Slashdot Log In
The Study of Physical Hacks at DefCon
Posted by
Zonk
on Sun Aug 05, 2007 12:53 PM
from the old-ways-are-the-best-ways dept.
from the old-ways-are-the-best-ways dept.
eldavojohn writes "DefCon usually focuses on electronic security, but Saturday a talk was held that focused on possibly the oldest form of hacking — lockpicking. As software security becomes better and better, the focus may be shifting towards simple hacking tips like looking over someone's shoulder for their password, faking employment or just picking the locks to gain access to the building where machines are left on overnight. From the article: 'Medeco deadbolt locks relied on worldwide at embassies, banks and other tempting targets for thieves, spies or terrorists can be opened in seconds with a strip of metal and a thin screw driver, Marc Tobias of Security.org demonstrated for AFP ... Tobias says he refuses to publish details of 'defeating' the locks because they are used in places ranging from homes, banks and jewelers to the White House and the Pentagon. He asked AFP not to disclose how it is done.' I'm sure all Slashdot readers are savvy enough to use firewall(s) but do you know and trust what locks 'physically' protect your data from hacks like these?"
Related Stories
[+]
Science: NASA Hacker Gary McKinnon Interviewed 402 comments
An anonymous reader writes "A BBC article reports about an interview between Click and Gary McKinnon who in 2002 hacked into NASA and other US Military networks. In the interview he talks about how he accessed machines by using default passwords and a conversation with a NASA network engineer using Wordpad. He also talks about how he found information about anti-gravity, UFO technology, free energy and how UFOs are regularly airbrushed out from high-resolution satellite images."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Backstop that lock... (Score:5, Insightful)
Re:Backstop that lock... (Score:5, Insightful)
It isn't difficult to slice through or drill most locks or the doors holding them, let alone picking the lock, but if there is an armed human on the other side that changes the game a bit.
Parent
Re:Backstop that lock... (Score:5, Informative)
Weapons keep out ANYBODY, but watch out for criminal-friendly laws on deadly force that either require you to flee your own home or prove that you were threatened with imminent risk of death or great bodily harm.
Fortunately where I live, deadly force is justified within your own home top stop the commission of a felony, and burglary is a felony.
Parent
Re:Backstop that lock... (Score:5, Insightful)
You mistake shooting a "burglar" for penalizing said burglar instead of SELF-defense. Defending yourself is not to be confused with lynching.
A "burglar" (intruder) is a huge risk to the occupant of a house because the intruder has incentive to kill the householder to shut him/her up, and sometimes does.
Crimes of opportunity in a home invasion include rape, torture, arson to cover up the evidence etc.
Intruders are not typically like Roger Moore in "The Saint".
If you don't want to defend yourself, it is your right not to. To say that I cannot defend myself is to say that I don't matter, and those who would violate me do. I respectfully disagree.
Even in Iraq, the US allows householders one firearm. This is because police response is reactive, not preemptive. All the cops can usually do is collect evidence and maybe arrest the perp for whatever he/she did. This neither does not reverse or prevent damage to the victim.
When I was TDY to Saudi Arabia, some crackheads decided to party on my property. My wife asked them to leave. They told her to fsck off and made threatening statements. (We lived in an area with light police protection and long response times.) She retreated to the house, got our our Mini-14, and put several warning shots into the ground (not towards the crackheads) where the bullets could be retrieved if required. They promptly left and never returned for the remaining three years we lived there. When the police finally responded, the officer was fine with it. (I love the South!
The right to violent self-defense is essential to freedom, because if you are forbidden to defend yourself anyone can do their will to you.
Parent
Re:Backstop that lock... (Score:4, Insightful)
Agreed.
IMO, any rational burglar will attempt to flee once he or she discovers that the residence is occupied and the occupant is armed.
Any burglar who does not flee once the occupant announces that he or she is armed loses the benefit of the doubt in my book. The burglar is clearly involved in an illegal act and is not making an attempt to flee when discovered. That is not a good sign, and the occupant is justified in assuming that his or her life is threatened, IMO.
Parent
Re:Backstop that lock... (Score:5, Insightful)
It is also essential to get those high homicide rates. Your call."
Lawful self-defense
"Self-defense should be proportional to the actual threat.
Shooting any burglar because some burglars might become violent is just stupid. If the burglar is coming at you, fine. If he's trying to leave or running away, no."
The applicable laws cover that. They vary by state, so do read yours.
"Your wife is a psycho. (and apparently you are as well, from the tone of your post)"
Nice troll, but note I mentioned firing into the ground to facilitate bullet retrieval. That is not "psychotic"
We both have military training and are disciplined shooters. Making noise to scare away the crackheads worked, no one was injured, and the situation was de-escalated nicely. What you may (and others who may be unfamiliar with the way criminals like crackheads think) not understand is that they only respect people who appear scary. I'm not some crazed redneck, but I'll emulate one if it is useful. Crackheads are not deterred by the consequences of crack use, so that worldview limits the things that do deter them.
