{"id":2811,"date":"2019-09-22T11:59:13","date_gmt":"2019-09-22T09:59:13","guid":{"rendered":"https:\/\/blackbag.toool.nl\/?p=2811"},"modified":"2021-03-13T11:28:30","modified_gmt":"2021-03-13T09:28:30","slug":"key-duplication-from-a-photo-ctf","status":"publish","type":"post","link":"https:\/\/blackbag.toool.nl\/?p=2811","title":{"rendered":"Key duplication from a photo CTF"},"content":{"rendered":"\n

Jos has a talk about key duplication from pictures. If you have not seen it: https:\/\/youtu.be\/muINcnhj1EQ<\/a>
For a conference there was the question: What does it take to make it into a workshop? There was little budget so we have turned it into a CTF instead of a training\/workshop.
This CTF has no prices and might teach you something new.

If you ever wished you could try it without being sneaky, this is your chance. The CTF is a controlled and safe environment. You are encouraged to copy these keys!<\/p>\n\n\n\n

The problem: <\/strong>
Publishing pictures of your keys is not a good security practice. Keys can be duplicated from a photo rather easily. Twitter and other social media are full of threads filled with pictures of keys. I got shared one but they’ve removed it on our advice.
(Note to self: Take more screenshots.)<\/p>\n\n\n\n

Example: <\/strong>https:\/\/twitter.com\/hashtag\/zeigteureschluesselanhaenger<\/a>
The hashtag is about the keychain but there are some perfectly decodable keys in there.<\/p>\n\n\n\n

The CTF:<\/strong>
1)<\/strong> Get to the keys
2)<\/strong> Take a photo or make an imprint of it
3)<\/strong> Make a key
4)<\/strong> Test the key<\/p>\n\n\n\n

Measuring tools and files will be available at the lockpicking village.
We are going to help as little as possible to not spoil the fun.<\/p>\n\n\n\n

There are three keys at the moment:
CTF 1)<\/strong> Key will be published here
CTF 2)<\/strong> Key will be placed on the table at lockpicking villages (do not borrow\/steal the key please.)
CTF 3)<\/strong> Key will be on the belt\/lanyard of the Orga or instructors at the lockpicking Village<\/p>\n\n\n\n

Please don’t publish pictures of the CTF 2 and CTF 3 key. You are allowed to do a writeup about CTF 1. <\/p>\n\n\n\n

CTF Key 1:<\/strong>
\"\"<\/p>\n\n\n\n

Key measurements:<\/strong>
\"\"

\n\"\"<\/p>\n\n\n\n

As there was still some ambiguity, this picture should prove be useful. Each square is 5mm by 5mm.\"\"<\/p>\n\n\n\n

All locks are standard unmodified 5pin Abus\/Buffo. The blanks that work are Y1, 1A (SKS\/JMA), CS206 (Silca) and many others. You’ll get points for sourcing your own keys. Really, give it a try! <\/p>\n\n\n\n

This CTF will run for the next months to years. Come see Toool at a conference near you.
Next up: Hardwear.io, HITB, LockCon and Hackerhotel 2020.<\/p>\n\n\n\n

If you want to play but can’t make it to a conference. Please send me a digital bird at Jan-Willem at Toool dt nl. You’ll be send three pictures and a post address. You can mail me the physical keys you’ve made.<\/p>\n\n\n\n

I’ve tested the CTF myself. It took me about 30 minutes to make three keys from a photo.
Please, don’t publish pictures of your keys, stay safe.<\/p>\n\n\n\n

\nPublished by Jan-Willem.\n\n<\/p>\n","protected":false},"excerpt":{"rendered":"

Jos has a talk about key duplication from pictures. If you have not seen it: https:\/\/youtu.be\/muINcnhj1EQFor a conference there was the question: What does it take to make it into a workshop? There was little budget so we have turned it into a CTF instead of a training\/workshop.This CTF has no prices and might teach […]<\/p>\n","protected":false},"author":8081,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5,1,6],"tags":[10,11],"_links":{"self":[{"href":"https:\/\/blackbag.toool.nl\/index.php?rest_route=\/wp\/v2\/posts\/2811"}],"collection":[{"href":"https:\/\/blackbag.toool.nl\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blackbag.toool.nl\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blackbag.toool.nl\/index.php?rest_route=\/wp\/v2\/users\/8081"}],"replies":[{"embeddable":true,"href":"https:\/\/blackbag.toool.nl\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2811"}],"version-history":[{"count":0,"href":"https:\/\/blackbag.toool.nl\/index.php?rest_route=\/wp\/v2\/posts\/2811\/revisions"}],"wp:attachment":[{"href":"https:\/\/blackbag.toool.nl\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2811"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blackbag.toool.nl\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2811"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blackbag.toool.nl\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2811"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}