Slashdot Mirror
The Study of Physical Hacks at DefCon
eldavojohn writes "DefCon usually focuses on electronic security, but Saturday a talk was held that focused on possibly the oldest form of hacking — lockpicking. As software security becomes better and better, the focus may be shifting towards simple hacking tips like looking over someone's shoulder for their password, faking employment or just picking the locks to gain access to the building where machines are left on overnight. From the article: 'Medeco deadbolt locks relied on worldwide at embassies, banks and other tempting targets for thieves, spies or terrorists can be opened in seconds with a strip of metal and a thin screw driver, Marc Tobias of Security.org demonstrated for AFP ... Tobias says he refuses to publish details of 'defeating' the locks because they are used in places ranging from homes, banks and jewelers to the White House and the Pentagon. He asked AFP not to disclose how it is done.' I'm sure all Slashdot readers are savvy enough to use firewall(s) but do you know and trust what locks 'physically' protect your data from hacks like these?"
...with a Smith & Wesson (or a Glock, or a Bushmaster, or a Remington).
the focus may be shifting towards simple hacking tips like looking over someone's shoulder for their password, faking employment or just picking the locks to gain access to the building where machines are left on overnight.
It's not shifting at all. I've done my share of hacking when I was younger (ahem) and the weakest link was always the human link. It was much easier to con the secretary into giving a password than hacking the secretary's computer, and I suspect it's even more the case now with more solid computer systems. That's called social engineering and it will always work very well indeed, because much to my dismay, computer users get dumber and dumber as computer get more and more powerful.
As for lockpicking, it's not really a secret that no lock is safe. Look up "bump key" in your favorite search engine and you'll see what I mean.
"A door is what a dog is perpetually on the wrong side of" - Ogden Nash
My own data is kept at home, where my windows are left open all day and the locks can be picked by amateur locksmiths in a few minutes. It's basically there for the taking, but as it happens there's really very little of value - I don't keep identifying information like social security numbers electronically, and I don't happen to own any intrinsically valuable data. The reason I protect my computers is to avoid seeing them used by others to launch attacks; between the legal concerns and a simple moral obligation to the rest of humanity, I don't want that happening. The actual data that needs protecting is stored elsewhere - in a bank vault, perhaps. The real concerns are around all the corporations and government agencies which insist that they need all this information but then do nothing to protect it - physically or electronically. Given their lax electronic safeguards, I don't really see much point in improving physical security: right now my data can be obtained more easily and with less risk of detection by electronic means than by physically breaking into a data centre.
The OP's article really didn't have much detail, but there are other sites that one can check out that have more details on attacks on Medeco locks.
The Medeco reward I've heard about in a number of different forms, so I'm not sure the exact details. Last I heard, if someone can pick 3 Medeco cylinders (the six pin type found in deadbolts, not the four or five that are used as replacement for disk tumbler cylinder replacements.), they get a prize. However I have no clue what the real status of that is.
Nothing is unpickable by someone who knows their stuff and has the manual dexterity. Its slowing people down, to where even a skilled lock manipulator will take hours to open the lock, which will most likely mean detection. Its also forcing someone to leave a signature (scratches), so if stuff does get taken, one can prove to an insurance company that a lock was defeated or something was broken.
Mushroom pins help, but are just one security mechanism, forcing locksmiths to jam the pins up, then let them float downward to the shear line, rather than pushing pins up from their resting place. I'm pretty sure the sidebar is pickable by some tool that rotates the pins, as its talked about on various lockpicking sites.
This is one reason I recommend high security locks. If someone kicks down a door or breaks a window, that leaves a noticable signature where a claim with insurance has more ground. If someone's house is robbed by a bumped lock, there is no trace, and it goes to a word against word thing to prove that stuff was there, and is now not.
It may be the security has nothing to do with the tumbler mechanism. In some locks are weaknesses that have nothing to do with the cylinder used. For example, one lock I have has a very pick resistant cylinder, but one can use a shim and the lock pops right open.
Lastly, some people may state security through obscurity, but I'm glad that the methods of opening Medeco deadbolts are not made public. Physical locks can't be updated like most programs can. Every cylinder in a building would need replacing, and that would amount to hundreds of thousands, if not millions of dollars, factoring in parts, labor, the time it takes to deploy a new keying system, getting the new keys to all the employees, etc.
That's what encryption is for. Even with physical access, your files are secure as long as the key lives inside your brain.
Of course they can then be deleted, but someone who would have access to my computer could only "damage" my most precious data, not read it. A computer does not work like a safe, it can be much more efficient.
The Wise adapts himself to the world. The Fool adapts the world to himself. Therefore, all progress depends on the Fool.
Of course in such places the criminals simply find ways to not have to open the lock. I'm sure in some of those places the door literally has to withstand a battering ram, car powered one that is, or it isn't of much use. In Poland criminals didn't even bother to pick locks to apartments half the time, they simply found some old lady carrying groceries to her apartment then offered to help carry them for her. Then as soon as she opened the door they punched her out (or killed her or just pushed her out of the way if she was lucky) and robbed her apartment. And I don't mean a few did this, I mean all of them did this.
Basically, the trick is you don't pick the lock at all. You pass the metal strip THROUGH the body of the lock and out the back, and use it to retract the bolt mechanism behind the cylinder. Damned clever attack.
John
Parent's point I'd guess would be that it's an arms war. If you're saying that the way to stop being knifed is to carry a knife yourself, then the criminals carry guns. And if you match that with a gun, surely the only solution is for everybody to carry fecking ridiculous big guns around? Personally I am happy to be able to walk down to the shops without needing to carry a weapon.
If weapons stop crime, how come the USA, one of the most tooled up countries in the world, has so much crime and so many people die from gun injuries?
...defeated, of course, by the nearest prowler with a drugged steak...
Don't tell me to get a life. I'm a gamer; I have LOTS of lives!
Lockpicking is the oldest form of cracking, not hacking. Hacking is best summed up as "unconventional and creative use of technology". It is not a synonym for breaking and entering.
This used to be news for nerds -- please get it right.
I came in here to read about locks and lock security and lockpicking. Instead it has turned into almost complete gun control debate. Letting people stray so far off topic should be discouraged so we can read posts that relate more to the subject at hand. /if there is an off topic mod I guess this should be given the same rank as well.
My Xbox Live Gamer Card