[Music]
good evening thank you all for taking
your time to being here with me tonight
um and also welcome to the people on the
stream this talk is about the amiibo
anchor lock
i have one of these logs in my
collection i'm a bit of a lock collector
i used to be a chairman of tool as well
and of course i'm a hacker like most of
you
and i like to figure out how stuff works
and i thought a few years ago already
how does this
specific lock work because it's quite
special in that it uses magnets
so i set up on a trip on figuring out
about this particular lock and this talk
the next 50 minutes i will tell you
about what i've tried to do with the
lock where i failed what not many people
will tell you nowadays when we all have
instagram but i will tell you all the
failures and all the successes as well
i probably don't have enough time to
have a real uh to have questions in
between if you have any questions maybe
we have some time at the end or
otherwise you can find me outside after
the talk
so i have this background tool
and i also have to say i'm writing a
book together with a few friends about
log sport
so this cylinder the anker 3800 or miwa
3800 that originated was invented in
japan as miwa it is sold in the
netherlands as anker
this is a view from the inside and you
see that this log has
four pins which you will find in many
regular locks that you will find on the
door but also here above the pins we
have
sliders with magnets in them and that
makes this
a special kind of cylinder
now here you see the key
and on the bottom of the key there are
these indents the bitting of the key and
you can see that they match for the four
pins that are inside the cylinder so
and on the other side of the key we see
eight black squares those are four sets
of two magnets
and those are samarium cobalt magnets
and they can also be fakes so some of
these black blobs are magnets and some
of them are fakes
and these magnets make tiny little
sliders in the cylinder move
and they need to move to the correct
spot to open
right so here again you see a blown up
version where you can clearly see that
the
what did i do the wrong button
where you can see that the sliders
go from left to right within the plug
and they are operated by the magnets
that you can see here in the key and on
the bottom these pins are operated
now the pins i'm not really going into
lock picking
you can go to other talks or to visit
the tool village here at the campsite
but for lock picking
or for the the pins they need to be
aligned at the shear line so the length
of the red pins need to match the cuts
in the key and when they're all
perfectly aligned
the
plug is free to rotate
well that's not the interesting part the
interesting part is those magnets so we
have here the four sliders
that can slide
in this orientation they slide up and
down
and
so you see there's
four sets of two magnets in the key that
one set per slider
um
now i then did some photoshopping to
create this wonderful slide so i think
this is my photoshop achievement
unlocked although it's a bit crappy but
i'm not a designer i'm a hacker on the
left you see the closed lock and you can
see that the pin is not at the shear
line and also you see this
yellow
slider
it it protrudes into the
edge of the cylinder so that's why it
won't open and there's a little spring
on top
and this green and red thing that's the
magnet
and on the right you see it with the
correct key inserted
so the key pushes the pin to the correct
depth
and also the magnets in the key
will
interact with the magnets in the slider
moving it away to the right
freeing up the plug
so that's basically how it works
and here you see that in this
so i said there are pairs of magnets but
in this case there's only a magnet on
one side of the key
and that is actually quite normal
here you see a key with a piece of
magnetic paper on top of it and you can
clearly make out that there is magnets
in there and i can even also tell that
the bottom two they are either facing
north up or south up and the upper two
they are
facing left or right
so there are different orientations of
magnets and that is what creates the key
in this the the code in this key
and of course you need at least one
magnet per slider to operate the slider
if you would use a
incorrect key
then
maybe the bidding is incorrect which
means that some pins are sticking out
or you have the incorrect magnets which
means that the sliders are sticking out
so they all need to be
correct
for everything to align within the plug
and the plug to rotate
right so this is a the theory um how
this lock works so i hope that is all
clear now let's look at defeating this
lock so what about picking can we pick
this cylinder well the four pins that
are in there they're just for pins and
you could
lock pick them with
regular picking techniques
and actually there's only four of them
whereas most common locks have five so
that should be easier but then there's
also these magnets
now these magnets can also be
manipulated if you take a piece of metal
and
glue a small magnet on the end of it you
can insert in the lock and wiggle it and
manipulate these sliders
and the sliders will move inside of the
