The Search for the Perfect Door - Deviant Ollam

yeah there are some there's some pictures already on Twitter I'll retweet them later with the Chaka Khan fun hashtag and you'll see the meat and everything going on in our room but you can ask me questions about meat later today we're talking about physical security as I as I usually do and this talk it mean it might sound boring right but like this is not about the lock this is about the thing your lock is usually in your door or your fence or your container so I am a physical penetration tester I may as people in the family love to joke I'm the physical penetration specialist of my clan of beings I look like consultant during the day but at night I break into buildings I just you know I break into places and steal stuff and then write a report about it and it's really fun and as the core group has grown over the years and we've pinched people from government roles and from law enforcement work we're basically just professionally dangerous folk at this point we teach people a lot of combatives work we do a lot of restraints escape we you know we do a lot of really fun things and people you know blow a lot of smoke up us and make us make us seem way more awesome than we really are if you want to learn how to bust out a zip ties I'll show you it's not as hard as it looked in the James Bond movie but why do we do this why do I have a job why does physical security matter especially in InfoSec well if you read any of the breach reports if you read a lot about InfoSec news you'll see that breaches and a lot of compromises they impact the physical world the physical world and the data and InfoSec world are not that separate did anybody see in the latest you know the story about the water utility right that they got compromised with malware and it was actually there were changes made to their to their PLC's and their controllers they were actually changing the amount of chemicals that were in the water stream and of course what was happening while I was running on archaic technology that's how they got popped so when when news like this hits you now see a lot of players in the space of InfoSec that are really saying wow we've got we've got a look at things on all surfaces this isn't just some problem of like our email addresses got compromised like the real physical world is getting impacted so you see utility companies utility companies are looking for more info SEC now they're looking for more physical background now of course when in these reports they call people out for like well the problem was just really old software it was running it was super comp no this is such a weird and like that never happens today right like you would never see completely outdated systems you know running at a utility company this you know we visit a lot of utilities now water utilities power companies you'll see a lot of images relating to those and these slides but while everyone's thinking of OWL InfoSec has this sort of maybe physical component these companies especially you know infrastructure firms are realizing that with a physical breach not only can your data be compromised I mean that this is the connector right if if I physically breach you I'm just you know I'm not going to just try to like oh maybe I can pone this exploit I don't write exploits like I'm gonna throw console cables into things and just change firewall rules right my mantra is you get undermined on your data side with if somebody makes a bad choice at Home Depot you've seen this slide before but firms in the infrastructure space they are now approaching us saying hey we heard you did some you know InfoSec kind of evaluation can you just do just straight physical we we don't really need it we just want to know if someone breaks in okay what can they do hands on to our equipment or even we had you know a company that was like you know we were walking around like so how much is all this brass worth do you have like a math problem in this rural area and like yeah I'm like so what if someone just broke in here and stole all this like you think that's maybe a target do you think maybe tons of these smart meters I'm like how much did it's a little little water company and I was like physical break-in is something that happens what if someone just steals all these off a shelf and you know is that gonna hit your budget they're like oh we never thought of that like yeah what what if what if a really bad person gets into a room and kind of just messes with this is this a problem and they're like oh how did you get this photo I'm like well I was standing in this room with my team and we popped the door I'll show you how like so the physical space it ties into data compromise it also just ties into general oh crap kind of compromise and that's why I love talking about what's quote unquote wrong with your door and this is the focus of this talk if you've seen me before you may expect that I'm going to talk about locks and sure out in a lockpick village out there I will show you that lock picking is easy how many people have come and spoken with us the past at the lock picking area how many people have not all right so this is this is new material to some of you we're going to talk all about this sort of stuff how locks work in the lock picking area the rest of this con and we'll talk all about how you can make locks operate without the key and that's something that I'm known for it's something that I've talked about a lot it's nothing to do with what I'm going to speak about on this stage today maybe we'll even get the drinks going on later this is the first year that Chaka Khan did not provide me with a blender and a pineapple so we're just mixing I think this is mango juice and bourbon we we make do we're hackers but come on by we'll give you some cocktails will get unofficially of course we'll give you some knowledge about locks and lock picking but this is not the focus of today's talk you want to learn about how lock pick tools work come to the lock pick village the focus of this talk is literally everything else that is wrong with doors and when I say what is wrong with doors I literally mean when I attack a door like on sight as a physical pentester I am virtually never messing with the lock not first anyway I'm doing way up Dunn's of other stuff away more often and I will shoot maybe I could just put a talk together about that dumb stuff dumb stuff that we should talk about like the hinges okay you guys know if you've ever done home improvement it's not hard to pop hinges out of a door right like you just hammer them out it's such a common thing that you don't even have to do it with a screwdriver or a nail you can actually get like there's a special tool the orange thing is so you don't smack your fingers like popping hinges off a door completely valid way to get that door open we've done it a lot on site if the lock looks good why am i messing with the lock and the oh you know you could have this amazing door look at this person's like so many locks is super secure this is the inside of the door of course you don't see hinges in this picture the hinges are on the outside I don't have to mess with all those locks if I want to open this door I will pop the hinge pins now everything I show you in this talk and it's gonna be very fast I've got how many slides so I have let's see 227 slides most of them are no words just I'm big pictures and video guy everything I show you and talk about I'm going to show you a solution for boom boom boom