WEBVTT
00:00:00.239 -->
00:00:10.960By listening to the sound of a rotating hard drive, the way the heads moved across the platter, they could recreate what some of the data was.
00:00:10.960 -->
00:00:13.279So my gosh, that's interesting.
00:00:16.960 -->
00:00:20.480You are listening to the audit presented by IT Audit Labs.
00:00:20.480 -->
00:00:23.440I am your co-host and producer, Joshua Schmidt.
00:00:23.440 -->
00:00:32.640Today we have the usual suspects, Eric Brown, Nick Mellum coming from Texas, as well as Eric Osterberg we have in the studio today.
00:00:32.640 -->
00:00:35.679Eric Osterberg works with uh Gray Duck Locks.
00:00:35.679 -->
00:00:39.520And then we have done some work with you recently around AI projects.
00:00:39.520 -->
00:00:48.880Um one of the things that I wanted to bring up today and get into uh after we do a little bit of a lock picking demo here is to talk about uh hugging face and local LMs.
00:00:48.880 -->
00:00:50.479Um we've been going hard here.
00:00:50.479 -->
00:00:52.560Eric's been doing a lot of work on cloud code.
00:00:52.560 -->
00:00:54.880I know Nick's been dabbling, and so have I.
00:00:54.880 -->
00:00:59.280So would love to talk about the future of hardware and local LMs.
00:00:59.280 -->
00:01:06.640So without further ado, Eric, give us just a little background about yourself, um, what you're working on right now, and and bring us up to speed.
00:01:06.879 -->
00:01:20.480Yeah, for the past 24 months or so, I've I'm an early adopter, um, just in general, whether it be uh drones or 3D printing or what you know, whatever the latest trend is.
00:01:20.480 -->
00:01:32.719I I like to I'm a full-time learner and um I've been using AI extensively, and um we've Eric and I have known each other for for decades now.
00:01:32.719 -->
00:01:33.200I think so.
00:01:33.200 -->
00:01:36.640It's been a while, uh, in in the InfoSec community.
00:01:36.640 -->
00:01:45.599Um we we got connected and discussed, you know, some of the AI projects, and so I came to IT Audit Labs here to help out on a few of those projects.
00:01:45.599 -->
00:01:52.640But yeah, right now I'm uh doing a lot of I guess vibe coding, you'd call it, or vibrating is watching next episode.
00:01:52.640 -->
00:01:53.920Vibrators.
00:01:53.920 -->
00:02:13.919Um I've been focused on the locksmithing business uh a fair amount, um, trying to ensure that my identity verification processes when I when I do locksmithing are a little bit smoother, that I don't put any of my customers' data at risk, but that I have it there, you know, to survive any audit requirements.
00:02:13.919 -->
00:02:16.800Um, and then trying to automate the the workflow.
00:02:16.800 -->
00:02:21.439Yeah, a lot of effort goes into quoting, making a key to a car.
00:02:21.439 -->
00:02:26.240Um, people don't realize the complexity that's in a in a modern automobile.
00:02:26.240 -->
00:02:29.520Um, you know, they're they're rolling computers these days.
00:02:29.520 -->
00:02:34.879If you're driving a current model car, you might have 35, 40 different computers in that thing.
00:02:35.280 -->
00:02:36.800And Eric, you're a pilot too, aren't you?
00:02:37.039 -->
00:02:37.759I am a pilot.
00:02:37.759 -->
00:02:40.800I've not flown a lot lately, but you and I need to get out there.
00:02:40.800 -->
00:02:41.599Absolutely.
00:02:41.599 -->
00:02:41.919Yeah.
00:02:41.919 -->
00:02:45.919The hundred dollar hamburger is now what, a thousand dollar hamburger or more?
00:02:46.400 -->
00:02:47.520Gas prices, it's ridiculous.
00:02:47.840 -->
00:02:48.879Insurance prices.
00:02:49.039 -->
00:02:49.360Yeah.
00:02:49.360 -->
00:02:51.680Have you ever made a key for an airplane?
00:02:52.000 -->
00:02:53.520Uh my own airplane.
00:02:53.840 -->
00:02:54.080Nice.
00:02:54.080 -->
00:02:54.560Okay.
00:02:54.719 -->
00:02:56.240Yeah, you had a Cessna, right?
00:02:56.240 -->
00:02:58.479Yeah, Cessna, a 1980-172.
00:02:58.719 -->
00:02:59.199Oh, nice.
00:02:59.360 -->
00:03:06.560So just get an early adopter of a glass panel, put uh Garmin stack in there before WAS was a thing.
00:03:06.719 -->
00:03:08.800And let's do a little bit of a demo here.
00:03:08.800 -->
00:03:18.479I mean, a lot of the time you spent at the office today, I know this is something that Eric Brown is also very passionate about and has been exciting and asking me to get on the podcast now for for quite some time.
00:03:18.479 -->
00:03:27.199So today we're finally doing uh a little bit of a lockpicking demo, or maybe get some new folks interested in this this hobby, which seems synonymous with cybersecurity experts.
00:03:27.520 -->
00:03:28.960Yeah, there's a lot of crossover.
00:03:28.960 -->
00:03:29.199Yeah.
00:03:29.520 -->
00:03:30.319Why is that?
00:03:31.280 -->
00:03:32.719We like to break into stuff, I guess.
00:03:32.719 -->
00:03:35.439It's a nefarious activity in all of us.
00:03:35.439 -->
00:03:37.520I see a puzzle, and can I get in there?
00:03:37.520 -->
00:03:38.159Can you get in?
00:03:38.159 -->
00:03:41.120Eric came into our office, found a lot of puzzles.
00:03:41.120 -->
00:03:47.120I think we did we we have um not not key access to the to the main space.
00:03:47.120 -->
00:03:49.840We have um digital access with a card.
00:03:49.840 -->
00:03:53.840So Eric's like, yeah, you know, I'll be there at like you know eight o'clock or whatever.
00:03:53.840 -->
00:03:57.360And I think I'd kind of forgotten exactly what time he was coming.
00:03:57.360 -->
00:04:01.199Next thing I know, he's standing in front of office because he got through the puzzle.
00:04:01.599 -->
00:04:03.280After calling you, of course, and getting permission.
00:04:03.280 -->
00:04:04.000Of course.
00:04:04.000 -->
00:04:07.599And and you I think basically said, if you can do it, go for it.
00:04:07.599 -->
00:04:08.240Go for it.
00:04:08.479 -->
00:04:09.520That sounds about right.
00:04:09.520 -->
00:04:15.520So you've you've 3D printed some of these uh you can do with your hands instead of having to use a tool.
00:04:15.520 -->
00:04:20.399Um, I actually got a little bit of time with you before we started today and and was successful a couple of times.
00:04:20.399 -->
00:04:21.439Have you tried this yet, Eric?
00:04:21.600 -->
00:04:21.839I have not.
00:04:22.000 -->
00:04:22.319Do you want one?
00:04:22.319 -->
00:04:24.319He's got one.
00:04:24.319 -->
00:04:25.600Okay, yeah.
00:04:25.600 -->
00:04:26.079Yeah.
00:04:26.079 -->
00:04:33.199So yeah, for game night, I brought this particular demo of a lock and tried to describe lock picking.
00:04:33.199 -->
00:04:36.879And um, you know, great, great model work.
00:04:36.879 -->
00:04:42.639Appreciate the person who designed this, but I found I was actually I printed another one, so I'd have more than one for our show.
00:04:42.639 -->
00:04:44.240And I've I found this model.
00:04:44.240 -->
00:04:46.240Again, I should have let me interrupt.
00:04:46.319 -->
00:04:53.040Just for our audio listeners, we're looking at 3D printed locksmithing um, I guess, puzzles, right?
00:04:53.040 -->
00:04:54.079Yeah, yeah, yeah.
00:04:54.079 -->
00:04:55.120And they're kind of gray.
00:04:55.120 -->
00:04:56.319They got some red keys.
00:04:56.319 -->
00:05:01.439We have some different pins here that you can insert and kind of create different combinations just for our audio.
00:05:01.439 -->
00:05:02.639Yep, audio only listeners.
00:05:02.879 -->
00:05:07.120It's a replica lock cylinder that is uh bigger than your fist.
00:05:07.120 -->
00:05:10.879Uh, so you can actually pick the lock by sticking your fingers inside the keyway.
