TRANSKRIPT 🔗
WEBVTT
00:00:00.239 --> 00:00:10.960
By listening to the sound of a rotating hard drive, the way the heads moved across the platter, they could recreate what some of the data was.
00:00:10.960 --> 00:00:13.279
So my gosh, that's interesting.
00:00:16.960 --> 00:00:20.480
You are listening to the audit presented by IT Audit Labs.
00:00:20.480 --> 00:00:23.440
I am your co-host and producer, Joshua Schmidt.
00:00:23.440 --> 00:00:32.640
Today we have the usual suspects, Eric Brown, Nick Mellum coming from Texas, as well as Eric Osterberg we have in the studio today.
00:00:32.640 --> 00:00:35.679
Eric Osterberg works with uh Gray Duck Locks.
00:00:35.679 --> 00:00:39.520
And then we have done some work with you recently around AI projects.
00:00:39.520 --> 00:00:48.880
Um one of the things that I wanted to bring up today and get into uh after we do a little bit of a lock picking demo here is to talk about uh hugging face and local LMs.
00:00:48.880 --> 00:00:50.479
Um we've been going hard here.
00:00:50.479 --> 00:00:52.560
Eric's been doing a lot of work on cloud code.
00:00:52.560 --> 00:00:54.880
I know Nick's been dabbling, and so have I.
00:00:54.880 --> 00:00:59.280
So would love to talk about the future of hardware and local LMs.
00:00:59.280 --> 00:01:06.640
So without further ado, Eric, give us just a little background about yourself, um, what you're working on right now, and and bring us up to speed.
00:01:06.879 --> 00:01:20.480
Yeah, for the past 24 months or so, I've I'm an early adopter, um, just in general, whether it be uh drones or 3D printing or what you know, whatever the latest trend is.
00:01:20.480 --> 00:01:32.719
I I like to I'm a full-time learner and um I've been using AI extensively, and um we've Eric and I have known each other for for decades now.
00:01:32.719 --> 00:01:33.200
I think so.
00:01:33.200 --> 00:01:36.640
It's been a while, uh, in in the InfoSec community.
00:01:36.640 --> 00:01:45.599
Um we we got connected and discussed, you know, some of the AI projects, and so I came to IT Audit Labs here to help out on a few of those projects.
00:01:45.599 --> 00:01:52.640
But yeah, right now I'm uh doing a lot of I guess vibe coding, you'd call it, or vibrating is watching next episode.
00:01:52.640 --> 00:01:53.920
Vibrators.
00:01:53.920 --> 00:02:13.919
Um I've been focused on the locksmithing business uh a fair amount, um, trying to ensure that my identity verification processes when I when I do locksmithing are a little bit smoother, that I don't put any of my customers' data at risk, but that I have it there, you know, to survive any audit requirements.
00:02:13.919 --> 00:02:16.800
Um, and then trying to automate the the workflow.
00:02:16.800 --> 00:02:21.439
Yeah, a lot of effort goes into quoting, making a key to a car.
00:02:21.439 --> 00:02:26.240
Um, people don't realize the complexity that's in a in a modern automobile.
00:02:26.240 --> 00:02:29.520
Um, you know, they're they're rolling computers these days.
00:02:29.520 --> 00:02:34.879
If you're driving a current model car, you might have 35, 40 different computers in that thing.
00:02:35.280 --> 00:02:36.800
And Eric, you're a pilot too, aren't you?
00:02:37.039 --> 00:02:37.759
I am a pilot.
00:02:37.759 --> 00:02:40.800
I've not flown a lot lately, but you and I need to get out there.
00:02:40.800 --> 00:02:41.599
Absolutely.
00:02:41.599 --> 00:02:41.919
Yeah.
00:02:41.919 --> 00:02:45.919
The hundred dollar hamburger is now what, a thousand dollar hamburger or more?
00:02:46.400 --> 00:02:47.520
Gas prices, it's ridiculous.
00:02:47.840 --> 00:02:48.879
Insurance prices.
00:02:49.039 --> 00:02:49.360
Yeah.
00:02:49.360 --> 00:02:51.680
Have you ever made a key for an airplane?
00:02:52.000 --> 00:02:53.520
Uh my own airplane.
00:02:53.840 --> 00:02:54.080
Nice.
00:02:54.080 --> 00:02:54.560
Okay.
00:02:54.719 --> 00:02:56.240
Yeah, you had a Cessna, right?
00:02:56.240 --> 00:02:58.479
Yeah, Cessna, a 1980-172.
00:02:58.719 --> 00:02:59.199
Oh, nice.
00:02:59.360 --> 00:03:06.560
So just get an early adopter of a glass panel, put uh Garmin stack in there before WAS was a thing.
00:03:06.719 --> 00:03:08.800
And let's do a little bit of a demo here.
00:03:08.800 --> 00:03:18.479
I mean, a lot of the time you spent at the office today, I know this is something that Eric Brown is also very passionate about and has been exciting and asking me to get on the podcast now for for quite some time.
00:03:18.479 --> 00:03:27.199
So today we're finally doing uh a little bit of a lockpicking demo, or maybe get some new folks interested in this this hobby, which seems synonymous with cybersecurity experts.
00:03:27.520 --> 00:03:28.960
Yeah, there's a lot of crossover.
00:03:28.960 --> 00:03:29.199
Yeah.
00:03:29.520 --> 00:03:30.319
Why is that?
00:03:31.280 --> 00:03:32.719
We like to break into stuff, I guess.
00:03:32.719 --> 00:03:35.439
It's a nefarious activity in all of us.
00:03:35.439 --> 00:03:37.520
I see a puzzle, and can I get in there?
00:03:37.520 --> 00:03:38.159
Can you get in?
00:03:38.159 --> 00:03:41.120
Eric came into our office, found a lot of puzzles.
00:03:41.120 --> 00:03:47.120
I think we did we we have um not not key access to the to the main space.
00:03:47.120 --> 00:03:49.840
We have um digital access with a card.
00:03:49.840 --> 00:03:53.840
So Eric's like, yeah, you know, I'll be there at like you know eight o'clock or whatever.
00:03:53.840 --> 00:03:57.360
And I think I'd kind of forgotten exactly what time he was coming.
00:03:57.360 --> 00:04:01.199
Next thing I know, he's standing in front of office because he got through the puzzle.
00:04:01.599 --> 00:04:03.280
After calling you, of course, and getting permission.
00:04:03.280 --> 00:04:04.000
Of course.
00:04:04.000 --> 00:04:07.599
And and you I think basically said, if you can do it, go for it.
00:04:07.599 --> 00:04:08.240
Go for it.
00:04:08.479 --> 00:04:09.520
That sounds about right.
00:04:09.520 -->
Load full transcript
00:04:15.520
So you've you've 3D printed some of these uh you can do with your hands instead of having to use a tool.
00:04:15.520 --> 00:04:20.399
Um, I actually got a little bit of time with you before we started today and and was successful a couple of times.
00:04:20.399 --> 00:04:21.439
Have you tried this yet, Eric?
00:04:21.600 --> 00:04:21.839
I have not.
00:04:22.000 --> 00:04:22.319
Do you want one?
00:04:22.319 --> 00:04:24.319
He's got one.
00:04:24.319 --> 00:04:25.600
Okay, yeah.
00:04:25.600 --> 00:04:26.079
Yeah.
00:04:26.079 --> 00:04:33.199
So yeah, for game night, I brought this particular demo of a lock and tried to describe lock picking.
00:04:33.199 --> 00:04:36.879
And um, you know, great, great model work.
00:04:36.879 --> 00:04:42.639
Appreciate the person who designed this, but I found I was actually I printed another one, so I'd have more than one for our show.
00:04:42.639 --> 00:04:44.240
And I've I found this model.
00:04:44.240 --> 00:04:46.240
Again, I should have let me interrupt.
00:04:46.319 --> 00:04:53.040
Just for our audio listeners, we're looking at 3D printed locksmithing um, I guess, puzzles, right?
00:04:53.040 --> 00:04:54.079
Yeah, yeah, yeah.
00:04:54.079 --> 00:04:55.120
And they're kind of gray.
00:04:55.120 --> 00:04:56.319
They got some red keys.
00:04:56.319 --> 00:05:01.439
We have some different pins here that you can insert and kind of create different combinations just for our audio.
00:05:01.439 --> 00:05:02.639
Yep, audio only listeners.
00:05:02.879 --> 00:05:07.120
It's a replica lock cylinder that is uh bigger than your fist.
