Hi all, I would like to share a presentation I’ve worked on for quite a while. The talks were on electronic safe locks, and a starting point for lockpickers to get into picking electronic locks. For Hackerhotel 2024 I’ve decided to create a summarized version to inspire others to pursuit electronic security research, and apply the knowledge on electronic locks.
The talk, linked below, has two main topics; Opening electronic locks with Ketchup, so-called liquid spiking, and attempts in reading the memory of the 8051 chip in the early Kaba-mas X0 locks. X07 to X09, specifically. When I find time, I’ll work both into a series of blog posts as well, but no promises.
If after this presentation you like an idea of other talks at Hackerhotel, there are some great ones. Walter presented about Lucid dreaming, and Chantal and Nancy discussed what man can do to promote diversity in the workspace. Women in tech, specifically.
Hugo and I taught Safe cracking to a group of eleven at Hackerhotel 2024. It was great sharing the knowledge and inspiring others. Much respect goes to the attendees, which after a busy conference still had energy to take on this mighty challenge.
Every training needs to start with a good basis. We started with an introduction on what safe locks are about and how they operate, specifically group two safe combination locks. From there, we built knowledge from practical examples and exercises. From simply operating the safe lock by dialing 4L-3R-2L-1R with a known combination, to exploring contact points and graphing.
For this two-hour session, we worked with locks of known combination, and usually only get to complete one and a half graphs in this time. Around six graphs were completed in total, and some even finished all three graphs within the session.
While any training is mostly satisfying a curiosity, we expect this training gave the attendees enough knowledge to give it a try on their own later. Maybe even getting obsessed about it in the process 🙂
Hi all, I want to take the opportunity to look back at the year 2023, and discuss our achievements of the last year. The first post on Blackbag of the year was on a modified electric heater. While the post was off brand (as in: not a lock), it helped several pickers to save hundreds of euros on the heating bill. I’ve used mine ever since.
Our first event of the year was in February, a luxurious hacking experience at Hackerhotel. It was a good conference where we talked with our friends from other Dutch Hackerspaces. The talks were everything from community discussions to creativity and security topics. Toool hosted three impressioning workshops a day, and Jan-Willem gave a talk on experimental lockpicking techniques. Which includes, analysis of the Bowley Rotasera, and lessons learned on the Kromer protector.
Wendt hosted a well received lockpicking competition end of March. Walter and Henri competed, and several others joined for the exposition and side events. In case you have missed it, Wendt invites you to join their open house 2nd and 3rd of March 2024.
In May Toool was at the last HITBSecConf2023 in Amsterdam. Toool has hosted the lockpicking village for HITB Amsterdam from the beginning of the conference, and we made great friends along the way. It is truly an end of a decade. The lockpicking village has always been one of the more consistent and popular side events at the conference, and we hosted it again with great pleasure.
During the summer, several Toool members from the Netherlands went to Defcon and visited the lockpicking village hosted by Toool US and to promote Locksport. I, myself, went to the Chaos Communication Camp in Germany. This is the largest German hacker camp hosted by the Choas Computer Club. Jascha from Sportsfreunden der Sperrtechnik, SSDeV set up the lockpicking event, which was a great success. I’ve run a few sessions in English, it was good fun.
LockCon was in October hosted at the Westcord Hotel in Garderen. We hosted close to a hundred guests from all over the world. Where in the three days we ran four competitions, a dozen talks, and many locks picked. It was great to meet our friends again. The recap of the event is worth a read.
ACF organized their annual festival in December. Walter traveled to Paris for the event and competition and won the third price. Walter shares his thoughts in this post.
Next to all these big events, we went twice at Tkkrlab, Hack42, and several other small events. On average we have run a side event a month. Furthermore, we hosted a lockpicking meetup almost every week, as well as published several blogs on locks, tools, and more, here on Blackbag. In case you have missed them, here are the highlights.
Walter looks for interesting locks and published a series of small unusual locks. For example, Walter found a 28mm double euro cylinder from Keso which is unique as it is operated with a standard length key. This short 6-pin euro cylinder from Dom is also quite clever. The Evva Elus is also a curiosity. Given the lock has electromechanical master keying.
Henri wrote about a clever implementation of multi tenant lever locks. These and other lever locks are quite rare here, sadly. It’s a wonderful, but forgotten technology, which still has a place in high security systems in the UK and Italy. Hopefully, Henri will write more about those in a future Blackbag post.
