Post-its, post-its, post-its everywhere (and how they relate to physical keys)
Weyers, Jos
A password shouldnt be on a post-it note. In plain view. On the console. The password to a locked door is called a key. So if a reporter wants to get the point across that certain people shouldn't have access to a particular key, would it be wise for said reporter to show that key to the world? This talk show how not to run this story, why we should care and maybe make you rethink your physical security a bit.
 Hello, I'm Norse Valles and I'm talking about stuff. I'm a member of Tool and Tool is the open organization of lockpickers. We pick lock for a sport. So we open locks without keys and without force and without damaging it. And we have actual competitions for them. Some competitions are international, so there's championships and everything. If you are trying to pick a lock for sports, there are a couple of rules you should abide by. At least that's how we play it. One, you only pick locks that you own or you have explicit permission from the actual owner that you're allowed to pick that. And if you can help it in any shape, way, or form, try to refrain from picking locks that you rely on. Because at some point you will fail and then you maybe can't open or close your front door, your server room or whatever. That's a problem. So if you live by those rules, you probably will not get into trouble. Furthermore, I'm an active member of Hack 42, which is a hackerspace in Arnhem. We reside at a defunct German military base. We're blurred on Google Earth. It's awesome. And when Hackaday, the American blog, did a tour through Europe to look at hackerspaces, they also visited us. And their first line in their article was like, wow, this is the most awesome space ever. And of course, I can only agree. To start off with my talk, we'll start off with a little video. Music playing Three printing of keys. What has the world come to? Show of hands. Who thinks this is a good idea? I think it's a cool idea. I think it's a cool idea. It's a neat idea, but I don't think it's a smart idea. Well, I don't know. I mean, you're putting your keys in the cloud and God knows where or what's going to happen. Well, the fun thing is this is an ad for a Belgium insurance company that does this on the site. So at least if your house gets looted afterwards, you know, it's going to pay for it. So that's a good thing. What you did see that they put a key on a turning pedestal and took basically took a with a sort of connecting. They took a 3D render of it and from that 3D thing, they went on for that file. And why they had to do this is basically because they're Belgium and Belgium is, as we all know, part of Europe, which is not the USA. And because in if you are in America, you basically, if you want a lock on your front door, you have a couple of choices. That's a quick set. That's a Schlag. That's very expensive. So that's three choices. And basically as a residential area, you probably go for option one or two. So you have a Schlag in a quick set, which kind of limits your choices down. So what you can do then is you don't have to put your key on a turning pedestal and make a complete 3D render for it. One picture can be enough. And there's actually a company who does that, well, who did that. I don't think they're existing anymore. This was Schlussel.com. What they said, just take a picture of your key on a white background, just flat on, click, mail it to us, give us $5 and we'll ship you a copy of that key to your home address. Well, personally, I would not use my home address for that return envelope. But the idea is neat. I mean, so it just takes one picture, click, go, you have a key. Cool, right? And they actually wrote some interesting software for that that analyzes your picture. So they don't make a stupid dupe of the picture you send it. Now, first it figures out what the actual key is and then it starts looking at where the depth should be and what the depth actual is. And what you see at space number one, this one, this one, you see that red line is a bit higher than the actual key is. This is not good. There we are. I don't know. I did nothing. I burned it. So the red line is actually a bit higher than the actual key is. So what they did is they figured out the type of brand of the key and what the original code was. So the gap there is wear and tear of the key. So the copy you receive in the mail probably works better than the original you sent them. I think that's neat. I think that's cool, right? So they just make a duplicate of your key by one picture alone. I believe now they need both sides, but the idea remains the same. They can do it with one. There's actually other companies who expand on that same idea. This is Outbox. They were running in, I believe, only Manhattan because they can't be, it doesn't scale that well, because what they do is basically they are reverse mailmen, a reverse physical snail mail mailman. So they show up at your door and take your paper mail. They take it back to their office. They scan it and they mail it to you electronically. So even if you're not at home, you can reach a spam. Whoa. They probably feed that out, but I'm not sure about that. So they need access to your mailbox, at least. So what they say, again, send us a picture of your lock, of your key. And of course there are several places when you can have your mail. That's in a mailbox that is outside. Maybe that's not locked, so then they're easily done. And if there is a lock in your mailbox, they need a picture of that key. If that's behind the gate at Fence, because that's what most Americans do, they need that key as well. And you have several layers, but they didn't want to go into your house, probably because it's American and they want to get sued or the liability or whatever. So they say if you have your mail, if you have a slit in your door and the mail goes through there, so you need to be behind your front door to actually grab the mail, they'll supply you with a mailbox you can put outside your door. But the idea remains the same. I mean, so you need a picture of a key and they make a copy of it, and then they actually use them in their business proposition. So I think that's cool. Taking pictures of keys and making that. That's not new. That's not new at all. In 2008, the University of California was playing with this device. Let's say, need camera and a kick-ass lens. What you can do with big lenses is take, need pictures and zoom in a bit. That's a terrace. There's a table on the terrace on the table. There's a book on the book. There's a key, and that's the zoom in. You can neatly zoom in with big lenses. Well, you and, of course, we can see that key. Let's focus on that one. The picture is not taken straight on, but that's not really a problem, because if you look at the head of this key, this one, this looks like a K. And if you know your luck, you know that's a quick set. And the fun part about a quick set is we know what the dimensions of that key is, especially from that head, because that head is the same for all the quick sets. Of course, the code is different, but if you keep on distorting and changing the picture, I mean, that's clearly not the key, but if you keep on wrapping it until this is the correct shape, then you know this is the correct shape as well, which you then can decode to the actual code and use a code cutter and run it. That works. So this happens from far away. You just need a big lens. And this was 2008. Lenses improved. CCTV improved. So that happens. Now, for example, this is a picture shot by Ray from Ray as a member of SSDef, which is basically a tool in Germany. It's not the same, but ish. This is 2009 in Haar in Viehouten. Ray, he likes handcuffs. He's a lock picker, but he's especially interested in handcuffs. So he knows his cuffs. And he did bring this key. This is a 3D printed key of the German handcuff keys. And because the handcuffs keys for the German police are all key to like, well, bulk of them are, the normal police, they're all key to like. And if you think for that for a second, you might go, that's stupid. But if you think for a bit longer, that actually makes sense. Because if you get arrested by cop number one, and he cuffs you, puts you in the car and drives you off, hands you at the station, hands you over to another cop, it's quite neat that he can open your cuffs. Otherwise that's going to hurt. So yes, they're key to like. In most countries, that's the case. And Ray was in this big event in the Netherlands. And it's that big that we actually have police working about. Dutch police. And of course, Ray B and Ray, he was like, that's a lips. He instantly recognized the name and brand of the handcuffs that the Dutch policemen were wearing. And the German cuffs are lips also. So he was like, will this key fit on the Dutch cuffs as well? So he went to this police officer and said, dear police officer, can I use this key in your cuffs? And he turned this back to him and said, shut up. Turned his back to him. So which clearly gave a vision of, a visual on the actual key that he was wearing. Well, I'm not saying I can make a key from that picture because it's a bit blurry. It's a bit less blurry here, but you get the idea. But I can see that this is a low, high, bit low and high. Yes? So if I compare that to the original key that we already have, I'm not saying it is the same key, but you can kind of guesstimate that it is, right? I mean, that is information leakage. Just wiggling about your key gives away quite a lot of intel. And a bit later he tried with another cop and he said, yes, show, go ahead and yes, it works. So this is actually the key to all Dutch and German police handcuffs. And the STL, you can download there and you can print your own. Because, well, information wants to be free, right? Different example. This is what I call a typical clean desk environment. It's a mess, but of course, me being a log geek, I see a key. We put a coin there just for scale because if we know the scale, we can do stuff with it. We guessed that this is a cabinet key because there's a cabinet underneath that desk that we kind of want to have opened and, well, it looks like a cheap key. Because it's cheap, we can assess that it probably has weird tolerances. So we don't have to be exact. So what we did, if you print out that picture you just took, if you take the picture that on, you don't have to, you don't have that distorted image anymore. So you just need to size it so that the coin is the correct size. And if you then print it out on paper and put that paper on a sheet of metal and just cut it out, go all kindergarten on it and stay within the perimeters and follow the lines, with some luck, you'll have a, at least you have a metal shape, a piece of metal with roughly the same shape of your key. If you put that in with some luck, that'll open. And that will open your cabinet. But it's fun. I mean, we could have just nicked the key, but this is way more fun. So this works on absolute crappy locks. And, well, talk about crappy locks. This is a TSA approved luggage lock. Actually, these are two locks. Well, this one says Samsung, it doesn't matter, I'm not bashing that brand. I just, well, talking about the idea. This lock, this number lock, that's yours. This one, the lock that actually takes the key, that's not yours. That's from the TSA. Because you do not have a key for this. This is a built-in backdoor for that lock. Because what happened after 9-11, well, especially after 9-11, the TSA, if you fly to or from the US, the TSA wants to look in your baggage. That's fair, I guess. But if, so if you lock your, your locks, if you lock your, your bags, they need to go through those locks. So they just start cutting the locks to get in that. People found that annoying. So some companies like Travel Sentry, this is their logo, they started making and selling locks that had built-in backdoors. That was the feature. This is the backdoor. It's quite, quite certainly not hidden. It's just plainly backdoor. What happens, TSA has a couple of keys, 9 to be exact. This is the number 2, clearly stated on there. So the TSA official just takes out his number 2 key, opens it. That's it. And then there is a papal trail and so they can go through your locks, through your baggage without destroying the locks. Okay. So there are 9 keys that can open all the baggage. So if you have media reports with these kind of pictures, I fringe. It's like, come on guys. Well, I can't really see which number is which, but that's about it. And well, and then again, having an internal document from the TSA leaked on their external website, because, well, because rules and databases and God knows what, this is dead on quite easy. And of course, if you own that lock, you know what this distance is. So you know what the scale of that key is. And because of internet and information, of course, there are 3D printers. And these are the keys to all the baggage. And of course, those are not high security locks. They're not. Well, maybe except the number 6, that one is made by Abbas. That's actually quite hard to pick. The other ones are just stick anything in there and goes. These are actually printable again, downloadable there. You can print your own. That's what we do, share information. So, I mean, like I said, it's not a high security lock, but it gives, it tries to give the user some sense of security, which I think is false. It's a seal at best, because now I can unseal it and seal it. So I refuse to travel with these locks. I just use zip ties. I use weird zip ties that probably are not in possession of other people per se at that moment. And so I use a zip tie as a security seal, not as a deterrent, just a seal. And it works. And I put some spares in the box, and most of the time, TSA just reapplies one of the spares. And I know how many spares I had. So that works. That's my security posture. Another example, in April 2010, some media attention went to this idea. Apparently, you were able to buy a key, a master key, so not just the key, but the key, to all the New York subway stations for only $27. A master key means you can open all the locks. So not just travel for free. Now, shut it down, because you have access to technical cabinets, and God knows what. So exit doors, fire exit, all that kind of stuff, you can open it. And of course, it'd be in post-911, and it'd be in definitely, it'd be in New York. The idea was terrorists, if terrorists get hold of this key, this key, this key. So by stating that the evil guy