00:05:11.120 -->
00:05:11.360Yeah.
00:05:11.360 -->
00:05:14.959And and maybe just a quick level set on lock picking.
00:05:14.959 -->
00:05:27.360The premise is you you have a key that you put into a lock, and and that key has ridges on it, and those ridges are raising pins to different heights in the lock.
00:05:27.360 -->
00:05:33.839And when the heights are at the right level, they move the pins out of the way, and then you can freely turn the lock.
00:05:33.839 -->
00:05:43.199And Eric, I know you can talk a lot about this, and there's different kinds of uh of locks that make it a lot more difficult to pick.
00:05:43.199 -->
00:05:53.439But like if somebody were to go down to Home Depot and get the typical master lock with the blue ribbon around the bottom, are those relatively easy to get into?
00:05:53.920 -->
00:05:55.279Uh, the padlocks, yes.
00:05:55.279 -->
00:05:55.519Yeah.
00:05:55.519 -->
00:05:58.560There's fewer pins, tolerances are so so.
00:05:58.560 -->
00:06:02.879Um yeah, I think you did a pretty good description there, right?
00:06:02.879 -->
00:06:03.439Cool.
00:06:03.439 -->
00:06:10.480So traditional cylinder, uh, as you described, there's a key cut with particular depths.
00:06:10.480 -->
00:06:18.800There's a matching set of pins in an inline row in in the lock that raises you and insert the key all the way.
00:06:18.800 -->
00:06:31.920And uh, if you've got the right combination, then that uh stack of pins all line up with what we call the shear line, and that allows the plug to rotate inside of the of the lock body.
00:06:31.920 -->
00:06:45.120Um so to pick a lock, what we're doing is we're taking advantage of the imperfections in the milling out of the of those stack of pins that that are lined up there.
00:06:45.120 -->
00:06:51.920It's nearly impossible to get everything in atom for atom perfect row.
00:06:51.920 -->
00:06:57.920You know, you're you're always gonna have the the drill profiles are gonna be just a little bit off center.
00:06:57.920 -->
00:07:10.720And if you if you apply torsion uh to the face of the lock where the lock plug is, uh you can manipulate the pins and feel for which pin is gonna bind before another.
00:07:10.720 -->
00:07:18.639Um and and that'll it will bind before another because you you can't really make a perfect row of drilling.
00:07:18.639 -->
00:07:26.079So with a little bit of torsion on the lock cylinder, if you manipulate each pin, you'll find that one drags more than another.
00:07:26.079 -->
00:07:32.720And if you manipulate it up just enough, you'll feel that friction change.
00:07:32.720 -->
00:07:36.240And you essentially want to find the pin that's binding first, right?
00:07:36.240 -->
00:07:38.720You you push up the binding pin.
00:07:38.720 -->
00:07:41.360Um, you can kind of play with it with your finger.
00:07:41.360 -->
00:07:42.639You want it to drop back down.
00:07:42.639 -->
00:07:47.120If if it sticks also, then you know that you've got it stuck above the shear line.
00:07:47.120 -->
00:08:00.480So if you're if you're pushing the pin that's binding to the point where when you let go, it still falls, you'll eventually drive the upper pin in the stack above the shear line and you can move on to the next pin that's binding.
00:08:00.480 -->
00:08:00.959That's cool.
00:08:01.199 -->
00:08:03.600I don't know if that no, that was for one of the listeners.
00:08:03.600 -->
00:08:04.399That was amazing.
00:08:04.399 -->
00:08:04.639Yeah.
00:08:04.639 -->
00:08:15.040But this this particular model that you have allows you to get kind of simplified on that that concept and has four pins that are sitting in in kind of a into the uh what's it called?
00:08:15.040 -->
00:08:15.920The tor the torsion.
00:08:15.920 -->
00:08:16.639The key way.
00:08:16.639 -->
00:08:17.600The key way, yeah.
00:08:18.160 -->
00:08:23.759And maybe show that that thing there, because it's got a side cutout, the the red, the one with the red key in it.
00:08:23.920 -->
00:08:24.079Yeah.
00:08:24.560 -->
00:08:27.360You got another model here that's more of a traditional lock and key.
00:08:27.360 -->
00:08:28.959It looks backwards there.
00:08:30.319 -->
00:08:33.120It looks like the delay, that's why it was backwards a minute ago.
00:08:33.120 -->
00:08:33.679Yeah.
00:08:33.679 -->
00:08:36.080There it is with the side profile.
00:08:36.080 -->
00:08:48.240In a traditional lock picking here, you'd put some rotational tension with a tension tool on here, and you'd use another tool to reach in the lock and manipulate this stack of pins.
00:08:48.240 -->
00:08:48.879Got it.
00:08:48.879 -->
00:08:49.120Yeah.
00:08:49.120 -->
00:08:50.799Josh got it.
00:08:52.159 -->
00:08:52.639Nice.
00:08:52.639 -->
00:08:55.440I'm gonna need this file to print it.
00:08:55.759 -->
00:08:56.080Yeah.
00:08:56.080 -->
00:08:58.320Maybe we could share that in the show notes today.
00:08:58.320 -->
00:08:58.720Sure.
00:08:58.720 -->
00:09:02.399Or maybe you could tell people where to find it if they're interested to have a 3D printer.
00:09:02.720 -->
00:09:04.720Well, I'm using Bamboo Labs.
00:09:04.720 -->
00:09:13.919I've got uh Carbon X1C, and um, in the Bamboo Labs software uh on the home tab, you can just search for Lockpick.
00:09:14.240 -->
00:09:16.080Can we talk 3D printing for a second?
00:09:16.080 -->
00:09:16.559Sure.
00:09:16.559 -->
00:09:21.039So you have the like this has very fine lines in it, right?
00:09:21.039 -->
00:09:23.919Uh and what's that type of printer called?
00:09:23.919 -->
00:09:26.399Where it prints on top of itself?
00:09:26.399 -->
00:09:28.639Uh FDM printing.
00:09:28.879 -->
00:09:31.039And you're gonna make me remember that acronym.
00:09:31.039 -->
00:09:33.600Filament something, something.
00:09:33.600 -->
00:09:34.480It's okay.
00:09:34.480 -->
00:09:37.200Um one of our 10 listeners or Google.
00:09:37.200 -->
00:09:39.200Fused deposit modeling.
00:09:39.200 -->
00:09:39.759Oh, nice.
00:09:39.759 -->
00:09:40.159There we go.
00:09:40.159 -->
00:09:40.399Okay.
00:09:40.399 -->
00:09:41.120Deposition.
00:09:41.120 -->
00:09:42.240I wouldn't have guessed that one.
00:09:42.480 -->
00:09:43.360Fused deposition.
00:09:43.360 -->
00:09:45.279So it kind of layers on itself.
00:09:45.279 -->
00:09:49.919I I I I heard they were printing houses that way with concrete and and that type of thing, right?
00:09:50.000 -->
00:09:50.159Yeah.
00:09:50.399 -->
00:09:56.639But uh so that's one type, and then you have another resin type where it's kind of like dipped in the resin or something.
00:09:56.960 -->
00:09:57.279Yep.
00:09:57.279 -->
00:10:06.480So on on you have um like a plate or surface and you're using a like a video projector essentially to project an image out of that plate.
00:10:06.480 -->
00:10:14.320It's using UV light, and the um printer's full of a fluid that uh the fuses when it's exposed to the UV light.
00:10:14.320 -->
00:10:18.720So uh you you're projecting a picture while you slowly raise up.
00:10:18.720 -->
00:10:28.559It's almost imagine a movie being shined on a screen that's that's sort of causing the liquid inside to fuse at those points where it made contact with the light.
00:10:28.559 -->
00:10:41.200Um the models come out fairly sticky, and so you need to give them a wash uh and then set them under UV light or set them outside for an hour, and then then they'll cure more solid.
00:10:41.200 -->
00:10:48.000Um because it's a video projection, um, just that that process, it it can be a much higher resolution.
00:10:48.159 -->
00:10:48.480Yeah.
00:10:49.039 -->
00:10:53.279Um and they're the the resolution on all these are getting better every year.
00:10:53.279 -->
00:10:58.080Yeah, the the accuracy of the of the 3D printers itself.
