Hackerhotel 2024: Opening electronic safe locks with Ketchup and Lasers

February 21st, 2024

Hi all, I would like to share a presentation I’ve worked on for quite a while. The talks were on electronic safe locks, and a starting point for lockpickers to get into picking electronic locks. For Hackerhotel 2024 I’ve decided to create a summarized version to inspire others to pursuit electronic security research, and apply the knowledge on electronic locks.

The talk, linked below, has two main topics; Opening electronic locks with Ketchup, so-called liquid spiking, and attempts in reading the memory of the 8051 chip in the early Kaba-mas X0 locks. X07 to X09, specifically. When I find time, I’ll work both into a series of blog posts as well, but no promises.

If after this presentation you like an idea of other talks at Hackerhotel, there are some great ones. Walter presented about Lucid dreaming, and Chantal and Nancy discussed what man can do to promote diversity in the workspace. Women in tech, specifically.

CCBY4.0 Jan-Willem Markus Toool Blackbag

Hackerhotel 2024: Safe cracking workshop

February 16th, 2024

Hugo and I taught Safe cracking to a group of eleven at Hackerhotel 2024. It was great sharing the knowledge and inspiring others. Much respect goes to the attendees, which after a busy conference still had energy to take on this mighty challenge.

Every training needs to start with a good basis. We started with an introduction on what safe locks are about and how they operate, specifically group two safe combination locks. From there, we built knowledge from practical examples and exercises. From simply operating the safe lock by dialing 4L-3R-2L-1R with a known combination, to exploring contact points and graphing.

For this two-hour session, we worked with locks of known combination, and usually only get to complete one and a half graphs in this time. Around six graphs were completed in total, and some even finished all three graphs within the session.

While any training is mostly satisfying a curiosity, we expect this training gave the attendees enough knowledge to give it a try on their own later. Maybe even getting obsessed about it in the process 🙂

CCBY4.0 Jan-Willem Markus Toool Blackbag

Challenge completed!

February 2nd, 2024

Walter and Jan-Willem successfully completed the UKLS January challenge, and like to share the lessons learned as well as show off the 31 locks. The challenge is to open a lock, every day, for the days of January. This is a good way to get in the consistent lockpicking practice, and challenge yourself to pick more difficult locks. You can find a longer explanation of the challenge in the blog released earlier this year. (https://blackbag.toool.nl/?p=4023).

Picking a lock a day has helped me to get use to my new thick acrylic Moki handles, and taught me a few new picking tricks. As the month progressed, I attempted quite difficult locks, of which most didn’t open, at least not right away. For example, I’ve played an hour a day with a particular BKS, which still remains shut. When a lock didn’t open after a while, I frequently tried another lock, if not to keep the streak.

Walter picked a DOM, Pfaffenhain, Nemef, Mul-T-Lock, Wally, Anker, EVVA, ISEO, Gerda, CES, Ivana, Geba, Novoferm, Wilka, FF, Abus, Thirard, Yale, Vachette, Lips, Pratic, S2, Sobinco, Mauer, Corbin, BASI, VBH, Zeiss Ikon, Destil, Kale and an M&C.

On the other hand Jan-Willem picked the Kibb, Dom Sigma, Abus C83, MD, Anker, CAS, Gerda, Lockinox, Nemef, Pfaffenhain, Kraft, Nino, Gaba, (another) Lockinox, Bern, Yale, Axa, S, Era, UAP, Evva, M&C, F (can’t recall, federico? fred?), Iseo, Fake Assa 700, (2nd) gaba, corbin, mila, Ivana, Favour, and a SEZAM cylinder.

By Jan-Willem. Pictures CCYBY4.0 by Walter and Jan-Willem Toool Blackbag.

UKLS January challenge

January 1st, 2024

The January challenge is a lockpicking game ran on the UKlocksport forum. In short, the challenge is to picks/impressions/opens one lock a day for the days of January. The rules say to post pictures daily and not to play catch up. As in, to pick a lock every day, not just 31 in the month of January.

