117
Lockpicking Forensics datagram [email protected] Black Hat USA Briefings, 2009

Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram [email protected] Black Hat USA Briefings, 2009. Agenda ... Impressioning

  • Upload
    vothu

  • View
    226

  • Download
    0

Embed Size (px)

Citation preview

Page 1: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Lockpicking Forensics

[email protected] Hat USA Briefings, 2009

Page 2: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Agenda

How locks/picks work Normal wear Lock Analysis Key Analysis Investigative process

Page 3: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Destructive entry still #1!

Page 4: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

How Locks Work

Page 5: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

How Locks Work

Page 6: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

How Locks Work

Page 7: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

How Locks Work

Page 8: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Pin Binding

Page 9: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Pin Binding

Page 10: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Picking a Lock

Apply tensionFind binding pinRaise to shear lineRepeat

Page 11: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Picking a Lock

Page 12: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Forensic Locksmithing

1976 - Art Paholke, Chicago PD

Locks, Safes, Security (Tobias) Werkzeugspur (Goth) Impressioning (Diederichsen)

Determine method of entry Identify evidence, tool marks, techniques Provide expert testimony

Page 13: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Pins – New

Page 14: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Pins – New

Page 15: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Key - New

Page 16: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Plug - New

Page 17: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Pins – 100 uses

Page 18: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Pins – 100 uses

Page 19: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Plug – 100 uses

Page 20: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Key – 100 Uses

Page 21: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Pins – 1,500 uses (pin 1)

Page 22: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Pins – 1,500 uses (pin 5)

Page 23: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Key – 1,500 uses

Page 24: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Plug – 1,500 uses

Page 25: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Pins - 5,000 uses (pin 1)

Page 26: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Pins - 5,000 uses (pin 5)

Page 27: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Plug – 5,000 uses

Page 28: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Plug – 5,000 uses

Page 29: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Plug – 5,000 uses

Page 30: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Key - 5,000 uses

Page 31: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Forensic Analysis

Components (pins, springs, etc)PlugCylinderCam/ActuatorKeysBoltDoor, window, wall, etc

Page 32: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Lockpicking

Page 33: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Lockpicking - Pins

Page 34: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Lockpicking - Pins

Page 35: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Lockpicking - Pins

Page 36: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Lockpicking - Pins

Page 37: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Lockpicking - Pins

Page 38: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Lockpicking - Pins

Page 39: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Lockpicking - Pins

Page 40: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Lockpicking - Pins

Page 41: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Lockpicking - Pins

Page 42: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Lockpicking - Pins

Page 43: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Lockpicking - Pins

Page 44: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Lockpicking - Plug

Page 45: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Lockpicking - Plug

Page 46: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Lockpicking - Plug

Page 47: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Lockpicking - Plug

Page 48: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Lockpicking - Plug

Page 49: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Lockpicking - Plug

Page 50: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Lockpicking - Tension

Page 51: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Lockpicking - Tension

Page 52: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Lockpicking - Tension

Page 53: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Lockpicking - Cam

Page 54: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Lockpicking - Cam

Page 55: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Lockpicking - Medecoder

Page 56: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Pick Guns

Page 57: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Pick Guns - Pins

Page 58: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Pick Guns - Pins

Page 59: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Pick Guns - Cam

Page 60: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Pick Guns - Cam

Page 61: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Key Bumping

Page 62: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Key Bumping

Page 63: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Key Bumping - Pins

Page 64: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Key Bumping - Pins

Page 65: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Key Bumping - Pins

Page 66: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Key Bumping - Pins

Page 67: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Key Bumping - Pins

Page 68: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Key Bumping - Pins

Page 69: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Key Bumping - Plug

Page 70: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Key Bumping - Face

Page 71: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Key Bumping - Face

Page 72: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Key Bumping - Plug

Page 73: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Impressioning

Page 74: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Impressioning - Manipulation

Page 75: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Impressioning - Manipulation

Page 76: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Impressioning - Plug

Page 77: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Impressioning – UV residue

Page 78: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Impressioning – UV Residue

Page 79: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Decoding

Depends on technique Covert vs. surreptitious

Decoder “pick” Manipulation Visual/Optical Thermal Radiological Disassembly

Page 80: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Decoding - Visual

Page 81: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Decoding - Visual

Page 82: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Bypass

Page 83: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Bypass

Page 84: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Bypass

Page 85: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Key Analysis

Material, keyway, cuts, codes

Original or duplicate Hand cut or machined Recent cutting, copying

Material transfer

Page 86: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Keys - Plating

Page 87: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Keys – Original vs Copied

Page 88: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Keys – Original vs Copied

Page 89: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Keys – Stylus striae

Page 90: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Keys – Hand made

Page 91: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Keys – Filed

Page 92: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Keys – Filed

Page 93: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Keys - Dremel

Page 94: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Keys – Cutting Wheels

Page 95: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Keys - Comparison

Page 96: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Key - Bumping

Page 97: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Keys – Bumping

Page 98: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Keys – Tool Marks

Page 99: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Keys – Tool Marks

Page 100: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Keys – Tool Marks

Page 101: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Keys – Clay residue

Page 102: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Keys – Wax residue

Page 103: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Keys – UV Residue

Page 104: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Anti-forensics Tools?

Possible!

Difficult to use Limited durability Expensive*

Page 105: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Safe/Vault Forensics

Drill points Writing/marking Magnetic/adhesive Tool marks

Page 106: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Investigative Process

Crime scene investigation Laboratory examination Investigative report Testimony

Page 107: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Crime Scene Investigation

Photographs Sketches Permission issues Evidence preservation Chain of custody

Police vs. Insurance

Page 108: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Initial Questions

Purchase/Installation Per day usage Security rating(s) Key/combo distribution Lock condition

− Working?− Repaired?− Replaced?

Page 109: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Forensic Examination

Lock specs & data Lock operation Lock security rating Tool marks Material transfer Keys

Do your homework!

Page 110: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Disassembly

Chamber casings

Use of key(s)

Shimming

Destructive

Page 111: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Shimming

Page 112: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Forensic Workspaces Separate!

Clean area

Clean/new tools− Tweezers, followers, shims− Saws− Clay− Hands/etc

Page 113: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Cleaning of Components

To clean or not?

Always look first!

Evidence destruction False evidence creation

Page 114: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Cleaning of Components

Page 115: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Investigative Report

Findings Supporting pictures Mirrored locks*

− Picked− Pick gun− Bumped− Impressioned

Page 116: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Licensing & Certification

International Association of Investigative Locksmiths (IAIL)

Page 117: Lockpicking Forensics - Black Hat Briefings€¦ ·  · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

Resources

http://www.LockpickingForensics.com

http://www.LockpickingForensics.com/links.php

http://www.LockWiki.com