cylinder and you can also use audio
magnification to make it easier to to
figure out what is happening and open
this lock
this is not easy when i started my
research which was already quite a few
years ago
i had not seen anybody open this
cylinder before
but
later on
i found well here's at least four videos
on youtube where you can figure out
where you can see this lock actually
being picked by hand
but there's only a few videos so that
already tells you that this is very hard
lock to lockpick because of those
magnets and and
the oldest videos are about two years
old that i found
so what i did was i took an old cylinder
and i
made a test cylinder out of it so in one
side i only kept the pins and the other
side i only kept the
magnetic sliders to
to work with this and my first thought
was can we duplicate the key
because you cannot just duplicate such a
key you need
to call to the factory to get it
duplicated you need to have a
certificate but if you have a key can
you make a copy
and of course you need to
read out the magnets
so we need some kind of device to
measure the magnetic field
now i'm quite an old hacker so
i like to do electronics real ultra
stuff electronics i have a talk about
the gigatron tomorrow night but it's a
different story so i made this i found
this on the internet and i made a
magnetometer
so here's a device that you can use
to measure magnetic fields
and as you can see here i can read out
the magnets and you will see that some
magnets are orientated left right
and some of them are up down
oh that's not true in this particular
key they are all
left right oriented and you can also see
that for for each pair there's only one
that is an actual magnet the other one
is fake
okay reading the
magnets done my electronic batch is in
the pocket
but now i need to create a duplicate key
with these magnets
now the blank keys are cannot be
obtained
so i cannot start off with a blank key
and and put a magnet and make it fit
the magnets are made by factory and i
believe it is in france or spain or
somewhere
and the only
company in the netherlands that has
these is the anchor factory itself
and they won't just give you a key
maybe if you're very good in social
engineering
but anyway i thought i'd make a
magnet setup key so i take an existing
key
try to take out all the existing magnets
so i have holes in which i can put my
own magnets
so i used my dremel and i also took away
the bitting
and my idea was this key
is used to set the magnets
and then i can use this slit in between
to pick
the pins
because uh yeah i cannot form an
existing key i cannot make another
bitting of another key so i thought well
let's make a key with the magnets and do
picking
well that was also an epic fail because
there there's so little room inside this
cylinder that i just could not put my
pick in the
in the lock
and uh yeah not disturb pins that i did
not want to move
so that was a fail
but nevertheless i proceeded i i bought
some two by two by two millimeter
magnets
um
and um
yeah i tried to make the setup key
anyway
because i wanted to do yeah i still was
trying to learn more stuff but this just
didn't work i'm not very good at metal
work it appears and it was too steep a
learning curve for me i didn't have the
right equipment
so the setup key thing was going nowhere
it failed
so i thought
how else well let's let's forget about
these magnets for a while uh let's
suppose that we can create a key with
the correct magnets let's suppose i find
somebody who can do the metal stuff and
create this empty key for me
if i have it
what do i do with the bidding how do i
copy the bidding
well i also
do have
some equipment to make
copies of keys by using molding
so you take some putty you put in the
key
it makes a
you get a mold you pour in molten metal
and you have a copy
[Music]
you see a mold i made of an existing key
so now my idea was if i have a
setup key with the correct magnets i
need to put in this bitting that you see
here
and this is how i did it
so the setup key i combine with the mold
of the key i want to copy
i pour in metal and this is the result
does it work
yeah achievement unlocked
of course this is the cylinder that only
has the pins and not the sliders because
i didn't
succeed in making the setup key
but this proves that if i have a setup
key i could copy the
bidding
[Music]
so to duplicate a key we could make a
skeleton key from the existing key
but that's quite frustrating also
even if i could get this empty key with
the holes to put the magnets in the
magnets that i bought are two by two by
two millimeters and the key is only 2.1
millimeters thick
if you have only point one millimeter
left you yeah it becomes really horrible
to work with
and this was a state of affairs
in at lok con 2019 just before kovit and
i thought well
the only solution i see to get it to get
to advance is to do 3d printing but i
didn't have a 3d printer
and
yeah i left the project
i abandoned it
but then came covert
and i had time
and i also had a little bit of money
left to buy myself a
present which is this creality halo
printer this is a resin printer because
i thought because of the really tight