00:05:07.120 --> 00:05:10.879
Uh, so you can actually pick the lock by sticking your fingers inside the keyway.
00:05:11.120 --> 00:05:11.360
Yeah.
00:05:11.360 --> 00:05:14.959
And and maybe just a quick level set on lock picking.
00:05:14.959 --> 00:05:27.360
The premise is you you have a key that you put into a lock, and and that key has ridges on it, and those ridges are raising pins to different heights in the lock.
00:05:27.360 --> 00:05:33.839
And when the heights are at the right level, they move the pins out of the way, and then you can freely turn the lock.
00:05:33.839 --> 00:05:43.199
And Eric, I know you can talk a lot about this, and there's different kinds of uh of locks that make it a lot more difficult to pick.
00:05:43.199 --> 00:05:53.439
But like if somebody were to go down to Home Depot and get the typical master lock with the blue ribbon around the bottom, are those relatively easy to get into?
00:05:53.920 --> 00:05:55.279
Uh, the padlocks, yes.
00:05:55.279 --> 00:05:55.519
Yeah.
00:05:55.519 --> 00:05:58.560
There's fewer pins, tolerances are so so.
00:05:58.560 --> 00:06:02.879
Um yeah, I think you did a pretty good description there, right?
00:06:02.879 --> 00:06:03.439
Cool.
00:06:03.439 --> 00:06:10.480
So traditional cylinder, uh, as you described, there's a key cut with particular depths.
00:06:10.480 --> 00:06:18.800
There's a matching set of pins in an inline row in in the lock that raises you and insert the key all the way.
00:06:18.800 --> 00:06:31.920
And uh, if you've got the right combination, then that uh stack of pins all line up with what we call the shear line, and that allows the plug to rotate inside of the of the lock body.
00:06:31.920 --> 00:06:45.120
Um so to pick a lock, what we're doing is we're taking advantage of the imperfections in the milling out of the of those stack of pins that that are lined up there.
00:06:45.120 --> 00:06:51.920
It's nearly impossible to get everything in atom for atom perfect row.
00:06:51.920 --> 00:06:57.920
You know, you're you're always gonna have the the drill profiles are gonna be just a little bit off center.
00:06:57.920 --> 00:07:10.720
And if you if you apply torsion uh to the face of the lock where the lock plug is, uh you can manipulate the pins and feel for which pin is gonna bind before another.
00:07:10.720 --> 00:07:18.639
Um and and that'll it will bind before another because you you can't really make a perfect row of drilling.
00:07:18.639 --> 00:07:26.079
So with a little bit of torsion on the lock cylinder, if you manipulate each pin, you'll find that one drags more than another.
00:07:26.079 --> 00:07:32.720
And if you manipulate it up just enough, you'll feel that friction change.
00:07:32.720 --> 00:07:36.240
And you essentially want to find the pin that's binding first, right?
00:07:36.240 --> 00:07:38.720
You you push up the binding pin.
00:07:38.720 --> 00:07:41.360
Um, you can kind of play with it with your finger.
00:07:41.360 --> 00:07:42.639
You want it to drop back down.
00:07:42.639 --> 00:07:47.120
If if it sticks also, then you know that you've got it stuck above the shear line.
00:07:47.120 --> 00:08:00.480
So if you're if you're pushing the pin that's binding to the point where when you let go, it still falls, you'll eventually drive the upper pin in the stack above the shear line and you can move on to the next pin that's binding.
00:08:00.480 --> 00:08:00.959
That's cool.
00:08:01.199 --> 00:08:03.600
I don't know if that no, that was for one of the listeners.
00:08:03.600 --> 00:08:04.399
That was amazing.
00:08:04.399 --> 00:08:04.639
Yeah.
00:08:04.639 --> 00:08:15.040
But this this particular model that you have allows you to get kind of simplified on that that concept and has four pins that are sitting in in kind of a into the uh what's it called?
00:08:15.040 --> 00:08:15.920
The tor the torsion.
00:08:15.920 --> 00:08:16.639
The key way.
00:08:16.639 --> 00:08:17.600
The key way, yeah.
00:08:18.160 --> 00:08:23.759
And maybe show that that thing there, because it's got a side cutout, the the red, the one with the red key in it.
00:08:23.920 --> 00:08:24.079
Yeah.
00:08:24.560 --> 00:08:27.360
You got another model here that's more of a traditional lock and key.
00:08:27.360 --> 00:08:28.959
It looks backwards there.
00:08:30.319 --> 00:08:33.120
It looks like the delay, that's
why it was backwards a minute ago.
00:08:33.120 --> 00:08:33.679
Yeah.
00:08:33.679 --> 00:08:36.080
There it is with the side profile.
00:08:36.080 --> 00:08:48.240
In a traditional lock picking here, you'd put some rotational tension with a tension tool on here, and you'd use another tool to reach in the lock and manipulate this stack of pins.
00:08:48.240 --> 00:08:48.879
Got it.
00:08:48.879 --> 00:08:49.120
Yeah.
00:08:49.120 --> 00:08:50.799
Josh got it.
00:08:52.159 --> 00:08:52.639
Nice.
00:08:52.639 --> 00:08:55.440
I'm gonna need this file to print it.
00:08:55.759 --> 00:08:56.080
Yeah.
00:08:56.080 --> 00:08:58.320
Maybe we could share that in the show notes today.
00:08:58.320 --> 00:08:58.720
Sure.
00:08:58.720 --> 00:09:02.399
Or maybe you could tell people where to find it if they're interested to have a 3D printer.
00:09:02.720 --> 00:09:04.720
Well, I'm using Bamboo Labs.
00:09:04.720 --> 00:09:13.919
I've got uh Carbon X1C, and um, in the Bamboo Labs software uh on the home tab, you can just search for Lockpick.
00:09:14.240 --> 00:09:16.080
Can we talk 3D printing for a second?
00:09:16.080 --> 00:09:16.559
Sure.
00:09:16.559 --> 00:09:21.039
So you have the like this has very fine lines in it, right?
00:09:21.039 --> 00:09:23.919
Uh and what's that type of printer called?
00:09:23.919 --> 00:09:26.399
Where it prints on top of itself?
00:09:26.399 --> 00:09:28.639
Uh FDM printing.
00:09:28.879 --> 00:09:31.039
And you're gonna make me remember that acronym.
00:09:31.039 --> 00:09:33.600
Filament something, something.
00:09:33.600 --> 00:09:34.480
It's okay.
00:09:34.480 --> 00:09:37.200
Um one of our 10 listeners or Google.
00:09:37.200 --> 00:09:39.200
Fused deposit modeling.
00:09:39.200 --> 00:09:39.759
Oh, nice.
00:09:39.759 --> 00:09:40.159
There we go.
00:09:40.159 --> 00:09:40.399
Okay.
00:09:40.399 --> 00:09:41.120
Deposition.
00:09:41.120 --> 00:09:42.240
I wouldn't have guessed that one.
00:09:42.480 --> 00:09:43.360
Fused deposition.
00:09:43.360 --> 00:09:45.279
So it kind of layers on itself.
00:09:45.279 --> 00:09:49.919
I I I I heard they were printing houses that way with concrete and and that type of thing, right?
00:09:50.000 --> 00:09:50.159
Yeah.
00:09:50.399 --> 00:09:56.639
But uh so that's one type, and then you have another resin type where it's kind of like dipped in the resin or something.
00:09:56.960 --> 00:09:57.279
Yep.
00:09:57.279 --> 00:10:06.480
So on on you have um like a plate or surface and you're using a like a video projector essentially to project an image out of that plate.
00:10:06.480 --> 00:10:14.320
It's using UV light, and the um printer's full of a fluid that uh the fuses when it's exposed to the UV light.
00:10:14.320 --> 00:10:18.720
So uh you you're projecting a picture while you slowly raise up.
00:10:18.720 --> 00:10:28.559
It's almost imagine a movie being shined on a screen that's that's sort of causing the liquid inside to fuse at those points where it made contact with the light.
00:10:28.559 --> 00:10:41.200
Um the models come out fairly sticky, and so you need to give them a wash uh and then set them under UV light or set them outside for an hour, and then then they'll cure more solid.
00:10:41.200 --> 00:10:48.000
Um because it's a video projection, um, just that that process, it it can be a much higher resolution.
00:10:48.159 --> 00:10:48.480
Yeah.
00:10:49.039 --> 00:10:53.279
Um and they're the the resolution on all these are getting better every year.
00:10:53.279 --> 00:10:58.080
Yeah, the the accuracy of the of the 3D printers itself.