boom boom boom boom right down the line the solution to that stupid hinge problem by the way is this it's called a security hinge when the door swings shut that peg pops into the other side of the hinge you can you can bang those hinge pins out you're not yanking it out of the frame now that's the left side of the slide what's on the right side of the slide those are called jam pins if you don't have a security hinge you've got a regular hinge on every door in your facility you don't want to rehang your doors buy some jam pins what do you do with them well take these two screws pull them out replace them with jam pins take these two screws pull them out replace them with nothing you now have a security hinge doesn't affect the door at all easy stupid install BAM done hinge pin problem gone simple what about the latch you've seen some footage of like the in some of my other talks occasionally when I talk about latch slipping maybe you've seen me talk about some tools that a buddy of mine spread out on a table once when I met him friend of mine named Keith I was like Keith you were actual trading locksmith I would love to do you have like what was your field kit and he spreads a bunch of stuff on the table I was like huh that's anti-climactic alright I guess a locksmith does a lot of servicing work in the field it's not really all penetration he's like nobody this is my entry kit here deviant these are my top three entry tools really he's like oh yeah I slip latches all the time I said what is that thing in the middle because I don't know found it at a flea market I just call it a Carolina Roller that's what's stamped on it I tracked it down Carolina Roller is a textile like supply firm they work in the textile and garment industry and I said hey your websites terrible but I think you make this thing it's on the homepage can i buy it like yeah what it's the the traveler hook I'm like yeah yeah traveler hook give me hunter to them I said what I said look you're a based in North Carolina I don't think you speak Pashto or oh do and this industry is dying in this country ship me these while you're still in business so they did and now like traveler hook this is our go to attack tool for door latches so here's a locked door at a big power you know this is a water company actually and like that door is open and they said what what do you is it really I said yeah let's try that again not it not a goof not a fluke so what the hell happened there what what am i doing the traveler hook or any type of thin slim tool this is like it's it's like credit card in a door if you've ever seen old TV shows like I grew up watching I spy back when you were allowed to make Bill Cosby references culturally and it wasn't gauche but like that the whole credit card ad or thing also known as Lloyd or latch slipping using thin tools to get in the door jamb and retract the latch is it totally valid technique now there are some people say oh we got these plates over our doors and you know we've heard about latch slipping you can't we got a protective plate not so much loll oops no you don't solve this problem by by just putting metal over the latch you solve it by putting the latch on correctly what's happening in this in this issue here so when you look at a door this is the latch this is what is supposed to hold the door closed whether someone leans on it or a stiff breeze blows on it and for a long time that's all doors had remember when doors will look like this right but now they look like this what is this other thing what is this other button that is not the latch that is the dead latch plunger or the dead latch mechanism and unless you know how these work you might not realize when the door is shut that's supposed to be held back by the strike plate have you I actually had like my family member is one of them they had a shore house and we're down the shore house and I would close the door and a guy comes running he was like hey you didn't close it I'm like God do you know my job I think I know how doors work he was no no and he pressed harder on the door he and it clicked again he's like see now it's like really closed no no no no no no no no completely wrong he was pushing the weatherstripping in and the little dead latch was popping out that's completely wrong that's what I exploit half the time improper door fitment improper strike plate fitment something where the dead latch plunger is not being pressed and held in that latch isn't is completely slipper belén shippable if that plunger is held in you can't mess with the latch you can't push on it that's why it's a dead latch this is a huge problem in companies that have electronic card strikes and such so here we have a door we're gonna open it with a piece of garbage that we found look at the size of that strike plate hole it's effing massive why because this is a solenoid style badge reader connected electronic strike plate they come in all different configurations for all different doors many integrators and contractors will just keep a stock of the one with the biggest hope because it'll work on any door when they're doing a job and they're just swapping out door parts I can always use the 21 J cuz it's got the big hole no man know that is bad that is really bad this is another company the same problem bobak co-owner of the firm he looks like a effing ninja here this is not an unlocked door he just low loops boom that bad she's wearing it was just like a blank badge does nothing you can see the plunger the little security plunger is not engaging you go that strike plate is huge and again we're just again we just kept walking around this whole corporate campus that was like the packaging from a Linksys router I was in like a trash can we just ripped it up shoved it in door frames and it was opening everywhere I was out of the water facility and you know rural somewheres Vil and I said hey can I shoot some foot I want to try to pop this door and some of the guys that I was walking around with they were doing their morning rounds and like yeah give it a give it a try I see what you could find you can almost hear the guy he's like well it did take you long at all so yeah you know I could completely just improper door fitment that was the only problem and it was everywhere and what was in here you know like pump controls well controls places you don't need people to be here's another door different facility same industry so nice lock actually they had some good locks but I was showing them I'm like no fitment this is bad this is very very bad and like I'm a jackass you don't want me in here there's nothing about me that belongs in this building so simple stuff you can fix that if the door is just fit correctly into its aura into its surroundings and the dead latch plunger is working what about inside the door not this is not talking about the latch now I'm talking about the inside handle of the door if you're on the secure side of the door I leverage these all the time on jobs here's the door of the crash bar it's locked that was a bent piece of wire let's let's actually watch that again locked door middle of the night and I can just come along clack why because the door is going to open this is fire code in a lot of buildings unless can anyone tell me what they could have done late at night to prevent this sir yes what is what is below that so the thumb turn for a deadbolt in the evening I'm pretty sure fire code because it's low occupancy or no occupancy in the evening I bet you're allowed to dead bolt