Archive for the ‘Uncategorized’ Category

The Vault below the Nutshuis, The Hague

Saturday, December 4th, 2021

Hidden in plain sight are the obsolete vaults in old bank buildings. What do you do with them when they no longer serve their purpose? Tearing down the vault is usually out of the question, as the buildings are cultural significant and therefore protected. But you can make it in something useful again, as long the main structure remains intact.

Most bank building conversions are quite dramatic, as where others leave the vaults mostly intact. Walter send me the suggestion to show a famous geocache: GC2JV5X, van “Kluis tot Kookhuis”, this bank building is converted into a shop for high-end cookware. One of the deposit boxes in the basement is the geocache.

In this case, I wasn’t looking for a vault, but with just dumb luck I came across one while giving trainings. Specifically, I was in The Hague at the Nutshuis named after the Nutsspaarbank, this savings bank that used it as headquarters from 1921 to 1992. While staying in an old bank building is kinda crazy, the ‘nut’ in either building and bank is the Dutch word for utility.

The host was very kind and let me in the vault to take pictures, hopefully these will give you a nice insight in the 1920s vault technology. Most of the building and vault is still original, they removed most of the safe deposit boxes to make the room function in its new purpose as a movie room. To enter the vault there are originally three heavy doors of which two are prodded open and one is permanently closed.

Inside the movie Vault.

This is the door on the right side of the building. The door is heavy and impressive and clearly designed to intimidate, as it has many more locking bolts than necessary and large handle and gearing on the outside. This door has three locks: One keyed safe lock, one Chubb/Lips vault combination lock, and one Kromer time lock, similar to one I’ve in my collection.

Vault door two is less impressive looking and has a completely different style: it has a flat, unimpressive looking door with two keyed safe locks and a normal size handle. What locks they are, we can only guess at.

The third door is similar in style to the first door in the list. However, the day gate was still in place, and they removed the back cover from the safe. From the picture, we can see the same Kromer time lock and a Chubb/Lips vault combination lock.

Here are a few links I’ve promised. While the pages are largely uninspiring and the photos aren’t as clear. These will give some idea of what is out there and the hidden treasures there are to discover.

Amsterdam’s Archive: http://www.lucvandelagemaat.nl/category/voice-over/
Deventer, Carlos in huis: Furniture and living https://carlosinhuis.nl/winkel/
The Hague, Nutshuis filmkluis: https://nutshuis.nl/zaal-huren/filmkluis-en-foyer/#et_pb_dp_oc_custom_0_3
Den Bosch, Robbies concept store: https://www.verwersstraat.nl/robbies/

I’ll finish this post with a these safe deposit boxes used as props throughout the basement.

Article and pictures CCBY4.0 Jan-Willem Markus at Toool Blackbag.

JimyLongs’s Lockpick Project

Monday, August 2nd, 2021

JimyLongs made a small batch of custom lockpicks and shared them with his friends to get feedback on the design and to make them better. I was fortunate enough to be included in the European distribution and testing of the picks.

The pick making process is pretty involved from selecting the right materials to endlessly simulating and tweaking the design. Jimy had the picks laser cut and it was not without issues. It turns out laser cutters can be too powerful and ruin the picks in the process. Furthermore Jimy build his own injection molding apparatus for the handles.

Let’s have a look at the picks. 🙂

The set contains three picks; short, medium, and long hook in 0.5mm. The picks are full tang tempered & polished 1095 carbon steel with characteristics similar to High Yield SS 301.

I like the picks very much. They give great feedback as they are very stiff. No chance I’ll snap the handles like I did once with a Southord Max (Sad image). Can’t wait to bring these picks to a meetup and gather more feedback for Jimy.

To wrap this one up let’s compare the profile of the long hook to other picks in my kit.

From left to right: Peterson H7, Sparrows SSDeV, JimyLongs long hook, Multipick PN04, Southord Max, Law Lock Tools Tipene Teardrop.

For me the thinnest profiles work best (LLT & SSDeV). Each of these picks have their uses.

