Dear viewer, these subtitles were generated by a machine via the service YouTube and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/2574 Thanks!
[Music]
okay all right now I think you can hear
me right so uh welcome to the last Talk
of the day um so um it will be a talk
where where the uh physical uh security
research gets really physical at Parts
at least uh so uh please uh Welcome Matt
Smith uh for the
[Applause]
talk all right let's try this again
shall we hopefully we're not going to
have terrible weather tonight so we'll
see okay so this is about physical
vulnerability research and some of the
stuff that I've been up to so I'm going
to go through the whole thing again so
it probably makes sense so if you've
heard it before you know I'm sorry so
anyway bit about me um I'm Matt Smith
the otherwise known as Huxley Pig um
I've done a lot of social engineering
like throughout my life uh I used to I
used to call it like blagging getting
stuff for free getting in places for
free and then when I got older this
legitimate term came along like yes I'm
a social engineer yeah
great and uh it's making you know passes
that sort of thing I don't work for
Oxfam um then I got a degree in computer
science software developer scarer
engineer and then I became a locksmith
at first the black hat and then a white
hat and now I make tools this is uh
marel where I at the tools uh lock fall
towers and um I look for things like I
like to call physical OD days so that's
exactly what it sounds like it's
undisclosed vulnerability in a physical
system and now I also help a lot of lock
makers improve their designs um find
problems with the locks and I've also
got a couple of patents for locks I've
design
now so if you're like me you know you've
always loved breaking [ __ ] that's why
you're here right uh one of the first
things um I hacked was Virgin Media to
get through it was nothing great it was
just getting free internet but that was
a lot of
fun um lock smithing actually goes back
seven generations in my family um my
great great great Granddad um started it
and um eventually I fell into the same
profession um I never wanted to be a
locksmith when I was growing up by the
way I I didn't want to do what my
parents did like everyone um I wanted to
be a software developer and then when I
actually did it and sat down at a
computer for hours and hours and weeks
on end I thought maybe
not maybe I don't want to do this um so
yeah originally I was a black hat and I
was um stealing the money from vending
machines
primarily um not the food the the money
this is before contact list so it was
all change so you know you could find
quite a lot of money in the busy ones
but it's okay I've change now so no more
black hat it's white hat
now um and I shouldn't have to say this
but uh don't break into vending machines
or parking meters um I know a guy who
got convicted for breaking into parking
meters he wasn't picking the locks he
was forcing the locks but he was
definitely stealing the money and um he
got a 5-year injunction Banning him from
going near any parking meter unless it
was at an airport and he could do it for
a maximum of 10 minutes and then he
couldn't return to the parking me for a
minimum of six hours and yeah it could
make life difficult so don't do
this
okay so I'm going to go through some
stuff I've not released before not
publicly at least and go through some
vulnerabilities that I've found and sort
of the how I managed to arrive at where
I
did and look for sort of common patterns
and errors and this is um applicable to
digital security as well you get like um
vendors that'll use the same chipsets
which have got badly implemented Stacks
or bad pseudo random number generators
and you know every vendor that uses that
chipset that device will be
vulnerable and yeah we'll try and apply
some sort of PR framework to see if we
can expedite it in the future uh I'm not
going to be showing any sort of
classified stuff um but if you want to
chat to me in the bar later buy me a
beer we can we can talk about the fun
stuff
then okay so like I say if you like me
you think security stuff exists to be
broken right if it's meant to be secure
we want into it and um this goes for
lots of people red T red teams
pentesters Etc
criminals and there's an old adage in
locksmith in that says locks only keep
honest people out and this is pretty
true if someone wants through your lock
badly enough it's just a matter of
resources and time they'll do it
eventually if they want to doesn't
matter how good your luck is and I used
to think that
um if you found problems with things and
then report Ed it back to the people who
made it that they'd fix it and if you if
this kept happening security would
generally get better in the world and I
I've since since I've been in the
industry a while I've learned that that
