The Toool NL competition is a lockpicking competition which is available at meetups for the members. About twenty locks are selected, and the members improve the picking times throughout the year. Opening a lock in the best time gives ten points, 2nd best time nine points etc. The member with the most points at the end of the year wins the competition. https://toool.nl/competitie2023/
Jos, Henri, Jan-Willem and Rob made a quick start in the competition at the first meetup. At the Eindhoven meetup, Walter took the lead, and kept the top score throughout the year. There was more competition for the second and third place, and was held and lost by many. (Week by week: https://toool.nl/competitie2023/tussenstanden.html)
Walter won the competition with 215.5 points (out of 240) and received a Multipick Kronos Electropick. Tom won the second with 178.5 points and received the Multipick Elite Meister 19-parts lockpick set. Jos won the third price with 170 points and received a Sparrows Vorax pickset and a Sparrows pinning mat.
Kudos to the dozen people who have opened at least one lock in the competition!
The Dutch open 2023 lockpicking championship had 51 competitors. Tables of up to nine were created for the first round, in which relative simple locks are picked in at most five minutes per lock. The two picker with the most opens at the table competed in a bracketed round, where each competitor picks two lock for fifteen minutes each. The last three play the finals.
ImSchatten360 won the competition and received a Multipick Essentials 39-piece lockpick set. Manfred won the second price and received a Multipick cutaway lock and a Sparrows pinning mat. Torsten received a Multipick Bogota set for the third place.
From 12 to 15 October 2023, Toool organized LockCon, a Locksport conference with attendees from Europe and the USA. Here is a recap of this year’s event at the beautiful Westcord Hotel Veluwe in Garderen.
On a warm late summer day, we started LockCon. After check-in and setup at the venue, the first of guests already arrived. It was great to meet so many friends again. On Thursday evening, we dined at a restaurant at walking distance from the venue, after which we set up the conference hall for the talks and competitions. We protected the tables with stucco runner, as locks and vices can otherwise easily damage furniture. The rest of the evening was used to meet new people, catch up with friends and discuss lock topics at the hotel bar.
After a first night of not enough sleep, we had breakfast at the venue’s restaurant. The food selection was nice, from the usual bread to fruit salad, yogurt, scrambled egg, and poffertjes! Jos opened the conference by highlighting achievements of the community, including the LPU belt explorer picture archive and Locksport. Jos thanked the sponsors, Abus, Multipick, Sparrows, and Dulimex, as well as the LockCon team, who make LockCon possible.
The first talk was by Walter, who introduced the Evva Elus electromechanical temporary access function lock, and updated the attendees on the Anker 3800 research. It’s incredible what we can do with a bit of dedication and a 3d printer. There was an active debate if Anker 3800 magnets can be overlifted.
In another talk, Zeefeene shared his insights in manufacturing locks in China. From the lesson in using chopsticks to a deep dive in lock diplomacy. The highlight of the talk were the videos of lock manufacturing equipment, which showed keyway broaches to full automatic lock assembly machines. It was eye-opening as these insights are rarely shared.
After lunch and socializing, it was time to set up for the impressioning championship. Thirty-four competitors tried their skill against the Abus C83. It was nice to compete again, and it’s amazing to see how much different it was compared to the competition last year. In both finals, the majority locks opened, with several competitors opening all the locks.
After dinner, with again a good selection of food, we had an evening of disc detainers. Idanhurja gave a talk on his Abloy disc detainer picking adventures. From figuring out Abloy classic from first principles to advanced techniques to defeat other Disc locks from the same brand. The rest of the evening was filled with workshops on the Abloy classic by Idanhurja and the DaMage Fichet F3D (Not a DD) workshop by Nitiflor. We also made a start with the disc detainer competition. I’ve selected five locks, from ‘relatively easy’ to ‘unlikely to be opened’ and Sparrows sponsored the disc detainer picks.
