On the last day of DEF CON, I talked to some charity hackers, checked out the lockpicking village, and learned how insecure my router is in the wireless village.
What Maker Faire would be complete without teaching children the joys of jiggling and twisting locks until they’ve opened? Toool, the open organisation of lockpickers made their way to New York this weekend to show off their bumping skills and get the kids interested in manipulating small mechanical devices.
The guys from Toool had a very cool setup – just a bunch of tables and chairs with a few picks and torsion wrenches. There were a few classic Master Locks on the table, but also a series of six tumbler locks each labeled with a number 1 through 6 signifying how many pins were in the lock. The idea is to get someone started on a one-pin lock, and eventually have them work their way up to the full six pins.
In the video after the break, one of the more animated guys from Toool explains why they were there, and also shows off picking a Master Lock twice in under 30 seconds. Seriously, people: educate yourself on locks before buying one.
The Open Organization Of Lockpickers (TOOOL) ran the lock picking village at Toorcamp. They gave great workshops on how lock picking works, provided a lot of examples of security flaws in popular locks, and let everyone practice with their locks and tools. Lock picking is a bit addictive, and I spent quite a bit of time at the village.
TOOOL is an international organization that aims to advance the general public knowledge about locks and lockpicking. If you’ve ever wanted to know more about locks, you can check out their list of chapters to see if there’s one in your area, or send them an email to see if there’s other lock picking enthusiasts near you. Their detailed slides that were used for the village are also available.
[Eric] from TOOOL worked on building a lock picking installation called the Labyrinth of Locks. The first prototype of this consists of locks enclosed in 3D printed enclosures, and lit by LEDs. The goal was to string them up in the woods and challenge people to find and pick the locks. MakerBot Industries printed the orange and flower shaped enclosures that the LEDs and locks were mounted into.
This is a first prototype, and [Eric] plans to expand on the idea and use it at other lock picking events he attends. It’s a neat way to mix lock picking and an art installation into an interactive activity.
[Steffen Wernéry] has published a video of the impressioning contest at LockCon. We learned about key impressioning at this year’s HOPE conference. You start the process by inserting a key blank into the lock. By turning the lock until it stops and then moving the key up and down you create marks on the blank’s face. Take a file to those marks to remove the extra material and then repeat the process. Once the pins are set properly, they’ll stop leaving marks on the blank. It takes a lot of skill to do this right, but you end up with a perfectly functional key. [Barry Wels] managed to win the competition in 5:30 with second place coming in at 6 minutes.
The Open Organisation Of Lockpickers (TOOOL) is planning a new annual gathering for lockpickers. October 9-12th they will hold the first ever LockCon in Sneek, Netherlands. The event was spawned from the Dutch Open lockpicking championships, but they’ve decided to expand beyond just competition into a full conference. This year the conference is limited to just 100 lockpickers, technicians, manufacturers, hackers, and law enforcement members. They’ll compete in picking competitions, safe manipulation, and key impressioning.
On a related note: Organizer [Barry Wels] just became the first non-German to win an SSDeV competition with his key impressioning skills. We covered key impressioning when we saw his talk about high security keys at The Last Hope. He says it’s only been about two years worth of study and 500 keys to become a master. He managed to open the lock in 5:13 filing two whole keys during that time.
[photo: Rija 2.0]
Despite, Hack a Day seeming to be fairly lock heavy lately, we’ve yet to cover a major story from The Last HOPE. At the conference, [Jon King] talked about vulnerabilities in Medeco locks and presented his Medecoder tool. Medeco is really what makes this story interesting; unlike the EU, the US has very few high security lock manufacturers. You pretty much have to use Medeco and it’s found in many government agencies.
The Medeco locks have a vertical row of six pins arranged like most pin tumbler locks. Unlike your average lock, the rotation of the pins is important. When the key is placed in the lock, it not only moves the pins to the correct height, it also rotates them to the correct orientation. A sidebar blocks the cylinder unless the pins are rotated properly. Each pin has three possible orientations. They’re biaxial as well, which means the pin’s offset point allows for three more possible positions.
Speaking of laser engraving, the blackbag blog announced that Toool has designed 2 unique picksets for The Last HOPE this year. First is the credit card sized snap-off set seen above. They have named this one The Last HOPE emergency pickset. The other pickset is a new version of the ‘double sided pick’ series. This set consists of picks with the same tool on either end, but they are sized differently. This set will contain 8 picks with promised improvements. If you are interested in more complex picks, check out the centipede.