is not the case at all um I don't think
things are more secure now than they
were when I first started
locksmithing right so let's have a look
at some physical
attacks so
hammers can be used in many different
ways it might sound like a hammer you
just hit something but you it's like um
wire shock or other tools you can use
them for multiple
purposes so this is an example of a lock
that's been trounced with a hammer this
this is like the obvious thing that you
do with a
hammer um other things you can do uh
include freezing the shackle so um it
becomes shatter or um if the body of a
padlock is made of aluminium or has any
aluminium in it you can actually put
gallium on there and it'll react with
the aluminium and make the aluminium
crumbly and then you could hit it with a
hammer again
and get into the lock that way uh
spanners are another interesting one so
I don't know if many people have seen
this before but on the cheap blocks you
can use two spanners as demonstrated in
the picture and just
priz into the shackle and this is an
attack on the lock body the lock body
will
break but back to
hammers many padlocks for convenience
you can just shut them closed so the
good ones have a ball bearing that locks
the shackle in place but the cheaper
ones or the most padlocks you just click
and you shut the shackle like that and
so uh we can make use of that spring and
it's a conservation of momentum attack
so like when one pull ball hits another
pull ball if we can create enough energy
into the outside of the lock then we can
the idea is you can compress that spring
and the shackle should just pop open and
uh
I can show you this in
action so here here's a couple of Master
padlocks I'm just demonstrating here
that they're they are
locked and that's hits it with a hammer
one hits it with a hammer too just pops
open and you can do this on lots and
lots of uh locks it's only a question
really of how much energy you can get
into the body of the
padlock uh this is the story of the
first vulnerability that I ever found in
a lock so a long time ago about 1998
when when I were a lad me and my friends
uh used to go over canic Chase in my
mate's Jeep he had one of these jeeps
and he was obsessed with taking it into
the places you shouldn't go uh canic
Chase if you don't know is uh like like
here it's like it's just a wood with
hills and Forest
and um we couldn't get to the cool bits
we couldn't get to the really cool bits
because there's ditches and there's
locked
barriers and the lock on the barrier was
this I actually found this in um in the
street and I was driving past and was
like [ __ ] I know that lock I need to get
that lock because that's the one that's
on the barriers at canic Jace so anyway
I got this lock and thought well oh this
is the reasons they use it right it's
weatherproof um um it has to be if it's
in the forest and it's secure because it
says so on on
the on the front of the lock there so it
must be so I didn't know uh how to pick
L locks at the time I sort of knew how
they worked but I didn't know how to
pick them so I thought let's break open
the lock see what I can find
inside and at the time I didn't have a
workshop or even a vice um so I used a
hammer again and uh a wood chisel it's
not even a metal chisel it's a wood
chisel and I took it outside onto the
pavement and just went at it until I
broke it open and uh this this is what
it looks like today and when I got it
open I noticed that those little spiky
bit circles are the bits that the key
contacts and those little lumps on the
left are the bits that need to be lifted
so that the shackle can
open now this is an example of a good
lever lock and a good lever lock has
circle at the bottom there there's a
physical barrier to stop you lifting the
levers too high and that's not the case
on this lock
so I use like a two-part attack um one
part to tension the Bol thrower and
basically just a blank that goes up and
pushes all four levers at once and you
can see here at the side the levers have
been lifted clear of The Blocking part
so the lock can open
and the good thing is with this as well
you can lock it back up again and it no
no one's ever known that you've you've
been there and that led to a lot of fun
over canic Chase in the Jeep we all we
almost died several times I'm surprised
I'm still here to tell a
tale this is another lock that I've
spent a long time working on ablo
classic it's been around for a very long
time uh 1896 I think ablo invented this
lot and it went unpicked for years and
then in the 70s uh a guy called sepi
Turan um a Finnish sex pest he used to
pick the locks on pick this lock um on
women's doors let himself in and then
he'd hide under the bed and then at some
point in the night he'd come out and
attack them like some sort of scary
bogey man and the Finnish police didn't
think that he could actually pick the
