Listen Notes: o melhor motor de busca de podcasts
Lock Picking Secrets: Key Cloning, AI Coding and Safe Cracking

Transcrição completa de Lock Picking Secrets: Key Cloning, AI Coding and Safe Cracking

TRANSCRIÇÃO 🔗

WEBVTT 00:00:00.239 --> 00:00:10.960 By listening to the sound of a rotating hard drive, the way the heads moved across the platter, they could recreate what some of the data was. 00:00:10.960 --> 00:00:13.279 So my gosh, that's interesting. 00:00:16.960 --> 00:00:20.480 You are listening to the audit presented by IT Audit Labs. 00:00:20.480 --> 00:00:23.440 I am your co-host and producer, Joshua Schmidt. 00:00:23.440 --> 00:00:32.640 Today we have the usual suspects, Eric Brown, Nick Mellum coming from Texas, as well as Eric Osterberg we have in the studio today. 00:00:32.640 --> 00:00:35.679 Eric Osterberg works with uh Gray Duck Locks. 00:00:35.679 --> 00:00:39.520 And then we have done some work with you recently around AI projects. 00:00:39.520 --> 00:00:48.880 Um one of the things that I wanted to bring up today and get into uh after we do a little bit of a lock picking demo here is to talk about uh hugging face and local LMs. 00:00:48.880 --> 00:00:50.479 Um we've been going hard here. 00:00:50.479 --> 00:00:52.560 Eric's been doing a lot of work on cloud code. 00:00:52.560 --> 00:00:54.880 I know Nick's been dabbling, and so have I. 00:00:54.880 --> 00:00:59.280 So would love to talk about the future of hardware and local LMs. 00:00:59.280 --> 00:01:06.640 So without further ado, Eric, give us just a little background about yourself, um, what you're working on right now, and and bring us up to speed. 00:01:06.879 --> 00:01:20.480 Yeah, for the past 24 months or so, I've I'm an early adopter, um, just in general, whether it be uh drones or 3D printing or what you know, whatever the latest trend is. 00:01:20.480 --> 00:01:32.719 I I like to I'm a full-time learner and um I've been using AI extensively, and um we've Eric and I have known each other for for decades now. 00:01:32.719 --> 00:01:33.200 I think so. 00:01:33.200 --> 00:01:36.640 It's been a while, uh, in in the InfoSec community. 00:01:36.640 --> 00:01:45.599 Um we we got connected and discussed, you know, some of the AI projects, and so I came to IT Audit Labs here to help out on a few of those projects. 00:01:45.599 --> 00:01:52.640 But yeah, right now I'm uh doing a lot of I guess vibe coding, you'd call it, or vibrating is watching next episode. 00:01:52.640 --> 00:01:53.920 Vibrators. 00:01:53.920 --> 00:02:13.919 Um I've been focused on the locksmithing business uh a fair amount, um, trying to ensure that my identity verification processes when I when I do locksmithing are a little bit smoother, that I don't put any of my customers' data at risk, but that I have it there, you know, to survive any audit requirements. 00:02:13.919 --> 00:02:16.800 Um, and then trying to automate the the workflow. 00:02:16.800 --> 00:02:21.439 Yeah, a lot of effort goes into quoting, making a key to a car. 00:02:21.439 --> 00:02:26.240 Um, people don't realize the complexity that's in a in a modern automobile. 00:02:26.240 --> 00:02:29.520 Um, you know, they're they're rolling computers these days. 00:02:29.520 --> 00:02:34.879 If you're driving a current model car, you might have 35, 40 different computers in that thing. 00:02:35.280 --> 00:02:36.800 And Eric, you're a pilot too, aren't you? 00:02:37.039 --> 00:02:37.759 I am a pilot. 00:02:37.759 --> 00:02:40.800 I've not flown a lot lately, but you and I need to get out there. 00:02:40.800 --> 00:02:41.599 Absolutely. 00:02:41.599 --> 00:02:41.919 Yeah. 00:02:41.919 --> 00:02:45.919 The hundred dollar hamburger is now what, a thousand dollar hamburger or more? 00:02:46.400 --> 00:02:47.520 Gas prices, it's ridiculous. 00:02:47.840 --> 00:02:48.879 Insurance prices. 00:02:49.039 --> 00:02:49.360 Yeah. 00:02:49.360 --> 00:02:51.680 Have you ever made a key for an airplane? 00:02:52.000 --> 00:02:53.520 Uh my own airplane. 00:02:53.840 --> 00:02:54.080 Nice. 00:02:54.080 --> 00:02:54.560 Okay. 00:02:54.719 --> 00:02:56.240 Yeah, you had a Cessna, right? 00:02:56.240 --> 00:02:58.479 Yeah, Cessna, a 1980-172. 00:02:58.719 --> 00:02:59.199 Oh, nice. 00:02:59.360 --> 00:03:06.560 So just get an early adopter of a glass panel, put uh Garmin stack in there before WAS was a thing. 00:03:06.719 --> 00:03:08.800 And let's do a little bit of a demo here. 00:03:08.800 --> 00:03:18.479 I mean, a lot of the time you spent at the office today, I know this is something that Eric Brown is also very passionate about and has been exciting and asking me to get on the podcast now for for quite some time. 00:03:18.479 --> 00:03:27.199 So today we're finally doing uh a little bit of a lockpicking demo, or maybe get some new folks interested in this this hobby, which seems synonymous with cybersecurity experts. 00:03:27.520 --> 00:03:28.960 Yeah, there's a lot of crossover. 00:03:28.960 --> 00:03:29.199 Yeah. 00:03:29.520 --> 00:03:30.319 Why is that? 00:03:31.280 --> 00:03:32.719 We like to break into stuff, I guess. 00:03:32.719 --> 00:03:35.439 It's a nefarious activity in all of us. 00:03:35.439 --> 00:03:37.520 I see a puzzle, and can I get in there? 00:03:37.520 --> 00:03:38.159 Can you get in? 00:03:38.159 --> 00:03:41.120 Eric came into our office, found a lot of puzzles. 00:03:41.120 --> 00:03:47.120 I think we did we we have um not not key access to the to the main space. 00:03:47.120 --> 00:03:49.840 We have um digital access with a card. 00:03:49.840 --> 00:03:53.840 So Eric's like, yeah, you know, I'll be there at like you know eight o'clock or whatever. 00:03:53.840 --> 00:03:57.360 And I think I'd kind of forgotten exactly what time he was coming. 00:03:57.360 --> 00:04:01.199 Next thing I know, he's standing in front of office because he got through the puzzle. 00:04:01.599 --> 00:04:03.280 After calling you, of course, and getting permission. 00:04:03.280 --> 00:04:04.000 Of course. 00:04:04.000 --> 00:04:07.599 And and you I think basically said, if you can do it, go for it. 00:04:07.599 --> 00:04:08.240 Go for it. 00:04:08.479 --> 00:04:09.520 That sounds about right. 00:04:09.520 -->
Load full transcript
00:04:15.520 So you've you've 3D printed some of these uh you can do with your hands instead of having to use a tool. 00:04:15.520 --> 00:04:20.399 Um, I actually got a little bit of time with you before we started today and and was successful a couple of times. 00:04:20.399 --> 00:04:21.439 Have you tried this yet, Eric? 00:04:21.600 --> 00:04:21.839 I have not. 00:04:22.000 --> 00:04:22.319 Do you want one? 00:04:22.319 --> 00:04:24.319 He's got one. 00:04:24.319 --> 00:04:25.600 Okay, yeah. 00:04:25.600 --> 00:04:26.079 Yeah. 00:04:26.079 --> 00:04:33.199 So yeah, for game night, I brought this particular demo of a lock and tried to describe lock picking. 00:04:33.199 --> 00:04:36.879 And um, you know, great, great model work. 00:04:36.879 --> 00:04:42.639 Appreciate the person who designed this, but I found I was actually I printed another one, so I'd have more than one for our show. 00:04:42.639 --> 00:04:44.240 And I've I found this model. 00:04:44.240 --> 00:04:46.240 Again, I should have let me interrupt. 00:04:46.319 --> 00:04:53.040 Just for our audio listeners, we're looking at 3D printed locksmithing um, I guess, puzzles, right? 00:04:53.040 --> 00:04:54.079 Yeah, yeah, yeah. 00:04:54.079 --> 00:04:55.120 And they're kind of gray. 00:04:55.120 --> 00:04:56.319 They got some red keys. 00:04:56.319 --> 00:05:01.439 We have some different pins here that you can insert and kind of create different combinations just for our audio. 00:05:01.439 --> 00:05:02.639 Yep, audio only listeners. 