shouldn't have this key, by that act, they're actually giving it to them. And just in case this picture is not high-res enough to actually read that key, they put it on a map with a known scale. So this is giving it away, because any locksmith should be able to cut a functional key from this. Okay, mind you, this is 2010 when this happened. I give a version of this lecture every now and then. And last month, no, two months ago I was in Los Angeles doing this, and one of the questions was, did they change these locks? And I was like, I don't know. I don't know. Because, well, one, I'm not in New York, so I can't test it. I don't have the key. Well, I do. But then again, rule number one, you can only pick locks that you own, or don't own these. Or you have explicit permission from the only to do. Well, that's probably out of the question, so I don't know. I have no way of telling you that. Until last month, when this media article appeared, the key is $8 all of a sudden. And of course, they had to print that freaking key full size, otherwise the message doesn't come across. So people just found that out. And actually, if you go to the online version of this article and twinkle a bit with the URL, you'll get this picture, which is 300 dpi, high res, definitely enough to actually do that. I mean, come on. You don't need this. It's not needed. Okay, more fail. If you try to skim cards, you can go off-ansion it and make plastic add-ons that look like the real deal and to hide all your electronics. That's quite a cool, but there are better ways to get in. Let's watch a tiny video. Let's bring in NBC Bay Area's investigative reporter Vicky Nguyen. Vicky seems unbelievable that one golden key, so to speak, unlocks so many pumps. We were surprised too, Raju, could call it the key to the kingdom. It is a remnant from back in the day when all gas station pumps were made with the same lock to make it easier for inspections and maintenance. Now those keys are just providing easy access to a very lucrative crime using new high-tech technology, and in the end, we are all on the hook. Hidden behind here, a new Bluetooth-enabled skimmer that can rip off your credit or debit information in seconds. This universal gas pump key is making it even easier for thieves to install these new skimmers. That's not a high-security lock. The bidding is quite obvious, but I also know now exactly which blank to order, because that's a Y11 USA, which costs about 50 cents, I don't know, if you buy them in bulk. But of course, having access to the box that your machinery is in, then you have a box, and you can all your key-loggers and crapware and you can all put inside the box. And it'll look like a real deal, because guess what? It's the real deal. It's the original box. Nobody's going to see that it's a fake, because it's not. The fake is inside. So having one key for all those gas pumps, well, it does make sense, because if you're the engineer who has to maintain all this stuff, you don't want to create of keys, you want one. So there is a, it's always a trade-off. And I think this is the wrong trade-off, because when it goes wrong, it goes wrong in a bad way. All right, suppose you live in New York. New York has a lot of buildings which are high, and suppose you're thinking about a fire in New York. When there's a fire in one of those high buildings, you definitely want the fire people to get into your building. One way of doing that is don't lock your door. It's not the best option, or give them the key. But then again, New York is a big place. So if you, if they would get the keys to those buildings, they would need a separate truck to... So that's, that's, that's annoying. And that goes for every truck, because you never know which truck is the first one there. So you have to double everything. So what they do is they have basically tiny, tiny boxes, tiny vaults that they put outside the building, and they put the key to the building they put in that lock, put in that tiny vault. And those vaults, those are key to like. And if you do it in a wise way, I put some extra alarms on there and some monitoring on that box, that at least all hell breaks loose when that is broken open. So there are a couple of keys, just a handful, that basically are the keys to the city, literally. Of course, these locks get cut by locksmith, and some locksmith, they get out of business because of old age or whatever. This is one. This is a locksmith who used to cut those keys. And he went out of business, and he had some leftover stock. Well, the apocalypse might be coming because a New York Post reporter just scooped a legitimate story. An intrepid reporter for America's third dumbest paper has found a slightly disturbing item for sale on eBay. Former locksmith, Dan and Ferraris, sold the undercover reporter a New York City Fireman's key ring for $150. The keys give the owner the ability to control elevators, circuit breakers, sub-wanderers and traffic lights all over the city. They essentially become the key maker from the matrix reloaded. Media being media, every now and then you see an original story, but both of it is a copy of a copy of a copy, basically like keys. So other media outlets start copying the same story. So this is, you know, having to post actually dead on pictures, white background. Useful. Definitely other media outlets actually copy that again, and they added information. This one actually, these are the keys to the electric fennel. Fire elevator key also works in, where is it? Hold on a second. Well, high-rise, important stuff. Scary stuff. That's the fireman's service key. That's the subway key. We were talking about traffic lights. Turn all the lights red. Turn all the lights green. Remember Hacker, the movie? Brilliant. Fire alarm box sets. So sound the alarm or don't sound the alarm when you actually fire. So, yeah, I mean, you can create chaos with this key set. And of course, the only way to get the story across is by giving out those keys for free, apparently. Okay, this is the logo from a hacker space in Amsterdam called Techink. And, well, I'm a member of Hack 42, which is a different hacker space, also in the Netherlands. And being a, it's not a rivalry, a hacker space. It's a bit more like a sibling. And what do siblings do? They quarrel, right? All in fair and love and stuff like that. Techink got a new space at some point. And of course, with a new space comes a new lock and comes new keys. They were very proud of their new space, which is awesome, absolutely. And so one of our members, which is a regular troll, started calling one of these guys. He's like, are you sure that's a okay lock you have on your new facility? Because we have a member in our team that knows his locks. So if you can just send a picture, then we can assess if it's a decent key or not. And this showed up at the mailbox. Well, it's not a very clear picture, but if I do this... Yeah... I basically end up with that, right? I mean, if it was a high-powered laser, it actually would still be there. Well, this is a vague outline of what the key should look like, ish. So we hooked that up on our newest machine we happen to have, which happened to be a laser cutter. Good thing it wasn't a coffee maker, because that would have been a mess. And what you see happening is it just burns that outline out of a piece of plastic. That piece of plastic is, I don't know, a whole mill thick, so that will never fit, or at least it should never fit, in your keyhole. So, well, actually, that was the label. Now it's the actual burning. We do have some ventilation now. We just got that machine, so we do not want to inhale those fumes. So you end up with a basic outline of the key, which does not fit your keyhole, but it is a basic outline. So what you can do with that... Well, let's wait for the actual burning to stop. Burn, burn, burn, burn. Focus, focus, focus. There we are. See? Basic outline. Picture. There you go. You see, we set it a bit too hard-burned as a shadow, but this is the actual shape. The key, we kind of assessed what the blank was by just by looking at it. So, hooking this piece of plastic into a normal key cutter. Here's our bit of see-through plastic, and that's a normal blank. And you can just do it the way you're used to. And, well, did it work or not? As I was not a member at that time, I couldn't assess that, because rule number one, it's not my luck, no permission. But being a hackerspace, which is all information, wants to be free, we put this whole video and all the specs on our public wiki, of course. Well, that's what you do, right? Well, some people freaked out. It's all for play, so the day after we showed up with a decent luck, and 80 copies of the keys so they can redistribute that. And then they said, so now we have a good luck. You can't get into a door again. I said, who supplied you that luck? Off-hooking game. I became a member and they even gave me a discount, because, well, you didn't have to give me a key anymore, did they? So that was good. Cool. Speedcams. Fun, right? Let's do the video first. Keys and a cylinder lock. According to the mail, this is in the flyer. And I can open the flyer with these keys. And how much did it cost? It cost 14 euros and 23 cents. If this works for 14 euros and 23 cents, that's also a lot cheaper than a flyer's boots. This is the one. This one. There have been a lot of actions in Flanders to change this flyer. We shot it, we burned it, we even stuck it. But actually, according to our mail writer, all of this is not needed. Because the secret of this flyer is in this box. This robust box is the remote control, the electronic power of that flyer. This key, that you can make this combination with it, and then you open it. The key fits. The door opens. Here you can just put it on and off automatically. Let's close this. Finally, completely new. This is very cool. This is cool. Did not change that combo. That's leaving default password as default password. That's exactly the same as they did. That's weird. But I didn't want to buy those locks with those keys. I just want to assess if I can make a working key from the stills we got from that moving video. We got this one. I can get some info, but not all that I need. We got another one. That's doable. I think this is the money shot. It's kind of straight on. It kind of gives the shadows a nice, so we can see the depth. If you know your locks, this is a quite peculiar shaped head. If you know your lock, you see that's a BKS. That's a BKS head, because that's the only one I know that has this head. Again, a BKS has the standard size, so we can see what the rest of the key should look like. Actually, this is basically the style sheet for a BKS. The head should be here. These are where the positions are. These are the possible depths. If you keep looking to this picture and compare to that, you can kind of guesstimate what the actual depth should be. We came up with this. We guessed and assessed, basically. It's a guesstimate. We think this is the lock to all the Belgium speedcamps. Of course, rule number one, can't pick it, because I don't own it, or I have explicit permission from the owner to actually try that. Well, that's probably how to the question, right? So what to do? So we bought a speedcam, right? And yeah, it works. This is actually the key to all the Belgium speedcamps, so maybe we shouldn't show it. Well, so we're talking about pictures of keys, that that's a bad thing. But actually having hold of that key, even for a split second, that's the golden ticket, right? So now you can do stuff. Of course, you can run to the coffee shop and have it cut. But there are ways to protect from that. I mean, one way is if you look at your keyway, and there's a certain swerve in your keyway, if you get all intricate with that, so make weird swerves and you pattern those forms, some other people are not allowed to sell keys that look the same. And if you use a very weird shape and only use that for your installation, it's going to be harder to get fitting pieces of metal who go into the lock. Normally, if you play nice. But then there are boxes like this. This is a key cutter, but it works in another direction, basically. This is an easy entry machine, it costs a couple of thousand dollars, well, euros or whatever, and which is some money, but it depends how determined your attacker is. For a sports lock picker, that's an investment, which we made because we want to have that box. It's a cool machine. It takes slugs of brass, look like this, smiley face is always good. What it does, it cuts keys. But a normal key cutter would go in that direction and duplicate that. This one takes those grooves and duplicates those. There's a zoom. You see, it just mills out these grooves. And so you end up with a blank key that you have to put on another key-covering machine that does the sides. And then you open and then you end up with a working key. It's fun. It's a very expensive way of duplicating keys, but if you have a key that's hard to duplicate or buy a normal service because you can't get the blanks, this is a way to go. It's a fun machine. Kind of cool. Tin soldiers. How are tin soldiers made? Anyone? That's the material. How are they made? They're cast. And they're melted, of course, because that's part of the casting. They're cast. So if you can make a cast of a metal, if you can make a cast of your key, which we'll hold it, something's out in here. Still here? Yep. If you can make a cast of your key, you can pour metal in there, right? If you have to go crack stuff. And you can go quite fancy with that. So we tried a very cheap set, comparably. This is just regular clay. We went to the hobby shop and bought all the clay, basically, to figure out what the correct clay is. It takes some research to figure out what it is, because if it's too solid, then it won't take an imprint. And if it's too soft, it'll smudge it a bit. But, well, if you're buying clay, that's not an investment. Come on. And, well, there's a piece of metal that we haven't figured out, actually, what it actually is, because it has a very, very low melting point. It's not lead, because that would be unhealthy. But it's, I don't know, whatever. And we just tried it with a normal, quite good key, not a high security one, but a quite normal average key on one of our friends on his kitchen table. We just tried it there, and it worked first time, first time with Charm. And it's brilliant. It even works with that. And if you go a bit more high secure, then that clay probably won't do. So you need a material that basically