00:10:58.080 -->
00:11:03.840Their their ability to move to a coordinate and stop at an exact point, uh, is it's just phenomenal.
00:11:03.840 -->
00:11:07.759They're and you can 3D print 3D printer.
00:11:07.759 -->
00:11:15.840I think my first 3D printer was um the the idea was that you need vitamins.
00:11:15.840 -->
00:11:20.960Those are the circuits and wires and and bearings and things like that.
00:11:20.960 -->
00:11:29.200You'd you'd use vitamins, you'd feed vitamins into uh an existing 3D printer, and uh that that's how a new 3D printer was born.
00:11:29.200 -->
00:11:29.919That's cool.
00:11:29.919 -->
00:11:40.399Um I went to a local maker space and um printed the components for my 3D printer and uh assembled the vitamins and again being an early adopter there.
00:11:40.399 -->
00:11:44.000Uh Joseph Prusso was still in high school at the time.
00:11:44.000 -->
00:11:47.440Um some folks may know his name.
00:11:47.440 -->
00:11:50.320He's well known in the in the rep rep community.
00:11:50.559 -->
00:11:52.960Oh um Josh forgot to get him on the podcast.
00:11:53.120 -->
00:11:53.360Yep.
00:11:53.679 -->
00:12:00.480Well, Pro Prusso, isn't that one of the that's the one of the bigger printers that people use that you can print like you were talking about, printing your own printer.
00:12:00.480 -->
00:12:00.720Yeah.
00:12:00.960 -->
00:12:01.440Yep.
00:12:01.440 -->
00:12:22.000So uh Joseph Proofsa would be uh at home at his parents or grandmother's place, and uh in the middle of the night for him, you know, it'd be my evening, but in the middle of the night for him, he'd be chatting on IRC and we could discuss how the print went or what would make a print better, or wouldn't it be nice if we had.
00:12:22.000 -->
00:12:25.519And um early on he was a great you know, CAD person.
00:12:25.519 -->
00:12:31.120So if you the in the early days of 3D printing, most of us didn't know CAD, but we liked assembling stuff.
00:12:31.120 -->
00:12:35.120We could if we could borrow a printer, we could make stuff and and bolt stuff together.
00:12:35.120 -->
00:12:38.159Uh learning the CAD skill is where it really got cool.
00:12:38.159 -->
00:12:50.000Um you know, right now, if if you're just starting a 3D printing, you see something online like this lock we're looking at, and decide that you want one, you can get a 3D printer, take it home, download the file, and you know, boom, you've got this thing.
00:12:50.000 -->
00:13:03.519But it is so much more powerful when you imagine, wouldn't it be great if I had and could sit down with the software app and and draw it up and and then send it to the printer.
00:13:03.519 -->
00:13:08.960That to me, that's very related to um AI as well.
00:13:08.960 -->
00:13:13.279I think now you could probably have an idea that you want.
00:13:13.279 -->
00:13:19.200If you can describe it to an AI agent, these large language models will generate the file for you.
00:13:19.200 -->
00:13:20.639Now you can send that to your printer.
00:13:20.639 -->
00:13:26.320So if you're a Star Trek fan, we're moving closer and closer to that idea of a replicator.
00:13:26.320 -->
00:13:27.039Ah, nice.
00:13:27.200 -->
00:13:30.000So now I know what I'm doing this weekend.
00:13:30.000 -->
00:13:31.279Now you're printing.
00:13:31.279 -->
00:13:33.200I have uh bamboo labs also.
00:13:33.200 -->
00:13:36.320It's uh Eric probably knows it's a P1S, I think.
00:13:36.320 -->
00:13:37.039Yep.
00:13:37.039 -->
00:13:47.519Uh yeah, so but it's not uh I haven't been using it very much in the past, you know, few months, but now I've got a project for this weekend to work with uh Claude to think up something cool.
00:13:47.759 -->
00:13:48.639Yep, fire it up.
00:13:48.879 -->
00:13:56.159And Eric, are you seeing now in the lock picking industry being able to print keys to to maybe get through a certain lock?
00:13:56.559 -->
00:13:57.519I have heard of that.
00:13:57.519 -->
00:14:00.320I have not I've not attempted that myself.
00:14:00.320 -->
00:14:09.039Uh uh a very high-quality lock is gonna have tolerances that are greater than that of most 3D printers.
00:14:09.039 -->
00:14:09.440Oh, okay.
00:14:09.440 -->
00:14:14.960But I say most 3D printers and most high-quality locks, there's always the middle ground there.
00:14:14.960 -->
00:14:32.399If you have a um we shouldn't name names and quit you know, pick on them, but let's say something manufactured in a country starting with C that's in the blister pack at your local hardware store and costs less than 35 bucks, odds are the talents are really quite low.
00:14:32.399 -->
00:14:36.799And sure, you take that to a 3D printer and make yourself a key.
00:14:36.799 -->
00:14:37.440Right.
00:14:37.440 -->
00:14:38.480I'll give you an example.
00:14:38.480 -->
00:14:54.720If you want to open any luggage lock that's compatible with the TSA's plan, uh years ago, somebody took a picture of a TSA officer's keyring, made a couple measurements, and went, hey, I can replicate all those keys and and published a set of keys.
00:14:54.720 -->
00:15:02.000So, you know, TSA 001 through TSA 014, uh just download and print it, and there you go.
00:15:02.240 -->
00:15:02.960There you go.
00:15:03.600 -->
00:15:04.080Wow.
00:15:04.080 -->
00:15:20.000And of caution, anybody who has typical security or I would say lower security locks, if you have your keys exposed, if you leave them on the uh the the table at uh Chipotle, you guys had Chipotle for lunch, right?
00:15:20.000 -->
00:15:26.960Um, leave your keys out on the table, um a quick photo and and you're done for.
00:15:27.279 -->
00:15:28.639We're gonna share this comment real quick.
00:15:28.639 -->
00:15:37.039Are we close to seeing AI-powered robotic lock picks that can decode a lock in seconds just by analyzing the acoustic or haptic feedback of the of the pins?
00:15:37.039 -->
00:15:37.919That's interesting.
00:15:37.919 -->
00:15:39.279We are well past that.
00:15:39.279 -->
00:15:39.919Are we?
00:15:39.919 -->
00:15:42.480Can you give us a little bit more context there?
00:15:42.480 -->
00:15:44.720A little bit more uh what's going on?
00:15:45.840 -->
00:15:46.399Sure.
00:15:46.399 -->
00:15:54.879Um we have micro cameras that are the cameras essentially the size of the key.
00:15:54.879 -->
00:16:00.399So you you just basically are shooting a video as you put your key into the lock.
00:16:00.399 -->
00:16:09.519And certain locks have been designed in a way where if if you could be small and be inside and look in a particular direction, you can actually see in in particular.
00:16:09.519 -->
00:16:12.799I'm talking about those keys that allow you to re-key them yourselves.
00:16:12.799 -->
00:16:39.759You may have one, I think both Schlag and uh QuickSet have this where you you you put in the key that works right now, and then you insert another tool, uh rotate the lock to a certain position, allows you to pull out your old key and then put in the new key that you want to be the key for your house, and then you pull out that special pin and and reset the lock, and now the lock's been re-keyed without hiring a locksmith.
00:16:39.759 -->
00:16:40.639It it's good to go.
00:16:40.639 -->
00:16:47.200Well, the the design of that has a bunch of serrated uh columns essentially.
00:16:47.200 -->
00:16:52.320When you're when you're inserting the tool, you're separating the serrated columns so you can you can realign the points.
00:16:52.320 -->
00:16:55.360When you insert the new key, that that's how everything kind of lines up.
00:16:55.360 -->
00:17:09.279Anyhow, there's um there's now an app and a camera where you just slide that into the lock, and then I can go back to my machine and say, cut my one of these five three five one threes and uh you know I've I've got the new key.
00:17:10.960 -->
00:17:34.720With with that vibration question and and kind of continuing on with what Eric was talking about, I I had read somewhere maybe a couple of years ago that they were able to pick up the vibration off of the glass using like a la laser from far away and be able to reinterpret what the conversation was from the sound waves that resonated on the glass.
00:17:34.720 -->
00:17:49.519And then I think maybe it was two years ago, I saw that by listening to the sound of a rotating hard drive, the way the heads moved across the platter, they could recreate what some of the data was.
