HPAVC

home *** CD-ROM | disk | FTP | other *** search

/ HPAVC / HPAVC CD-ROM.iso / INFORM_5.ZIP / INFORM-5

Wrap

Text File | 1993-03-31 | 177KB | 3,700 lines

+=============================================================================+ | ## ## ## ###### ###### ###### ### ### ###### ###### ## ## ## | | ## ### ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## | | ## ## ### ##### ## ## ###### ## ## ###### ## ## #### | | ## ## ## ## ###### ## ## ## ## ## ## ## ## ## ## | +=============================================##==============================+ | Oct 31, 1992| | [ The Journal of Privileged Information ] | | | +-----------------------------------------------------------------------------+ | Issue 05 By: 'Above the Law' | +-----------------------------------------------------------------------------+ | | |Informatik--Bringing you all the information you should know... | | and a lot you shouldn't... | | | +=============================================================================+ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - *DISCLAIMER* Informatik Journal is printed for informational purposes only. We do not recommend or condone any illegal or fraudulent application of the information found in this electronic magazine. As such, we accept no liability for any criminal or civil disputes arising from said information. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - =========================================== ============== - CONTENTS - =============== ================ Issue 05 ================= ======= Release date Oct 31, 1992 ======== =========================================== 01) Issue #5 Introduction By: Informatik Staff 02) X-Mas Con 1992 Announcement By: DrunkFux 04) Locks and Physical Security By: Sterling 05) USSS Frequency Guide By: Miles Barkman 06) Cellular Update By: The US Congress 07) The HP3000's 'SECURITY/3000' system (part 3) By: Sterling 08) Informatik Submission & Subscription Policy By: Informatik Staff - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - /* Introduction */ Happy Halloween and welcome to the 5th issue of the Informatik Journal. Though still suffering the slings and arrows of higher education, we have again managed to crank out an issue. Unfortunately we are still having a very poor response to our call for submissions. Come on! Contribute it. Even if you aren't an expert, we can all benefit from a little research on your part. Just head on out to the local library, find something interesting, and research it into a nice, informative article. We welcome information on the government, radio, computer hacking, preaking, and anything else of interest to the "computer underground" crowd. Even if you are not a writer, we welcome any feedback you may have concerning informatik. Speaking of which, WE HAVE MOVED SHOP! Thanks to our pals in Pittsburgh, we now have a new home: (inform@grind.cheme.cmu.edu) All subscription requests, feedback, etc, should be sent to that address. The old address is no longer valid, so any correspondance to our previous address has long since entered the cyber void. The bulk of this issue (135k!!) is devoted to an article on Security Devices that is the most complete guide to locks, lockpicking, and security systems available to date. It should prove interesting to you all. In other news XMAS CON IS COMING! The whole staff of Informatik will be there, as will plenty of other interesting characters. Be there, its always interesting. Radio scanners need to check out the new collection of Secret Services frequencies and information on the latest, greatest cellular interception restrictions. And wrapping it up, we have the third and final part our series on The HP3000's 'SECURITY/3000' system. We've been asked to pass along that a bbs has been set up on 128.2.55.27 for those of you with internet access. Simply logon as bbs. Informatik staff currently consists of Sterling, and MackHammer (between naps), with additional assistance provided by Live0ne and Holistic. If you are interested in working with the staff, drop us a line. Enjoy, Informatik Staff - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - [Updated Announcement - October 27, 1992] dFx International Digest and cDc - Cult Of The Dead Cow proudly present : The Third Annual X M A S C O N AKA H 0 H 0 C O N "WE KAN'T BE ST0PPED!" Who: All Hackers, Journalists, Security Personnel, Federal Agents, Lawyers, Authors and Other Interested Parties. Where: Allen Park Inn 2121 Allen Parkway Houston, Texas 77019 U.S.A. Tel: (800) 231-6310 Hou: (713) 521-9321 Fax: (713) 521-9321, Ext. 350 When: Friday December 18 through Sunday December 20, 1992 HoJo's Says NoNo To HoHo ~~~~~~~~~~~~~~~~~~~~~~~~ HAY!^@!*%!$1#&! We beat our own record! This year, thanks to one certain person's complete stupidity and ignorance, we managed to get kicked out of our first chosen hotel four months in advance. Needless to say, this caused some serious confusion for those who called to make reservations and were told the conference had been canceled. Well ... it hasn't been. The story is long, but if you wish to read exactly what happened, check out CuD 4.45. The conference dates are still the same, but the hotel has changed since what was originally reported in the first update, which made it's way throughout Usenet and numerous other places, including CuD 4.40. If you haven't heard about the new location, please make a note of the information listed above. What Exactly Is HoHoCon? ~~~~~~~~~~~~~~~~~~~~~~~~ HoHoCon is something you have to experience to truly understand. It is the largest annual gathering of those in, related to, or wishing to know more about the computer underground (or those just looking for another excuse to party). Attendees generally include some of the most notable members of the "hacking/telecom" community, journalists, authors, security professionals, lawyers, and a host of others. Last year's speakers ranged from Bruce Sterling to Chris Goggans and Scot Chasin of Comsec/LoD. The conference is also one of the very few that is completely open to the public and we encourage anyone who is interested to attend. Or, as Jim Thomas put it in CuD 4.45: "For the past few years, a conference called "XmasCon" (or HoHoCon) has been held in Texas in December. As reported previously (CuD #4.40), it will be held again this year from 18-21 December. For those unfamiliar with it, XmasCon is a national meeting of curious computer aficionados, journalists, scholars, computer professionals, and others, who meet for three days and do what people do at other conferences: Discuss common interests and relax." Hotel Information ~~~~~~~~~~~~~~~~~ The Allen Park Inn is located along Buffalo Bayou and is approximately three minutes away from downtown Houston. The HoHoCon group room rates are $49.00 plus tax (15%) per night, your choice of either single or double. As usual, when making reservations you will need to tell the hotel you are with the HoHoCon Conference to receive the group rate. Unlike our previously chosen joke of a hotel, the Allen Park Inn is not situated next to an airport and this may cause a small inconvenience for those of you who will be flying to the conference. The hotel is centrally located so you can fly in to either Intercontinental or Hobby airport but we are recommending Hobby as it is 15 miles closer and much easier to get to from the hotel. Here's where it may get a little confusing: If you arrive at Hobby, you will need to take the Downtown Hyatt Airport Shuttle to the Hyatt, which departs every 30 minutes and will cost you $6.00. When you get to the Hyatt, get out of the shuttle with your luggage (for those who may not of figured that out yet) and use any of the nearby payphones to call the Allen Park Inn (521-9321) and tell them you need a ride. It's just like calling Mom when you need a ride home from glee club! The hotel shuttle will be around shortly to pick you up and take you to the aforementioned elite meeting place, and that ride is free. If all this is too much for you, you can always take a cab directly to the hotel which will run you about $20. If you arrive at Intercontinental, you will need to board the Airport Express bus and take it to the Downtown Hyatt ($9). Once there, just follow the same instructions listed above. We are in the process of trying to get the hotel to provide constant airport transportation during the conference, but they've yet to give us a definite answer. It is quite possible that we will have our own shuttle to bus people between the airports and hotel, so if you'd prefer a faster and more direct method of transportation, it would be helpful to mail and let us know what time you'll be arriving and at what airport. This will give us a chance to coordinate things more efficiently. Check-in is 3:00 p.m. and check-out is 12:00 noon. Earlier check-in is available if there are unoccupied rooms ready. Free local calls are provided, so bring dem 'puterz. I don't know if cable is free also, so those who wish to rekindle the memories of yesteryear may want to bring their screwdrivers. The hotel has both 24 hour room service, and a 24 hour restaurant, The Nashville Room. Call it a wacky coincidence, but the hotel bar is called the ATI room and like most of Houston's similar establishments, closes at 2 a.m. Good thing Tony still works at Spec's ... This time around, the hotel is placing the conference guests in the rooms surrounding the courtyard/pool area. We are once again encouraging people to make their reservations as soon as possible for two reasons -- first, we were told that if you wait too long and the courtyard rooms are all taken, there is a chance that you'll be situated at the complete opposite end of the hotel, which isn't so bad if you don't mind walking all that way back and forth outside in December. Secondly, there is no other hotel exactly next door to this one (the closest is about five minutes away or so), so if for some odd reason all the rooms get rented, you'll get to do some nifty traveling every night. Directions ~~~~~~~~~~ For those of you who will be driving to the conference, the following is a list of directions on how to get to the hotel from most of Houston's major freeways that bring traffic in from out of town: I-45 North or South: Exit Allen Parkway on the inside (left side) of the freeway. Take the Studemont/Montrose exit off Allen Parkway, then make a u-turn at the bridge and head back towards downtown. The hotel will be on the right hand side. 290: Take 290 to 610 South, then take I-10 East towards downtown. Exit Studemont. Right on Studemont, left on Allen Parkway. The hotel will be on the right hand side. I-10 West: Exit Studemont. Right on Studemont, left on Allen Parkway. The hotel will be