"Getting the Right Rotation: Safe Locks and Sushi Rolls" my talk at PancakesCon 2024
ฝัง
- เผยแพร่เมื่อ 25 ก.ย. 2024
- My video showing how to swap out an electronic safe lock and replace it with a mechanical safe lock is here...
• How To Swap Out an Ele...
- -- ----- ----------
PancakesCon is a marvelous annual one-day hacker conference that is held entirely online, thanks to the work of Lesley Carhart (@hacks4pancakes) and their amazing crew of volunteers. The format of this conference is unique... each session consists of "half industry" and "half interest" presentations, where speakers delve into technical topics but also speak about something they find interesting or fun within their personal lives.
My presentation was about attacks against electronic safe locks and also my passion for making sushi. My talk abstract and bio from the event were as follows...
abstract... "As a safe technician and security trainer, Deviant has not only manipulated open his share of safe locks but he also regularly educates other individuals on the topic of how to perform this clandestine entry tactic. However, increasingly we are seeing the market (at least, the consumer market) moving toward electronic safe locks as opposed to mechanical dials with wheel packs. How does one go about attacking electronic safe locks? What was all the fuss in the news a while back regarding Liberty gun safes and manufacturers like Securam? In the first half of his presentation, Deviant will discuss how electronic safe locks have their own unique vulnerabilities and showcase tools and techniques for attacking them. He will also demonstrate how to swap out an electronic safe lock with an old-school mechanical dial... which some of you might want to do after the presentation is over! If you follow Deviant on social media, you may have seen that he regularly posts photos of sushi either late Thursday night or early Friday morning. This is because during the pandemic he wanted to learn to make one meal as well as he possibly could and both Deviant and his wife decided, "If we are obliged to have the same meal once a week forever, it had better be Japanese food." While by no means an expert, Dev has learned a thing or two about making sushi and he will endeavor to share some of that knowledge with all of you during the second half of his PancakesCon presentation. Let's see how this goes!"
bio... "Deviant pays the bills by being a SAVTA certified safe technician, a GSA certified safe and vault inspector, member of the International Association of Investigative Locksmiths, and by working with many people who are far more talented and capable than he is. His name pops up in leadership roles at companies such as Red Team Alliance, The CORE Group, The Open Organisation of Lockpickers, and many hacker contests and events. Don't ask him too many questions about how to run a business, though, because he hates thinking about work and would much prefer if we all had universal basic income and three-day weekends all year long. At last count, Deviant has spoken over 250 times at hacker cons, universities, and government facilities around the world. Deviant enjoys good food but hates feeling too full, enjoys firearms but hates gun culture, and enjoys breaking the rules because he hates systems of authority."
Excited to hear this Cold War classified documents talk now
SAME
Why is it every time i hear ollam has a new obsession, it's also something I've always wanted to do. Lock picking, elevators, sushi, aviation, guns. It's like he's in my brain.
I suspect another reason the locksmith version of the DPA tool has a delay is to get better tips. My friends who did time as locksmiths got worse tips if they opened locked as quick as possible, because it made the task seem embarrassingly easy.
As an IT tech, I feel this so much. Most of my job some days is explaining to clients that no they're not stupid, I've just seen it a dozen times. You're not paying for the 30 seconds it took me, you're paying for the X years of experience I have that allowed me to fix it in 30 seconds. You also didn't see me looking up the issue and brainstorming solutions before/while heading to your desk.
@@joyfuflower That's why when I did freelance IT work I had a minimum charge for a visit of 1 hour even if it didn't take me an hour.
Who else watched this talk and instead of hearing "don't use an electronic lock" they heard "I dare you to build a better version"? I got lots of ideas.
Yes roll your own crypto as they say, experts all agree one should always roll their own. QED
@@TH-cam_username. Roll your own crypto should be a requirement before you "invest" in crypto. Nothing like seeing how the sausage is made.
@@jmr They meant cryptography. Sure, roll your cryptographic implementation, but never use it for anything important, at all, because that's not how safety works.