00:17:49.519 -->
00:17:51.680So that that's interesting.
00:17:52.000 -->
00:18:12.319That reminds me of that Operation Ghost Murmur where they found the guy in Iran, the pilot using AI to listen for his heartbeat, and they probably had his personal heartbeat signature on some uh kind of uh of a info sheet and compared it to what they were listening to in the environment in front of them.
00:18:12.720 -->
00:18:15.680But yeah, uh you've probably seen the mapping with Wi-Fi also.
00:18:15.680 -->
00:18:16.240Yeah.
00:18:16.240 -->
00:18:17.200Another one.
00:18:17.200 -->
00:18:19.200There's quite a few things like that.
00:18:19.200 -->
00:18:21.119I I don't know how practical it is.
00:18:21.119 -->
00:18:23.440I I don't fear that a whole lot.
00:18:24.240 -->
00:18:24.960What's Eric?
00:18:24.960 -->
00:18:33.039So one of the things that maybe you've seen that's kind of crazy when you get called out to say, you know, like, oh hey, I can't get into whatever, and they call you out.
00:18:33.039 -->
00:18:38.640You've you've had to show up and there's some weirdness going on or something interesting.
00:18:38.640 -->
00:18:42.240Yeah.
00:18:42.240 -->
00:18:46.799Eric, didn't you tell me that for game night we were going to break into somebody's car?
00:18:46.799 -->
00:18:48.240A volunteer's car.
00:18:48.240 -->
00:18:48.559Right.
00:18:48.559 -->
00:18:49.039Right?
00:18:49.039 -->
00:18:49.759We're gonna do that.
00:18:49.759 -->
00:18:50.160Sure.
00:18:50.160 -->
00:18:51.839Are you volunteering now?
00:18:51.839 -->
00:18:59.759That's a cool story that that you know, I think most people don't know the capabilities of what a locksmith can do.
00:18:59.759 -->
00:19:05.359And you can get into just about anything with the right tools and equipment, right?
00:19:05.599 -->
00:19:05.759Sure.
00:19:05.759 -->
00:19:07.920And there's different specialties as well.
00:19:07.920 -->
00:19:09.920So I I specialize in automotive.
00:19:09.920 -->
00:19:14.160Um, I've got friends that are in the commercial lock and safe sort of business.
00:19:14.160 -->
00:19:16.000Safes are another good example.
00:19:16.000 -->
00:19:19.200You you mentioned the robotic, you know, can you open a lock?
00:19:19.200 -->
00:19:21.920There, there's a device called the soft drill.
00:19:21.920 -->
00:19:24.400Everybody's Googling for that one as well.
00:19:24.400 -->
00:19:28.880Those are um are very rare to find now.
00:19:28.880 -->
00:19:31.599The manufacturer basically said I sold enough of these.
00:19:31.599 -->
00:19:40.640I think uh certain agencies of our government that may or may not have three or four letter acronyms uh kind of controlled that because they're very good.
00:19:40.640 -->
00:19:47.519Safe manipulation uh is is a skill that you can learn, and so can robots.
00:19:47.519 -->
00:19:56.160And so the soft drill can open a safe much, much faster than um than most people need to be able to open a safe.
00:19:56.160 -->
00:20:00.160Uh if you're a locksmith, of course, you're making money if you fix price to open a safe, right?
00:20:00.160 -->
00:20:05.279You'd you'd rather be gone in 15 minutes and make a boatload of money than attach a machine and wait 13 hours.
00:20:05.279 -->
00:20:09.279But um there's a TL2000 dialer.
00:20:09.279 -->
00:20:12.160Most of the safe people that I know are are using that.
00:20:12.160 -->
00:20:18.799That literally just manipulates every combination until it senses the lock is open and it stops.
00:20:18.799 -->
00:20:26.559Um but for electronic safes, you most of the electronics are inside the safe, just the battery and the keypad is on the outside.
00:20:26.559 -->
00:20:30.160There are devices on the market that will plug into the keypad bus.
00:20:30.160 -->
00:20:35.119And uh, you know, five, four, three, two, one, she's open.
00:20:35.519 -->
00:20:41.279Looks like peep people are making uh these uh soft drill brushes by using a uh electronic toothbrush.
00:20:41.279 -->
00:20:42.160Different thing.
00:20:42.160 -->
00:20:42.880Totally different thing.
00:20:42.880 -->
00:20:43.359Okay.
00:20:43.359 -->
00:20:46.720It looks like this is a lockpicking mechanism, though, yeah.
00:20:46.960 -->
00:20:47.200Yeah, yeah.
00:20:47.200 -->
00:20:58.559The the soft drill has a um a microphone and a uh servo with feedback that attaches to the dial on the safe.
00:20:58.559 -->
00:21:14.000And it it will swing the dial around, listening to the acoustics, and can detect when components within the lock are bumping other components within the lock that allows it to decipher how things are aligned.
00:21:14.000 -->
00:21:21.599If you know how things are aligned and where where the contact points are, uh it very quickly knows, like, okay, here's the combination.
00:21:21.920 -->
00:21:24.160I gotta I gotta start hold that thought, Eric.
00:21:24.160 -->
00:21:25.119I gotta share this comment.
00:21:25.119 -->
00:21:30.160This is my this is why my door has uh porticules and draw bars installing a drawbridge next year.
00:21:30.160 -->
00:21:31.759That's from Faye 9915.
00:21:32.480 -->
00:21:34.079Faye's a regular listener, I think.
00:21:34.319 -->
00:21:36.319Yeah, we'll get to all your questions, but Eric, you had to do it.
00:21:36.480 -->
00:21:37.039Yeah, no, I did.
00:21:37.039 -->
00:21:38.960So with Eric Hotel Safe, right?
00:21:38.960 -->
00:21:50.480Like you go into the hotel and I think there's a Darknet Diaries episode where the guy um was a poker player and um they they got his laptop and installed some stuff on it and what have you.
00:21:50.480 -->
00:21:54.559But it how do those is that just an illusion of safety?
00:21:54.799 -->
00:22:02.799Uh yeah, if if that a lot of the safes in hotels are You know, bulk manufactured, another country starting with C.
00:22:02.799 -->
00:22:04.720Maybe that other one, same one.
00:22:04.720 -->
00:22:08.000Uh many of these are opened with just a uh a magnet.
00:22:08.000 -->
00:22:11.920You know, there's there's an electromagnet inside of it to release the lock.
00:22:11.920 -->
00:22:12.960Carry a big fish.
00:22:12.960 -->
00:22:14.000You can go fishing.
00:22:14.000 -->
00:22:17.759You can you can do magnet fishing.
00:22:17.759 -->
00:22:19.039The lake fishing.
00:22:19.039 -->
00:22:21.680You just drag a large magnet behind your boat.
00:22:22.160 -->
00:22:25.839You go like go over a bridge and drop it down on the rope and yeah.
00:22:26.240 -->
00:22:26.799Yeah, totally.
00:22:26.799 -->
00:22:35.839But you could you can pick up all the the safes and the firearms and the every other piece of metal that's discarded in the middle of the night over a bridge.
00:22:35.839 -->
00:22:37.599Have you guys done this?
00:22:38.079 -->
00:22:39.920Eric's acting like he hasn't done it before.
00:22:39.920 -->
00:22:42.480That's the kind of fishing that might be might be interesting.
00:22:42.880 -->
00:22:44.720We may have to do an expedition this summer, Eric.
00:22:44.720 -->
00:22:58.799I uh now I've scuba dived, and when when I was scuba diving uh in in rivers, like this is you know back in high school, they would say if you see a um bag underwater, do not open the bag.
00:22:58.799 -->
00:23:02.480Um because you're not you're probably not gonna like what you find.
00:23:02.480 -->
00:23:04.000We we found a bag.
00:23:04.000 -->
00:23:06.319We did not adhere to the guidelines.
00:23:06.319 -->
00:23:10.160We opened the bag and it was just full of sand from a construction thing.
00:23:10.160 -->
00:23:10.799Uh okay.
00:23:10.960 -->
00:23:11.920Sandbag.
00:23:11.920 -->
00:23:15.359We got another question here if that the that's okay.
00:23:15.359 -->
00:23:17.839Um this is again from Joshua Morgan Goldstein.