00:10:58.080 --> 00:11:03.840
Their their ability to move to a coordinate and stop at an exact point, uh, is it's just phenomenal.
00:11:03.840 --> 00:11:07.759
They're and you can 3D print 3D printer.
00:11:07.759 --> 00:11:15.840
I think my first 3D printer was um the the idea was that you need vitamins.
00:11:15.840 --> 00:11:20.960
Those are the circuits and wires and and bearings and things like that.
00:11:20.960 --> 00:11:29.200
You'd you'd use vitamins, you'd feed vitamins into uh an existing 3D printer, and uh that that's how a new 3D printer was born.
00:11:29.200 --> 00:11:29.919
That's cool.
00:11:29.919 --> 00:11:40.399
Um I went to a local maker space and um printed the components for my 3D printer and uh assembled the vitamins and again being an early adopter there.
00:11:40.399 --> 00:11:44.000
Uh Joseph Prusso was still in high school at the time.
00:11:44.000 --> 00:11:47.440
Um some folks may know his name.
00:11:47.440 --> 00:11:50.320
He's well known in the in the rep rep community.
00:11:50.559 --> 00:11:52.960
Oh um Josh forgot to get him on the podcast.
00:11:53.120 --> 00:11:53.360
Yep.
00:11:53.679 --> 00:12:00.480
Well, Pro Prusso, isn't that one of the that's the one of the bigger printers that people use that you can print like you were talking about, printing your own printer.
00:12:00.480 --> 00:12:00.720
Yeah.
00:12:00.960 --> 00:12:01.440
Yep.
00:12:01.440 --> 00:12:22.000
So uh Joseph Proofsa would be uh at home at his parents or grandmother's place, and uh in the middle of the night for him, you know, it'd be my evening, but in the middle of the night for him, he'd be chatting on IRC and we could discuss how the print went or what would make a print better, or wouldn't it be nice if we had.
00:12:22.000 --> 00:12:25.519
And um early on he was a great you know, CAD person.
00:12:25.519 --> 00:12:31.120
So if you the in the early days of 3D printing, most of us didn't know CAD, but we liked assembling stuff.
00:12:31.120 --> 00:12:35.120
We could if we could borrow a printer, we could make stuff and and bolt stuff together.
00:12:35.120 --> 00:12:38.159
Uh learning the CAD skill is where it really got cool.
00:12:38.159 --> 00:12:50.000
Um you know, right now, if if you're just starting a 3D printing, you see something online like this lock we're looking at, and decide that you want one, you can get a 3D printer, take it home, download
the file, and you know, boom, you've got this thing.
00:12:50.000 --> 00:13:03.519
But it is so much more powerful when you imagine, wouldn't it be great if I had and could sit down with the software app and and draw it up and and then send it to the printer.
00:13:03.519 --> 00:13:08.960
That to me, that's very related to um AI as well.
00:13:08.960 --> 00:13:13.279
I think now you could probably have an idea that you want.
00:13:13.279 --> 00:13:19.200
If you can describe it to an AI agent, these large language models will generate the file for you.
00:13:19.200 --> 00:13:20.639
Now you can send that to your printer.
00:13:20.639 --> 00:13:26.320
So if you're a Star Trek fan, we're moving closer and closer to that idea of a replicator.
00:13:26.320 --> 00:13:27.039
Ah, nice.
00:13:27.200 --> 00:13:30.000
So now I know what I'm doing this weekend.
00:13:30.000 --> 00:13:31.279
Now you're printing.
00:13:31.279 --> 00:13:33.200
I have uh bamboo labs also.
00:13:33.200 --> 00:13:36.320
It's uh Eric probably knows it's a P1S, I think.
00:13:36.320 --> 00:13:37.039
Yep.
00:13:37.039 --> 00:13:47.519
Uh yeah, so but it's not uh I haven't been using it very much in the past, you know, few months, but now I've got a project for this weekend to work with uh Claude to think up something cool.
00:13:47.759 --> 00:13:48.639
Yep, fire it up.
00:13:48.879 --> 00:13:56.159
And Eric, are you seeing now in the lock picking industry being able to print keys to to maybe get through a certain lock?
00:13:56.559 --> 00:13:57.519
I have heard of that.
00:13:57.519 --> 00:14:00.320
I have not I've not attempted that myself.
00:14:00.320 --> 00:14:09.039
Uh uh a very high-quality lock is gonna have tolerances that are greater than that of most 3D printers.
00:14:09.039 --> 00:14:09.440
Oh, okay.
00:14:09.440 --> 00:14:14.960
But I say most 3D printers and most high-quality locks, there's always the middle ground there.
00:14:14.960 --> 00:14:32.399
If you have a um we shouldn't name names and quit you know, pick on them, but let's say something manufactured in a country starting with C that's in the blister pack at your local hardware store and costs less than 35 bucks, odds are the talents are really quite low.
00:14:32.399 --> 00:14:36.799
And sure, you take that to a 3D printer and make yourself a key.
00:14:36.799 --> 00:14:37.440
Right.
00:14:37.440 --> 00:14:38.480
I'll give you an example.
00:14:38.480 --> 00:14:54.720
If you want to open any luggage lock that's compatible with the TSA's plan, uh years ago, somebody took a picture of a TSA officer's keyring, made a couple measurements, and went, hey, I can replicate all those keys and and published a set of keys.
00:14:54.720 --> 00:15:02.000
So, you know, TSA 001 through TSA 014, uh just download and print it, and there you go.
00:15:02.240 --> 00:15:02.960
There you go.
00:15:03.600 --> 00:15:04.080
Wow.
00:15:04.080 --> 00:15:20.000
And of caution, anybody who has typical security or I would say lower security locks, if you have your keys exposed, if you leave them on the uh the the table at uh Chipotle, you guys had Chipotle for lunch, right?
00:15:20.000 --> 00:15:26.960
Um, leave your keys out on the table, um a quick photo and and you're done for.
00:15:27.279 --> 00:15:28.639
We're gonna share this comment real quick.
00:15:28.639 --> 00:15:37.039
Are we close to seeing AI-powered robotic lock picks that can decode a lock in seconds just by analyzing the acoustic or haptic feedback of the of the pins?
00:15:37.039 --> 00:15:37.919
That's interesting.
00:15:37.919 --> 00:15:39.279
We are well past that.
00:15:39.279 --> 00:15:39.919
Are we?
00:15:39.919 --> 00:15:42.480
Can you give us a little bit more context there?
00:15:42.480 --> 00:15:44.720
A little bit more uh what's going on?
00:15:45.840 --> 00:15:46.399
Sure.
00:15:46.399 --> 00:15:54.879
Um we have micro cameras that are the cameras essentially the size of the key.
00:15:54.879 --> 00:16:00.399
So you you just basically are shooting a video as you put your key into the lock.
00:16:00.399 --> 00:16:09.519
And certain locks have been designed in a way where if if you could be small and be inside and look in a particular direction, you can actually see in in particular.
00:16:09.519 --> 00:16:12.799
I'm talking about those keys that allow you to re-key them yourselves.
00:16:12.799 --> 00:16:39.759
You may have one, I think both Schlag and uh QuickSet have this where you you you put in the key that works right now, and then you insert another tool, uh rotate the lock to a certain position, allows you to pull out your old key and then put in the new key that you want to be the key for your house, and then you pull out that special pin and and reset the lock, and now the lock's been re-keyed without hiring a locksmith.
00:16:39.759 --> 00:16:40.639
It it's good to go.
00:16:40.639 --> 00:16:47.200
Well, the the design of that has a bunch of serrated uh columns essentially.
00:16:47.200 --> 00:16:52.320
When you're when you're inserting the tool, you're separating the serrated columns so you can you can realign the points.
00:16:52.320 --> 00:16:55.360
When you insert the new key, that that's how everything kind of lines up.
00:16:55.360 --> 00:17:09.279
Anyhow, there's um there's now an app and a camera where you just slide that into the lock, and then I can go back to my machine and say, cut my one of these five three five one threes and uh you know I've I've got the new key.
00:17:10.960 --> 00:17:34.720
With with that vibration question and and kind of continuing on with what Eric was talking about, I I had read somewhere maybe a couple of years ago that they were able to pick up the vibration off of the glass using like a la laser from far away and be able to reinterpret what the conversation was from the sound waves that resonated on the glass.
00:17:34.720 --> 00:17:49.519
And then I think maybe it was two years ago, I saw that by listening to the sound of a rotating hard
drive, the way the heads moved across the platter, they could recreate what some of the data was.