Saturday we started with my talk about electronic safe locks. I’ve shared my insights in how you can attack embedded systems and specifically electronic safes. The target is the Kaba-Mas X0 series locks. Starting from the X07 from ’92 and building to analyzing the electronics of the X09. I’ve shared about hardware reverse engineering, but also high-end techniques like laser fault injection used to extract the memory content of the lock. While still a lot of work has to be done, progress is made.
Lubos Cech shared stories about the early European lock industry. For example, the euro profile cylinder hasn’t been the standard forever. One manufacturer designed and patented the hole through the two lock bodies to fit a mounting screw. While this is regarded as a mistake from a security perspective, the competitors worked around the patent and came up with many innovative solutions. Including clamping the lock from the side in various ways. The stories fit quite well with the lessons learned in manufacturing shared by Zeefeene.
For the lockpicking championship, fifty-one competitors joined. We started in groups of nine and worked towards a bracketed system after the first round. Many people opened locks, and some were unlucky on the table placement. A lot of pin tumblers have been picked from the following selection: Kibb, Nemef, Mastermate, Dom Plura, Destil, Era, Basi, M&C, S^2, Zi-Ikon, and Winkhaus.
In the evening, Matt Smith (Huxleypick) ran his presentation on Physical Vulnerability Research. In which he shared the things he researched over the years and how others can get involved as well. After that, we ran had the price ceremony for the Lockpicking, Impressioning, and Toool NL competition.
We ended the night with a panel on the new book Locksport. Walter, Jos, Matt, and Nigel shared their stories on what it’s like to write a book on the subject. Where the key point is: it’s a lot of work. A nice summer project, which ends up being several years of small improvements until there is something really called a book. This book is a great introduction to the hobby and will make Locksport more popular than ever.
On Sunday morning, a presentation and panel discussion on RFID hacking was organized by Torsten, Christian Holler and mh. It was well worth the time and certainly interesting to see how hotel cards function. Mh shared a list of the current RFID devices, for those willing to get started.
BugBlue shared how the badge works and how you can start working with shop price tag e-paper displays. It’s a great idea, and hopefully we will see more like it for other events. https://openepaperlink.de/
The final event at LockCon was the Pentathlon competition, hosted by the Italians from ParmaKey. Within about an hour, the competitors had to complete five lockpicking challenges. Pin tumbler picking, dimple picking, creating a key with impressioning, lever lock picking, and car lockpicking. For each challenge, a time limit is given and if you didn’t finish the challenge in the limit, you have to wait a couple of minutes before starting the next one. Participants shared that waiting four minutes after failing the impressioning challenge indeed felt punishing. Mostly, because everyone who passed the gate in time got to continue with the next challenges. In the closing ceremony, the prices for the disc detainer competition and Pentathlon competition were handed out. After which we cleaned up and said our goodbyes.
I would like to thank the people who made LockCon possible. Thanks to Sparrows, who sponsored their disc detainer lockpicks for the dd competition and a large box of goodies including various lockpicking sets. Thank you, Multipick, for sponsoring the prices for the competition, including various community lockpicking sets from Christina, Decoder, and LockNoob. As well as a ERAS disc detainer lockpick for Toool to practice with.
For as long as we work with Abus C83 in the Impressioning championships, Abus sponsors the locks and blanks for the competition. The majority of locks and blanks are used up, and the remaining will be used to teach the skill and help people new to the hobby getting started.
Thanks to Dulimex for sponsoring five Pro-Line padlocks with a Tokoz core to challenge the lockpickers with a unique challenge. The group from Italy, with ParmaKey ran the Pentathlon competition for us, and we thank them for all their effort.
Thanks to the LockCon team who made LockCon possible. Without them, it wouldn’t be possible: Jos, Holly, Chantal, Jan-Willem, and Hugo. While organizing this event was a lot of work, it was well worth it. Finally, thanks to all presenters, other organizers, and participants for joining LockCon as you made it a great event again. We hope to see you all again next year!