That’s all for this post. See you in the next one.
Photos CCBY4.0 Jan-Willem Markus Toool Blackbag.

New tool: EVVA Dual Gut Key

Thursday, June 24th, 2021

The EVVA Dual is a lock with twelve spring loaded sliders and two sidebars. One on each side. It is an exceptionally hard lock to pick. Reinder Stegen, a gifted picker, found gutting of the Dual error prone and devised a tool to help with gutting the lock instead.

EVVA Dual with the correct key inserted.

For a normal pin tumbler lock you can gut the lock once the plug rotates freely. This can, for example, be achieved by picking, back shimming, or using the key. The EVVA Dual can’t be gutted in the same way as a regular pin tumbler lock as the sliders protrude the cylinder both in the resting position as with the correct key. While the housing has grooves cut for the sliders to slide and rotate this also means that gutting the lock is much harder to accomplish.

EVVA Dual Gut Key moved the sliders down

You will find more detailed pictures on the EVVA Dual on a recent upload to the Lock Wiki. http://lockwiki.com/index.php/EVVA_DUAL This wiki has been quietly expanding with lots of detailed pictures over the past year. Certainly worth a look at the Abloy Easy and the Chubb Mark IV Manifoil that are recently added.

Let’s get back to the EVVA Dual as that’s what this post was all about. The solution to gutting the EVVA Dual is this Gut Key (Set-up key for gutting) designed and 3D printed by Reinder. It solves the problem by moving the sliders down to the fictitious ‘shear line’ making gutting the Dual a breeze.

EVVA Dual Gut Key by Reinder Stegen

Reinder Stegen was kind enough to allow inclusion of the pictures and STL under CCBY4.0.

Alternative download for the Gut Key: https://www.thingiverse.com/thing:4892450

Bought a safe; decoded; sold

Tuesday, June 15th, 2021

This is a short story of me, Jan-Willem, buying a floor safe without a combination. Then failing to decode it, resorting to an alternative method, and eventually having to part with it again.

Let’s start at the beginning. I’ve found a rusty Major floor safe for sale online, without combo. The ad looked alright and the price was good. I miscalculated the drive and spend the next five hours in the car to pick it up. (Note: I live pretty cental and the Netherlands is not that big.)

The safe was also a lot heavier than anticipated and comes in at about 40kg (~90 pound). The safe door is about 8kg (17 pound).

Failing to manipulate
First up was cleaning the safe. The dial felt quite gritty and washed most of the sand away with lock spray from the WD-40 company. It worked quite well. It also created a huge mess in the safe but that was not my concern at the moment.

I’ll just say this outright: I’m not good at manipulating safes. I’ve beaten a few S&G but never beyond 6730 and 6741. Manipulating it was a pain as the space was tight and the dial didn’t show much. I must have spend 10h on it over a week and gave up on it.

Opening the safe, slightly destructive
When I have projects like this I want them done as soon as possible. I decided manipulating was not fun and resorted to the semi destructive method of drilling a small hole and use the key change hole to dial the safe open. I’ve used a 8mm (1/3th inch) hole and a 4mm (1/6th inch) camera. (Hopefully more about those in an upcoming blog.) The process was still quite painful but I’ve learned a lot from it. It did not take more than 60 minutes in the end.

As the camera is actually an integrated USB webcam I’ve recorded the process and shared for your entertainment. The short version is 82 seconds and the long version just over half an hour. [note to self: fix Word press so it embeds YouTube videos properly.]

Short video: https://youtu.be/t72zbyRs2EI
Full video: https://youtu.be/jezF5elcHbc

Selling the safe
I’ve promised to share the full story so I’ll share a bit about selling the safe as well. These safes are quite rare here. From a quick search I’ve found a new safe door would cost me about €1k. Mostly shipping and import charges.

I love buying second hand goods. I search online and find an item, strike a conversation, place a very good bid, and pay minutes after we struck a deal. Selling on the other hand is extremely painful. (Hence why good manners work so well as a buyer.) For this safe I’ve taken plenty of detailed pictures, included all measurements, and put the safe up for sale. The difference between one buyer and another is clearly noticeable. Many people offered me to take the safe away for free or next to nothing and were offended when I said no. Finding a buyer took a few weeks.