has a higher resolution than normal clay. What we found out is that your dentist used a two-component putty, basically, to take impressionings for your teeth. That's awesome stuff. It doesn't melt or shrink when it's heated or cooled down. So that's, well, because that would be weird, because then your key would be different size. So that's good stuff. It's quite expensive, though. So befriend a dentist is always a good thing. You end up with stuff like this. That's the original key. And you can imagine, I mean, this is not a high security key, but it's a different key. Actually, the talk after my talk will be about keys like this. On a normal key duplication machine, the one that normally cuts like this, this is going to be impossible to do with that. It's just a different type of machine. I'm not saying it's a better lock, but it's different. And so a normal key cutter won't be able to do this. But of course, you can pour that. And if you take it out of the mold carefully without destroying that mold, then you can retry, because the mold is still intact. You can just melt this one and redo it. And then you're golden. So you can keep on doing it over and over. This actually works. We tried this. OK, another one. This is the ID of Rob Grongeijp. You probably have no idea who the fuck Rob Grongeijp is. But if you were Dutch, you would have known. Rob is the most well-known hacker of the Netherlands. He's basically one of the driving forces behind that we're not using computers to vote for parliament these days, which is Jaffer Rob. And he founded our first commercial, well, public ISP. So he's one of the good guys. And he's a hacker. So he knows his operational security, you would think. These guys knows risks, knows risk profiles. He should know better than show keys in public. Let's see what that goes. And he wants to make sure that there are all sorts of interesting things under this station. Shards, bunkers, extremely exciting. Especially at that time, it's really great. I'm going to go in. We're standing in the lift. I'm not going to push the button. I can turn the switch on. It's going to be very close again. No, we're not going to the tree. We're going to be lucky that the light is on. We're just going to keep going. I'm going to go deeper and deeper. The room is really light. Great. Oh, I lost it. And then you have hackers in your super secret nuclear facility. What's wrong with this picture? It's a bit out of focus. It's not that on. There's no chance in hell that this is the actual key. Because this is a double-bitted key. This is a cabinet lock. This is just a key he happened to have in his pocket. And he showed it to the camera. You didn't know that, did you? It took nothing away from the story to lie. So this guy has excellent operational security. The journalist is happy because he has his footage. The audience is happy because the attention is still there. You didn't know it was a fake. It's just a prop. Security is not compromised. The story is still there. He's not showing keys. Not showing keys is a good idea. Other ways of not showing keys is this is a key pass. No, a key port is the term. It's actually basically a box that you slip your keys in and out of. This one is branded Defcon 22 because it's a fail. And that's what I like. I like fails. What it is, it is a box. It's a neat idea. So you can put USB things in it, but it's about the keys that you just slid in there. So it's basically an intricate way of keeping your keys in your pocket. So you only slide them out when you use them so nobody can see them if they're looking. And so what they do, they don't cut your keys, but they send you the blanks with this adapter basically. So they need to figure out what your actual keys are. So of course, what do they need? They need a picture of your key. So you're selling it to Defcon 22 attendees who are paranoid, rightfully so, and you're selling it to the upper paranoid there because they know they don't have to show their keys, and you're asking them to send pictures of their keys. That's wrong. Well, for granted, in the small print it says for extra added security, you should maybe blur or blind the actual teeth on your lock. But that should not be added security. Come on, guys, you're selling a security product. That should be the default. That should be the only way you can upload pictures of your keys. Come on, get out of here. So we did figure out that this is probably not the best idea of the world, right? I mean, Post-it should not be on consoles. There should not be passwords on Post-its. That's not going to happen. So this is wrong, right? Well, this is a website called pleasebreak.in. What it does is basically a Twitter feed grabber, and every time you tweet a picture and say, Newhouse and keys in that tweet, it gets added to this site. So we have, and of course these are all click-through, so if you click on one of these pictures, you will get the key, the house, which is, and that picture is probably geotagged, right? And if it's not, I'm pretty sure someone can write a Google Street View add-on that can grab pictures and compare to that. We only have to look at Turlock, which I have no idea how big that city is, but this is doable, and you have access to this guy's Twitter feed, so you probably know when he's on holiday, and he just had a new house, so it's probably filled to the brim with new, shiny toys. Come on, this is given away, don't do this, this is wrong. So, like I said, showing pictures of keys is wrong, but then taking pictures of keys or having pictures taken while you're using that key, it gets harder and harder. If you happen to live in London, you're surrounded by a gazillion CCTV camps that basically watch you every time, right? And of course there's Google Glass, well, we don't see it that often now, but something like that will evolve, so we're already looking at contact lenses, so we haven't got the clue if somebody's actually looking at you or not, or taping or recording it, and we all have pretty capable cameras in our pocket right now. Well, those tracking devices are called cameras, our core telephones, but they're cameras as well, right? And they're high-res enough to do this stuff. So, when I was younger, and we stopped using cash money, basically, and there was a TV series that basically showed us if you're pinching in your PIN code for your plastic money, shield your numbers. A PIN code. A key is basically a code to that lock, so, I mean, don't show it. You saw Rob doing it in that video when he actually was operating that elevator, you didn't see that key in the clear. Just slide it a bit. Okay, I got one more fail and they were done, so that I don't want to keep you away from the drinks. This is a bad guy. This is actually a killer. I know that because he got convicted for killing people. He went to jail for killing people, and he walked out of jail because the design of the master key was printed on front of the prisoner's information handbook. A copy of the upset book was given to all inmates upon arrival of that facility. So, it's, I don't know, so security can be hard, and security can be easy, but for some weird reason it's always quite easy to fuck it up. So, that's me. Any questions? That's me. I'm done.
 Hello, I'm Norse Valles and I'm talking about stuff.  I'm a member of Tool and Tool is the open organization of lockpickers.  We pick lock for a sport. So we open locks without keys and without force and without damaging it.  And we have actual competitions for them. Some competitions are international, so there's championships and everything.  If you are trying to pick a lock for sports, there are a couple of rules you should abide by.  At least that's how we play it. One, you only pick locks that you own or you have explicit permission from the actual owner that you're allowed to pick that.  And if you can help it in any shape, way, or form, try to refrain from picking locks that you rely on.  Because at some point you will fail and then you maybe can't open or close your front door, your server room or whatever.  That's a problem. So if you live by those rules, you probably will not get into trouble.  Furthermore, I'm an active member of Hack 42, which is a hackerspace in Arnhem.  We reside at a defunct German military base. We're blurred on Google Earth. It's awesome.  And when Hackaday, the American blog, did a tour through Europe to look at hackerspaces, they also visited us.  And their first line in their article was like, wow, this is the most awesome space ever.  And of course, I can only agree. To start off with my talk, we'll start off with a little video.  Music playing  Three printing of keys. What has the world come to?  Show of hands. Who thinks this is a good idea? I think it's a cool idea.  I think it's a cool idea. It's a neat idea, but I don't think it's a smart idea.  Well, I don't know. I mean, you're putting your keys in the cloud and God knows where or what's going to happen.  Well, the fun thing is this is an ad for a Belgium insurance company that does this on the site.  So at least if your house gets looted afterwards, you know, it's going to pay for it. So that's a good thing.  What you did see that they put a key on a turning pedestal and took basically took a with a sort of connecting.  They took a 3D render of it and from that 3D thing, they went on for that file.  And why they had to do this is basically because they're Belgium and Belgium is, as we all know, part of Europe,  which is not the USA. And because in if you are in America, you basically, if you want a lock on your front door,  you have a couple of choices. That's a quick set. That's a Schlag. That's very expensive.  So that's three choices. And basically as a residential area, you probably go for option one or two.  So you have a Schlag in a quick set, which kind of limits your choices down.  So what you can do then is you don't have to put your key on a turning pedestal and make a complete 3D render for it.  One picture can be enough. And there's actually a company who does that, well, who did that. I don't think they're existing anymore.  This was Schlussel.com. What they said, just take a picture of your key on a white background, just flat on, click, mail it to us,  give us $5 and we'll ship you a copy of that key to your home address.  Well, personally, I would not use my home address for that return envelope.  But the idea is neat. I mean, so it just takes one picture, click, go, you have a key.  Cool, right? And they actually wrote some interesting software for that that analyzes your picture.  So they don't make a stupid dupe of the picture you send it.  Now, first it figures out what the actual key is and then it starts looking at where the depth should be and what the depth actual is.  And what you see at space number one, this one, this one, you see that red line is a bit higher than the actual key is.  This is not good. There we are. I don't know. I did nothing. I burned it.  So the red line is actually a bit higher than the actual key is.  So what they did is they figured out the type of brand of the key and what the original code was.  So the gap there is wear and tear of the key.  So the copy you receive in the mail probably works better than the original you sent them.  I think that's neat. I think that's cool, right?  So they just make a duplicate of your key by one picture alone.  I believe now they need both sides, but the idea remains the same. They can do it with one.  There's actually other companies who expand on that same idea.  This is Outbox. They were running in, I believe, only Manhattan because they can't be, it doesn't scale that well,  because what they do is basically they are reverse mailmen, a reverse physical snail mail mailman.  So they show up at your door and take your paper mail.  They take it back to their office. They scan it and they mail it to you electronically.  So even if you're not at home, you can reach a spam.  Whoa. They probably feed that out, but I'm not sure about that.  So they need access to your mailbox, at least.  So what they say, again, send us a picture of your lock, of your key.  And of course there are several places when you can have your mail.  That's in a mailbox that is outside. Maybe that's not locked, so then they're easily done.  And if there is a lock in your mailbox, they need a picture of that key.  If that's behind the gate at Fence, because that's what most Americans do, they need that key as well.  And you have several layers, but they didn't want to go into your house,  probably because it's American and they want to get sued or the liability or whatever.  So they say if you have your mail, if you have a slit in your door and the mail goes through there,  so you need to be behind your front door to actually grab the mail,  they'll supply you with a mailbox you can put outside your door.  But the idea remains the same. I mean, so you need a picture of a key and they make a copy of it,  and then they actually use them in their business proposition.  So I think that's cool.  Taking pictures of keys and making that. That's not new. That's not new at all.  In 2008, the University of California was playing with this device.  Let's say, need camera and a kick-ass lens.  What you can do with big lenses is take, need pictures and zoom in a bit.  That's a terrace. There's a table on the terrace on the table.  There's a book on the book. There's a key, and that's the zoom in.  You can neatly zoom in with big lenses.  Well, you and, of course, we can see that key. Let's focus on that one.  The picture is not taken straight on, but that's not really a problem,  because if you look at the head of this key, this one, this looks like a K.  And if you know your luck, you know that's a quick set.  And the fun part about a quick set is we know what the dimensions of that key is,  especially from that head, because that head is the same for all the quick sets.  Of course, the code is different, but if you keep on distorting and changing the picture,  I mean, that's clearly not the key, but if you keep on wrapping it until this is the correct shape,  then you know this is the correct shape as well,  which you then can decode to the actual code and use a code cutter and run it.  That works. So this happens from far away. You just need a big lens.  And this was 2008. Lenses improved. CCTV improved. So that happens.  Now, for example, this is a picture shot by Ray from Ray as a member of SSDef,  which is basically a tool in Germany. It's not the same, but ish.  This is 2009 in Haar in Viehouten.  