your doors check with your lawyers but the idea of any of the oh look our doors really really tight well take a little step to the side you can see if you see light leaking through you can bet I have a number of tools I can slap into those crash bars and pop the door open from the outside this is how we got into this room and this was this was add another it was a water treatment plant we showed them we're like so you got all your chlorine tanks and they're on a nice little cart we could just wheel them away do some bad things with them anywhere you see weather stripping weather stripping is not a security device weather stripping is compressible it is squishable you can reach around it and you know this is not a crash bar this is what's called an exit paddle same idea those hand-press paddles if I can slap or hit any of those from the outside like this that's bad and I say on this slide what could we have done you guys talked about it right you could quote lock the deadbolt well let's talk about dead bolts for a second most dead bolts in this country oh thank you very much that's more of my in room steak I'd promised it to Morgan there you get first crack at the steak if you want it right now come grab some so yeah most dead bolts in this country are not keyed on both sides again this is usually fire code there has to be a thumb turn on most dead bolts you ever seen one of these know what it is yeah that's a thumb turn flipper we stick it through the door just like we would to hit the crash bar and we can spin the deadbolt and then we slap the crash bar then we open it be aware of this integrate this into your thinking key boxes oh man do I love key boxes when I find them on jobs it's usually because some other Authority or regulatory person or inspector or maintenance person needs to get in to that infrastructure nowadays by the way oh my god electric and water companies especially they're gonna have tons of key boxes outside their fence line because of how much cellular infrastructure telco infrastructure is up on towers so you've got a telco person coming out and they need to get in so oh I need the key that's inside the key box that I have a key for blah blah blah blah blah the key boxes themselves are usually massively worse in quality and insecurity than the door so here we have a really nice this was a proper door it had I think like a schlager promise or some other kind of lock that I wasn't going to spend time messing with but what's way on top of that door well that's a low key box that is a what kind of lock is that does anyone know what we'd call it some people say circular other names I heard cylinder I heard tubular most people would call this a tubular lock some people will even call it an ace lock or even if you're really old a chicago lock the chicago lock company who no longer exists they're now called compacts they made the ace back in the 70s and 80s the ace lock was like the flagship tubular lock and when everyone saw it they would can't attack it it's so new you can attack it but then now it's out of patent so everyone makes too bit of Locke's thinking they look like hot sex and this is a tubular pic I've got one with me if you want to play with one this is a clear see-through tubular lock and you'll see about how long it takes to pick it let's try to wiggle wiggle wiggle turn turn turn you're just setting pins like you would normally with any other pin tumbler lock they're just arranged differently and before you know it ma'am I've messed with a lot of tubular lock boxes I've messed with a lot of regular key-based lock boxes in the end the result is the same I get the key for the door or fence lock that I'm standing in front of and it was so you had a good key on a good lock and you locked the key at the door with a crappy lock right over my head tubular lock picking anything else you name it like the big one that scared people lately is Knox boxes Knox boxes if you don't know what these are they are the most popular emergency responder key keeper box so again in many jurisdictions the local fire department will have a master key that they can use to open a box outside of your building Knox is not the only brand supera is also popular in some parts of the country but Knox is by far way the biggest there have been compromises of Knox keys and right I think SIA is it Seattle I'm pretty sure it's Seattle was in the news about a week or two ago and the Seattle Fire Department Seattle PD is trying to figure out there's like grainy you know security camera footage of a man and a woman going up two buildings doing like something and then opening a front door and stealing packages or stealing a bike from the vestibule of a building and they're leaving and they think it's possibly an ox compromise and again you're getting burned by code on this one the fire code says key for your building goes in Knox box Knox boxes master keyed what's the way around this by the way don't put your top effing master key in the Knox box like you're supposed to but I would just put the front door key maybe not the top master key for the whole facility in the Knox box but you know you're not supposed to do that talk to legal before you take my advice municipal contractor boxes I said I've seen these before absolutely pickable or decodable combination numerical combination ones are stupid popular these two very popular not just in the municipal space but in the real estate space you can absolutely decode the numbers on these if I can find some I don't know if I travel with any I might have one I will show you how to use thin stick tools to just decode the number pop it open and all of a sudden oh my god I've got the key to whatever this thing is hanging on what about the whole edge of the door not just slipping through to hit the handle but doing a lot of interesting things if if there's any kind of gap let's return to that topic that we can talk a little more about so here's a locked door shaking it it's locked and now here comes dr. Tran with a big giggle on his face what the heck did he just do there you snipped some of you have seen this kind of attack before so here's enough this is a development lab all right this door is locked you want it you want to get in Ross says to his buddy he's like here and Babak has just showed him this trick so now instantly Ross wants to show other people and Babak says no here put it put it right here right where the gap is and get a pretty good view of what's about to happen do you see this little white cloud and then the door opens well what are they exploiting ah yes I heard it over here motion sensors you take a can of compressed air from any staples or office Mac's you name it you flip that over it's like the thing I used to do if my cats were jumping on the keyboard and I wanted to get em to live you know spraying with cold air most passive infrared sensors which are part of a lot of exit systems will trip on temperature differential that is a cloud of cold air tripping what is called a Rex sensor a request to exit sensor many doors if you trigger any kind of temperature differential on the inside the door system and the access control you know header the head and says oh wow there's there's movement must be a human trying to egress from the secure side I should unlock now OOP George's pops open and you don't even get a door open alert condition because it was preceded by movement on the inside so the access control system says oh that's that's just a normal aggressive en't do better sensors exist