The buyer asked for details on the change key mechanism and I’ve found the La Gard change key worked well. I’ve reset the combination to a random but valid combination. The buyer was unfamiliar with safes and how to operate them. We must have spend an hour on it. Instructing him how to dial the safe and he preformed the dialing a dozen times.

Just before the buyer left with the safe, afraid they would forget, they recorded them selves opening the safe. I’ve discussed this with a few locksmiths and it’s apparently normal. People, scared to forget, will take videos or involve spouse to help remember.

I’ve made a bit of profit on it, not including my time. Learned a few new tricks and have another story. I’ll think twice before buying another safe without combo but we know it’ll happen again.

Pictures
Lastly I want to add a few pictures for the archive. The lock is integrated in the safe door and can’t be removed or function without the door. The safe door has a cover that’s held in place with a large spring washer. Without the cover a relocker prevents the lock from opening.

Photo credit: CCBY4.0 Jan-Willem Markus, Toool Blackbag

Other than the circular nature of this lock it’s very similar to a La-Gard 3330.

Cellular CyberKey

Friday, April 30th, 2021

A friend knows I’m into electronic locks and gave me this CyberKey key as a present. He did not have the locks to share so you will have to do with pictures of the key. Let’s just admire the construction and not worry about all the ways you would break an electronic access system like this.

Note: Click the pictures for the full size image.

CC-BY-4.0 Jan-Willem Markus Toool Blackbag

Toool Discord server invite

Tuesday, March 9th, 2021

Toool NL has created a Discord server to keep in touch with other lockpickers in The Netherlands and meet new people in locksport. If you are interested in joining Toool or just want to chat about locks, please join and meet us on the Discord server.

Discord is a text based platform similar to IRC and Slack. It is not a forum where discussions are grouped into subjects and threads. Discord uses categories and channels instead. The style suits better suited for ongoing conversations or for fast pase communication than in depth discussion on a topic. Discord is not limited to text and can also be used as video chat or sharing photos.

Toool UK has a Discord server for several years with great success. The Toool NL server is live from January and is now open to the public.

Find the latest invite link on the gatherings page
Create a Discord account. Click the invite link. Complete the CAPTCHA and write a short introduction in #introduction. The member role will be added manually, please be patient as we are not on Discord 24/7. Toool members are asked to register and send a mail to the board with the full Discord username. You can call it a 2FA.

On the server we have different roles and privileges. From member, trusted member, board, and admin. It is not the goal to gate keep but it is useful to limit accessibility to some content for newly joined. This will for instance protect against bots, scraping or spamming the server.

Do keep in mind Toool does not host the server. Do not post things on the internet that should not be on the internet. Not limited to: Personal details or secret research.

Hope to see you on the Discord!

:(

Sunday, May 10th, 2020
🙁

TL;DR : lockcon 2020 is cancelled
The slightly longer version:
With conferences being cancelled left-and-right in these current covid-times it wont surprise you that the ToooL.nl board has rather extensively been looking at options.
The dutch government has drafted, a rather ambitious, timetable to battle the current crisis.
According to this schedule, September 1st would be the first point in time to give an actual go/no-go for lockcon2020. Mind you, this is in a rather best-case scenario. That would give us a bit less than two months to get organized, AND for our guests to sort out vacation days and (international) travelplans.
This currently seems unfeasible to us.

By interpreting the rules to the letter, there might be loopholes to be found to legally be allowed to organize and run the event as originally planned. And yes, we really would like to run the event, but we would like it even more if our lockpick community members would stay healthy.

Jan-Willem (co-chair)
Tom (finance)
Jos (chair)

Key duplication from a photo CTF

Sunday, September 22nd, 2019

Jos has a talk about key duplication from pictures. If you have not seen it: https://youtu.be/muINcnhj1EQ
For a conference there was the question: What does it take to make it into a workshop? There was little budget so we have turned it into a CTF instead of a training/workshop.
This CTF has no prices and might teach you something new.

