Ten Things You Should Know About...

Deviant Ollam and Babak Javadi

http:// toool.us

Ten Things You Should Know About Lockpicking

by Deviant Ollam and Babak Javadi

CONfidence 2011 - Krakow

2011-05-24 ^


http:// toool.us

Who are we ?


http:// toool.us

auditing

assessments

research

trainings

Who are we ?


http:// toool.us

auditing

assessments

research

trainings

workshops

public lectures

lockpick village

contests & games

Who am i ?


http:// toool.us

Things You Should Know about Lockpicking… 1. Why locks matter to IT professionals


http:// toool.us


http:// toool.us

All your hard work here…


http:// toool.us

All your hard work here… gets undermined here


http:// toool.us


2. Pin tumblers are universal


http:// toool.us

Pin Tumbler Locks

../_media/lifting_picking.avi


http:// toool.us

Pin Tumbler Locks


http:// toool.us

The View From Outside


http:// toool.us

What’s On The Inside


http:// toool.us

It’s Not Just a Single Pin Stack


http:// toool.us

The Key Has To Be Just Right


http:// toool.us



3. Picking is simple and fun


http:// toool.us

In An Ideal World …


http:// toool.us

In The Real World …


http:// toool.us

Setting a Pin


http:// toool.us

Setting the Pins


http:// toool.us

And You Can All Do This !


http:// toool.us




4. Pins are pins, in any arrangement


http:// toool.us

Other Ways of Arranging the Pins


http:// toool.us

Other Ways of Attacking the Pins


http:// toool.us

But what about…


?


http:// toool.us





5. Other everyday designs are often weak, too


http:// toool.us

Wafer Locks


http:// toool.us

Raking & Jiggling


http:// toool.us

Wafer Lock Usage


http:// toool.us






6. You can open locks with beer and beatings


http:// toool.us

Popular Padlocks


http:// toool.us

Terrible Padlocks


http:// toool.us

Padlock Shims


http:// toool.us

Padlock Shims… From a Catalog


http:// toool.us

Padlock Shims… From a Beer Can


http:// toool.us

Padlock Shims


http:// toool.us

Double Ball Mechanism

Padlock Shim Prevention


http:// toool.us

Which Padlocks are Protected ?



http:// toool.us



http:// toool.us

Bumping


http:// toool.us







7. Many locks are pick resistant


http:// toool.us

Pick-Resistant Keyways


http:// toool.us

Pick-Resistant Pins


http:// toool.us








8. Poor locks spread like a contamination


http:// toool.us

Contamination by Poor Locks


http:// toool.us









9. It comes down to your attackers and defenders


http:// toool.us


http:// toool.us

Most Attacks are Brute Force


http:// toool.us

But Covert Entry Is A Risk


http:// toool.us

This Lock Did Its Job (sort of)


http:// toool.us

High Security Locks as Seals


http:// toool.us









9. It comes down to your attackers and defenders

10. Many times, the lock isn’t what is attacked


http:// toool.us

Bypassing


http:// toool.us

Bypassing

“How To Pwn and Protect Your Office Space”

by Dr. Tran Security B-Sides


http:// toool.us

Bypassing


http:// toool.us

So, in conclusion…


http:// toool.us

Who’s Behind Your Security?


http:// toool.us

Do Your Users Undermine Security?


http:// toool.us

Does Your Security Allow for Failure?


http:// toool.us

Fail Happens


http:// toool.us

Learn From Your Fail


http:// toool.us

So really…what about…


?


http:// toool.us

Gerda Tytan Advertisement


http:// toool.us

Gerda Tytan ZX


http:// toool.us

Gerda Tytan ZX (Side View)


http:// toool.us

Gerda Tytan ZX (Rear View)


http:// toool.us

Gerda Tytan ZX (Removing the Shroud)

v.s.


http:// toool.us

Gerda Tytan ZX (Shroud Removed)

Vertical Mill Wins!


http:// toool.us

Gerda Tytan ZX [Has No Clothes]


http:// toool.us

Gerda Tytan ZX (Removing the Pins)

v.s.


http:// toool.us

Gerda Tytan ZX (Pins Removed)

Drill Press Wins!


http:// toool.us

Gerda Tytan ZX Plug (No Pins)


http:// toool.us

Gerda Tytan ZX Plug (With Pins)


http:// toool.us

Gerda Tytan ZX Plug (???)


http:// toool.us

Gerda Tytan ZX Plug (Sloppy Manufacturing)

+

=


http:// toool.us

Gerda Tytan Rearranging Pins, Polish-style


http:// toool.us

Gerda Tytan ZX (Pick Tools)

So can you pick it?

Talk to me in a few months.


http:// toool.us

Thank you very much.

this presentation is CopyLeft by Deviant Ollam. you are free to reuse any or all of

this material as long as it is attributed and freedom for other s to do the same is maintained

http://deviating.net http://enterthecore.net http://toool.us

Ten Things You Should Know About...

Documents

Transcript of Ten Things You Should Know About...