Page 1
Deviant Ollamhttp:// deviating.net / lockpicking
The Four Types of Locks
by Deviant OllamEvent NameXXXX-XX-XX
Page 2
Deviant Ollamhttp:// deviating.net / lockpicking
Who am i ?
Page 3
Deviant Ollamhttp:// deviating.net / lockpicking
Who am i ?
Page 4
Deviant Ollamhttp:// deviating.net / lockpicking
auditing
assessments
research
trainings
Who am i ?
Page 5
Deviant Ollamhttp:// deviating.net / lockpicking
auditing
assessments
research
trainings
workshops
public lectures
lockpick village
contests & games
Who am i ?
Page 6
Deviant Ollamhttp:// deviating.net / lockpicking
Who am i ?
Page 7
Deviant Ollamhttp:// deviating.net / lockpicking
Who am i ?
Page 8
Deviant Ollamhttp:// deviating.net / lockpicking
Who am i ?
Page 9
Deviant Ollamhttp:// deviating.net / lockpicking
But on to locks…
Page 10
Deviant Ollamhttp:// deviating.net / lockpicking
But on to locks…… why do theymatter ?
Page 11
Deviant Ollamhttp:// deviating.net / lockpicking
Page 12
Deviant Ollamhttp:// deviating.net / lockpicking
Page 13
Deviant Ollamhttp:// deviating.net / lockpicking
Page 14
Deviant Ollamhttp:// deviating.net / lockpicking
Page 15
Deviant Ollamhttp:// deviating.net / lockpicking
All your hard work here…
Page 16
Deviant Ollamhttp:// deviating.net / lockpicking
All your hard work here…getsundermined here
Page 17
Deviant Ollamhttp:// deviating.net / lockpicking
The Lowest Grade of Lock…a.k.a. “The Locks That You Are
Probably Using”
Page 18
Deviant Ollamhttp:// deviating.net / lockpicking
Pin Tumbler Locks
Page 19
Deviant Ollamhttp:// deviating.net / lockpicking
Pin Tumbler Locks
Page 20
Deviant Ollamhttp:// deviating.net / lockpicking
Pin Tumbler Locks
Page 21
Deviant Ollamhttp:// deviating.net / lockpicking
Page 22
Deviant Ollamhttp:// deviating.net / lockpicking
Page 23
Deviant Ollamhttp:// deviating.net / lockpicking
Page 24
Deviant Ollamhttp:// deviating.net / lockpicking
Page 25
Deviant Ollamhttp:// deviating.net / lockpicking
Pin Stacks
Page 26
Deviant Ollamhttp:// deviating.net / lockpicking
Key Operation
Page 27
Deviant Ollamhttp:// deviating.net / lockpicking
Bitting Too Low
Page 28
Deviant Ollamhttp:// deviating.net / lockpicking
Bitting Too High
Page 29
Deviant Ollamhttp:// deviating.net / lockpicking
In a Perfect World
Page 30
Deviant Ollamhttp:// deviating.net / lockpicking
In the Real World
Page 31
Deviant Ollamhttp:// deviating.net / lockpicking
In the Real World
Page 32
Deviant Ollamhttp:// deviating.net / lockpicking
In the Real World
Page 33
Deviant Ollamhttp:// deviating.net / lockpicking
Page 34
Deviant Ollamhttp:// deviating.net / lockpicking
Page 35
Deviant Ollamhttp:// deviating.net / lockpicking
Lifting Picking
Page 36
Deviant Ollamhttp:// deviating.net / lockpicking
Raking
Page 37
Deviant Ollamhttp:// deviating.net / lockpicking
Wafer Locks
Page 38
Deviant Ollamhttp:// deviating.net / lockpicking
Wafer Locks
Page 39
Deviant Ollamhttp:// deviating.net / lockpicking
Wafer Locks
Page 40
Deviant Ollamhttp:// deviating.net / lockpicking
Wafer Locks
Page 41
Deviant Ollamhttp:// deviating.net / lockpicking
Raking & Jiggling
Page 42
Deviant Ollamhttp:// deviating.net / lockpicking
Shimming
Page 43
Deviant Ollamhttp:// deviating.net / lockpicking
Bumping
Page 44
Deviant Ollamhttp:// deviating.net / lockpicking
Bumping
Page 45
Deviant Ollamhttp:// deviating.net / lockpicking
Pick Guns
Page 46
Deviant Ollamhttp:// deviating.net / lockpicking
Bump Key Attack“Pull” Method
Page 47
Deviant Ollamhttp:// deviating.net / lockpicking
Bump Key Attack“Push” Method
Page 48
Deviant Ollamhttp:// deviating.net / lockpicking
Bump Key Attack“Push” Method
Page 49
Deviant Ollamhttp:// deviating.net / lockpicking
Where are you using these weaklocks ?
