Archive for the ‘Uncategorized’ Category

Key duplication from a photo CTF

Sunday, September 22nd, 2019

Jos has a talk about key duplication from pictures. If you have not seen it: https://youtu.be/muINcnhj1EQ
For a conference there was the question: What does it take to make it into a workshop? There was little budget so we have turned it into a CTF instead of a training/workshop.
This CTF has no prices and might teach you something new.

If you ever wished you could try it without being sneaky, this is your chance. The CTF is a controlled and safe environment. You are encouraged to copy these keys!

The problem:
Publishing pictures of your keys is not a good security practice. Keys can be duplicated from a photo rather easily. Twitter and other social media are full of threads filled with pictures of keys. I got shared one but they’ve removed it on our advice.
(Note to self: Take more screenshots.)

Example: https://twitter.com/hashtag/zeigteureschluesselanhaenger
The hashtag is about the keychain but there are some perfectly decodable keys in there.

The CTF:
1) Get to the keys
2) Take a photo or make an imprint of it
3) Make a key
4) Test the key

Measuring tools and files will be available at the lockpicking village.
We are going to help as little as possible to not spoil the fun.

There are three keys at the moment:
CTF 1) Key will be published here
CTF 2) Key will be placed on the table at lockpicking villages (do not borrow/steal the key please.)
CTF 3) Key will be on the belt/lanyard of the Orga or instructors at the lockpicking Village

Please don’t publish pictures of the CTF 2 and CTF 3 key. You are allowed to do a writeup about CTF 1.

CTF Key 1:
Key measurements:

As there was still some ambiguity, this picture should prove be useful. Each square is 5mm by 5mm.

All locks are standard unmodified 5pin Abus/Buffo. The blanks that work are Y1, 1A (SKS/JMA), CS206 (Silca) and many others. You’ll get points for sourcing your own keys. Really, give it a try!

This CTF will run for the next months to years. Come see Toool at a conference near you.
Next up: Hardwear.io, HITB, LockCon and Hackerhotel 2020.

If you want to play but can’t make it to a conference. Please send me a digital bird at Jan-Willem at Toool dt nl. You’ll be send three pictures and a post address. You can mail me the physical keys you’ve made.

I’ve tested the CTF myself. It took me about 30 minutes to make three keys from a photo.
Please, don’t publish pictures of your keys, stay safe.

Published by Jan-Willem.

Impromptu lockpicking village at Bornhack IV

Monday, August 19th, 2019

Jos and I (Jan-Willem) where at Bornhack.dk a small hacker conference in Denmark. Not only where the talks interesting also the quietness was welcome. Bornhack does not have multiple tracks so plenty of time to relax and pick locks.

We brought a lockpicking village in a box. A decently sized tool case with everything you’d need for a unplanned lockpicking village.

I’m attempting to learning manipulation of safe locks and brought a S&G lock and a bunch of manipulation sheets to Bornhack. It took me the better part of three days to crack it. (For a upcoming conference I’ve got an hour.)

Manipulating safes and safecracking sparked the interest of multiple people and I’ve did my best to explain the basics. What I was doing and how to exploit the lock.

Jos did his talk on post-its and invited people to join us at theFEEST village. aka Dutch village with free beer and stroopwafels. Many Danish hackers joined us at the village. It’s always fun to teach people a new skills.

Internet of lockpicks.

Note to self: Create a http://www.istodayfriday.com/ like website for lockpicking.

Lockpicking escape rooms

Tuesday, December 25th, 2018

Eric runs a lock shop (Au P’tit Clou Serrurerie) in Belgium, in the city of Beauraing (near Dinant and also near a degree confluence point). He has also set up a few escape rooms with a lockpicking angle. If you’ve ever been in an escape room, you know they often involve locks to be opened, to get to the next stage. But the the escape rooms Eric designed, are completely in a lock theme. One is based on the story of Charles Hobbs. Hobbs was the first to defeat the security of the locks of Jeremiah Chubb and Joseph Bramah. We still call the tools he used ‘Hobbs Hooks’.