on the right hand side. I-10 East: Take I-10 East to I-45 South and follow the same directions from I-45 listed above. I-59 North or South: Take I-59 to I-45 North and follow the same directions from I-45 listed above. Call the hotel if these aren't complete enough or if you need additional information. Conference Details ~~~~~~~~~~~~~~~~~~ HoHoCon will last three days, with the actual conference being held on Saturday, December 19 in the Hermitage Room, starting at 11:00 a.m. and continuing until 5 p.m. or earlier depending on the number of speakers. We are still in the planning stages at the moment, primarily due to time lost in finding a new hotel and getting contracts signed. We have a number of speakers confirmed (yes, Goggans will be speaking again) and will try to finalize the list and include it in the next update. We are definitely still looking for people to speak and welcome diverse topics (except for "The wonders and joys of ANSI, and how it changed my life"). If you're interested in rattling away, please contact us as soon as possible and let us know who you are, who you represent (if anyone), the topic you wish to speak on, a rough estimate of how long you will need, and whether or not you will be needing any audio-visual aids. We would like to have people bring interesting items and videos again this year. If you have anything you think people would enjoy having the chance to see, please let us know ahead of time, and tell us if you will need any help getting it to the conference. If all else fails, just bring it to the con and give it to us when you arrive. We will also include a list of items and videos that will be present in a future update. If anyone requires any additional information, needs to ask any questions, wants to RSVP, or would like to be added to the mailing list to receive the HoHoCon updates, you may mail us at: dfx@nuchat.sccsi.com drunkfux@freeside.com drunkfux@ashpool.freeside.com 359@7354 (WWIV Net) or via sluggo mail at: Freeside Data Network Attn: HoHoCon/dFx 11504 Hughes Road Suite 124 Houston, Texas 77089 We also have a VMB which includes all the conference information and is probably the fastest way to get updated reports. The number is: 713-866-4884 You may also download any of the conference announcements and related materials by calling 713-492-2783 and using the username "unix", which is unpassworded. The files will be in the "hohocon" directory. Type "biscuit" if you wish to gain an account on the system. You can find us there too. Conference information and updates will most likely also be found in most computer underground related publications, including CuD, Informatik, NIA, Mondo 2000, 2600, Phrack, World View, etc. We completely encourage people to use, reprint, and distribute any information in this file. Stupid Ending Statement To Make Us Look Good ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ HoHoCon '92 will be a priceless learning experience for professionals (yeah, right) and gives journalists a chance to gather information and ideas direct from the source. It is also one of the very few times when all the members of the computer underground can come together for a realistic purpose. We urge people not to miss out on an event of this caliber, which doesn't happen very often. If you've ever wanted to meet some of the most famous people from the hacking community, this may be your one and only chance. Don't wait to read about it in all the magazines and then wish you had been there, make your plans to attend now! Be a part of what we hope to be our largest and greatest conference ever. Remember, to make your reservations, call (800) 231-6310 and tell them you're with HoHoCon. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - ********************************************* ********************************************* ** ** * Locks and Physical Security Devices * * * * by Sterling * ** ** ********************************************* ********************************************* Introduction ------------ Ever since man has had something worth keeping, he has devised ways to protect it. The Egyptians were the first to develop a working lock of any complexity. It was based on a flat, wooden "key" with a series of raised pins that enable the user to slide back a wooden bolt that protected the door from entry. Advances in metallurgy eventually brought forth locks of iron. As locks became more complex, the great medieval locksmiths' guilds carefully guarded their secrets. Restrictions forbid the guild's members from discussing the relatively simple inner workings of locks for fear of losing their power. By protecting their secrets, the locksmiths were able to exploit their unique skills, charging outlandish sums for their services. The same principles apply today. That is why a locksmith can charge you $60 to come and unlock the door to your house. Americans spend millions each year on security systems to protect their property. Often this money is wasted on devices that really provide only limited protection. In this text I would like to expose how locks and security systems work, and how you can bypass them if needed. It is easy to lose faith in the common door lock once you understand its simple operation. It took me less than a week with my lock picks before I could open my front door. Any first timer can open a desk or filing cabinet after achieving a basic understanding of the principles of modern locks. Hopefully this article will expose to more people just how unsecure locks can be, and with practice you should be able to pick your way into your house should the need arise. The content of the article comes from a wide variety of sources. Personal experience, excerpts and summaries from the "alt.locksmithing" newsgroup, and from locksmithing and lockpicking books. Special thanks goes out to *Hobbit* for his simplex and hotel lock articles. There are several types of locks that you are likely to encounter. These locks are easy to spot and identify what you know what to look for. Here I will discuss everything from the seldom used "warded lock" to alarm systems. Table of Contents: ------------------ Key Operated Locks Latches The Warded Lock The Lever Lock The Wafer (Disc) Tumbler Lock The Pin Tumbler Lock Tubular Cylinder Locks Lockpicking Tools The Basic Picks Making Your Own Picks Purchasing Picks Attitude and Tips for Success Other Security Devices Combination Locks Magnetic Locks Simplex Locks Automotive Protection Systems The Marlock System VingCard Locks Electronic Hotel Card Locks Alarm Systems Type of Latches ~~~~~~~~~~~~~~~ The latch is a spring bolt that actually holds the door shut. This is in contrast to the deadbolt, that had NO spring, and must be manually engaged. There are two primary types of latches, the springlatch and the deadlatch. The springlatch is much more convenient, when the door is shut, the springlatch springs into place, locking the door shut. This is the type of latch found on most key-in-knob type door locks. The problem with the springlatch is that it is easily defeated by sliding a plastic card or thin knife and forcing it back. To prevent this, a latch guard can be installed. This is a device constructed from heavy steel folded lengthwise at a ninety degree angle or a T-bar shape. It is usually anywhere from six to twelve inches in length and is fastened to the edge of the door by bolts. The latch guard hides the latchbolt, and prevents any tampering with it. The deadlatch cannot be shoved open like the unprotected springlatch can. When the door is closed, the latch bolt is secure in the lock position and acts as a deadbolt (a bolt that is not spring loaded, and resists any end pressure). The deadlatch resembles a smaller, beveled bolt projecting from the latchbolt. On some designs, the deadlatch takes the shape of an additional bolt, somewhat smaller, and usually placed higher up on the lock body. A key or interior locking mechanism must be used to engage the deadlatch and lock the door. The Warded Lock ~~~~~~~~~~~~~~~ The warded lock's basic design was created by the ancient Romans. The basic principle behind its operation is a series of "wards" (projecting obstructions) that prevent all but the proper cut key from being rotated inside the lock. These obstructions have been placed in the path of the turning of the bit portion of the key. This type of lock utilizes a key that has been notched in a way that it clears all the wards, but is still able to turn the bolt. These locks are easy to recognize. They are the "classic" antique lock that you may still find in old houses. _______ blade (stem) ##### handle (bow) / \ ######## | | ################################# ## \ / ################################# ## | | #### ### ######## / \ #### ### ##### / \ #### / \ bit a warded key for a two-ward lock /___________\ warded key lock entrance The number of wards in the lock can vary, but normally two is the minimum. When a user inserts a key into the warded lock, the metal obstructions inside the lock allow only the proper key to be inserted. The key bittings allow the key to turn in a circular motion, opening the lock through one of four different mechanisms: 1) The key lifts a detent lever while throwing the bolt, providing deadbolt action. (Deadbolt action means that the bolt is secure against end pressure.) 2) The key moves a bolt whose locked or unlocked position is maintained by the action of a humped flat spring in two notches on the bolt. 3) The key moves directly against the latch tail of a latchbolt, or does so through the action of a floating lever. 