00:17:49.519 --> 00:17:51.680
So that that's interesting.
00:17:52.000 --> 00:18:12.319
That reminds me of that Operation Ghost Murmur where they found the guy in Iran, the pilot using AI to listen for his heartbeat, and they probably had his personal heartbeat signature on some uh kind of uh of a info sheet and compared it to what they were listening to in the environment in front of them.
00:18:12.720 --> 00:18:15.680
But yeah, uh you've probably seen the mapping with Wi-Fi also.
00:18:15.680 --> 00:18:16.240
Yeah.
00:18:16.240 --> 00:18:17.200
Another one.
00:18:17.200 --> 00:18:19.200
There's quite a few things like that.
00:18:19.200 --> 00:18:21.119
I I don't know how practical it is.
00:18:21.119 --> 00:18:23.440
I I don't fear that a whole lot.
00:18:24.240 --> 00:18:24.960
What's Eric?
00:18:24.960 --> 00:18:33.039
So one of the things that maybe you've seen that's kind of crazy when you get called out to say, you know, like, oh hey, I can't get into whatever, and they call you out.
00:18:33.039 --> 00:18:38.640
You've you've had to show up and there's some weirdness going on or something interesting.
00:18:38.640 --> 00:18:42.240
Yeah.
00:18:42.240 --> 00:18:46.799
Eric, didn't you tell me that for game night we were going to break into somebody's car?
00:18:46.799 --> 00:18:48.240
A volunteer's car.
00:18:48.240 --> 00:18:48.559
Right.
00:18:48.559 --> 00:18:49.039
Right?
00:18:49.039 --> 00:18:49.759
We're gonna do that.
00:18:49.759 --> 00:18:50.160
Sure.
00:18:50.160 --> 00:18:51.839
Are you volunteering now?
00:18:51.839 --> 00:18:59.759
That's a cool story that that you know, I think most people don't know the capabilities of what a locksmith can do.
00:18:59.759 --> 00:19:05.359
And you can get into just about anything with the right tools and equipment, right?
00:19:05.599 --> 00:19:05.759
Sure.
00:19:05.759 --> 00:19:07.920
And there's different specialties as well.
00:19:07.920 --> 00:19:09.920
So I I specialize in automotive.
00:19:09.920 --> 00:19:14.160
Um, I've got friends that are in the commercial lock and safe sort of business.
00:19:14.160 --> 00:19:16.000
Safes are another good example.
00:19:16.000 --> 00:19:19.200
You you mentioned the robotic, you know, can you open a lock?
00:19:19.200 --> 00:19:21.920
There, there's a device called the soft drill.
00:19:21.920 --> 00:19:24.400
Everybody's Googling for that one as well.
00:19:24.400 --> 00:19:28.880
Those are um are very rare to find now.
00:19:28.880 --> 00:19:31.599
The manufacturer basically said I sold enough of these.
00:19:31.599 --> 00:19:40.640
I think uh certain agencies of our government that may or may not have three or four letter acronyms uh kind of controlled that because they're very good.
00:19:40.640 --> 00:19:47.519
Safe manipulation uh is is a skill that you can learn, and so can robots.
00:19:47.519 --> 00:19:56.160
And so the soft drill can open a
safe much, much faster than um than most people need to be able to open a safe.
00:19:56.160 --> 00:20:00.160
Uh if you're a locksmith, of course, you're making money if you fix price to open a safe, right?
00:20:00.160 --> 00:20:05.279
You'd you'd rather be gone in 15 minutes and make a boatload of money than attach a machine and wait 13 hours.
00:20:05.279 --> 00:20:09.279
But um there's a TL2000 dialer.
00:20:09.279 --> 00:20:12.160
Most of the safe people that I know are are using that.
00:20:12.160 --> 00:20:18.799
That literally just manipulates every combination until it senses the lock is open and it stops.
00:20:18.799 --> 00:20:26.559
Um but for electronic safes, you most of the electronics are inside the safe, just the battery and the keypad is on the outside.
00:20:26.559 --> 00:20:30.160
There are devices on the market that will plug into the keypad bus.
00:20:30.160 --> 00:20:35.119
And uh, you know, five, four, three, two, one, she's open.
00:20:35.519 --> 00:20:41.279
Looks like peep people are making uh these uh soft drill brushes by using a uh electronic toothbrush.
00:20:41.279 --> 00:20:42.160
Different thing.
00:20:42.160 --> 00:20:42.880
Totally different thing.
00:20:42.880 --> 00:20:43.359
Okay.
00:20:43.359 --> 00:20:46.720
It looks like this is a lockpicking mechanism, though, yeah.
00:20:46.960 --> 00:20:47.200
Yeah, yeah.
00:20:47.200 --> 00:20:58.559
The the soft drill has a um a microphone and a uh servo with feedback that attaches to the dial on the safe.
00:20:58.559 --> 00:21:14.000
And it it will swing the dial around, listening to the acoustics, and can detect when components within the lock are bumping other components within the lock that allows it to decipher how things are aligned.
00:21:14.000 --> 00:21:21.599
If you know how things are aligned and where where the contact points are, uh it very quickly knows, like, okay, here's the combination.
00:21:21.920 --> 00:21:24.160
I gotta I gotta start hold that thought, Eric.
00:21:24.160 --> 00:21:25.119
I gotta share this comment.
00:21:25.119 --> 00:21:30.160
This is my this is why my door has uh porticules and draw bars installing a drawbridge next year.
00:21:30.160 --> 00:21:31.759
That's from Faye 9915.
00:21:32.480 --> 00:21:34.079
Faye's a regular listener, I think.
00:21:34.319 --> 00:21:36.319
Yeah, we'll get to all your questions, but Eric, you had to do it.
00:21:36.480 --> 00:21:37.039
Yeah, no, I did.
00:21:37.039 --> 00:21:38.960
So with Eric Hotel Safe, right?
00:21:38.960 --> 00:21:50.480
Like you go into the hotel and I think there's a Darknet Diaries episode where the guy um was a poker player and um they they got his laptop and installed some stuff on it and what have you.
00:21:50.480 --> 00:21:54.559
But it how do those is that just an illusion of safety?
00:21:54.799 --> 00:22:02.799
Uh yeah, if if that a lot of the safes in hotels are You know, bulk manufactured, another country starting with C.
00:22:02.799 --> 00:22:04.720
Maybe that other one, same one.
00:22:04.720 --> 00:22:08.000
Uh many of these are opened with just a uh a magnet.
00:22:08.000 --> 00:22:11.920
You know, there's there's an electromagnet inside of it to release the lock.
00:22:11.920 --> 00:22:12.960
Carry a big fish.
00:22:12.960 --> 00:22:14.000
You can go fishing.
00:22:14.000 --> 00:22:17.759
You can you can do magnet fishing.
00:22:17.759 --> 00:22:19.039
The lake fishing.
00:22:19.039 --> 00:22:21.680
You just drag a large magnet behind your boat.
00:22:22.160 --> 00:22:25.839
You go like go over a bridge and drop it down on the rope and yeah.
00:22:26.240 --> 00:22:26.799
Yeah, totally.
00:22:26.799 --> 00:22:35.839
But you could you can pick up all the the safes and the firearms and the every other piece of metal that's discarded in the middle of the night over a bridge.
00:22:35.839 --> 00:22:37.599
Have you guys done this?
00:22:38.079 --> 00:22:39.920
Eric's acting like he hasn't done it before.
00:22:39.920 --> 00:22:42.480
That's the kind of fishing that might be might be interesting.
00:22:42.880 --> 00:22:44.720
We may have to do an expedition this summer, Eric.
00:22:44.720 --> 00:22:58.799
I uh now I've scuba dived, and when when I was scuba diving uh in in rivers, like this is you know back in high school, they would say if you see a um bag underwater, do not open the bag.
00:22:58.799 --> 00:23:02.480
Um because you're not you're probably not gonna like what you find.
00:23:02.480 --> 00:23:04.000
We we found a bag.
00:23:04.000 --> 00:23:06.319
We did not adhere to the guidelines.
00:23:06.319 --> 00:23:10.160
We opened the bag and it was just full of sand from a construction thing.
00:23:10.160 --> 00:23:10.799
Uh okay.
00:23:10.960 --> 00:23:11.920
Sandbag.
00:23:11.920 --> 00:23:15.359
We got another question here if that the that's okay.
00:23:15.359 --> 00:23:17.839
Um this is again from Joshua Morgan Goldstein.
