Ten Things You Should Know About...
Transcript of Ten Things You Should Know About...
Deviant Ollam and Babak Javadi
http:// toool.us
Ten Things You Should Know About Lockpicking
by Deviant Ollam and Babak Javadi
CONfidence 2011 - Krakow
2011-05-24 ^
Deviant Ollam and Babak Javadi
http:// toool.us
Who are we ?
Deviant Ollam and Babak Javadi
http:// toool.us
auditing
assessments
research
trainings
Who are we ?
Deviant Ollam and Babak Javadi
http:// toool.us
auditing
assessments
research
trainings
workshops
public lectures
lockpick village
contests & games
Who am i ?
Deviant Ollam and Babak Javadi
http:// toool.us
Things You Should Know about Lockpicking… 1. Why locks matter to IT professionals
Deviant Ollam and Babak Javadi
http:// toool.us
Deviant Ollam and Babak Javadi
http:// toool.us
Deviant Ollam and Babak Javadi
http:// toool.us
Deviant Ollam and Babak Javadi
http:// toool.us
Deviant Ollam and Babak Javadi
http:// toool.us
All your hard work here…
Deviant Ollam and Babak Javadi
http:// toool.us
All your hard work here… gets undermined here
Deviant Ollam and Babak Javadi
http:// toool.us
Things You Should Know about Lockpicking… 1. Why locks matter to IT professionals
2. Pin tumblers are universal
Deviant Ollam and Babak Javadi
http:// toool.us
Pin Tumbler Locks
Deviant Ollam and Babak Javadi
http:// toool.us
The View From Outside
Deviant Ollam and Babak Javadi
http:// toool.us
What’s On The Inside
Deviant Ollam and Babak Javadi
http:// toool.us
What’s On The Inside
Deviant Ollam and Babak Javadi
http:// toool.us
What’s On The Inside
Deviant Ollam and Babak Javadi
http:// toool.us
It’s Not Just a Single Pin Stack
Deviant Ollam and Babak Javadi
http:// toool.us
It’s Not Just a Single Pin Stack
Deviant Ollam and Babak Javadi
http:// toool.us
The Key Has To Be Just Right
Deviant Ollam and Babak Javadi
http:// toool.us
The Key Has To Be Just Right
Deviant Ollam and Babak Javadi
http:// toool.us
Things You Should Know about Lockpicking… 1. Why locks matter to IT professionals
2. Pin tumblers are universal
3. Picking is simple and fun
Deviant Ollam and Babak Javadi
http:// toool.us
In An Ideal World …
Deviant Ollam and Babak Javadi
http:// toool.us
In The Real World …
Deviant Ollam and Babak Javadi
http:// toool.us
In The Real World …
Deviant Ollam and Babak Javadi
http:// toool.us
In The Real World …
Deviant Ollam and Babak Javadi
http:// toool.us
Setting a Pin
Deviant Ollam and Babak Javadi
http:// toool.us
Setting a Pin
Deviant Ollam and Babak Javadi
http:// toool.us
Setting the Pins
Deviant Ollam and Babak Javadi
http:// toool.us
Setting the Pins
Deviant Ollam and Babak Javadi
http:// toool.us
And You Can All Do This !
Deviant Ollam and Babak Javadi
http:// toool.us
Things You Should Know about Lockpicking… 1. Why locks matter to IT professionals
2. Pin tumblers are universal
3. Picking is simple and fun
4. Pins are pins, in any arrangement
Deviant Ollam and Babak Javadi
http:// toool.us
Other Ways of Arranging the Pins
Deviant Ollam and Babak Javadi
http:// toool.us
Other Ways of Attacking the Pins
Deviant Ollam and Babak Javadi
http:// toool.us
But what about…
Other Ways of Attacking the Pins
?