@@TH-cam_username. Dude. It's ridiculously trivial to build electronics with an on-board power buffer (any number of layers you care to add) that will completely obscure what your computing element is ACTUALLY consuming right now, this instant. The only reason it's not done more often is the same reason why most mechanical locks are utter rubbish: because nobody sees a NEED to protect against it for the wast majority of users who will never experience a power-based attack. That doesn't mean it's not EASILY done, much the same way most typical attacks against mechanical locks have rather simple counter-solutions - that just nobody bothers actually installing/incorporating most of the time...
@@AttilaAsztalosYou don't protect against differential power analysis by "buffering power", whatever you think that means. The only mitigation that actually works is in software, you use a combination of masking (mixing random bits of data into the data you're computing and then reversing the process later on), and constant time computing so that every step in a function takes precisely the same amount of time and energy to execute irrespective of the result being produced.
I'm a complete outsider to these subjects, but I still enjoy these talks! Fascinating stuff
Thanks for enjoying!
Deviant: "rules aren't real!" The island of japan since the 1800s: dies
It's funny to me how the standard for storing classified documents at one point required delrin wheels for radiological resistance, and now consists of bathroom floor 😂
Came for the safe locks stayed for the sushi.
Me too! 😂
Sushi in restaurants IS expensive. I didn’t care in the past when I was working and had an expense account. Now that I’m retired I don’t often eat in restaurants. I hadn’t considered making sushi at home until just now when I saw this YT video. Think I’ll give it a try. Thanks.
That sushi @ 40:08 proves that I've been on the internet too long.
I didn't see it at first, but thanks for mentioning it, i got a good laugh out of it
The goatsushi
Seems suspicious that those 8 grains of rice were placed in just the right spot after cutting.
you know its a good youtuber when he can go from safe locks to talking about sushi and keep your interest
Really recommend a sharpening stone instead of a drag sharpener - there are lots of videos which will show you how those drag sharpeners destroy your blade.
I rather use the underside of a dinner plate to sharpen my knives instead of a pull-trough sharpener. 😂
Me and my partner picked up our sushi habit inspired by you! We live in different cities, so ours isn't as regular as yours, but one day I hope it will be.
One trick we figured out: we wanted to cut down on plastic waste, so instead of saran wrap we use a silicone baking sheet from ikea cut down to the size of our bamboo mats. Used together with the bamboo mat they give a better feel than full silicone sushi mats. (also they make uramaki a breeze! You can eliminate the flipping entirely because the rice won't stick to silicone.)
Man oh man. If you _actually_ want to cut down on plastic waste, stop eating fish. The plastic produced by the fishing industry is responsible for the vast majority of ocean plastic pollution: 70% of all floating plastic and 86% of all ocean floor plastic. And that's just the plastic waste, which doesn't even begin to match the long term ecological damage that's been done to our oceans due to the fishing industry, which kills three _trillion_ marine animals each year, a full third of which are bycatch like turtles, dolphins, and other species that we don't eat but which die in their trillions to satiate our never ending demand for seafood.
That tiny strip of saran wrap is a fraction of a fraction of a fraction of the waste produced by a single piece of sushi, it's performative virtue signalling of the worst kind.
And while we're on the subject of plastic waste, a single piece of steak produces the same amount of carbon pollution as an entire week's worth of household plastic waste. Not a whole cow, a _single piece_ of steak, and not a single person's plastic waste, an entire _household's_ waste.
Again, this is all just performative virtue signalling, it's what we do in lieu of addressing the behaviours that are _actually_ destroying the environment, a fairytale we tell ourselves so we don't have to confront our true complicity in this crime.
@@sfdntk Glad we are making assumptions and blaming the individual instead of corporations! The sushi me and my partner make is actually mostly vegan, and when we do use fish, we buy from fishmongers who buy from local fishermen to ensure it's fresh and safe to eat raw, so it's just about the most ethical way to eat fish, aside from fishing for it ourselves.