All the pictures are by Toool NL. Feel free to use the photos of locks under CCBY4.0, and for pictures with people, please ask for permission first.
Dulimex kindly sent us the new PRO-LINE padlocks as a lockpicking challenge. Picking these won’t be easy, as the padlock features a Tokoz Pro core with eight disks and a disk blocking system similar to Abloy Protec.
While it’s fun to spend days picking the lock, picking isn’t necessarily a realistic threat for your normal security needs. This Dulimex padlock achieved a SKG** rating. While it’ll not be indestructible, you have the assurance it’ll be at least a few minutes with a selection of power tools.
We received five locks from Dulimex for the challenge. The locks will be available at LockCon, and we will borrow them to pickers thereafter. If you are up for it, please send us a message.
At first glance, the core looks similar to the Abloy Protec. But there are quite a few notable differences. The Tokoz very cleverly uses the spacers to build up the core. The construction makes it difficult to reassemble the lock, so please keep them together.
Thanks everyone for giving me tips on picking these locks. The tips can be summarized as, to use dimple picks instead of a 2-in-1, unless one is custom-made for the Tokoz. Furthermore, the key guide can be twisted, which bricks the lock. When the lock is picked, then use a modified key to rotate the key guide, instead of forcing it from the front.
In an effort to bring people up to speed on the Dutch Open Competitions at LockCon, we are publishing the competition rules. The PDF below are rules for the Lockpicking, Impressioning and Lever lockpicking competition, exported from the ‘How to run LockCon’ document written by Walter in 2016.
We have a lockpicking, impressioning, disk detainer, and Lockpicking Pentathlon. The Pentathlon has five opening techniques which includes picking, lever lockpicking, car locks and much more.
The organizers will put up flip overs, on which you can register yourself for the competition. Please be on time when the competition starts. We aim to have Impressioning on Friday afternoon, Lockpicking on Saturday afternoon, and the Pentathlon on Sunday.
Lockpicking
For LockCon 2023 we will run the lockpicking competition with locks commonly found in the Netherlands, in addition to locks kindly sponsored by Zeefeene and Nigel from Toool UK.
The locks are pickable with normal lockpicks, of which we do not have a restriction for custom or commercial.
We aim to have locks without a secondary locking system, I.e. sidebar.
Applying torque on the tailpiece instead of using a tension wrench is allowed.
The time per round is adjusted for the difficulty of the lock, usually 5/10/15 minutes per round.
Impressioning
The Impressioning competition will be on Abus C83 locks, kindly sponsored by Abus. The first round will be an hour, and the A and B finals are planned to be six rounds of 15 minutes each.
In addition to the rules below, we added several small nuances to the rules:
The tailpiece of the lock needs to be unobstructed. As in, no torque can be applied from the tailpiece. Please take care to mount the lock properly, and not pinch the tailpiece.
Any newly invented tool or technique can only be used in the competition after explicit permission of the Judges.
Please see the Dutch Open Impressioning Championship 2022 report for more information on the competition. https://blackbag.toool.nl/?p=4222
Disk detainer competition
We will have a disk detainer lockpicking competition for the first time. For which, Sparrows kindly sponsored five of their disk detainer lockpicks. The competition will run throughout the event as a self timed competition.
There will be three to five locks, from easy to fairly difficult.
Locks are not guaranteed to be front tensioning, but can all be opened with the tools provided.
Please keep the combinations a secret for others competing.
The tools are not fragile, but shouldn’t be abused either. We have some spares, and come to the organizers if the tools are defective.
For people that are either new to disk detainers or don’t like competing, there will be tools and locks available to learn the technique, as well as workshops in picking high security disk detainers. We will also bring locks with much higher difficulty, starting at Abus plus with butterfly disks, to Tokoz Pro. Picking these high-end locks is left as an exercise to the attendees. (Maybe bring your own tools for these.)