You can extend your lockpicking streak, if you so wish. Some people extend the streak by a few days, others do a full year. One exemplary lockpicker, Toni, picked a lock a day for 1093 days straight, which is three days short of three years! Furthermore, Toni started a new streak of several hundred lock in 2022, as well.

The last two locks of the lockpicking streak by Toni are both sides of the same DOM Plura.
Lockpicking collage of the special picks from Toni from the first 365 locks.

I’ve used the January challenge as a good excuse to learn a new skill. For example, in 2018 I’ve impressioned a lock a day in January. In 2019, I’ve impressioned a dozen, and picked locks for the remaining days.

It’s very easy to start the challenge, and then let it drop when that one lock doesn’t open. So to help you along, here are a few tips and tricks.

  • Don’t set the bar too high, as the difficulty isn’t as important for your daily lock.
  • Try to incorporate lockpicking in your daily schedule, for example to pick your lock while waiting for public transit, or during a coffee break.
  • Plan out your month so you have enough easier locks for the busy days of the month.
  • If you challenge yourself with an F3D, have a contingency when it doesn’t open that quick, as someone on YT.
  • Skipping posting is better than skipping a pick.
  • Lastly, share your picked locks, no matter if it’s a steak or not. Celebrate the victories will help you stay motivated.
The two rings are easier locks than the box on the right, but at 25g each, you can’t beat the cores of Master Loto for weight. Toni took a box of these to keep his streak alive during holidays abroad. (Do check the country’s stance on lockpicking, though.)

With picking a lock a day, you built the lockpicking muscle memory. We as Toool advocate for using the three O of out name, oefenen, oefenen, and oefenen. Which is the Dutch word for practice. In English, you could say to pick locks over, over, and over again.

If you are inspired, please join the UKLS forum, and start sharing your picked locks. I would like to extend the invitation to any lockpicking streak, also if your streak starts on another date. Next to practice, share your achievements with the community.

This Kibb is my 1st pick of the year.

Pictures from Toni have his copyright. The rest are CCBY4.0, as per usual Toool Blackbag license.

Recap of 2023

December 29th, 2023

Hi all, I want to take the opportunity to look back at the year 2023, and discuss our achievements of the last year. The first post on Blackbag of the year was on a modified electric heater. While the post was off brand (as in: not a lock), it helped several pickers to save hundreds of euros on the heating bill. I’ve used mine ever since.

Our first event of the year was in February, a luxurious hacking experience at Hackerhotel. It was a good conference where we talked with our friends from other Dutch Hackerspaces. The talks were everything from community discussions to creativity and security topics. Toool hosted three impressioning workshops a day, and Jan-Willem gave a talk on experimental lockpicking techniques. Which includes, analysis of the Bowley Rotasera, and lessons learned on the Kromer protector.

Wendt hosted a well received lockpicking competition end of March. Walter and Henri competed, and several others joined for the exposition and side events. In case you have missed it, Wendt invites you to join their open house 2nd and 3rd of March 2024.

In May Toool was at the last HITBSecConf2023 in Amsterdam. Toool has hosted the lockpicking village for HITB Amsterdam from the beginning of the conference, and we made great friends along the way. It is truly an end of a decade. The lockpicking village has always been one of the more consistent and popular side events at the conference, and we hosted it again with great pleasure.

During the summer, several Toool members from the Netherlands went to Defcon and visited the lockpicking village hosted by Toool US and to promote Locksport. I, myself, went to the Chaos Communication Camp in Germany. This is the largest German hacker camp hosted by the Choas Computer Club. Jascha from Sportsfreunden der Sperrtechnik, SSDeV set up the lockpicking event, which was a great success. I’ve run a few sessions in English, it was good fun.

LockCon was in October hosted at the Westcord Hotel in Garderen. We hosted close to a hundred guests from all over the world. Where in the three days we ran four competitions, a dozen talks, and many locks picked. It was great to meet our friends again. The recap of the event is worth a read.

ACF organized their annual festival in December. Walter traveled to Paris for the event and competition and won the third price. Walter shares his thoughts in this post.