00:23:17.839 -->
00:23:27.519Comparing something like a minimalist Volvo to a high performance Porsche, who is winning the digital arms race against the uh against relay attacks and the key cloning, or are they both wide open to the exploits?
00:23:27.920 -->
00:23:30.480Volvo's ahead, I would I would say.
00:23:30.480 -->
00:23:37.039Um and I would say European vehicles in general are far ahead of domestic vehicles.
00:23:37.039 -->
00:23:39.119Why why is that?
00:23:39.119 -->
00:23:56.640Yeah, so uh typical key for a domestic or Asian vehicle, there's a serial number burned into the key, and during a programming session, we tell the car, okay, now I want you to trust this key, and uh the process is done.
00:23:56.640 -->
00:24:06.640In a typical European vehicle, we have public-private key encryption and challenge response algorithms going on between multiple computers in the vehicle.
00:24:06.640 -->
00:24:13.680Your key contains a private key burned into the the chip itself at the factory.
00:24:13.680 -->
00:24:24.319And um, if if I as a cyber security auto locksmith open up the computers and get in there, I can extract the public key.
00:24:24.319 -->
00:24:26.880Uh gee, what am I gonna do with that now?
00:24:26.880 -->
00:24:31.200I mean it I I I I call it public key, but it's a little different, right?
00:24:31.200 -->
00:24:34.000You've we've got an asymmetric key pair.
00:24:34.000 -->
00:24:43.680Um but there's a lot of brute force cyber work necessary in order to come up with the matching key that's gonna make those handshakes work between those modules.
00:24:43.680 -->
00:24:49.359So when you make a key to your uh we'll give Audi some credit here.
00:24:49.359 -->
00:24:59.200When you go to Audi and order a key for the $600, they are just putting the order in the assembly line and you know, out comes a blank key.
00:24:59.200 -->
00:25:05.359They write the codes that they knew when they built the car and its key and they send it to you in a huge profit margin.
00:25:05.359 -->
00:25:10.720When I get the call to make a key to your Audi, you don't want to watch.
00:25:10.720 -->
00:25:12.400It's like making sausage.
00:25:12.400 -->
00:25:14.720Just look the other way, I'll be done in four hours.
00:25:14.720 -->
00:25:25.920Um we're gonna open up those computers, peel back the metal on the cans for for for some of the more difficult ones, uh, desolder certain integrated circuits.
00:25:25.920 -->
00:25:34.480We're gonna do the things we need to do to get uh MCUs or EE proms to dump their goodies.
00:25:34.480 -->
00:25:36.799Those goodies are gonna go up into the cloud.
00:25:36.799 -->
00:25:46.400I have subscriptions for products that also came from a company man manufactured it in a country with starts with C or R.
00:25:46.400 -->
00:25:47.920They're very good at their work too.
00:25:47.920 -->
00:26:02.000Um we're essentially reverse engineering the security mechanisms on the hardware and then brute forcing those keys in order to come up with the secret in your key.
00:26:02.559 -->
00:26:11.759It seems that the Volkswagen group actually owns Audi Porsche and other brands like Lamborghini and Bentley.
00:26:11.759 -->
00:26:12.400Yeah.
00:26:12.400 -->
00:26:17.680So if you're getting a Lamborghini, it's the same thing as a Volkswagen.
00:26:17.680 -->
00:26:18.480Same thing.
00:26:18.960 -->
00:26:24.480Some of these cars that you might call exotic cars, the ones you expect to have the best security.
00:26:24.480 -->
00:26:25.680Yeah.
00:26:25.680 -->
00:26:30.319It's they put all the money in the in the paint and the polish and the delivery.
00:26:30.640 -->
00:26:31.119Nice.
00:26:31.119 -->
00:26:35.200So, Eric, you're telling me my F-150 key is pretty easy to clone?
00:26:35.839 -->
00:26:41.279Until 2021, when Ford totally uh changed how they go about things.
00:26:41.279 -->
00:26:44.319Um I have a 2021 Ford F-150.
00:26:44.319 -->
00:26:52.000The um electrical system was modeled after the Mach E, and the Mach E was designed to sort of compete with the Tesla.
00:26:52.000 -->
00:26:56.480That was the beginning of uh self-driving and you know, much more modern architecture.
00:26:56.480 -->
00:27:04.799So the the process requires factory tools and um a VSP, uh vehicle security professional certification from NASA.
00:27:04.799 -->
00:27:12.799Uh Ford restricts access to those functions to folks that are vetted with uh licensing insurance and and so on.
00:27:12.799 -->
00:27:16.319And then in 2025, it gets even more interesting.
00:27:16.319 -->
00:27:19.200They introduced encryption between all the modules.
00:27:19.200 -->
00:27:22.000And so um I have a self-driving vehicle.
00:27:22.000 -->
00:27:30.160I I bought the Ford for the Blue Crews and the ability to do self-driving, but um didn't like the idea of paying the subscription fee.
00:27:30.160 -->
00:27:37.680And there were new features that weren't available for my older vehicle, so I've got a comma AI and I run blue pilot software.
00:27:37.680 -->
00:27:38.640That's a whole plug.
00:27:38.640 -->
00:27:40.880But yeah, I've heard of that.
00:27:40.880 -->
00:27:42.480I've heard of that.
00:27:43.279 -->
00:27:45.519Who's the guy that started comma AI?
00:27:46.079 -->
00:27:50.160Uh I can picture him and I'll walk right up to him at DEF CON and say, hey, how's it going?
00:27:50.160 -->
00:27:52.799Yeah, but I cannot remember his name right offhand.
00:27:53.119 -->
00:27:56.799Didn't Musk try to hire him or something, or he worked over there for a little bit?
00:27:56.799 -->
00:27:58.480George Hotz or that's what it is.
00:27:58.480 -->
00:27:58.880Yeah.
00:27:58.880 -->
00:28:00.160Yeah, GeoHotz.
00:28:00.160 -->
00:28:00.960Yes, John.
00:28:00.960 -->
00:28:02.880So how do you like the comma AI?
00:28:02.880 -->
00:28:05.759Because you just plug that into the bus, right?
00:28:06.000 -->
00:28:08.400Yeah, it works on a number of vehicles.
00:28:08.400 -->
00:28:10.480Um, so check it out.
00:28:10.480 -->
00:28:12.480You don't have to have a Ford F-150.
00:28:12.480 -->
00:28:16.720Um and and primarily he's doing hardware sales, right?
00:28:16.720 -->
00:28:19.039And then promoting the idea of software development.
00:28:19.039 -->
00:28:26.960Um there is open pilot, which is the the generic uh driving module for does things a little differently.
00:28:26.960 -->
00:28:30.400So we've got blue pilot, a fork of that code.
00:28:30.400 -->
00:28:37.200Uh, but yeah, the the wonderful thing about it um is that it will plot a course through whatever it sees.
00:28:37.200 -->
00:28:46.400If if your truck ends up in a cornfield and you kind of want to go that way, um you can turn on cruise control and keep driving through the cornfield.
00:28:46.400 -->
00:28:50.000Set your speed and you know, pay attention to the road, right?
00:28:50.000 -->
00:28:53.279If you look off the road, the thing will uh refuse to drive for you.
00:28:53.279 -->
00:28:55.839Um But but there's probably hacks around there.
00:28:56.079 -->
00:29:18.079A buddy of mine's an airline pilot, and he he said that there's some some some of his other pilots that, you know, they're they're home-based in say Minnesota, but they live way far away, like way up north somewhere, and they've got to commute from way up north wherever they live down to MSP for you know their you know, their shift.
00:29:18.079 -->
00:29:22.720And sometimes they'll come back, you know, late at night or whatever, and then need to go home.
00:29:22.720 -->
00:29:29.119They have this comma AI system, and like they're sleeping on the way home.
00:29:29.119 -->
00:29:34.319And I mean, this is hearsay through hearsay, but yeah, it's uh it's interesting.
00:29:35.039 -->
00:29:37.200There's a there's another whole talk there, I'm sure.
00:29:37.200 -->
00:29:37.599Yes.
00:29:37.599 -->
00:29:39.279There are separate teams.
00:29:39.279 -->
00:29:42.799There's a camera that watches the driver, and then there's the camera that watches the road.