Page 50
Deviant Ollamhttp:// deviating.net / lockpicking
Outdoor “Rugged” Locks
Page 51
Deviant Ollamhttp:// deviating.net / lockpicking
Outdoor “Rugged” Locks
Page 52
Deviant Ollamhttp:// deviating.net / lockpicking
Outdoor “Rugged” Locks
Page 53
Deviant Ollamhttp:// deviating.net / lockpicking
Outdoor “Rugged” Locks
Page 54
Deviant Ollamhttp:// deviating.net / lockpicking
Outdoor “Rugged” Locks
Page 55
Deviant Ollamhttp:// deviating.net / lockpicking
Outdoor “Rugged” Locks
Page 56
Deviant Ollamhttp:// deviating.net / lockpicking
Desk Drawers & Filing Cabinets
Page 57
Deviant Ollamhttp:// deviating.net / lockpicking
Power Panels
Page 58
Deviant Ollamhttp:// deviating.net / lockpicking
Sensitive Wiring
Page 59
Deviant Ollamhttp:// deviating.net / lockpicking
Sensitive Wiring
Page 60
Deviant Ollamhttp:// deviating.net / lockpicking
Sensitive Wiring
Page 61
Deviant Ollamhttp:// deviating.net / lockpicking
Why are most locks this bad?
Page 62
Deviant Ollamhttp:// deviating.net / lockpicking
• American National Standards Institute• Classification A156• No Covert Security Ratings At All
• American Society for Testing Materials• Classification F883• Toughest Rating is only 15 minutes
It’s a Problem of Standards
Page 63
Deviant Ollamhttp:// deviating.net / lockpicking
Many Times, Picking isInstantaneous
Page 64
Deviant Ollamhttp:// deviating.net / lockpicking
You Need a Response Window
Page 65
Deviant Ollamhttp:// deviating.net / lockpicking
One Step Up…“Pick Resistant” Locks
Page 66
Deviant Ollamhttp:// deviating.net / lockpicking
Simple…
straight and wide
Advanced Keyways
Page 67
Deviant Ollamhttp:// deviating.net / lockpicking
Simple…
straight and wide
Medium…
straight but narrow
Advanced Keyways
Page 68
Deviant Ollamhttp:// deviating.net / lockpicking
Simple…
straight and wide
Medium…
straight but narrow
Complex…
thinner and curvy
Advanced Keyways
Page 69
Deviant Ollamhttp:// deviating.net / lockpicking
Simple…
straight and wide
Medium…
straight but narrow
Complex…
thinner and curvy
Harder…
lots of angles
Advanced Keyways
Page 70
Deviant Ollamhttp:// deviating.net / lockpicking
Simple…
straight and wide
Medium…
straight but narrow
Complex…
thinner and curvy
Harder…
lots of angles
Fiendish…
overlapping wards
Advanced Keyways
Page 71
Deviant Ollamhttp:// deviating.net / lockpicking
Un-Shimmable Padlocks
Page 72
Deviant Ollamhttp:// deviating.net / lockpicking
Pick Resistant Pins
Page 73
Deviant Ollamhttp:// deviating.net / lockpicking
Pick Resistant Pins
Page 74
Deviant Ollamhttp:// deviating.net / lockpicking
Pick Resistant Pins
Page 75
Deviant Ollamhttp:// deviating.net / lockpicking
Pick Resistant Pins
Page 76
Deviant Ollamhttp:// deviating.net / lockpicking
Pick Resistant Pins
Page 77
Deviant Ollamhttp:// deviating.net / lockpicking
Top Gapping
Bump-Resistant Pins
Page 78
Deviant Ollamhttp:// deviating.net / lockpicking
Anti-Bump Driver Pin
Bump-Resistant Pins
Page 79
Deviant Ollamhttp:// deviating.net / lockpicking
The Next Step Up…“High Security” Locks
Page 80
Deviant Ollamhttp:// deviating.net / lockpicking
Schlage Everest
check pin