lock because this was the first example
of this lock ever being picked in the
field before this ablo offered yeah a
million th marks reward if anyone could
pick the lock um but obviously they
scrap that after
this so what they did abau changed the
design of the lock um the tool this guy
was using the vamp uh it's Finnish
thinger Mig or what you call it you know
it's got some some Finnish name and they
changed the design so this tool didn't
work anymore and then this was um about
1978 I think and since then again since
the change of the design allegedly it
went unpicked
and in a nutshell here's the problem
with trying to pick this lock you need
90° of movement on your lock picking
tool and you can see there's a gap there
of 90° so you might think okay you've
got 90° you need 90° movement what's the
problem well the problem
is your lockpicking tool has to exist
within that 90° as well so if you go 90°
one way you going to upset the
furthermost disc and if you put the tool
on the other side and go 90 degre the
other way you're going to upset the
other
disc so again I took it apart and
studied it for a long time and um found
out that you can actually get away with
dislodging the discs a little bit and
that's
because in the bottom picture that like
little steel bit at the top that's the
sidebar that's what prevents the lock
from opening and it has to sit in that
little U shape at the top of the
disc and if you dislodge you can see
it's not perfectly aligned so dislodged
a little bit and new tension the lock
that side bar will push down into that U
shape and end up pulling the disc back
around like by itself so you can get
away with a little bit so that led to me
thinking okay so maybe I maybe I can do
this maybe we can exploit
This and like I say everyone in
locksmithing said this lot can't be
picked um it's not possible no one's
done it so it's like a red rag to I'm
like okay I'm going to do this doesn't
matter how long it takes I'm doing this
so about six years of work off and on
uh Design After design didn't work
didn't work and then I realized the
design that I wanted to use was
difficult to make so I had to save up to
buy a milling machine and make this very
fine thin delicate part anyway long
story short it worked I managed to make
a tool that picked this lock um and then
three four weeks later a friend Rings me
up and says oh you're tool it's really
cool it's for sale on that locksmithing
website no I don't know anything about
this so so I went to the website and I
see pretty much the same design of my
tool there so I contacted the website
owner and he said uh okay so yeah the
government have been using this tool for
like eight years um only it's been
restricted and it's not publicly
available so no one knows about it and
now you've done an design that's pretty
much identical we can derestrict it and
sell it publicly now oh
[ __ ]
okay so I'm I don't want to invent
things that have already been done if
I'd have known this tool existed already
I wouldn't have spent so much time and
effort and money doing it um so yeah it
it was quite a kick in the balls but I
decided I'll tell you what then I'm
going to use what I've learned and make
the tool better and so this is the tool
in action you don't get to see it the
tool itself is
restricted but um this is the improved
version of the tool that I made and it's
it's a terrible video is it was a while
ago but
anyway the tools in the lot now and I'm
not really picking it it's a
self-impression and attack so I'm just
I'm just jiggling the tool
basically and that's it 13 seconds it
took to open that lock with the improved
tool and that's that's a lock that's
meant to be
unpickable this is another one of my
favorite locks uh ever MCS it's a
magnetic lock um it was developed in
Vienna Austria and again this lock went
unpicked for a very long time because
you can't physically access the
internals of it cuz it's all
magnetic and I've spent more time on
this lock I think than any other
lock so this is how it works you can see
each of these wheels has got like a
little pie slice cut out of it and they
all have to line up like in the picture
and there's a blocking element that will
go into the pie slices and allow the
lock to open and it's that times two on
both sides of the
lock and you can never know what
position these little pie slices are in
from outside the lock so ostensibly it's
impossible to
open and then oh maybe 20 years ago I
got an email from um a German friends
and he said in the MCS those uh those
rotors they're quite
noisy uh I was thinking you know yeah
they are quite noisy so I thought maybe
we can Leverage The Noise thing see if
we can open the lock so you using like a
guitar pickup you don't have to use a
guitar pickup by the way you can hear it
but this this AIDS it to a massive
degree so using a guitar
pickup you can tell which wheel is
