Ten Things Everyone Should Know About Lockpicking & Physical - - PowerPoint PPT Presentation

▶
ten things everyone should know about lockpicking
SMART_READER_LITE
LIVE PREVIEW

Ten Things Everyone Should Know About Lockpicking & Physical - - PowerPoint PPT Presentation

Nov 17, 2023 319 likes •1.56k views

Ten Things Everyone Should Know About Lockpicking & Physical Security Deviant Ollam Black Hat Europe 2008/03/25 Lockpicking & Physical Security Deviant Ollam 1. Locks are not complicated mechanisms Simple components Simple

slide-1
SLIDE 1

Lockpicking & Physical Security Deviant Ollam

Ten Things Everyone Should Know About Lockpicking & Physical Security

Deviant Ollam

Black Hat Europe – 2008/03/25

slide-2
SLIDE 2

Lockpicking & Physical Security Deviant Ollam

  • 1. Locks are not complicated mechanisms

Simple components Simple operation Efficient & resilient

slide-3
SLIDE 3

Lockpicking & Physical Security Deviant Ollam

slide-4
SLIDE 4

Lockpicking & Physical Security Deviant Ollam

slide-5
SLIDE 5

Lockpicking & Physical Security Deviant Ollam

slide-6
SLIDE 6

Lockpicking & Physical Security Deviant Ollam

slide-7
SLIDE 7

Lockpicking & Physical Security Deviant Ollam

slide-8
SLIDE 8

Lockpicking & Physical Security Deviant Ollam

  • 2. Most locks are wildly easy to pick

Common faults Easily exploited Anyone can do it

3:00

slide-9
SLIDE 9

Lockpicking & Physical Security Deviant Ollam

slide-10
SLIDE 10

Lockpicking & Physical Security Deviant Ollam

slide-11
SLIDE 11

Lockpicking & Physical Security Deviant Ollam

slide-12
SLIDE 12

Lockpicking & Physical Security Deviant Ollam

Picking

slide-13
SLIDE 13

Lockpicking & Physical Security Deviant Ollam

Demonstration

Everyone Cross Your Fingers Think “No Demonstration Effect” The Two Biggest Errors… Too much wrench pressure Lifting pins too far up

slide-14
SLIDE 14

Lockpicking & Physical Security Deviant Ollam

Raking

slide-15
SLIDE 15

Lockpicking & Physical Security Deviant Ollam

  • 3. Unpickable doesn’t mean invulnerable

Combination instead of key Pins arranged in other formats Different keyway orientation

7:00

slide-16
SLIDE 16

Lockpicking & Physical Security Deviant Ollam

Combination Locks

Show of Hands

slide-17
SLIDE 17

Lockpicking & Physical Security Deviant Ollam

Combination Locks

Show of Hands Immensely popular in the USA Schools Gyms Etc.

slide-18
SLIDE 18

Lockpicking & Physical Security Deviant Ollam

Combination Locks

Show of Hands Immensely popular in the USA Schools Gyms Etc. These Locks Provide Essentially Zero Security

slide-19
SLIDE 19

Lockpicking & Physical Security Deviant Ollam

slide-20
SLIDE 20

Lockpicking & Physical Security Deviant Ollam

slide-21
SLIDE 21

Lockpicking & Physical Security Deviant Ollam

Padlock Shims

Simple Cheap Buy Online 20-pack for $25 Shim stock metal Homemade Aluminum Cans

slide-22
SLIDE 22

Lockpicking & Physical Security Deviant Ollam

Tubular Locks

Still traditional pin stacks Pins simply arranged in unconventional pattern Need specialized tools (well… sometimes)

Low-tech Kryptonite bypass (bic_pen.avi)

slide-23
SLIDE 23

Lockpicking & Physical Security Deviant Ollam

Dimple Locks

Traditional pin stacks Horizontal keyway

slide-24
SLIDE 24

Lockpicking & Physical Security Deviant Ollam

Dimple Locks

Traditional pin stacks Horizontal keyway Nearly impossible to insert usual pick tools

slide-25
SLIDE 25

Lockpicking & Physical Security Deviant Ollam

Dimple Locks

Traditional pin stacks Horizontal keyway Nearly impossible to insert usual pick tools Other means to bypass Impressioning Bump keying