key (bottom) pins
driver (top) pins
pin springs
plug
check pin spring
specialized key
Side Pin
Page 81
Deviant Ollamhttp:// deviating.net / lockpicking
Schlage Everest
photos courtesy of Matt Blaze
Side Pin
Page 82
Deviant Ollamhttp:// deviating.net / lockpicking
Schlage Everest
photos courtesy of Matt Blaze
Side Pin
Page 83
Deviant Ollamhttp:// deviating.net / lockpicking
Schlage Everest
specialized “finger tensioner” modified Everest key
Side Pin
Page 84
Deviant Ollamhttp:// deviating.net / lockpicking
Similar to side pins
Restrict plug movement
Harder to pick than pin stacks
Side Bars
Page 85
Deviant Ollamhttp:// deviating.net / lockpicking
Finger Pins
Side Bars
Page 86
Deviant Ollamhttp:// deviating.net / lockpicking
Finger Pins
Side Bars
Page 87
Deviant Ollamhttp:// deviating.net / lockpicking
Finger PinsSchlage Primus
Side Bars
Page 88
Deviant Ollamhttp:// deviating.net / lockpicking
Sliders
Side Bars
Page 89
Deviant Ollamhttp:// deviating.net / lockpicking
Sliders
Side Bars
Page 90
Deviant Ollamhttp:// deviating.net / lockpicking
Rotating Pins
Side Bars
Page 91
Deviant Ollamhttp:// deviating.net / lockpicking
Rotating Pins
Side Bars
Page 92
Deviant Ollamhttp:// deviating.net / lockpicking
Medeco Locks
Medeco plug exposed, key pins rotating to align sidebar cuts
Top View Side View
Rotating Pins
Page 93
Deviant Ollamhttp:// deviating.net / lockpicking
Medeco lockscertainly not “unpickable”
Can be picked Can be bumped Numerous weaknesses
“Open in 30 Seconds” Marc Tobias Tobias Bluzmanis
Rotating Pins
Page 94
Deviant Ollamhttp:// deviating.net / lockpicking
Sometimes Very Good Security Mimics a safe lock
Difficult To Pick Takes much time and great skill Specialized tools required
Rotating Disks
Page 95
Deviant Ollamhttp:// deviating.net / lockpicking
Sometimes Very Good Security Mimics a safe lock
Difficult To Pick Takes much time and great skill Specialized tools required
Two-in-One Tool Manipulates disks individually Decodes cut positions
Barry Wels picking a rotating disk lock with Mike Glasser
Rotating Disks
Page 96
Deviant Ollamhttp:// deviating.net / lockpicking
The Highest Grade…Dare we say “unpickable” locks ?
Page 97
Deviant Ollamhttp:// deviating.net / lockpicking
Abloy Protec Not just rotating disks Disk blocking mechanism
“Unpickable?” Closest I ever come to using that word Two-in-one tools cannot be used
Specialized Rotating Disks
Page 98
Deviant Ollamhttp:// deviating.net / lockpicking
Miwa Japanese company Array of magnetic pins Simple North / South
Evva MCS Austrian company Axial-rotated magnets Interaction with sidebar
Certain Magnetic Locks
Page 99
Deviant Ollamhttp:// deviating.net / lockpicking
Possibly the most duplication-resistant lock
Evva Magnetic Code System
Page 100
Deviant Ollamhttp:// deviating.net / lockpicking
Protec
MCS
No Known Attack or Bypass
Page 101
Deviant Ollamhttp:// deviating.net / lockpicking
photo courtesy of Don the Shadow
What About Safes ?
Page 102
Deviant Ollamhttp:// deviating.net / lockpicking
What About Safes ?
Page 103
Deviant Ollamhttp:// deviating.net / lockpicking
S&G 8400
What About Safes ?