Next to all these big events, we went twice at Tkkrlab, Hack42, and several other small events. On average we have run a side event a month. Furthermore, we hosted a lockpicking meetup almost every week, as well as published several blogs on locks, tools, and more, here on Blackbag. In case you have missed them, here are the highlights.

Walter looks for interesting locks and published a series of small unusual locks. For example, Walter found a 28mm double euro cylinder from Keso which is unique as it is operated with a standard length key. This short 6-pin euro cylinder from Dom is also quite clever. The Evva Elus is also a curiosity. Given the lock has electromechanical master keying.

I’ve written quite a bit for blackbag, for example on the cutaway collection from Qikom. Furthermore, in a collaborative work, I’ve 3D printed keys for the Abloy Protec2, as well as analyzed the yet unpicked Dulimex PRO-LINE padlock.

Henri wrote about a clever implementation of multi tenant lever locks. These and other lever locks are quite rare here, sadly. It’s a wonderful, but forgotten technology, which still has a place in high security systems in the UK and Italy. Hopefully, Henri will write more about those in a future Blackbag post.

To end this list, we like to suggest reading a post with in depth technical knowledge. The report in the LockCon 2022 impressioning competition. The document can be quite useful for pickers interested in impressioning.

If you see something you like, please leave a reaction below the post. It’ll help grow the brand as well as motivate the writers to continue putting in the effort. If you want to share your project on Blackbag, do reach out as well.

Best holiday wishes from me and the rest of Toool,
May many locks open for you in 2024 🙂

Jan-Willem Markus
Secretary of The Open Organisation of Lockpickers

Progressive Disc detainer

December 17th, 2023

In learning lockpicking try to get all advantage you can get. A good first step is to learn as much as possible about the lock. For example, You should disassemble and reassemble the lock a few times, but looking at pictures on the lpubelts or lockwiki are good options as well. The next step is to assemble the lock with fewer locking elements, pick it, and increase the difficulty after each success. This is a well understood practicing method for pin tumbler locks, call progressive pinning.

I’ve built several progressive locks for myself and for teaching lockpicking to others. Of some locks, I’ve got a keyed alike set. In this way, you can practice the locks without the (sometimes tedious) opening and reassembly of the locks. For the practice session, just work through the locks in the set.

For disc detainer locks we aren’t lucky as the locks don’t function well without all the elements. The locks consist of a stack of code discs and spacers and all live in a partially cut hollow tube. If you have several of the same lock, you can use the spacers from one lock to fill the progressive lock. This technique worked well for an attempt to pick the Rosengrens 32A81 lock.

Disassembled Rosengrens 32A81 Safe deposit box lock.

Dmac shows an clever alternative for regular disc detainers in this video. https://www.youtube.com/watch?v=ehHG-BhgdMs He is replacing part of the disc stack with a properly sized tube to take up the space of the missing discs. The tube allows the key to operate the lock and has enough movement to move freely and not impede the sidebar, but small enough so the sidebar doesn’t drop in the core. This is a clever trick which is certainly worth testing.

In this post, I propose an alternative solution which is more generic, and will most likely work for all disc detainer, lever, and wafer locks. I’ve designed a spacer to fill the lock. The spacer shape can often be reproduced from the original lock parts in most CAD packages within hours. As a proof of concept, I’ve designed the spacers for the Anchor Las and laser cut the parts at Hackerspace Bitlair in Amstersfoort.

My process is quite straight forward: Measure the part, design it in OpenCAD, determine the laser parameters, cut the part, test the part. Then adjust and repeat the steps until satisfied with the results. (Or when you run out of material/time/money, whatever comes first.) It is like CI/CD, but in hardware, with an iteration cycle of about five minutes.

In the table below, I’ve captured the measurements of the core from the Anchor Las 833-3 padlock.

ItemSize
Disc pack20.51 mm
Disc1.395 mm
Spacer0.5 mm (calculated)
Core13.92 mm
Sidebar1.97 mm
Key width5.1mm
Spacers stack0.5 mm + 0.28 mm
Anchor Las measurements with a micrometer.