Barry Wels & Laz impressioning a dimple lock (dimple.avi)

slide-26
SLIDE 26

Lockpicking & Physical Security Deviant Ollam

  • 4. Minor changes make a big difference

Specialized pins Unshimable padlocks

13:00

slide-27
SLIDE 27

Lockpicking & Physical Security Deviant Ollam

Pick-Resistant Pins

Mushroom

slide-28
SLIDE 28

Lockpicking & Physical Security Deviant Ollam

Pick-Resistant Pins

Mushroom

slide-29
SLIDE 29

Lockpicking & Physical Security Deviant Ollam

Pick-Resistant Pins

Mushroom Spool

slide-30
SLIDE 30

Lockpicking & Physical Security Deviant Ollam

Pick-Resistant Pins

Mushroom Spool

slide-31
SLIDE 31

Lockpicking & Physical Security Deviant Ollam

Pick-Resistant Pins

Mushroom Spool Serrated

slide-32
SLIDE 32

Lockpicking & Physical Security Deviant Ollam

Europe Raises the Bar

slide-33
SLIDE 33

Lockpicking & Physical Security Deviant Ollam

Europe Raises the Bar

slide-34
SLIDE 34

Lockpicking & Physical Security Deviant Ollam

Europe Raises the Bar

slide-35
SLIDE 35

Lockpicking & Physical Security Deviant Ollam

Europe Raises the Bar

slide-36
SLIDE 36

Lockpicking & Physical Security Deviant Ollam

Europe Raises the Bar

slide-37
SLIDE 37

Lockpicking & Physical Security Deviant Ollam

Un-Shimmable Padlocks

Collar / Boot Double-Ball Mechanism Key-Retaining Locks Less Convenient Less Popular Can still have combination dials Size doesn’t always equal security Resistance to Brute Force Not Always Resistant to Finesse

slide-38
SLIDE 38

Lockpicking & Physical Security Deviant Ollam

  • 5. Advanced features aren’t a panacea

Sidepin… the industry’s first attempt Sidebars… good and bad Mul-T-Lock dimple system Abloy’s rotating disks

15:00

slide-39
SLIDE 39

Lockpicking & Physical Security Deviant Ollam

Side Pin

Schlage Everest

check pin key (bottom) pins driver (top) pins pin springs plug check pin spring specialized key

slide-40
SLIDE 40

Lockpicking & Physical Security Deviant Ollam

Side Pin

Schlage Everest

slide-41
SLIDE 41

Lockpicking & Physical Security Deviant Ollam

Side Pin

Schlage Everest

slide-42
SLIDE 42

Lockpicking & Physical Security Deviant Ollam

Side Pin

Schlage Everest

specialized “finger wrench” modified Everest key

slide-43
SLIDE 43

Lockpicking & Physical Security Deviant Ollam

Side Bars

Similar to side pins Restrict plug movement Harder to pick than pin stacks

slide-44
SLIDE 44

Lockpicking & Physical Security Deviant Ollam

Side Bar

Finger Pins

slide-45
SLIDE 45

Lockpicking & Physical Security Deviant Ollam

Side Bar

Finger Pins

slide-46
SLIDE 46

Lockpicking & Physical Security Deviant Ollam

Side Bar

Sliders

slide-47
SLIDE 47

Lockpicking & Physical Security Deviant Ollam

Side Bar

Sliders

slide-48
SLIDE 48

Lockpicking & Physical Security Deviant Ollam

Side Bar

Rotating Pins

slide-49
SLIDE 49

Lockpicking & Physical Security Deviant Ollam

Side Bar

Rotating Pins

slide-50
SLIDE 50

Lockpicking & Physical Security Deviant Ollam

Advanced Dimple Lock

Mul-T-Lock Developer & Manufacturer Patent Holder Exclusive Distributor Specialized Design Pins Within Pins Can’t Impression

slide-51
SLIDE 51

Lockpicking & Physical Security Deviant Ollam

Mul-T-Lock

Pins within pins

slide-52
SLIDE 52

Lockpicking & Physical Security Deviant Ollam

Mul-T-Lock

Pins within pins Imagine the inside

slide-53
SLIDE 53

Lockpicking & Physical Security Deviant Ollam

Mul-T-Lock

Pins within pins Imagine the inside In fact, this is the actual mechanism

slide-54
SLIDE 54

Lockpicking & Physical Security Deviant Ollam

Mul-T-Lock

see the difference now?