When Eric saw the talk of Tim Jenkin at LockCon 2017, he was inspired to build another escape room about his amazing story of escaping from a Pretoria jail as well. So if you would like to relive that experience, be sure to visit Trésors Cachés!

Results Toool NL championships

Friday, October 5th, 2018

Toool organises an ongoing competition that ends every year at LockCon. A box with locks travels to all meetings and members of Toool can have a go at them and Toool competition. Since you can really get to know the lock (you can try as often as you like), the opening times become very fast over the year.

The results of the competition were:

1. Walter 266.5
2. Jos 235.5
3. Tom 204
4. Decoder 198
5. Rob 127
6. Rolf 66
7. Martin EHV   36
8. J-W 32
9. Christ 19
10.   Maykel 2

Here we see the winners, from left to right Tom, Walter and Jos:
Toool competition winners
Picture by Urs

Results Lever Lockpicking championships

Friday, October 5th, 2018

The newest of the competitions is the lever lock competition. This is really fast paced, four locks to be opened in each round, with just two minutes per lock. This is done in groups of four, the winners of each group go to the final. One group had no winners (no locks opened). The first rounds went as follows:

Round  Name Lock 1  Lock 2  Lock 3  Lock 4 
1 Nigel 1’28 1’59
Femurat 1’05
Torsten
Walter
2 Julian 0’43 0’56
Lars 1’09 0’58
Decoder 1’42 0’54
Cattani 1’28
3 Oli 1’32 0’51 1’58
Kilae
Dune
Zanella
4 Harry 0’23 0’47 1’59
Jaakko 1’39
R@y
Jascha
5 BenD
DG
Klepas
Topy
6 mkie 0’34 1’15 0’24
Morris 0’24 1’33 0’39
Marc 1’27
Tom

The finals were exiting, with the following end result:

# Name Lock 1  Lock 2  Lock 3  Lock 4 
1. Julian  1’07  1’32  1’20  1’52  0’56
2. Oli 0’34 1’28 1’58 0’34
3. Harry 1’37 1’24 1’22
4. Nigel 1’50
5.  mkie

Here we see the winners, from left to right Harry, Julian and Oli:
Lever lockpicking winners
Picture by Urs

Results Impressioning championships

Friday, October 5th, 2018

Also many people participated in the impressioning championships. Given an Abus C83 cylinder and some blank keys, the goal was to make one of them into a working key as fast as possible. The first six would then proceed to the A-final, the second six to the B-final, to open another set of six locks.

The first round lasted an hour, but the first two times were under a minute!

The results of the first round:

1. J-W 0’51
2. Jos 0’59
3. Manfred 1’11
4. Oli 1’12
5. Harry 1’32
6. Morris 2’10
7. Alex 2’34
8. Holly 2’40
9. Walter 3’03
10. Django 3’38
11. Jord 5’51
12. Torsten 6’34
13. Zahella 7’48
14. Nigel 8’04
15. RFGuy 9’46
16. Marc 10’36
17. R@y 14’08
18. DG 15’43
19. mkie 15’50
20. Julian 22’31
21. Hotaru 23’41
22. Tom 28’05
23. Matt B. 30’12
24. mh 31’02
25. Lars 44’45
26. Martin.BE  26’28
27.  Jascha 47’42

Then the top-6 were to compete in the (A) final. The numbers 7 through 12 did the B-final. The results were as follows:

A FINAL

1 Jos 1’55 7’27 13’54 8’14 5’12 4’28
2 Manfred   7’17 5’45 7’06 2’42 5’40
3 Oli 2’53 8’14 3’14  11’28
4 J-W 10’38   3’51   12’02   12’02 
5 Harry 6’16 4’58 6’45
6 Morris 11’02 11’57 6’42