Page 104
Deviant Ollamhttp:// deviating.net / lockpicking
photo courtesy of Barry Wels
What About Safes ?
Page 105
Deviant Ollamhttp:// deviating.net / lockpicking
What About Safes ?
Page 106
Deviant Ollamhttp:// deviating.net / lockpicking
But what about destructive entry ?
Page 107
Deviant Ollamhttp:// deviating.net / lockpicking
Page 108
Deviant Ollamhttp:// deviating.net / lockpicking
Page 109
Deviant Ollamhttp:// deviating.net / lockpicking
Page 110
Deviant Ollamhttp:// deviating.net / lockpicking
Page 111
Deviant Ollamhttp:// deviating.net / lockpicking
Page 112
Deviant Ollamhttp:// deviating.net / lockpicking
There’s one upshot… you know ithappened
Page 113
Deviant Ollamhttp:// deviating.net / lockpicking
The scarier risk is non-destructiveentry
Page 114
Deviant Ollamhttp:// deviating.net / lockpicking
Page 115
Deviant Ollamhttp:// deviating.net / lockpicking
Page 116
Deviant Ollamhttp:// deviating.net / lockpicking
Page 117
Deviant Ollamhttp:// deviating.net / lockpicking
Different locks for differentpurposes
Page 118
Deviant Ollamhttp:// deviating.net / lockpicking
No s pec ial pro tec tionsNo bypas s ing res is tance
Unskilled Attacker – basic tools & techniques, under 5 minutesSkilled Attacker – basic tools & techniques, under 5 minutes
1. Basic Locks
Page 119
Deviant Ollamhttp:// deviating.net / lockpicking
Some pick-resistant pins (possibly tighter keyway)Bump resistant, Zero potential of shimming or over lifting
Unskilled Attacker – basic tools & techniques, more than 5 minutesSkilled Attacker – basic tools & techniques, under 5 minutes
2. Resistant Locks
Page 120
Deviant Ollamhttp:// deviating.net / lockpicking
Advanced pick resistance, possibly wholly new mechanismsZero potential of shimming or over lifting or bumping
Unskilled Attacker – no chance in less than 30 minutesSkilled Attacker – special tools & techniques, at least 5 minutes
3. High Security Locks
Page 121
Deviant Ollamhttp:// deviating.net / lockpicking
Advanced pick resistance, possibly wholly new mechanismsNo potential of shimming or over lifting / Bump resistance
Unskilled Attacker – no chance at allSkilled Attacker – highly special tools & techniques, at least 30 minutes
(and quite possibly a lot of disturbance created)
4. “Unpickable” Locks
Page 122
Deviant Ollamhttp:// deviating.net / lockpicking
Page 123
Deviant Ollamhttp:// deviating.net / lockpicking
Page 124
Deviant Ollamhttp:// deviating.net / lockpicking
Page 125
Deviant Ollamhttp:// deviating.net / lockpicking
Page 126
Deviant Ollamhttp:// deviating.net / lockpicking
Page 127
Deviant Ollamhttp:// deviating.net / lockpicking
Page 128
Deviant Ollamhttp:// deviating.net / lockpicking
Page 129
Deviant Ollamhttp:// deviating.net / lockpicking
Page 130
Deviant Ollamhttp:// deviating.net / lockpicking
Page 131
Deviant Ollamhttp:// deviating.net / lockpicking
Protecting against force or finesse?
Page 132
Deviant Ollamhttp:// deviating.net / lockpicking
A New Physical SecurityFramework
Three Types of Secured Area External Access Internal Access Sensitive Access
Which Locks Go Where…?