tolerances i needed a very a printer
that could make really my new details
i bought this printer and i thought and
i was still somehow stupid of me in the
mode of i need to get that setup key
so what i did was i made a setup key
with the slit to do the picking which i
already knew didn't work anyway
and i but this was fun because i needed
to learn about
openscad
and
design
so again achievement unlocked i was able
to create a 3d model of this key
and this has a slit to allow for picking
and this is actually maybe the the
second or third thing i printed on this
printer so i was really chuffed
it did need a little bit of filing to
make it really fit because the
measurements were a little bit a little
bit off
but as you can see the magnets did fit
it didn't break
and best of all it does work on my
cylinder that has just the magnets
so the proof of concept is i can make
this key
still a tiny problem of the slit where i
cannot put in my picking tool without
yeah
doing anything
but i first i i fixed my model to make
it more to make it fit better so this is
a
somewhat later key and this fits right
away after printing
but i still had that problem in the
meantime i had learned from those
youtube videos which were made
after i picked this project up again in
kovit
i find out that the pins are first to
bind in many locks with different rows
of pins of different elements
you need to pick one row first
then the
lock will rotate slightly and then you
need to pick another one the the second
row of pins
now in this particular lock you need to
pick the pins first then it will rotate
a little bit and then you need to
put the sliders in the correct position
so i can actually by applying tension in
the middle of the lock and using a
picking tool i can pick the four pins
and when the four pins have been picked
i can use the setup key that i made by
copying the magnets from the original
key
i can insert it
and
keep the tensioner in place and that
would open the lock
and i tried this and i picked the lock
and actually it was
much harder than i had anticipated
but
achievement unlocked i did open it but
this is not really something that a
non-professional lock picker would
easily do
also the pins in this lock
are anti-picking pins which makes it
more difficult to pick them
yeah but as i said um
oh so the attack factor that we have up
till now is if i have access to a key
even temporary i can read out the
magnets i can create a setup key i can
pick the pins and open it
but of course why am i not just 3d
printing the bidding i was really stuck
on my original train of thoughts of
do continuing what i was doing but of
course you can just print the bidding i
mean that's no no biggie
so i
updated my model and you can now
create a bidding in there as well
and
yeah you can just type in another code
and as you can see
it will
change another bidding so you can just
type in the number of the
the code of the bidding that you want to
have
and you create a key
so
with that here's a such a key that has
been printed
and it does work on both sides
so now we can actually
create a copy of course you also need to
know what the bidding is but
there's only four pins and the depth of
these pins there's only four
possibilities
so that's not much
in many locks you will have seven or
maybe nine possibilities and then you
really have to measure quite well to see
which
which depth it is but in the anchor it's
only four
and if you've been doing this for a bit
of time you can do this with a naked eye
if you give me an anchor key i can see
with the naked eye what the depth
are
so i can
put that in my open scat printer key and
have a duplicate so that's interesting
uh problem is a little bit that the keys
are very brittle
i once dropped the key from this height
and it broken too
and also you have to be careful inside
of the lock
uh so i also did have a key break inside
of the lock and it gave me very hard
time getting that key out again
so that's also why if you do these kinds
of experiments you do them on your own
cylinders that you don't use in a door
or somewhere where you rely upon them
so the keys are brittle so what to do
about that i thought about this and i
thought well if we make the magnets
smaller
there's more
surrounding material making the key more
sturdy so i did find some one by one by
one millimeter magnets now they are so
incredibly small that if you put them in
tweezers and you move them around they
will they will already flip it's
i gave up
and then i talked to a colleague of mine
at work about this uh hobby project and
he said
well why not to use disk magnets
and he actually already started on
printing on his printer a key and he
does not have a resin printer but a
filament printer
and as you can see here on the bottom
this is a key where the magnets are
cylindrical this means that some
cylinders some magnets need to go flat
and some magnets need to be
going deep inside of the key
but of course if you print a key on a
per use basis you can print it any way
you like so you just print it so it fits
the correct magnets
and what's even better you can leave out
the holes where you don't need a magnet