B FINAL

7 Jord 7’46 2’55 3’57   7’35
8 Alex 7’56   11’06   5’05   6’42  
9 Torsten   8’09 5’52
10 Walter 8’48 12’20
11 Django 6’08
12 Holly 6’21

Here we see the winners, from left to right: Oli, Manfred and Jos:
Impressioning winners
Picture by femurat

Walter doing impressioning
Picture by Dennis van Zuijlekom

Hack in the Box Amsterdam

Tuesday, April 18th, 2017

We regularly give lectures and workshops at conferences and for companies. Contact us if you are interested. Last week, we were at the Hack in the Box conference in Amsterdam, where we taught people how to lockpick. They even included a lockpicking challenge in the Capture the Flag competition. Here is a picture of the lock we used for that.

challenge

Toool competition 2017 has started

Wednesday, January 11th, 2017

Every year, Toool NL has a competition that is only open to Toool NL members. A box of around 25 locks travels to all meetings where members can try to pick the locks. What makes this quite different from regular competitions, is that you can get to learn the lock. You are allowed to improve your best picking time throughout the year, figuring out what tool works best and in what order you need to set the pins.

We assembled 26 locks this year, ranging from used locks with no apparant brand name to factory new locks. The Best lock was donated by Christina, some other locks were donated by Eurokey and Locksystems in Eindhoven, thanks! Last years competition was pretty stiff, so we settled for what we believe are slightly easier locks, but time will tell if they really are.

The competition page is at https://toool.nl/competitie2017/.

The 26 locks for 2017

LockCon day #3

Monday, October 3rd, 2016

Day #2 almost blended into day #3, the last day of the event, filled with lectures and a competition, just like the previous days. Mr. Cherepov showed his safe lock that uses a matrix key. Decoder talked about how he created a tool to pick the DOM Diamant lock. Jaakko talked about his research on safe combination locks that could lead to such locks being opened in a few minutes.

After that, we had a lever lock competition. Last time, this was an impromptu thing, this year it was a real competition with a record number of participants. With only 2 minutes per lock in the first round, this was quickfire picking. Still, all the 10 groups had at least one person open a lock. The fastest 10 then tried to open six locks in the final. Only Lars succeeded in opening all six, winning him first prize.

More problems for Abloy Protec? Decoding the pickproof lock?!?

Friday, February 6th, 2009

Having a weblog like this attracts a lot of interesting people. And some people who think they are interesting and just try to feed you with little tidbits of information to ‘tease’ you. Well … I think I have grown pretty immune for that.

One of these people mailed me little over a year ago is interesting though. He claimed to had developed a method of decoding an Abloy protec ‘in around ten minutes, fifteen max’. His real problem was cutting the keys after decoding the lock. During some long talks he explained that decoding a 2, 3 or 4 cut disk was the most easy, without telling me how he did it.

Abloy Protec Decoder

And all of a sudden today there is a video on Youtube, showing the decoding of an Abloy Protec. What you see is some sort of probe tool (made from a keyblank), a scale and a laser pointer to tell you how far the probe can be turned. It seems as if this way you can identify the position of the disc, and the laser pointer will tell you the number of the cut. It is a pity he is holding the lock in his hand and that he is using a cut-away lock that is set to the factory cutaway combination ….

But this sure is a big dent in Abloy’s reputation. First the video of a destructive opening technique and now a video of decoding the ‘pickproof lock’.

I am convinced the person who made this video is very skilled and bright, and I think the video and tool are for real. I would just love to see some more close ups of the tip of the tool and some more info. And that also goes for another strange video that was released on Youtube: Pick Mottura doppia mappa.

If all goes well I will meet the person behind these tools and techniques in a month orso, and hopefully can give you some more details. In the meantime we can all speculate about the tool in the comments 😉

* Update 06-02-2009 (19:15) : the video was removed before it even got 500 hits. It is a good thing I captured it before it went offline …

** Update 08-02-2009: the video became online again on youtube and could been found here.

*** Update 14-02-2009 video was removed from youtube again…