Deviant Ollam and Babak Javadi
http:// toool.us
Things You Should Know about Lockpicking… 1. Why locks matter to IT professionals
2. Pin tumblers are universal
3. Picking is simple and fun
4. Pins are pins, in any arrangement
5. Other everyday designs are often weak, too
Deviant Ollam and Babak Javadi
http:// toool.us
Wafer Locks
Deviant Ollam and Babak Javadi
http:// toool.us
Wafer Locks
Deviant Ollam and Babak Javadi
http:// toool.us
Wafer Locks
Deviant Ollam and Babak Javadi
http:// toool.us
Wafer Locks
Deviant Ollam and Babak Javadi
http:// toool.us
Raking & Jiggling
Deviant Ollam and Babak Javadi
http:// toool.us
Raking & Jiggling
Deviant Ollam and Babak Javadi
http:// toool.us
Wafer Lock Usage
Deviant Ollam and Babak Javadi
http:// toool.us
Wafer Lock Usage
Deviant Ollam and Babak Javadi
http:// toool.us
Wafer Lock Usage
Deviant Ollam and Babak Javadi
http:// toool.us
Wafer Lock Usage
Deviant Ollam and Babak Javadi
http:// toool.us
Wafer Lock Usage
Deviant Ollam and Babak Javadi
http:// toool.us
Wafer Lock Usage
Deviant Ollam and Babak Javadi
http:// toool.us
Wafer Lock Usage
Deviant Ollam and Babak Javadi
http:// toool.us
Wafer Lock Usage
Deviant Ollam and Babak Javadi
http:// toool.us
Wafer Lock Usage
Deviant Ollam and Babak Javadi
http:// toool.us
Wafer Lock Usage
Deviant Ollam and Babak Javadi
http:// toool.us
Things You Should Know about Lockpicking… 1. Why locks matter to IT professionals
2. Pin tumblers are universal
3. Picking is simple and fun
4. Pins are pins, in any arrangement
5. Other everyday designs are often weak, too
6. You can open locks with beer and beatings
Deviant Ollam and Babak Javadi
http:// toool.us
Popular Padlocks
Deviant Ollam and Babak Javadi
http:// toool.us
Terrible Padlocks
Deviant Ollam and Babak Javadi
http:// toool.us
Padlock Shims
Deviant Ollam and Babak Javadi
http:// toool.us
Padlock Shims… From a Catalog
Deviant Ollam and Babak Javadi
http:// toool.us
Padlock Shims… From a Beer Can
Deviant Ollam and Babak Javadi
http:// toool.us
Padlock Shims
Deviant Ollam and Babak Javadi
http:// toool.us
Double Ball Mechanism
Padlock Shim Prevention
Deviant Ollam and Babak Javadi
http:// toool.us
Which Padlocks are Protected ?
Padlock Shim Prevention
Deviant Ollam and Babak Javadi
http:// toool.us
Padlock Shim Prevention
Deviant Ollam and Babak Javadi
http:// toool.us
Padlock Shim Prevention
Deviant Ollam and Babak Javadi
http:// toool.us
Bumping
Deviant Ollam and Babak Javadi
http:// toool.us
Bumping
Deviant Ollam and Babak Javadi
http:// toool.us
Bumping
Deviant Ollam and Babak Javadi
http:// toool.us
Bumping
Deviant Ollam and Babak Javadi
http:// toool.us
Bumping
Deviant Ollam and Babak Javadi
http:// toool.us
Bumping
Deviant Ollam and Babak Javadi
http:// toool.us
Bumping
Deviant Ollam and Babak Javadi
http:// toool.us
Things You Should Know about Lockpicking… 1. Why locks matter to IT professionals
2. Pin tumblers are universal
3. Picking is simple and fun
4. Pins are pins, in any arrangement
5. Other everyday designs are often weak, too
6. You can open locks with beer and beatings
7. Many locks are pick resistant
Deviant Ollam and Babak Javadi
http:// toool.us
Pick-Resistant Keyways
Deviant Ollam and Babak Javadi
http:// toool.us
Pick-Resistant Keyways
Deviant Ollam and Babak Javadi
http:// toool.us
Pick-Resistant Keyways
Deviant Ollam and Babak Javadi
http:// toool.us
Pick-Resistant Keyways
Deviant Ollam and Babak Javadi
http:// toool.us
Pick-Resistant Keyways
Deviant Ollam and Babak Javadi
http:// toool.us
Pick-Resistant Pins
Deviant Ollam and Babak Javadi
http:// toool.us