00:05:02.879 --> 00:05:07.120 It's a replica lock cylinder that is uh bigger than your fist. 00:05:07.120 --> 00:05:10.879 Uh, so you can actually pick the lock by sticking your fingers inside the keyway. 00:05:11.120 --> 00:05:11.360 Yeah. 00:05:11.360 --> 00:05:14.959 And and maybe just a quick level set on lock picking. 00:05:14.959 --> 00:05:27.360 The premise is you you have a key that you put into a lock, and and that key has ridges on it, and those ridges are raising pins to different heights in the lock. 00:05:27.360 --> 00:05:33.839 And when the heights are at the right level, they move the pins out of the way, and then you can freely turn the lock. 00:05:33.839 --> 00:05:43.199 And Eric, I know you can talk a lot about this, and there's different kinds of uh of locks that make it a lot more difficult to pick. 00:05:43.199 --> 00:05:53.439 But like if somebody were to go down to Home Depot and get the typical master lock with the blue ribbon around the bottom, are those relatively easy to get into? 00:05:53.920 --> 00:05:55.279 Uh, the padlocks, yes. 00:05:55.279 --> 00:05:55.519 Yeah. 00:05:55.519 --> 00:05:58.560 There's fewer pins, tolerances are so so. 00:05:58.560 --> 00:06:02.879 Um yeah, I think you did a pretty good description there, right? 00:06:02.879 --> 00:06:03.439 Cool. 00:06:03.439 --> 00:06:10.480 So traditional cylinder, uh, as you described, there's a key cut with particular depths. 00:06:10.480 --> 00:06:18.800 There's a matching set of pins in an inline row in in the lock that raises you and insert the key all the way. 00:06:18.800 --> 00:06:31.920 And uh, if you've got the right combination, then that uh stack of pins all line up with what we call the shear line, and that allows the plug to rotate inside of the of the lock body. 00:06:31.920 --> 00:06:45.120 Um so to pick a lock, what we're doing is we're taking advantage of the imperfections in the milling out of the of those stack of pins that that are lined up there. 00:06:45.120 --> 00:06:51.920 It's nearly impossible to get everything in atom for atom perfect row. 00:06:51.920 --> 00:06:57.920 You know, you're you're always gonna have the the drill profiles are gonna be just a little bit off center. 00:06:57.920 --> 00:07:10.720 And if you if you apply torsion uh to the face of the lock where the lock plug is, uh you can manipulate the pins and feel for which pin is gonna bind before another. 00:07:10.720 --> 00:07:18.639 Um and and that'll it will bind before another because you you can't really make a perfect row of drilling. 00:07:18.639 --> 00:07:26.079 So with a little bit of torsion on the lock cylinder, if you manipulate each pin, you'll find that one drags more than another. 00:07:26.079 --> 00:07:32.720 And if you manipulate it up just enough, you'll feel that friction change. 00:07:32.720 --> 00:07:36.240 And you essentially want to find the pin that's binding first, right? 00:07:36.240 --> 00:07:38.720 You you push up the binding pin. 00:07:38.720 --> 00:07:41.360 Um, you can kind of play with it with your finger. 00:07:41.360 --> 00:07:42.639 You want it to drop back down. 00:07:42.639 --> 00:07:47.120 If if it sticks also, then you know that you've got it stuck above the shear line. 00:07:47.120 --> 00:08:00.480 So if you're if you're pushing the pin that's binding to the point where when you let go, it still falls, you'll eventually drive the upper pin in the stack above the shear line and you can move on to the next pin that's binding. 00:08:00.480 --> 00:08:00.959 That's cool. 00:08:01.199 --> 00:08:03.600 I don't know if that no, that was for one of the listeners. 00:08:03.600 --> 00:08:04.399 That was amazing. 00:08:04.399 --> 00:08:04.639 Yeah. 00:08:04.639 --> 00:08:15.040 But this this particular model that you have allows you to get kind of simplified on that that concept and has four pins that are sitting in in kind of a into the uh what's it called? 00:08:15.040 --> 00:08:15.920 The tor the torsion. 00:08:15.920 --> 00:08:16.639 The key way. 00:08:16.639 --> 00:08:17.600 The key way, yeah. 00:08:18.160 --> 00:08:23.759 And maybe show that that thing there, because it's got a side cutout, the the red, the one with the red key in it. 00:08:23.920 --> 00:08:24.079 Yeah. 00:08:24.560 --> 00:08:27.360 You got another model here that's more of a traditional lock and key. 00:08:27.360 --> 00:08:28.959 It looks backwards there. 00:08:30.319 --> 00:08:33.120 It looks like the delay, that's
why it was backwards a minute ago. 00:08:33.120 --> 00:08:33.679 Yeah. 00:08:33.679 --> 00:08:36.080 There it is with the side profile. 00:08:36.080 --> 00:08:48.240 In a traditional lock picking here, you'd put some rotational tension with a tension tool on here, and you'd use another tool to reach in the lock and manipulate this stack of pins. 00:08:48.240 --> 00:08:48.879 Got it. 00:08:48.879 --> 00:08:49.120 Yeah. 00:08:49.120 --> 00:08:50.799 Josh got it. 00:08:52.159 --> 00:08:52.639 Nice. 00:08:52.639 --> 00:08:55.440 I'm gonna need this file to print it. 00:08:55.759 --> 00:08:56.080 Yeah. 00:08:56.080 --> 00:08:58.320 Maybe we could share that in the show notes today. 00:08:58.320 --> 00:08:58.720 Sure. 00:08:58.720 --> 00:09:02.399 Or maybe you could tell people where to find it if they're interested to have a 3D printer. 00:09:02.720 --> 00:09:04.720 Well, I'm using Bamboo Labs. 00:09:04.720 --> 00:09:13.919 I've got uh Carbon X1C, and um, in the Bamboo Labs software uh on the home tab, you can just search for Lockpick. 00:09:14.240 --> 00:09:16.080 Can we talk 3D printing for a second? 00:09:16.080 --> 00:09:16.559 Sure. 00:09:16.559 --> 00:09:21.039 So you have the like this has very fine lines in it, right? 00:09:21.039 --> 00:09:23.919 Uh and what's that type of printer called? 00:09:23.919 --> 00:09:26.399 Where it prints on top of itself? 00:09:26.399 --> 00:09:28.639 Uh FDM printing. 00:09:28.879 --> 00:09:31.039 And you're gonna make me remember that acronym. 00:09:31.039 --> 00:09:33.600 Filament something, something. 00:09:33.600 --> 00:09:34.480 It's okay. 00:09:34.480 --> 00:09:37.200 Um one of our 10 listeners or Google. 00:09:37.200 --> 00:09:39.200 Fused deposit modeling. 00:09:39.200 --> 00:09:39.759 Oh, nice. 00:09:39.759 --> 00:09:40.159 There we go. 00:09:40.159 --> 00:09:40.399 Okay. 00:09:40.399 --> 00:09:41.120 Deposition. 00:09:41.120 --> 00:09:42.240 I wouldn't have guessed that one. 00:09:42.480 --> 00:09:43.360 Fused deposition. 00:09:43.360 --> 00:09:45.279 So it kind of layers on itself. 00:09:45.279 --> 00:09:49.919 I I I I heard they were printing houses that way with concrete and and that type of thing, right? 00:09:50.000 --> 00:09:50.159 Yeah. 00:09:50.399 --> 00:09:56.639 But uh so that's one type, and then you have another resin type where it's kind of like dipped in the resin or something. 00:09:56.960 --> 00:09:57.279 Yep. 00:09:57.279 --> 00:10:06.480 So on on you have um like a plate or surface and you're using a like a video projector essentially to project an image out of that plate. 00:10:06.480 --> 00:10:14.320 It's using UV light, and the um printer's full of a fluid that uh the fuses when it's exposed to the UV light. 00:10:14.320 --> 00:10:18.720 So uh you you're projecting a picture while you slowly raise up. 00:10:18.720 --> 00:10:28.559 It's almost imagine a movie being shined on a screen that's that's sort of causing the liquid inside to fuse at those points where it made contact with the light. 00:10:28.559 --> 00:10:41.200 Um the models come out fairly sticky, and so you need to give them a wash uh and then set them under UV light or set them outside for an hour, and then then they'll cure more solid. 00:10:41.200 --> 00:10:48.000 Um because it's a video projection, um, just that that process, it it can be a much higher resolution. 