We are delighted to announce that registration for LockCon 2023 is open! The conference will be held from the 12th of October to the 15th of October at the WestCord Hotel de Veluwe in Garderen, The Netherlands.
The Event
We will welcome registered attendees from Thursday afternoon (check-in 15:00 hr) with a meet and greet in the bar. On Friday, Saturday, and Sunday, we will have talks, workshops, competitions, and social events. And, of course, there will be plenty of opportunities to pick locks. We will have to vacate the hotel again on Sunday evening.
Invitation
LockCon is an event for the locksport community. Everyone with a passion for locksport is welcome, no matter the locksport group you are with. We work with the principle of friends, and friends of friends. If your friends are going to LockCon, ask them to vouch for you.
We have also reserved seats for people we have never met before. If you think you have something to contribute, or just are a very enthusiastic lockpicker who does not have the right connections yet, please contact us through the usual channels.
Hotel
As you may have seen, this year we will reside in a Hotel. This means there will be no dorm rooms, the maximum number of people sharing a room will be 4, and you will be able to suggest preferred roommates. As always, we have a limited amount of beds, so please complete the registration process early. The price for the entire weekend will be €360 per person, and will include LockCon 2023, breakfast and lunch on Friday, Saturday, and Sunday, dinner on Friday and Saturday, and lots of fun!
We are looking forward to seeing you there!
LockCon Team
Thursday October 12th 15:00 until Sunday October 15th early evening.
WestCord Hotel de Veluwe | Oud Millingenseweg 62 | 3886MJ Garderen | The Netherlands
Locks don’t have to be hard to pick to be interesting, and a Lips lock Jos loaned me is a fine example of that.
Lately I’ve been drawn to picking lever locks, as they have that nice “Skyrim” vibe. You can get a long way with just some bent wires. Knowing that, Jos brought this nice Lips lock to a Toool meetup, and I got to play with it a little.
Picking it is pretty straightforward, as there are no false gates on the lever, and no curtain. The pin in the keyway does make navigation a bit awkward, but all in all it’s not hard to pick.
Things get more interesting when you take a closer look at the lock.
First of all, it’s a Lips lock. Lips is a Dutch lock manufacturer that was founded in Dordrecht in 1871 by Jacobus Lips. In 1971 it became part of Chubb, and since 2000 it’s part of the Assa Abloy group.
The second name on the lock is P.G.E.M. The P.G.E.M. (or Provinciale Gelderse Energie Maatschappij) was a utility company delivering electricity and gas to the whole province of Gelderland in The Netherlands. Every Dutch province used to have its own utility company. It was owned by the province, and the local municipalities.
In the 1990’s the Dutch government decided all the utility companies had to be privatized, and P.G.E.M. became part of Nuon (which is now a part of Vattenfall).
Below P.G.E.M. are the letters LS, that stand for Laagspanning or Low Voltage. PGEM used these locks to secure electrical substations, and LS indicates this particular lock was used on a low voltage substation. The other side of the lock tells us more about this.
Here we see “Onderstation Woudhuis” written in pencil. Onderstation Woudhuis is a substation located in the city of Apeldoorn.
The double keyway is a striking feature which reminds of dual custody locks, only this isn’t that. It’s shared access, where only one of both keys is required to open the lock. This becomes clear when the faceplate is removed.
This seems to be a form of master keying without having to need to add extra gates to the levers, which would compromise the security of the lock.
Every lever has two cuts at the bottom. A closer look at two of the levers shows how different cut heights make it possible to open the lock with two different keys.
Moral of the story: locks are fun in so many ways.
In the current Tool rhythm, we have one meetup a week. Both the Amsterdam and Eindhoven meetups are Bi-weekly, where we planned to have one meetup a week. We come together to discuss lock topics, compete in the Toool competition, and generally have fun picking locks.
In this post, I’d like to share pictures topics and projects that have come across at Toool meetups.