Getting the dimensions into OpenSCAD isn’t too difficult. I did however reuse someone else’s code for a partial circle, which isn’t trivial in this scripting language. (The code will be on the bottom of the page)

Laser cutters are amazing machines, and I’m always excited when finding a new use for the tool. My go-to materials are acrylic, Delrin, and the occasional sheets of triplex. While, acrylic isn’t the most robust, it makes for great visualizations. POM (Delrin and Acetal are the brandnames) is an engineering plastic great for key gauges and other locksport tools. It also so happens to work great for lock replacement parts.

To get the part the correct size, we need to compensate for the kerf (laser cut width). While it can be measured, I chose to do trial and error: change the kerf compensation in the Lightburn laser software and measure the parts with a micrometer. After I was satisfied, I ran a small batch of a hundred rings, just so there are enough to play with for me and other community members.

At the hackerspace, we actively share lessons learned. For this one, I’ve found putting a sacrificial material below the Delrin greatly improved the cut quality. Half the power and speed, with two passes also worked well. The laser parameters are saved to the Bitlair wiki for others to use in the future.

Back home, I’ve assembled the lock with the spacers and found them to be slightly too large. The sandpaper took off the difference quite easily. After reassembly, the lock works great with the key and it’s hard to distinguish from a lock with a complete disc pack. (I see options for a trick lock).

I’m looking forward to picking it, and will have others play with the lock as well to gather feedback on how the parts affects picking. As I expect the Delrin spacer have noticeably more friction than metal on metal, it will likely be beneficial to keep code discs in between original spacers. Furthermore, the lock works fine without a shackle and won’t brick on you without one.

Above are the minimum parts required for a functional front tensioning training lock.

I’ve picked the lock a few times with six random code discs. This is nine spacers of 1mm thick, and six of each code disc and metal spacer. After which, I quickly progressed through the other configuration, and picked the unmodified lock an hour later. As the spacers are thinner than discs, I’ve used the remaining metal spacers to fill out the remaining space.

At the moment we do not have a repository of lock parts, but we will likely create one soon.
In the meantime, the script for OpenSCAD is attached below. When you create your own discs, please share them around.

// Ancher Las spacer V2.1
// 20231213 Jan-Willem CCBY4.0
// OpenSCAD 2021

// F5 render
// F6 generate
// Export as ...

$fn = 100;

projection() // make it flat
difference(){ // substract the keyhole and gate from the disc
    union(){ // create the disc
        cylinder(1.4,11.4/2,11.4/2, center = true);

        // code for a part of a circle
        // https://openhome.cc/eGossip/OpenSCAD/SectorArc.html
        radius = 13.2/2;
        angles = [35, 145];

        linear_extrude(1.4, center = true){
        points = [
            for(a = [angles[0]:1:angles[1]]) [radius * cos(a), radius * sin(a)]
        ];
            polygon(concat([[0, 0]], points));
        }
    }

    //key hole
    cylinder(1.4,7/2,7/2,, center = true);
    
    // gate
    translate([0,-11.5/2,0])
    cylinder(1.4,3/2,3/2, center = true);
}

Copyright CCBY4.0 Jan-Willem Markus, Toool NL

French Open competition

December 10th, 2023

Yesterday, the yearly “Festival ACF” was held in Paris, France. This is a combination of lectures, workshops and competitions held by the ACF (Association des Crocheteurs de France), the French Locksport group.

I believe this must be the 4th or 5th time I visited. It was good to meet old friends and make new friends. The first lecture I saw was from a pentester, talking about a red teaming assignment (that did not involve physical security). Next was a historical overview of pump locks from Fichet-Bauche.

After that, the lockpicking championships were held. About 25 people participated. In the first round, people were seated at tables with at most four people, each having to pick three cylinders in less than 5 minutes. I got an Opsial, a Thirard (which felt very cheap) and an unbranded cylinder. The Opsial was my first and I made the mistake not to try and rake it. I spent too much time picking and though I made not even make it past the first round! But in the end, it was me and Wesley both going through, thanks to our quick raking of 2 (me) or 3 (Wesley) cylinders.

The second round I had 2 opponents, and the cylinders were more difficult, a TESA TE5, a Heracles and a Vachette V5. They needed to be picked in under 10 minutes. I opened them all and my opponents opened none, which meant I was in the final!