4) The key inserts between two springs and wedges them apart as it is turned. (Usually only in warded padlocks) Picking These locks offer only token security to the user. Besides being easy to circumvent, the warded locks offers only about fifty alternate keying combinations. Picking them is generally regarded as trivial. All that is required is to bypass the wards and move the bolt into the unlocked position. This can be accomplished by using a pick known as a "buttonhook". To make your own buttonhook pick, use a pair of pliers to bend a six inch section of coat hanger into a warded key shape as below: ######## ### ## ################################# ## # ## ## ### ## # ##### The wire should be thin enough to pass into the keyway while avoiding all the wards, but stiff enough that it can still manipulate the bolt to open the lock. Though you may have to make a "large" and a "small" warded lock pick, the same principle applies. The Lever Lock ~~~~~~~~~~~~~~ Robert Barron invented the lever lock in 1778. This constituted a considerable improvement over the ancient warded lock. It was based on a series of several "levers" that must each be raised to their own set height. If a particular lever was lifted to high or not enough, then the lock would not open. When the proper key is inserted, the notches on the key raise all the lever tumblers the required distance, lining up all the gates, allowing the lock to be opened. Not only was this new lock much harder to pick, it offered up to ten billion possible keying combinations. (The amount of practical combinations is actually around fifty thousand) ##### __ ####### / \ ## ### #### ## ########### ## \ / ###### ####### ########### ## | | a lever or "lever tumbler" ########################### ## | | lock keyhole ####### |__| #### a lever tumbler lock key Since its design the lever tumbler lock has undergone numerous improvements. One of the is called the parautopic lock. The parautopic lock consisted of two sets of lever tumbler, where the first worked on the second. It also proved a plate that turned with the key so that one could not inspect the locks interior construction. Lever locks, though limited in use, can still be found today in some hospitals, suitcases, cabinets, fine furniture, and attache cases. Lever locks are also used on safe-deposit boxes, often with fifteen or more levers and sometimes requiring two keys. Picking Lever locks are a little harder to pick then the wafer and pin tumbler variety. In fact, the type of lever locks used on safe-deposit boxes are very difficult to pick indeed. To pick a lever lock requires that tension be placed against the deadbolt throughout the course of lifting one or more levers within the lock to the required alignment with the post. This requires the use of a "lever lock tension wrench" and a "hook" or "lifter" pick. [Picks are discussed later in the Lockpicking Tools section.] Insert the lever lock tension wrench (a bit different than a normal tension wrench) into the keyway, and exert torsional pressure. The long bit is the part you hold, the next bend runs to the bottom of the lock, and the final bend fits into the notch in the bolt. Unlike most other types of locks, the lever locks requires you to exert considerable pressure on the tension wrench while picking. Usually the lever springs provide enough force to cause the levers to drop back down once picked. Because of the greater pressure, lever locks may require a slightly thicker tension wrench then normal. Then insert the hook pick all the way into the lock. Locate the back lever and raise it gently until you FEEL or HEAR a slight "click". With the lever locks, the force required to push against the spring is substantially more than in other locks. Once it reaches the correct position, the gate will align with the post, and you should notice a slight "give" in the deadbolt, as there is now one less lever obstructing the lock from opening. You should note that once a lever has been picked, the amount of force required to lift that lever will be substantially less. Move on to the next lever by slightly withdrawing the pick and repeat the process. Each subsequent lever will require the use of slightly less tension then on the previous ones. Otherwise the increased tension could cause the lock to bind up. Once you have picked each individual lever, the lock should open. If it does not, then reinsert the pick (always maintaining tension with your wrench) and jiggle each lever slightly to ensure correct alignment. Each lever does not require very much lift. This is due to the fact that the maximum depth of the cut under any tumbler is no more than half the width of the key, and never more than two-thirds its width. You should therefore use a pick that does not have too much "hook" to it. The Wafer Tumbler Lock ~~~~~~~~~~~~~~~~~~~~~~ The wafer tumbler lock was developed as a low-cost lock that offered a reasonable degree of security to the owner. These locks are make up over one-fourth of all the locks in the world. The outside of the lock resembles the pin tumbler lock (yet to be discussed), but uses a much simpler mechanism. Wafer keyways usually have simple side ward indentions. The key is usually shorter than that of other locks, but equally broad. It may be cut on one or both sides. A two sided wafer lock is often called a "double wafer." The lock consists of four main parts. The plug housing, which contains the wafers and springs, the shell, the cam (locking bolt), and the retainer. The wafers are sometimes referred to as "discs" because their top and bottom are rounded to fit into the cylinder. Here is a diagram: 5 ___ 7 | ___ ||############## 1-> @| _ |_ ## ||## ## ## ## ## @||2||/ 6##||##4##3##2##1## <-keyway @||_|| ## ||## ## ## ## ## \|___| ___||############## 3 | \plug/ detail of a wafer tumbler cutaway side view 1) spring of a wafer lock 2) key slot 3) spring wing 1-4) spacings #1-4 5) cam (operates the bolt) 6) retainer (rear plug) 7) the shell (body of the lock) Each lock has a series of chambers in which the wafers rest. These spacing closest to the front of the lock is numbered with one, and their numbers increase toward the back of the lock. Picture a number of the wafers placed face-to-face in the plug's spacing chambers. Each wafer is equal in overall size, but the key slots are of varying height. A metal spring exerts pressure on the spring wing of each wafer, forcing its lower part into the shell's "locking grooves" which lets the lower portion hang about midway into the keyway. Looking into the lock, you should be able to see this. These wafers act to hold the plug and shell together, preventing the lock from turning. When the correct key is inserted, it goes through the key slots on each wafer, raising the wafers out of the locking groove. The key must have the appropriate depth of cut in each position to raise the wafer the correct amount. The depth of the key's cut (and the length of the wafer's key slot) is any one of five different depths. The shorter the top edge of the wafer's key slot, the lower the key cut depth value. For instance the number 1 slot (the slot that is the largest) would require the shallowest cut in the key. Normally lock manufacturers place a number four or five wafer near the keyhole to block the view of the back wafers. Also note that the same type of wafer may appear several times in the same lock. Above some brands of wafer tumbler lock you will see a small hole. When the lock has been unlocked, you can remove the entire lock plug by inserting a piece of stiff wire into this hole and depressing the retainer. Though nowhere near as secure as the pin tumbler lock, the wafer tumbler is a very popular, low cost lock. The lock is normally found on cheaper cabinets and desks, some padlocks, some automobile locks, locking handles, and trailer doors. Where more security is desired, the double wafer type is used, providing wafers on the top and bottom of the keyway. Picking Though harder to pick then the warded lock, the wafer lock is still easy to circumvent. This is an excellent lock to practice on because the techniques required to pick it are applicable to the pin tumbler lock as well. Like the lever lock, picking the wafer tumbler lock requires use of a tension wrench and a pick. A variety of the different picks can be used including the rake, the hook, the half-diamond, and the half-round pick. Selection depends on the size of the lock, the distance between each wafer, and personal preference. Raking One of the most common methods of picking the wafer tumbler lock is by raking. To rake the lock, insert the tension wrench is inserted just inside the keyway, stopping short of the first wafer, and flush with the bottom of the keyway. Apply moderate tension to the wrench. If you apply too much tension the wafers will bind and not be able to move into alignment. Once you have the tension wrench in place, insert either the rake or half-round pick into the keyway. Don't worry about feeling the tumblers, instead concentrate on applying uniform pressure to them as you move the rake in and out of the keyway in a scrubbing motion. This scrubbing motion should cause the wafers to lift into alignment as they are thrown up and down in their spacings. This method is usually quite effective on most wafer locks, and should always be tried first. Manipulating Individual Wafers If the lock does not respond to raking, you can try using the half-diamond pick to each wafer into alignment one-by-one. While maintaining light but consistent pressure with the tension wrench, use the pick to lift each wafer into alignment at the shear line, starting from the backmost tumbler. Once it reaches the proper alignment, you should feel or hear a slight "click" and the plug will turn ever so slightly, relieving a bit of pressure on the wrench. Continue one-by-one, working outward, until each tumbler has been aligned and the lock opens. Vibration Picking Often you can use a technique called vibration picking to open a wafer tumbler lock. This uses a tool known as a "snapper" pick or a "lockpick gun". [These are described in the Lockpicking Tools section of this article] To use the snapper pick maintain a light tension with the wrench and insert the tip of the pick into the keyway, just touching the bottom of the tumblers. Then use the thumb, which rests along the top edge of the pick to depress the top loop. Let the thumb slide off the compressed part of the pick, permitting it to snap back. It will then strike a light blow to the tumblers, popping them up until they are held in place at the shear line. Repeated snaps, while maintaining tension with the wrench, usually results in aligning all the tumblers, and thus opening the lock. The lockpick gun works automatically, with a trigger device that "snaps" its wire pick up in the keyway. Picking Double Wafer Locks Double Wafer locks are picked the same way as single wafer locks, but there two sides to the story. Not only must you align all the top wafers, but the bottom ones as well. You can purchase special designed tension wrenches with will let you then use a ball pick to pick both sets of wafers. Alternatively you can use a standard tension wrench in the center of the keyway, using a half diamond pick. Once you have picked one set, simply reverse the pick and pick the other. It may take a few tries before you are able to hold all the wafers in place. The Pin Tumbler Lock ~~~~~~~~~~~~~~~~~~~~ Pin tumbler locks are by far the most popular lock today. Over half of the locks in use are of the pin tumbler type. They look similar to the wafer tumbler lock, but can easy be distinguished by their round pins, visible in the keyhole. There operation is also similar to the wafer type, but is more costly and requires much stricter machining tolerances. Here are some diagrams: | | | |________________________________________ | | @ | | @ | | @ | | @ | | @ | | | @ | | @ | | @ | | @ | | @ | Tumbler springs | | @ | | @ | | @ | | @ | | @ | | | @ | 4 | @ | | @ | | @ | | @ | | | @ | ||~|| | @ | ||~|| ||~|| |___||~||___|| ||___||~||___|| ||___|| ||__ _ _ _ _ _ _Shearline \_ ||1|| 3 || || || || || || || | | \_|| ||___||~||___|| ||___||~||___||~| | |~| | | |~| | | | | | keyway |2| | | | | | | | | | Plug |_| |_| |_| |_| |_| | +-----------------------------------------+ | | | | The pin tumbler lock, cutaway side view (locked) 1) top pin 2) bottom pin 3) cylinder (top of plug) 4) shell | | | |________________________________________ | | @ | | @ | | @ | | @ | | @ | | | @ | | @ | | @ | | @ | | @ | Tumbler springs | | @ | | @ | | @ | | @ | | @ | | || || 4 || || || || || || || || | ||1|| || || || || || || || || |___|| ||_ _|| ||___|| ||___|| ||___|| ||__ _ _ _ _ _ _Shearline \_ ||~|| 3 ||~|| ||~|| ||~|| ||~| | \_||2||___|| ||___|| ||___|| ||___|| | | | | |_| | | | | | keyway |_| |_| |_| | Plug | +-----------------------------------------+ | | | | The pin tumbler lock, cutaway side view (unlocked) 1) top pin (drivers) 2) bottom pin (key pins) 3) cylinder (top of plug) 4) shell ___________________ ___________________ _/ @ \_ _/ @ \_ / @ 3 \ / @ 3 \ | @ | | | | | | | | | | |2| | | ____|2|____ | | ____|_|____ | | / |_| \ | | / | | \ | | | _| |_ 4 | | | | _|1|_ 4 | | | | / |1| \ | | | | / |_| \ | | | | | |_| | | | | | | | | | | | | | | | | | | | | | | | | 5 | | | | | | 5 | | | | | \_____/ | | | | \_____/ | | | | 6 | | | | 6 | | | \___________/ | | \___________/ | | 7 | | 7 | \_ _/ \_ _/ \___________________/ \___________________/ Locked Unlocked Pin Tumbler Lock (front) Pin Tumbler Lock (front) 1) bottom pin (key pins) 2) top pin (drivers) 3) tumbler spring 4) shear line 5) keyway 6) plug (cylinder) 7) shell OK, I will explain how the pin tumbler lock works, but you really should consider going to K-Mart and buying a cheap lock to take apart and study. In the lock's shell (main body) there is the keyway and three to eight (usually five) spacings drilled from the top of the lock into the keyway. This is similar in principle to the wafer lock. In each of theses spacings are two pins and a spring. The top pins are always the same length, while each bottom pins can each be any of ten different sizes (0-9). Note that the bottom pins have a rounded bottom, allowing for them to ride up the key easier. The spring forces the pin stack down so that the lower pin protrudes into the keyway. (The wedge slot keeps them from falling all the way to the bottom of the keyway) When the correct key is inserted, each pin stack is lifted according to how deep or shallow the key is cut in that corresponding location. To open the lock, the top of bottom pin (the point where the top and bottom pin meet) must line up with the lock plug and the shell (the shearline). When in this position, the lock is unlocked and the plug can rotate around, taking the bottom pin around with it. If any pin is raised too high, or not high enough, then that pin keeps the plug from turning inside the lock shell. Of course in the locked position, all the pins stop the plug from turning. These locks are used almost everywhere. The provide over a million possible combinations for a five pin lock, and billions for the eight pin. These are the standard door locks in most residential and commercial buildings. Often you will find pin tumbler locks with only three pins on cheap desks, some copy machines, and storage lockers. They offer a reasonable degree of security, but are far from tamper proof. Picking Picking the pin tumbler lock is based on the principle that slight imperfections exist in every lock. Every lock is machined to certain sets of tolerances, such as plus or minus .0002 inches. The closer the tolerance, the harder the lock is to pick, but the more expensive the machining costs. That is what makes one pin tumbler lock harder to pick than another. This variation in the lock's components means that in attempting to turn the plug in the lock without the proper key, one tumbler will be caught up and become tight before subsequent tumblers are. Therefore, when turning tension is applied to the plug with a tension wrench, and the tight tumbler is lifted with a pick, there will be either a clicking feel or a sudden relief in the tension the tumbler exerts on the pick. This relief of tension occurs when the pin is brought up even with the shear line. At this time, lifting can be stopped. Use a hook pick to lift each pin to its breaking point, starting with the pin that is bound (resisting) the tightest. Gently pry the pin up against the spring pressure until it breaks at the shear line. Care must be taken not to lift the pin too high, or it may become jammed in the upper chamber. It is often impossible to get this pin back down without releasing tension on the plug. A common problem is applying too much tension. A light touch should be used because too much pressure on the wrench not only makes it hard to feel any change in torsional pressure, but tends to bind all the pins, making picking order difficult to determine. The tension wrench needs only to provide a little torque so that the pins stay up once picked. Raking and Vibration picking You can also use the raking and vibration picking methods described in the section on wafer tumbler locks to pick pin tumblers. You can even use a combination of raking and pin picking. Simply rake the pins a few times, and then go back and pick any pins that the rake missed. You can use the hook pick to probe each pin. If the pin feels "springy" then it has not yet broke at the shear line. Another technique: Start picking at the back pin, the one furthest away from you as you face the keyway. The reason for this is relatively simple. The rear pin will be the last worn, and when you break it, the lock's plug will move the most it ever will for just one pin breaking. This will make it easier to pick the other pins, as the break between the inner and outer cylinders will be progressively held tight against the pin you are working, as you work the lock from rear to front. The reason the rear pin is least worn is that inserting a key "rakes" the pins up and down, wearing down their sides. The rear pin is raked only once per time the key is inserted, the pin in front of it is raked twice, and so on. Its not uncommon to see locks in which the front pin can not be picked before the rear ones. The reason was that it was worn down to the point that no amount of torsion would cause the inner plug to put any force against it. Consequently, it won't break. Rapping Sometimes you can use a form of vibration picking known as rapping to open a pin tumbler lock. A tension wrench is inserted into the keyway, and light to moderate tension is applied. At the same time, the face of the plug is struck sharply with a plastic mallet or hammer handle. The rapping forces the springs and pins to gravitate toward the force of the blows. Hopefully this vibrates the picks into their breaking positions. DO NOT HIT TOO HARD! Approach this method with caution. Practicing To learn how to pick pin tumbler locks, it is best to go to the store and buy a "practice" lock. Try to find either a KwikSet brand or a cheap Ilco lock cylinder. On top of the lock shell is a little sliding strip that covers the pin spacings. Carefully slide it out. you can then take out the spring, the top pin, and the bottom pin. Remove all but one the assemblies and replace the cover. Now you can practice on picking the lock with only one pin. When you become good at that, insert another stack of pins, and so on until you can pick the lock with all five pins in place. Spool Pins It is possible that in the course of picking a high security pin tumbler locks, the plug will turn a bit as if it were going to unlock, then stop. I will turn no more than 2 or 3 degrees around. This means you have encountered a spool pin. These are simply drivers, or key pins, or both that have had their center portions cut down to a smaller diameter. ______ |_ _| | | | | Lock body Note that any torsion applied to the ___| | | |____ cylinder will tend to catch the spooled ||____|| pins at their waists instead of at the | ____ | Cylinder break between the pins. This will ||_ _|| either prevent the pick from pushing | | | | the pin up if the top spool is caught, | | | | or it will prevent the pin from falling ___|| ||____ down, if the bottom spool is caught. | | \__/ Keyway spool pins With a hook pick, you'll be able to press up on each pin and feel the difference. When you have a spool pin caught across the shear line, gentle upward pressure will result in force in the opposite direction of the way you're turning. Determine which pins are spool pins and push up until the bottom of the pin (assuming it's a top pin) crosses the shear line. You might lose some previously picked pins, but just pick them again. Interlocking Pins Several manufacturers have designed high security locks involving angled and interlocking pins. Emhart makes a cylinder using angled cuts on the keys where the top and bottom pins actually interlock: +--------------+ | | | Top | | Pin | | | | | Interlocking Pins +-----+ +-----+ +---+ | | +---+ | | | | | | | +-+ | | +-+ | | | +-+ +-+ | | | | | | | | | | +------+ | | | +----------+ | | | | Bottom | | Pin | So the pins have to be turned to the correct angle in order for the pins to slide apart when you turn the plug. This also means that the cylinder has to be grooved to allow for the portion of the top pin sticking down, and the bottom of each key has notches in it so that it can turn more than 180 degrees. Tubular Cylinder Locks ~~~~~~~~~~~~~~~~~~~~~~ Tubular cylinder locks are widely accepted as the most secure locks you can get for a reasonable price. Tubular cylinder locks are the round type locks you find on most vending machines, ATMs, and the like. They are basically a pin tumbler lock where the pins are arranged on a circular plane. The key is a cylinder with cuts around its perimeter. When the key is inserted, each pin (whose faces are visible) is pushed in the corresponding depth and the plug can be turned. Picking Your best bet for picking these locks is to purchase a specially designed tubular cylinder pick. While it can be picked with conventional tools, it takes forever because you have to pick it three or four times to turn the plug the 120 to 180 degrees needed to unlock it. And what's worse is that the cylinder locks after each time you pick it -- every one-seventh of a turn! If you want to try it, here's how. If you don't have a tubular cylinder pick you will require a wrench that is .062 inches square on its end. Fit this into the groove of the tubular cylinder plug. Apply tension in a clockwise