incorrect so you can't tell which one's
right but you can tell when it's wrong
so if something's wrong and you change
it and it's still wrong and you change
it and all of a sudden it's right and
another one's wrong you repeat this
process until everything's right and
then the lock
opens so you've got 2.2 mm of space
space to work with in this lock so
making something that simulated the key
was very difficult um this is four fails
designs the one in the top left is um
just magnet super glued to a bit of
metal that didn't work the other one's
like fiddly little magnets you push into
holes I mean it sort of worked but it
was it was fiddly and yeah anyway none
of these worked but eventually I managed
to simulate how the original key worked
now you
can't you can't copy how
ever have made their keys they've
magnetized the magnets in um they've
patented the process they used to
magnetize the magnets but using two
magnets on each side you can simulate
the key which is exactly what I've done
here but this this only was the start
you then had to I then had to work on
the technique to narrow it down but um
eventually yeah I got to the point where
I can open the MCS lock as well I don't
know if anyone knows this lock um again
another unpickable lock bowy they've not
been around Long uh bless them they have
tried their hardest to make a lock
that's
unpickable and I guess it's a good idea
on the face of it this is the key for
the bowy and you can see you've got this
funny U shape in it and that bit missing
in the middle that goes around like a
metal shield so that if you want to try
and pck this lock your lockpicks have to
go around that U shape and
also manipulate the five pins and
because there's only maybe 2 mm of Gap
at the end you physically don't have the
space to pick the lock so if traditional
lock picks won't work then that's a win
right they've made an unpickable luck oh
no not at
all I got a
video of me opening this
luck that one
yeah
so we'll skip forward a
little so what I'm using here is
um again it's another conservation of
momentum attack um so I don't know if
you know how key bumping works but
basically um what you do you hit all of
the bottom pins simultaneously and the
top pins then absorb the energy and fly
up away from the bottom pins creating a
big gap between the two and if you time
it right you can open the lock while
that Gap exists that's what I'm doing
here only this is an EPG it's an
electric pit gun so it does that but
just really fast it's not a drill people
sometimes think it's a drill it's not a
drill so that's vibrating the pins
now and that's it the locks open at this
point so this unpickable lock I used to
say I can open this lock with a
paperclip and people used to laugh at me
and I'm well actually it's perfectly
possible that that's the back spinning
just to prove it's
open
and yeah like you see it's very
effective and very
fast this is another one of my pet locks
if you like um I went through the chain
of abloy locks and this is like their
current top of the range lock abloy
protect 2 it is
now it uses um a disc blocking system so
the idea is that if the discs are jammed
in place then if you try and manipulate
them you can't because they're
physically
unmovable what I did was I looked at the
differences between Protek 1 and Protek
2 and had a look at what they changed
between the two versions which gave me a
lot of hints as to what the problems
with the prot tech 1 might have been
because otherwise they wouldn't have
changed things
right and actually the prote 2 some of
the new changes they made introduced new
problems so and this happens again with
digital security all the
time so I broke it down in stages howy I
can open this lock like chaining
vulnerabilities so
originally I bypassed the DBS that's the
disc blocking system with a piece of
wire which can be seen here U and since
then I found quite a few ways to do it
but originally I did it like this so the
two bars on either side of the lock have
to meet and come together and sort of
slip down one under the other and that
piece of
wire allows them to meet but it doesn't
allow them to physically slip down into
the grooves and block the discs so that
was the first stage bypass the dis
blocking
system even then you still have to
manipulate the lock which is very
difficult in itself but at least now the
blocking system is neutralized at least
it's
possible um the my current protet 2
tools are restricted so I can't show
those but uh we can we can open the
protet 2 as well um it's in a folder
it's in the folder full of ndas I've got
loads of ndas from different loot
companies and Tool makers that sort of
things this one's kind of fun Kensington
laptop like this is used to uh secure
your digital it
infrastructure and I thought again it's
got um a sprung shackle on the bottom so
you can just push the wire in for