A locked coin safe was brought to the meeting. Due to the construction of the box, the lock was a very difficult to put torque on with a turning tool. We succeeded in opening the lock several times, and had great fun picking the lock in literally seconds with an electronic pick.
Once in a while, we receive donations from community members. This Sparrows vault was donated to us with the request for an upgrade to the lock, as the original served not enough of a challenge. We complied, and mounted a Kaba Mas X0 Electronic lock on the Vault.
Everyone has a go-to pickset, one which is a mix of everything. We also bring Sunday’s best to dedicated sets. For example, Moki makes great picksets, which are even better with homemade handles. Or a shiny Multipick set, be it dimple or a dual-gauge set designed by Christina Palmer. Where the only part staged about the photo is to have all the sets neatly displayed.
We went to the Association des Crocheteurs de France conference in December 2022, and brought back a few tools and picks from France. We attempted to pick the Polox-5, and Fichet F3D. Both attempts made possible by the incredible work of Nitiflor, who designed and 3D printed these picks.
Jos brought a suitcase with Chinese locks, which was gifted to him for organizing LockCon 2016. At the time, these locks were unobtainable, and information sparse. The mechanisms are very intricate with 50-element wafer locks, and cores with continuous rotation similar to the Yuema 750, an implementation we have yet to see used in Europe.
If this blog sparked interest in lockpicking, or if you have been picking and would like to join a meetup, please contact us. We are always welcome to new people, be it to teach the basics or to share advanced tricks. https://toool.nl/Gatherings
In the summer of 2022, the Dutch hacker community gathered at the May Contain Hackers conference. The conference was amazing, with over a dozen simultaneous tracks with topics ranging from electronics, privacy and internet security, to art and technology. The program is published at https://program.mch2022.org/ and the talks are published on https://media.ccc.de/c/MCH2022.
For Lockpicking content, Toool organized a lockpicking village, The MCH CTF included lockpicking challenges, and plenty of exciting talks are given. Including Introduction to lockpicking and safe cracking, Anker 3800 Magnetic lock, and bumping electronic locks! More on these after a photo impression of MCH.
Jan-Willem presented an introduction to lockpicking and safe lock manipulation.
Talk description from the MCH schedule: Most security implementations leak information, mechanical security is no different. It takes sharp eyes, a soft touch, and a good hearing to distinguish between information and noise. In this talk we will go in depth on how locks works, and how we can persuade them to disclose their secrets, and open them without damage.
The Open Organization of Lockpickers (Toool) is a group of nerds obsessed with mechanical security. We create, collect, take apart, discuss, and attempt to defeat locks. While we are known for lockpicking, there are many other techniques for opening locks without damage.
This talk will focus on the language of the locks, the side channels in mechanical security systems. We will start with binding order, the mechanism to isolate the locking elements, and exploit them one by one. Then we will discuss a wide variety of other methods of gathering information and opening locks. Most of these methods are not practical, but working them out gives us great joy, and we would like to share the highlights with you.
Walter presented his research of the Anker 3800 magnetic lock. It includes deriving master keyed systems, designing an electronic key/lock decoder, and 3D printing keys.
Talk description from the MCH schedule:The Anker 3800 is a mechanical lock that has both traditional pins as well as magnetic sliders. Can it be opened without the key? This talk discusses how the lock works in a master keyed system and how it can possibly be defeated. It will cover decoding, picking and key duplication.
The Anker 3800 is a mechanical lock that has both traditional pins as well as magnetic sliders. It was designed by Japanese company MIWA and is sold in the Netherlands under the Anker brand. It is a high security lock that is often used in large master keyed systems.
I wondered: can it be opened without the key? I will present my adventures with the lock, having opened it up to see how it works, and several things I have tried to copy the key, pick the lock, decode the lock and find out what the master key looks like. The talk will include successes and failures and I will discuss designing 3D models, C&C work, electronics, Arduino programming, PCB design, and more.