direction, then use a straight pin to push each pin down until it clicks into place. Proceed to the next pin, until all are picked and the plug turns a few degrees. You will have to repeat this until it unlocks. Do not leave the locks halfway picked. If you do, even the original key will not be able to open the lock until it has been picked back into its original position. Good Luck! Lock Picking Tools ~~~~~~~~~~~~~~~~~~ The Basic Picks | _______________________________________| tension wrench This is the standard tool for pin and wafer tumbler locks. It is inserted in the bottom of the keyway to provide a torsional force to the lock cylinder. ______________________________________/| half-diamond pick The half-diamond pick can be used for raking or picking wafer tumbler locks, or picking pin tumbler locks where the distance between pins is small. ---------------------------------\/\/\/\ rake Not surprisingly, the rake (sometimes called a snake pick) is used to rake wafer and pin tumbler locks. . ______________________________________/ hook The hook (also known as the feeler or lifter pick) is normally used for picking pin and lever tumbler locks, but can be used on larger wafer locks. ______________________________________O O ball _____________________________________OO OO double ball The ball type picks are actually not as pronounced as they look here in the ascii diagram. Imagine a "ball" of a little less height, a bit more width. Though not essential, the ball picks can be used when attempting to rake a wafer-tumbler lock. Lever Tumbler Tension Wrench The big difference with a lever tumbler is in the method of applying torque. The cylinder, in models where it's visible, rotates freely--it does not operate the bolt. Rather, the end of the key goes into a notch in the bolt, directly operating it, just as in a warded lock. This means you need a different torsion wrench, that looks like this: _______ | | | | | | | | |__________________ Obtaining Lockpicks Now I'm sure that you are ready to start practicing. Unfortunately, locksmiths and the public in general seem reluctant to make picks an easy item to obtain. Therefore you can either make your own, (not that difficult) or obtain them from a commercial supplier (also not that difficult.) Making Your Own Picks You can file or grind picks out of spring steel. It is best to use spring steel - sources include hacksaw blades, piano (music) wire, clock springs, streetsweeper bristles (which can be found along the street after the sweeper has passed), etc. Or, go down to the auto parts store and buy a few stock lengths of .022 in. automobile feeler gauge. You can cut each one in thirds and make a pick from each piece. In a pinch safety pin steel, or even a bobby pin (much worse) can be used. Also try the metal band that holds a set of walkman type earphones together. It is already the perfect width and all you have to do is grind the indentations on it. It makes a really great heavy duty wrench also. You will need an electric grinder, or a grinding wheel mounted on a drill, to shape the picks. When grinding, keep the steel from getting so hot as to anneal (soften) it. You may have to re-harden or re-temper it. Temper the steel by repeatedly getting it red-hot against the grinder, then quenching it. What you get won't be feeler gauge and it won't be spring steel, but something in between that has some give to it and won't shatter. For a tension wrench, while you're at the grinder, take a medium-sized Allen wrench and grind its hexagonal head into a flat blade. Alternatively, you can use a small screwdriver, bent at the end. (Bending a screwdriver with any precision is pretty tough). Bobby pins also make an alright tension wrench, especially the larger ones. They work best if you cut them off and flame to red hot with a burner. Then while it's still hot twist it 180 deg with a pair of vicegrips or needle nose pliers, and bend down the end so it looks like the professional ones, this gives it more 'spring'. The flaming should be done, maybe 3/4ths of an inch from the end. Finally file and sand rough spots from where you cut it. If you take the finest or next to finest crochet hook they make and file down the sides of the business end of it so it will fit in the lock, you can make an excellent feeler pick. Picks from Paper Clips To open a lock with two paper clips, unbend one like this: ____________ / \ This shape is your lockpick, you \__________________________/ put the end with the little hook in the lock and use it to fiddle with the pins. Unbend and re-bend the other paperclip like this: ____________ / \ This shape is your torsion \______________________ wrench. You use it to put | torque on the lock cylinder. _| When the hook is in the cylinder the handle should hand off to the side and the final bend on the hook should be short enough that there is room to get the pick into the keyhole. Warning: Filing cabinets and desks are pretty easy to do with these, but it's not easy to do a door lock with them. Better materials really do help when you're dealing with more than 4 pins in a lock. Making a Pick Gun Get yourself a piece of music wire from the local hobby shop. Find wire that seems just a bit big for an average keyway. This will be ground down later so that it can be inserted. Wire of this diameter is so stiff you may doubt that you have the right size. But you need this stiffness for the device to work. Don't use wire that is too light. You want to bend a circle in the wire about 5 inches back from the end. You want enough length in the first straight part to go all the way into the keyway and leave enough to comfortably fit in your hand. Call this straight part Side A. Try bending the wire around the body of a Magic Marker; this seems to make a nice sized loop. The loop should be 360 + 180 degrees so that the long end of your wire is now parallel to side A. Let's be original and call this Side B. Use pliers to make a 90 degree bend in side B so that the end of it crosses side A. This bend should be located so that the part of side A which extends past the bent part of the wire is long enough to go all the way into the keyway. Hey, why don't we call this cross-piece Side C? Bend this cross-piece 180 degrees around side A so that it forms a slot for side A to slide up and down in. Call the wire segment which goes from A to B and is parallel to C, Side D. Snip off the end of side D which extends beyond side B. We now have an object which resembles a safety pin (hence the name) which has one side (side A) which slides up and down in a slot made by sides C and D and which is held in the bottom of this slot by the spring tension in the loop between sides A and B. Grind the sides of the piece which is to go in the keyway so it will fit. Grind the top of this piece flat. The Top is the side toward side B. This is the part which will be against the tumblers. Bevel the end so it will slide under the tumblers more easily. To use the gun, insert the end into the keyway with side B up. Press down on side B with your thumb to slide the slot C-D down. Let your thumb slip off the wire and the spring will pull side B back up. When the bottom of the C-D channel hits the bottom of side A, it delivers a sharp blow to the bottoms of the pins. Use VERY light pressure on the tension wrench and snap the gun a few times to knock the pins up to the shear line. See the section on wafer locks for a more information. Electric Vibration Picks The motor/base casing from a electric toothbrush, or vibrator makes a decent vibrator pick (pick gun) when you superglue a straight pick to it. Alot cheaper than the pro models, and generally smaller too. Purchasing Your Picks Generally picks are not sold over the counter. Your best bet is to order them from a mail order firm. Most firms will inquire as to your profession when making a purchase. They may not wish to sell them to you unless you are some sort of pubic safety personnel such as an EMT or a fireman. They are available from a variety of sources. Here are some of the most popular: ---------- Gall's Inc. (800)-477-7766 Catalog #BA ---------- Item # : ALS15B Price : $19.99 Name : 10-Piece Locksmith Pick Set "Be prepared for any lock-out. Nine picks and wrenches are grouped in a handy foldover carrying case that is small enough to carry in your pocket. Order you lock pick set and keep it handy for easy entry to any lock-out situation. Black." Item # : PG1B Price : $59.99 Name : Lock Pick Gun "Our trigger action lock pick gun opens doors easily. Just use it with the included picks and instructions -- with a little practice, you can smoothly open any locked house or apartment." ---------- Delta Press Ltd. (800)-852-4445 ---------- Item # : LPS-002 Price : $24.95 Name : The 8 Piece Tool Set "These high quality picks feature new lighter non-breakable plastic color coded handles. Picks are of .022 blue spring steel - hardened to perfection Eight piece set comes with handy see-through case." Item # : LPS-003 Price : $39.95 Name : The 11 Piece Tool Set "This deluxe 11 piece kit features all metal handles and comes in a discrete carrying case for undercover operatives. All picks are .022 blue spring steel and hardened to perfection." Item # : LPS-005 Price : $119.95 Name : The 60 Piece Tool Set "Here it is. The finest lockpick set we've stocked. It includes 60 picks, tension wrenches, and a broken key extractor plus a zippered top grain cowhide case and warded master keys." Item # : LPS-004 Price : $59.95 Name : Professional Locksmithing Tool "The famous lockaid Tool was designed for law enforcement agencies to quickly pick pin tumbler locks. The american-made product is the only superior "lock gun" available. Unlike conventional hand picks that activate only one or two cylinder pins, this tool is designed to span all the pins at once. The needle, powered by trigger action, strikes all t the cylinder bottom pins simultaneously. As the force is transferred to the upper pins, they momentarily rise in the chambers. Comes complete with 3 stainless steel needles and tension wrench." ---------- Phoenix Systems Inc. (303)-277-0305 ---------- "OUR LOCK PICKS ARE THE FINEST QUALITY PROFESSIONAL TOOLS AVAILABLE. Each pick is made of hard-finished clock-spring steel, tempered to the correct degree of hardness. Whether the subject is wafer tumbler locks or 6 & 7 pin tumbler locks, our picks are the best available, and the standard of the industry. With a few minutes of practice, even a beginner can open most padlocks, door locks and deadbolts. NOTE: BE SURE TO CHECK YOUR LOCAL, AND STATE ORDINANCES GOVERNING POSSESSION OF THESE TOOLS." Item # : 604 Price : $75.00 Name : Superior Pick Set "Hip pocket size in top grain leather case. Our most complete