Page 133
Deviant Ollamhttp:// deviating.net / lockpicking
A New Physical SecurityFramework
Basic Locks Utterly unacceptable Should be removed, in my view False sense of security Inevitable “cross-contamination”
X
Page 134
Deviant Ollamhttp:// deviating.net / lockpicking
“Cross Contamination” withLocks
Page 135
Deviant Ollamhttp:// deviating.net / lockpicking
“Cross Contamination” withLocks
Page 136
Deviant Ollamhttp:// deviating.net / lockpicking
“Cross Contamination” withLocks
Page 137
Deviant Ollamhttp:// deviating.net / lockpicking
“Cross Contamination” withLocks
Page 138
Deviant Ollamhttp:// deviating.net / lockpicking
“Cross Contamination” withLocks
Page 139
Deviant Ollamhttp:// deviating.net / lockpicking
“Cross Contamination” withLocks
Page 140
Deviant Ollamhttp:// deviating.net / lockpicking
“Cross Contamination” withLocks
Page 141
Deviant Ollamhttp:// deviating.net / lockpicking
A New Physical SecurityFramework
Basic Locks Utterly unacceptable Should be removed, in my view False sense of security Inevitable “cross-contamination”
X
Page 142
Deviant Ollamhttp:// deviating.net / lockpicking
A New Physical SecurityFramework
X External Access
Personnel Doors Wiring / Utilities Susceptible to Vandals & Thugs
High Security Locks Should Be Required
Page 143
Deviant Ollamhttp:// deviating.net / lockpicking
A New Physical SecurityFramework
X Internal Access
Office Doors Closets Protecting Privacy & Supplies, not Data
Pick Resistant Locks Are Acceptable
Page 144
Deviant Ollamhttp:// deviating.net / lockpicking
A New Physical SecurityFramework
X Sensitive Access
Server Racks Networking Equipment Any Termination-Worthy Data
“Unpickable” Locks Should Be Used
Page 145
Deviant Ollamhttp:// deviating.net / lockpicking
Be Totally Immune to Zero-Skill Attacks
To Me, a “Proper” LockShould …
Resist Skilled Tactics for Thirty Minutes
Leave Behind Clear Signs of Tampering
Page 146
Deviant Ollamhttp:// deviating.net / lockpicking
Security is only as effective
… as the people behind it
Page 147
Deviant Ollamhttp:// deviating.net / lockpicking
Social Engineering
Page 148
Deviant Ollamhttp:// deviating.net / lockpicking
Social Engineering
Page 149
Deviant Ollamhttp:// deviating.net / lockpicking
Social Engineering
Page 150
Deviant Ollamhttp:// deviating.net / lockpicking
Social Engineering Preparedness
Stop
Page 151
Deviant Ollamhttp:// deviating.net / lockpicking
Social Engineering Preparedness
Stop Challenge
Page 152
Deviant Ollamhttp:// deviating.net / lockpicking
Social Engineering Preparedness
Stop Challenge
Authenticate
Page 153
Deviant Ollamhttp:// deviating.net / lockpicking
Social Engineering Preparedness
Stop Challenge
Authenticate
Page 154
Deviant Ollamhttp:// deviating.net / lockpicking
Social Engineering Preparedness
Stop Challenge
Authenticate
… then you follow this with“Reward”
Page 155
Deviant Ollamhttp:// deviating.net / lockpicking
Social Engineering
Page 156
Deviant Ollamhttp:// deviating.net / lockpicking
Social Engineering
Page 157
Deviant Ollamhttp:// deviating.net / lockpicking
Forensic Evidence
Page 158
Deviant Ollamhttp:// deviating.net / lockpicking
Forensic Evidence
Page 159
Deviant Ollamhttp:// deviating.net / lockpicking
Forensic Evidence
Page 160
Deviant Ollamhttp:// deviating.net / lockpicking
Forensic Evidence
Page 161
Deviant Ollamhttp:// deviating.net / lockpicking
Forensic Evidence – 250 uses
Page 162
Deviant Ollamhttp:// deviating.net / lockpicking
Forensic Evidence – 1,500 uses
Page 163
Deviant Ollamhttp:// deviating.net / lockpicking
Forensic Evidence – 5,000 uses
Page 164
Deviant Ollamhttp:// deviating.net / lockpicking
Forensic Evidence – 250 uses
Page 165
Deviant Ollamhttp:// deviating.net / lockpicking
Forensic Evidence – 1,500 uses
Page 166
Deviant Ollamhttp:// deviating.net / lockpicking