"Then all of a sudden it is the burglar who is being threatened for life, and who feels a need to defend yourself. Do you really want to go into that spiral?"
There is no spiral. Burglar has choice of turning and running or being shot. If he entered an occupied residence he may be presumed willing to attack and subdue anyone in that residence. If he hopped my fence and continued past my barking dogs he was determined to enter.
I'm not advocating trap guns or other nonsense, I'm advocating reasonable latitude in defending myself and other humans in my house where I have the reasonable (through human history) expectation of security. If I get burgled and no one is home, that's why I buy home insurance!
"A burglar has no intent to kill. If he would, why not do armed robbery instead? Why not take people hostage, take them to their home, clear out and kill them?"
He may have no INITIAL intent to kill/rape/assault. Your statement seems to imply burglars are a logical, rational lot. Some meth head who has been awake for thirty days may start out to burgle, but they aren't necessarily going to stick to that. Never assume the bad guy is interested in your logic. I'm not expecting to defend against Slashdotters, so I don't assume crooks think like Slashdotters.
Parent
Re:Backstop that lock... (Score:5, Insightful)
I have both the ADT sign and the above suggested firearms.
Parent
Re:Backstop that lock... (Score:5, Funny)
Parent
Re:Backstop that lock... (Score:5, Insightful)
Just look at how they derive those numbers...they categorize "loved ones" and "family members" and anyone you have ever met.
If you want the real, peer reviewed scientific analysis on guns in the hands on citizens, just check out the writings of John Lott.
Parent
Re:Backstop that lock... (Score:5, Informative)
http://www.smith-wesson.com/webapp/wcs/stores/ser
http://www.preparedness.com/protbysmitwe.html [preparedness.com]
Parent
Re:Backstop that lock... (Score:5, Insightful)
Parent
Re:Backstop that lock... (Score:4, Informative)
If someone's going to be an asshole, I'd rather they try it against someone who is overwhelmingly better-armed than they are.
Parent
Re:Backstop that lock... (Score:5, Insightful)
The problem we have is that since the 1970s, we've emaciated homeowners and law-abiding citizens by making it difficult to use deadly force.
If, as was the case prior to 1960 in most parts of the US, it was generally assumed that a property owner could use deadly force against an intruder, it would be the equivalent of a "Protected by Smith and Wesson" sign in front of EVERY house, along with criminals having to assume the risk of such crimes.
Parent
Re: (Score:3, Interesting)
If guns stop crime then why crime in the USA? (Score:4, Insightful)
If weapons stop crime, how come the USA, one of the most tooled up countries in the world, has so much crime and so many people die from gun injuries?
Parent
Re:If guns stop crime then why crime in the USA? (Score:5, Insightful)
Also if guns are the cause of all evil how come after they were mostly banned in the UK the crime rate hasn't budged, knife murders are way up, burglaries are 3 times that in the US and rapes are also close to 3 times that in the US (rate wise of course).
Parent
Re:If guns stop crime then why crime in the USA? (Score:4, Informative)
Parent
Re:If guns stop crime then why crime in the USA? (Score:5, Insightful)
This argument always pops up when the topic is guns. And I always counter by asking why Finland, which is in the top five when it comes to guns per capita, has one of the lowest crime rates in the world.
The roots of the American crime problem lies somewhere else than guns. Try income inequality and poverty if you really want some kind of beginnings of an real answer, instead of reinforcement to preexisting memes.
Parent
Re: (Score:3, Insightful)
Because of the gun control laws in place, funnily enough. If in this country you could easily and legally carry around a concealed firearm, criminals would be less inclined to attack you because it's legal and easy for you to have a gun to defend yourself. With the gun laws as they are, the odds are in favor of the law breaking criminal who HAS a conceale
Re:Backstop that lock... (Score:4, Funny)
Parent
Re: (Score:3, Interesting)
Or you could do what Pat McManus does, and have an alarm system that doesn't beep, it plays the sound of a pump-action 12-gauge. A gun doesn't have to be dangerous to be a deterrent.
Re: (Score:3, Interesting)
You sir, are a fucking idiot.
So you're saying it's better to have an alarm system which usually takes over a minute to alert the alarm company, then about 30 seconds for them to call your local dispatch center. Then another 30 seconds for the dispatcher to get the information. Then they have to give the info out to the officers...and in a lot of places (other than Big City USA) it can take 15 minutes
Protection (Score:5, Funny)
I know I weld my doors shut nightly. You should too!
Re: (Score:3, Funny)
I tried that with my wooden doors, didn't work out too well...