yes not all of them are passive infrared you see other models listed and mentioned here some use microwave radar RC our range control radar they need to see something of approximately the right size and shape approximately coming toward the door not just like a cloud of something moving away from the door it's possible to try to trick them out it's a lot harder you can also have hybrid ones whether they're and gated or or gated logic is something you want to ask your integrator and installer but you know really secure door it should be a something like the right size the temperature of a human coming at the door a lot harder to fake out what's another part of the door that I can I can attack well the bottom of a door there's a gap that we were just messing with on the large you know frame of the door what about a gap at the bottom of the door some of you have heard me talk about this and I'll say it again fire code and modern ad a compliance code eliminated knob style handle sets in most commercial spaces years ago when's the last time you've seen a doorknob in a hotel or an office building the 80s basically now it's all lever style handle sets and that means that the inside of a door is very exploitable if there's a bottom gap so here we see a plated up door probably can just tell you it was properly installed I couldn't slip a wire into that plate but I'm slipping something under the door and I'm moving and pushing and I'm gonna grab this handle and all of a sudden yank and the doors open well let's look at that from the other side and you'll see what that attack method is this is called an under door attack it uses just an under door tool and all I'm doing it's basically a wire delivery system I deliver I can feel exactly where I am on this door I can tell by the touch and the feel the sensation of where I'm hitting I can get a rope around that handle and I'm just hitting the inside handle just yanking it and then the door again the door will behave like any person on the inside is egressing and this there are specialized tools that do this for knobs for crash bars there's a lot of them if you can get under the door and get something up to that handle which is very easy to figure out by the way most facilities if I want to attack like the server room I don't go right for that door I go for some closet or some you know some office that no one's in because usually every door in the facility is the same the contractor just brings in them so I can open that door I got baalbek or Robert or somebody Anderson I'm practicing unlike a closet like am I on it am I not on it all right is I'm hitting it cool let's go try the server room like every facility has practice training sessions built into other doors so sure enough you can bang on that inside handle with amazing ease what is the solution to this well there do exist products that are called dynamic door bottoms where there's a plunger or button in the doorframe when the door shuts the bottom of the door drops down now what you're seeing here this little marketing video this is just sort of an environmental version for light and heating and cooling leakage they make much more secure versions of the same system though for security purposes so there is something basically a company a brand name pemko which is now a sub brand of ASSA ABLOY who owns everybody in the security space nowadays pemko makes this dynamic door bottom that has interlocks and if the door is shut like you're not lifting that up this is not a little rubber sweeper on the bottom this is a metal bar that drops down hits a contoured floor plate you're not getting anything under that door to mess with the other side beautiful idea you could more to sit into the door or you can just this one shows it just bolted onto the back of the door a couple hundred bucks you know you don't put it on every door in your office you put it on the most important places and it does a really brilliant job you don't have that kind of budget there are hacky er solutions that will frustrate the hell out of me especially if I'm going in blind I'm like why is my freak I can't hit it - god damn it damn it and then eventually we get in some other way and I'm like oh look with this freaking thing the shroud on the god damn it and wasted 15 minutes of my life I don't know who makes this I don't know where this product comes from but I've been in buildings where I've seen this like in hotels and I asked one site engine like site you know facilities guy at a hotel I'm like where what is this thing because it's clearly aftermarket and it wasn't there the last year I was at this conference I saw your talk and okay I said what the hell is this you know what he told me it was like sliding doors for your closets in your bedroom they can have these little plastic guides that go in the track he's like yeah we went to Lowe's we found a bunch of them and just kind of like bolted them on the door and it we tried to make it at that under door tool you gave us last year like we trying to make it work we couldn't really like I was like I don't think I could make this wreck either that's frustrating as hell it's a that's like the greatest Clodius solution I've ever seen to this problem and it's brilliant man it's freakin brilliant I love it the door frame the door frame itself now we're not talking just about door fitment here but there is one other attack and it's almost a little bit outside of the non-destructive entry but I've done it there is the ability to spread the doorframe out and if you have a latch or a deadbolt or something sticking into the you know into the strike if you spread the whole doorframe just by not even an inch you can sometimes swing the door open now criminals and thieves have done this in Europe much more than here in the US they'll just take a hydraulic jack and they'll Jack the door open entry teams police will do this especially in Europe it's more popular in the US I had a neighbor in West Philly where I used to live he had like a super antique door and when he slammed to his basement door one day like he heard this weird springy snap sound the door handle set which was like his original 200 year old handle thing basically rusted and blown apart inside the door so now his knob didn't do anything and I think the knob fell out when he tried to keep jiggling it and he couldn't he's like what can I do and he was freaking out he's like my laundry's down there oh my god my cats down there like so he was gonna take an axe to the door or something and I was like he's it's beautiful old how am I'm not letting you destroy this veneer on this door so I went out to my truck and I fired some like two-by-four that I was made some dunnage when I lifted up something on a jacket all right let me give me a second I'm gonna cut this 2x4 and do this and I'm gonna hang him he might get my jacket of the truck what we did is we just jacked the door frame open like I was like here you hold this block and I hold and I started cranking this jack and I'm like all right everyone stand back and I'm just I'm just cranking on the stand you know if you Jack like a car it's you can do it with like one hand it's not easy this we had to put like a cheater bar on the end of the jack we're like and you heard the whole house was like and I'm like that is way too much pressure to put on a piece of to buy but eventually after a few turns I was like wait a minute I just touched the door and I was like yeah we just spread the doorframe out and then like a tourniquet we slowly