Pick-Resistant Pins
Deviant Ollam and Babak Javadi
http:// toool.us
Pick-Resistant Pins
Deviant Ollam and Babak Javadi
http:// toool.us
Pick-Resistant Pins
Deviant Ollam and Babak Javadi
http:// toool.us
Pick-Resistant Pins
Deviant Ollam and Babak Javadi
http:// toool.us
Pick-Resistant Pins
Deviant Ollam and Babak Javadi
http:// toool.us
Things You Should Know about Lockpicking… 1. Why locks matter to IT professionals
2. Pin tumblers are universal
3. Picking is simple and fun
4. Pins are pins, in any arrangement
5. Other everyday designs are often weak, too
6. You can open locks with beer and beatings
7. Many locks are pick resistant
8. Poor locks spread like a contamination
Deviant Ollam and Babak Javadi
http:// toool.us
Contamination by Poor Locks
Deviant Ollam and Babak Javadi
http:// toool.us
Contamination by Poor Locks
Deviant Ollam and Babak Javadi
http:// toool.us
Contamination by Poor Locks
Deviant Ollam and Babak Javadi
http:// toool.us
Contamination by Poor Locks
Deviant Ollam and Babak Javadi
http:// toool.us
Contamination by Poor Locks
Deviant Ollam and Babak Javadi
http:// toool.us
Contamination by Poor Locks
Deviant Ollam and Babak Javadi
http:// toool.us
Contamination by Poor Locks
Deviant Ollam and Babak Javadi
http:// toool.us
Things You Should Know about Lockpicking… 1. Why locks matter to IT professionals
2. Pin tumblers are universal
3. Picking is simple and fun
4. Pins are pins, in any arrangement
5. Other everyday designs are often weak, too
6. You can open locks with beer and beatings
7. Many locks are pick resistant
8. Poor locks spread like a contamination
9. It comes down to your attackers and defenders
Deviant Ollam and Babak Javadi
http:// toool.us
Deviant Ollam and Babak Javadi
http:// toool.us
Deviant Ollam and Babak Javadi
http:// toool.us
Deviant Ollam and Babak Javadi
http:// toool.us
Deviant Ollam and Babak Javadi
http:// toool.us
Deviant Ollam and Babak Javadi
http:// toool.us
Deviant Ollam and Babak Javadi
http:// toool.us
Most Attacks are Brute Force
Deviant Ollam and Babak Javadi
http:// toool.us
But Covert Entry Is A Risk
Deviant Ollam and Babak Javadi
http:// toool.us
This Lock Did Its Job (sort of)
Deviant Ollam and Babak Javadi
http:// toool.us
High Security Locks as Seals
Deviant Ollam and Babak Javadi
http:// toool.us
Things You Should Know about Lockpicking… 1. Why locks matter to IT professionals
2. Pin tumblers are universal
3. Picking is simple and fun
4. Pins are pins, in any arrangement
5. Other everyday designs are often weak, too
6. You can open locks with beer and beatings
7. Many locks are pick resistant
8. Poor locks spread like a contamination
9. It comes down to your attackers and defenders
10. Many times, the lock isn’t what is attacked
Deviant Ollam and Babak Javadi
http:// toool.us
Bypassing
Deviant Ollam and Babak Javadi
http:// toool.us
Bypassing
Deviant Ollam and Babak Javadi
http:// toool.us
Bypassing
Deviant Ollam and Babak Javadi
http:// toool.us
Bypassing
Deviant Ollam and Babak Javadi
http:// toool.us
Bypassing
Deviant Ollam and Babak Javadi
http:// toool.us
Bypassing
Deviant Ollam and Babak Javadi
http:// toool.us
Bypassing
Deviant Ollam and Babak Javadi
http:// toool.us
Bypassing
Deviant Ollam and Babak Javadi
http:// toool.us
Bypassing
“How To Pwn and Protect Your Office Space”
by Dr. Tran Security B-Sides
Deviant Ollam and Babak Javadi
http:// toool.us
Bypassing
Deviant Ollam and Babak Javadi
http:// toool.us
Bypassing
Deviant Ollam and Babak Javadi
http:// toool.us
So, in conclusion…
Deviant Ollam and Babak Javadi
http:// toool.us
Who’s Behind Your Security?
