house
[Music]
welcome everybody
I am evil MOG and this talk at one point
had slides
demo Gods screwed me so this is now 100
percent live demo
I'm going to tempt the demo Gods because
why not because I don't really care well
actually I do but I spent 11 hours
cracking a safe yesterday
so
why did I do this
I spent I first bit about me I'm evil
MOG Dustin Haywood remember team hashcat
Bishop of the Church of Wi-Fi
shenanigator in Chief and I collect
black badges
I'm black badge to sky.com rest in peace
Derby con rest in peace Defcon
thoughtcon and now safercon after
many grueling hours in front of this
very challenge safe
I was not a safe cracker until November
I got bored
I figured you know what this can't be
that hard I'm going to figure out why if
carfoo car can do it I can do it
yeah that was the first mistake
um I decided to order about three
thousand dollars worth of cracking
Hardware from
now
fantastic we lost there we go is this
thing still outputting
aha cool see demo technology I.T is hard
all the rest of that stuff that's all
right so I decided to order some
hardware and some software off of a
German locksmithing company called zytec
they make a tool called the safe
manipulator
now for those of you who don't know
about safe manipulation
safe manipulation is basically feeling
the difference between contact points
now the way a lock is made up is you
have this thing called a nose the nose
is basically what's attached to a lever
and that's what dives into the cam drive
that engages the lock
so with a safe you basically have three
to four Gates
three bingo
or it will be towed in 15 minutes
also I've got a bingo
sorry this is uh I should also specify
opinions expressed this is talk are mine
and mine alone my employer has no uh
responsibility for any content within
herein therefore that finger was not on
company dime I paid my own way here
because this is just cool anyways
so what you're doing with a safe crack
is you're basically manipulating Wheels
into location to identify when
there's differences in that contact
point the nose dips just a little bit if
you're getting a wheel indication but as
everyone who saw me cracking safe
yesterday it's literally an 11 hour slog
and it is harder trying to crack a safe
in a lab or here that isn't a lab
because you got people walking up going
hey what you doing how's the progress I
spent most of yesterday teaching people
to crack safes rather than actually safe
cracking now this software saved my
bacon because when you lose track of
where you're on the Wheeled locations
these little red dots indicate where the
gates line up so I'm going to spin this
guy
and you'll see this thing go so the
yellow dots represent where the wheel
cams are so this by default is you only
see a bunch of little wheels and then
you see these little fiddly contact
points after I load this up open Final
yeah you can see my namings convention
it's kind of funny you know say first
11. here we go final two
so what we're looking at on here is
individual mappings on where these
contact points are and then Advanced
graph interpretation on Wheel three
wheel two wheel one
now I had to delete a bunch of contacts
because
traditionally in the sergeant and
Greenleaf lock wheel number three
indicates first which it did
wheel number two indicates second which
is this little dot right here
and then wheel number one
unfortunately in my case
it didn't indicate that way I spent
seven hours going down a rabbit hole
that proved to be completely and utterly
fruitless I mapped the entire drive cam
only to go through up in a matter of
Harry Carey oh my God I can't believe I
just wasted seven hours
I restarted remapped I grabbed myself a
Red Bull did some woosa relaxed
re-centered my mind and went back to
work on Wheel number one
thank God that thing popped in the first
20 minutes because I was sweating
bullets this morning like this was the
most YOLO safe cracking attempt I've
ever tried
um it's advice for you for anyone who
wants to do this at home go buy a
practice safe
go buy some graph paper and be prepared
to waste 20 hours a week sitting there
while you're watching Big Bang Theory
and your spouse getting very very angry
at you because you're skipping date
nights to go play with safe dials
I have over 250 hours since November of
safe spinning time put into this just to
practice and the worst part is this tool
doesn't work on the practice safe dolls
because they're at an angle of about 15
degrees and they fall over and getting
the mount up doesn't work in fact the
way this tool works is you have a rotary
encoder attached to a MAG Mount arm
the magmount arm doesn't Mount to an
acrylic safe we had to get creative
thank Mike for those door hinges that
were on there and all the additional
Hardware meant to prevent you guys from
taking this thing apart I would never
have cracked this like I'd been coming
up going hey here's how I attempted this
and here's how I failed
so basically
when you were cracking a safe
you need to be able to measure to within
1 8 of an increment of a dial
so I say 1 8 of an increment a safe dial
has a hundred Little Numbers around
there
you have to measure 1 8 of one of those
dial increments while you're fiddling
for those conduct points and it was made
worse because this lock is not a