eased it down and the doorframe kind of just settled back in and no damage so that's an amazing attack vector what's the solution to that there are some dead bolts that are called a hammer head dead bolts where when the dead bolt fires out a pair of ball bearings will actually shoot to the sides and they'll lock into a cup of style strike plate so you can't literally rip the doorframe away from the door it's much more expensive and not every manufacturer makes one of these but it's a solution to that now we called this talk the perfect door but I do have a little bit of padlock stuff I want to throw at you how we doing on time here Oh 10:00 a.m. we got we got some time I'm going to give you a couple of padlock pointers because why not so quick terminology on padlocks and I'm going to show you every stupid attack - I'm literally making my life harder because if you do this stuff and then you hire me like you're gonna ruin my day if I'm trying to break in because I don't pick a lot of padlocks in the field either padlocks have a shackle of some kind that's the part that pops out when you operate it you operate it because the body of the padlock usually contains the shackle or it can release it when you turn the key what does the key do well the key goes in two key way and it hits the plug of the lock the plug is the part that turns when you turn the key there are pin stacks in most padlocks pin base locks you'll learn all about this in the lockpick area hands on but if those pin stacks line up and the plug turns there's usually some kind of release or cam on the tail side of the plug which interacts with the latch or usually two latches the latches are what hold the lock shut let's talk about attacking them first because again if the latches are what hold the lock shut the shackle shut why am i messing with all those other parts right if you've seen me before you've probably seen me talk about padlock shims padlock shims are just thin pieces of metal that you slip down into the lock body hitting the latch and springing it out of the way if this combination lock was open and you wanted to close it would you dial the combination or do you just slap it shut you just slap it shut the latch is spring-loaded likewise if you just stick the shim in you just spring the latch over and pop it apart most padlocks operate this way unless you have a high-quality padlock you can slip a padlock shim down into the lock body and just spring that latch out of the way and there you go the lock just flies open there are locks that prevent this but how often do people talk about this not very often here's this big beefy looking padlock right and sure enough click bang lock swings open 2 cent piece of steel easily done now you can purchase them like the store-bought shims you can make them you can make them out of beer cans we do this all the time I probably have some aluminum cans and my stuff if you want to try it we get some scissors you cut you up some padlock shims some locks have single latches some locks have two latches doesn't make the lock any better you know it's got two latches one on each side yeah you just need two shims put one in one side put one on the other side those little latches are just again they're spring loaded they say oh something's pushing on me must be the shackle coming down I better get out of the way boom this is ridiculous that it's so easy but most of the locks on store shelves today are vulnerable to this technique because nobody nobody really talks about this master lock of all people is finally producing some gear that they're like auntie shim you can totally check YouTube for anti shim padlock being shimmed and you'll see video of us like at blackhat doing it so yeah this is not hard what is a proper padlock in this department a padlock that doesn't use a spring-loaded latch this is called a double ball mechanism these are two solid steel ball bearings that only fall inward if this cam control cylinder turns that is a nice lock that is it that is a non shimma bull padlock not all padlocks are constructed this way not all padlocks are this robust they're out there they're not crazy expensive I'll give you some good examples in a bit what about attacking with quote skeleton keys is that a thing that exists now is this a piece of history is it arcane well let's talk about it warded locks again because I work with a lot of utility companies these are ridiculously popular outdoors warded locks have this very square looking key what's going on inside of a lock with this very square cut key well awarded lock has protrusions of metal these gray bumps are called wards there's only one like latch or catch or release in the lock usually so it's almost an inverted security model it's not the lock saying to the key hey are you the right key or you the wrong key I'm not going to let you turn the key will does this make sense you're slipping the key in next to those protrusions of metal the key can get down the key way but if it's the wrong key it can't turn if the key way is matched perfectly with those protrusions it's literally the key query ngey for me oh I can turn yay and if the key were the wrong key obviously the wards wouldn't line up and that all the key just can't turn but most of the key is not responsible for opening the lock yeah skeleton keys exist you just trim all the other stuff off of awarded key you are basically trimming away all the extra flesh you're left with the bare bones and it will hit the frickin release mechanism and always hit it so that is what quote warded Pixar they basically look like trim down warded keys and you reach in as long as you can find that lever and strike it with the right angle BAM the lock will use the release I have warded locks with me I have warded picks and cut down keys with me try it out you will be able to open basically every warded lock ever yes skeleton keys exist what about the pin stacks again I said I wasn't talking about picking in this talk there's something else you can do it's ridiculous that this exists in this day and age this was a problem ages ago that we thought we had stamped out in the manufacturing world comb picking over lifting with comb picks what is this most locks should not be able to be what's called over lifted door locks padlocks you name it this is way more of a problem with padlocks today though on the shelf right now I'm talking go to the store locks you can do this too if you try to push a pin stack as high as it will go like so hide you've crushed the spring it's still not out of the plug right and that's a very long pin stack that that key pin is very long and red even the short red pin still I can't get it out of the plug the housing is just not big enough but there are locks if you can believe it manufactured so cheaply that basically this is their construction there's so much room in the housing that you reach in with a comb pick you literally lift all the pins completely out of the plug and then it just spins around there's nothing restricting it this is absolutely a vulnerability on locks that are in production right now on the shelves and the fact that this was a problem with the industry almost forgot and now we're like wait didn't we never this what sure enough master 140 series the little brass body master 150 master 142 the little black padlocks that we have to play with comb pickable right now comb pics are like 2 bucks maybe 9 bucks if you get the set of them that you don't really need the whole set completely insane that that exists