slide-55
SLIDE 55

Lockpicking & Physical Security Deviant Ollam

Mul-T-Lock

Standard Operation

slide-56
SLIDE 56

Lockpicking & Physical Security Deviant Ollam

Mul-T-Lock

Standard Operation Overlifting

slide-57
SLIDE 57

Lockpicking & Physical Security Deviant Ollam

Mul-T-Lock

Standard Operation Overlifting Michaud Attack

slide-58
SLIDE 58

Lockpicking & Physical Security Deviant Ollam

Rotating Disks

Tremendous Security Mimics a safe lock Very Difficult To Pick Takes much time and great skill Specialized tools required

slide-59
SLIDE 59

Lockpicking & Physical Security Deviant Ollam

Rotating Disks

Tremendous Security Mimics a safe lock Very Difficult To Pick Takes much time and great skill Specialized tools required Falle Tool Manipulates disks individually Decodes cut orientation Numerical key values

Barry Wels picking a rotating disk lock with Mike Glasser (rotating_disk.avi)

slide-60
SLIDE 60

Lockpicking & Physical Security Deviant Ollam

  • 6. Adding electricity isn’t magical

Hotel safes Deadbolts Access control systems

Magnetic door locks Passive IR sensors The Wiegand pitfall

Malaysian Hotel (electronic_safe_spiking.avi) Major Malfunction (majormal-paperclip.avi) Winkhaus Blue Chip (winkhaus_long.avi) Mul-T-Lock CLIQ System (cliq.avi)

25:00

slide-61
SLIDE 61

Lockpicking & Physical Security Deviant Ollam

A problematic access control door

Magnetic lock

slide-62
SLIDE 62

Lockpicking & Physical Security Deviant Ollam

A problematic access control door

Magnetic lock Large gap

slide-63
SLIDE 63

Lockpicking & Physical Security Deviant Ollam

A problematic access control door

Magnetic lock Large gap IR Sensor

slide-64
SLIDE 64

Lockpicking & Physical Security Deviant Ollam

Zac Franken… the Gecko project

slide-65
SLIDE 65

Lockpicking & Physical Security Deviant Ollam

  • 7. Safe locks vary as widely as door locks

Mechanisms Certifications Resistance to other conditions Amazing electronic models

35:00

slide-66
SLIDE 66

Lockpicking & Physical Security Deviant Ollam

Safes

Mechanism Operation

Wheels, Gates, & a Fence Direct Entry Fence vs. Nose & Cam

Insurance Ratings

Underwriters’ Labs (TL, TRTL, TXTL + ##)

Fire Safes

Often terribly weak hardware Also not typically rated for electronic media

Compromise

Manual or Robotic Manipulation Manipulation-Proof Safes (S&G 8400) Electronic Mas-Hamilton X-07 & X-09

slide-67
SLIDE 67

Lockpicking & Physical Security Deviant Ollam

  • 8. Bump keying is a real problem…

… but one with real solutions

38:00

slide-68
SLIDE 68

Lockpicking & Physical Security Deviant Ollam

The “Bump Key” Attack

Popping a lock open with a special key Takes little skill, almost no training, no special tools Vast number of locks are vulnerable The media (and public) is finally taking notice Exploit closely related to physics of a pick gun Best explained via billiard ball analogy…