straight off the shelf fresh from the
store lock it's an eBay special that's
been disassembled a few times the cam
orders are in different orders the
Machining differences it's kind of
spongy
it is not your ideal training lock which
made it just that much harder like
I wish I could have three months of my
life back
but it's doable anybody can do it it's
just a matter of time practice and very
very light pressure so the good news is
next year I'll be helping run the safe
cracking Village so I'll be teaching you
all how to crack this and tormenting you
from now on this is the second learning
rule I've learned from cybercon do
something great get called back to do it
again and all of a sudden Mike owns you
for the rest of your natural life
thanks monster we all love you
um
so basically what we do is we rotate
this you can see how things track now
the nice part about this is when you're
doing safe dial manipulation
um it becomes kind of fiddly because
you'll say Park a wheel and you'll be
messing with you know wheeled locations
in the case I pop this around
and then you pop something back and
you're going to go for a feel and you go
back to what the contact points are so
the nice part about this is I can like
feel where my contact points are it also
indicates when I'm in the zone
so
when I was doing this I had to do six to
seven measurements per contact Point
times a couple hundred rotations and
then redoing them when you mess them up
so I've been literally spinning this
dial and I switch over to this hand spin
this dial then back to this end spin
this dial
um
it is the most painful and rewarding
experience I would rather do a toy
Maker's badge again than try this again
and their badges are hard like the most
ridiculous
so I'm going to do a sample dialing I'm
going to put this mic down so I can do
so because it's hard to touch a mic
while you're doing this also there's a
book here fingertip safe cracking by the
Numbers if you want to crack a safe this
is the book you buy
I'm not affiliated with them I don't get
any commissions based off them
I've bought hundreds of dollars of the
books trying to learn how to do this and
they're all dry technical manuals that
make me eyes just bleed this is nice
color-coded diagrams step-by-step guides
persistence inconsistency are key
so when you first start dialing a safe
your contact Point readings are going to
be slightly off
and until you get like the very precise
touch you're gonna get nowhere
the other annoying part is different
locks have different manipulation
techniques
so when you first start picking a lock
we start scanning into your two or two
increment um
in two increments
the big red CDL locks that we practice
with needed in two and a half
the Lagarde 3300s they run on two every
lock speaks a different thing and it's
like
you communicate with the lock you know
the lock better than it knows itself
sometimes and it will frustrate you to
no absolute end I strongly recommend
that far more relaxing hobby like
I know go into a metal concert or uh you
know beating your head against a wall
repeatedly because it's far more
therapeutic but
when you get in the zone it works see
I'm sort of this turns into a rant on
wipe safe cracking sucks but I'm a
little salty and bitter today as you can
tell
and you will be too it's okay
so I'm gonna put this mic down I'm gonna
do a demo bear with me I still cheat
using this because even though I've got
all the visual tools sometimes it's
handy having a safe rotation formula
because these things are finicky and if
you mess them up well it gets annoying
so watch my little screen I'll talk
through this as I go
we're going to rotate left four times
we're rotating
so all these yellow parts are lined up
and now I'm going to get you on to
number 88 AK
a we are then going to go back
once
twice
and there we go okay so now we're gonna
rotate you into number 32.
we are then going to rotate U to number
16.
and
then we rotate all the way around to the
right
and miss the click even with the tool I
missed the click every time
so we do this again rotate four times
it's a lot of this
sorry those that missed out I missed the
dialing sequence by about half a number
on this even those things got a two
number slop so I have to Redial it
because safe dialing sucks and that's
what a lot of the safe cracking is it's
you miss a number you re-attempt you try
again and it gets kind of annoying so
we'll redial this and I'll show you what
it looks like for a normal open
so left
swing to 88
I'm going to rotate once
has 88
rotate twice past 88.
now we're going to stop at
32 or sorry yeah 32.
you're then going to start rotating back
32 once
stop at 16.
then we're going to rotate back
oh son of a this might not work
nope
now the nice part is you can do visual
dialing
that's what I'm doing right now
dial him again
also yes I know I'm tempting the demo
gods and that is totally okay I've
angered them before and I'm not prepared
they're not afraid to anger them again
[Music]
I am
the Earth man
stop 32.
this week yet we don't plug your laptop
in
and I know I'm off again on this but I
know why wheel three is in the wrong
position
16 I want you in
there aha
be my nope
see what I mean opening it dials hard
I left to 88
left 288.
there
right
once
you idiot twice
and then we are going to stop on 30
.
