Archive for januari, 2022

2-in-1 for Abus, that barely works.

zaterdag, januari 8th, 2022

Lishi 2-in-1 have been around for a long time, both for automotive and more recently for pin tumbler locks. Sadly, these tools are quite costly as they are keyway specific. Furthermore, this type of tool can’t be made for some locks as the keyways are too tight. Or so I thought, as of writing there are several 2-in-1 for sale for the paracentric Yale keyway. As I was intrigued, I’ve bought an off brand 2-in1 for CISA. In testing the tool, I’ve found various limitations that might impact the usefulness of this tool.

Let’s start from the beginning, Lishi is the brand name of a series of lockpicking tools designed and made by Zhi Qin Li. The Lishi company split up and Zhi Qin Li still sells his 2-in-1 under the brand Original Lishi, while another company sells them under the brand Genuine Lishi.

Original Lishi sells a variety of tools, the one generally referred to as a Lishi is a 2-in-1 lockpick that both applies a turning force and a tool for picking individual elements. The tool can also be used to decode the lock once the lock is open, and a key can be cut in the field with another of Li’s tools.

Lishi for the Schlage SC4 keyway.

So, what does a Lishi 2-in-1 lockpick do? The tool consists of two parts; the body that is used as a turning tool and the thin feeler that’s used as a lockpick. This in itself would not be too useful, however, the body has a chart of where the lockpick is in the lock. You move the pointer to the desired element, indicated by the vertical lines, and push down lightly on the pointer. This in turn moves the lockpick, pushing down on the element in the lock. You can feel if the element is binding or not. And just as lockpicking, you go through the lock, pin by pin, and feel for the binders. Then you set each binder and search for the next one, until all elements are set. Click on one, click on three… Open!

From y2k these tools have been available for automotive locks as the combination of open keyways, many wafers, and typically low tolerances work very well for this tool. 2015 was the year 2-in-1 picks became available for pin tumbler lock for the USA market. (Schlage, Kwikset, and Master). Most of these locks have wide keyways, low tolerance, and very few security pins.

I’ve played with a few of these tools, but didn’t find them too useful. I’m not a locksmith, not in the USA. For me, they would be mostly a novelty. But the pick I’m about to show can be a game changer as it targets European locks I’m familiar with.

In December, I was notified a seller on AliExpress sells 2-in-1 (not a Lishi!) for the paracentric Yale keyway. The consensus under lockpickers is that this tool could not exist, because the keyway is too tight and has no straight access to the pins. I was curious enough to fork over €50, and bought one for CISA as it’s very close if not identical to the Abus C83, the lock we use for impressioning championships.

The seller is quite open about the tool’s limitations and wrote on the lever “80% coverage. Without pin 8 or 9”. While this sounds like it’ll open 80% of locks, but it doesn’t seem to be the whole story, as we will find out. The biggest concern with a tool that works on a subsection of locks is if the user can detect the tool does not work, instead of user error or lack of skill. I suspect so, but it will be far from easy. In short, a lock will not work with one or more cuts deeper than a 7 and therefore this pin will always be overset and this you can detect.

Small sub section of factory cut Abus C83 keys, I’ve a modest collection of them.

As I was curious about the 80% claim, I’ve spent an evening measuring my Abus C83 keys. While these are not CISA, they are close, and I happen to have a modest collection of these keys. 92 out of 283 of the measured keys have no cuts deeper than 5.5mm, the size of the tool. This means the tool will only work on 30% of my Abus C83. This is consistent with a statistics sanity check. For this, we assume every lock has a uniform distribution of cuts, ignoring MACS. This came to be (7/9)^5 = 28.4%.

I’m considering this 30% an upper bound, as Abus C83 and CISA aren’t shipped with standard pins. The old locks are shipped with mostly spool pins, and the new ones have serrated, spool, and T-pin key pins and the same for the drivers.

Abus C83 old style vs new style pins.

Besides the theoretical usability and security pins, what other flaws would make this tool suboptimal? The picking tip snags while moving from pin to pin. Furthermore, picking in the counterclockwise direction binds the picking tip, and it makes it difficult to differentiate between a binding pin and a binding picking tip.