Ray, he likes handcuffs. He's a lock picker, but he's especially interested in handcuffs.  So he knows his cuffs. And he did bring this key.  This is a 3D printed key of the German handcuff keys.  And because the handcuffs keys for the German police are all key to like,  well, bulk of them are, the normal police, they're all key to like.  And if you think for that for a second, you might go, that's stupid.  But if you think for a bit longer, that actually makes sense.  Because if you get arrested by cop number one, and he cuffs you, puts you in the car and drives you off,  hands you at the station, hands you over to another cop, it's quite neat that he can open your cuffs.  Otherwise that's going to hurt.  So yes, they're key to like. In most countries, that's the case.  And Ray was in this big event in the Netherlands.  And it's that big that we actually have police working about.  Dutch police. And of course, Ray B and Ray, he was like, that's a lips.  He instantly recognized the name and brand of the handcuffs that the Dutch policemen were wearing.  And the German cuffs are lips also.  So he was like, will this key fit on the Dutch cuffs as well?  So he went to this police officer and said, dear police officer, can I use this key in your cuffs?  And he turned this back to him and said, shut up. Turned his back to him.  So which clearly gave a vision of, a visual on the actual key that he was wearing.  Well, I'm not saying I can make a key from that picture because it's a bit blurry.  It's a bit less blurry here, but you get the idea.  But I can see that this is a low, high, bit low and high. Yes?  So if I compare that to the original key that we already have,  I'm not saying it is the same key, but you can kind of guesstimate that it is, right?  I mean, that is information leakage. Just wiggling about your key gives away quite a lot of intel.  And a bit later he tried with another cop and he said, yes, show, go ahead and yes, it works.  So this is actually the key to all Dutch and German police handcuffs.  And the STL, you can download there and you can print your own.  Because, well, information wants to be free, right?  Different example. This is what I call a typical clean desk environment.  It's a mess, but of course, me being a log geek, I see a key.  We put a coin there just for scale because if we know the scale, we can do stuff with it.  We guessed that this is a cabinet key because there's a cabinet underneath that desk  that we kind of want to have opened and, well, it looks like a cheap key.  Because it's cheap, we can assess that it probably has weird tolerances.  So we don't have to be exact.  So what we did, if you print out that picture you just took, if you take the picture that on,  you don't have to, you don't have that distorted image anymore.  So you just need to size it so that the coin is the correct size.  And if you then print it out on paper and put that paper on a sheet of metal  and just cut it out, go all kindergarten on it and stay within the perimeters and follow the lines,  with some luck, you'll have a, at least you have a metal shape, a piece of metal with roughly the same shape of your key.  If you put that in with some luck, that'll open.  And that will open your cabinet.  But it's fun.  I mean, we could have just nicked the key, but this is way more fun.  So this works on absolute crappy locks.  And, well, talk about crappy locks.  This is a TSA approved luggage lock.  Actually, these are two locks.  Well, this one says Samsung, it doesn't matter, I'm not bashing that brand.  I just, well, talking about the idea.  This lock, this number lock, that's yours.  This one, the lock that actually takes the key, that's not yours.  That's from the TSA.  Because you do not have a key for this.  This is a built-in backdoor for that lock.  Because what happened after 9-11, well, especially after 9-11, the TSA, if you fly to or from the US,  the TSA wants to look in your baggage.  That's fair, I guess.  But if, so if you lock your, your locks, if you lock your, your bags, they need to go through those locks.  So they just start cutting the locks to get in that.  People found that annoying.  So some companies like Travel Sentry, this is their logo,  they started making and selling locks that had built-in backdoors.  That was the feature.  This is the backdoor.  It's quite, quite certainly not hidden.  It's just plainly backdoor.  What happens, TSA has a couple of keys, 9 to be exact.  This is the number 2, clearly stated on there.  So the TSA official just takes out his number 2 key, opens it.  That's it.  And then there is a papal trail and so they can go through your locks, through your baggage without destroying the locks.  Okay.  So there are 9 keys that can open all the baggage.  So if you have media reports with these kind of pictures, I fringe.  It's like, come on guys.  Well, I can't really see which number is which, but that's about it.  And well, and then again, having an internal document from the TSA leaked on their external website,  because, well, because rules and databases and God knows what, this is dead on quite easy.  And of course, if you own that lock, you know what this distance is.  So you know what the scale of that key is.  And because of internet and information, of course, there are 3D printers.  And these are the keys to all the baggage.  And of course, those are not high security locks.  They're not.  Well, maybe except the number 6, that one is made by Abbas.  That's actually quite hard to pick.  The other ones are just stick anything in there and goes.  These are actually printable again, downloadable there.  You can print your own.  That's what we do, share information.  So, I mean, like I said, it's not a high security lock, but it gives, it tries to give the user some sense of security,  which I think is false.  It's a seal at best, because now I can unseal it and seal it.  So I refuse to travel with these locks.  I just use zip ties.  I use weird zip ties that probably are not in possession of other people per se at that moment.  And so I use a zip tie as a security seal, not as a deterrent, just a seal.  And it works.  And I put some spares in the box, and most of the time, TSA just reapplies one of the spares.  And I know how many spares I had.  So that works.  That's my security posture.  Another example, in April 2010, some media attention went to this idea.  Apparently, you were able to buy a key, a master key, so not just the key, but the key, to all the New York subway stations for only $27.  A master key means you can open all the locks.  So not just travel for free.  Now, shut it down, because you have access to technical cabinets, and God knows what.  So exit doors, fire exit, all that kind of stuff, you can open it.  And of course, it'd be in post-911, and it'd be in definitely, it'd be in New York.  The idea was terrorists, if terrorists get hold of this key, this key, this key.  So by stating that the evil guy shouldn't have this key, by that act, they're actually giving it to them.  And just in case this picture is not high-res enough to actually read that key, they put it on a map with a known scale.  So this is giving it away, because any locksmith should be able to cut a functional key from this.  Okay, mind you, this is 2010 when this happened.  I give a version of this lecture every now and then.  And last month, no, two months ago I was in Los Angeles doing this, and one of the questions was, did they change these locks?  And I was like, I don't know. I don't know.  Because, well, one, I'm not in New York, so I can't test it.  I don't have the key. Well, I do.  But then again, rule number one, you can only pick locks that you own, or don't own these.  Or you have explicit permission from the only to do. Well, that's probably out of the question, so I don't know.  I have no way of telling you that.  Until last month, when this media article appeared, the key is $8 all of a sudden.  And of course, they had to print that freaking key full size, otherwise the message doesn't come across.  So people just found that out.  And actually, if you go to the online version of this article and twinkle a bit with the URL,  you'll get this picture, which is 300 dpi, high res, definitely enough to actually do that.  I mean, come on. You don't need this. It's not needed.  Okay, more fail. If you try to skim cards, you can go off-ansion it and make plastic add-ons that look like the real deal  and to hide all your electronics. That's quite a cool, but there are better ways to get in.  Let's watch a tiny video.  Let's bring in NBC Bay Area's investigative reporter Vicky Nguyen.  Vicky seems unbelievable that one golden key, so to speak, unlocks so many pumps.  We were surprised too, Raju, could call it the key to the kingdom.  It is a remnant from back in the day when all gas station pumps were made with the same lock to make it easier for inspections and maintenance.  Now those keys are just providing easy access to a very lucrative crime using new high-tech technology,  and in the end, we are all on the hook.  Hidden behind here, a new Bluetooth-enabled skimmer that can rip off your credit or debit information in seconds.  This universal gas pump key is making it even easier for thieves to install these new skimmers.  That's not a high-security lock.  The bidding is quite obvious, but I also know now exactly which blank to order,  because that's a Y11 USA, which costs about 50 cents, I don't know, if you buy them in bulk.  But of course, having access to the box that your machinery is in, then you have a box,  and you can all your key-loggers and crapware and you can all put inside the box.  And it'll look like a real deal, because guess what? It's the real deal.  It's the original box. Nobody's going to see that it's a fake, because it's not.  The fake is inside.  So having one key for all those gas pumps, well, it does make sense,  because if you're the engineer who has to maintain all this stuff, you don't want to create of keys, you want one.  So there is a, it's always a trade-off.  And I think this is the wrong trade-off, because when it goes wrong, it goes wrong in a bad way.  All right, suppose you live in New York.  New York has a lot of buildings which are high, and suppose you're thinking about a fire in New York.  When there's a fire in one of those high buildings, you definitely want the fire people to get into your building.  One way of doing that is don't lock your door.  It's not the best option, or give them the key.  But then again, New York is a big place.  So if you, if they would get the keys to those buildings, they would need a separate truck to...  So that's, that's, that's annoying.  And that goes for every truck, because you never know which truck is the first one there.  So you have to double everything.  So what they do is they have basically tiny, tiny boxes, tiny vaults that they put outside the building,  and they put the key to the building they put in that lock, put in that tiny vault.  And those vaults, those are key to like.  And if you do it in a wise way, I put some extra alarms on there and some monitoring on that box,  that at least all hell breaks loose when that is broken open.  So there are a couple of keys, just a handful, that basically are the keys to the city, literally.  Of course, these locks get cut by locksmith, and some locksmith, they get out of business because of old age or whatever.  This is one. This is a locksmith who used to cut those keys.  And he went out of business, and he had some leftover stock.  Well, the apocalypse might be coming because a New York Post reporter just scooped a legitimate story.  An intrepid reporter for America's third dumbest paper has found a slightly disturbing item for sale on eBay.  Former locksmith, Dan and Ferraris, sold the undercover reporter a New York City Fireman's key ring for $150.  The keys give the owner the ability to control elevators, circuit breakers, sub-wanderers and traffic lights all over the city.  They essentially become the key maker from the matrix reloaded.  Media being media, every now and then you see an original story, but both of it is a copy of a copy of a copy, basically like keys.  So other media outlets start copying the same story.  So this is, you know, having to post actually dead on pictures, white background.  Useful. Definitely other media outlets actually copy that again, and they added information.  This one actually, these are the keys to the electric fennel. Fire elevator key also works in, where is it? Hold on a second.  Well, high-rise, important stuff. Scary stuff.  That's the fireman's service key. That's the subway key. We were talking about traffic lights. Turn all the lights red. Turn all the lights green.  Remember Hacker, the movie? Brilliant. Fire alarm box sets.  So sound the alarm or don't sound the alarm when you actually fire.  So, yeah, I mean, you can create chaos with this key set.  And of course, the only way to get the story across is by giving out those keys for free, apparently.  Okay, this is the logo from a hacker space in Amsterdam called Techink.  And, well, I'm a member of Hack 42, which is a different hacker space, also in the Netherlands.  And being a, it's not a rivalry, a hacker space. It's a bit more like a sibling.  And what do siblings do? They quarrel, right? All in fair and love and stuff like that.  Techink got a new space at some point. And of course, with a new space comes a new lock and comes new keys.  They were very proud of their new space, which is awesome, absolutely.  And so one of our members, which is a regular troll, started calling one of these guys.  He's like, are you sure that's a okay lock you have on your new facility?  Because we have a member in our team that knows his locks.  So if you can just send a picture, then we can assess if it's a decent key or not.  And this showed up at the mailbox.  Well, it's not a very clear picture, but if I do this...  Yeah...  I basically end up with that, right?  I mean, if it was a high-powered laser, it actually would still be there.  Well, this is a vague outline of what the key should look like, ish.  So we hooked that up on our newest machine we happen to have, which happened to be a laser cutter.  Good thing it wasn't a coffee maker, because that would have been a mess.  And what you see happening is it just burns that outline out of a piece of plastic.  That piece of plastic is, I don't know, a whole mill thick, so that will never fit, or at least it should never fit, in your keyhole.  So, well, actually, that was the label. Now it's the actual burning.  