where we have these fake magnets which
will also
strengthen the key more
and
i was worried about the filament print
or not being able to make the key
with such tolerances that it would work
but actually it does work flawlessly
so that's about key copying
but another kind of attack is where you
want to gain an entry to a
or again entry open a lock where you do
not have the original key so this is not
about key copying but about
opening the lock decoding picking
whatever
now here again some wonderful
photoshopping and you see that the
key on the right has a magnet with north
facing up and this matches for this
slider
a magnet where north is facing
right
[Music]
and it always has to be the same if you
if you have this key this
type of magnet in the key you know what
needs to be in the
slider
to make it move in the correct direction
[Music]
and for each of these magnets there's
five possibilities north up north down
north to the left north to the right or
no magnet at all
[Music]
so here you see the arrows represent the
direction the sliders need to move so
two of them move right and two of them
move left and that's the same for every
cylinder
and here you see the magnets that i've
read out
and
i then know if i see this key i know
already that the lock must contain these
sliders
because if this key is inserted in this
specific lock
i know that is the only way that the
sliders will be
moved to the correct position
so knowing the magnets in the key
with that i will learn what the magnets
are in the cylinder
but it's also the
other way around if i know what is in
the cylinder
i then know what is in the key
so i wanted to read out the magnets in
the cylinder
so i use my
wonderful magnetometer try to read out
the magnets but yeah it doesn't fit the
sensor is too big
as i said this lock is a weird shape and
there's really not a lot of space
so this was a fail and um
i looked for smaller ones smaller hole
sensors and i found this in a soft 23
package which is rather small
i bought a few of them
and
then i needed to put this on something
to insert into the cylinder
[Music]
i then
tried the kicad to design a little pcb
just a flat piece of pcb that goes
inside of the cylinder
and
i bought some 0.4 millimeter flexible
pcb and i was told by somebody you can
so that's a keycard achievement
and somebody told me if you print your
keycard design with a laser printer on
inkjet paper and then use an iron you
can transfer it to the pcb and etch it
well for me this failed horribly i don't
know what i did wrong maybe some of you
know
come see me after the talk but i
reverted to a really old-school pcb
making which i've already done years and
years ago it's just using a sharpie and
drawing on it
and
making it so
that was
achieved but still failed because it
didn't fit
here you see on the bottom left you see
that the
sensor is on top of the pcb and together
with the pcb it was still too high
so the solution was to put this the
whole center at the end of the
pcb and glue it on
and for that i needed to extend the wire
so i used 0.1 millimeter wires and
soldered them on and this was the most
hard thing of the whole project
it was really frustrating but it did
work in the end so it was on it was
working
i used it with my magnetometer and it
failed because it uses different voltage
levels than the other wall sensor
so i needed to fix my electronics
but
i thought well let's learn some more
stuff let's do something with an arduino
i mean it's totally overkill for reading
out the whole sensor but it's fun anyway
so here you can see the device in action
so i can insert it i have to wiggle it a
little bit
in case the magnet is going left and
right
but you see i can actually read out the
the magnets that are in the cylinder
and what's interesting is that this lock
has quite a few magnets but we'll get to
that later
and since i was doing this anyway i
thought well let's make it more
beautiful so i ordered this
lcd touchscreen
and
i also programmed in that you can
that will translate from the magnets in
the key to the cylinder and vice versa
it has now an analog mode and a digital
mode to show what the magneti
magnetization is
there's an sd card in there so you can
save the current readout to the sd card
and here you see me reading out a
specific cylinder
and you see it will translate
automatically if the cylinder in this
position has this kind of magnet
then the key must have this other magnet
in that place
and now if i read out the original key i
should get what is depicted on the left
works great so i can now read out
the magnets in a cylinder
so the attack factor is if i have
temporary access to a cylinder
but not the key i can read out the
magnets and i can determine what magnets
need to be in the key
but i don't have the bitings so we still
i can make a setup key but i still need
to do the lock picking for the four pins
for one time opening with a lot of
effort
or i could make
all possibilities because it's only four
pins with four possibilities if i make
if i spend a few days and make 256 keys
i could try them out and one of them
will fit
so that's yeah do we have an alternative
instead of picking or creating 256 keys
