chicago see that wasn't limited down to exactly 405 different possibilities that you can buy on the guide key set is what it's called by the way now there's literally a set of every key in the series that you can buy now it's not as if an attacker was going to get into the facility and turn this key what Howard found funny is how it actually knows the code about DoD keys right well not exactly I'm not going to pretend I'm a lawyer but what happened was of course with the Google through we started searching US code for the word key yeah and this popped up which is fascinating that is any locker key adopted by the DoD is covered in the scope of this and they actually go so far as to say that key means any key key blank or key way so protects lis important things apparently during the time when that at least the Titan two systems were online the CG one key way was just verboten the CG one key way should have been illegal exactly but it really wasn't I guess because reasons but yeah like government key systems being keyed alike of course why not this is the government but to bring it back I mean I know we've been a lot of these are just funny stories we're not just going to make you all laugh up here the whole time we do want to kind of drop something that is meaningful especially to the city of New York let's come back to the 26:42 key and this boy if this topic if you saw us in the elevator talk you saw us talking about this is the New York City Fire key every elevator in New York uses this key sure does yeah and a friend of ours who is here today that's well the 16:20 is the fire door key the 26:42 is the quick just the fire service key on the key switch okay so - rabbit - rabbit sent us this photo and we're not gonna lie dude like get yourself a drink because the first thing that I said when I saw this was bullshit yeah and I was deeper DMing we're like that's a really good Photoshop with the mirror image of the key like he's really trying hard to pull our freakin leg eager with this stupid-ass key so we all like Howard and I were like it's a fucking quick set key no no that real so then brother sends us this video in a fire panel and we're like alright he's got the key and he's trying to just pretend why so now we got into so we're like so then we'll start turning alright and we buy of course similar lock let's talk about some of the some of the very popular lock installations for fire service keys in New York this is a cam lock that would now there's different ways of doing fire service this is an access panel to the fire controls but it's one of it's a very popular vendor it is a wafer lock it is yeah you take it apart you'll see it looks like a lot of wafers in there right look like ount them all up like wow two four six eight Wow all those so many wafers and biddings well not right what's going on doesn't go not all of them are the same so some of them are what you would call operating wafers key bidding wafers others are just known as guide wafers they don't move up and down they don't block the cylinder from they just guide the key they see if the right key is because you notice the key way on this lock is not a Yale a key way like you'd expect like that's just a giant rectangle it's literally a lane on the New Jersey Turnpike yeah apparently so that's what those guide wafers are for and you notice they do a tremendous job of making the key really tightly fit in there as for the actual operating wafers there are not as many as you would think there either though so here we have a key now the tip of the key does not use any bidding as we talked about in our last talk like the tip of the key the fifth bidding position really isn't there but look at this the front of the key is clearly exposed with know like there's empty wafer holes what's going on here okay you have the citywide standard key and the New York City Fire key these are two keys the 26:42 in the 1620 they have similar but not exact biddings now the tip of the key again like you could ignore that and the manufacturer did they're like alright well we don't care about that but we still have a problem that we need to make a lock that operates both of these but like a wafer you can't really master away for lock easily so what do they do take out a chamber take out a wafers from the chamber are done we got that one covered nailed it all right that's literally what they did they have three cut positions they care about and they also make a lock that works in the 3502 application across four states and immediately when we report with this we noticed something odd the key doesn't go in all the way all the way so let's take that one apart well they have a lot of wafers but again only four of them are real operating wafers they also use guide wafers that don't fit very well by the way none of you have even noticed this is even a Yale key this is a freaking quick-set key just jammed into that guide wafer it works just fine and if you take this if you slip the right key into a New York lock you can see this is a this is the New York City key this is a quick set key like we saw and sure enough those wafers are lined up well how is that possible so we bust out our TI 86 do a little math on the Yale biddings you'll find so many quick set biddings that are close enough to the yale not only does a key that somebody found work this system is actually exploitable and can be accessed by any of these quick set keys at all everybody check your pockets will give you a sockets if you have these keys because again it's only three biddings so you can jiggle a key in or out in the end we went to Home Depot we actually looked at packages because you can look at the locks through the package right and we found an actual lock on the shelf that has like right off the shelf has a key that you could stick in to these cam locks and completely make it work now you can ask us later what like what this was replacing there's there is a very valid reason that this was engineered this way and it has to do with pin tumbler locks and what's going on with fire service on elevators and it's all very technical and we're going to skip past it cuz we're running out of time