We do have some ventilation now. We just got that machine, so we do not want to inhale those fumes.  So you end up with a basic outline of the key, which does not fit your keyhole, but it is a basic outline.  So what you can do with that...  Well, let's wait for the actual burning to stop.  Burn, burn, burn, burn. Focus, focus, focus.  There we are. See? Basic outline.  Picture. There you go. You see, we set it a bit too hard-burned as a shadow, but this is the actual shape.  The key, we kind of assessed what the blank was by just by looking at it.  So, hooking this piece of plastic into a normal key cutter.  Here's our bit of see-through plastic, and that's a normal blank.  And you can just do it the way you're used to.  And, well, did it work or not? As I was not a member at that time, I couldn't assess that,  because rule number one, it's not my luck, no permission.  But being a hackerspace, which is all information, wants to be free, we put this whole video and all the specs on our public wiki, of course.  Well, that's what you do, right? Well, some people freaked out.  It's all for play, so the day after we showed up with a decent luck, and 80 copies of the keys so they can redistribute that.  And then they said, so now we have a good luck. You can't get into a door again.  I said, who supplied you that luck?  Off-hooking game. I became a member and they even gave me a discount, because, well, you didn't have to give me a key anymore, did they?  So that was good. Cool.  Speedcams. Fun, right?  Let's do the video first.  Keys and a cylinder lock.  According to the mail, this is in the flyer. And I can open the flyer with these keys.  And how much did it cost? It cost 14 euros and 23 cents.  If this works for 14 euros and 23 cents, that's also a lot cheaper than a flyer's boots.  This is the one. This one. There have been a lot of actions in Flanders to change this flyer.  We shot it, we burned it, we even stuck it.  But actually, according to our mail writer, all of this is not needed.  Because the secret of this flyer is in this box.  This robust box is the remote control, the electronic power of that flyer.  This key, that you can make this combination with it, and then you open it.  The key fits.  The door opens.  Here you can just put it on and off automatically.  Let's close this.  Finally, completely new.  This is very cool. This is cool.  Did not change that combo.  That's leaving default password as default password. That's exactly the same as they did.  That's weird. But I didn't want to buy those locks with those keys.  I just want to assess if I can make a working key from the stills we got from that moving video.  We got this one. I can get some info, but not all that I need.  We got another one.  That's doable.  I think this is the money shot.  It's kind of straight on. It kind of gives the shadows a nice, so we can see the depth.  If you know your locks, this is a quite peculiar shaped head.  If you know your lock, you see that's a BKS.  That's a BKS head, because that's the only one I know that has this head.  Again, a BKS has the standard size, so we can see what the rest of the key should look like.  Actually, this is basically the style sheet for a BKS. The head should be here.  These are where the positions are. These are the possible depths.  If you keep looking to this picture and compare to that, you can kind of guesstimate what the actual depth should be.  We came up with this.  We guessed and assessed, basically. It's a guesstimate.  We think this is the lock to all the Belgium speedcamps.  Of course, rule number one, can't pick it, because I don't own it, or I have explicit permission from the owner to actually try that.  Well, that's probably how to the question, right?  So what to do? So we bought a speedcam, right?  And yeah, it works.  This is actually the key to all the Belgium speedcamps, so maybe we shouldn't show it.  Well, so we're talking about pictures of keys, that that's a bad thing.  But actually having hold of that key, even for a split second, that's the golden ticket, right?  So now you can do stuff.  Of course, you can run to the coffee shop and have it cut.  But there are ways to protect from that.  I mean, one way is if you look at your keyway, and there's a certain swerve in your keyway,  if you get all intricate with that, so make weird swerves and you pattern those forms,  some other people are not allowed to sell keys that look the same.  And if you use a very weird shape and only use that for your installation,  it's going to be harder to get fitting pieces of metal who go into the lock.  Normally, if you play nice.  But then there are boxes like this.  This is a key cutter, but it works in another direction, basically.  This is an easy entry machine, it costs a couple of thousand dollars, well, euros or whatever,  and which is some money, but it depends how determined your attacker is.  For a sports lock picker, that's an investment, which we made because we want to have that box.  It's a cool machine.  It takes slugs of brass, look like this, smiley face is always good.  What it does, it cuts keys.  But a normal key cutter would go in that direction and duplicate that.  This one takes those grooves and duplicates those.  There's a zoom.  You see, it just mills out these grooves.  And so you end up with a blank key that you have to put on another key-covering machine that does the sides.  And then you open and then you end up with a working key.  It's fun.  It's a very expensive way of duplicating keys, but if you have a key that's hard to duplicate  or buy a normal service because you can't get the blanks, this is a way to go.  It's a fun machine.  Kind of cool.  Tin soldiers.  How are tin soldiers made?  Anyone?  That's the material.  How are they made?  They're cast.  And they're melted, of course, because that's part of the casting.  They're cast.  So if you can make a cast of a metal, if you can make a cast of your key,  which we'll hold it, something's out in here.  Still here?  Yep.  If you can make a cast of your key, you can pour metal in there, right?  If you have to go crack stuff.  And you can go quite fancy with that.  So we tried a very cheap set, comparably.  This is just regular clay.  We went to the hobby shop and bought all the clay, basically,  to figure out what the correct clay is.  It takes some research to figure out what it is,  because if it's too solid, then it won't take an imprint.  And if it's too soft, it'll smudge it a bit.  But, well, if you're buying clay, that's not an investment.  Come on.  And, well, there's a piece of metal that we haven't figured out,  actually, what it actually is, because it has a very, very low melting point.  It's not lead, because that would be unhealthy.  But it's, I don't know, whatever.  And we just tried it with a normal, quite good key, not a high security one,  but a quite normal average key on one of our friends on his kitchen table.  We just tried it there, and it worked first time, first time with Charm.  And it's brilliant.  It even works with that.  And if you go a bit more high secure, then that clay probably won't do.  So you need a material that basically has a higher resolution than normal clay.  What we found out is that your dentist used a two-component putty, basically,  to take impressionings for your teeth.  That's awesome stuff.  It doesn't melt or shrink when it's heated or cooled down.  So that's, well, because that would be weird, because then your key would be different size.  So that's good stuff.  It's quite expensive, though.  So befriend a dentist is always a good thing.  You end up with stuff like this.  That's the original key.  And you can imagine, I mean, this is not a high security key, but it's a different key.  Actually, the talk after my talk will be about keys like this.  On a normal key duplication machine, the one that normally cuts like this,  this is going to be impossible to do with that.  It's just a different type of machine.  I'm not saying it's a better lock, but it's different.  And so a normal key cutter won't be able to do this.  But of course, you can pour that.  And if you take it out of the mold carefully without destroying that mold,  then you can retry, because the mold is still intact.  You can just melt this one and redo it.  And then you're golden.  So you can keep on doing it over and over.  This actually works.  We tried this.  OK, another one.  This is the ID of Rob Grongeijp.  You probably have no idea who the fuck Rob Grongeijp is.  But if you were Dutch, you would have known.  Rob is the most well-known hacker of the Netherlands.  He's basically one of the driving forces behind that we're not using computers  to vote for parliament these days, which is Jaffer Rob.  And he founded our first commercial, well, public ISP.  So he's one of the good guys.  And he's a hacker.  So he knows his operational security, you would think.  These guys knows risks, knows risk profiles.  He should know better than show keys in public.  Let's see what that goes.  And he wants to make sure that there are all sorts of interesting things under this station.  Shards, bunkers, extremely exciting.  Especially at that time, it's really great.  I'm going to go in.  We're standing in the lift.  I'm not going to push the button.  I can turn the switch on.  It's going to be very close again.  No, we're not going to the tree.  We're going to be lucky that the light is on.  We're just going to keep going.  I'm going to go deeper and deeper.  The room is really light.  Great.  Oh, I lost it.  And then you have hackers in your super secret nuclear facility.  What's wrong with this picture?  It's a bit out of focus.  It's not that on.  There's no chance in hell that this is the actual key.  Because this is a double-bitted key.  This is a cabinet lock.  This is just a key he happened to have in his pocket.  And he showed it to the camera.  You didn't know that, did you?  It took nothing away from the story to lie.  So this guy has excellent operational security.  The journalist is happy because he has his footage.  The audience is happy because the attention is still there.  You didn't know it was a fake.  It's just a prop.  Security is not compromised.  The story is still there.  He's not showing keys.  Not showing keys is a good idea.  Other ways of not showing keys is this is a key pass.  No, a key port is the term.  It's actually basically a box that you slip your keys in and out of.  This one is branded Defcon 22 because it's a fail.  And that's what I like.  I like fails.  What it is, it is a box.  It's a neat idea.  So you can put USB things in it,  but it's about the keys that you just slid in there.  So it's basically an intricate way of keeping your keys in your pocket.  So you only slide them out when you use them so nobody can see them if they're looking.  And so what they do, they don't cut your keys,  but they send you the blanks with this adapter basically.  So they need to figure out what your actual keys are.  So of course, what do they need?  They need a picture of your key.  So you're selling it to Defcon 22 attendees who are paranoid, rightfully so,  and you're selling it to the upper paranoid there because they know they don't have to show their keys,  and you're asking them to send pictures of their keys.  That's wrong.  Well, for granted, in the small print it says for extra added security,  you should maybe blur or blind the actual teeth on your lock.  But that should not be added security.  Come on, guys, you're selling a security product.  That should be the default.  That should be the only way you can upload pictures of your keys.  Come on, get out of here.  So we did figure out that this is probably not the best idea of the world, right?  I mean, Post-it should not be on consoles.  There should not be passwords on Post-its.  That's not going to happen.  So this is wrong, right?  Well, this is a website called pleasebreak.in.  What it does is basically a Twitter feed grabber,  and every time you tweet a picture and say,  Newhouse and keys in that tweet, it gets added to this site.  So we have, and of course these are all click-through,  so if you click on one of these pictures,  you will get the key, the house, which is, and that picture is probably geotagged, right?  And if it's not, I'm pretty sure someone can write a Google Street View add-on  that can grab pictures and compare to that.  We only have to look at Turlock, which I have no idea how big that city is,  but this is doable, and you have access to this guy's Twitter feed,  so you probably know when he's on holiday,  and he just had a new house,  so it's probably filled to the brim with new, shiny toys.  Come on, this is given away, don't do this, this is wrong.  So, like I said, showing pictures of keys is wrong,  but then taking pictures of keys or having pictures taken while you're using that key,  it gets harder and harder.  If you happen to live in London, you're surrounded by a gazillion CCTV camps  that basically watch you every time, right?  And of course there's Google Glass, well, we don't see it that often now,  but something like that will evolve,  so we're already looking at contact lenses,  so we haven't got the clue if somebody's actually looking at you or not,  or taping or recording it,  and we all have pretty capable cameras in our pocket right now.  Well, those tracking devices are called cameras, our core telephones,  but they're cameras as well, right?  And they're high-res enough to do this stuff.  So, when I was younger, and we stopped using cash money, basically,  and there was a TV series that basically showed us  if you're pinching in your PIN code for your plastic money,  shield your numbers.  A PIN code.  A key is basically a code to that lock, so, I mean, don't show it.  You saw Rob doing it in that video when he actually was operating that elevator,  you didn't see that key in the clear.  Just slide it a bit.  Okay, I got one more fail and they were done,  so that I don't want to keep you away from the drinks.  This is a bad guy.  This is actually a killer.  I know that because he got convicted for killing people.  He went to jail for killing people,  and he walked out of jail because the design of the master key  was printed on front of the prisoner's information handbook.  A copy of the upset book was given to all inmates upon arrival of that facility.  So, it's, I don't know, so security can be hard,  and security can be easy,  but for some weird reason it's always quite easy to fuck it up.  So, that's me. Any questions?  That's me. I'm done.