Randomly pinned lock with standard pins, decoded to 52452.

Let’s wrap it up, this tool is sold at €50 and promises quite a lot. However, theoretical, it will only open 30% of all the locks it was designed for. Furthermore, the limitations of security pins and rotation direction will limit the functionality even more. A practiced lockpicker might be-able to overcome some limitations, or detect the tool will not work. A tool that only opens a very small subset of locks is not a very useful tool, and I can’t recommend it to pick these locks. However, as new pickers always struggle to find the binders, and this tool enables them to actually ‘see’ what they are doing, it could be a game changer for teaching.

Pictures CCBY4.0 Jan-Willem Toool Blackbag

HITB CyberWeek 2021, UAE

maandag, januari 3rd, 2022

At the end of November, Jos, Walter, Rob, and me (Jan-Willem) went to Abu Dhabi to teach lockpicking at HITB CyberWeek 2021. We brought close to eighty kilograms of gear, including a hundred locks, plenty lockpicks, impressioning gear, safe locks, and more.

Photo of our first trip to Abu Dhabi in 2019

Why fly all the way to the UAE for a lockpicking village? Toool has run many lockpicking villages, some years more than a dozen. When the Hack in the Box conference came to The Netherlands in 2010, Toool was there with a village and ever since we’ve run Lockpicking Villages at HITB Amsterdam. In 2019, we were invited to run the Lockpicking Village at HITB CyberWeek in the United Arabic Emirates. As it was a great success, we accepted the invitation without hesitation when we got it again this year.

Getting to the UAE was fairly straight forward, even with all the measures. We send in our documents, including vaccination history. Travel was slightly terrifying as we required a tested before the flight, and a positive result would cancel the trip. Luckily, all results were negative, and we were allowed to fly. The flight itself was 6h, and we arrived at Abu Dhabi near midnight.

The first day was to relax and recover from the trip. After breakfast, we explored part of the city. It’s hard to convey the scale to which Abu Dhabi is build. The buildings are large and the space between them are usually three lane roads. It doesn’t help that even in November, it was 30 degrees Celsius outside. We found the ATM, grocery store, and the Abu Dhabi National Exhibition Centre, even though it took most of the morning. We spent the rest of the day at the rooftop swimming pool of the hotel and the welcome reception in the evening.

The conference started early the next day. As always, setting up the village was rather quick. We created a few different areas within the village, one focussed on lockpicking, and another on impressioning and safe cracking.

Even through this was my 20th lockpicking village, it never gets boring. I was very excited to try out a few new things. For this trip, I’ve created a large set of progressive locks, with multiple brands, and pin styles. I’ve also brought multiple new slide decks on lockpicking, impressioning, and safe manipulation. Walter brought a variety of combination locks, from a small padlock to a dial safe lock, and we also brought a full impressioning kit, as it’s a great joy to demonstrate the technique.

We tried to gather people in small groups as much as possible, as it’s a lot more efficient. From early the first day, the lockpicking village was packed. Some attendees stayed for ten minutes and had a great time by learning the basics. While some stayed for hours and opened ever challenging locks. Most notable were the participants that kept returning to the village throughout the event, it was very clear they got the bug. We have taught between two hundred and three hundred people, and between five and fifteen people at the time.

After we packed our gear at the end of the event. We decided to take another dive in the swimming pool, before heading out to the after party at the Hyatt Capital Gate. I’ve cut the party short as our flight back was early in the morning.

The casualties of this event, insert lock pick and twist.

Wrapping up, we had a great time at the HITB CyberWeek 2021. For the next one, I’m likely to take more days of holiday and do more sightseeing and other activities in Abu Dhabi. Even as a midweek, it was well worth the time.

We would like to thank the HITB crew for inviting us and arranging everything. Furthermore, we had a great time at the event and hope to see you again at HITB Amsterdam.

Mandatory impressioning opens.

Blog by Jan-Willem Markus. Photo CCBY4.0 Toool Blackbag.