Deviant Ollam and Babak Javadi
http:// toool.us
Do Your Users Undermine Security?
Deviant Ollam and Babak Javadi
http:// toool.us
Does Your Security Allow for Failure?
Deviant Ollam and Babak Javadi
http:// toool.us
Does Your Security Allow for Failure?
Deviant Ollam and Babak Javadi
http:// toool.us
Fail Happens
Deviant Ollam and Babak Javadi
http:// toool.us
Fail Happens
Deviant Ollam and Babak Javadi
http:// toool.us
Fail Happens
Deviant Ollam and Babak Javadi
http:// toool.us
Fail Happens
Deviant Ollam and Babak Javadi
http:// toool.us
Learn From Your Fail
Deviant Ollam and Babak Javadi
http:// toool.us
So really…what about…
Other Ways of Attacking the Pins
?
Deviant Ollam and Babak Javadi
http:// toool.us
Gerda Tytan Advertisement
Deviant Ollam and Babak Javadi
http:// toool.us
Gerda Tytan ZX
Deviant Ollam and Babak Javadi
http:// toool.us
Gerda Tytan ZX (Side View)
Deviant Ollam and Babak Javadi
http:// toool.us
Gerda Tytan ZX (Rear View)
Deviant Ollam and Babak Javadi
http:// toool.us
Gerda Tytan ZX (Removing the Shroud)
v.s.
Deviant Ollam and Babak Javadi
http:// toool.us
Gerda Tytan ZX (Shroud Removed)
Vertical Mill Wins!
Deviant Ollam and Babak Javadi
http:// toool.us
Gerda Tytan ZX [Has No Clothes]
Deviant Ollam and Babak Javadi
http:// toool.us
Gerda Tytan ZX (Removing the Pins)
v.s.
Deviant Ollam and Babak Javadi
http:// toool.us
Gerda Tytan ZX (Pins Removed)
Drill Press Wins!
Deviant Ollam and Babak Javadi
http:// toool.us
Gerda Tytan ZX Plug (No Pins)
Deviant Ollam and Babak Javadi
http:// toool.us
Gerda Tytan ZX Plug (With Pins)
Deviant Ollam and Babak Javadi
http:// toool.us
Gerda Tytan ZX Plug (With Pins)
Deviant Ollam and Babak Javadi
http:// toool.us
Gerda Tytan ZX Plug (???)
Deviant Ollam and Babak Javadi
http:// toool.us
Gerda Tytan ZX Plug (Sloppy Manufacturing)
+
=
Deviant Ollam and Babak Javadi
http:// toool.us
Gerda Tytan Rearranging Pins, Polish-style
Deviant Ollam and Babak Javadi
http:// toool.us
Gerda Tytan ZX (Pick Tools)
So can you pick it?
Talk to me in a few months.
Deviant Ollam and Babak Javadi
http:// toool.us
Thank you very much.
this presentation is CopyLeft by Deviant Ollam. you are free to reuse any or all of
this material as long as it is attributed and freedom for other s to do the same is maintained
http://deviating.net http://enterthecore.net http://toool.us