JosWeyersPost-itspost-itspost-its_0_119.png JosWeyersPost-itspost-itspost-its_120_2375.png JosWeyersPost-itspost-itspost-its_2376_2435.png JosWeyersPost-itspost-itspost-its_2436_2735.png JosWeyersPost-itspost-itspost-its_2736_3251.png JosWeyersPost-itspost-itspost-its_3252_3755.png JosWeyersPost-itspost-itspost-its_3756_4103.png JosWeyersPost-itspost-itspost-its_4104_4355.png JosWeyersPost-itspost-itspost-its_4356_4427.png JosWeyersPost-itspost-itspost-its_4428_4835.png JosWeyersPost-itspost-itspost-its_4836_4967.png JosWeyersPost-itspost-itspost-its_4968_5015.png JosWeyersPost-itspost-itspost-its_5016_5123.png JosWeyersPost-itspost-itspost-its_5124_5207.png JosWeyersPost-itspost-itspost-its_5208_5279.png JosWeyersPost-itspost-itspost-its_5280_5351.png JosWeyersPost-itspost-itspost-its_5352_5435.png JosWeyersPost-itspost-itspost-its_5436_5603.png JosWeyersPost-itspost-itspost-its_5604_5651.png JosWeyersPost-itspost-itspost-its_5652_5819.png JosWeyersPost-itspost-itspost-its_5820_7451.png JosWeyersPost-itspost-itspost-its_7452_8183.png JosWeyersPost-itspost-itspost-its_8184_8339.png JosWeyersPost-itspost-itspost-its_8340_11087.png JosWeyersPost-itspost-itspost-its_11088_11627.png JosWeyersPost-itspost-itspost-its_11628_12755.png JosWeyersPost-itspost-itspost-its_12756_13727.png JosWeyersPost-itspost-itspost-its_13728_14843.png JosWeyersPost-itspost-itspost-its_14844_16895.png JosWeyersPost-itspost-itspost-its_16896_20099.png JosWeyersPost-itspost-itspost-its_20100_22223.png JosWeyersPost-itspost-itspost-its_22224_26723.png JosWeyersPost-itspost-itspost-its_26724_27143.png JosWeyersPost-itspost-itspost-its_27144_29591.png JosWeyersPost-itspost-itspost-its_29592_29843.png JosWeyersPost-itspost-itspost-its_29844_30083.png JosWeyersPost-itspost-itspost-its_30084_31103.png JosWeyersPost-itspost-itspost-its_31104_31151.png JosWeyersPost-itspost-itspost-its_31152_34079.png JosWeyersPost-itspost-itspost-its_34080_34403.png JosWeyersPost-itspost-itspost-its_34404_36707.png JosWeyersPost-itspost-itspost-its_36708_37775.png JosWeyersPost-itspost-itspost-its_37776_38075.png JosWeyersPost-itspost-itspost-its_38076_38207.png JosWeyersPost-itspost-itspost-its_38208_40247.png JosWeyersPost-itspost-itspost-its_40248_40367.png JosWeyersPost-itspost-itspost-its_40368_42119.png JosWeyersPost-itspost-itspost-its_42120_44771.png JosWeyersPost-itspost-itspost-its_44772_47675.png JosWeyersPost-itspost-itspost-its_47676_51575.png JosWeyersPost-itspost-itspost-its_51576_52739.png JosWeyersPost-itspost-itspost-its_52740_53939.png JosWeyersPost-itspost-itspost-its_53940_55139.png JosWeyersPost-itspost-itspost-its_55140_57527.png JosWeyersPost-itspost-itspost-its_57528_58055.png JosWeyersPost-itspost-itspost-its_58056_58199.png JosWeyersPost-itspost-itspost-its_58200_58319.png JosWeyersPost-itspost-itspost-its_58320_58415.png JosWeyersPost-itspost-itspost-its_58416_64619.png JosWeyersPost-itspost-itspost-its_64620_65387.png JosWeyersPost-itspost-itspost-its_65388_65579.png JosWeyersPost-itspost-itspost-its_65580_67055.png JosWeyersPost-itspost-itspost-its_67056_68120.png
Hello, I'm Norse Valles and I'm talking about stuff. I'm a member of Tool and Tool is the open organization of lockpickers. We pick lock for a sport. So we open locks without keys and without force and without damaging it. And we have actual competitions for them. Some competitions are international, so there's championships and everything. If you are trying to pick a lock for sports, there are a couple of rules you should abide by. At least that's how we play it. One, you only pick locks that you own or you have explicit permission from the actual owner that you're allowed to pick that. And if you can help it in any shape, way, or form, try to refrain from picking locks that you rely on. Because at some point you will fail and then you maybe can't open or close your front door, your server room or whatever. That's a problem. So if you live by those rules, you probably will not get into trouble. Furthermore, I'm an active member of Hack 42, which is a hackerspace in Arnhem. We reside at a defunct German military base. We're blurred on Google Earth. It's awesome. And when Hackaday, the American blog, did a tour through Europe to look at hackerspaces, they also visited us. And their first line in their article was like, wow, this is the most awesome space ever. And of course, I can only agree. To start off with my talk, we'll start off with a little video. Music playing Three printing of keys. What has the world come to? Show of hands. Who thinks this is a good idea? I think it's a cool idea. I think it's a cool idea. It's a neat idea, but I don't think it's a smart idea. Well, I don't know. I mean, you're putting your keys in the cloud and God knows where or what's going to happen. Well, the fun thing is this is an ad for a Belgium insurance company that does this on the site. So at least if your house gets looted afterwards, you know, it's going to pay for it. So that's a good thing. What you did see that they put a key on a turning pedestal and took basically took a with a sort of connecting. They took a 3D render of it and from that 3D thing, they went on for that file. And why they had to do this is basically because they're Belgium and Belgium is, as we all know, part of Europe, which is not the USA. And because in if you are in America, you basically, if you want a lock on your front door, you have a couple of choices. That's a quick set. That's a Schlag. That's very expensive. So that's three choices. And basically as a residential area, you probably go for option one or two. So you have a Schlag in a quick set, which kind of limits your choices down. So what you can do then is you don't have to put your key on a turning pedestal and make a complete 3D render for it. One picture can be enough. And there's actually a company who does that, well, who did that. I don't think they're existing anymore. This was Schlussel.com. What they said, just take a picture of your key on a white background, just flat on, click, mail it to us, give us $5 and we'll ship you a copy of that key to your home address. Well, personally, I would not use my home address for that return envelope. But the idea is neat. I mean, so it just takes one picture, click, go, you have a key. Cool, right? And they actually wrote some interesting software for that that analyzes your picture. So they don't make a stupid dupe of the picture you send it. Now, first it figures out what the actual key is and then it starts looking at where the depth should be and what the depth actual is. And what you see at space number one, this one, this one, you see that red line is a bit higher than the actual key is. This is not good. There we are. I don't know. I did nothing. I burned it. So the red line is actually a bit higher than the actual key is. So what they did is they figured out the type of brand of the key and what the original code was. So the gap there is wear and tear of the key. So the copy you receive in the mail probably works better than the original you sent them. I think that's neat. I think that's cool, right? So they just make a duplicate of your key by one picture alone. I believe now they need both sides, but the idea remains the same. They can do it with one. There's actually other companies who expand on that same idea. This is Outbox. They were running in, I believe, only Manhattan because they can't be, it doesn't scale that well, because what they do is basically they are reverse mailmen, a reverse physical snail mail mailman. So they show up at your door and take your paper mail. They take it back to their office. They scan it and they mail it to you electronically. So even if you're not at home, you can reach a spam. Whoa. They probably feed that out, but I'm not sure about that. So they need access to your mailbox, at least. So what they say, again, send us a picture of your lock, of your key. And of course there are several places when you can have your mail. That's in a mailbox that is outside. Maybe that's not locked, so then they're easily done. And if there is a lock in your mailbox, they need a picture of that key. If that's behind the gate at Fence, because that's what most Americans do, they need that key as well. And you have several layers, but they didn't want to go into your house, probably because it's American and they want to get sued or the liability or whatever. So they say if you have your mail, if you have a slit in your door and the mail goes through there, so you need to be behind your front door to actually grab the mail, they'll supply you with a mailbox you can put outside your door. But the idea remains the same. I mean, so you need a picture of a key and they make a copy of it, and then they actually use them in their business proposition. So I think that's cool. Taking pictures of keys and making that. That's not new. That's not new at all. In 2008, the University of California was playing with this device. Let's say, need camera and a kick-ass lens. What you can do with big lenses is take, need pictures and zoom in a bit. That's a terrace. There's a table on the terrace on the table. There's a book on the book. There's a key, and that's the zoom in. You can neatly zoom in with big lenses. Well, you and, of course, we can see that key. Let's focus on that one. The picture is not taken straight on, but that's not really a problem, because if you look at the head of this key, this one, this looks like a K. And if you know your luck, you know that's a quick set. And the fun part about a quick set is we know what the dimensions of that key is, especially from that head, because that head is the same for all the quick sets. Of course, the code is different, but if you keep on distorting and changing the picture, I mean, that's clearly not the key, but if you keep on wrapping it until this is the correct shape, then you know this is the correct shape as well, which you then can decode to the actual code and use a code cutter and run it. That works. So this happens from far away. You just need a big lens. And this was 2008. Lenses improved. CCTV improved. So that happens. Now, for example, this is a picture shot by Ray from Ray as a member of SSDef, which is basically a tool in Germany. It's not the same, but ish. This is 2009 in Haar in Viehouten. Ray, he likes handcuffs. He's a lock picker, but he's especially interested in handcuffs. So he knows his cuffs. And he did bring this key. This is a 3D printed key of the German handcuff keys. And because the handcuffs keys for the German police are all key to like, well, bulk of them are, the normal police, they're all key to like. And if you think for that for a second, you might go, that's stupid. But if you think for a bit longer, that actually makes sense. Because if you get arrested by cop number one, and he cuffs you, puts you in the car and drives you off, hands you at the station, hands you over to another cop, it's quite neat that he can open your cuffs. Otherwise that's going to hurt. So yes, they're key to like. In most countries, that's the case. And Ray was in this big event in the Netherlands. And it's that big that we actually have police working about. Dutch police. And of course, Ray B and Ray, he was like, that's a lips. He instantly recognized the name and brand of the handcuffs that the Dutch policemen were wearing. And the German cuffs are lips also. So he was like, will this key fit on the Dutch cuffs as well? So he went to this police officer and said, dear police officer, can I use this key in your cuffs? And he turned this back to him and said, shut up. Turned his back to him. So which clearly gave a vision of, a visual on the actual key that he was wearing. Well, I'm not saying I can make a key from that picture because it's a bit blurry. It's a bit less blurry here, but you get the idea. But I can see that this is a low, high, bit low and high. Yes? So if I compare that to the original key that we already have, I'm not saying it is the same key, but you can kind of guesstimate that it is, right? I mean, that is information leakage. Just wiggling about your key gives away quite a lot of intel. And a bit later he tried with another cop and he said, yes, show, go ahead and yes, it works. So this is actually the key to all Dutch and German police handcuffs. And the STL, you can download there and you can print your own. Because, well, information wants to be free, right? Different example. This is what I call a typical clean desk environment. It's a mess, but of course, me being a log geek, I see a key. We put a coin there just for scale because if we know the scale, we can do stuff with it. We guessed that this is a cabinet key because there's a cabinet underneath that desk that we kind of want to have opened and, well, it looks like a cheap key. Because it's cheap, we can assess that it probably has weird tolerances. So we don't have to be exact. So what we did, if you print out that picture you just took, if you take the picture that on, you don't have to, you don't have that distorted image anymore. So you just need to size it so that the coin is the correct size. And if