slide-69
SLIDE 69

Lockpicking & Physical Security Deviant Ollam

slide-70
SLIDE 70

Lockpicking & Physical Security Deviant Ollam

slide-71
SLIDE 71

Lockpicking & Physical Security Deviant Ollam

slide-72
SLIDE 72

Lockpicking & Physical Security Deviant Ollam

The “Bump Key” Attack

slide-73
SLIDE 73

Lockpicking & Physical Security Deviant Ollam

The “Bump Key” Attack

slide-74
SLIDE 74

Lockpicking & Physical Security Deviant Ollam

Countermeasures to Bumping

Certain High Security Mechanisms

Sidebars in Schalge Primus Slider-based sidebars in Evva & Scorpion Pins Within Pins (newer Mul-T-Lock models) Rotating Disk locks (Abloy & clones)

Other High Security Locks Don’t Help As Much

Assa V10 Twin is “exploitable” geographically It is theoretically possible that Medeco locks could be bumped (given adequate knowledge beforehand) There is a risk of information leakage in mastered systems

New Approaches

Trap Pins Shallow Drilling Top Gapping Fluids & Gels

slide-75
SLIDE 75

Lockpicking & Physical Security Deviant Ollam

Trap Pins

slide-76
SLIDE 76

Lockpicking & Physical Security Deviant Ollam

Trap Pins

Normal Key Operation

slide-77
SLIDE 77

Lockpicking & Physical Security Deviant Ollam

Trap Pins

Attempt Without a Key

slide-78
SLIDE 78

Lockpicking & Physical Security Deviant Ollam

Trap Pins

A Double-Edged Sword Absolute evidence of any any attempted pick or bypass Only one course of action after trap pins have fired Remove lock from door and replace with a new one Shallow drilling is simpler and

  • ffers more elegant protection…
slide-79
SLIDE 79

Lockpicking & Physical Security Deviant Ollam

Shallow Drilling

Normal pin stack chambers being drilled…

slide-80
SLIDE 80

Lockpicking & Physical Security Deviant Ollam

Shallow Drilling

Notice the difference with shallow drilling…

slide-81
SLIDE 81

Lockpicking & Physical Security Deviant Ollam

Shallow Drilling

Pin stacks have differing heights in their default position

slide-82
SLIDE 82

Lockpicking & Physical Security Deviant Ollam

Shallow Drilling

Attempts at bumping will fail, not all pins touch the key

slide-83
SLIDE 83

Lockpicking & Physical Security Deviant Ollam

Shallow Drilling

No easy, outward evidence of this protection

slide-84
SLIDE 84

Lockpicking & Physical Security Deviant Ollam

Shallow Drilling

Conceivably possible to examine for shallow stacks… … but what then, carry a whole ring of bump keys?

slide-85
SLIDE 85

Lockpicking & Physical Security Deviant Ollam

Top gapping

This design offers the most promise for fully hardening basic pin tumbler locks against the bump key attack.

slide-86
SLIDE 86

Lockpicking & Physical Security Deviant Ollam

Top gapping

Master Lock has published on this topic and begun equipping locks with specialized top pins. Look for part numbers ending with the letter “N” or ask a locksmith.

slide-87
SLIDE 87

Lockpicking & Physical Security Deviant Ollam

Kwikset??

When even this company is making locks designed to prevent bump keying, it’s finally gotten proper attention

slide-88
SLIDE 88

Lockpicking & Physical Security Deviant Ollam

What locks have these countermeasures?

Trap Pins M&C (Mitchel & Collin) "Antiklop" model Shallow Drilling CES (Carl Eduard Schulte) VA5 & VB7 models Top Gapping Master Lock / American Lock (retail or re-pinned) Kwikset "Smart Series" line includes biometric options

slide-89
SLIDE 89

Lockpicking & Physical Security Deviant Ollam

Fluids & Gels

Pickbuster Invented by Mark Garratt Distributed by Almore based in Pontypridd, Wales Impedes Pin Movement Mixed Industry Reaction Pros: inexpensive, simple, bump resistant Cons: not permanent, not perfect, and... Significant concern about fouling Weigh Costs and Benefits Yourself