There were 4 people in the final, having to open 4 locks (BKS 6-pin, DormaKaba, Heracles with a horrible keyway and a GeGe). I needed to relax and try to open something, as I hoped to get a plaque to take home with me. The BKS I could not open, but the DormaKaba I did open in 13’11, so just within the 15 minute time limit. And that was the only one I opened.. Nitiflor opened the DormaKaba as well as the GeGe, Wesley opened just the GeGe (in 9’20) and Hadrian did not open any. Too bad I could not open the GeGe as well, as that would have yielded second place. The final result was: Nitiflor #1, Wesley #2, I came third and Hadrian fourth. But that meant I got a plaque!

The ACF had gotten some really nice sponsoring resulting in nice prizes. Nitiflor got the wonderful Multipick ARES disc detainer pick, Wesly the Kronos electropick, I got a Flipper Zero. And some more goodies including some cylinders (DOM iX TECO, M&C Minos) and a manual pickgun.

I hope to return to Paris next year, and maybe win another plaque. Although my scores are declining, in 2021 I became first (and second in impressioning), in 2022 I became second, this year third. I see a downward trend 😉

Walter.

Asking the community: How are pins painted?

November 22nd, 2023

A while ago, we had a discussion on our Discord server on how the pins for pinning kits are painted, as achieving the same effect at home was quite appealing. For example, to accentuating the different pins for teaching, or to make cutaways more fancy.

In this short blog, I’ll share what has been tried, and how we can use your help to solve the mystery.

A picture of a pinning kit by Nigel, Toool UK.

The first clue was from a pinning kit manufacturer, as they shared with a community member that the pins were soaked in bowls of food coloring. I’ve bought water based, and later alcohol based food coloring and tried the same. The color doesn’t really stick to the surface of the metal surface, as the metal was not clean enough. I wasn’t too scientific about improving the wetting and tried different cleaners. The paint didn’t stick to the pins, came on thick, or rubbed off with a towel.

A better attempt was to use alcohol (based) paints used for arts and crafts, as the pins are indeed painted. But the effect was fairly uneven and the paint washed off easily.

The best attempt was also the simplest, by painting the pins with permanent markers. The process isn’t complicated, simply rub the permanent marker on the pins. For a one-off cutaway, this process is quite feasible, but not for big quantities. Cleaning the pins beforehand will likely improve the results as well.

Edding 390 permanent marker for scale.

We have tried a few ideas, but this is where we are currently stuck. If you have an idea on how to paint these pins more evenly, leave the suggestions below. It would even be better if you gave the suggestions a go and shared the results with us.

Dutch Open 2023 Disc detainer picking results

October 23rd, 2023

The Dutch Open 2023 Disc Detainer competition was held in a self-timed format. Throughout LockCon, the participants worked on getting the best times on the five Disc detainer locks: 001 Fort Knox, 002 Parkside, 003 No-name, 004 Abus Plus, 005 Abus Plus with butterfly disks.

We used the Sparrows Disc detainer pick with a 3D printed spacer. One of the Sparrows tools was modified to allow tensioning lock 004, the Abus 37/55.

Nitiflor won the competition by opening all the locks and won a Sparrows Vorax set. ImSchatten360 opened all locks as well, but spend more time in total and won the second price, a Sparrows Tuxedo royale. Matt Smith opened four out of five and won for the third price, a Sparrows Tuxedo set.

Dutch Open 2023 Pentathlon competition results

October 23rd, 2023

The Pentathlon competition is a series of five lock challenges sponsored and hosted by Parmakey. The competitors had to pick a pin tumbler, pick a dimple, impression a key, pick a safe lock, and pick a car lock. Twenty competitors joined the challenge.

Torsten won the competition with 52 points and won a Sparrows Vorax lockpickset, a book on historic keys. Decoder, with 50 points, won the second price and received a Sparrows Tuxedo Royale and a book on safe lock history. Robert won the third price with 42 points and received a Sparrows Tuxedo set, as well as a book on locksmithing history. All three also received a bottle of Nabucco wine.