Re:Protection (Score:5, Funny)
Parent
Re:Protection (Score:4, Funny)
Parent
Re: (Score:3, Funny)
"Hacking" (Score:5, Informative)
"...simple hacking tips like looking over someone's shoulder for their password."
How far the meaning of this word has come from it's original [wikipedia.org] usage.
Re:"Hacking" (Score:5, Funny)
"Canvas. JC Penny. Three ninety-eight. You like?"
Parent
Locks are pretty much useless (Score:5, Funny)
Wetware hacking (Score:4, Insightful)
It's not shifting at all. I've done my share of hacking when I was younger (ahem) and the weakest link was always the human link. It was much easier to con the secretary into giving a password than hacking the secretary's computer, and I suspect it's even more the case now with more solid computer systems. That's called social engineering and it will always work very well indeed, because much to my dismay, computer users get dumber and dumber as computer get more and more powerful.
As for lockpicking, it's not really a secret that no lock is safe. Look up "bump key" in your favorite search engine and you'll see what I mean.
How to pick Medeco locks (Score:3, Informative)
Re:How to pick Medeco locks (Score:5, Informative)
Other than Medeco, there is one type of lock that would be excellent for security, Abloy's Protec line, which from what I read takes 10-12 hours to pick even for the pros at detainer disk type of locks. However, the Protec line isn't sold in the US. Older Abloy lines are decent, but it would take far less time for a pro to pick them open. There are other high security locks out there, and one can read from a lock site what the weaknesses are of each of them.
Nothing is 100% secure. If some thief is determined enough to bypass something, they can.
Lastly, high security locks just one tool, in a toolbox of security options. If its worth locking with a high security cylinder, its worth having a centrally monitored alarm system (with a duress code [2] option.)
[1]: Biaxial isn't that much more secure than the original Medeco, but it allows for (IIRC) 10 times as many key combinations, allowing for more flexible keying options.
[2]: Yes, home invasions are on the rise, so make sure an alarm system has a duress feature (where it disarms, but silently calls the central station)... and USE the alarm. If at home, use the alarm's "at home" feature which monitors the doors and windows, but doesn't arm the IR detectors. A high security lock is no good when it is opened by the owner at gunpoint.
Parent
Re:How to pick Medeco locks (Score:5, Interesting)
You seem to know a thing or two about Medeco locks (like the fact that there's a diff. between the original and Biaxial). If you know/see something about the article I don't, please let me know. My father worked for Medeco (and I briefly worked in their factory one summer) and I'm sure he'd love to know.
Also, last I heard, there was still a reward offered by Medeco for picking a lock at their headquarters in Salem VA.
Parent
Re:How to pick Medeco locks (Score:5, Insightful)
The Medeco reward I've heard about in a number of different forms, so I'm not sure the exact details. Last I heard, if someone can pick 3 Medeco cylinders (the six pin type found in deadbolts, not the four or five that are used as replacement for disk tumbler cylinder replacements.), they get a prize. However I have no clue what the real status of that is.
Nothing is unpickable by someone who knows their stuff and has the manual dexterity. Its slowing people down, to where even a skilled lock manipulator will take hours to open the lock, which will most likely mean detection. Its also forcing someone to leave a signature (scratches), so if stuff does get taken, one can prove to an insurance company that a lock was defeated or something was broken.
Mushroom pins help, but are just one security mechanism, forcing locksmiths to jam the pins up, then let them float downward to the shear line, rather than pushing pins up from their resting place. I'm pretty sure the sidebar is pickable by some tool that rotates the pins, as its talked about on various lockpicking sites.
This is one reason I recommend high security locks. If someone kicks down a door or breaks a window, that leaves a noticable signature where a claim with insurance has more ground. If someone's house is robbed by a bumped lock, there is no trace, and it goes to a word against word thing to prove that stuff was there, and is now not.
It may be the security has nothing to do with the tumbler mechanism. In some locks are weaknesses that have nothing to do with the cylinder used. For example, one lock I have has a very pick resistant cylinder, but one can use a shim and the lock pops right open.
Lastly, some people may state security through obscurity, but I'm glad that the methods of opening Medeco deadbolts are not made public. Physical locks can't be updated like most programs can. Every cylinder in a building would need replacing, and that would amount to hundreds of thousands, if not millions of dollars, factoring in parts, labor, the time it takes to deploy a new keying system, getting the new keys to all the employees, etc.
Parent
Re: (Score:3, Insightful)
Basically, the trick is you don't pick the lock at all. You pass the metal strip THROUGH the body of the lock and out the back, and use it to retract the bolt mechanism behind the cylinder. Damned clever attack.
If its anything like hacking.. (Score:3, Funny)
How Medeco locks work (Score:5, Informative)
Bump keys can't even get started opening that.