attacking the release cam attacking the tail side here's a quick story about that the most popular lock used by contractors out in like you know construction sites the master 175 thin bit of metal can be slipped in between the wheels you can rock it just the right way at the right angle squeeze it the whole lock flies apart what is going on you can do this over in the lock picking area if you've never done it you are exploiting the release mechanism see this long Y shaped piece of brass this is we call it the tongue that has to lift up when you dial a combination correctly that's how the lock releases a thin enough piece of metal can slip into the lock body get underneath the tongue and lift the tongue up from the outside it's literally faster than using the correct combination to make this lock fly more I'm gonna show you I'm gonna cut the video off once you see it it's unbelievable you squeeze in lift the tongue and done every single master 175 on shelves right now is vulnerable to this and every time they come out with like a new version and like oh did you hear it's they fixed it no they effing didn't I keep buying them every time someone tells me that and it's still vulnerable American lock company and I'm gonna keep keep picking up the pace I know we've got a lot to get through I want you to see all this stuff I really I can't believe that some of these attacks are valid there is a bypass tool that hits the tail cam on them they have since kind of fixed it and will come back if you ask me how they fixed it later this is the rear side of the plug-in this lock this key way which is broached all the way through the plug right you can reach through and just flick the tail cam flick the release mechanism with this tool now American lock actually did come out with a patch basically they said here this little metal disc you disassemble your lock you put the metal disc on you reassemble the lock and now we're shipping all new units with this disc and it blocks the you know the gap it's really it's like a hotfix like it was Tuesday and I like here just download this you're good so the person who made that at that bypass tool they made this which he called the wafer breaker and you stick it in and you bang on it you press it you swing and it punches a hole it's like when somebody downloads the hotfix and they immediately reverse-engineer it like what did they fix oh I could I could mess with that boom so yeah they there are still vulnerable you know American locks out there so where do we encounter these well everywhere you expect right like every job I do every big utility company I've ever hit I'm just banging locks open all the time on their fence line I'm getting into their facilities this was one way out in the field somewhere pop that open you know I'm like at a holding reservoir just like I could just maybe roll a 50 gallon drum of something out of my truck into this should I do that no that would be bad on top of a big subterranean storage tank like again just craptacular padlocks out in the middle of nowhere where no one's watching it I don't like to spread FUD because like let's be honest no one cares about podunk nowhere water utility company no terrorists are on that freakin hit list there but still like if you want it for liability purposes alone like getting on top of water towers maybe you're really rednecky and that's how you propose marriage to somebody like I don't know with spray paint like yeah just friggin this is a little superb I passable masterlock to protecting that so how many people are starting to think a little more critically about their doors and their locks right now thing has anybody learned anything new in this talk thus far all right when yeah like let's give a quick rundown here right this door has some problems what are some things that you just shout what's what's wrong you seeing here yeah you see a light leaking through right if I look up at the door what do I see on the inside of the ceiling wreck sensor exactly I can reach through slap the the door release I could maybe gasp the wreck sensor what kind of lock is holding this shut that's a magnetic lock many doors they're not mechanically locked they're magnetically locked so if the power goes out are those failing five minutes got it are those failings secure or those failing you know open this is the basement of a hospital where we did a job and sure enough like this looks like you're on the inside like the sick the insecure so like you could oh this is where staff is clearly there's a push bar no this door was locked on both sides this was a cross through between two buildings and you needed to use your badge reader like on either side of the door to get through this part of the facility but I looked I'm like alright so these are mechanical crash bars they do nothing so this is not a mechanical lock it's a badge reader I'll give you you know ten dollars and a box of donuts this has got to be a magnetic lock so we're looking and like kind of looking at them like alright well there's this wiring conduit that goes to this junction box either that's an illuminated exit sign or it's got to be the magnetic lock sure enough you know we just unscrewed the thing we found a couple wire nuts took them off and the door fell open because when the power went out the magnetic magnetic lock couldn't hold anything so threats come from all kind of angles I'm not telling you that every attacker is just super low tech dumb like that we have a whole electronics division you want to ask us crazy badge cloning question whenever I show that people are like well is it the badge reader supposed to be the real high-end security yeah like we can clone badges and everything else this is bobak our electronics guy the company just he had cloned a you know guys badge we can get wherever we need to get with that so there's a lot of different threats in the physical landscape it was really a point of pride for us by the way that so babak's latest project is to take a giant you know our ninety badge reader that you'd see in like a parking garage and he's regretted it so we call it the hunt pad it just he just throws it battery packs and everything he just walks around with this in a laptop bag and he clones badges it was nice to see that feature to mr. robot if you watch mr. robot but um threats come from all angles but keep the dumb stuff in mind please so really quickly just to summarize those padlocks attacks and mitigations right please don't let your locks be Chimel if the padlock is can you know protecting anything good don't use warded locks for anything they're awful they can all be skeleton keyed don't let your locks be over lifted there's only a handful of locks that are super popular right now that are vulnerable to this but everyone's buying them because they're super popular and the release cam you know make sure that your system is not just easily slip by passable I will tell you about which models can and can't be bypassed I have a whole little site I don't work for any of these companies but I have a list of locks that I just love and we can talk about the more in the lockpick Village area for for padlocks like you can get super crazy amazing you know ABLOY cysts I love a blur locks like there's some serious cash on those but if you want to go with just like a couple that a bus make there are locks that you can you notice why do I like these you can record them to match your door locks make it easier on your facility's team if you can have like Schlage locks