00:23:17.839 --> 00:23:27.519
Comparing something like a minimalist Volvo to a high performance Porsche, who is winning the digital arms race against the uh against relay attacks and the key cloning, or are they both wide open to the exploits?
00:23:27.920 --> 00:23:30.480
Volvo's ahead, I would I would say.
00:23:30.480 --> 00:23:37.039
Um and I would say European vehicles in general are far ahead of domestic vehicles.
00:23:37.039 --> 00:23:39.119
Why why is that?
00:23:39.119 --> 00:23:56.640
Yeah, so uh typical key for a domestic or Asian vehicle, there's a serial number burned into the key, and during a programming session, we tell the car, okay, now I want you to trust this key, and uh the process is done.
00:23:56.640 --> 00:24:06.640
In a typical European vehicle, we have public-private key encryption and challenge response algorithms going on between multiple computers in the vehicle.
00:24:06.640 --> 00:24:13.680
Your key contains a private key burned into the the chip itself at the factory.
00:24:13.680 --> 00:24:24.319
And um, if if I as a cyber security auto
locksmith open up the computers and get in there, I can extract the public key.
00:24:24.319 --> 00:24:26.880
Uh gee, what am I gonna do with that now?
00:24:26.880 --> 00:24:31.200
I mean it I I I I call it public key, but it's a little different, right?
00:24:31.200 --> 00:24:34.000
You've we've got an asymmetric key pair.
00:24:34.000 --> 00:24:43.680
Um but there's a lot of brute force cyber work necessary in order to come up with the matching key that's gonna make those handshakes work between those modules.
00:24:43.680 --> 00:24:49.359
So when you make a key to your uh we'll give Audi some credit here.
00:24:49.359 --> 00:24:59.200
When you go to Audi and order a key for the $600, they are just putting the order in the assembly line and you know, out comes a blank key.
00:24:59.200 --> 00:25:05.359
They write the codes that they knew when they built the car and its key and they send it to you in a huge profit margin.
00:25:05.359 --> 00:25:10.720
When I get the call to make a key to your Audi, you don't want to watch.
00:25:10.720 --> 00:25:12.400
It's like making sausage.
00:25:12.400 --> 00:25:14.720
Just look the other way, I'll be done in four hours.
00:25:14.720 --> 00:25:25.920
Um we're gonna open up those computers, peel back the metal on the cans for for for some of the more difficult ones, uh, desolder certain integrated circuits.
00:25:25.920 --> 00:25:34.480
We're gonna do the things we need to do to get uh MCUs or EE proms to dump their goodies.
00:25:34.480 --> 00:25:36.799
Those goodies are gonna go up into the cloud.
00:25:36.799 --> 00:25:46.400
I have subscriptions for products that also came from a company man manufactured it in a country with starts with C or R.
00:25:46.400 --> 00:25:47.920
They're very good at their work too.
00:25:47.920 --> 00:26:02.000
Um we're essentially reverse engineering the security mechanisms on the hardware and then brute forcing those keys in order to come up with the secret in your key.
00:26:02.559 --> 00:26:11.759
It seems that the Volkswagen group actually owns Audi Porsche and other brands like Lamborghini and Bentley.
00:26:11.759 --> 00:26:12.400
Yeah.
00:26:12.400 --> 00:26:17.680
So if you're getting a Lamborghini, it's the same thing as a Volkswagen.
00:26:17.680 --> 00:26:18.480
Same thing.
00:26:18.960 --> 00:26:24.480
Some of these cars that you might call exotic cars, the ones you expect to have the best security.
00:26:24.480 --> 00:26:25.680
Yeah.
00:26:25.680 --> 00:26:30.319
It's they put all the money in the in the paint and the polish and the delivery.
00:26:30.640 --> 00:26:31.119
Nice.
00:26:31.119 --> 00:26:35.200
So, Eric, you're telling me my F-150 key is pretty easy to clone?
00:26:35.839 --> 00:26:41.279
Until 2021, when Ford totally uh changed how they go about things.
00:26:41.279 --> 00:26:44.319
Um I have a 2021 Ford F-150.
00:26:44.319 --> 00:26:52.000
The um electrical system was modeled after the Mach E, and the Mach E was designed to sort of compete with the Tesla.
00:26:52.000 --> 00:26:56.480
That was the beginning of uh self-driving and you know, much more modern architecture.
00:26:56.480 --> 00:27:04.799
So the the process requires factory tools and um a VSP, uh vehicle security professional certification from NASA.
00:27:04.799 --> 00:27:12.799
Uh Ford restricts access to those functions to folks that are vetted with uh licensing insurance and and so on.
00:27:12.799 --> 00:27:16.319
And then in 2025, it gets even more interesting.
00:27:16.319 --> 00:27:19.200
They introduced encryption between all the modules.
00:27:19.200 --> 00:27:22.000
And so um I have a self-driving vehicle.
00:27:22.000 --> 00:27:30.160
I I bought the Ford for the Blue Crews and the ability to do self-driving, but um didn't like the idea of paying the subscription fee.
00:27:30.160 --> 00:27:37.680
And there were new features that weren't available for my older vehicle, so I've got a comma AI and I run blue pilot software.
00:27:37.680 --> 00:27:38.640
That's a whole plug.
00:27:38.640 --> 00:27:40.880
But yeah, I've heard of that.
00:27:40.880 --> 00:27:42.480
I've heard of that.
00:27:43.279 --> 00:27:45.519
Who's the guy that started comma AI?
00:27:46.079 --> 00:27:50.160
Uh I can picture him and I'll walk right up to him at DEF CON and say, hey, how's it going?
00:27:50.160 --> 00:27:52.799
Yeah, but I cannot remember his name right offhand.
00:27:53.119 --> 00:27:56.799
Didn't Musk try to hire him or something, or he worked over there for a little bit?
00:27:56.799 --> 00:27:58.480
George Hotz or that's what it is.
00:27:58.480 --> 00:27:58.880
Yeah.
00:27:58.880 --> 00:28:00.160
Yeah, GeoHotz.
00:28:00.160 --> 00:28:00.960
Yes, John.
00:28:00.960 --> 00:28:02.880
So how do you like the comma AI?
00:28:02.880 --> 00:28:05.759
Because you just plug that into the bus, right?
00:28:06.000 --> 00:28:08.400
Yeah, it works on a number of vehicles.
00:28:08.400 --> 00:28:10.480
Um, so check it out.
00:28:10.480 --> 00:28:12.480
You don't have to have a Ford F-150.
00:28:12.480 --> 00:28:16.720
Um and and primarily he's doing hardware sales, right?
00:28:16.720 --> 00:28:19.039
And then promoting the idea of software development.
00:28:19.039 --> 00:28:26.960
Um there is open pilot, which is the the generic uh driving module for does things a little differently.
00:28:26.960 --> 00:28:30.400
So we've got blue pilot, a fork of that code.
00:28:30.400 --> 00:28:37.200
Uh, but yeah, the the wonderful thing about it um is that it will plot a course through whatever it sees.
00:28:37.200 --> 00:28:46.400
If if your truck ends up in a cornfield and you kind of want to go that way, um you can turn on cruise control and keep driving through the cornfield.
00:28:46.400 --> 00:28:50.000
Set your speed and you know, pay attention to the road, right?
00:28:50.000 --> 00:28:53.279
If you look off the road, the thing will uh refuse to drive for you.
00:28:53.279 --> 00:28:55.839
Um But but there's probably hacks around there.
00:28:56.079 --> 00:29:18.079
A buddy of mine's an airline pilot, and he he said that there's some some some of his other pilots that, you know, they're they're home-based in say Minnesota, but they live way far away, like way up north somewhere, and they've got to commute from way up north wherever they live down to MSP for you know their you know, their shift.
00:29:18.079 --> 00:29:22.720
And sometimes they'll come back, you know, late at night or whatever, and then need to go home.
00:29:22.720 --> 00:29:29.119
They have this comma AI system, and like they're sleeping on the way home.
00:29:29.119 --> 00:29:34.319
And I mean, this is hearsay through hearsay, but yeah, it's uh it's interesting.
00:29:35.039 --> 00:29:37.200
There's a there's another whole talk there, I'm sure.
00:29:37.200 --> 00:29:37.599
Yes.
00:29:37.599 --> 00:29:39.279
There are separate teams.
00:29:39.279 --> 00:29:42.799
There's a camera that watches the driver, and then there's the camera that watches the road.