so one of the ways that you can also
open a lock
one time is using bumping so i won't
explain everything with bumping but the
idea very shortly is that you
apply a lot of force to the pins that
transform that the force is
moved over to the other pins on the on
top they will
separate for short moment of time and in
that time you can open the lock
can we do bumping
now that's quite hard as well because
for bumping you need a bump key a bum
key is a key
where as you can see here in the in the
movie the the key is cut to the deepest
most position everywhere
but for this i need an existing key
and i also need to have the correct
magnets in there
um
so i could print a uh
so yeah i cannot get a blank key from
the factory
because i won't give it to anybody
but i can print the key well the resin
printed key is much too brittle so i if
i if i yeah smash it it will break
but fortunately the pat g key is strong
enough
so this is pad g on the filament printer
so i have the correct magnets that i've
read out
i use a bump
hammer
and of course i show you the video where
this works in one hit normally it would
take maybe five six seven eight hits
to open it it does require a bit of
practice to be able to do this but it
works and it did work repeatedly so the
key was not
it was still operational
for another bump
after i did this bump
so that's nice that gives me the
possibility to do a one-time opening
if i don't have the key
there's another way of finding the
bidding which is impressioning that's
also a very interesting topic that you
could also talk about for 50 minutes
instead maybe you can watch this video
by joel zveyers he did a great job on
attacking master keith systems how to do
that with impressioning with
impressioning you start with a key that
has all the pins in the top
maximum level
you wiggle it in the lock and it the the
the pins will make tiny marks on the key
so you need to have a key that has
rather soft material like brass not
steel
and you get tiny marks you need a
magnifying glass to see them and where
you see a mark you need to file away a
little bit of material until it yeah it
fits because if you if you file it to
the correct depth it will no longer mark
and here you see a lock so so there's a
key a dimple lock key that i impressions
and you see it looks a bit weird because
i filed straight over the key but it
doesn't matter as long as the place
where the pin drops goes to the correct
spot that is fine now can we do this for
the anchor well not with our 3d printed
keys i mean that material is not suited
for doing impressioning you need to
apply quite a lot of force and these
pins need to mark the key
so we need a brass
setup key
and we don't have those
setup key brass impressioning key
well i was talking to my colleague hido
about this project and he said oh but i
have a cnc machine maybe i can do
something for you
so
actually he did an aluminum key for me
as well so he and from that one he took
some pictures so here you see that he's
creating from a piece of
aluminum a or aluminium i should say
probably here
made a key with the
spaces to put the magnets in
and you can make this a bum key
or an impressioning key
and here's the impression key so this
was made out of brass
and on the bottom left you can see
that under the right lighting you can
see the marks that the pins make on the
key
and there you file away a little bit and
you try again so this is not something
that you can do in a few minutes it
takes
yeah several steps
and quite a bit of time
and
yeah did i achieve it yeah i achieved
impressing a a key to make it fit but i
feel i also kind of failed
because this was
very hard i mean i've done impressioning
in the past with regular locks and the
lock you saw before
that is way more easy than with this
particular lock i'm not really sure what
is the reason for that
maybe it's also the material used but i
found it very hard and it's
not really a
yeah a real life scenario i would say
but still we now have an attack factor
when you have access to the cylinder but
you don't have a key we can read out the
magnets
and we could create a set of key uh
with the deepest cuts to do a one-time
bump so you have opened it but you don't
know what the combination is
or if you're very experienced you might
be able to do impressioning which will
take
quite a bit of time but then you end up
with knowing the correct bitting so you
have an actual key
for a cylinder that you have not seen
the key
for before
now let's talk about something else
which is master keying because
the anchor lock is a high security lock
it was invented in the 1980s i think i
already mentioned it was patented in the
early 80s
the patent has been
is no longer valid by a long time
but they are used in in high security
environments like
hospitals
and such
and in those environments
they use master keying a lot and very
short introduction to master keying
master keying is where you have
cylinders that have that each have their
own key so you have a key that works on
your door in your office but you also
have a key that works on all the doors
on your floor or all the doors in your
building or all the doors on the site