00:10:48.159 --> 00:10:48.480 Yeah. 00:10:49.039 --> 00:10:53.279 Um and they're the the resolution on all these are getting better every year. 00:10:53.279 --> 00:10:58.080 Yeah, the the accuracy of the of the 3D printers itself. 00:10:58.080 --> 00:11:03.840 Their their ability to move to a coordinate and stop at an exact point, uh, is it's just phenomenal. 00:11:03.840 --> 00:11:07.759 They're and you can 3D print 3D printer. 00:11:07.759 --> 00:11:15.840 I think my first 3D printer was um the the idea was that you need vitamins. 00:11:15.840 --> 00:11:20.960 Those are the circuits and wires and and bearings and things like that. 00:11:20.960 --> 00:11:29.200 You'd you'd use vitamins, you'd feed vitamins into uh an existing 3D printer, and uh that that's how a new 3D printer was born. 00:11:29.200 --> 00:11:29.919 That's cool. 00:11:29.919 --> 00:11:40.399 Um I went to a local maker space and um printed the components for my 3D printer and uh assembled the vitamins and again being an early adopter there. 00:11:40.399 --> 00:11:44.000 Uh Joseph Prusso was still in high school at the time. 00:11:44.000 --> 00:11:47.440 Um some folks may know his name. 00:11:47.440 --> 00:11:50.320 He's well known in the in the rep rep community. 00:11:50.559 --> 00:11:52.960 Oh um Josh forgot to get him on the podcast. 00:11:53.120 --> 00:11:53.360 Yep. 00:11:53.679 --> 00:12:00.480 Well, Pro Prusso, isn't that one of the that's the one of the bigger printers that people use that you can print like you were talking about, printing your own printer. 00:12:00.480 --> 00:12:00.720 Yeah. 00:12:00.960 --> 00:12:01.440 Yep. 00:12:01.440 --> 00:12:22.000 So uh Joseph Proofsa would be uh at home at his parents or grandmother's place, and uh in the middle of the night for him, you know, it'd be my evening, but in the middle of the night for him, he'd be chatting on IRC and we could discuss how the print went or what would make a print better, or wouldn't it be nice if we had. 00:12:22.000 --> 00:12:25.519 And um early on he was a great you know, CAD person. 00:12:25.519 --> 00:12:31.120 So if you the in the early days of 3D printing, most of us didn't know CAD, but we liked assembling stuff. 00:12:31.120 --> 00:12:35.120 We could if we could borrow a printer, we could make stuff and and bolt stuff together. 00:12:35.120 --> 00:12:38.159 Uh learning the CAD skill is where it really got cool. 00:12:38.159 --> 00:12:50.000 Um you know, right now, if if you're just starting a 3D printing, you see something online like this lock we're looking at, and decide that you want one, you can get a 3D printer, take it home, download
the file, and you know, boom, you've got this thing. 00:12:50.000 --> 00:13:03.519 But it is so much more powerful when you imagine, wouldn't it be great if I had and could sit down with the software app and and draw it up and and then send it to the printer. 00:13:03.519 --> 00:13:08.960 That to me, that's very related to um AI as well. 00:13:08.960 --> 00:13:13.279 I think now you could probably have an idea that you want. 00:13:13.279 --> 00:13:19.200 If you can describe it to an AI agent, these large language models will generate the file for you. 00:13:19.200 --> 00:13:20.639 Now you can send that to your printer. 00:13:20.639 --> 00:13:26.320 So if you're a Star Trek fan, we're moving closer and closer to that idea of a replicator. 00:13:26.320 --> 00:13:27.039 Ah, nice. 00:13:27.200 --> 00:13:30.000 So now I know what I'm doing this weekend. 00:13:30.000 --> 00:13:31.279 Now you're printing. 00:13:31.279 --> 00:13:33.200 I have uh bamboo labs also. 00:13:33.200 --> 00:13:36.320 It's uh Eric probably knows it's a P1S, I think. 00:13:36.320 --> 00:13:37.039 Yep. 00:13:37.039 --> 00:13:47.519 Uh yeah, so but it's not uh I haven't been using it very much in the past, you know, few months, but now I've got a project for this weekend to work with uh Claude to think up something cool. 00:13:47.759 --> 00:13:48.639 Yep, fire it up. 00:13:48.879 --> 00:13:56.159 And Eric, are you seeing now in the lock picking industry being able to print keys to to maybe get through a certain lock? 00:13:56.559 --> 00:13:57.519 I have heard of that. 00:13:57.519 --> 00:14:00.320 I have not I've not attempted that myself. 00:14:00.320 --> 00:14:09.039 Uh uh a very high-quality lock is gonna have tolerances that are greater than that of most 3D printers. 00:14:09.039 --> 00:14:09.440 Oh, okay. 00:14:09.440 --> 00:14:14.960 But I say most 3D printers and most high-quality locks, there's always the middle ground there. 00:14:14.960 --> 00:14:32.399 If you have a um we shouldn't name names and quit you know, pick on them, but let's say something manufactured in a country starting with C that's in the blister pack at your local hardware store and costs less than 35 bucks, odds are the talents are really quite low. 00:14:32.399 --> 00:14:36.799 And sure, you take that to a 3D printer and make yourself a key. 00:14:36.799 --> 00:14:37.440 Right. 00:14:37.440 --> 00:14:38.480 I'll give you an example. 00:14:38.480 --> 00:14:54.720 If you want to open any luggage lock that's compatible with the TSA's plan, uh years ago, somebody took a picture of a TSA officer's keyring, made a couple measurements, and went, hey, I can replicate all those keys and and published a set of keys. 00:14:54.720 --> 00:15:02.000 So, you know, TSA 001 through TSA 014, uh just download and print it, and there you go. 00:15:02.240 --> 00:15:02.960 There you go. 00:15:03.600 --> 00:15:04.080 Wow. 00:15:04.080 --> 00:15:20.000 And of caution, anybody who has typical security or I would say lower security locks, if you have your keys exposed, if you leave them on the uh the the table at uh Chipotle, you guys had Chipotle for lunch, right? 00:15:20.000 --> 00:15:26.960 Um, leave your keys out on the table, um a quick photo and and you're done for. 00:15:27.279 --> 00:15:28.639 We're gonna share this comment real quick. 00:15:28.639 --> 00:15:37.039 Are we close to seeing AI-powered robotic lock picks that can decode a lock in seconds just by analyzing the acoustic or haptic feedback of the of the pins? 00:15:37.039 --> 00:15:37.919 That's interesting. 00:15:37.919 --> 00:15:39.279 We are well past that. 00:15:39.279 --> 00:15:39.919 Are we? 00:15:39.919 --> 00:15:42.480 Can you give us a little bit more context there? 00:15:42.480 --> 00:15:44.720 A little bit more uh what's going on? 00:15:45.840 --> 00:15:46.399 Sure. 00:15:46.399 --> 00:15:54.879 Um we have micro cameras that are the cameras essentially the size of the key. 00:15:54.879 --> 00:16:00.399 So you you just basically are shooting a video as you put your key into the lock. 00:16:00.399 --> 00:16:09.519 And certain locks have been designed in a way where if if you could be small and be inside and look in a particular direction, you can actually see in in particular. 00:16:09.519 --> 00:16:12.799 I'm talking about those keys that allow you to re-key them yourselves. 00:16:12.799 --> 00:16:39.759 You may have one, I think both Schlag and uh QuickSet have this where you you you put in the key that works right now, and then you insert another tool, uh rotate the lock to a certain position, allows you to pull out your old key and then put in the new key that you want to be the key for your house, and then you pull out that special pin and and reset the lock, and now the lock's been re-keyed without hiring a locksmith. 00:16:39.759 --> 00:16:40.639 It it's good to go. 00:16:40.639 --> 00:16:47.200 Well, the the design of that has a bunch of serrated uh columns essentially. 00:16:47.200 --> 00:16:52.320 When you're when you're inserting the tool, you're separating the serrated columns so you can you can realign the points. 00:16:52.320 --> 00:16:55.360 When you insert the new key, that that's how everything kind of lines up. 00:16:55.360 --> 00:17:09.279 Anyhow, there's um there's now an app and a camera where you just slide that into the lock, and then I can go back to my machine and say, cut my one of these five three five one threes and uh you know I've I've got the new key. 00:17:10.960 --> 00:17:34.720 With with that vibration question and and kind of continuing on with what Eric was talking about, I I had read somewhere maybe a couple of years ago that they were able to pick up the vibration off of the glass using like a la laser from far away and be able to reinterpret what the conversation was from the sound waves that resonated on the glass. 00:17:34.720 --> 00:17:49.519 And then I think maybe it was two years ago, I saw that by listening to the sound of a rotating hard