slide-90
SLIDE 90

Lockpicking & Physical Security Deviant Ollam

  • 9. Large facilities have their own

unique set of pitfalls and concerns

Master keying Interchangeable cores Key control

48:00

slide-91
SLIDE 91

Lockpicking & Physical Security Deviant Ollam

Master Key Theory

Remember standard pin tumbler stacks? Same operation, with extra pin (or “wafer”) in the middle Potential for varied levels of clearance Also potential for many additional shear lines

slide-92
SLIDE 92

Lockpicking & Physical Security Deviant Ollam

Master Pinning

slide-93
SLIDE 93

Lockpicking & Physical Security Deviant Ollam

Master Pinning

User’s “Change” Key

slide-94
SLIDE 94

Lockpicking & Physical Security Deviant Ollam

Master Pinning

Top Master Key

slide-95
SLIDE 95

Lockpicking & Physical Security Deviant Ollam

Master Pinning

Imagine a crafty user…

slide-96
SLIDE 96

Lockpicking & Physical Security Deviant Ollam

Master Pinning

They modify their key… it doesn’t open

slide-97
SLIDE 97

Lockpicking & Physical Security Deviant Ollam

Master Pinning

They modify their key… it doesn’t open

slide-98
SLIDE 98

Lockpicking & Physical Security Deviant Ollam

Master Pinning

They modify their key… it doesn’t open

slide-99
SLIDE 99

Lockpicking & Physical Security Deviant Ollam

Master Pinning

They modify their key… suddenly it opens!

slide-100
SLIDE 100

Lockpicking & Physical Security Deviant Ollam

Master Pinning

This last chamber is now at the “master” height

http://www.crypto.com/papers/mk.pdf

slide-101
SLIDE 101

Lockpicking & Physical Security Deviant Ollam

Master Pinning

This bitting can be measured

http://www.crypto.com/papers/mk.pdf

slide-102
SLIDE 102

Lockpicking & Physical Security Deviant Ollam

Master Pinning

This is how “intermediate master” keying works

Keep in mind… in a large, mastered facility all doors have within them the full top master pinning. Compromise of any single door can give access everywhere.

slide-103
SLIDE 103

Lockpicking & Physical Security Deviant Ollam

SFIC Locks

Small Format Interchangeable Core

BEST Yale Others

Easy to Manage

Plug and pins all eject as a single, contained unit

Hard to Pick

Multiple independent shear lines Keyways are worse than any nightmares you could find at the bottom of a bottle or at the hands of the U.S. Congress

slide-104
SLIDE 104

Lockpicking & Physical Security Deviant Ollam

SFIC Locks

Very popular in large institutions Cores remove with a “control key” Two independent shear lines

Raising pins to one level allows plug to rotate freely Raising pins to other shear line locks plug and control sleeve together and they turn as one, either exposing

  • r retracting core’s retaining tab

Picking attempts typically fail with standard tools

Tension binds across both shear lines

slide-105
SLIDE 105

Lockpicking & Physical Security Deviant Ollam

SFIC Locks

Pin Stacks

core housing control sleeve plug top pins control pins bottom pins

slide-106
SLIDE 106

Lockpicking & Physical Security Deviant Ollam

SFIC Locks

Operating Key

slide-107
SLIDE 107

Lockpicking & Physical Security Deviant Ollam

SFIC Locks

Control Key

slide-108
SLIDE 108

Lockpicking & Physical Security Deviant Ollam

SFIC Locks

Normal picking attempts typically fail

Tension binds across both shear lines Extremely likely to set pins in various places

slide-109
SLIDE 109

Lockpicking & Physical Security Deviant Ollam

SFIC Locks

There are specialized tools

Torsion wrench with “fingers” puts pressure on only one shear line Still very difficult, however, due to tight tolerances and keyways

slide-110
SLIDE 110

Lockpicking & Physical Security Deviant Ollam

SFIC Locks

Matt Blaze’s modified sleeve

Nothing for specialized “finger wrench” to grab

slide-111
SLIDE 111

Lockpicking & Physical Security Deviant Ollam

SFIC Locks

New BEST design

I believe the locks are manufactured this way now

slide-112
SLIDE 112

Lockpicking & Physical Security Deviant Ollam

Key control

Preventing illicit copies Using “restricted” keyways Inability to make blanks E-Z Entrie vs. Side Cuts

slide-113
SLIDE 113

Lockpicking & Physical Security Deviant Ollam

  • 10. Security in the Real World

Technical Finesse or Brute Force

Common criminals do not pick locks A $100 lock in a $10 door is little help

Doors

Solid-core, heavy material Heavy hinges, screws deep into frame Deadbolts with round core(s)