but let's keep it simple and only look
at
i'll show you an example with just two
locks with two individual keys and one
third key that opens both of them how
does that work
in a traditional system
this is a traditional pin tumbler lock
master key so on the left is alice's
lock
and on the right is andy's lock
and here you see alice's key alice's key
will open alice's lock why because all
the pins are
all the pins
are
here
straight at the shear line
so that works but it doesn't work on
andy's lock because as you can see some
pins are still blocking so alice's key
only works on alice's lock
nd has a different key and here you can
see that andy's key will work on andy's
lock but it does not work on alice's
lock
so far so good
and now comes the special key
the master key or master key or
submaster key or whatever you call it
and this key will open as you can see
both locks
and you've also seen that the way they
do this is by cutting up the pins once
more so you have two possible depths
that will open
that will set that pin to the correct
position while there's two correct
positions
and what's also interesting to note is
that the master key that you see here on
top
in this case in this example differs in
two spots
and the master key always has more
material on it than the individual user
keys
and
if you're a real hacker you will
probably figure this out but the reason
is that if you have the user key you
must not be able to create a mask key by
just filing away a little bit of stuff
so you can create an individual key by
the mask key by filing but that's not
really an attack factor
now if you translate that to
anker then you will see that also there
we have master keying in the pins
so the the the pin in red is a is
actually it's now lying flat but it is a
really thin
spacer and on the right middle right you
see the three different spaces that
exist with the depth of one two or three
and you also see the pins with depth one
two three four so with these you can
make all kinds of combinations
so for this
these pins in this cylinder is part of a
master key system and there is two
bittings that will
match to open the lock
so my naive thought
when i started this was to think well if
i have an existing key so let's get back
to the scenario where we do have a key
for a cylinder and we know it's master
keyed
and i have this key i know it's a user
key so i don't have much access
then well this must be the correct
position also for the
master key because otherwise the i could
file away stuff to get to the master key
which is against our rule and this pin
while the muskie might have one
of three other
uh positions there
and this one and we can try them out so
we
create we print three keys
and we can uh just
um alter one of the pin stack positions
so we keep three positions the same and
the other one we can vary
and we make three keys and we test them
all and maybe none of them work
that gives us information
and for the third key there's two more
possibilities and we print them and we
try them out and maybe only one works
and for the last one we print three
and also maybe one works
and naively speaking we would say well
it must be the highest positions for
every
for everyone that must be the master key
and we can print that and hopefully that
will open all of the logs
um
it is actually not true
oh yeah we can't copy these
but you can make these keys try them out
and get information about what
works but what's interesting is that we
do not have just the pins we also have
the magnets and that makes this look
much more interesting
and in the magnets we can also do master
keying because the magnets here you see
the the bottom of the
sorry the sliders the bottom of the
slider you see there's place for two
magnets also in the key we have place
for two magnets
and this we can use for master keying so
we can have a key with a magnet on the
left side and another key with a magnet
on the right side and the slider has
magnets on both sides
and that's really cool
in this lock
here's a key
this is a key that's part of a master
key system this is a user key
if i have this key i can read out the
magnets and i already know using my
little device here
it will tell me what magnets are in the
cylinder
so
but
uh when i
let's go again so i know at least these
are in the cylinder
and but what is in the master key
well what i can do is i can also read
out
the magnets in the cylinder in my door
and maybe i will find find some extra
magnets that are in the cylinder but
they do not match anything in my key
now so that gives information
so first of all i know that the master
key
the master key operates on my door
so it must have the magnets
to operate it must have magnets to
operate each slider
now there are two sliders the middle
ones
that only have one magnet so i know that
the corresponding magnet must be
in the master key
so that is something i know for sure
now there are also
magnets that are in the master key
that i did not find corresponding
magnets in my key
but there are in the master in the in
the oh i said master right i the the
magnets i found in the cylinder that are
not matched on the key
but they must be in the cylinder for a