drive, the way the heads moved across the platter, they could recreate what some of the data was. 00:17:49.519 --> 00:17:51.680 So that that's interesting. 00:17:52.000 --> 00:18:12.319 That reminds me of that Operation Ghost Murmur where they found the guy in Iran, the pilot using AI to listen for his heartbeat, and they probably had his personal heartbeat signature on some uh kind of uh of a info sheet and compared it to what they were listening to in the environment in front of them. 00:18:12.720 --> 00:18:15.680 But yeah, uh you've probably seen the mapping with Wi-Fi also. 00:18:15.680 --> 00:18:16.240 Yeah. 00:18:16.240 --> 00:18:17.200 Another one. 00:18:17.200 --> 00:18:19.200 There's quite a few things like that. 00:18:19.200 --> 00:18:21.119 I I don't know how practical it is. 00:18:21.119 --> 00:18:23.440 I I don't fear that a whole lot. 00:18:24.240 --> 00:18:24.960 What's Eric? 00:18:24.960 --> 00:18:33.039 So one of the things that maybe you've seen that's kind of crazy when you get called out to say, you know, like, oh hey, I can't get into whatever, and they call you out. 00:18:33.039 --> 00:18:38.640 You've you've had to show up and there's some weirdness going on or something interesting. 00:18:38.640 --> 00:18:42.240 Yeah. 00:18:42.240 --> 00:18:46.799 Eric, didn't you tell me that for game night we were going to break into somebody's car? 00:18:46.799 --> 00:18:48.240 A volunteer's car. 00:18:48.240 --> 00:18:48.559 Right. 00:18:48.559 --> 00:18:49.039 Right? 00:18:49.039 --> 00:18:49.759 We're gonna do that. 00:18:49.759 --> 00:18:50.160 Sure. 00:18:50.160 --> 00:18:51.839 Are you volunteering now? 00:18:51.839 --> 00:18:59.759 That's a cool story that that you know, I think most people don't know the capabilities of what a locksmith can do. 00:18:59.759 --> 00:19:05.359 And you can get into just about anything with the right tools and equipment, right? 00:19:05.599 --> 00:19:05.759 Sure. 00:19:05.759 --> 00:19:07.920 And there's different specialties as well. 00:19:07.920 --> 00:19:09.920 So I I specialize in automotive. 00:19:09.920 --> 00:19:14.160 Um, I've got friends that are in the commercial lock and safe sort of business. 00:19:14.160 --> 00:19:16.000 Safes are another good example. 00:19:16.000 --> 00:19:19.200 You you mentioned the robotic, you know, can you open a lock? 00:19:19.200 --> 00:19:21.920 There, there's a device called the soft drill. 00:19:21.920 --> 00:19:24.400 Everybody's Googling for that one as well. 00:19:24.400 --> 00:19:28.880 Those are um are very rare to find now. 00:19:28.880 --> 00:19:31.599 The manufacturer basically said I sold enough of these. 00:19:31.599 --> 00:19:40.640 I think uh certain agencies of our government that may or may not have three or four letter acronyms uh kind of controlled that because they're very good. 00:19:40.640 --> 00:19:47.519 Safe manipulation uh is is a skill that you can learn, and so can robots. 00:19:47.519 --> 00:19:56.160 And so the soft drill can open a
safe much, much faster than um than most people need to be able to open a safe. 00:19:56.160 --> 00:20:00.160 Uh if you're a locksmith, of course, you're making money if you fix price to open a safe, right? 00:20:00.160 --> 00:20:05.279 You'd you'd rather be gone in 15 minutes and make a boatload of money than attach a machine and wait 13 hours. 00:20:05.279 --> 00:20:09.279 But um there's a TL2000 dialer. 00:20:09.279 --> 00:20:12.160 Most of the safe people that I know are are using that. 00:20:12.160 --> 00:20:18.799 That literally just manipulates every combination until it senses the lock is open and it stops. 00:20:18.799 --> 00:20:26.559 Um but for electronic safes, you most of the electronics are inside the safe, just the battery and the keypad is on the outside. 00:20:26.559 --> 00:20:30.160 There are devices on the market that will plug into the keypad bus. 00:20:30.160 --> 00:20:35.119 And uh, you know, five, four, three, two, one, she's open. 00:20:35.519 --> 00:20:41.279 Looks like peep people are making uh these uh soft drill brushes by using a uh electronic toothbrush. 00:20:41.279 --> 00:20:42.160 Different thing. 00:20:42.160 --> 00:20:42.880 Totally different thing. 00:20:42.880 --> 00:20:43.359 Okay. 00:20:43.359 --> 00:20:46.720 It looks like this is a lockpicking mechanism, though, yeah. 00:20:46.960 --> 00:20:47.200 Yeah, yeah. 00:20:47.200 --> 00:20:58.559 The the soft drill has a um a microphone and a uh servo with feedback that attaches to the dial on the safe. 00:20:58.559 --> 00:21:14.000 And it it will swing the dial around, listening to the acoustics, and can detect when components within the lock are bumping other components within the lock that allows it to decipher how things are aligned. 00:21:14.000 --> 00:21:21.599 If you know how things are aligned and where where the contact points are, uh it very quickly knows, like, okay, here's the combination. 00:21:21.920 --> 00:21:24.160 I gotta I gotta start hold that thought, Eric. 00:21:24.160 --> 00:21:25.119 I gotta share this comment. 00:21:25.119 --> 00:21:30.160 This is my this is why my door has uh porticules and draw bars installing a drawbridge next year. 00:21:30.160 --> 00:21:31.759 That's from Faye 9915. 00:21:32.480 --> 00:21:34.079 Faye's a regular listener, I think. 00:21:34.319 --> 00:21:36.319 Yeah, we'll get to all your questions, but Eric, you had to do it. 00:21:36.480 --> 00:21:37.039 Yeah, no, I did. 00:21:37.039 --> 00:21:38.960 So with Eric Hotel Safe, right? 00:21:38.960 --> 00:21:50.480 Like you go into the hotel and I think there's a Darknet Diaries episode where the guy um was a poker player and um they they got his laptop and installed some stuff on it and what have you. 00:21:50.480 --> 00:21:54.559 But it how do those is that just an illusion of safety? 00:21:54.799 --> 00:22:02.799 Uh yeah, if if that a lot of the safes in hotels are You know, bulk manufactured, another country starting with C. 00:22:02.799 --> 00:22:04.720 Maybe that other one, same one. 00:22:04.720 --> 00:22:08.000 Uh many of these are opened with just a uh a magnet. 00:22:08.000 --> 00:22:11.920 You know, there's there's an electromagnet inside of it to release the lock. 00:22:11.920 --> 00:22:12.960 Carry a big fish. 00:22:12.960 --> 00:22:14.000 You can go fishing. 00:22:14.000 --> 00:22:17.759 You can you can do magnet fishing. 00:22:17.759 --> 00:22:19.039 The lake fishing. 00:22:19.039 --> 00:22:21.680 You just drag a large magnet behind your boat. 00:22:22.160 --> 00:22:25.839 You go like go over a bridge and drop it down on the rope and yeah. 00:22:26.240 --> 00:22:26.799 Yeah, totally. 00:22:26.799 --> 00:22:35.839 But you could you can pick up all the the safes and the firearms and the every other piece of metal that's discarded in the middle of the night over a bridge. 00:22:35.839 --> 00:22:37.599 Have you guys done this? 00:22:38.079 --> 00:22:39.920 Eric's acting like he hasn't done it before. 00:22:39.920 --> 00:22:42.480 That's the kind of fishing that might be might be interesting. 