convenience and it it's locked and I
thought so I'm going to try the same
thing on this lock I'm going to try and
bounce those Springs back so I got a
hammer again and uh I was only tapping
it I swear to God I was only tapping it
gently and it and it just fell off I was
like whoa sure surely that isn't right
um and what's happened with this
um is when you when you hit it there's a
part inside that deforms and it allows
the shutters to still work so you can
still come back and put the lock on and
it you can still use the key and the
user would never know there was a
problem with it but yeah it's it's very
very uh very
[ __ ] and it was accidental like I say a
lot of um Disco best discoveries are The
Accidental ones right I wasn't even
trying to do this to this like
let's have a look at some digital stuff
now so I don't know if anyone's got
ringed doorbells I mean I know I've got
one and they're pretty useless right I
think the solds like a security device
but I mean they're not they're not right
um
so the problem with these
is in order to see who's at your front
door it has to make uh essentially a
viip call there's no local recording on
the device so if comm's drops then you
don't know there's anyone at your door
and worse when the comms comes back up
if someone has been at your door again
you don't know it doesn't give you any
sort of indication that there's been
someone there I believe the Ringle arm
Pro actually has a little SD card that
records locally on it so that's better
that is
better so how could we attack this well
if you cut the power to the place then
coms are going to go down I mean that's
pretty noisy it doesn't have to be
destructive if you got access to the
breaker but
again the phone line if you got the
phone line coms are going to be down uh
and like if you got access to the signal
box again it's not necessarily
destructive um you can jam the wireless
which uh again is a bit better I guess
but you risk jamming other
stuff but uh what you can do is using
why shark is sniff the MAC address and
just de it off the network and if you if
you just keep deor in it off the network
then the owner of the Ring doorbell
never knows doesn't know anything's
happening and uh yeah that's very
targeted very clean that's that's
probably the best way to do it I
think and yeah like I say when it
connects back to the network it's as if
nothing's happen the user would never
know you'd been
there there's a trade-off between
convenience and security always and this
is one of those so people are getting
Wireless alarms fitted a lot um because
it's more convenient than drilling holes
and laye cables and they've got exactly
the same problems is the ring doorbell
so again any sort of connectivity loss
and it's a problem so um you can sniff
the MAC address of a particular wireless
sensor and again you can deor them off
the network you can jam them um one of
the cool things you can do is if you
know the protocol um you can talk to the
base station and make out that the
signal isn't an alarm when really it
is the better alarm systems won't let
you get away with this because they will
poll back regularly to either from the
sensor to the base station or from the
base station to whoever might be
supervising the alarm um but how long do
you actually need to get if if you've
opened the door already then maybe you
only need three or 4 seconds 5 seconds
maybe to open and shut that door
again and physical access is always King
if you can get to a system physically
then you own
it so I I much preferred wired alarm
systems often you have redundant coms so
you got the phone line and then they'll
be like 5G connection as well and again
if you if you were to jam the 5G and
putut the phone line the better systems
will pull back to whoever's supervising
the alarm and say yeah it's gone offline
put it into
alarm and again attack vectors for this
so you can Target individual sensors for
what alarm systems if you can get
physical access to something you've got
it right another thing you could do is
protocol reversal again so if you've got
physical access to some of the wires um
I know someone who's done this in fact
um if you can get an access point into
the network then you can spoof whatever
you want to the base
station and a lot of sensors have got
blind spots as well bad badly installed
alarm systems
everywhere and you can social engineer
your way in there's lot there's lots of
ways the these read sensors are on the
doors of alarm systems I'm sure you've
seen these everywhere now there's um a
few ways you can get to these they're
normally normally it's normally closed
in with a magnet that keeps it from
going into alarm so if you don't know if
let's say you're on the outside of a
door and you don't know the position of
an alarm sensor you can sense for that
magnet using a hall
sensor and that'll tell you where the