00:29:42.799 -->
00:29:50.640In fact, multiple cameras watching the road, but the camera that watches the driver, it is open source, you could theoretically manipulate that.
00:29:50.640 -->
00:29:59.839Um they have a practice of monitoring for all forks, and the hardware is designed by default to pull from your GitHub repo.
00:29:59.839 -->
00:30:01.200Give it a URL.
00:30:01.200 -->
00:30:15.119There are some safety mechanisms in there, and if you attempt to bypass the safety mechanisms, the community will attempt to bypass you because that's not good for safety in general.
00:30:15.119 -->
00:30:21.680And the last thing any of us want are regulators deciding that they know best for us.
00:30:22.559 -->
00:30:25.119We had tinfoil hat coming on here, guys.
00:30:25.119 -->
00:30:25.759Here we go.
00:30:25.759 -->
00:30:26.720Here we go.
00:30:26.720 -->
00:30:41.920Uh I mean, this has been kind of brewing in the background, but it looks like there's just been some legislation passed driven by the 2021 Infrastructure Investment and Jobs Act, requires automakers to install advanced impaired driving prevention technology in all new passenger vehicles.
00:30:41.920 -->
00:30:55.519The mandate directs the NHTSA to finalize rules require built-in passive monitoring systems such as cameras and sensors to detect driver impairment fatigue and distraction with the authority to limit and prevent vehicle uh operation.
00:30:55.519 -->
00:30:58.319So uh I've been seeing this a lot on YouTube.
00:30:58.319 -->
00:31:02.640There's been a lot of commentary on this, and in most of it negative, as you can imagine.
00:31:02.640 -->
00:31:04.240Where do you guys kind of fall?
00:31:04.240 -->
00:31:06.079I I kind of see both sides, right?
00:31:06.079 -->
00:31:08.799No one wants to be we want to we want to be free, right?
00:31:08.799 -->
00:31:17.599We want to be able to get into our car and we don't want to get shut down because we didn't get very good sleep that night or we had a cold or something like that, not be able to go where we want to go.
00:31:17.599 -->
00:31:22.960But also, we've all seen these terrible drivers on the road that have no business being behind the wheel.
00:31:22.960 -->
00:31:25.599And it would be great to take them off the road.
00:31:25.599 -->
00:31:28.160So uh where do you guys fall on this one?
00:31:28.160 -->
00:31:29.759Kind of as the intersection.
00:31:29.759 -->
00:31:32.480Maybe this is our our transition to AI, right?
00:31:32.799 -->
00:31:35.519Or or gun control or any other uh topic.
00:31:35.519 -->
00:31:37.279Don't get us into that.
00:31:37.279 -->
00:31:39.440I eyes expanding in the room.
00:31:40.079 -->
00:31:44.160I think I think a lot of people are just getting a piece of electrical tape to go over the camera.
00:31:45.680 -->
00:31:47.599It will stop driving at that point.
00:31:47.599 -->
00:31:51.200Um you're for it or are you against it?
00:31:51.359 -->
00:31:52.880That's that's kind of what I'm looking for here.
00:31:53.200 -->
00:31:53.680Yes.
00:31:53.680 -->
00:31:54.640Exactly.
00:31:54.640 -->
00:31:56.079Yes.
00:31:56.079 -->
00:32:06.880I I think that uh taking advantage of where technology has led us is is a great thing in general.
00:32:06.880 -->
00:32:13.039Um I I think like a lot of laws, they're great when they apply to everybody but me.
00:32:13.039 -->
00:32:16.559Rules for thee and not for me, huh?
00:32:16.559 -->
00:32:17.119Yeah.
00:32:17.119 -->
00:32:19.200So I don't know, right?
00:32:19.200 -->
00:32:21.200I'm I I'm a libertarian.
00:32:21.200 -->
00:32:24.000I I definitely support our freedoms.
00:32:24.000 -->
00:32:26.880I don't have to even mention Second Amendment or anything else.
00:32:26.880 -->
00:32:27.920I've said enough.
00:32:27.920 -->
00:32:32.400Um I think that uh the technology is incredible.
00:32:34.640 -->
00:32:38.000And I think it's walking on eggshells.
00:32:38.000 -->
00:32:39.920I think it's I think it's a good idea for most.
00:32:41.039 -->
00:32:42.640Nick, do you want to weigh in on this, Mr.
00:32:42.640 -->
00:32:43.039Marine?
00:32:43.359 -->
00:32:45.839Let's make it heckable and then I'm cool with it.
00:32:45.839 -->
00:32:53.599No, I kind of go both ways too, honestly, because you know, if somebody's impaired driving, I certainly don't want them on the road if I'm on out there with my family, right?
00:32:53.599 -->
00:32:55.839So that's the the logical thinking.
00:32:55.839 -->
00:33:02.559But I certainly don't want my space, you know, invaded if I'm getting in the truck to run across the street to the grocery store.
00:33:02.559 -->
00:33:05.759So I guess overall, if I had to pick, I'd say I'm against it.
00:33:06.079 -->
00:33:06.160Yeah.
00:33:06.480 -->
00:33:08.319Eric Brown, you got some thoughts on this.
00:33:08.319 -->
00:33:09.440I I've been curious.
00:33:09.920 -->
00:33:10.480I do.
00:33:10.480 -->
00:33:12.960Um what were they?
00:33:12.960 -->
00:33:14.960I was distracted by the headphones here.
00:33:14.960 -->
00:33:16.720About about being monitored in your vehicle.
00:33:16.720 -->
00:33:17.359Oh, yeah.
00:33:17.359 -->
00:33:19.200Well, so okay.
00:33:19.200 -->
00:33:41.359I uh we've got a client that some of the people in the organization are refusing to take phishing training and they are still clicking on phishing emails, but then when they're told about it, they're like, oh yeah, I I clicked on it on purpose because it was, you know, I whatever, right?
00:33:41.359 -->
00:33:42.240It's some excuse.
00:33:42.240 -->
00:33:43.759And it's like just owning it, huh?
00:33:43.759 -->
00:34:07.920Yeah, just so you know, when you have people like that that, you know, with that mentality in the public space, I I would want some sort of guidelines and structure so that, you know, I know somebody just didn't homebrew something in their garage and now they're ripping down the road at 110 and like, oh whoops, I forgot, you know, to put this on.
00:34:07.920 -->
00:34:18.079It's, you know, I I kind of go to the aviation community that has been using autopilot for decades and it works really well.
00:34:18.079 -->
00:34:26.079And and there's been refinements with terrain avoidance over the years and air traffic control, and it's gotten better and better.
00:34:26.079 -->
00:34:33.599But you know, you you really could not fly in instrument meteorological conditions without autopilot.
00:34:33.599 -->
00:34:40.880Like it's strictly it's simply safer like to to fly with with autopilot, because you can get spatial disorientation.
00:34:40.880 -->
00:34:54.079You know, if you're if you're flying in the clouds and you're getting you know buffeted around from um weather and you've got rain or snow or whatever coming in, um there's a lot of environmental distractions.
00:34:54.079 -->
00:35:07.119And if you're trying to fly the plane or you're getting bounced around and you know, trying to figure out where the horizon is, and your vestibular system is telling you you're in a turn, but you're really not.
00:35:07.119 -->
00:35:08.719So you're you're straightening that out.
00:35:08.719 -->
00:35:13.360You know, it's just it it's what happened with JFK Um Jr.
00:35:13.360 -->
00:35:17.840up in the Cape, you know, where he where he kind of who was not instrument rated.
00:35:17.840 -->
00:35:27.519So he he he probably wasn't aware of all of these things that can happen, but you you really want to be on the instrument system and and you want to be relying on the plane to to fly itself.
00:35:27.519 -->
00:35:30.400And you know, we've been doing this for years in in aviation.
00:35:30.400 -->
00:35:32.480So I would love to see it on the roads.
00:35:32.480 -->
00:35:37.840The experience that I I have with it is it's a better driver than most.
00:35:37.840 -->
00:35:38.800It's safer.
00:35:38.880 -->
00:35:45.679Aaron Powell That's a little different than uh being monitored, right, in your vehicle, like having a having a self-driving car or an automated driver.
00:35:46.159 -->
00:35:48.159I think it's because that's where we're at level two today.
00:35:48.159 -->
00:35:54.159But when we get to like level, what is it, four where we don't, you know, that you don't need the monitoring because the system's better than you are.