00:22:42.880 --> 00:22:44.720 We may have to do an expedition this summer, Eric. 00:22:44.720 --> 00:22:58.799 I uh now I've scuba dived, and when when I was scuba diving uh in in rivers, like this is you know back in high school, they would say if you see a um bag underwater, do not open the bag. 00:22:58.799 --> 00:23:02.480 Um because you're not you're probably not gonna like what you find. 00:23:02.480 --> 00:23:04.000 We we found a bag. 00:23:04.000 --> 00:23:06.319 We did not adhere to the guidelines. 00:23:06.319 --> 00:23:10.160 We opened the bag and it was just full of sand from a construction thing. 00:23:10.160 --> 00:23:10.799 Uh okay. 00:23:10.960 --> 00:23:11.920 Sandbag. 00:23:11.920 --> 00:23:15.359 We got another question here if that the that's okay. 00:23:15.359 --> 00:23:17.839 Um this is again from Joshua Morgan Goldstein. 00:23:17.839 --> 00:23:27.519 Comparing something like a minimalist Volvo to a high performance Porsche, who is winning the digital arms race against the uh against relay attacks and the key cloning, or are they both wide open to the exploits? 00:23:27.920 --> 00:23:30.480 Volvo's ahead, I would I would say. 00:23:30.480 --> 00:23:37.039 Um and I would say European vehicles in general are far ahead of domestic vehicles. 00:23:37.039 --> 00:23:39.119 Why why is that? 00:23:39.119 --> 00:23:56.640 Yeah, so uh typical key for a domestic or Asian vehicle, there's a serial number burned into the key, and during a programming session, we tell the car, okay, now I want you to trust this key, and uh the process is done. 00:23:56.640 --> 00:24:06.640 In a typical European vehicle, we have public-private key encryption and challenge response algorithms going on between multiple computers in the vehicle. 00:24:06.640 --> 00:24:13.680 Your key contains a private key burned into the the chip itself at the factory. 00:24:13.680 --> 00:24:24.319 And um, if if I as a cyber security auto
locksmith open up the computers and get in there, I can extract the public key. 00:24:24.319 --> 00:24:26.880 Uh gee, what am I gonna do with that now? 00:24:26.880 --> 00:24:31.200 I mean it I I I I call it public key, but it's a little different, right? 00:24:31.200 --> 00:24:34.000 You've we've got an asymmetric key pair. 00:24:34.000 --> 00:24:43.680 Um but there's a lot of brute force cyber work necessary in order to come up with the matching key that's gonna make those handshakes work between those modules. 00:24:43.680 --> 00:24:49.359 So when you make a key to your uh we'll give Audi some credit here. 00:24:49.359 --> 00:24:59.200 When you go to Audi and order a key for the $600, they are just putting the order in the assembly line and you know, out comes a blank key. 00:24:59.200 --> 00:25:05.359 They write the codes that they knew when they built the car and its key and they send it to you in a huge profit margin. 00:25:05.359 --> 00:25:10.720 When I get the call to make a key to your Audi, you don't want to watch. 00:25:10.720 --> 00:25:12.400 It's like making sausage. 00:25:12.400 --> 00:25:14.720 Just look the other way, I'll be done in four hours. 00:25:14.720 --> 00:25:25.920 Um we're gonna open up those computers, peel back the metal on the cans for for for some of the more difficult ones, uh, desolder certain integrated circuits. 00:25:25.920 --> 00:25:34.480 We're gonna do the things we need to do to get uh MCUs or EE proms to dump their goodies. 00:25:34.480 --> 00:25:36.799 Those goodies are gonna go up into the cloud. 00:25:36.799 --> 00:25:46.400 I have subscriptions for products that also came from a company man manufactured it in a country with starts with C or R. 00:25:46.400 --> 00:25:47.920 They're very good at their work too. 00:25:47.920 --> 00:26:02.000 Um we're essentially reverse engineering the security mechanisms on the hardware and then brute forcing those keys in order to come up with the secret in your key. 00:26:02.559 --> 00:26:11.759 It seems that the Volkswagen group actually owns Audi Porsche and other brands like Lamborghini and Bentley. 00:26:11.759 --> 00:26:12.400 Yeah. 00:26:12.400 --> 00:26:17.680 So if you're getting a Lamborghini, it's the same thing as a Volkswagen. 00:26:17.680 --> 00:26:18.480 Same thing. 00:26:18.960 --> 00:26:24.480 Some of these cars that you might call exotic cars, the ones you expect to have the best security. 00:26:24.480 --> 00:26:25.680 Yeah. 00:26:25.680 --> 00:26:30.319 It's they put all the money in the in the paint and the polish and the delivery. 00:26:30.640 --> 00:26:31.119 Nice. 00:26:31.119 --> 00:26:35.200 So, Eric, you're telling me my F-150 key is pretty easy to clone? 00:26:35.839 --> 00:26:41.279 Until 2021, when Ford totally uh changed how they go about things. 00:26:41.279 --> 00:26:44.319 Um I have a 2021 Ford F-150. 00:26:44.319 --> 00:26:52.000 The um electrical system was modeled after the Mach E, and the Mach E was designed to sort of compete with the Tesla. 00:26:52.000 --> 00:26:56.480 That was the beginning of uh self-driving and you know, much more modern architecture. 00:26:56.480 --> 00:27:04.799 So the the process requires factory tools and um a VSP, uh vehicle security professional certification from NASA. 00:27:04.799 --> 00:27:12.799 Uh Ford restricts access to those functions to folks that are vetted with uh licensing insurance and and so on. 00:27:12.799 --> 00:27:16.319 And then in 2025, it gets even more interesting. 00:27:16.319 --> 00:27:19.200 They introduced encryption between all the modules. 00:27:19.200 --> 00:27:22.000 And so um I have a self-driving vehicle. 00:27:22.000 --> 00:27:30.160 I I bought the Ford for the Blue Crews and the ability to do self-driving, but um didn't like the idea of paying the subscription fee. 00:27:30.160 --> 00:27:37.680 And there were new features that weren't available for my older vehicle, so I've got a comma AI and I run blue pilot software. 00:27:37.680 --> 00:27:38.640 That's a whole plug. 00:27:38.640 --> 00:27:40.880 But yeah, I've heard of that. 00:27:40.880 --> 00:27:42.480 I've heard of that. 00:27:43.279 --> 00:27:45.519 Who's the guy that started comma AI? 00:27:46.079 --> 00:27:50.160 Uh I can picture him and I'll walk right up to him at DEF CON and say, hey, how's it going? 00:27:50.160 --> 00:27:52.799 Yeah, but I cannot remember his name right offhand. 00:27:53.119 --> 00:27:56.799 Didn't Musk try to hire him or something, or he worked over there for a little bit? 00:27:56.799 --> 00:27:58.480 George Hotz or that's what it is. 00:27:58.480 --> 00:27:58.880 Yeah. 00:27:58.880 --> 00:28:00.160 Yeah, GeoHotz. 00:28:00.160 --> 00:28:00.960 Yes, John. 00:28:00.960 --> 00:28:02.880 So how do you like the comma AI? 00:28:02.880 --> 00:28:05.759 Because you just plug that into the bus, right? 00:28:06.000 --> 00:28:08.400 Yeah, it works on a number of vehicles. 00:28:08.400 --> 00:28:10.480 Um, so check it out. 00:28:10.480 --> 00:28:12.480 You don't have to have a Ford F-150. 00:28:12.480 --> 00:28:16.720 Um and and primarily he's doing hardware sales, right? 00:28:16.720 --> 00:28:19.039 And then promoting the idea of software development. 00:28:19.039 --> 00:28:26.960 Um there is open pilot, which is the the generic uh driving module for does things a little differently. 00:28:26.960 --> 00:28:30.400 So we've got blue pilot, a fork of that code. 00:28:30.400 --> 00:28:37.200 Uh, but yeah, the the wonderful thing about it um is that it will plot a course through whatever it sees. 00:28:37.200 --> 00:28:46.400 If if your truck ends up in a cornfield and you kind of want to go that way, um you can turn on cruise control and keep driving through the cornfield. 00:28:46.400 --> 00:28:50.000 Set your speed and you know, pay attention to the road, right? 00:28:50.000 --> 00:28:53.279 If you look off the road, the thing will uh refuse to drive for you. 00:28:53.279 --> 00:28:55.839 Um But but there's probably hacks around there.