not you back in because you look too far
there
back we're going to there now we'll get
it correctly
so
I know this is boring as watching paint
dry I apologize but it's fun
all right
left twice until it stops on 16.
one
now
assuming that I did this right
I missed the nose again
all right so there you go the problem I
have with this is I screwed up when I
did my save completion in my moment of
Triumph I peeled off the little Drive
encoder off the safe dial and I super
glued it back on
and so now it's off-centered by about
half a millimeter so my old un coupling
is not attaching correctly to the safe
guaranteeing an automatic demo fail
but you know what that's all right this
whole experience is about learning how I
failed because as a pen tester I fail a
thousand times a day
I succeed once and all it takes is once
same deal with the safe you will fail
thousands upon thousands upon thousands
of times
and then you'll get a little bit of
success that success will breed more
success you'll get an indication
all of a sudden things start popping
like dominoes and then that door opens
and it's like the Ultimate Rush like
your first shell you've ever popped it's
addictive it's what gets me doing up on
this so I encourage you to do it even
though I've been bashing this this
entire time
um
I do not recommend dropping as much
money as I did on Hardware you can do it
with graph paper manipulation AIDS I'm
going to teach all that next year
I also don't recommend starting with an
old janky lock that has been beat to
hell
start with a nice well lubed easy to
work with lock a good cutaway work your
way up start with a group three then
move to a group two and cthulhu's sake
don't touch a group 2m or group 2R those
things are just
it's like a jumping difficulty from
popping a basic shell with
ms-170010 to
reverse engineering assembly blind while
riding a horse
terrible description but that's
basically what it's like it's just
it is maddening it's a lot of data a lot
of processing and you know what next
time I'm just gonna pay a locksmith to
open my locks for me because it is not
worth it
most locksmiths do not manipulate open a
safe they'll just drill it and the way
you can defeat the save is there is a
little tiny change Keyhole
right on the back there it's currently
covered in electrical tape
what you can do
and this is how someone won it a couple
of years ago was the change Keyhole
wasn't covered
and so they scope the change Keyhole
with their phone
they manipulated the dials washed the
disk packs lined up and low it popped
the year before that carfoo car used or
year after that carfoo car used a iPhone
mic
from his a headset
and listened for the click clack of the
gates
that method sort of works and is also
very error prone
honestly touch
more touch and lots and lots of graph
paper
so with that I mean this is a super
quick talk it'll let 20 minutes in so I
apologize for all the demo fails but
that's all right does anybody have any
questions before I sit here playing with
this lock till it pops open
yes
oh yeah the name of the book is
fingertip safe cracking by the numbers
by Sean C Evans
start again for the room was fingertip
safe cracking by the numbers
by Sean C Evans that has been my Bible
through this entire experience
um
you could probably get some pretty good
manipulation aids for about 300 bucks
from Lock Masters as well as MBA USA you
do need a locksmith license to get
access to some of these tools
but you're all hackers you can figure a
process
you know I'm licensed in the province of
Alberta getting the stuff through TSA
was interesting I don't think I'd ever
do that again
oh dude they had some questions for me
it took three supervisors and a bomb
Tech to clear me to board the airplane
yeah I do not recommend that route all
right let's try this one more time now
that I'm calm to go pop this safe see
what happens
thank you
oh yeah so for those of you following
along at home the book I keep
referencing page 22 has the normal save
dialing sequence because even though
I've opened these every time it is not
muscle memory yet
the day it becomes this please put me
out of my misery I'll go make surfboards
for a living in some beach in Mexico
two passes on 88 we stop at 32.
turn left past 32
you stop it at 16.
is that lined up oh that is lined up
perfect now with your rights
we feel for the bolt to engage
bingo
now I'm gonna pull this guy off
and
you notice that barely looked at the
dial for all of this
the nice part about this tool is I was
barely looking at the dial the entire
time I was staring at a computer screen
everyone thought hey is the computer
doing the sensing for you I'm like let's
just touch it's just the eye strain you
put up with so I don't hear over 40 no
they're starting to deal with the
bifocals and that the distance Vision
issues
this makes it that much worse this is
not an old person's game this is The
Young Person's game I mean you need the
wisdom of being old with the eyesight of
a 20 year old
which none of us have I mean I think we
got some 20 year olds roaming around
they might but I don't I sure as heck
don't
but that's it thank you all very much
for coming to my very a bridge safe demo
talk yes I got the red lifetime badge
and I'll teach you all to do this next
year assuming I keep my sanity which is
a big if
so follow me on Twitter evil underscore
MOG thank you very much
foreign
[Music]