@@Ruostevuori blaming the individual instead of the corporations, lol. Which corporation forced you to buy fish, exactly? You're a virtue signalling hypocrite, that's all, just another pretender who needs to tell themselves they're making a difference, as long as they don't need to actually lift a finger to make that difference.
The sense resistor is to pick up the amps in there, not the ohms in there.
shunt resistance, too
Pendants
32:22 Polish native speaker here: I was kinda hoping you would actually tell us the text we can read :DD
I said "Oh nice!" out loud when he said "it's Polish"
Deev, gotta mention on the cauliflower rice sushi tip- what youre missing is a starch component, part of what makes sushi rice sticky is gelatinized surface starches. I'll bet theres a way to use arrowroot or cornstarch to make a cummier "rice" out of cauliflower
I used to work in a government establishment and discovered that some of the combination locks (Chubb) had a disk of lead fitted behind the dial pack. The lead disk had a series of concentric circles cut into it. I guess they were to cheap the get the plastic dial pack version 🙂
Not too cheap, just a different era and approach to providing some xray resistance, the milner/Chatwood milner/chubb manifoil lock designs probably pre dated the use on engineering plastics
I ran into one of those 8560 locks recently and I hate to admit; but it took me a minute to figure out how to reassemble it.
Coincidentally I recently had a vegetarian sushi weekend at home recently because I have been missing sushi & other Japanese recipes fiercely after acquiring a fin fish allergy in the last year. Thank you for the tip of crushing up rice cakes for crunch! I need to try that. I was missing the tobiko/masago pop and have tried quick pickling small bits of carrot & that works pretty well, but I need to experiment more on size and shape for those. My next goal is to learn how to tempura fry veggies.
I've been considering acquiring a small safe for my house, I need to go back and review your info on safes & take notes!
Man, your acquisitions department really messed up on that one
@@dailythenoob they sure did! I do not recommend!
Was not expecting the Mercury Stardust quote at the end. What a fitting quote to go out on though
Man I oeve everything about this talk. The technical parts, the food part. just awesome. Also: if you ever wanna get out of security and start a restaurant, I wanna go there!
Excellent video, thank you again for being an awesome human. 🙂
Con was a fun one to both attend and to speak at.
we learn so much from you bro
Love the Mercury Stardust shoutout!
Cold war Sushi... what a nice combo.
thank you SO much for making sushi less scary to me. i love eating it but its always pricey even from the grocery store
Any recs for where to get the fish?
41:35 just one thing. "dashi" with no qualifiers is not vegan, it's has bonito in it. "konbu-dashi" is the one made from just kelp. "shiitake-dashi" would also be vegan, but won't have any sea flavors
Thank you for the CD reference.
Well....I was very much not expecting to get sushi making advice from one of your talks...but that's very cool. I have ideas!
Happy to be the lego car, gun, and sword friend for my peoples
edit: I want to be peoples sushi friend now :o
You never cease to amaze me. I hope I get to have a whiskey with you one day.
I would like to learn more about the safe cracking and getting "the feel" or whatever it's called. I played around those dial style Master Locks couldn't feel anything (although shiming them seems to be the proper way to open those.) I would like to learn more about that and can't seem to find any information, although you already shared the most anyone's ever talked about pertaining to those. Thank you.
Was that a planter full of Sorrell?
Are you familiar with the Abus 190 CS/60 Series 2 and why it is the best combination lock?
Good, dry, crispy nori makes _such_ a difference.
What was the text you mentioned about using radiography in the Cold War? I didn't catch you saying it, but it sounded very interesting
Come for the locksmithing, stay for the sushi!
One hell of a talk :)
So YT is hiding your uploads & posts from my Subscriber feed, despite having the bell set to "All" =/ This is getting past silly with how many channels this is affecting, does anyone want to take a guess what these channels might be discussing:> 5 open spots to the types of channel content that YT is REALLY clearly making a push to smother *at least from where I'm sat* =(
Are you sure you're looking at the right page? I don't have notifications on for anything and these have all turned up in my subscriptions page, but aren't showing up in my main recommendations feed
Huh interesting I saw this video but I noticed a few of my other channels the videos were hidden and only showed up a few days later. Might be a bug on TH-cam
Did you actually click "Subscriptions" on the top left? I don't have this issue ever w/any YTer and I never "ding" the bell either.
