3 ms·
When I was frequently using things like this on coworkers in red teaming (back when being in an office was a thing) putting my own desktop in a steel cage with
by lrvick 5y ago
When I was frequently using things like this on coworkers in red teaming (back when being in an office was a thing) putting my own desktop in a steel cage with a good lock proved effective against retaliation.
Then we moved on to attacking the firmware in each others keyboards.
- hughrr 5y agoWe just broke the locks on the cages with a screwdriver. Locks only keep honest people honest.
- xenadu02 5y agoMost common locks can be easily picked with a tiny bit of practice. I'm completely incompetent but I can pick any Master lock in 5 minutes or less.
- lrvick 5y agoWhich is why you should never use Master Locks. I am pretty decent at lockpicking but I can't pick a Medeco or better in any practical amount of time and very few in the world can. Little bit more money vastly reduces your attack surface.
- Godel_unicode 5y ago> Little bit more money Aren't medeco padlocks like $100, whereas master lock padlocks are less than $20?
- deleted 5y ago[deleted]
- vdqtp3 5y agoWhat's the value of the asset it's protecting?
- dekhn 5y agoI remember learning how to break master locks back in the 1980s. But I also heard they changed the mechanism after that.
- danachow 5y agoI’m pretty sure they did on a number of models, but it wasn’t for the better
- lrvick 5y agoI went to home depot a couple years ago and bought every model of master lock they sold. Picked all of them in an afternoon. I then taught kids to pick them.
- dekhn 5y agodo you mean combo locks, or key locks?
- ris 5y agoThat would generally be considered "detectable intrusion" though.
- liketochill 5y agoNot if you replace it with another lock that looks similar
- richardw 5y agoI think when you get home and your key doesn’t work on the lock, it might tip you off.
- liketochill 5y agoWhen I had towers or pizza boxes I pretty much never touched them once it became normal to leave them on all the time, which was as soon as they were always downloading from the internet at 3.3 kbps. If the case was locked in a cage I wouldn’t notice until I needed to put access the tower to plug in a usb, which might not be for weeks these days.
- lrvick 5y agoI don't expect good locks to keep people out. I expect good locks to be tamper evident so I know I can't trust my system.
- Ajedi32 5y agoUnfortunately, there aren't really all that many "good locks" on the market. The Lock Picking Lawyer on YouTube[1] has pretty much destroyed my faith in the modern lockmaking industry. [1]: https://www.youtube.com/c/lockpickinglawyer/videos https://www.youtube.com/c/lockpickinglawyer/videos
- hirundo 5y agohttps://www.youtube.com/watch?v=qV8QKZNFxLw https://www.youtube.com/watch?v=qV8QKZNFxLw
- akavel 5y agoApparently, picked here: https://youtu.be/ai5Hf-wPXFE https://youtu.be/ai5Hf-wPXFE but check out this one instead: https://youtu.be/sES_Hbj92BQ https://youtu.be/sES_Hbj92BQ - ~2h to open fully (though the author of the video claims impressioning could speed up the thing; anyway, reportedly attacking the door is just easier in this case)
- lrvick 5y agoI have Bowley locks in my collection. Amazing quality. Not only does it take a couple hours to pick for an expert but you have to make a custom set of tools that only work on that one particular lock. If a lock keeps someone out for several hours it is a great lock.
- Norlin 5y agoGuy who made the video here. The lock mechanism itself isn't one of the easiest, but also not one of the hardest to pick skill-wise. However, it does take a very long time to pick through which means that the lock is doing its job very well. Also, I have read that this lock is very resistant to destructive attack as well. So combining pick resistance with physical resistance, you have a very good lock as long as it's installed on a good door and the building has all other security measures in place (no ground level unprotected windows, etc) Also worth noting, Bosnian Bill (a more recognized name) also attempted this lock here https://www.youtube.com/watch?v=tLeiPmfm-2s https://www.youtube.com/watch?v=tLeiPmfm-2s
- ManBlanket 5y agoBeing in an office is definitely still a thing. Let's be real, vaccinated adults working from home is a privilege. Mostly a white upper middle class one. Always was.
- gruez 5y ago>putting my own desktop in a steel cage with a good lock proved effective against retaliation. >Then we moved on to attacking the firmware in each others keyboards. In what world is hacking keyboard firmware easier than lockpicking?
- Forge36 5y agoHarder to spot visibly?
- jimmySixDOF 5y agoand what's this site we are on's name again ?
- michaelt 5y agoI once saw a PC security case where instead of the lock cylinder retracting a bolt, it turned a screw thread and opened the case by about half a millimeter. It took the guy unlocking it a good fifty turns to get the PC out of it. And there were two - one on each side. What's more, it was a tubular lock, so if you were single-pin picking you'd have to pick it 5 times per rotation. Nothing that would stand up to a battery powered angle grinder, of course.
- lrvick 5y agoI don't know anyone that would SPP a tubular lock in the field. $40 for tools designed to pick all pins at once and make a "key" with some quick impressioning motions. Some do have spool pins. In those cases you will need manual fiddling to pick it once then you have a key to keep spinning. Still, sounds like an interesting design. Link?
- michaelt 5y agoI was under the impression impressioning relied on all the lock's springs and driver pins being identical, and that better tubular locks avoided that? I looked for a picture of the case but couldn't find one. I was in that college CAD lab... quite a long time ago.
- infogulch 5y agoSince this has generated some discussion on locks and picking, there's been some interesting developments on "unpickable locks" that sidestep the tolerance problem by decoupling setting the pins from testing them. I.e. pins are tested all at once after they are physically decoupled from the key & keyway, eliminating state space reduction attacks (aka picking one pin at a time) leaving only brute force. One such effort features locks made by Stuff Made Here sent to Lock Picking Lawyer. According to LPL the locks are theoretically sound and he did not attempt to pick them, but these particular implementations had a couple (easily fixable) bypasses. Made for interesting videos on both sides: Stuff Made Here describes the design in detail: TWO Unpickable (?) Locks for Lock Picking Lawyer! - https://www.youtube.com/watch?v=2A2NY29iQdI https://www.youtube.com/watch?v=2A2NY29iQdI Lock Picking Lawyer reviews them and performs some bypasses: [1299] Unpickable Locks From Stuff Made Here - https://www.youtube.com/watch?v=Ecy1FBdCRbQ https://www.youtube.com/watch?v=Ecy1FBdCRbQ
- minism 5y agoThanks for sharing, fascinating stuff.
- infogulch 5y agoWhelp it seems I recalled incorrectly this time, because LPL did pick the second one open, via a weakness in the design that he believes can be patched. I don't think my sentiment was totally off base, but clearly my statement about not being picked was factually incorrect.