reason
um
i mean you could frustrate hackers and
put in magnets that do not do anything
but i'm pretty sure that's not the case
so these magnets are there
they are operated by some other key
other than mikey so that must be the
master key so the master key must have
magnets that operate on the blue
magnets in the cylinder
what to do with these sliders
that have two magnets so i still have
the
the north up here and i have the south
up there
should we put the corresponding magnets
on the master key or not
well i can give you
an example that shows you that you
should not
so let's suppose that so this is the key
we just saw
and this is my cylinder
but we all in this master key system we
also have a different cylinder cylinder
b
with its own key
key b and if you look closely you will
see that key a does not open cylinder b
and key b does not open cylinder a
because
here is a south
matching the north south and here's the
north
matching the south north so they cannot
be mixed
if the master key would have a
north south there or south north
it would not open
one of the keys
so
if we
go to
cylinder b
read out the magnets in the key
we find out that on the bottom left
there's a north we know that in the mass
key there should be no magnet that's
something we learn
and
we also learn by reading out the second
cylinder
that it has a magnet that we had not
seen before there's a on the on the
second
slider there's a north on the right
and again this slider only has one
magnet
so the master key must operate that one
magnet so in the key there must be the
corresponding
magnet southward
and for the one on the top
top left in the mast key we are not sure
yet we do not have enough information
it could be
that there is no magnet in the master
key or it could be that there is one but
if there is one it must be a north south
one
to operate on these two cylinders
so this is a process of
looking at keys
measuring the magnets measuring the
magnets in the cylinder going to a
different cylinder
measuring the cylinder to a different
cylinder and each time you see something
that you haven't seen before you get
more information to paint a complete
picture of what the master key will look
like
as far as the magnets go
and the last one the last magnet well we
didn't see any magnets neither in the
key or in the cylinder so we just don't
know yet
but you could make a key with these
magnets and and see if it works as a
master key
and
if it doesn't work you need to read out
more cylinders
so getting master key
well
the what i said before about filing away
uh that was a bit naive also in in the
anchor system because you have both pins
and magnets
that means that if you have a key
that is that could be filed to the
master key biting that's not an issue if
the magnets are different because if you
are an end user and you file away well
you have you do not have the the
capabilities to exchange the magnets
at least i don't i don't have the cnc
stuff
um
so if you take your key to another lock
and you you wonder if it's the most key
and it doesn't work well that's a bit of
an issue you can read out the magnets in
the cylinder to figure out what the
correct magnets are but you cannot
figure out what the correct bidding is
so what do you need to do what you can
do
is to
check all other possible
uh biddings
in the original
lock so you have the first lock with
your own key
and for each pin
you try the other three possibilities
and that will give you information about
all the possibilities that are present
in the master key for the bidding
and then you can make a whole lot of
keys but not 256 but at most 80
depending on the mastery system and try
them out and try which fits in the
second log
so it's interesting um the more
cylinders you see and the more cylinders
you measure
the better you are able to get the uh
the master key or as i call it gold mode
the key to all
but it's surprisingly hard
just and the reason is this combination
of the pins and the magnets so i'm
actually quite impressed with this
system that is already 40 years old and
it still has such a resistance against
finding out the master key it certainly
is a lot harder than with regular pin
terminal locks only
so let's summarize
i may even have time for a few questions
i see which is great
summarizing here for the people who are
more visually
you start if you have a key
if you don't have a key
now let's start yeah let's start with
not having a key you don't have a key
then you can decode at least the magnets
in the cylinder so you know which
magnets are in the key
then for the pins well either you can
pick but that's very hard that's why
it's in light blue i don't think that's
really a realistic way of doing it
you could bump i think bumping is quite
realistic but then you have a one-time
opening
if you are able to do impressioning
which is also very very hard you could
get a working key so getting a working
key
without having one
at start is very hard but
opening once
is for a very determined hacker doable
if you already have a key an end user
key a user key then you can decode the
cylinder and the key gives you more
information you can duplicate the key