Only reason I found this was because Shadivers did a blast video on the issue, so I came looking on my subs list. YT is making a LOT of channels into ghosts right now.
Some stuff I learned during my days as a nub sushi chef: give the mat some love with at least few wraps of foil. You can easily go up to 10 times, and still have enough flex in it to do the job properly. The mat feels differently but the overall grip improves and it is easier to squeeze them tight without crushing what's inside. Then I highly recommend using nitril gloves in the process. Splash a dash of whatever oil on ur wrapped mat and spread it on both sides using ur hands in gloves. Continue the wrong way but cleaner.
The harsh language from the person introducing Deviant at 0:06 was really shocking!
I started laughing at that point, how Midwestern could you possibly be? That was an answer without having to answer.
so, given that everything about the form factor is standardized, and how easy that swap was with most of the difficulty going into things specific to the mechanical lock, how long until we start seeing open-source electronic safe locks? i'd love to see something combine the ease of use of electronic safe locks with the auditability of mechanical locks. and please, _please_ put a capacitor bank somewhere in there with some nice isolation circuitry to cut out the differential power analysis attacks
All through the video I'm wondering to myself, "WTF is that thing next to the dial?" every time it appeared. It wasn't until 40:33 after he actually started talking about sushi that I realized that it's a black and white sushi roll! :D "I'm an idiot and so can you!"
my takeaway is "I'm an idiot, and you can too!"
Could you do another going into how to source fish? I live about 150km inland, and fresh fish is generally not an option.
Also, another fun thing to try doing is omelets! Eggs are (mostly) cheap, and you can make spectacular breakfasts with a little skill and literally anything you can find in your fridge. The best bit is, like the sushi, if you screw it up, you have a bowl of scrambled egg and other stuff. There are so many kinds, too, that working your way through mastering each can be a lot of fun and a long, enjoyable quest.
Frozen fish. Sushi fish sold in the US has to have been flash frozen on the boat to kill parasites (except for tuna, since it tends to have far fewer worm eggs). Don't get the defrosted stuff at the grocery store if you're not going to use it the same day, get the stuff that's never been unfrozen & defrost it yourself. Better to defrost exactly once, it maintains the texture, and it guarantees nobody illegally skipped out on the freezing.
Are the photos at 15:06 the ones I sent you? That looks a bit like my counter beneath them.
I think they are!
@@DeviantOllam Nice!
BTW I'll be back on Mastodon soon. I think my server of choice is definitely staying dead so I'll reach out once I make a new account somewhere else.
omfg finally me being Polish has its perks
I would love to hang out with you sometime when you come to Portland.
Would you be so kind as to put that Polish publication you mentioned in the description? I'd love to read it, seeing as I'm Polish. Also: Google Translate is pretty good with Polish nowadays.
awesome as always
2:27 I appreciate the wine label easter egg 😏 also i miss sushi and fried rice, i became allergic to egg and rice at age 29 this year, i had no idea that could happen.
At the end you sound a lot like James @Woodbywright talking about woodworking. :)
“I don’t have a deep frier” but you have a costco membership and a pot. 2gals of veggieoil is $15. Tempura & katsu hellz yea
Ahh 1312 a fine vintage!
man... i remember the days of when the cd player head got misaligned and started sounding mono, so you needed to adjust with the tiny screwdriver through the hole. i share your passion of cooking and producing food and truly think it's the most important aspect of life to eat properly. yet i rather skip sushi due to good ingredients too far for my location to make it a regular. question: my friend in eu has a 400lbs mechanical safe with double-sided "skeleton"(?) keys. is that any safer than the turning dial? might be feeling cute and posting a pic of the key later.