The talk is aimed at people with an interest in lockpicking. No prior knowledge is necessary.
mh shared his research on bumping electronic locks. As in, opening the electronic locks by using a percussion drill and custom attachment.
Talk description from the MCH schedule:Modern electronic locks are often optimized for cost, not security. Or their manufacturers don’t do security research. Or they ignore it. For whatever reason, many current electronic lock systems are susceptible to surprisingly simple attacks. We’ll look at some of them, and at the underlying basics, so that you can do your own research.
In this talk, we look at a number of modern electronic locks and their security flaws. Surprisingly many current systems are susceptible to very simple attacks, like the equivalent of using bump keys. Of course, there are electronic and/or SW-based attacks, too. We’ll look at some of them, and at the underlying basics, so that you can do your own research. Some of the problems have been fixed by manufacturers, but typically only for future production runs, so you will get some practical advice on how to test your own hardware for these critical flaws.
Jan-Willem presented a basic introduction to threat modeling and uses puzzles as an example.
Talk description from the MCH schedule:Mechanical locks are everywhere and come in all shapes and flavors. But choosing the right lock can be rather difficult. For example, what is better? A lock that is hard to pick, or a lock with hard to duplicate keys. This talk will not give you the answers, but it will help you understand the trade-offs. Furthermore, we will have fun threat modeling our locks.
Is lockpicking a threat you should be concerned about, or is the brick the tool you should care for? Jan-Willem, from The Open Organization of Lockpickers (Toool), will share his ideas on mechanical security and threat modeling. We will make it fun and use several case studies, starting with defining a lock, threat modeling mechanical puzzles, and use several case studies where the threat was overrated. Simply put, attacks against locks range from the trivial to mastery. I’ll share multiple failed attempts of attacks that should be trivial, but were not in practice, and we will analyze them together.
In a previous blog post, I’ve written about Qikom’s cutaways. Whereas, this post is a tangent on why we would like to see more cutaways made and the knowledge shared.
When we teach beginners, and show them a unique lock, often they can’t imagine what happens in the lock. As all they can see is the outside. To illustrate this, let’s play a short game with a Fichet 787. The key looks quite interesting, as it has half a dozen cutouts on each side. It’s not symmetrical, and can only be inserted in the keyway in one direction. You feel a spring pushing against the key, but at rotation it seems to be like any other lock.
If you haven’t seen this lock before, take a moment to imagine what the internals are like.
Fichet 787. CC-BY-4.0 Jan-Willem, Toool Blackbag
It’s quite obvious where I’m going with this. There can be almost anything inside the shiny cylinder. It will be very difficult to find the solution without taking it a part, or looking at a diagram. The cutaway, like the one from Qikom below, shows the internals from the lock. Reducing the guess work over a picture of the parts.
Qikom Fichet 787 Cutaway CC BY-NC-SA 4.0Qikom Fichet 787 Cutaway; The interaction between the lever pack and the gears. CC BY-NC-SA 4.0Qikom Fichet 787 Cutaway; The lock is open. CC BY-NC-SA 4.0
Is it anything like you imagined it to be?
What does the 787 do? The Fichet 787, is a push lever lock. Where the push action allows the lateral movement of the levers to rotate a set of gears to the opening position. The sidebar is a passive element that checks if the gears are all aligned. With the correct key, the cylinder moves inwards, clears a blocking element, and is able to rotate. At the same time, the key is trapped by two half circle disks.
It is quite possible you have seen this lock before, as it has been around for decades. I’ve learned about the lock in 2018, and recently expanded the knowledge at the Association des Crocheteurs de France lock conference in December 2022. I’ve learned the dovetail, which connects the cam to the core, is a fairly recent addition that prevents a (partially) destructive attack, for example.
French locks are my favorite weird lock designs, where Fichet is king. The ingenuity is admirable, with many clever ways to solve the same problem…
Posted in Lockpicking, Locks, General | Comments Off on Cutaway locks, why put in the effort?