and if it is master keyed you can try
with creating a lot of other well with
the 12 keys find the other bittings and
then you can go to other
cylinders read them out
and
maybe you need to print quite a lot of
keys but if you are persistent you will
be able to in the end find the mast key
but that is still quite hard
now there's one thing i didn't really
discuss which is that if you have opened
the cylinder once
what you could also do is open the
cylinder
and look at what's inside so you don't
have to make all the setup keys but you
just open it up look at the pins and the
depth
and you can maybe reassemble it or throw
it away
but this is also quite
hard if you have a cylinder like this
well at least i'm not able to to
disassemble this but i'm able to
disassemble it but i'm not able to then
reassemble it
if it would be a half cylinder that is
doable
still quite quite hard
so that's actually where i am with the
uh investigation it took me quite a lot
of time i i did have a bit of a risk
list wish list but i didn't have time
enough to implement this before
mch
so i wanted to build a
arduino shield where you have 16 hole
sensors so you can put on a key and get
a reading immediately for the complete
key
but obviously it doesn't really add to
what i've been saying but
it's just a nice project to to do
another pcb and some electronic stuff
and what also would be really nice is to
make a device that would read out all
the
magnets from a cylinder in one go and i
did later find out that there are uh
devices that magnetomaters that are
suitable for that
um
but yeah this is harder to solder and
i didn't really pursue this yet
so the conclusion
with the advent of 3d printers copying
keys has become much more easy
for regular
standard keys
it's become super easy
and
yeah if you show your key to somebody
and it's a regular key somebody can just
make a picture of it and make a copy and
3d print it
with these it's still a bit more
complicated with these keys because if
you have a picture you could see the
bidding but you can't see the magnets
but of course if you have the bidding
you can go to the cylinder it should the
the key fits in and read out the magnets
and then you have everything as well so
you should still always
keep your keys in your pocket or at
least non-visible to others
but the attacks are also in this law
quite difficult because there is such a
constrained space
find the grand master key i thought it
was it would be quite easy but in the
end it is quite complicated
much more than with conventional locks
and please do not test stuff on
cylinders that you that are not yours or
that you do not use
and in the end i would really spend like
to spend a minute on
hiro who has helped me out quite a lot a
colleague of mine but also ankerslaught
so in the process of responsible
disclosure i talked to ancelott a while
ago saying that i was going to do a
presentation and i wanted to hear their
thoughts about it and they were really
super about it so the lead developer
invited me to the factory in amsterday
he showed me around he talked about this
he knew about these things
and he was really a great sports about
it so i would like to if he's watching i
would like to thank him very much
and in the end i would like to thank you
for spending your time to being here
with me tonight thank you very much
[Applause]
thank you we've probably got time for
maybe one or two questions um if
anyone's got any
oh i've got one quickly
could you
could you've used electromagnets um
instead of putting magnets in
i i i have contemplated electromagnets
but it was too much of a hassle to fight
to make or find electromagnets and do it
and
yeah it would be very interesting
because you could make a sort of setup
key and maybe flip through all the
possibilities and do a brute force
attack or just
click and you have the key
but it would be just too hard for this
project to actually make i'm already
very happy with the result i have so far
i spent a lot of times in on it and i
learned a bunch of stuff about a lot of
things and
that's where it ends for me now okay no
super thanks
does anyone else have any other
questions oh we've got one here
since you've talked to a anchor as an
ethical hacker is there a recommendation
you have for for them to improve their
locks so it's
even harder to pick
well they're already i would say big
proof i mean for uh for
for a company that buys a lock that that
that wants to deter uh burglars
this is secure enough this is fine
and they're still selling these
cylinders and they sell quite well i
believe but of course they're also
working on new ideas so i talked to the
developer they also put magnets in their
standard line they have an infinity line
that also has a magnet and they're also
making some they are actually making
some improvements to this specific
cylinder so yeah there's still a bit of
development going on there
but otherwise yeah i think this
you should also not change too much on
the design to prevent introducing other
flaws
so maybe they they will come up with a
completely new design
okay
great
well thank you very much indeed for
explaining that to us it's fascinating
you