If you see something you like, please leave a reaction below the post. It’ll help grow the brand as well as motivate the writers to continue putting in the effort. If you want to share your project on Blackbag, do reach out as well.
Best holiday wishes from me and the rest of Toool, May many locks open for you in 2024 🙂
Jan-Willem Markus Secretary of The Open Organisation of Lockpickers
Yesterday, the yearly “Festival ACF” was held in Paris, France. This is a combination of lectures, workshops and competitions held by the ACF (Association des Crocheteurs de France), the French Locksport group.
I believe this must be the 4th or 5th time I visited. It was good to meet old friends and make new friends. The first lecture I saw was from a pentester, talking about a red teaming assignment (that did not involve physical security). Next was a historical overview of pump locks from Fichet-Bauche.
After that, the lockpicking championships were held. About 25 people participated. In the first round, people were seated at tables with at most four people, each having to pick three cylinders in less than 5 minutes. I got an Opsial, a Thirard (which felt very cheap) and an unbranded cylinder. The Opsial was my first and I made the mistake not to try and rake it. I spent too much time picking and though I made not even make it past the first round! But in the end, it was me and Wesley both going through, thanks to our quick raking of 2 (me) or 3 (Wesley) cylinders.
The second round I had 2 opponents, and the cylinders were more difficult, a TESA TE5, a Heracles and a Vachette V5. They needed to be picked in under 10 minutes. I opened them all and my opponents opened none, which meant I was in the final!
There were 4 people in the final, having to open 4 locks (BKS 6-pin, DormaKaba, Heracles with a horrible keyway and a GeGe). I needed to relax and try to open something, as I hoped to get a plaque to take home with me. The BKS I could not open, but the DormaKaba I did open in 13’11, so just within the 15 minute time limit. And that was the only one I opened.. Nitiflor opened the DormaKaba as well as the GeGe, Wesley opened just the GeGe (in 9’20) and Hadrian did not open any. Too bad I could not open the GeGe as well, as that would have yielded second place. The final result was: Nitiflor #1, Wesley #2, I came third and Hadrian fourth. But that meant I got a plaque!
The ACF had gotten some really nice sponsoring resulting in nice prizes. Nitiflor got the wonderful Multipick ARES disc detainer pick, Wesly the Kronos electropick, I got a Flipper Zero. And some more goodies including some cylinders (DOM iX TECO, M&C Minos) and a manual pickgun.
I hope to return to Paris next year, and maybe win another plaque. Although my scores are declining, in 2021 I became first (and second in impressioning), in 2022 I became second, this year third. I see a downward trend 😉
The Dutch Open 2023 Disc Detainer competition was held in a self-timed format. Throughout LockCon, the participants worked on getting the best times on the five Disc detainer locks: 001 Fort Knox, 002 Parkside, 003 No-name, 004 Abus Plus, 005 Abus Plus with butterfly disks.
We used the Sparrows Disc detainer pick with a 3D printed spacer. One of the Sparrows tools was modified to allow tensioning lock 004, the Abus 37/55.
Nitiflor won the competition by opening all the locks and won a Sparrows Vorax set. ImSchatten360 opened all locks as well, but spend more time in total and won the second price, a Sparrows Tuxedo royale. Matt Smith opened four out of five and won for the third price, a Sparrows Tuxedo set.
The Pentathlon competition is a series of five lock challenges sponsored and hosted by Parmakey. The competitors had to pick a pin tumbler, pick a dimple, impression a key, pick a safe lock, and pick a car lock. Twenty competitors joined the challenge.
Torsten won the competition with 52 points and won a Sparrows Vorax lockpickset, a book on historic keys. Decoder, with 50 points, won the second price and received a Sparrows Tuxedo Royale and a book on safe lock history. Robert won the third price with 42 points and received a Sparrows Tuxedo set, as well as a book on locksmithing history. All three also received a bottle of Nabucco wine.
Edit: 20240312 We were made aware of a mistake in the official competition results, and would like to correct this. After a remark from one of the participants on his missing opens in the official scores, ParmaKEY checked the papers and found there were two filled in papers which were missing in the official scoring. The table below is the updated scoring form, which now includes the scores from Jascha and Nitiflor.
With this new raking, Nitiflor has the well deserved second place. We decided not to change the original certificate and prizes, but to create an additional certificate with prizes for Nitiflor.
We apologize for the inconvenience, and we will celebrate it with him the next time we meet.