00:29:42.799 --> 00:29:50.640
In fact, multiple cameras watching the road, but the camera that watches the driver, it is open source, you could theoretically manipulate that.
00:29:50.640 --> 00:29:59.839
Um they have a practice of monitoring for all forks, and the hardware is designed by default to pull from your GitHub repo.
00:29:59.839 --> 00:30:01.200
Give it a URL.
00:30:01.200 --> 00:30:15.119
There are some safety mechanisms in there, and if you attempt to bypass the safety mechanisms, the community will attempt to bypass you because that's not good for safety in general.
00:30:15.119 --> 00:30:21.680
And the last thing any of us want are regulators deciding that they know best for us.
00:30:22.559 --> 00:30:25.119
We had tinfoil hat coming on here, guys.
00:30:25.119 --> 00:30:25.759
Here we go.
00:30:25.759 --> 00:30:26.720
Here we go.
00:30:26.720 --> 00:30:41.920
Uh I mean, this has been kind of brewing in the background, but it looks like there's just been some legislation passed driven by the 2021 Infrastructure Investment and Jobs Act, requires automakers to install advanced impaired driving prevention technology in all new passenger vehicles.
00:30:41.920 --> 00:30:55.519
The mandate directs the NHTSA to finalize rules require built-in passive monitoring systems such as cameras and sensors to detect driver impairment fatigue and distraction with the authority to limit and prevent vehicle uh operation.
00:30:55.519 --> 00:30:58.319
So uh I've been seeing this a lot on YouTube.
00:30:58.319 --> 00:31:02.640
There's been a lot of commentary on this, and in most of it negative, as you can imagine.
00:31:02.640 --> 00:31:04.240
Where do you guys kind of fall?
00:31:04.240 --> 00:31:06.079
I I kind of see both sides, right?
00:31:06.079 --> 00:31:08.799
No one wants to be we want to we want to be free, right?
00:31:08.799 --> 00:31:17.599
We want to be able to get into our car and we don't want to get shut down because we didn't get very good sleep that night or we had a cold or something like that, not be able to go where we want to go.
00:31:17.599 --> 00:31:22.960
But also, we've all seen these terrible drivers on the road that have no business being behind the wheel.
00:31:22.960 --> 00:31:25.599
And it would be great to take them off the road.
00:31:25.599 --> 00:31:28.160
So uh where do you guys fall on this one?
00:31:28.160 --> 00:31:29.759
Kind of as the intersection.
00:31:29.759 --> 00:31:32.480
Maybe this is our our transition to AI, right?
00:31:32.799 --> 00:31:35.519
Or or gun control or any other uh topic.
00:31:35.519 --> 00:31:37.279
Don't get us into that.
00:31:37.279 --> 00:31:39.440
I eyes expanding in the room.
00:31:40.079 --> 00:31:44.160
I think I think a lot of people are just getting a piece of electrical tape to go over the camera.
00:31:45.680 --> 00:31:47.599
It will stop driving at that point.
00:31:47.599 --> 00:31:51.200
Um you're for it or are you against it?
00:31:51.359 --> 00:31:52.880
That's that's kind of what I'm looking for here.
00:31:53.200 --> 00:31:53.680
Yes.
00:31:53.680 --> 00:31:54.640
Exactly.
00:31:54.640 --> 00:31:56.079
Yes.
00:31:56.079 --> 00:32:06.880
I I think that uh taking advantage of where technology has led us is is a great thing in general.
00:32:06.880 --> 00:32:13.039
Um I I think like a lot of laws, they're great when they apply to everybody but me.
00:32:13.039 --> 00:32:16.559
Rules for thee and not for me, huh?
00:32:16.559 --> 00:32:17.119
Yeah.
00:32:17.119 --> 00:32:19.200
So I don't know, right?
00:32:19.200 --> 00:32:21.200
I'm I I'm a libertarian.
00:32:21.200 --> 00:32:24.000
I I definitely support our freedoms.
00:32:24.000 --> 00:32:26.880
I don't have to even mention Second Amendment or anything else.
00:32:26.880 --> 00:32:27.920
I've said enough.
00:32:27.920 --> 00:32:32.400
Um I think that uh the technology is incredible.
00:32:34.640 --> 00:32:38.000
And I think it's walking on eggshells.
00:32:38.000 --> 00:32:39.920
I think it's I think it's a good idea for most.
00:32:41.039 --> 00:32:42.640
Nick, do you want to weigh in on this, Mr.
00:32:42.640 --> 00:32:43.039
Marine?
00:32:43.359 --> 00:32:45.839
Let's make it heckable and then I'm cool with it.
00:32:45.839 --> 00:32:53.599
No, I kind of go both ways too, honestly, because you know, if somebody's impaired driving, I certainly don't want them on the road if I'm on out there with my family, right?
00:32:53.599 --> 00:32:55.839
So that's the the logical thinking.
00:32:55.839 --> 00:33:02.559
But I certainly don't want my space, you know, invaded if I'm getting in the truck to run across the street to the grocery store.
00:33:02.559 --> 00:33:05.759
So I guess overall, if I had to pick, I'd say I'm against it.
00:33:06.079 --> 00:33:06.160
Yeah.
00:33:06.480 --> 00:33:08.319
Eric Brown, you got some thoughts on this.
00:33:08.319 --> 00:33:09.440
I I've been curious.
00:33:09.920 --> 00:33:10.480
I do.
00:33:10.480 --> 00:33:12.960
Um what were they?
00:33:12.960 --> 00:33:14.960
I was distracted by the headphones here.
00:33:14.960 --> 00:33:16.720
About about being monitored in your vehicle.
00:33:16.720 --> 00:33:17.359
Oh, yeah.
00:33:17.359 --> 00:33:19.200
Well, so okay.
00:33:19.200 --> 00:33:41.359
I uh we've got a client that some of the people in the organization are refusing to take phishing training and they are still clicking on phishing emails, but then when they're told about it, they're like, oh yeah, I I clicked on it on purpose because it was, you know, I whatever, right?
00:33:41.359 --> 00:33:42.240
It's some excuse.
00:33:42.240 --> 00:33:43.759
And it's like just owning it, huh?
00:33:43.759 --> 00:34:07.920
Yeah, just so you know, when you have people like that that, you know, with that mentality in the public space, I I would want some sort of guidelines and structure so that, you know, I know somebody just didn't homebrew something in their garage and now they're ripping down the road at 110 and like, oh whoops, I forgot, you know, to put this on.
00:34:07.920 --> 00:34:18.079
It's, you know, I I kind of go to the aviation community that has been using autopilot for decades and it works really well.
00:34:18.079 --> 00:34:26.079
And and there's been refinements with terrain avoidance over the years and air traffic control, and it's gotten better and better.
00:34:26.079 --> 00:34:33.599
But you know, you you really could not fly in instrument meteorological conditions without autopilot.
00:34:33.599 --> 00:34:40.880
Like it's strictly it's simply safer like to to fly with with autopilot, because you can get spatial disorientation.
00:34:40.880 --> 00:34:54.079
You know, if you're if you're flying in the clouds and you're getting you know buffeted around from um weather and you've got rain or snow or whatever coming in, um there's a lot of environmental distractions.
00:34:54.079 --> 00:35:07.119
And if you're trying to fly the plane or you're getting bounced around and you know, trying to figure out where the horizon is, and your vestibular system is telling you you're in a turn, but you're really not.
00:35:07.119 --> 00:35:08.719
So you're you're straightening that out.
00:35:08.719 --> 00:35:13.360
You know, it's just it it's what happened with JFK Um Jr.
00:35:13.360 --> 00:35:17.840
up in the Cape, you know, where he where he kind of who was not instrument rated.
00:35:17.840 --> 00:35:27.519
So he he he probably wasn't aware of all of these things that can happen, but you you really want to be on the instrument system and and you want to be relying on the plane to to fly itself.
00:35:27.519 --> 00:35:30.400
And you know, we've been doing this for years in in aviation.
00:35:30.400 --> 00:35:32.480
So I would love to see it on the roads.
00:35:32.480 --> 00:35:37.840
The experience that I I have with it is it's a better driver than most.
00:35:37.840 --> 00:35:38.800
It's safer.
00:35:38.880 --> 00:35:45.679
Aaron Powell That's a little different than uh being monitored, right, in your vehicle, like having a having a self-driving car or an automated driver.
00:35:46.159 --> 00:35:48.159
I think it's because that's where we're at level two today.
00:35:48.159 --> 00:35:54.159
But when we get to like level, what is it, four where we don't, you know, that you don't need the monitoring because the system's better than you are.