yeah escalator you have to be able to pull the key in multiple positions so too cheap in the process to make it easier you can either find any one of many quick set keys at Howard just started spitting out he's like oh my god this works oh my god this works then he started getting really ridiculous like you have some keys right here you want to try some of them right here sure hold him up so he has these regular quick set keys that are just these are all within code these are totally valid that you could have found on a store shelf this is 26:42 regular cam lock operates nice and smooth this is a whole ring of random quick set keys that happen to work it it does not always work so smoothly this one actually happens to work exceptionally smoothly mm-hmm but a little bit of jiggling is required and the lock will still up because Kwikset biddings are in between el biddings so you have high slightly too high slightly too low but again the lock has so much slop it doesn't matter as long as you but here's the thing right when you pick away for a lock you're not attacking it the way you attack a pin tumbler lock jiggling is a very effective strategy for picking wafer locks now with that being said if six for two is your bidding code you've created a separate issue you've created a staircase pattern it's something you try to avoid you don't want to key your quick set key to one two three four five because it's all in one direction it's yet it's something that is not attaining variation so how it is that should have variation he just took a bump key so really quick set bump key you trimmed it down and you were able to just slam that in there at an angle good stuff yeah he's not like yeah you can't bump away for lock but you can just angle and scrub it around to jiggle it and it works do you guys remember the uh you know lock picking in Hollywood talk and people are sticking the wrong things in the lock yeah watch this is it universally understood you need two tools to pick a lock okay I've got a turning tool here all right how it's going to have a turning tool literally just a turning tool remember it's a staircase pattern so this should make sense insert it and twist boom so again you might think well it does its job it still works with both keys it's supposed to work with it and okay now we get real for a second all right we disclose this to the vendor and we'll get into the response in a second but the vendors response was basically well people are buying it because it's approved yeah and so yeah works right sell locks you check the coaster who cares you know what are you talking about it's only supposed to like this is the this shouldn't even have to be in a code I locks only supposed to work with the right freaking key right you couldn't tell someone oh yeah this is the key for your car it's totally great everyone else's key works too but don't worry about that your car works with your key you're fine no I mean I I implore everybody who's actually responsible for us to really consider whether or not the lock itself is operable only by sixteen twenty and twenty six forty two if you can simply use a turning tool and I would suggest that no in fact it's operable by far more than that and it does not comply so now you talk to the vendor right and of course we got hash tag won't fix yeah so we call a little bit bullshit on that because let's be honest this is this is kind of a problem so to wrap it up like there's a lot of situations where things are key to like sometimes it doesn't matter it's just funny but in truth in critical applications and important things like this is how problems start yeah and we're up here just I mean we're up here to give you guys some laughs but also because you tell people there's a problem that's the first step is talking about it yeah so as a practical matter if you're responsible for FOIA stuff right like if somebody wrote a FOIA request and said can I have the email password for the police chief they'd be like fuck no but it's like can I have the vehicle bid spec for the police chief's personal car and they give you the sticker yeah and that's a key that's crazy so fixing this like yes it costs money to replace cylinders ask us later about let's say why we like interchangeable cores why you can do a lot of these systems better than they are done and it's still manageable and industrial sense even with key switches please think about leaks of information so ceiling ceiling those leaky details that are all over the place right like you're responsible for FOIA disclosures you don't have to give this stuff away speed up information great and transparency is great but this is one specific instance where I think we can all agree we don't need that level of detail to really have appropriate oversight when we're trying to do our citizen journalism our way and in the end like we can all laugh at lousy photos in the internet of like oh so I'm going to move the jet way but this should all be all of these locks not just the jet way key lock they should all be part of a larger system a system where many different factors are in play like hopefully there's wheel chocks under the under the jet way hopefully an average passenger even if they knew the key for the Siemens switch and they they couldn't just like start driving the jet way without somebody smacking them in the head keep this in mind for all of your locks in all of your key system the same thing that all of us in to land core and everyone have said for years locks are just one of many layers and they're only as good as how well they're installed how well they're keyed think about that in the bigger picture and had apt your policies accordingly so you know stay safe out there and thanks for listening guys we appreciate it we have time for like one short question in the form of a question a question can be can I have a scotch and the answer is yes to the first three people great question deviant alright see you next time

Info

Channel: DeviantOllam

Views: 190,350

Rating: 4.9268422 out of 5

Keywords:

Id: a9b9IYqsb_U

Channel Id: undefined

Length: 52min 13sec (3133 seconds)

Published: Thu Jul 28 2016

Reddit Comments