set. 32 picks, tension tools & extractors." Item # : 606 Price : $34.95 Name : Tyro Pick Set. "An excellent choice for the beginner. Cowhide leather case contains 9 picks, tension wrenches & key extractor." Item # : 607 Price : 9.95 Name : Warded Padlock Pick Set "This 5 piece padlock pick set is made of the finest blue tempered spring steel. This set will pick open most every warded padlock made today." Item # : 610 Price : $24.95 Name : Double Sided Tumbler Lock Picks "Set of 4 picks for use with double-sided, disc tumbler, showcase, cam and PADLOCKS. An excellent addition to your other pick sets." Item # : 617 Price : $39.95 Name : Padlock Shim Picks "Open padlocks in seconds! Our new Padlock Shim pick's unique design makes them so successful that it is frightening! Simply slide the shim down between the shackle and the lock housing, twist and the lock is open. Works best on laminated type padlocks (the most popular type) but will open ALMOST ANY TYPE OF PADLOCK -- INCLUDING THE POPULAR 3 NUMBER COMBINATION TYPE. Include 20 shims -- 5 each of the 4 most common shackle diameters for perfect fit every time. Comes with complete instructions." Item # : 618 Price : $34.95 Name : Schlage Wafer Pick Set "There are two types of Schlage wafer locks, each needing a different base key to pick with. This set comes with both types of base keys and the pick. With the proper base key the lock is already half picked. Very quick and easy to use. Comes with complete instructions. Item # : 620 Price : $59.95 Name : Pick Gun "Picks locks FAST. Open locks in less than 5 seconds. Specifically designed for tumbler locks. Insert pick into key slot, then just pull trigger. Throws all pins into position at one time. Lock is then turned with tension bar. Used extensively by police and other government agencies. Gun is spring loaded, with tension adjustment knob. Comes with 3 needle picks and tension bar. No batteries necessary. Life-time guarantee. Item # : 612 Price : $16.00 Name : The Slim Jim "Car door opener. The tool does not enter inside the car. Opens a car door by "feel" rather then sight. With a little practice, car opening will be no problem. For GM, Ford and Chrysler cars. Made of clock-spring steel and is hand finished." Item # : 613 Price : $16.00 Name : The Super Jim "This tool will open most GM, Ford and AMC car doors. Opener does not enter vehicle. Made wider and thicker, and is bright nickel plated. Faster openings on most domestic automobiles. With illustrated instructions." Item # : 614 Price : $19.95 Name : Houdini Car Door Opener "The latest and best innovations on car door openers. It works the same as your old Slim Jim, except it now folds neatly to fit in pocket or toolbox without getting in the way. ONLY 6 1/2 INCHES LONG WHEN FOLDED. Open up and snaps into place like a fold-up ruler, excellent stainless steel constructions with vinyl handle for comfort." Item # : 615 Price : $39.95 Name : Pro-Lok "Car Killer" Kit "Over the years we have had thousands of requests for a multi-vehicle opening kit. We are now able to offer the most complete kit that we have ever seen. This kit of tools will open over 135 automobiles, both domestic and foreign, on the road today. The opening procedure for each vehicle is diagrammed and explained in the instruction manual. Kit comes with complete instruction manual and gas cap pick tool." Item # : 600 Price : $129.95 Name : Tubular Lock Pick "This tool is an easy and reliable method for picking tubular locks, as found on commercial vending machines, washers, dryers, etc. This newest high tech design is much faster and easier to use than the old type that used rubber bands to hold the feeler picks. Internal neoprene "O" rings together with knurled collar provide a very simple and easy tension adjustment. Sturdy stainless steel construction provides for long-lasting service. This tool will, with a little practice, easily and quickly open any regular center-spaced tubular lock -- the most popular type of tubular lock on the market. Comes with complete instructions and leather carrying case." Tips for Success ~~~~~~~~~~~~~~~~ Following is information that will help you become more adept at manipulating locks. Solutions to common problems and general miscellaneous information that could prove useful is included. Determining the Direction of Rotation Before you can pick a tumbler type lock, you must determine the correct direction of rotation. It may sound like a trivial point, but who wants to waste hours trying to pick a lock the wrong direction. Though there will of course be exceptions, there are some general guidelines. Cylindrical locks, padlocks, file cabinet locks almost always turn in a clockwise direction or either direction to open. When confronted with a door lock, turn the plug so that the top of the keyhole turns toward the edge of the door. There is a notable exception here, Corbin and Russwin locks turn AWAY from the door edge. Tight or Dirty Locks If a lock seems exceptionally tight or dirty, it will be hard to break the pins. It may help to lubricate the lock. NEVER use a liquid type lubrication such as WD40, 3-in-1 oil, etc... Use powdered graphite, available in most hardware stores. It comes in a little tube, allowing a light squeeze to blow a puff of graphite into the keyway. If lubrication does not help, you may need to apply a little firmer hand on the tension wrench. Proper Attitude It is very important to maintain a confident attitude while you are learning to pick locks. If you feel nervous or stressed, it will only make things harder. You will not be able to pick every lock you come to, but with practice and patience, you may be surprised. Visualise what is happening inside the lock, this is the key. If you don't fully understand how a lock works and exactly what you are doing to it, you will not experience a high degree of success. Combination Locks ~~~~~~~~~~~~~~~~~ Combination locks work on a series of flat, round disks that have notches and pegs (one of each, one set per disk) along their circumference. Notches are referred to as "gates". The first tumbler determines the last digit of the combination, and is actually attached to the dial directly. As the dial is turned, the peg of the first tumbler catches on the middle tumbler's peg, dragging it along. As the dial is turned further, the middle tumbler latches on to the peg of the last tumbler, all three turning together. Turning all the tumblers is known as "clearing" the lock, and must be done before attempting to operate the lock. For the lock to open, the gate on each disk must align up with the pawl (breaking arm) of the bolt. Dialing the first digit of the combination aligns the last tumbler's gate to the pawl. Before dialing the second digit, the dial must be turned one complete turn in the opposite direction (assuming a three tumbler lock, twice for a four digit one). Rotating in the original direction to the last digit will align the first tumbler's gate, and the lock can open. Modern safe combination locks are impossible to crack (literally). Many innovations have given high quality locks this degree of security. Burglars learned to feel the gates and pegs rotate about the lock, allowing them to manipulate the tumblers into their proper position. To combat this, a searted front tumbler was designed to create shallow "false gates". The false gates are difficult to distinguish from the actual gates. To combat this problem, safe crackers would hook up a high speed drill to the dial. This would wear the tumblers edges smooth, eliminating the bothersome shallow gates. Still, despite their security, cheap combination locks are far from foolproof. Determining an Unknown Combination The most common and difficult to open of these small disk tumbler locks are the Master combination padlocks, and they are quite popular. With practice, they CAN be opened. The newer the lock is, though, the more difficult it will be to open at first. If the lock has had a lot of use, such as that on a locker-room door where the shackle gets pulled down and encounters the tumblers while the combination is being dialed, the serrated front tumblers will become smoothed down, allowing easier sensing of the tumblers. So, until you have become good at opening these locks, practice extensively on an old one. Here's how. Step One First, clear the tumblers by engaging all of them. This is done by turning the dial clockwise (sometimes these locks open more easily starting in the opposite direction) three to four times. Now bring your ear close to the lock and gently press the bottom back edge to the bony area just forward of your ear canal opening so that vibrations can be heard and felt. Slowly turn the dial in the opposite direction. As you turn, you will hear a very light click as each tumbler is picked up by the previous tumbler. This is the sound of the pickup pegs on each disk as they engage each other. Clear the tumblers again in a clockwise manner and proceed to step two. Step Two After you have cleared the tumblers, apply an upward pressure on the shackle of the padlock. Keeping your ear on the lock, try to hear the tumblers as they rub across the pawl; keep the dial rotating in a clockwise direction. You will hear two types of clicks, each with a subtle difference in pitch. The shallow, higher pitched clicks are the sound of the false gates on the first disk tumbler. Do not let them fool you-the real gates sound hollow and empty, almost nonexistent. When you feel a greater than normal relief in the shackle once every full turn, this is the gate of the first tumbler (last number dialed). This tumbler is connected directly to the dial as mentioned earlier. Ignore that sound for now. When you have aligned the other two tumblers, the last tumbler's sound will be drowned out by the sound of the shackle popping open. Step Three While continuing in a clockwise direction with the dial, listen carefully for the slight hollow sound of either one of the first two tumblers. Note on the dial face where these sounds are by either memorizing them or writing them down. Make certain that you do not take note of the driving tumbler (last number dialed). If you hear and feel only one hollow click (sounds like "dumpf"), chances are that the first number could be the same as the last one. You should have two numbers now. Let us say one of them is 12 and the other is 26. Clear the tumblers again just to be safe and stop at the number 12. Go counterclockwise one complete turn from 12. Continue until there is another "dumpf" sound. After the complete turn pass 12, if you feel and hear a louder than normal sound of a tumbler rubbing on the pawl, the first tumbler is properly aligned and the second tumbler is taking the brunt of