switch is the where the sensor
is and so if you then know where it is
you can then simulate that magnet on the
outside of the door so long as the
magnet's sufficiently powerful enough or
even better if there's a gap in the door
and I've done this if there's a gap in
the door you can feed a little magnet
through and simulate the magnet on the
door and then obviously you keep the
magnet there and open the door and the
sensor doesn't know anything's
happened if you've got physical access
then you can permanently trick it using
like a little little round magnet you
can type tape a magnet to the sensor and
because you're doing that when the alarm
isn't
activated when it is activated that
magnet is permanently there then so
again you can open and close the door
and that magnet is tricking the sensor
into thinking nothing's
happen these are fun too um dual passive
infrared and microwave so in order to
get these to go into alarm both parts
have to be tripped both the microwave
and the infrared and there's three
lights on there there's like a green an
Amber and a red and green means not a
problem amber means one of the two has
been tripped and if it goes red then
both of the two have been tripped and
then it goes into
alarm I don't know if any is anyone else
done this I this might be weird but
sometimes I go into shops and um you'll
see these sensors and obviously the
alarms AR activated but the Sens is
still active and so you can walk around
the room and see how sensitive the alarm
is and where the blind spots are so if
you walk to the edge of the room and all
of a sudden it stops going orange or red
you know okay so there's there's the
line of that's how that's where the
sensor can see
too and I I'll do that quite a
lot the infrared part is the easiest
part to trick on these um it it just
sees heat it sees changes in heat um so
if you can get some sort of room
temperature Shields if you if you were
to enter a room that has one of these
and and you have a shield in front of
you that is the same temperature as
everything else then the alarm's not
going to see and it can be something as
simple as like just
cardboard something really
simple um if you can get physical access
to it while it's not alarmed then um
again physical access is King they did
this in the ANP Diamond Heist they spr
and there's a whole talk about the ANP
Diamond Heist absolutely brilliant but
they had
um they' rented out safety deposit OS it
boxes in the vault and so when they were
in the vault ostensibly going about the
regular work they sprayed um hairspray
or latex onto the sensor while it wasn't
an alarm and then later on when they
came back the alarm was blind the sensor
was blinded so because they already
sprayed it and it couldn't see them
there uh another trick I've heard people
say you can do is turn the heating up to
body temperature so if you walk in it
doesn't see a body temperature but I I
don't know how feasible that is and if
all else f you can Treck them by walking
really slowly but if you're if you're in
a situation that sort of isn't conducive
to that it's Pro it's probably a bad
idea uh bad installation of alarm
systems again is is really common
they'll Miss places they'll the CCTV the
sensors will have blind spots a lot of
the old cameras um you can blind them
with lasers or
infrared and if there's a wire EXP
exposed from the outside like like in
this picture then again if you can get
into the network then you can um inject
protocols into it there's a really cool
talk
um hold on I've written it
down yeah exploiting Network
surveillance like a Hollywood hacker
it's a de cont talk from a while ago and
they did exactly that they reverse
engineered the protocol and um they in
the end they could inject whatever they
wanted into the CCTV feed
like a text video whatever that they
totally totally own the CCTV uh baback
javard and Keith hell I've done some
good stuff on this as well if you want
to look those guys
up something else you can do is um
deliberately trip an alarm over and over
again so you can see what the response
time is and the response strength is um
and often if you keep doing it over and
over again whoever is in charge of the
alarm system is just going to get
annoyed and take take the sensor out the
system and that that's the idea
sometimes or you can do what I said with
the read sensor earlier but deliberately
get the magnet wrong and trip the alarm
from the outside of the door and do the
same sort of thing same with vibr
vibration sensors and Floors or
fences and yeah like I said you can use
it to sort of socially engineer the
response access control a lot of these
um are vulnerable to um a magnetic
attack so they've got relay in them and
um often as well these are on the
outside of buildings but they'll put
really bad screws in them like security
screws but you know if you have the