More burglars have feet than have lockpicking skills. Step one in physical security is to combat kick-in attacks. Replace your strike plate, which I can almost guarantee is inadequate, with a reinforced model like the Mag-3 and most important, install it with #10 wood screws at least 3" long, so it can't tear out of the studs when subjected to a good kick. Predrill the holes and put soap on the threads so you don't break screws as you install it.
A block watch is a great idea too. Neighbors are a security mechanism.
An alarm system also protects you against fire, which depending on where you live can be a bigger threat than burglary.
Re: (Score:3, Insightful)
It's the form factor, stupid. (Score:4, Interesting)
A big problem with mechanical locks is the form factor. Anything that has to fit in a standard US cylinder lock hole is inherently weak. It's just too small.
There are some good locking systems out of Israel. Mul-T-Lock makes door locks that extend three or four deadbolts through the door and into the frame, like a vault door. These are made to work like ordinary door lever locks.
The best residential doors are found in older HUD-financed housing projects in bad neighborhoods. Apartment doors are steel fire doors mounted in steel frames, and walls are reinforced concrete. Those things will resist a battering ram. The lock mechanisms usually aren't that great, but the threat there is generally brute force, not lockpicking.
It's surprisingly hard to get good doors and locks in the US. There are better locks in parts of the Third World.
Re: (Score:3, Insightful)
It's surprisingly hard to get good doors and locks in the US. There are better locks in parts of the Third World.
Mostly because there is greater demand there.
Of course in such places the criminals simply find ways to not have to open the lock. I'm sure in some of those places the door literally has to withstand a battering ram, car powered one that is, or it isn't of much use. In Poland criminals didn't even bother to pick locks to apartments half the time, they simply found some old lady carrying groceries to her apartment then offered to help carry them for her. Then as soon as she opened the door they punched her
Crypto (Score:4, Insightful)
Of course they can then be deleted, but someone who would have access to my computer could only "damage" my most precious data, not read it. A computer does not work like a safe, it can be much more efficient.
Encryption - easier to use than you might think (Score:3, Interesting)
But it doesn't just protect my data from burglars. It also enables me
Locks are easy (Score:5, Funny)
Keyboard JitterBug eavesdropping (Score:4, Informative)
professional hackers/security staffers into the wrong direction, as in
May 2006, USENIX published the following research article :
"Keyboards and Covert Channels"
by Gaurav Shah, Andres Molina and Matt Blaze , 2006-05-17
Department of Computer and Information Science
University of Pennsylvania
http://www.usenix.org/events/sec06/tech/shah/shah
In it the authors demonstrate that todays unwarranted wire tapping NSA
activities, normally don't result in much success as serious internet
users routinely apply encryption into their communications, like IPSec
tunneling, ssh, VPN access connections, secure web-traffic https when
i.e. doing Internet banking activities.
However, secret service found a clever approach to all this, by
covertly installing a Keyboard JitterBug into your keyboard. Here's
how to secure your most trusted keyboard :
Keyboard JitterBug eavesdropping
http://crashrecovery.org/internet/#jitter [crashrecovery.org]
where i may add, that lock picking _ALSO_ has been the best hoax ever
on public display. Why? How many people today design their _OWN_
locksmith locks? All installed door-locks worldwide are somehow sold in
stores, hence its products and replacement keys are in the archives of
the local secret service.
Robert
For details... (Score:4, Informative)
Digital locks are fun - Samsonite (Score:4, Interesting)
Why?
Because they DIDN'T try all available combinations. I discovered that the Samsonite digital lock with 4 positions from 0..9 can have a total of 11110 combinations instead of 10000 because you do not need to use all positions (which is not even in the little manual). In other words, the number of possible combinations is 10000 + 1000 + 100 + 10. The combination in use was "9" with me pretending to press the remaining 3 digits so there was a little bit of misdirection involved
Having said that, that specific lock has a more fundamental flaw that allows it to be easily reset, and this type of briefcase is not popular with airport security so I eventually stopped using it.
Cracking, not hacking (Score:3, Insightful)
This used to be news for nerds -- please get it right.
anecdotal (Score:5, Interesting)
Ya, it sucked doing that,the principle rankled me, but my practical nature took over, because it was better than having to replace a door window.
Most modern stick frame construction houses are vulnerable to a razor knife. Just pick a section of wall and slice a hole. You got plastic siding, a thin tyvek sheet, some cheap ass pressboard stuff,(glorified cardboard really), some spun fiberglass insulation, then drywall. That's all you need, a couple minutes with a razor knife and any thief can get in easy, let alone if they use something like a cordless sawzall thing.
Parent
Re:anecdotal (Score:4, Interesting)
There were thieves in Chicago(and I'm sure elsewhere) that would steal whole garages, bricks and all. Turns out they could sell the bricks. And watch out for stolen manhole covers. That could really hurt. Well, you have the right idea. Don't go through those neighborhoods wearing your nice shoes.
Parent