00:28:56.079 --> 00:29:18.079 A buddy of mine's an airline pilot, and he he said that there's some some some of his other pilots that, you know, they're they're home-based in say Minnesota, but they live way far away, like way up north somewhere, and they've got to commute from way up north wherever they live down to MSP for you know their you know, their shift. 00:29:18.079 --> 00:29:22.720 And sometimes they'll come back, you know, late at night or whatever, and then need to go home. 00:29:22.720 --> 00:29:29.119 They have this comma AI system, and like they're sleeping on the way home. 00:29:29.119 --> 00:29:34.319 And I mean, this is hearsay through hearsay, but yeah, it's uh it's interesting. 00:29:35.039 --> 00:29:37.200 There's a there's another whole talk there, I'm sure. 00:29:37.200 --> 00:29:37.599 Yes. 00:29:37.599 --> 00:29:39.279 There are separate teams. 00:29:39.279 --> 00:29:42.799 There's a camera that watches the driver, and then there's the camera that watches the road. 00:29:42.799 --> 00:29:50.640 In fact, multiple cameras watching the road, but the camera that watches the driver, it is open source, you could theoretically manipulate that. 00:29:50.640 --> 00:29:59.839 Um they have a practice of monitoring for all forks, and the hardware is designed by default to pull from your GitHub repo. 00:29:59.839 --> 00:30:01.200 Give it a URL. 00:30:01.200 --> 00:30:15.119 There are some safety mechanisms in there, and if you attempt to bypass the safety mechanisms, the community will attempt to bypass you because that's not good for safety in general. 00:30:15.119 --> 00:30:21.680 And the last thing any of us want are regulators deciding that they know best for us. 00:30:22.559 --> 00:30:25.119 We had tinfoil hat coming on here, guys. 00:30:25.119 --> 00:30:25.759 Here we go. 00:30:25.759 --> 00:30:26.720 Here we go. 00:30:26.720 --> 00:30:41.920 Uh I mean, this has been kind of brewing in the background, but it looks like there's just been some legislation passed driven by the 2021 Infrastructure Investment and Jobs Act, requires automakers to install advanced impaired driving prevention technology in all new passenger vehicles. 00:30:41.920 --> 00:30:55.519 The mandate directs the NHTSA to finalize rules require built-in passive monitoring systems such as cameras and sensors to detect driver impairment fatigue and distraction with the authority to limit and prevent vehicle uh operation. 00:30:55.519 --> 00:30:58.319 So uh I've been seeing this a lot on YouTube. 00:30:58.319 --> 00:31:02.640 There's been a lot of commentary on this, and in most of it negative, as you can imagine. 00:31:02.640 --> 00:31:04.240 Where do you guys kind of fall? 00:31:04.240 --> 00:31:06.079 I I kind of see both sides, right? 00:31:06.079 --> 00:31:08.799 No one wants to be we want to we want to be free, right? 00:31:08.799 --> 00:31:17.599 We want to be able to get into our car and we don't want to get shut down because we didn't get very good sleep that night or we had a cold or something like that, not be able to go where we want to go. 00:31:17.599 --> 00:31:22.960 But also, we've all seen these terrible drivers on the road that have no business being behind the wheel. 00:31:22.960 --> 00:31:25.599 And it would be great to take them off the road. 00:31:25.599 --> 00:31:28.160 So uh where do you guys fall on this one? 00:31:28.160 --> 00:31:29.759 Kind of as the intersection. 00:31:29.759 --> 00:31:32.480 Maybe this is our our transition to AI, right? 00:31:32.799 --> 00:31:35.519 Or or gun control or any other uh topic. 00:31:35.519 --> 00:31:37.279 Don't get us into that. 00:31:37.279 --> 00:31:39.440 I eyes expanding in the room. 00:31:40.079 --> 00:31:44.160 I think I think a lot of people are just getting a piece of electrical tape to go over the camera. 00:31:45.680 --> 00:31:47.599 It will stop driving at that point. 00:31:47.599 --> 00:31:51.200 Um you're for it or are you against it? 00:31:51.359 --> 00:31:52.880 That's that's kind of what I'm looking for here. 00:31:53.200 --> 00:31:53.680 Yes. 00:31:53.680 --> 00:31:54.640 Exactly. 00:31:54.640 --> 00:31:56.079 Yes. 00:31:56.079 --> 00:32:06.880 I I think that uh taking advantage of where technology has led us is is a great thing in general. 00:32:06.880 --> 00:32:13.039 Um I I think like a lot of laws, they're great when they apply to everybody but me. 00:32:13.039 --> 00:32:16.559 Rules for thee and not for me, huh? 00:32:16.559 --> 00:32:17.119 Yeah. 00:32:17.119 --> 00:32:19.200 So I don't know, right? 00:32:19.200 --> 00:32:21.200 I'm I I'm a libertarian. 00:32:21.200 --> 00:32:24.000 I I definitely support our freedoms. 00:32:24.000 --> 00:32:26.880 I don't have to even mention Second Amendment or anything else. 00:32:26.880 --> 00:32:27.920 I've said enough. 00:32:27.920 --> 00:32:32.400 Um I think that uh the technology is incredible. 00:32:34.640 --> 00:32:38.000 And I think it's walking on eggshells. 00:32:38.000 --> 00:32:39.920 I think it's I think it's a good idea for most. 00:32:41.039 --> 00:32:42.640 Nick, do you want to weigh in on this, Mr. 00:32:42.640 --> 00:32:43.039 Marine? 00:32:43.359 --> 00:32:45.839 Let's make it heckable and then I'm cool with it. 00:32:45.839 --> 00:32:53.599 No, I kind of go both ways too, honestly, because you know, if somebody's impaired driving, I certainly don't want them on the road if I'm on out there with my family, right? 00:32:53.599 --> 00:32:55.839 So that's the the logical thinking. 00:32:55.839 --> 00:33:02.559 But I certainly don't want my space, you know, invaded if I'm getting in the truck to run across the street to the grocery store. 00:33:02.559 --> 00:33:05.759 So I guess overall, if I had to pick, I'd say I'm against it. 00:33:06.079 --> 00:33:06.160 Yeah. 00:33:06.480 --> 00:33:08.319 Eric Brown, you got some thoughts on this. 00:33:08.319 --> 00:33:09.440 I I've been curious. 00:33:09.920 --> 00:33:10.480 I do. 00:33:10.480 --> 00:33:12.960 Um what were they?
00:33:12.960 --> 00:33:14.960 I was distracted by the headphones here. 00:33:14.960 --> 00:33:16.720 About about being monitored in your vehicle. 00:33:16.720 --> 00:33:17.359 Oh, yeah. 00:33:17.359 --> 00:33:19.200 Well, so okay. 00:33:19.200 --> 00:33:41.359 I uh we've got a client that some of the people in the organization are refusing to take phishing training and they are still clicking on phishing emails, but then when they're told about it, they're like, oh yeah, I I clicked on it on purpose because it was, you know, I whatever, right? 00:33:41.359 --> 00:33:42.240 It's some excuse. 00:33:42.240 --> 00:33:43.759 And it's like just owning it, huh? 00:33:43.759 --> 00:34:07.920 Yeah, just so you know, when you have people like that that, you know, with that mentality in the public space, I I would want some sort of guidelines and structure so that, you know, I know somebody just didn't homebrew something in their garage and now they're ripping down the road at 110 and like, oh whoops, I forgot, you know, to put this on. 00:34:07.920 --> 00:34:18.079 It's, you know, I I kind of go to the aviation community that has been using autopilot for decades and it works really well. 00:34:18.079 --> 00:34:26.079 And and there's been refinements with terrain avoidance over the years and air traffic control, and it's gotten better and better. 00:34:26.079 --> 00:34:33.599 But you know, you you really could not fly in instrument meteorological conditions without autopilot. 00:34:33.599 --> 00:34:40.880 Like it's strictly it's simply safer like to to fly with with autopilot, because you can get spatial disorientation. 00:34:40.880 --> 00:34:54.079 You know, if you're if you're flying in the clouds and you're getting you know buffeted around from um weather and you've got rain or snow or whatever coming in, um there's a lot of environmental distractions. 00:34:54.079 --> 00:35:07.119 And if you're trying to fly the plane or you're getting bounced around and you know, trying to figure out where the horizon is, and your vestibular system is telling you you're in a turn, but you're really not. 00:35:07.119 --> 00:35:08.719 So you're you're straightening that out. 00:35:08.719 --> 00:35:13.360 You know, it's just it it's what happened with JFK Um Jr. 00:35:13.360 --> 00:35:17.840 up in the Cape, you know, where he where he kind of who was not instrument rated. 00:35:17.840 --> 00:35:27.519 So he he he probably wasn't aware of all of these things that can happen, but you you really want to be on the instrument system and and you want to be relying on the plane to to fly itself. 00:35:27.519 --> 00:35:30.400 And you know, we've been doing this for years in in aviation. 00:35:30.400 --> 00:35:32.480 So I would love to see it on the roads. 00:35:32.480 --> 00:35:37.840 The experience that I I have with it is it's a better driver than most. 00:35:37.840 --> 00:35:38.800 It's safer. 