right screwdriver you can just get into
there and again if you've got physical
access to it then you're in you can use
it sniff
creds you can jump the contacts inside
of the box to open it and again you can
do protocol injection with this stuff
too um smart locks uh are quite an
interesting one these are like getting
popular now um the problem with these is
a lot of them were designed
by Electronics Engineers not people who
are well versed in physical
security um so even if the digital side
of it is secure then you can still
manipulate or bypass the
locks uh a lot of these can be bypassed
using um hammer drill not hammer drill
hammer drill is it reciprocating drill
and um you can bump the solenoid in the
middle and lots of Manufacturers copy
the design of each other and
so these vulnerabilities are present in
all of
them so yeah like I say um you can open
them often from there's a solenoid in
the middle so when you come along with
your card or your phone or whatever and
open it and it authenticates this little
solenoid moves back but it's often on a
spring and we can do the same thing I
was talking about earlier with a spring
and where you can hit the outside of the
lock compress that spring from the
outside and then open the
lock and the thing about this is there's
normally an audit Trail selling you
who's been and when they've been there
but this totally bypasses any sort of
audit Trail and yeah that you put a 3D
printed head adapter on it and use a
hammer drill um and that's just the
physical side of it I mean there are a
lot of really bad smart locks where you
can the there are keys in clear text
going over the Wi-Fi and predictable
rolling codes replay attacks I mean that
they've been littered with problems
since their
invention uh
router so I mean routers are pretty bad
anyway right for a long time you've been
able to get onto them using default
admin I mean we weap was useless um
there was brute force in the pin I mean
that's that's better now but uh again
that that was something that was pretty
easy to do um there was an old virgin
box where you'd started up and it had
the Wi-Fi would come up open and then
it' go back down again and come back up
WPA 2 but if you could get onto it while
it was open then again you could use the
default creds and own the
Box uh I spoke about this briefly
earlier Virgin uh docis one I mean we're
going back a while but uh yeah you could
sniff the Mac addresses and swap them
with each other and
end up getting free virgin
internet and this is a common one W
default Wireless passwords derived from
the MAC address uh British Telecom made
this mistake and loads and loads of
their routers could um you could derive
the
password all right so briefly let's have
a look at some
methodologies so this guy Daniel Heist
um he was convicted in Australia for
murdering a guy him and his friend
wanted his guns and so he got sent to
bury my
prison and when he got there he found a
fellow inmate who' got um sort of
privileged status and he was a jeweler
on the outside so he'd been given access
to jewelry making equipment and he said
okay they got together and said let's
make a key let's make a key and we can
get out and they could have tried to
view the key as the wardens were using
it but where they actually got the key
from is much better than that so when
you first go to to Berry M prison they
gave you like um a booklet saying you
know welcome to the prison this is what
you should do this is what you shouldn't
do and on the front cover of the brocher
with a master keys to the
prison and so he he just copied those
and they
escaped um he left a Cheesy message
saying this bird has flown on his cell
um it Baker the Jeweler 24 hours he got
reacted and Heist 12 days and then he
got out and started making terrible
art and and now he's back in in prison
again for parole violation but the point
of this story is observation if you you
if you look hard enough you you can you
can see some pretty cool
stuff so photos of keys um there's now a
machine this is an easy entry machine um
it'll copy like the profile of a ky any
K well nearly any k um but there's
actually systems now that'll take long
range photographs of a key and
automatically decode the bitting and
then automatically cut the key
so observation can be really useful and
don't put photos online either that this
mistakes happens quite a lot like here
so
um SS Dev the guys um who were doing the
lot picking Village
um the Dutch police had these new high
security handcuffs and the the lock on
them was good it wasn't like generic
handcuffs where one key will open pretty
much all of them the these were good
hand handcuffs was a chub three L lock
anyway they put images of it online and
um so the guys at SSD saw it copied the
copied the key and this 3D printed key
will now open these high security Dutch
handcuffs um this is something else I've