around your building you can rekey and recore a lot of the ABBA's gear with removable cores in Schlage or in quick set or in whatever you're using at your facility for not a ton of money you can get locks like padlocks that work well of course you're spending some dollars on the first install when the locksmith keys them up but then you're good the door attacks wrapping it up on the door side what do we talk about the hinges security hinges or jam pins stupid easy to use slipping that latch right Lloyd in the latch get an anti thrust latch and make sure the door is properly fit getting the inside like if I'm slapping that release bar on the inside get a really proper good deadbolt that I can't you know flip with a flipper or again just door fitment get the door tight enough that I can't reach through it please don't use key boxes unless you're required by code and then have legal ask if you can get a variance you work for a data center you've probably got a low occupancy facility you may not need a fire box or a key box that way you think you need it the big edge gap we're blowing air on the sides again get better sensors on the inside that it's harder to fake or put it put an actual block it's called a security astragal slap shut when the door closes if you ever have a fridge that has two doors and when you close the fridge the door like clicks like that they make those for office doors the bottom gap again you could put a security door bottom underneath there or a blocking shroud or something on the inside so I can't grab the handle and as far as spreading the door frame virtually no one's doing that but that hammerhead deadbolt does exist if you want to use that now this looks like a lot of stuff but it's really not not every door has every one of these vulnerabilities and every solution that I'm showing you up here is not insanely expensive you could have the worst door imaginable in your server room that is vulnerable to all of this and you have to do all of this and you're out like you know maybe a foul really less than that honestly so in the end I love the simplest solutions this was a utility company where I'd shown you that like latch slip and I was saying I'm like look so that the strike what you had was door drift and the door over the years had just you know that it wasn't quite hitting the strike plate there is a locksmith ledger article where someone the guy was like yeah so we had some door drift we just put a little plate of metal and put the strike plate back on and now the anti thrust mechanism work like most of these problems you are solving with your facilities team doing a couple days work around the door sites just tighten it up some tolerances a bag of tools gets you way more protection than a whole lot of other stuff the people are trying to sell you and I'm happy to talk about that I'm happy to walk around your sites one day if you want to bring me out it's not hard just please stay safe out there and thank you for listening I don't know if I burned up my question time or what we are on the schedule here but what it was somebody somebody a red shirt tell me what we got I got five minutes all right who wants to know anything else about meat cooking in your room or or doors am i selling lockpick kits technically I am because the core group owns Red Team tools calm because so many people ask us for lock picks now that we got tired of trying to like you know carry them everywhere it's way easier if you just go to Red Team tools calm the shipping is super cheap and we will just send them anywhere at all so I did not bring a ton I wanted to bring more contest gear and other fun stuff to play with but yes we do we do sell the stuff we use we're not like a proper retail shop we're out of stock a lot but yell me by email and yes I will sell you the nice lockpicks anyone else over here how sophisticated is the temperature control mechanism I'm using on the sous-vide it does 1/2 degree Fahrenheit increments and yeah I have the Innova bobak who you saw he has the SANS air we got Robert the old anova when he got married so like everyone about like seriously I'll talk sube all day I'm just like I got a steak sitting right here I'm just gonna you know start eating this in a second because why not infinity steak everywhere you go any other questions yes sir so if you do all these things you've secured the door then you like if you have a key compromise whether you lose the key or you have an ex-employee when I was talking about the padlocks that I like I mentioned the removable core specifically the LF I see large format interchangeable core that's a really good standard to go with nowadays they work in both door locks and padlocks having a removable core system makes it monstrously cheap and effortless to basically instantly rekey your door or your whole site once you've stood up the system and paid to get it installed it's beautiful that way so key compromise almost becomes not a thing anyone else ah what do I think of TSA compatible locks so immediately after Chaka Khan I will be flying back east and the mainland I'm speaking at hope and the New York City area hope isn't yet who goes to anyone go to New York for hope not too many people 2600 magazine you're there so there is a talk this year by some friends of ours like night owl and click and I guess Johnny Christmas and Shawn they're all talking about the TSA key Fiasco because the TSA Keys are like all super compromised these are the luggage locks all of us have those keys at this point they are very badly made locks to begin with not to mention it's just super lousy how people have decoded them from photographs and PDFs that were online I don't fly with TSA locks I have proper heavy alloy locks in all my cases whenever I travel and I do that by throwing a firearm in every case usually my favorite thing to do now by the way if you've ever seen my old flying with guns talk is I just have bare stripped AR receivers which you know for like 50 bucks that's a firearm and it's like indestructible you can't bang it up and I just throw it in the case I'm like I'm flying with guns got to lock that up so if you fly with a firearm you use proper locks not TSA locks on your bags anyone else I got a few laughs yeah yeah yeah just I mean like a stripped lower like a block of aluminum doesn't take up any space it weighs nothing sometimes people still like sir where's the firearm and I'm like here they're like no when I call someone from the airport unit I'm like officer what would happen if I sold this to this guy across state lines with no paperwork he's like that's that's a registered receiver you notice that's the firearm thank you and good night yes right here Jason yes do i sear the sous-vide steaks absolutely you gotta have a good meillard reaction I use in my road kit I have a cast-iron pan it's always with me lodged 10-inch but I do have a searzall adapter on my TS 8,000 blow torch head so $2 bottle of propane gas at the you know at the grocery store you get your complimentary shower cap from like concierge you put that over your smoke detector in your room and yeah you just couple a couple minutes aside and you're all set yes Morgan is confirming they're delicious I have never had a person hanging out in my room who did not like the steak I make 126 Fahrenheit by the way just Pittsburgh Pittsburgh all the way anyone else before they throw me out all right I'm gonna see you in a lock-picking area thank you for listening and letting me be goofy year after year at Chaka Khan