The Toool NL competition is a lockpicking competition which is available at meetups for the members. About twenty locks are selected, and the members improve the picking times throughout the year. Opening a lock in the best time gives ten points, 2nd best time nine points etc. The member with the most points at the end of the year wins the competition. https://toool.nl/competitie2023/
Jos, Henri, Jan-Willem and Rob made a quick start in the competition at the first meetup. At the Eindhoven meetup, Walter took the lead, and kept the top score throughout the year. There was more competition for the second and third place, and was held and lost by many. (Week by week: https://toool.nl/competitie2023/tussenstanden.html)
Walter won the competition with 215.5 points (out of 240) and received a Multipick Kronos Electropick. Tom won the second with 178.5 points and received the Multipick Elite Meister 19-parts lockpick set. Jos won the third price with 170 points and received a Sparrows Vorax pickset and a Sparrows pinning mat.
Kudos to the dozen people who have opened at least one lock in the competition!
The Dutch open 2023 lockpicking championship had 51 competitors. Tables of up to nine were created for the first round, in which relative simple locks are picked in at most five minutes per lock. The two picker with the most opens at the table competed in a bracketed round, where each competitor picks two lock for fifteen minutes each. The last three play the finals.
ImSchatten360 won the competition and received a Multipick Essentials 39-piece lockpick set. Manfred won the second price and received a Multipick cutaway lock and a Sparrows pinning mat. Torsten received a Multipick Bogota set for the third place.
The Dutch Open impressioning championship is a competition in making a key for a C83 cylinder in the least amount of time. For the qualifying round, 34 competitors joined, of which, 27 (~80%) opened the qualifier lock within 60 minutes. The quickest twelve continued to the A and B finals, where they attempted six more locks in 15-minutes per round.
Jos won the competition and received the new Multipick ERAS dimple and disc detainer set. Manfred won the second price and received a Sparrows Tuxedo royale lockpickset and a Multipick cutaway lock. Oli received the Sparrows Vorax lockpickset as well as a Sparrows pinning mat as a third price. Alex, Walter, and Jord received the Multipick Elite LockNoob 10-piece duo peak set, Sparrows Tuxedo Royale, and Sparrows Tuxedo, respectively.
RubberBanned won the B-finals and received a Sparrows Vorax lockpick set. Jan-Willem with the second place won a Sparrows Tuxedo royale. Cocolitos with the third place won a Sparrows Darkshift lockpick set. Morris, Clefmentine, and Relocker received the Sparrows Darkshift, and Sparrows Tuxedo set.
From 12 to 15 October 2023, Toool organized LockCon, a Locksport conference with attendees from Europe and the USA. Here is a recap of this year’s event at the beautiful Westcord Hotel Veluwe in Garderen.
On a warm late summer day, we started LockCon. After check-in and setup at the venue, the first of guests already arrived. It was great to meet so many friends again. On Thursday evening, we dined at a restaurant at walking distance from the venue, after which we set up the conference hall for the talks and competitions. We protected the tables with stucco runner, as locks and vices can otherwise easily damage furniture. The rest of the evening was used to meet new people, catch up with friends and discuss lock topics at the hotel bar.
After a first night of not enough sleep, we had breakfast at the venue’s restaurant. The food selection was nice, from the usual bread to fruit salad, yogurt, scrambled egg, and poffertjes! Jos opened the conference by highlighting achievements of the community, including the LPU belt explorer picture archive and Locksport. Jos thanked the sponsors, Abus, Multipick, Sparrows, and Dulimex, as well as the LockCon team, who make LockCon possible.
The first talk was by Walter, who introduced the Evva Elus electromechanical temporary access function lock, and updated the attendees on the Anker 3800 research. It’s incredible what we can do with a bit of dedication and a 3d printer. There was an active debate if Anker 3800 magnets can be overlifted.
In another talk, Zeefeene shared his insights in manufacturing locks in China. From the lesson in using chopsticks to a deep dive in lock diplomacy. The highlight of the talk were the videos of lock manufacturing equipment, which showed keyway broaches to full automatic lock assembly machines. It was eye-opening as these insights are rarely shared.
After lunch and socializing, it was time to set up for the impressioning championship. Thirty-four competitors tried their skill against the Abus C83. It was nice to compete again, and it’s amazing to see how much different it was compared to the competition last year. In both finals, the majority locks opened, with several competitors opening all the locks.