00:35:38.880 --> 00:35:45.679 Aaron Powell That's a little different than uh being monitored, right, in your vehicle, like having a having a self-driving car or an automated driver. 00:35:46.159 --> 00:35:48.159 I think it's because that's where we're at level two today. 00:35:48.159 --> 00:35:54.159 But when we get to like level, what is it, four where we don't, you know, that you don't need the monitoring because the system's better than you are. 00:35:54.639 --> 00:36:02.079 Um that's actually a question in the chat about um when are we going to get to level five? 00:36:02.639 --> 00:36:05.519 I hope it's Eric, how far away are we from level five? 00:36:06.159 --> 00:36:06.800 Ten years. 00:36:06.800 --> 00:36:11.840 Early adapters six, general population fifteen? 00:36:12.159 --> 00:36:14.400 It it the technology is probably close. 00:36:14.400 --> 00:36:15.840 It's just all the regulations. 00:36:15.840 --> 00:36:19.119 And then there's that conversation of who's responsible if something goes wrong. 00:36:19.360 --> 00:36:19.519 Yeah. 00:36:19.519 --> 00:36:21.199 The the litigious side of it. 00:36:21.199 --> 00:36:26.320 And then when we're gonna get into smart contracts and all of that sort of stuff, which is just a different conversation. 00:36:26.320 --> 00:36:30.800 But I I don't know, is the technology six and then the legislation's 10? 00:36:31.679 --> 00:36:35.679 Yeah, I'm I'm I can't predict what legislation's gonna be up to. 00:36:35.679 --> 00:36:44.320 I I was thinking we can pivot right to privacy and talk about AI here as well, the private cloud. 00:36:44.320 --> 00:36:46.800 Yeah. 00:36:47.039 --> 00:36:49.519 Do we want to cut this one in do a double episode? 00:36:49.519 --> 00:36:50.559 Double it up. 00:36:50.559 --> 00:36:51.599 Let's keep going. 00:36:51.840 --> 00:36:56.400 I think when we're talking about the the monitoring of drivers, right? 00:36:56.400 --> 00:37:03.119 If if that is totally a local thing and that data is my data, it's not going anywhere. 00:37:03.119 --> 00:37:06.000 It's just my cars keeping me safe. 00:37:06.000 --> 00:37:11.360 And I have the option to override, you know, like that. 00:37:11.360 --> 00:37:13.119 It's a safety feature that's built in. 00:37:13.119 --> 00:37:13.760 We all have it. 00:37:13.760 --> 00:37:23.280 And when the thing says you're not safe to drive, um, if I can go on the record saying I think I was safe to drive, I'm more cool with it if it's totally local. 00:37:23.280 --> 00:37:26.719 But I already do not like the telemetry that's in a lot of vehicles. 00:37:26.960 --> 00:37:29.440 You're saying, and that's a sober, that's a sober take. 00:37:29.679 --> 00:37:37.760 Yeah, I mean, you're your cars today are are sharing a lot of data with the manufacturer because manufacturers are selling that data. 00:37:37.760 --> 00:37:38.320 Sure. 00:37:38.320 --> 00:37:42.079 Um, you know, how many of us are Google customers? 00:37:42.079 --> 00:37:47.840 Uh and and I say that because you know, if you're not paying them, you're the you're the product, not the
customer. 00:37:47.840 --> 00:37:53.679 I I I love the things that are built into my phone and integrated in my car, which is nice as well. 00:37:53.679 --> 00:37:58.159 You know, I had this uh had this appointment to come here for for the podcast, right? 00:37:58.159 --> 00:38:01.199 I I got in my truck and it knew where I wanted to go. 00:38:01.199 --> 00:38:08.079 I just kind of hit the button and then turned on reverse control in my driveway and and it was a fun, safe drive. 00:38:08.079 --> 00:38:16.800 But um Google knows where I'm going and follows everybody else around, and that data's useful, so that I I took the best route. 00:38:16.800 --> 00:38:19.840 If there was a traffic jam somewhere, we we went around it. 00:38:19.840 --> 00:38:22.239 So it's it's the love-hate thing. 00:38:22.239 --> 00:38:24.400 Um, and I'm rambling on a little bit, right? 00:38:24.400 --> 00:38:30.480 But I I don't like that car manufacturers are keeping tabs to the extent that they are. 00:38:30.480 --> 00:38:37.360 Um, that when you buy a car now uh buried in that mountain of paperwork, it's worse than closing out a house. 00:38:37.360 --> 00:38:39.119 And and I've done both recently. 00:38:39.119 --> 00:38:46.000 Um it there there's a license agreement with your car, and you don't necessarily own the software. 00:38:46.000 --> 00:38:52.880 And if you turn off the telematics, you've just ended your warranty after 45 days and and some other interesting things like that. 00:38:53.039 --> 00:38:54.559 So I don't like that. 00:38:54.719 --> 00:38:55.360 I don't like that. 00:38:55.360 --> 00:38:56.880 So you could ride a bike. 00:38:57.920 --> 00:39:00.079 Or I could buy an old used car for now. 00:39:00.079 --> 00:39:01.360 What kind of bike do you have? 00:39:01.360 --> 00:39:02.159 I don't have a bike. 00:39:02.159 --> 00:39:05.679 Yeah, you might get the telemetry to your bike uh motor. 00:39:06.000 --> 00:39:08.719 Do you want to pedal yourself or are you gonna hit the go button? 00:39:08.719 --> 00:39:09.679 The go button. 00:39:09.679 --> 00:39:09.920 Okay. 00:39:10.159 --> 00:39:11.599 It's like plow schwab. 00:39:11.599 --> 00:39:15.199 If I put my tinfoil hat back on, uh, you will own nothing and you will be happy. 00:39:15.519 --> 00:39:19.760 I I did have a locksmith question for you around the European cars you were saying. 00:39:19.760 --> 00:39:27.440 Every time I walk into Costco, and Costco's getting ridiculous now, which is a whole nother thing, but every time you go in there, you're getting accosted by these people. 00:39:27.440 --> 00:39:35.920 Like it's either phone or I think last weekend I I went in there and like they're they're trying to like, you know, can can we clone your key or make a copy of your key? 00:39:35.920 --> 00:39:41.679 And uh you can barely walk past them and they're like, you know, they're trying to flag you now, which is ridiculous. 00:39:41.679 --> 00:39:46.719 But um, how are they doing that with the if if people have European cars? 00:39:46.800 --> 00:39:48.880 Aaron Ross Powell They they don't actually work for Costco. 00:39:48.880 --> 00:39:54.000 They're they're just a third-party vendor that that finds their locations convenient to work in. 00:39:54.000 --> 00:39:55.920 I'm gonna have to go to Sam's Club, I guess. 00:39:55.920 --> 00:40:05.599 Those folks have access to I mean they've got insurance, they've they've got training, I mean, they're able to get access to some of the same tools. 00:40:05.599 --> 00:40:06.079 I see. 00:40:06.079 --> 00:40:08.400 I don't think they're on quite the same level. 00:40:08.400 --> 00:40:21.440 Very few of the folks standing around in uh Costco are cybersecurity guys who play with microcontrollers that understand, you know, public-private key encryption and what the process is. 00:40:21.440 --> 00:40:25.599 They're I don't want to know somebody, but no, they're just following the colour. 00:40:25.599 --> 00:40:26.719 Yeah. 00:40:26.719 --> 00:40:31.679 Yeah, the majority are opening the app and logging in and clicking next and next and next. 00:40:32.079 --> 00:40:35.519 And you can cut your own keys now at Home Depot, I saw, right? 00:40:35.519 --> 00:40:40.480 Like you just walk up to the machine, you put your old one in, and the whole robotic process does it. 00:40:40.639 --> 00:40:40.960 Yeah. 00:40:40.960 --> 00:40:42.400 Let's get in there. 00:40:42.400 --> 00:40:47.519 Take a picture, it determines what the cuts are and runs the machine. 00:40:47.519 --> 00:40:50.000 My machines are that way now as as well. 00:40:50.000 --> 00:40:58.159 I take high-resolution pictures of keys, uh, goes up to a database and says, okay, what should this key have been? 00:40:58.159 --> 00:41:07.039 Um and then sends it to the key cutter, which is basically a C and C machine that that cuts with absolute precision, you know, built for that. 00:41:07.039 --> 00:41:08.480 It's it's kind of cool. 00:41:08.480 --> 00:41:10.559 Um, I've I've worked on brand new vehicles. 00:41:10.559 --> 00:41:15.599 Someone's getting the third key because their you know, kid is also going to be the user of the brand new car. 00:41:15.599 --> 00:41:29.440 And um I can actually tell from with my scanning equipment if the manufacturer had a fresh blade when they cut their you know, never used key, or whether you know, maybe they had cut 500 keys and they were just about to replace the blade. 00:41:29.440 --> 00:41:41.840 Um these are keys that I, you know, the but the owner of the vehicle didn't realize that they had a key inside their key for the mechanical lock, or that you pop the cap off to get to the to the keyhole. 00:41:42.079 --> 00:41:45.199 For for game night Eric uh in uh what are we coming up on? 00:41:45.199 --> 00:41:46.000 August here? 00:41:46.000 --> 00:41:46.239 Yep. 00:41:46.239 --> 00:41:48.800 I think it's August 1st, maybe the first Wednesday of the month. 00:41:48.800 --> 00:41:50.480 I think we got to get into somebody's car.