you then print it out on paper and put that paper on a sheet of metal and just cut it out, go all kindergarten on it and stay within the perimeters and follow the lines, with some luck, you'll have a, at least you have a metal shape, a piece of metal with roughly the same shape of your key. If you put that in with some luck, that'll open. And that will open your cabinet. But it's fun. I mean, we could have just nicked the key, but this is way more fun. So this works on absolute crappy locks. And, well, talk about crappy locks. This is a TSA approved luggage lock. Actually, these are two locks. Well, this one says Samsung, it doesn't matter, I'm not bashing that brand. I just, well, talking about the idea. This lock, this number lock, that's yours. This one, the lock that actually takes the key, that's not yours. That's from the TSA. Because you do not have a key for this. This is a built-in backdoor for that lock. Because what happened after 9-11, well, especially after 9-11, the TSA, if you fly to or from the US, the TSA wants to look in your baggage. That's fair, I guess. But if, so if you lock your, your locks, if you lock your, your bags, they need to go through those locks. So they just start cutting the locks to get in that. People found that annoying. So some companies like Travel Sentry, this is their logo, they started making and selling locks that had built-in backdoors. That was the feature. This is the backdoor. It's quite, quite certainly not hidden. It's just plainly backdoor. What happens, TSA has a couple of keys, 9 to be exact. This is the number 2, clearly stated on there. So the TSA official just takes out his number 2 key, opens it. That's it. And then there is a papal trail and so they can go through your locks, through your baggage without destroying the locks. Okay. So there are 9 keys that can open all the baggage. So if you have media reports with these kind of pictures, I fringe. It's like, come on guys. Well, I can't really see which number is which, but that's about it. And well, and then again, having an internal document from the TSA leaked on their external website, because, well, because rules and databases and God knows what, this is dead on quite easy. And of course, if you own that lock, you know what this distance is. So you know what the scale of that key is. And because of internet and information, of course, there are 3D printers. And these are the keys to all the baggage. And of course, those are not high security locks. They're not. Well, maybe except the number 6, that one is made by Abbas. That's actually quite hard to pick. The other ones are just stick anything in there and goes. These are actually printable again, downloadable there. You can print your own. That's what we do, share information. So, I mean, like I said, it's not a high security lock, but it gives, it tries to give the user some sense of security, which I think is false. It's a seal at best, because now I can unseal it and seal it. So I refuse to travel with these locks. I just use zip ties. I use weird zip ties that probably are not in possession of other people per se at that moment. And so I use a zip tie as a security seal, not as a deterrent, just a seal. And it works. And I put some spares in the box, and most of the time, TSA just reapplies one of the spares. And I know how many spares I had. So that works. That's my security posture. Another example, in April 2010, some media attention went to this idea. Apparently, you were able to buy a key, a master key, so not just the key, but the key, to all the New York subway stations for only $27. A master key means you can open all the locks. So not just travel for free. Now, shut it down, because you have access to technical cabinets, and God knows what. So exit doors, fire exit, all that kind of stuff, you can open it. And of course, it'd be in post-911, and it'd be in definitely, it'd be in New York. The idea was terrorists, if terrorists get hold of this key, this key, this key. So by stating that the evil guy shouldn't have this key, by that act, they're actually giving it to them. And just in case this picture is not high-res enough to actually read that key, they put it on a map with a known scale. So this is giving it away, because any locksmith should be able to cut a functional key from this. Okay, mind you, this is 2010 when this happened. I give a version of this lecture every now and then. And last month, no, two months ago I was in Los Angeles doing this, and one of the questions was, did they change these locks? And I was like, I don't know. I don't know. Because, well, one, I'm not in New York, so I can't test it. I don't have the key. Well, I do. But then again, rule number one, you can only pick locks that you own, or don't own these. Or you have explicit permission from the only to do. Well, that's probably out of the question, so I don't know. I have no way of telling you that. Until last month, when this media article appeared, the key is $8 all of a sudden. And of course, they had to print that freaking key full size, otherwise the message doesn't come across. So people just found that out. And actually, if you go to the online version of this article and twinkle a bit with the URL, you'll get this picture, which is 300 dpi, high res, definitely enough to actually do that. I mean, come on. You don't need this. It's not needed. Okay, more fail. If you try to skim cards, you can go off-ansion it and make plastic add-ons that look like the real deal and to hide all your electronics. That's quite a cool, but there are better ways to get in. Let's watch a tiny video. Let's bring in NBC Bay Area's investigative reporter Vicky Nguyen. Vicky seems unbelievable that one golden key, so to speak, unlocks so many pumps. We were surprised too, Raju, could call it the key to the kingdom. It is a remnant from back in the day when all gas station pumps were made with the same lock to make it easier for inspections and maintenance. Now those keys are just providing easy access to a very lucrative crime using new high-tech technology, and in the end, we are all on the hook. Hidden behind here, a new Bluetooth-enabled skimmer that can rip off your credit or debit information in seconds. This universal gas pump key is making it even easier for thieves to install these new skimmers. That's not a high-security lock. The bidding is quite obvious, but I also know now exactly which blank to order, because that's a Y11 USA, which costs about 50 cents, I don't know, if you buy them in bulk. But of course, having access to the box that your machinery is in, then you have a box, and you can all your key-loggers and crapware and you can all put inside the box. And it'll look like a real deal, because guess what? It's the real deal. It's the original box. Nobody's going to see that it's a fake, because it's not. The fake is inside. So having one key for all those gas pumps, well, it does make sense, because if you're the engineer who has to maintain all this stuff, you don't want to create of keys, you want one. So there is a, it's always a trade-off. And I think this is the wrong trade-off, because when it goes wrong, it goes wrong in a bad way. All right, suppose you live in New York. New York has a lot of buildings which are high, and suppose you're thinking about a fire in New York. When there's a fire in one of those high buildings, you definitely want the fire people to get into your building. One way of doing that is don't lock your door. It's not the best option, or give them the key. But then again, New York is a big place. So if you, if they would get the keys to those buildings, they would need a separate truck to... So that's, that's, that's annoying. And that goes for every truck, because you never know which truck is the first one there. So you have to double everything. So what they do is they have basically tiny, tiny boxes, tiny vaults that they put outside the building, and they put the key to the building they put in that lock, put in that tiny vault. And those vaults, those are key to like. And if you do it in a wise way, I put some extra alarms on there and some monitoring on that box, that at least all hell breaks loose when that is broken open. So there are a couple of keys, just a handful, that basically are the keys to the city, literally. Of course, these locks get cut by locksmith, and some locksmith, they get out of business because of old age or whatever. This is one. This is a locksmith who used to cut those keys. And he went out of business, and he had some leftover stock. Well, the apocalypse might be coming because a New York Post reporter just scooped a legitimate story. An intrepid reporter for America's third dumbest paper has found a slightly disturbing item for sale on eBay. Former locksmith, Dan and Ferraris, sold the undercover reporter a New York City Fireman's key ring for $150. The keys give the owner the ability to control elevators, circuit breakers, sub-wanderers and traffic lights all over the city. They essentially become the key maker from the matrix reloaded. Media being media, every now and then you see an original story, but both of it is a copy of a copy of a copy, basically like keys. So other media outlets start copying the same story. So this is, you know, having to post actually dead on pictures, white background. Useful. Definitely other media outlets actually copy that again, and they added information. This one actually, these are the keys to the electric fennel. Fire elevator key also works in, where is it? Hold on a second. Well, high-rise, important stuff. Scary stuff. That's the fireman's service key. That's the subway key. We were talking about traffic lights. Turn all the lights red. Turn all the lights green. Remember Hacker, the movie? Brilliant. Fire alarm box sets. So sound the alarm or don't sound the alarm when you actually fire. So, yeah, I mean, you can create chaos with this key set. And of course, the only way to get the story across is by giving out those keys for free, apparently. Okay, this is the logo from a hacker space in Amsterdam called Techink. And, well, I'm a member of Hack 42, which is a different hacker space, also in the Netherlands. And being a, it's not a rivalry, a hacker space. It's a bit more like a sibling. And what do siblings do? They quarrel, right? All in fair and love and stuff like that. Techink got a new space at some point. And of course, with a new space comes a new lock and comes new keys. They were very proud of their new space, which is awesome, absolutely. And so one of our members, which is a regular troll, started calling one of these guys. He's like, are you sure that's a okay lock you have on your new facility? Because we have a member in our team that knows his locks. So if you can just send a picture, then we can assess if it's a decent key or not. And this showed up at the mailbox. Well, it's not a very clear picture, but if I do this... Yeah... I basically end up with that, right? I mean, if it was a high-powered laser, it actually would still be there. Well, this is a vague outline of what the key should look like, ish. So we hooked that up on our newest machine we happen to have, which happened to be a laser cutter. Good thing it wasn't a coffee maker, because that would have been a mess. And what you see happening is it just burns that outline out of a piece of plastic. That piece of plastic is, I don't know, a whole mill thick, so that will never fit, or at least it should never fit, in your keyhole. So, well, actually, that was the label. Now it's the actual burning. We do have some ventilation now. We just got that machine, so we do not want to inhale those fumes. So you end up with a basic outline of the key, which does not fit your keyhole, but it is a basic outline. So what you can do with that... Well, let's wait for the actual burning to stop. Burn, burn, burn, burn. Focus, focus, focus. There we are. See? Basic outline. Picture. There you go. You see, we set it a bit too hard-burned as a shadow, but this is the actual shape. The key, we kind of assessed what the blank was by just by looking at it. So, hooking this piece of plastic into a normal key cutter. Here's our bit of see-through plastic, and that's a normal blank. And you can just do it the way you're used to. And, well, did it work or not? As I was not a member at that time, I couldn't assess that, because rule number one, it's not my luck, no permission. But being a hackerspace, which is all information, wants to be free, we put this whole video and all the specs on our public wiki, of course. Well, that's what you do, right? Well, some people freaked out. It's all for play, so the day after we showed up with a decent luck, and 80 copies of the keys so they can redistribute that. And then they said, so now we have a good luck. You can't get into a door again. I said, who supplied you that luck? Off-hooking game. I became a member and they even gave me a discount, because, well, you didn't have to give me a key anymore, did they? So that was good. Cool. Speedcams. Fun, right? Let's do the video first. Keys and a cylinder lock. According to the mail, this