After dinner, with again a good selection of food, we had an evening of disc detainers. Idanhurja gave a talk on his Abloy disc detainer picking adventures. From figuring out Abloy classic from first principles to advanced techniques to defeat other Disc locks from the same brand. The rest of the evening was filled with workshops on the Abloy classic by Idanhurja and the DaMage Fichet F3D (Not a DD) workshop by Nitiflor. We also made a start with the disc detainer competition. I’ve selected five locks, from ‘relatively easy’ to ‘unlikely to be opened’ and Sparrows sponsored the disc detainer picks.
Saturday we started with my talk about electronic safe locks. I’ve shared my insights in how you can attack embedded systems and specifically electronic safes. The target is the Kaba-Mas X0 series locks. Starting from the X07 from ’92 and building to analyzing the electronics of the X09. I’ve shared about hardware reverse engineering, but also high-end techniques like laser fault injection used to extract the memory content of the lock. While still a lot of work has to be done, progress is made.
Lubos Cech shared stories about the early European lock industry. For example, the euro profile cylinder hasn’t been the standard forever. One manufacturer designed and patented the hole through the two lock bodies to fit a mounting screw. While this is regarded as a mistake from a security perspective, the competitors worked around the patent and came up with many innovative solutions. Including clamping the lock from the side in various ways. The stories fit quite well with the lessons learned in manufacturing shared by Zeefeene.
For the lockpicking championship, fifty-one competitors joined. We started in groups of nine and worked towards a bracketed system after the first round. Many people opened locks, and some were unlucky on the table placement. A lot of pin tumblers have been picked from the following selection: Kibb, Nemef, Mastermate, Dom Plura, Destil, Era, Basi, M&C, S^2, Zi-Ikon, and Winkhaus.
In the evening, Matt Smith (Huxleypick) ran his presentation on Physical Vulnerability Research. In which he shared the things he researched over the years and how others can get involved as well. After that, we ran had the price ceremony for the Lockpicking, Impressioning, and Toool NL competition.
We ended the night with a panel on the new book Locksport. Walter, Jos, Matt, and Nigel shared their stories on what it’s like to write a book on the subject. Where the key point is: it’s a lot of work. A nice summer project, which ends up being several years of small improvements until there is something really called a book. This book is a great introduction to the hobby and will make Locksport more popular than ever.
On Sunday morning, a presentation and panel discussion on RFID hacking was organized by Torsten, Christian Holler and mh. It was well worth the time and certainly interesting to see how hotel cards function. Mh shared a list of the current RFID devices, for those willing to get started.
BugBlue shared how the badge works and how you can start working with shop price tag e-paper displays. It’s a great idea, and hopefully we will see more like it for other events. https://openepaperlink.de/
The final event at LockCon was the Pentathlon competition, hosted by the Italians from ParmaKey. Within about an hour, the competitors had to complete five lockpicking challenges. Pin tumbler picking, dimple picking, creating a key with impressioning, lever lock picking, and car lockpicking. For each challenge, a time limit is given and if you didn’t finish the challenge in the limit, you have to wait a couple of minutes before starting the next one. Participants shared that waiting four minutes after failing the impressioning challenge indeed felt punishing. Mostly, because everyone who passed the gate in time got to continue with the next challenges. In the closing ceremony, the prices for the disc detainer competition and Pentathlon competition were handed out. After which we cleaned up and said our goodbyes.
I would like to thank the people who made LockCon possible. Thanks to Sparrows, who sponsored their disc detainer lockpicks for the dd competition and a large box of goodies including various lockpicking sets. Thank you, Multipick, for sponsoring the prices for the competition, including various community lockpicking sets from Christina, Decoder, and LockNoob. As well as a ERAS disc detainer lockpick for Toool to practice with.
For as long as we work with Abus C83 in the Impressioning championships, Abus sponsors the locks and blanks for the competition. The majority of locks and blanks are used up, and the remaining will be used to teach the skill and help people new to the hobby getting started.
Thanks to Dulimex for sponsoring five Pro-Line padlocks with a Tokoz core to challenge the lockpickers with a unique challenge. The group from Italy, with ParmaKey ran the Pentathlon competition for us, and we thank them for all their effort.
Thanks to the LockCon team who made LockCon possible. Without them, it wouldn’t be possible: Jos, Holly, Chantal, Jan-Willem, and Hugo. While organizing this event was a lot of work, it was well worth it. Finally, thanks to all presenters, other organizers, and participants for joining LockCon as you made it a great event again. We hope to see you all again next year!
All the pictures are by Toool NL. Feel free to use the photos of locks under CCBY4.0, and for pictures with people, please ask for permission first.