Channel: Shakacon LLC

Views: 672,026

Rating: 4.897851 out of 5

Keywords:

Id: 4YYvBLAF4T8

Length: 50min 49sec (3049 seconds)

Published: Mon Aug 01 2016

Reddit Comments

[u/mrsenile9223]

People think that the credit card through the door thing is just a movie stunt - I've used it on many occasions to easily pop a latch lock. Go and test it out on your doors and see how easy it is. Always use your dead-bolt lock in combination with the latch.

[u/RandomGarry]

Is there a subreddit for this shit...its fascinating

[u/evilplantosaveworld]

I thought to myself "Eh, I'll watch it for a few minutes, I'll probably get bored."
Almost an hour later I'm wondering how much trouble I'd get in at work seeing if we have these vulnerabilities.

[u/dudeedud4]

If you think this is bad, just go watch the 2 DefCon talks on Elevators.. theres only a handful of keys for them. Having only a few different keys gets you access to most elevator /secret/ functions.

[u/b00xx]

Remove all doors from house. Solved.

[u/Bowmance]

That's one hell of a cool job!

[u/turtlelord]

He talked a whole lot about why people's dead latches weren't working, but he never explained how they work so I'm left more confused on that segment

[u/mantis44]

his hotel steak cooking method at the end was hilarious

edit: 49:50 for the timestamp

[u/wow_shibe]

I met this man at a convention last summer in Durham, NC. He taught us (the convention) how to make proper mixed drinks! Also got to chat him up in the lockpicking village for a few hrs. Honestly was the inspiration for me to get into cybersecurity and phys. security as a profession! Go watch more of his stuff on youtube! Or check out his site.