If you ever wished you could try it without being sneaky, this is your chance. The CTF is a controlled and safe environment. You are encouraged to copy these keys!

The problem:
Publishing pictures of your keys is not a good security practice. Keys can be duplicated from a photo rather easily. Twitter and other social media are full of threads filled with pictures of keys. I got shared one but they’ve removed it on our advice.
(Note to self: Take more screenshots.)

Example: https://twitter.com/hashtag/zeigteureschluesselanhaenger
The hashtag is about the keychain but there are some perfectly decodable keys in there.

The CTF:
1) Get to the keys
2) Take a photo or make an imprint of it
3) Make a key
4) Test the key

Measuring tools and files will be available at the lockpicking village.
We are going to help as little as possible to not spoil the fun.

There are three keys at the moment:
CTF 1) Key will be published here
CTF 2) Key will be placed on the table at lockpicking villages (do not borrow/steal the key please.)
CTF 3) Key will be on the belt/lanyard of the Orga or instructors at the lockpicking Village

Please don’t publish pictures of the CTF 2 and CTF 3 key. You are allowed to do a writeup about CTF 1.

CTF Key 1:

Key measurements:


As there was still some ambiguity, this picture should prove be useful. Each square is 5mm by 5mm.

All locks are standard unmodified 5pin Abus/Buffo. The blanks that work are Y1, 1A (SKS/JMA), CS206 (Silca) and many others. You’ll get points for sourcing your own keys. Really, give it a try!

This CTF will run for the next months to years. Come see Toool at a conference near you.
Next up: Hardwear.io, HITB, LockCon and Hackerhotel 2020.

If you want to play but can’t make it to a conference. Please send me a digital bird at Jan-Willem at Toool dt nl. You’ll be send three pictures and a post address. You can mail me the physical keys you’ve made.

I’ve tested the CTF myself. It took me about 30 minutes to make three keys from a photo.
Please, don’t publish pictures of your keys, stay safe.

Published by Jan-Willem.

Impromptu lockpicking village at Bornhack IV

Monday, August 19th, 2019

Jos and I (Jan-Willem) where at Bornhack.dk a small hacker conference in Denmark. Not only where the talks interesting also the quietness was welcome. Bornhack does not have multiple tracks so plenty of time to relax and pick locks.

We brought a lockpicking village in a box. A decently sized tool case with everything you’d need for a unplanned lockpicking village.

I’m attempting to learning manipulation of safe locks and brought a S&G lock and a bunch of manipulation sheets to Bornhack. It took me the better part of three days to crack it. (For a upcoming conference I’ve got an hour.)

Manipulating safes and safecracking sparked the interest of multiple people and I’ve did my best to explain the basics. What I was doing and how to exploit the lock.

Jos did his talk on post-its and invited people to join us at theFEEST village. aka Dutch village with free beer and stroopwafels. Many Danish hackers joined us at the village. It’s always fun to teach people a new skills.

Internet of lockpicks.

Note to self: Create a http://www.istodayfriday.com/ like website for lockpicking.

Lockpicking escape rooms

Tuesday, December 25th, 2018

Eric runs a lock shop (Au P’tit Clou Serrurerie) in Belgium, in the city of Beauraing (near Dinant and also near a degree confluence point). He has also set up a few escape rooms with a lockpicking angle. If you’ve ever been in an escape room, you know they often involve locks to be opened, to get to the next stage. But the the escape rooms Eric designed, are completely in a lock theme. One is based on the story of Charles Hobbs. Hobbs was the first to defeat the security of the locks of Jeremiah Chubb and Joseph Bramah. We still call the tools he used ‘Hobbs Hooks’.

When Eric saw the talk of Tim Jenkin at LockCon 2017, he was inspired to build another escape room about his amazing story of escaping from a Pretoria jail as well. So if you would like to relive that experience, be sure to visit Trésors Cachés!