00:35:54.639 --> 00:36:02.079
Um that's actually a question in the chat about um when are we going to get to level five?
00:36:02.639 --> 00:36:05.519
I hope it's Eric, how far away are we from level five?
00:36:06.159 --> 00:36:06.800
Ten years.
00:36:06.800 --> 00:36:11.840
Early adapters six, general population fifteen?
00:36:12.159 --> 00:36:14.400
It it the technology is probably close.
00:36:14.400 --> 00:36:15.840
It's just all the regulations.
00:36:15.840 --> 00:36:19.119
And then there's that conversation of who's responsible if something goes wrong.
00:36:19.360 --> 00:36:19.519
Yeah.
00:36:19.519 --> 00:36:21.199
The the litigious side of it.
00:36:21.199 --> 00:36:26.320
And then when we're gonna get into smart contracts and all of that sort of stuff, which is just a different conversation.
00:36:26.320 --> 00:36:30.800
But I I don't know, is the technology six and then the legislation's 10?
00:36:31.679 --> 00:36:35.679
Yeah, I'm I'm I can't predict what legislation's gonna be up to.
00:36:35.679 --> 00:36:44.320
I I was thinking we can pivot right to privacy and talk about AI here as well, the private cloud.
00:36:44.320 --> 00:36:46.800
Yeah.
00:36:47.039 --> 00:36:49.519
Do we want to cut this one in do a double episode?
00:36:49.519 --> 00:36:50.559
Double it up.
00:36:50.559 --> 00:36:51.599
Let's keep going.
00:36:51.840 --> 00:36:56.400
I think when we're talking about the the monitoring of drivers, right?
00:36:56.400 --> 00:37:03.119
If if that is totally a local thing and that data is my data, it's not going anywhere.
00:37:03.119 --> 00:37:06.000
It's just my cars keeping me safe.
00:37:06.000 --> 00:37:11.360
And I have the option to override, you know, like that.
00:37:11.360 --> 00:37:13.119
It's a safety feature that's built in.
00:37:13.119 --> 00:37:13.760
We all have it.
00:37:13.760 --> 00:37:23.280
And when the thing says you're not safe to drive, um, if I can go on the record saying I think I was safe to drive, I'm more cool with it if it's totally local.
00:37:23.280 --> 00:37:26.719
But I already do not like the telemetry that's in a lot of vehicles.
00:37:26.960 --> 00:37:29.440
You're saying, and that's a sober, that's a sober take.
00:37:29.679 --> 00:37:37.760
Yeah, I mean, you're your cars today are are sharing a lot of data with the manufacturer because manufacturers are selling that data.
00:37:37.760 --> 00:37:38.320
Sure.
00:37:38.320 --> 00:37:42.079
Um, you know, how many of us are Google customers?
00:37:42.079 --> 00:37:47.840
Uh and and I say that because you know, if you're not paying them, you're the you're the product, not the
customer.
00:37:47.840 --> 00:37:53.679
I I I love the things that are built into my phone and integrated in my car, which is nice as well.
00:37:53.679 --> 00:37:58.159
You know, I had this uh had this appointment to come here for for the podcast, right?
00:37:58.159 --> 00:38:01.199
I I got in my truck and it knew where I wanted to go.
00:38:01.199 --> 00:38:08.079
I just kind of hit the button and then turned on reverse control in my driveway and and it was a fun, safe drive.
00:38:08.079 --> 00:38:16.800
But um Google knows where I'm going and follows everybody else around, and that data's useful, so that I I took the best route.
00:38:16.800 --> 00:38:19.840
If there was a traffic jam somewhere, we we went around it.
00:38:19.840 --> 00:38:22.239
So it's it's the love-hate thing.
00:38:22.239 --> 00:38:24.400
Um, and I'm rambling on a little bit, right?
00:38:24.400 --> 00:38:30.480
But I I don't like that car manufacturers are keeping tabs to the extent that they are.
00:38:30.480 --> 00:38:37.360
Um, that when you buy a car now uh buried in that mountain of paperwork, it's worse than closing out a house.
00:38:37.360 --> 00:38:39.119
And and I've done both recently.
00:38:39.119 --> 00:38:46.000
Um it there there's a license agreement with your car, and you don't necessarily own the software.
00:38:46.000 --> 00:38:52.880
And if you turn off the telematics, you've just ended your warranty after 45 days and and some other interesting things like that.
00:38:53.039 --> 00:38:54.559
So I don't like that.
00:38:54.719 --> 00:38:55.360
I don't like that.
00:38:55.360 --> 00:38:56.880
So you could ride a bike.
00:38:57.920 --> 00:39:00.079
Or I could buy an old used car for now.
00:39:00.079 --> 00:39:01.360
What kind of bike do you have?
00:39:01.360 --> 00:39:02.159
I don't have a bike.
00:39:02.159 --> 00:39:05.679
Yeah, you might get the telemetry to your bike uh motor.
00:39:06.000 --> 00:39:08.719
Do you want to pedal yourself or are you gonna hit the go button?
00:39:08.719 --> 00:39:09.679
The go button.
00:39:09.679 --> 00:39:09.920
Okay.
00:39:10.159 --> 00:39:11.599
It's like plow schwab.
00:39:11.599 --> 00:39:15.199
If I put my tinfoil hat back on, uh, you will own nothing and you will be happy.
00:39:15.519 --> 00:39:19.760
I I did have a locksmith question for you around the European cars you were saying.
00:39:19.760 --> 00:39:27.440
Every time I walk into Costco, and Costco's getting ridiculous now, which is a whole nother thing, but every time you go in there, you're getting accosted by these people.
00:39:27.440 --> 00:39:35.920
Like it's either phone or I think last weekend I I went in there and like they're they're trying to like, you know, can can we clone your key or make a copy of your key?
00:39:35.920 --> 00:39:41.679
And uh you can barely walk past them and they're like, you know, they're trying to flag you now, which is ridiculous.
00:39:41.679 --> 00:39:46.719
But um, how are they doing that with the if if people have European cars?
00:39:46.800 --> 00:39:48.880
Aaron Ross Powell They they don't actually work for Costco.
00:39:48.880 --> 00:39:54.000
They're they're just a third-party vendor that that finds their locations convenient to work in.
00:39:54.000 --> 00:39:55.920
I'm gonna have to go to Sam's Club, I guess.
00:39:55.920 --> 00:40:05.599
Those folks have access to I mean they've got insurance, they've they've got training, I mean, they're able to get access to some of the same tools.
00:40:05.599 --> 00:40:06.079
I see.
00:40:06.079 --> 00:40:08.400
I don't think they're on quite the same level.
00:40:08.400 --> 00:40:21.440
Very few of the folks standing around in uh Costco are cybersecurity guys who play with microcontrollers that understand, you know, public-private key encryption and what the process is.
00:40:21.440 --> 00:40:25.599
They're I don't want to know somebody, but no, they're just following the colour.
00:40:25.599 --> 00:40:26.719
Yeah.
00:40:26.719 --> 00:40:31.679
Yeah, the majority are opening the app and logging in and clicking next and next and next.
00:40:32.079 --> 00:40:35.519
And you can cut your own keys now at Home Depot, I saw, right?
00:40:35.519 --> 00:40:40.480
Like you just walk up to the machine, you put your old one in, and the whole robotic process does it.
00:40:40.639 --> 00:40:40.960
Yeah.
00:40:40.960 --> 00:40:42.400
Let's get in there.
00:40:42.400 --> 00:40:47.519
Take a picture, it determines what the cuts are and runs the machine.
00:40:47.519 --> 00:40:50.000
My machines are that way now as as well.
00:40:50.000 --> 00:40:58.159
I take high-resolution pictures of keys, uh, goes up to a database and says, okay, what should this key have been?
00:40:58.159 --> 00:41:07.039
Um and then sends it to the key cutter, which is basically a C and C machine that that cuts with absolute precision, you know, built for that.
00:41:07.039 --> 00:41:08.480
It's it's kind of cool.
00:41:08.480 --> 00:41:10.559
Um, I've I've worked on brand new vehicles.
00:41:10.559 --> 00:41:15.599
Someone's getting the third key because their you know, kid is also going to be the user of the brand new car.
00:41:15.599 --> 00:41:29.440
And um I can actually tell from with my scanning equipment if the manufacturer had a fresh blade when they cut their you know, never used key, or whether you know, maybe they had cut 500 keys and they were just about to replace the blade.