I love the whole ideology of "I am an idiot, and so can you"
Did the schmoo con talk happen
I’ e been hearing about differential power analysis for a while. Is anyone designing chips/boards to obscure that signal? Seems like a few components inside the safe could level out that signal beyond the sensitivity of your scope.
Mistaken cuts, not affecting taste are "learn what went wrong, try to improve, don't worry" learning opportunities. Food is ephemeral art anyway. People won't be pointing out mistaken strokes in years' time, like with a painting.
Is that a Siracha bottle inside the safe?
After all these teasers i *really* hope your talk is accepted. And if they happen to decide actually they wont accept it after youve already written it, perhaps you could share it on TH-cam? I realize that's a lot of work but youve got me very very curious indeed
Edit: that safe that you did the swap on has perhaps the most based collection of stickers ive ever seen, whoever this person is, well done
So SEN Wyden is looking out for me and not the mechanical safe lock manufacture in his state?
That's not a time lock. That's Spongebob, peeping through.
Deviant "rinsed cheese" Ollam, lol
I positively despise those digital X-whatever locks...if they aren't having batteries fail and shutting off mid dial then they're complaining that you spun it too fast, too slow, too smooth, too jerky.
Your friends lock now has a key in the front too. Could you just pick the lock?
I have no idea, but I might think that the lock is a first step to prevent tampering by locking the dial in place. Just plain opening the safe would totally defeat the purpose :)
Deviant just posted the video of him replacing that lock. The key just locks the dial as a way of keeping curious hands from rotating the dial. It doesn’t actually lock or unlock the safe.
Unless it serves you a purpose or benefit, sticking to tradition is just allowing yourself to be peer pressured by the dead.
X-10 lock: $1200. Neat. My employer needs a new lock and I bet I could get them to go for that. Only for sale to the US Government. Bummer.
The taste of "ocean" and seaweed is the very thing putting me off sushi. Also the texture of salmon and or tuna flesh is very much not my thing.
Tako poke though? Oh yeah, that's somehow delicious to me.
👍 für den Algorithmus
Vielen Dank
Anti crunchy peanut butter?!
"make people happy rules aren't real" 54:43
Nice thing about making sushi is there aren't very many ways to screw it up that make it not taste good, let alone become inedible. I've carbonized plenty of other foods, never sushi. Worst case you made a batch of yummy but ugly food. Oh no, I have to eat it and make more...how very sad...such a tragedy. Aww.
Dashi isn't vegan rip! lol
well work entertainment today is safe locks it seems lol
The problem with electronic locks is entirely cheapness. They may charge hundreds for them, but there's only pennies involved in their design and manufacture. Under no circumstances should the UNTRUSTED keypad be so easily replaced. Nor should the power be hanging on the outside. Jez, credit card PIN pads have infinitely more security, and they're dirt cheap.
Unless you set the combination in the field, assume everyone who's ever walked past the factory knows what it is. By YOU, I mean *YOU.* If a locksmith is paid to do it, then _they_ also know the combination; maybe they recorded it on the workorder, or a minion back at the shop recorded the wheels taken from inventory.
(For the record, my ADT alarm system was no different. The factory code is on the first f'ing page of the manual - and the same for every one of the buggers. It's valid for the first few minutes after power on. In my apartment complex, the manual was left in the box, keys hanging in the lock. Every one is hanging in _exactly_ the same place in every apartment - easily defeated through an exterior wall, if you're so inclined. Totally wireless, in a solid metal f'ing box. Even if they did lock and remove the keys, it would take 0.01 seconds to defeat... cut off the tiny antennas, and for good measure, set a penny over each of the holes. But unlocked, it's even faster to cut the battery and wall-wart power.)
what up with the "there isnt a proper way" stuff? literally half of them are physically impossible. its not about right or wrong, its about working.
You can NOT use a substitute for sushi rice and have it be sushi.
The word sushi is a specific reference to the rice.
Without japanese short grained, white rice, treated with seasoned ricewine vinegar it, BY DEFINITION, is NOT sushi.
No shari, no sushi.
lol sentry safe's suck. all u need is a grinder or circular saw...😂