Forensic Evidence – 5,000 uses
Page 167
Deviant Ollamhttp:// deviating.net / lockpicking
Forensic Evidence
Page 168
Deviant Ollamhttp:// deviating.net / lockpicking
Forensic Evidence
Page 169
Deviant Ollamhttp:// deviating.net / lockpicking
Forensic Evidence
Page 170
Deviant Ollamhttp:// deviating.net / lockpicking
Forensic Evidence
Page 171
Deviant Ollamhttp:// deviating.net / lockpicking
Forensic Evidence
Page 172
Deviant Ollamhttp:// deviating.net / lockpicking
Forensic Evidence – picking
Page 173
Deviant Ollamhttp:// deviating.net / lockpicking
Forensic Evidence – raking
Page 174
Deviant Ollamhttp:// deviating.net / lockpicking
Forensic Evidence – both
Page 175
Deviant Ollamhttp:// deviating.net / lockpicking
Forensic Evidence – ugh
Page 176
Deviant Ollamhttp:// deviating.net / lockpicking
Forensic Evidence – wow
Page 177
Deviant Ollamhttp:// deviating.net / lockpicking
Forensic Evidence
Page 178
Deviant Ollamhttp:// deviating.net / lockpicking
Forensic Evidence – pin sides
Page 179
Deviant Ollamhttp:// deviating.net / lockpicking
Forensic Evidence
Page 180
Deviant Ollamhttp:// deviating.net / lockpicking
Forensic Evidence
Page 181
Deviant Ollamhttp:// deviating.net / lockpicking
Forensic Evidence – tail cam
Page 182
Deviant Ollamhttp:// deviating.net / lockpicking
Forensic Evidence
Page 183
Deviant Ollamhttp:// deviating.net / lockpicking
Forensic Evidence
Page 184
Deviant Ollamhttp:// deviating.net / lockpicking
Forensic Evidence
Page 185
Deviant Ollamhttp:// deviating.net / lockpicking
Forensic Evidence
Page 186
Deviant Ollamhttp:// deviating.net / lockpicking
Forensic Evidence
Page 187
Deviant Ollamhttp:// deviating.net / lockpicking
Forensic Evidence
Page 188
Deviant Ollamhttp:// deviating.net / lockpicking
Forensic Evidence – bumping
Page 189
Deviant Ollamhttp:// deviating.net / lockpicking
Forensic Evidence – bumping
Page 190
Deviant Ollamhttp:// deviating.net / lockpicking
Forensic Evidence
Page 191
Deviant Ollamhttp:// deviating.net / lockpicking
Forensic Evidence
Page 192
Deviant Ollamhttp:// deviating.net / lockpicking
Forensic Evidence
Page 193
Deviant Ollamhttp:// deviating.net / lockpicking
Sometimesmajor insurance implications
Suspect something fishy? Don’t compromise the scene Contact a professional Forensic Locksmith vs. Yellow-Pages Locksmith
Having newer locks matters Age makes for a mess, internally Also… your locks should be updated as a matter of routine
The facts are out there!
Forensic Evidence
Page 194
Deviant Ollamhttp:// deviating.net / lockpicking
“Unpickable” Protec(rotating disks) MCS (magnetic) MT5 andMT5+ (electronic safe dials)
High Security Granit & Diskus (rotating disk) Twin (counter-milling, finger pins) 3KS (sliders), DPI (new models) Primus (if upgraded properly)
Resistant Padlocks (heavy duty models) Interchangeable Cores (modern models)
So Which Locks are Which ?
Page 195
Deviant Ollamhttp:// deviating.net / lockpicking
Thank you so much.
Thank you to TOOOL, Babak, Dave, Steve, JVR, Mouse, Mr. E, Barry & Han, Laz,
Valanx & the FOOLS,
Datagram, Matt Blaze, Jackalope, Renderman, Bruce & Heidi… and especially
Daisy
Page 196
Deviant Ollamhttp:// deviating.net / lockpicking
“Unpickable” Protec(rotating disks) MCS (magnetic) MT5 andMT5+ (electronic safe dials)
High Security Granit & Diskus (rotating disk) Twin (counter-milling, finger pins) 3KS (sliders), DPI (new models) Primus (if upgraded properly)
Resistant Padlocks (heavy duty models) Interchangeable Cores (modern models)
So Which Locks are Which ?
http://deviating.net/lockpickinghttp://enterthecore.net http://toool.us
this presentation is CopyLeft by Deviant Ollam. you are free to reuse any or all ofthis material as long as it is attributed and freedom for others to do the same is maintained