00:41:50.480 --> 00:41:51.519 We'll we'll pick a volunteer. 00:41:51.519 --> 00:41:52.239 Is it gonna be Cam? 00:41:52.239 --> 00:41:53.039 Who's it gonna be? 00:41:53.039 --> 00:41:54.000 I think it's gotta be Eric. 00:41:54.000 --> 00:41:54.639 It's gotta be Eric. 00:41:55.360 --> 00:41:55.920 August 5th. 00:41:56.159 --> 00:41:56.800 August 5th. 00:41:57.280 --> 00:41:58.960 Tesla gets a little more interesting. 00:41:58.960 --> 00:42:01.039 But I now do stock the cards. 00:42:01.039 --> 00:42:02.880 But uh you'll do your own duplicating. 00:42:02.880 --> 00:42:05.360 I can just hand you the card, I believe, and you do the rest of it. 00:42:05.360 --> 00:42:06.159 Interesting. 00:42:06.320 --> 00:42:06.639 Okay. 00:42:06.639 --> 00:42:08.800 We're gonna we're getting into somebody's car. 00:42:09.280 --> 00:42:10.000 I won't be here. 00:42:10.000 --> 00:42:11.119 Okay. 00:42:11.119 --> 00:42:13.199 You guys gonna have to find another person. 00:42:13.199 --> 00:42:14.880 Grey duck lock picking. 00:42:14.880 --> 00:42:16.320 Grey duck locksmithing? 00:42:16.320 --> 00:42:16.960 Or what is it? 00:42:16.960 --> 00:42:18.239 Which what's the name of it? 00:42:18.239 --> 00:42:19.440 Uh Grey Duck Locks. 00:42:19.440 --> 00:42:22.400 All right, gray duck locks for Grey Duck Security LLC. 00:42:22.400 --> 00:42:24.320 Duck Duck Grey Duck Corporation. 00:42:24.320 --> 00:42:24.719 Yep. 00:42:24.719 --> 00:42:28.960 You know it's not uh, you know, you know it's Minnesota because it's not Duck Duck Goose, right? 00:42:29.199 --> 00:42:29.679 That was the idea. 00:42:29.679 --> 00:42:36.320 I was getting a little older, a little more gray hair, and uh trying to come up with a company name, but I wanted to scream Minnesota Company. 00:42:36.320 --> 00:42:36.719 Sure. 00:42:36.719 --> 00:42:48.480 Not the guys hanging out in Costco, not the call center in New York that's you know dispatching to a guy who downloaded an app and wants to play locksmith this weekend because you know, saw a YouTube video on it. 00:42:48.480 --> 00:42:51.280 Um Minnesota, we called this pop. 00:42:51.280 --> 00:42:52.960 Soda. 00:42:53.760 --> 00:42:54.239 Soda. 00:42:54.239 --> 00:43:00.079 Eric, if somebody wanted to get a really good lock, um what's a good brand? 00:43:00.079 --> 00:43:01.599 Is it like an ambloy? 00:43:01.599 --> 00:43:03.760 What what would you recommend? 00:43:04.079 --> 00:43:10.239 Uh Asa, Abloy, Kaba, all of these are pretty much the same company now. 00:43:10.239 --> 00:43:19.119 Um multi-lock, medico, you know, CA commercial locksmith professional for the best locks. 00:43:19.119 --> 00:43:22.480 You you've got grade one, grade two, and grade three locks. 00:43:22.480 --> 00:43:28.480 The stuff we find at the traditional hardware store, I'd call that a grade three or three and a half. 00:43:28.480 --> 00:43:32.079 Or the the packaging is more resistant than the lock itself. 00:43:32.079 --> 00:43:33.599 Where's the opening that thing? 00:43:33.840 -->
00:43:35.199 Where do I get the grade one? 00:43:35.440 --> 00:43:38.400 Uh grade one you'd get from a professional distributor. 00:43:38.400 --> 00:43:51.679 Now, with today's distribution, if you know what you're shopping for, you know, I'm sure somebody on Amazon will send it to you, or wholesalers are happy to create a new account for you in the hopes of all your future business. 00:43:51.679 --> 00:43:54.800 Um you you can get the hardware in a lot of places. 00:43:54.800 --> 00:44:01.519 Um yeah, see a professional where it's not that expensive to work with somebody who knows what they're doing. 00:44:01.519 --> 00:44:10.079 You know, if you try to repair things yourself, often it costs you more than if you hired the guy who has the jiffy tool that does it in three minutes. 00:44:10.079 --> 00:44:15.840 You didn't need to spend 90 minutes packing your door frame up only to find it doesn't fit. 00:44:15.840 --> 00:44:16.800 You're here. 00:44:17.119 --> 00:44:18.719 Well, thanks for joining us today, Eric. 00:44:18.719 --> 00:44:21.119 It's been really fun talking about locksmithing. 00:44:21.119 --> 00:44:23.920 We got a lot of lock talk happening here today. 00:44:24.239 --> 00:44:24.960 Lock talk, right? 00:44:24.960 --> 00:44:26.079 Yeah, lock it down. 00:44:26.320 --> 00:44:26.480 Yeah. 00:44:26.880 --> 00:44:31.760 I wanted to extend a minute and go to AI for the we're out of time on this one. 00:44:31.760 --> 00:44:32.320 Okay. 00:44:32.639 --> 00:44:39.679 But uh, we're gonna have to have you back because I do want to do AI on-prem, um, large language models and local LMs too. 00:44:39.679 --> 00:44:42.239 So we'll have to schedule to come back sometime soon. 00:44:42.239 --> 00:44:44.719 But uh that wraps us up for today. 00:44:44.719 --> 00:44:47.280 My name is Joshua Schmidt, your co-host and producer. 00:44:47.280 --> 00:44:49.119 You've been listening to the Audit podcast. 00:44:49.119 --> 00:44:50.559 Please like, share, and subscribe. 00:44:50.559 --> 00:44:52.559 You can find us wherever you get your podcasts. 00:44:52.559 --> 00:44:57.920 We are now streaming with video uh on Spotify and as well as Apple here pretty soon. 00:44:57.920 --> 00:45:02.960 We've been joined by the usual suspects, Eric Brown, managing director of IT Auto Labs, and Nick Mellum. 00:45:02.960 --> 00:45:04.559 And our guest today was Eric Osterberg. 00:45:04.559 --> 00:45:04.880 Dr. 00:45:04.880 --> 00:45:05.119 Nick. 00:45:05.119 --> 00:45:05.599 Dr. 00:45:05.599 --> 00:45:06.320 Nick, yes. 00:45:06.320 --> 00:45:09.760 Eric Osterberg is Grey Luck, Gray Duck Lock. 00:45:09.760 --> 00:45:11.519 And you can find him on Google. 00:45:11.519 --> 00:45:15.840 Just uh search Eric Osterberg on LinkedIn or Google and you can find Grey Duck Lock. 00:45:15.840 --> 00:45:18.800 You've been listening to the audit presented by IT Audit Labs. 00:45:18.800 --> 00:45:20.079 We'll see you in the next one. 00:45:20.639 --> 00:45:24.400 You have been listening to the audit presented by IT Audit Labs. 00:45:24.400 --> 00:45:33.119 We are experts at assessing risk and compliance while providing administrative and technical controls to improve our clients' data security. 00:45:33.119 --> 00:45:45.920 Our threat assessments find the soft spots before the bad guys do, identifying likelihood and impact, or all our security control assessments rank the level of maturity relative to the size of your organization. 00:45:45.920 --> 00:45:50.239 Thanks to our devoted listeners and followers, as well as our producer, Joshua J. 00:45:50.239 --> 00:45:54.480 Schmidt, and our audio video editor, Cameron Hill. 00:45:54.480 --> 00:46:07.760 You can stay up to date on the latest cybersecurity topics by giving us a like and a follow on our socials, and subscribing to this podcast on Apple, Spotify, or wherever you source your security content.
Editar transcrição