the force from the shackle-you are on the right track. When the second tumbler has aligned in this case, you will feel a definite resistance with the last turn of the dial going clockwise. The final turn will automatically open the shackle of the lock. If none of these symptoms are evident, try starting with the number of the combination, 26, in the same way. Step Four If the lock still does not open, don't give up. Try searching for a different first number. Give it a good thirty or forty minute try. If you play with it long enough, it will eventually open. The more practice you have under your belt, the quicker you will be able to open these padlocks in the future. Using a stethoscope to increase audibility of the clicks is not out of the question when working on disk tumbler locks, though usually not needed for padlocks. A miniature wide-audio-range electronic stethoscope with a magnetic base for coupling a piezoelectric-type microphone is ideal for getting to know the tumblers better. Sesame Locks Another type of disk tumbler padlock is the Sesame lock made by the Corbin Lock Co. Its unique design makes it more difficult to open than Master padlocks, but it can be opened. Let's take one of the three or four wheel mechanisms, look at a cross section, and see how it works. The wheel has numbers from zero to nine. Attached to the wheel is a small cam. Both the wheel and cam turn on the shaft. Each wheel in this lock operates indepen- dently with its own cam and shaft. The locking dog is locked to the shackle. In this position the shackle cannot be opened. The locking dog operates with all three or four wheels. The locking dog is riding on the round edge of the cam. The spring is pushing up on the cam. The locking dog cannot move up because it is resting on the round part of the cam. When the wheel is turned to the proper combination number, the locking dog rests on the flat of the cam. The spring can then raise the locking dog to release the shackle, and this opens the lock. Magnetic Locks ~~~~~~~~~~~~~~ Magnetic locks are a recent innovation to the security world. Their basic operation involves the principle that like poles of a magnetic repel each other, while opposite poles repel. A magnetic lock then does not have pins, but magnets (which are often behind a plastic "roof" on the keyway). When all these magnets are in the "repelled" position, meaning a similar magnetic pole is below them, a lever arm releases the lock. A key then would have a magnet arrangement identical to that of the lock. These locks may be activated either by a flat, notchless key, or by use of a magnetic card, where in the lock actually uses a two dimensional arrangement of magnets. These are not too common, but can be found in some installations. Opening Magnetic Locks By using a pulsating electromagnetic field, you can cause the magnets in the lock to vibrate at thirty vibrations per second, thereby allowing it to open by applying constant tension to the bolt. You should be able to purchase one of these "picks" from a locksmith supply company. Unfortunately, this method usually ruins the properties of the lock's magnets, so use it in emergencies only. The magnetic pick can be used in padlocks by stroking it across the place where the key is placed. It is also designed to fit into a doorknob and is then used by stroking one pole in and out. Simplex 5-button combination locks ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ (*Hobbit*'s in-depth evaluation) This deals with the Simplex or Unican 5-button all-mechanical combination locks. They are usually used in a variety of secure but high-traffic applications, and come in a number of flavors: dead bolt, slam latch, lock switches for alarms, buttons in a circle or a vertical line, etc. The internal locking works are the same across all of these. Herein will be described the mechanical workings and a method of defeating the lock that falls out by logical inference and observations from playing with it. The internals Caveat: If this seems unclear at first, it is because the absolutely best way to understand the inner mysteries is to take a Simplex lock apart and study it. It is highly recommended that the reader obtain and disassemble one of the units while studying this; otherwise the following may be confusing. The locking mechanism box is swaged together at each end, but it is trivial to open up without destroying it. To set a lock up for study, remove the back, leaving the front plate held on by its Jesus clip. Put a spare thumb turn down over the shaft so you have something to grab. Take care not to lose the button connecting pins; they drop out. In the round configuration, the buttons talk via bent bars in the faceplate to the same vertical column as the straight ones. Thus all buttons henceforth shall be referred to as if they were in a straight vertical row, numbered 1 to 5 reading downward. The actual locking mechanism inside is a small metal box, about 3 inches high and .75 x .75 inch across the base. It contains five tumblers, one corresponding to each button, a common shift bar, and a couple of cams to handle reset and unlocking. The user dials the combination and turns the handle to the right to open the lock, or to the left to reset any dialed digits if he made a typo. If the proper combination has not been dialed yet, the shaft will not turn to the right. Setting a combination shall be described later. Some of the linear-style locks are actually made by Unican, but have the Simplex box inside. For these, a clockwise twist serves as both open and reset. There is a detent plate and a screwy lever system; if the lock is not open yet, the lever cannot turn to the *box*'s right. The detent slips, allows the levers to shift the other way, and the box arm is then turned to the left. If the detent does not slip, it's open, and the plate locks to the latch shaft and pulls it back. Each of the five tumblers has six possible positions. Each button does nothing but push its corresponding tumbler from the 0 position to the 1 position. Therefore, each button can only be used once, since once the tumbler has moved, the button has no further effect. The trick comes when *subsequent* buttons are pushed. Each button press not only shoves its tumbler from 0 to 1, it also advances any "enabled" tumblers one more step. When a tumbler is enabled, its corresponding gear has engaged the common bar and pushed it around one position, so the next button press will do this again, thus taking previously enabled tumblers around one more notch. This way, the further-in tumbler positions can be reached. It can be seen that there are undialable combinations; for instance, only *one* tumbler can reach position 5 for a valid combination [Positions labeled 0 thru 5, totalling six]. If one sits down and figures out possible places for the tumblers to go, many combinations are eliminated right away, so the number of possibilities is *not* 6^5 as one might expect. Two-at-once pushes are also valid, and are *not* the same as pushing the given two in some other order. Pushing two [or three or ...] at once simply enables two tumblers at once and shoves them to position 1 at the same time. [This of course leaves less buttons unused to push them in farther!] The tumblers themselves are small round chunks of metal, with gear teeth around the top half and a notch cut into the bottom edge. When all these notches line up with the locking bar, the lock is open. The tumblers are mounted on a vertical shaft so they can spin, with the locking bar fingers resting against the bottom of each one. The locking bar is prevented from rising if any notch is turned away from it. Juxtaposed to the tumblers is another shaft containing idler gears, which in turn talk to the common bar in the back. The intermediate shaft slides up and down and makes combination changes possible. Note: The buttons actually talk to the idler gears and not the tumblers themselves. This is necessary since during a combo change, the tumblers cannot move because the locking bar teeth are sitting in the notches. [Editor's note: Simplex locks are set at the factory with a default code of (2-4), 3. This is often not even changed.] Combination change, other random facts Once you know the current combination, you might want to change it. Instructions for doing this undoubtedly come with the lock; but it's real easy. There is a screw in the top with a hex hole; remove this from the lock body. Dial the proper combination, but don't move the handle. Press straight down through the hole with a small screwdriver, until you feel something go "thunk" downward. The lock is now in change mode. Reset the tumblers [leftward twist], enter your new combination, twist the handle as though opening the lock, and your change is now in effect. Re-insert the screw. This does the following: The thing you hit with the screwdriver pushes the tumblers down onto the locking bar [which is why the proper combination must be entered], and disengages them from their idler gears. Button presses turn the *idler* *gears* around, and then the opening action shoves the tumblers back up to mesh with these gears in their new positions. A subsequent reset mixes the tumblers up again to follow the new combination. This description is admittedly somewhat inadequate; the right thing to do is take one of the locks apart and see for one's self what exactly happens inside. The Unican model has a disk-locked screw on the rear side. Removing this reveals a round piece with a flat side. Twist this clockwise to enable change mode as in the above. This lock, of course, would be a little more secure against random people changing the combination for fun since you ostensibly need a key to get at it. Keep in mind that "reset" on these is done by turning the knob all the way *clockwise* instead. There is a linkage that ensures that the shaft inside goes counterclockwise for the time that change mode is enabled. It is amusing to hear local locksmiths call the Simplex internals a "computer". It would seem that none of them have taken one apart to see what is really inside; the box is painted black as far as they are concerned and non-openable. Obtaining one is the unquestionably best way to learn what's in there. Unfortunately they cost on the order of $120, a price which clearly takes advantage of the public's ignorance. These locks are *not* pick-proof after all, and anyone who maintains that they are is defrauding the customer. There are a variety of ways to increase the picking difficulty, to be discussed elsewhere. Your best bet is to borrow one from somewhere for an evening and spend the time learning its innards. Determining an unknown combination Contrary to what the marketing reps