00:35:54.639 -->
00:36:02.079Um that's actually a question in the chat about um when are we going to get to level five?
00:36:02.639 -->
00:36:05.519I hope it's Eric, how far away are we from level five?
00:36:06.159 -->
00:36:06.800Ten years.
00:36:06.800 -->
00:36:11.840Early adapters six, general population fifteen?
00:36:12.159 -->
00:36:14.400It it the technology is probably close.
00:36:14.400 -->
00:36:15.840It's just all the regulations.
00:36:15.840 -->
00:36:19.119And then there's that conversation of who's responsible if something goes wrong.
00:36:19.360 -->
00:36:19.519Yeah.
00:36:19.519 -->
00:36:21.199The the litigious side of it.
00:36:21.199 -->
00:36:26.320And then when we're gonna get into smart contracts and all of that sort of stuff, which is just a different conversation.
00:36:26.320 -->
00:36:30.800But I I don't know, is the technology six and then the legislation's 10?
00:36:31.679 -->
00:36:35.679Yeah, I'm I'm I can't predict what legislation's gonna be up to.
00:36:35.679 -->
00:36:44.320I I was thinking we can pivot right to privacy and talk about AI here as well, the private cloud.
00:36:44.320 -->
00:36:46.800Yeah.
00:36:47.039 -->
00:36:49.519Do we want to cut this one in do a double episode?
00:36:49.519 -->
00:36:50.559Double it up.
00:36:50.559 -->
00:36:51.599Let's keep going.
00:36:51.840 -->
00:36:56.400I think when we're talking about the the monitoring of drivers, right?
00:36:56.400 -->
00:37:03.119If if that is totally a local thing and that data is my data, it's not going anywhere.
00:37:03.119 -->
00:37:06.000It's just my cars keeping me safe.
00:37:06.000 -->
00:37:11.360And I have the option to override, you know, like that.
00:37:11.360 -->
00:37:13.119It's a safety feature that's built in.
00:37:13.119 -->
00:37:13.760We all have it.
00:37:13.760 -->
00:37:23.280And when the thing says you're not safe to drive, um, if I can go on the record saying I think I was safe to drive, I'm more cool with it if it's totally local.
00:37:23.280 -->
00:37:26.719But I already do not like the telemetry that's in a lot of vehicles.
00:37:26.960 -->
00:37:29.440You're saying, and that's a sober, that's a sober take.
00:37:29.679 -->
00:37:37.760Yeah, I mean, you're your cars today are are sharing a lot of data with the manufacturer because manufacturers are selling that data.
00:37:37.760 -->
00:37:38.320Sure.
00:37:38.320 -->
00:37:42.079Um, you know, how many of us are Google customers?
00:37:42.079 -->
00:37:47.840Uh and and I say that because you know, if you're not paying them, you're the you're the product, not the customer.
00:37:47.840 -->
00:37:53.679I I I love the things that are built into my phone and integrated in my car, which is nice as well.
00:37:53.679 -->
00:37:58.159You know, I had this uh had this appointment to come here for for the podcast, right?
00:37:58.159 -->
00:38:01.199I I got in my truck and it knew where I wanted to go.
00:38:01.199 -->
00:38:08.079I just kind of hit the button and then turned on reverse control in my driveway and and it was a fun, safe drive.
00:38:08.079 -->
00:38:16.800But um Google knows where I'm going and follows everybody else around, and that data's useful, so that I I took the best route.
00:38:16.800 -->
00:38:19.840If there was a traffic jam somewhere, we we went around it.
00:38:19.840 -->
00:38:22.239So it's it's the love-hate thing.
00:38:22.239 -->
00:38:24.400Um, and I'm rambling on a little bit, right?
00:38:24.400 -->
00:38:30.480But I I don't like that car manufacturers are keeping tabs to the extent that they are.
00:38:30.480 -->
00:38:37.360Um, that when you buy a car now uh buried in that mountain of paperwork, it's worse than closing out a house.
00:38:37.360 -->
00:38:39.119And and I've done both recently.
00:38:39.119 -->
00:38:46.000Um it there there's a license agreement with your car, and you don't necessarily own the software.
00:38:46.000 -->
00:38:52.880And if you turn off the telematics, you've just ended your warranty after 45 days and and some other interesting things like that.
00:38:53.039 -->
00:38:54.559So I don't like that.
00:38:54.719 -->
00:38:55.360I don't like that.
00:38:55.360 -->
00:38:56.880So you could ride a bike.
00:38:57.920 -->
00:39:00.079Or I could buy an old used car for now.
00:39:00.079 -->
00:39:01.360What kind of bike do you have?
00:39:01.360 -->
00:39:02.159I don't have a bike.
00:39:02.159 -->
00:39:05.679Yeah, you might get the telemetry to your bike uh motor.
00:39:06.000 -->
00:39:08.719Do you want to pedal yourself or are you gonna hit the go button?
00:39:08.719 -->
00:39:09.679The go button.
00:39:09.679 -->
00:39:09.920Okay.
00:39:10.159 -->
00:39:11.599It's like plow schwab.
00:39:11.599 -->
00:39:15.199If I put my tinfoil hat back on, uh, you will own nothing and you will be happy.
00:39:15.519 -->
00:39:19.760I I did have a locksmith question for you around the European cars you were saying.
00:39:19.760 -->
00:39:27.440Every time I walk into Costco, and Costco's getting ridiculous now, which is a whole nother thing, but every time you go in there, you're getting accosted by these people.
00:39:27.440 -->
00:39:35.920Like it's either phone or I think last weekend I I went in there and like they're they're trying to like, you know, can can we clone your key or make a copy of your key?
00:39:35.920 -->
00:39:41.679And uh you can barely walk past them and they're like, you know, they're trying to flag you now, which is ridiculous.
00:39:41.679 -->
00:39:46.719But um, how are they doing that with the if if people have European cars?
00:39:46.800 -->
00:39:48.880Aaron Ross Powell They they don't actually work for Costco.
00:39:48.880 -->
00:39:54.000They're they're just a third-party vendor that that finds their locations convenient to work in.
00:39:54.000 -->
00:39:55.920I'm gonna have to go to Sam's Club, I guess.
00:39:55.920 -->
00:40:05.599Those folks have access to I mean they've got insurance, they've they've got training, I mean, they're able to get access to some of the same tools.
00:40:05.599 -->
00:40:06.079I see.
00:40:06.079 -->
00:40:08.400I don't think they're on quite the same level.
00:40:08.400 -->
00:40:21.440Very few of the folks standing around in uh Costco are cybersecurity guys who play with microcontrollers that understand, you know, public-private key encryption and what the process is.
00:40:21.440 -->
00:40:25.599They're I don't want to know somebody, but no, they're just following the colour.
00:40:25.599 -->
00:40:26.719Yeah.
00:40:26.719 -->
00:40:31.679Yeah, the majority are opening the app and logging in and clicking next and next and next.
00:40:32.079 -->
00:40:35.519And you can cut your own keys now at Home Depot, I saw, right?
00:40:35.519 -->
00:40:40.480Like you just walk up to the machine, you put your old one in, and the whole robotic process does it.
00:40:40.639 -->
00:40:40.960Yeah.
00:40:40.960 -->
00:40:42.400Let's get in there.
00:40:42.400 -->
00:40:47.519Take a picture, it determines what the cuts are and runs the machine.
00:40:47.519 -->
00:40:50.000My machines are that way now as as well.
00:40:50.000 -->
00:40:58.159I take high-resolution pictures of keys, uh, goes up to a database and says, okay, what should this key have been?
00:40:58.159 -->
00:41:07.039Um and then sends it to the key cutter, which is basically a C and C machine that that cuts with absolute precision, you know, built for that.
00:41:07.039 -->
00:41:08.480It's it's kind of cool.
00:41:08.480 -->
00:41:10.559Um, I've I've worked on brand new vehicles.
00:41:10.559 -->
00:41:15.599Someone's getting the third key because their you know, kid is also going to be the user of the brand new car.
00:41:15.599 -->
00:41:29.440And um I can actually tell from with my scanning equipment if the manufacturer had a fresh blade when they cut their you know, never used key, or whether you know, maybe they had cut 500 keys and they were just about to replace the blade.