00:41:29.440 --> 00:41:41.840
Um these are keys that I, you know, the but the owner of the vehicle didn't realize that they had a key inside their key for the mechanical lock, or that you pop the cap off to get to the to the keyhole.
00:41:42.079 --> 00:41:45.199
For for game night Eric uh in uh what are we coming up on?
00:41:45.199 --> 00:41:46.000
August here?
00:41:46.000 --> 00:41:46.239
Yep.
00:41:46.239 --> 00:41:48.800
I think it's August 1st, maybe the first Wednesday of the month.
00:41:48.800 --> 00:41:50.480
I think we got to get into somebody's car.
00:41:50.480 --> 00:41:51.519
We'll we'll pick a volunteer.
00:41:51.519 --> 00:41:52.239
Is it gonna be Cam?
00:41:52.239 --> 00:41:53.039
Who's it gonna be?
00:41:53.039 --> 00:41:54.000
I think it's gotta be Eric.
00:41:54.000 --> 00:41:54.639
It's gotta be Eric.
00:41:55.360 --> 00:41:55.920
August 5th.
00:41:56.159 --> 00:41:56.800
August 5th.
00:41:57.280 --> 00:41:58.960
Tesla gets a little more interesting.
00:41:58.960 --> 00:42:01.039
But I now do stock the cards.
00:42:01.039 --> 00:42:02.880
But uh you'll do your own duplicating.
00:42:02.880 --> 00:42:05.360
I can just hand you the card, I believe, and you do the rest of it.
00:42:05.360 --> 00:42:06.159
Interesting.
00:42:06.320 --> 00:42:06.639
Okay.
00:42:06.639 --> 00:42:08.800
We're gonna we're getting into somebody's car.
00:42:09.280 --> 00:42:10.000
I won't be here.
00:42:10.000 --> 00:42:11.119
Okay.
00:42:11.119 --> 00:42:13.199
You guys gonna have to find another person.
00:42:13.199 --> 00:42:14.880
Grey duck lock picking.
00:42:14.880 --> 00:42:16.320
Grey duck locksmithing?
00:42:16.320 --> 00:42:16.960
Or what is it?
00:42:16.960 --> 00:42:18.239
Which what's the name of it?
00:42:18.239 --> 00:42:19.440
Uh Grey Duck Locks.
00:42:19.440 --> 00:42:22.400
All right, gray duck locks for Grey Duck Security LLC.
00:42:22.400 --> 00:42:24.320
Duck Duck Grey Duck Corporation.
00:42:24.320 --> 00:42:24.719
Yep.
00:42:24.719 --> 00:42:28.960
You know it's not uh, you know, you know it's Minnesota because it's not Duck Duck Goose, right?
00:42:29.199 --> 00:42:29.679
That was the idea.
00:42:29.679 --> 00:42:36.320
I was getting a little older, a little more gray hair, and uh trying to come up with a company name, but I wanted to scream Minnesota Company.
00:42:36.320 --> 00:42:36.719
Sure.
00:42:36.719 --> 00:42:48.480
Not the guys hanging out in Costco, not the call center in New York that's you know dispatching to a guy who downloaded an app and wants to play locksmith this weekend because you know, saw a YouTube video on it.
00:42:48.480 --> 00:42:51.280
Um Minnesota, we called this pop.
00:42:51.280 --> 00:42:52.960
Soda.
00:42:53.760 --> 00:42:54.239
Soda.
00:42:54.239 --> 00:43:00.079
Eric, if somebody wanted to get a really good lock, um what's a good brand?
00:43:00.079 --> 00:43:01.599
Is it like an ambloy?
00:43:01.599 --> 00:43:03.760
What what would you recommend?
00:43:04.079 --> 00:43:10.239
Uh Asa, Abloy, Kaba, all of these are pretty much the same company now.
00:43:10.239 --> 00:43:19.119
Um multi-lock, medico, you know, CA commercial locksmith professional for the best locks.
00:43:19.119 --> 00:43:22.480
You you've got grade one, grade two, and grade three locks.
00:43:22.480 --> 00:43:28.480
The stuff we find at the traditional hardware store, I'd call that a grade three or three and a half.
00:43:28.480 --> 00:43:32.079
Or the the packaging is more resistant than the lock itself.
00:43:32.079 --> 00:43:33.599
Where's the opening that thing?
00:43:33.840 -->
00:43:35.199
Where do I get the grade one?
00:43:35.440 --> 00:43:38.400
Uh grade one you'd get from a professional distributor.
00:43:38.400 --> 00:43:51.679
Now, with today's distribution, if you know what you're shopping for, you know, I'm sure somebody on Amazon will send it to you, or wholesalers are happy to create a new account for you in the hopes of all your future business.
00:43:51.679 --> 00:43:54.800
Um you you can get the hardware in a lot of places.
00:43:54.800 --> 00:44:01.519
Um yeah, see a professional where it's not that expensive to work with somebody who knows what they're doing.
00:44:01.519 --> 00:44:10.079
You know, if you try to repair things yourself, often it costs you more than if you hired the guy who has the jiffy tool that does it in three minutes.
00:44:10.079 --> 00:44:15.840
You didn't need to spend 90 minutes packing your door frame up only to find it doesn't fit.
00:44:15.840 --> 00:44:16.800
You're here.
00:44:17.119 --> 00:44:18.719
Well, thanks for joining us today, Eric.
00:44:18.719 --> 00:44:21.119
It's been really fun talking about locksmithing.
00:44:21.119 --> 00:44:23.920
We got a lot of lock talk happening here today.
00:44:24.239 --> 00:44:24.960
Lock talk, right?
00:44:24.960 --> 00:44:26.079
Yeah, lock it down.
00:44:26.320 --> 00:44:26.480
Yeah.
00:44:26.880 --> 00:44:31.760
I wanted to extend a minute and go to AI for the we're out of time on this one.
00:44:31.760 --> 00:44:32.320
Okay.
00:44:32.639 --> 00:44:39.679
But uh, we're gonna have to have you back because I do want to do AI on-prem, um, large language models and local LMs too.
00:44:39.679 --> 00:44:42.239
So we'll have to schedule to come back sometime soon.
00:44:42.239 --> 00:44:44.719
But uh that wraps us up for today.
00:44:44.719 --> 00:44:47.280
My name is Joshua Schmidt, your co-host and producer.
00:44:47.280 --> 00:44:49.119
You've been listening to the Audit podcast.
00:44:49.119 --> 00:44:50.559
Please like, share, and subscribe.
00:44:50.559 --> 00:44:52.559
You can find us wherever you get your podcasts.
00:44:52.559 --> 00:44:57.920
We are now streaming with video uh on Spotify and as well as Apple here pretty soon.
00:44:57.920 --> 00:45:02.960
We've been joined by the usual suspects, Eric Brown, managing director of IT Auto Labs, and Nick Mellum.
00:45:02.960 --> 00:45:04.559
And our guest today was Eric Osterberg.
00:45:04.559 --> 00:45:04.880
Dr.
00:45:04.880 --> 00:45:05.119
Nick.
00:45:05.119 --> 00:45:05.599
Dr.
00:45:05.599 --> 00:45:06.320
Nick, yes.
00:45:06.320 --> 00:45:09.760
Eric Osterberg is Grey Luck, Gray Duck Lock.
00:45:09.760 --> 00:45:11.519
And you can find him on Google.
00:45:11.519 --> 00:45:15.840
Just uh search Eric Osterberg on LinkedIn or Google and you can find Grey Duck Lock.
00:45:15.840 --> 00:45:18.800
You've been listening to the audit presented by IT Audit Labs.
00:45:18.800 --> 00:45:20.079
We'll see you in the next one.
00:45:20.639 --> 00:45:24.400
You have been listening to the audit presented by IT Audit Labs.
00:45:24.400 --> 00:45:33.119
We are experts at assessing risk and compliance while providing administrative and technical controls to improve our clients' data security.
00:45:33.119 --> 00:45:45.920
Our threat assessments find the soft spots before the bad guys do, identifying likelihood and impact, or all our security control assessments rank the level of maturity relative to the size of your organization.
00:45:45.920 --> 00:45:50.239
Thanks to our devoted listeners and followers, as well as our producer, Joshua J.
00:45:50.239 --> 00:45:54.480
Schmidt, and our audio video editor, Cameron Hill.
00:45:54.480 --> 00:46:07.760
You can stay up to date on the latest cybersecurity topics by giving us a like and a follow on our socials, and subscribing to this podcast on Apple, Spotify, or wherever you source your security content.