Windows

Break glass to reach knobs Shatterproof film

Visibility

Motion-sensing lights Keep bushes & trees trimmed

55:00

slide-114
SLIDE 114

Lockpicking & Physical Security Deviant Ollam

So what is a “good” lock?

Manufacturers whom I love…

(slider-based sidebar) (sliders & sidebars) Primus (unique sidebar system) (SFICs) (Granit & Diskus) (rotating disk) (shackle-less padlock) (double mushroom pins) (X-07 and X-09 dials) (armory locks, combo locks, safes, deposit boxes)

Good rules of thumb

You get what you pay for Keep the big picture in mind Keep tinkering and questioning

slide-115
SLIDE 115

Lockpicking & Physical Security Deviant Ollam

Security is only as effective… … as the person using it

slide-116
SLIDE 116

Lockpicking & Physical Security Deviant Ollam

A Security Fable

American 700 Padlock

Solid design Serrated pins Interchangeable cores

slide-117
SLIDE 117

Lockpicking & Physical Security Deviant Ollam

A Security Fable

American 700 Padlock

Solid design Serrated pins Interchangeable cores

Core Operation

Back of plug… half circle Control cylinder… quarter circle

slide-118
SLIDE 118

Lockpicking & Physical Security Deviant Ollam

A Security Fable

American 700 Padlock

Solid design Serrated pins Interchangeable cores

Core Operation

Back of plug… half circle Control cylinder… quarter circle

Peterson Bypass Tool

Slips all the way through core Interacts with control cylinder directly

slide-119
SLIDE 119

Lockpicking & Physical Security Deviant Ollam

A Security Fable

American 700 Padlock

Solid design Serrated pins Interchangeable cores

Core Operation

Back of plug… half circle Control cylinder… quarter circle

Peterson Bypass Tool

Slips all the way through core Interacts with control cylinder directly

Security Wafer

slide-120
SLIDE 120

Lockpicking & Physical Security Deviant Ollam

A Security Fable

American 700 Padlock

Solid design Serrated pins Interchangeable cores

Core Operation

Back of plug… half circle Control cylinder… quarter circle

Peterson Bypass Tool

Slips all the way through core Interacts with control cylinder directly

Security Wafer Wafer Breaker Tools

slide-121
SLIDE 121

Lockpicking & Physical Security Deviant Ollam

A Security Fable

American 700 Padlock

Solid design Serrated pins Interchangeable cores

Core Operation

Back of plug… half circle Control cylinder… quarter circle

Peterson Bypass Tool

Slips all the way through core Interacts with control cylinder directly

Security Wafer Wafer Breaker Tools

slide-122
SLIDE 122

Lockpicking & Physical Security Deviant Ollam

A Security Fable

American 700 Padlock

Solid design Serrated pins Interchangeable cores

Core Operation

Back of plug… half circle Control cylinder… quarter circle

Peterson Bypass Tool

Slips all the way through core Interacts with control cylinder directly

Security Wafer Wafer Breaker Tools Shackeless Padlock… the American 2000

slide-123
SLIDE 123

Lockpicking & Physical Security Deviant Ollam

So what is a “good” lock?

Manufacturers whom I love…

(slider-based sidebar) (sliders & sidebars) Primus (unique sidebar system) (SFICs) (Granit & Diskus) (rotating disk) (shackle-less padlock) (double mushroom pins) (X-07 and X-09 dials) (armory locks, combo locks, safes, deposit boxes)

Good rules of thumb

You get what you pay for Keep the big picture in mind Keep tinkering and questioning