done quite a lot sports events um if you
watch TV at sports events you can get a
lot of useful information so these are
all passes that I've managed to grab off
TV and Twitter feeds and that sort of
thing and I mean once you see them
they're really easy to copy you can get
in um this is one on a dog I don't know
if the dog actually had a legitimate
pass but this is a legitimate format of
pass so yeah just copy this and I've
done this I did this at the World Cup in
2006 actually in Germany uh Premier
League cricket music
[Music]
festivals copying passes is a a really
really easy way to get into places
another way we can um try and find out
some vulnerabilities in stuff is look at
what's been changed in the new version
to the old version so revision notes do
this a lot in software they'll say yeah
we fixed this and this and they go okay
so if you're look at it you know that oh
that used to be a problem and that used
to be a problem and so if you ever find
an old version of that software you know
for a fact that it's got x y and Zed
wrong with
it
huh uh and like I said this applies to
physical and digital security I did it
with um the Protek and if ever they
changed something look at what they've
changed okay so probably the best way to
go about finding vulnerabilities in
stuff is like what I did earlier you
know methodically break down the system
look at every part of it see if you can
find a hole and exploit the
hole um and like I say you
get common designs from one manufacturer
to
another um decapping psus and
electromagnetic microscope scanning so
you can see exactly what's going on and
stuff uh and fuzzing is another one so
just throwing stuff at it right and if
something sticks you don't really need
to know how it works if it works it
works and accidental discoveries a lot
of fun that some of my best discoveries
have been accidental
discoveries and then try and look at
ways in which a system can leak
information so um like cryptographic
weit times um I use the sound I
mentioned earlier um you can measure the
rotation of a lock or um the arm on a
safe to know how close you are to open
it there's lots of ways systems can leak
information that whoever designed them
didn't intend them
to and be inventive look for
unconventional tap vectors and I'm I'm a
big fan of this last one as soon as you
found a way to do something try and find
another way to do it and then try and
find another way to do it find as many
solutions to the same problem as you can
so you got some sort of redundancy and
the concept between between digital
security and physical security they're
the
same but once you found a problem you
have to ask yourself is it practical
safe just because something's feasible
doesn't mean it's
practical So Physical keys I could have
like a th000 10,000 keys to a lock and I
mean it's feasible for me to try every
key and one of them will eventually open
it but it's not practical and it's like
brute forceing passwords if a password
is sufficiently strong enough then it
might take 10,000 years and yet it's
feasible but it's not practical so you
have to ask yourself just cuz you found
a problem can I actually exploit
it and don't forget that every every
security system ever invented was
designed by people people no smarter
than you or me and people always miss
stuff so remember nothing's ever perfect
if if you get a more complex system
often that leaves a larger attack
surface so you can find more problems if
something's been made more complicated
and like I said they're just people
people miss things and they can't see
the future they can't see what's going
to happen like so um safes in the past
um were very secure they were very
burglarproof and then x-rays came along
and they they they didn't know what
X-rays were when they invented the safe
and all of a sudden you could get into
the safe and the good safes nowadays
actually have x-ray protection on them
so you can't do that and and yeah
another one never give up until you've
done it until you've broken it keep
going
so yeah I've only scratched surfice of
the subject I could do this talk again
and replace everything I've just said
with other examples there's so much to
go into other people's stuff historical
biggies and yeah a lot of the stuff that
I can't disclose as
well and I think the bottom line here is
if I can do it anyone can do it you know
just go and find some cool [ __ ] and
break it that's it we're done woo
[Applause]
so yeah uh thanks a lot for the the talk
Matt um we are going to have like uh 3
minutes for for questions so um uh if
you can line up here uh for for
questions it would be great I don't
think that's
working is this working maybe it is
maybe it is
perfect um any questions I cannot
see do we have a Q&A mic there okay so
um uh let's give a last big huge
Applause to mat
[Applause]
[Music]
thanks