00:41:29.440 -->
00:41:41.840Um these are keys that I, you know, the but the owner of the vehicle didn't realize that they had a key inside their key for the mechanical lock, or that you pop the cap off to get to the to the keyhole.
00:41:42.079 -->
00:41:45.199For for game night Eric uh in uh what are we coming up on?
00:41:45.199 -->
00:41:46.000August here?
00:41:46.000 -->
00:41:46.239Yep.
00:41:46.239 -->
00:41:48.800I think it's August 1st, maybe the first Wednesday of the month.
00:41:48.800 -->
00:41:50.480I think we got to get into somebody's car.
00:41:50.480 -->
00:41:51.519We'll we'll pick a volunteer.
00:41:51.519 -->
00:41:52.239Is it gonna be Cam?
00:41:52.239 -->
00:41:53.039Who's it gonna be?
00:41:53.039 -->
00:41:54.000I think it's gotta be Eric.
00:41:54.000 -->
00:41:54.639It's gotta be Eric.
00:41:55.360 -->
00:41:55.920August 5th.
00:41:56.159 -->
00:41:56.800August 5th.
00:41:57.280 -->
00:41:58.960Tesla gets a little more interesting.
00:41:58.960 -->
00:42:01.039But I now do stock the cards.
00:42:01.039 -->
00:42:02.880But uh you'll do your own duplicating.
00:42:02.880 -->
00:42:05.360I can just hand you the card, I believe, and you do the rest of it.
00:42:05.360 -->
00:42:06.159Interesting.
00:42:06.320 -->
00:42:06.639Okay.
00:42:06.639 -->
00:42:08.800We're gonna we're getting into somebody's car.
00:42:09.280 -->
00:42:10.000I won't be here.
00:42:10.000 -->
00:42:11.119Okay.
00:42:11.119 -->
00:42:13.199You guys gonna have to find another person.
00:42:13.199 -->
00:42:14.880Grey duck lock picking.
00:42:14.880 -->
00:42:16.320Grey duck locksmithing?
00:42:16.320 -->
00:42:16.960Or what is it?
00:42:16.960 -->
00:42:18.239Which what's the name of it?
00:42:18.239 -->
00:42:19.440Uh Grey Duck Locks.
00:42:19.440 -->
00:42:22.400All right, gray duck locks for Grey Duck Security LLC.
00:42:22.400 -->
00:42:24.320Duck Duck Grey Duck Corporation.
00:42:24.320 -->
00:42:24.719Yep.
00:42:24.719 -->
00:42:28.960You know it's not uh, you know, you know it's Minnesota because it's not Duck Duck Goose, right?
00:42:29.199 -->
00:42:29.679That was the idea.
00:42:29.679 -->
00:42:36.320I was getting a little older, a little more gray hair, and uh trying to come up with a company name, but I wanted to scream Minnesota Company.
00:42:36.320 -->
00:42:36.719Sure.
00:42:36.719 -->
00:42:48.480Not the guys hanging out in Costco, not the call center in New York that's you know dispatching to a guy who downloaded an app and wants to play locksmith this weekend because you know, saw a YouTube video on it.
00:42:48.480 -->
00:42:51.280Um Minnesota, we called this pop.
00:42:51.280 -->
00:42:52.960Soda.
00:42:53.760 -->
00:42:54.239Soda.
00:42:54.239 -->
00:43:00.079Eric, if somebody wanted to get a really good lock, um what's a good brand?
00:43:00.079 -->
00:43:01.599Is it like an ambloy?
00:43:01.599 -->
00:43:03.760What what would you recommend?
00:43:04.079 -->
00:43:10.239Uh Asa, Abloy, Kaba, all of these are pretty much the same company now.
00:43:10.239 -->
00:43:19.119Um multi-lock, medico, you know, CA commercial locksmith professional for the best locks.
00:43:19.119 -->
00:43:22.480You you've got grade one, grade two, and grade three locks.
00:43:22.480 -->
00:43:28.480The stuff we find at the traditional hardware store, I'd call that a grade three or three and a half.
00:43:28.480 -->
00:43:32.079Or the the packaging is more resistant than the lock itself.
00:43:32.079 -->
00:43:33.599Where's the opening that thing?
00:43:33.840 -->
00:43:35.199Where do I get the grade one?
00:43:35.440 -->
00:43:38.400Uh grade one you'd get from a professional distributor.
00:43:38.400 -->
00:43:51.679Now, with today's distribution, if you know what you're shopping for, you know, I'm sure somebody on Amazon will send it to you, or wholesalers are happy to create a new account for you in the hopes of all your future business.
00:43:51.679 -->
00:43:54.800Um you you can get the hardware in a lot of places.
00:43:54.800 -->
00:44:01.519Um yeah, see a professional where it's not that expensive to work with somebody who knows what they're doing.
00:44:01.519 -->
00:44:10.079You know, if you try to repair things yourself, often it costs you more than if you hired the guy who has the jiffy tool that does it in three minutes.
00:44:10.079 -->
00:44:15.840You didn't need to spend 90 minutes packing your door frame up only to find it doesn't fit.
00:44:15.840 -->
00:44:16.800You're here.
00:44:17.119 -->
00:44:18.719Well, thanks for joining us today, Eric.
00:44:18.719 -->
00:44:21.119It's been really fun talking about locksmithing.
00:44:21.119 -->
00:44:23.920We got a lot of lock talk happening here today.
00:44:24.239 -->
00:44:24.960Lock talk, right?
00:44:24.960 -->
00:44:26.079Yeah, lock it down.
00:44:26.320 -->
00:44:26.480Yeah.
00:44:26.880 -->
00:44:31.760I wanted to extend a minute and go to AI for the we're out of time on this one.
00:44:31.760 -->
00:44:32.320Okay.
00:44:32.639 -->
00:44:39.679But uh, we're gonna have to have you back because I do want to do AI on-prem, um, large language models and local LMs too.
00:44:39.679 -->
00:44:42.239So we'll have to schedule to come back sometime soon.
00:44:42.239 -->
00:44:44.719But uh that wraps us up for today.
00:44:44.719 -->
00:44:47.280My name is Joshua Schmidt, your co-host and producer.
00:44:47.280 -->
00:44:49.119You've been listening to the Audit podcast.
00:44:49.119 -->
00:44:50.559Please like, share, and subscribe.
00:44:50.559 -->
00:44:52.559You can find us wherever you get your podcasts.
00:44:52.559 -->
00:44:57.920We are now streaming with video uh on Spotify and as well as Apple here pretty soon.
00:44:57.920 -->
00:45:02.960We've been joined by the usual suspects, Eric Brown, managing director of IT Auto Labs, and Nick Mellum.
00:45:02.960 -->
00:45:04.559And our guest today was Eric Osterberg.
00:45:04.559 -->
00:45:04.880Dr.
00:45:04.880 -->
00:45:05.119Nick.
00:45:05.119 -->
00:45:05.599Dr.
00:45:05.599 -->
00:45:06.320Nick, yes.
00:45:06.320 -->
00:45:09.760Eric Osterberg is Grey Luck, Gray Duck Lock.
00:45:09.760 -->
00:45:11.519And you can find him on Google.
00:45:11.519 -->
00:45:15.840Just uh search Eric Osterberg on LinkedIn or Google and you can find Grey Duck Lock.
00:45:15.840 -->
00:45:18.800You've been listening to the audit presented by IT Audit Labs.
00:45:18.800 -->
00:45:20.079We'll see you in the next one.
00:45:20.639 -->
00:45:24.400You have been listening to the audit presented by IT Audit Labs.
00:45:24.400 -->
00:45:33.119We are experts at assessing risk and compliance while providing administrative and technical controls to improve our clients' data security.
00:45:33.119 -->
00:45:45.920Our threat assessments find the soft spots before the bad guys do, identifying likelihood and impact, or all our security control assessments rank the level of maturity relative to the size of your organization.
00:45:45.920 -->
00:45:50.239Thanks to our devoted listeners and followers, as well as our producer, Joshua J.
00:45:50.239 -->
00:45:54.480Schmidt, and our audio video editor, Cameron Hill.
00:45:54.480 -->
00:46:07.760You can stay up to date on the latest cybersecurity topics by giving us a like and a follow on our socials, and subscribing to this podcast on Apple, Spotify, or wherever you source your security content.