is in the flyer. And I can open the flyer with these keys. And how much did it cost? It cost 14 euros and 23 cents. If this works for 14 euros and 23 cents, that's also a lot cheaper than a flyer's boots. This is the one. This one. There have been a lot of actions in Flanders to change this flyer. We shot it, we burned it, we even stuck it. But actually, according to our mail writer, all of this is not needed. Because the secret of this flyer is in this box. This robust box is the remote control, the electronic power of that flyer. This key, that you can make this combination with it, and then you open it. The key fits. The door opens. Here you can just put it on and off automatically. Let's close this. Finally, completely new. This is very cool. This is cool. Did not change that combo. That's leaving default password as default password. That's exactly the same as they did. That's weird. But I didn't want to buy those locks with those keys. I just want to assess if I can make a working key from the stills we got from that moving video. We got this one. I can get some info, but not all that I need. We got another one. That's doable. I think this is the money shot. It's kind of straight on. It kind of gives the shadows a nice, so we can see the depth. If you know your locks, this is a quite peculiar shaped head. If you know your lock, you see that's a BKS. That's a BKS head, because that's the only one I know that has this head. Again, a BKS has the standard size, so we can see what the rest of the key should look like. Actually, this is basically the style sheet for a BKS. The head should be here. These are where the positions are. These are the possible depths. If you keep looking to this picture and compare to that, you can kind of guesstimate what the actual depth should be. We came up with this. We guessed and assessed, basically. It's a guesstimate. We think this is the lock to all the Belgium speedcamps. Of course, rule number one, can't pick it, because I don't own it, or I have explicit permission from the owner to actually try that. Well, that's probably how to the question, right? So what to do? So we bought a speedcam, right? And yeah, it works. This is actually the key to all the Belgium speedcamps, so maybe we shouldn't show it. Well, so we're talking about pictures of keys, that that's a bad thing. But actually having hold of that key, even for a split second, that's the golden ticket, right? So now you can do stuff. Of course, you can run to the coffee shop and have it cut. But there are ways to protect from that. I mean, one way is if you look at your keyway, and there's a certain swerve in your keyway, if you get all intricate with that, so make weird swerves and you pattern those forms, some other people are not allowed to sell keys that look the same. And if you use a very weird shape and only use that for your installation, it's going to be harder to get fitting pieces of metal who go into the lock. Normally, if you play nice. But then there are boxes like this. This is a key cutter, but it works in another direction, basically. This is an easy entry machine, it costs a couple of thousand dollars, well, euros or whatever, and which is some money, but it depends how determined your attacker is. For a sports lock picker, that's an investment, which we made because we want to have that box. It's a cool machine. It takes slugs of brass, look like this, smiley face is always good. What it does, it cuts keys. But a normal key cutter would go in that direction and duplicate that. This one takes those grooves and duplicates those. There's a zoom. You see, it just mills out these grooves. And so you end up with a blank key that you have to put on another key-covering machine that does the sides. And then you open and then you end up with a working key. It's fun. It's a very expensive way of duplicating keys, but if you have a key that's hard to duplicate or buy a normal service because you can't get the blanks, this is a way to go. It's a fun machine. Kind of cool. Tin soldiers. How are tin soldiers made? Anyone? That's the material. How are they made? They're cast. And they're melted, of course, because that's part of the casting. They're cast. So if you can make a cast of a metal, if you can make a cast of your key, which we'll hold it, something's out in here. Still here? Yep. If you can make a cast of your key, you can pour metal in there, right? If you have to go crack stuff. And you can go quite fancy with that. So we tried a very cheap set, comparably. This is just regular clay. We went to the hobby shop and bought all the clay, basically, to figure out what the correct clay is. It takes some research to figure out what it is, because if it's too solid, then it won't take an imprint. And if it's too soft, it'll smudge it a bit. But, well, if you're buying clay, that's not an investment. Come on. And, well, there's a piece of metal that we haven't figured out, actually, what it actually is, because it has a very, very low melting point. It's not lead, because that would be unhealthy. But it's, I don't know, whatever. And we just tried it with a normal, quite good key, not a high security one, but a quite normal average key on one of our friends on his kitchen table. We just tried it there, and it worked first time, first time with Charm. And it's brilliant. It even works with that. And if you go a bit more high secure, then that clay probably won't do. So you need a material that basically has a higher resolution than normal clay. What we found out is that your dentist used a two-component putty, basically, to take impressionings for your teeth. That's awesome stuff. It doesn't melt or shrink when it's heated or cooled down. So that's, well, because that would be weird, because then your key would be different size. So that's good stuff. It's quite expensive, though. So befriend a dentist is always a good thing. You end up with stuff like this. That's the original key. And you can imagine, I mean, this is not a high security key, but it's a different key. Actually, the talk after my talk will be about keys like this. On a normal key duplication machine, the one that normally cuts like this, this is going to be impossible to do with that. It's just a different type of machine. I'm not saying it's a better lock, but it's different. And so a normal key cutter won't be able to do this. But of course, you can pour that. And if you take it out of the mold carefully without destroying that mold, then you can retry, because the mold is still intact. You can just melt this one and redo it. And then you're golden. So you can keep on doing it over and over. This actually works. We tried this. OK, another one. This is the ID of Rob Grongeijp. You probably have no idea who the fuck Rob Grongeijp is. But if you were Dutch, you would have known. Rob is the most well-known hacker of the Netherlands. He's basically one of the driving forces behind that we're not using computers to vote for parliament these days, which is Jaffer Rob. And he founded our first commercial, well, public ISP. So he's one of the good guys. And he's a hacker. So he knows his operational security, you would think. These guys knows risks, knows risk profiles. He should know better than show keys in public. Let's see what that goes. And he wants to make sure that there are all sorts of interesting things under this station. Shards, bunkers, extremely exciting. Especially at that time, it's really great. I'm going to go in. We're standing in the lift. I'm not going to push the button. I can turn the switch on. It's going to be very close again. No, we're not going to the tree. We're going to be lucky that the light is on. We're just going to keep going. I'm going to go deeper and deeper. The room is really light. Great. Oh, I lost it. And then you have hackers in your super secret nuclear facility. What's wrong with this picture? It's a bit out of focus. It's not that on. There's no chance in hell that this is the actual key. Because this is a double-bitted key. This is a cabinet lock. This is just a key he happened to have in his pocket. And he showed it to the camera. You didn't know that, did you? It took nothing away from the story to lie. So this guy has excellent operational security. The journalist is happy because he has his footage. The audience is happy because the attention is still there. You didn't know it was a fake. It's just a prop. Security is not compromised. The story is still there. He's not showing keys. Not showing keys is a good idea. Other ways of not showing keys is this is a key pass. No, a key port is the term. It's actually basically a box that you slip your keys in and out of. This one is branded Defcon 22 because it's a fail. And that's what I like. I like fails. What it is, it is a box. It's a neat idea. So you can put USB things in it, but it's about the keys that you just slid in there. So it's basically an intricate way of keeping your keys in your pocket. So you only slide them out when you use them so nobody can see them if they're looking. And so what they do, they don't cut your keys, but they send you the blanks with this adapter basically. So they need to figure out what your actual keys are. So of course, what do they need? They need a picture of your key. So you're selling it to Defcon 22 attendees who are paranoid, rightfully so, and you're selling it to the upper paranoid there because they know they don't have to show their keys, and you're asking them to send pictures of their keys. That's wrong. Well, for granted, in the small print it says for extra added security, you should maybe blur or blind the actual teeth on your lock. But that should not be added security. Come on, guys, you're selling a security product. That should be the default. That should be the only way you can upload pictures of your keys. Come on, get out of here. So we did figure out that this is probably not the best idea of the world, right? I mean, Post-it should not be on consoles. There should not be passwords on Post-its. That's not going to happen. So this is wrong, right? Well, this is a website called pleasebreak.in. What it does is basically a Twitter feed grabber, and every time you tweet a picture and say, Newhouse and keys in that tweet, it gets added to this site. So we have, and of course these are all click-through, so if you click on one of these pictures, you will get the key, the house, which is, and that picture is probably geotagged, right? And if it's not, I'm pretty sure someone can write a Google Street View add-on that can grab pictures and compare to that. We only have to look at Turlock, which I have no idea how big that city is, but this is doable, and you have access to this guy's Twitter feed, so you probably know when he's on holiday, and he just had a new house, so it's probably filled to the brim with new, shiny toys. Come on, this is given away, don't do this, this is wrong. So, like I said, showing pictures of keys is wrong, but then taking pictures of keys or having pictures taken while you're using that key, it gets harder and harder. If you happen to live in London, you're surrounded by a gazillion CCTV camps that basically watch you every time, right? And of course there's Google Glass, well, we don't see it that often now, but something like that will evolve, so we're already looking at contact lenses, so we haven't got the clue if somebody's actually looking at you or not, or taping or recording it, and we all have pretty capable cameras in our pocket right now. Well, those tracking devices are called cameras, our core telephones, but they're cameras as well, right? And they're high-res enough to do this stuff. So, when I was younger, and we stopped using cash money, basically, and there was a TV series that basically showed us if you're pinching in your PIN code for your plastic money, shield your numbers. A PIN code. A key is basically a code to that lock, so, I mean, don't show it. You saw Rob doing it in that video when he actually was operating that elevator, you didn't see that key in the clear. Just slide it a bit. Okay, I got one more fail and they were done, so that I don't want to keep you away from the drinks. This is a bad guy. This is actually a killer. I know that because he got convicted for killing people. He went to jail for killing people, and he walked out of jail because the design of the master key was printed on front of the prisoner's information handbook. A copy of the upset book was given to all inmates upon arrival of that facility. So, it's, I don't know, so security can be hard, and security can be easy, but for some weird reason it's always quite easy to fuck it up. So, that's me. Any questions? That's me. I'm done.
on a turning pedestal and make a complete 3D your own. Because, well, information wants to be TSA. Because you do not have a key for this. This place. So if you, if they would get the keys to try that. Well, that's probably how to the so maybe we shouldn't show it. Well, so we're has excellent operational security. The Post-it should not be on consoles. There should this is doable, and you have access to this guy's