would have you believe, the locks can be opened fairly quickly without knowing the set combination and without damaging the lock. Through a blend of a soft touch, a little hard logic, and an implicit understanding of how the locking mechanism works, they generally yield within five minutes or so. [There are *always* exceptions...] This method requires that one does not think in terms of a sequence of button presses. One must think in terms of tumbler positions, and simply use the buttons to place tumblers where desired. For practical description purposes, it will be assumed that the buttons connect right to the tumblers, rather than the idler gears that they really do. The idler gears are a necessary part only during combination changes. Unless you are doing a change, considering it this way is pretty close to the facts. Remember that a 0 position means the button was never pushed, and 5 is enabled and shifted as far as possible. Turning the thumb handle to the right [clockwise] raises the locking bar against the tumblers. Since the lock is never machined perfectly, one or more tumblers will have more pressure on it than other ones, and this shows up as friction against it when it is turned via the button. This friction is felt in the short distance between fully-extended and the detent on the button [the first 2 or 3 mm of travel]. Some will travel easily to the detent, and others will resist efforts to push them in. Suppose you are twisting the handle, and tumbler 1 has lots of pressure on it [you can feel this when you try to push button 1 in]. When you back off the tension on the handle a little bit, the button can be pushed in against the resistance. The fact that the button has resistance at position 0 tells you that tumbler 1's proper position is *not* 0, or there would be no pressure if the notch was there! Upon pushing button 1 in, you find that no pressure has appeared at any other button. This eliminates position 1 for tumbler 1, also. Now, how do you get tumbler 1 to different positions so you can test for pressure against other ones? Push subsequent buttons. Push any other button, and tumbler 1 advances to position 2. Ignore what the other tumblers are doing for the moment. Now, perhaps another button has some resistance now. This means that tumbler 1 is either at the right position, or getting close. Basically you are using other tumblers to find out things about the one in question. [Keep in mind that the first one with friction won't *always* be tumbler 1! Any tumbler[s] could have the first pressure on them.] Continuing, push another "don't care" button. A "don't care" button is one that is not the one you're trying to evaluate, and not the one that recently showed some friction. What you want to do is advance tumbler 1 again without disturbing anything else. Did the pressure against your test tumbler get stronger, or disappear? If it got stronger, that points to an even higher probability that tumbler 1 is supposed to be at 3, rather than 2. If the pressure vanished or became less, 1 has gone too far, and you were safer with it at position 2. Let's assume that the pressure against your test tumbler increased slightly when tumbler 1 was at 2, increased even more when tumbler 1 was at 3 and vanished when you pushed it onward to 4. Reset the lock. You now know the proper position of tumbler 1 [that is, whatever tumbler first had pressure on it]. You've already drastically reduced the number of possible combinations, but you aren't finished yet. You can now eliminate positions for the next one or two tumblers the same way -- but to set things up so you can feel the pressure against these, you must ensure that your newly-known tumbler [1 in this case] is in its proper position. It is useful to make a little chart of the tumbler positions, and indicate the probabilities of correct positions. Positions 0 1 2 3 4 5 ---------------- 1 : L L + T L | <-- Indicates that tumbler 1 is not 0, not 1, maybe 2, more likely 3. Tumbler 2 : | | | | | | number 3 : | | | | | | 4 : L | | | | | <-- Indicates that tumbler 4 is not 0. 5 : | | | | | | This chart is simply a bunch of little vertical lines that you have drawn in a 5x6 matrix; the topmost row corresponds to button 1 and the lowest to 5. Mark the probabilities as little hash marks at the appropriate height. The leftmost bar indicates position 0, rightmost 5; a high mark on the left side indicates that the tumbler is 0, or is never used. The relative heights of your tick marks indicate the likelihood of the notch on the respective tumbler being there. If you don't know about a position, don't mark it yet. This chart serves as a useful mnemonic while learning this trick; as you gain experience you probably won't need it anymore if you can remember tumbler positions. A tumbler at the 0 position is already lined up before any buttons are pressed. This will feel like a lot of loose play with a little bit of pressure at the end of the travel, just before the enable detent. Be aware of this; often enough the first button with pressure can be a 0, and if you aren't watching for 0 positions you can easily assume it's a don't care, push it, and screw your chances of feeling others. Make sure your "don't care" test buttons aren't supposed to be at 0 either. It's a good idea to run through and try to find all the zeros first thing. Let us continue from the above. You have found that tumbler 1 is most likely to bet at position 3, with a slim chance of position 2. This is marked in the above chart. The reason this can happen is that the tops of the locking bar teeth are slightly rounded. When the tumbler is one away from its opening position, the locking bar can actually rise higher, since the notch is halfway over it already. So don't assume that the first increase in pressure on other buttons is the right position for the one you're finding out about. Let's assume that the next pressure showed up on button 4. You can feel this when tumbler 1 is at position 3; to get tumbler 1 out there, let's say you used the sequence 1,2,3. 2 and 3 were your "don't care" buttons used only to push 1 around. Therefore now, tumbler 1 is at position 3, 2 is at 2, and 3 is at 1. 5 and 4 are at 0, and can therefore be felt for pressure. The next step is to find the proper position for the next button with pressure against its tumbler. Many times you'll get more than one that exhibit pressure at the same time. Figure out which button has more pressure on it now with your first tumbler in the right position. In this example, only 4 applies. You now want to advance tumbler 4 to different places, *while* keeping 1 at its proper place. 1 must always advance to 3 to free the locking bar enough to press on other tumblers. To place tumbler 1 at position 3 and 4 at position 1, you would do something like 1,2,4 and check 3 and 5. To place tumbler 1 at position 3 and 4 at 2, you would do something like 1,4,2. To place 1 at 3 and 4 at 3, you have to press 1 and 4 at the same time, and then advance that mess by two positions. If you use 2 and 3 for this, the notation is (14),2,3, which means 1-with-4, then 2, then 3. You can also do 4,1,2,5 to put 4 at 4 and check 3. If all these tests fail, that is, no pressure appears at any other button, you can start assuming that 4 is supposed to be way out there at position 5. For the example, let's say you did 1,4,2 and pressure showed up on button 3. To double-check this, you did (14),2,5, and the pressure on 3 went away. So tumbler 4 must have gone too far that time. Place a fairly high tick mark on the chart at tumbler 4, position 2 to indicate the probability. Note: A better way to do that last test, to avoid ambiguity, is to do 1,(42),5 and check 3, then do (14),2,5 and check 3. This ensures that the only change you have made is to move tumbler 4 from 2 to 3 an avoids the possibility of movement of tumbler 2 giving bogus results. Through the entire process, you want to try to change one thing at a time at every point. Sometimes one of this sort of possible test setup won't tell you anything and you have to try another one [in this case, perhaps 1,(45),2 and then (14),5,2 while checking 3. This has simply swapped the positions of 2 and 5 during your testing]. You now know two tumbler positions, with a high degree of confidence, and have further reduced the possible combinations. From here, you could mix tumblers 2,3 and 5 into the sequence with various permutations, as long as you place 1 and 4 correctly every time. This would still take some time and brain work ... let's try to find out something about some other buttons. Place 1 and 4 where they're supposed to go ... the sequence 1,4,2 will do it, and see what's up with the other buttons. 1,4,3 will leave 2 and 5 available. You find eventually that 2 and 3 have the next bit of pressure distributed between them [and are nonzero], and 5 feels like a 0, as described above. To confirm this, advance 5 along with some other button and check 3. Bingo: There is no pressure on 2 when 5 is enabled [and you have not changed anything else besides 5's position], so you can firmly decide that 5 is 0 after all. So leave it there. [You did this by advancing 1 to 3 and 4 to 2, as usual, so you can feel 2's pressure in the first place.] By now you should know the proper positions of three of the tumblers, and have eliminated any other zeros by feeling their initial pressure. Now, since 2 and 3 have the next pressure on them, try and find out more about them. You know they aren't zero; suppose we try 1? To do this you must get one of them to 1, 1 to 3 as usual, 4 to 2, and leave 5 alone. How? Use hitherto unknown buttons as dummies to position the tumblers right. For instance, the sequence 1,4,3 will do what you want here; you then check pressure on 2. Or 1,4,2 and check 3. Here you may notice that the pressure on the leftover is a *little* stronger than before, but not enough to make any sure judgement. Well, now you want to advance an unknown to position 2 - but you suddenly notice that if you do [by doing something like 1,(42),3] there are no free buttons left to test for pressure! 'Tis time to try possibilities. Your only unknowns are 2 and 3 now. You must now advance 1 and 4 to their proper positions, leaving 5 alone, while sprinkling the unknowns around in the sequence in different permutations. Use your chart to remember where the known tumblers must go. Sometimes you get two possibilities for a tumbler; you must work this into the permutations also. In this particular example, you know that either 2 or 3 [or both!] must be the last button[s] pressed, since *something* has to get pressed after 4 to advance 4 to position 2. An obvious thing to try is putting both the unknowns at position 1 by doing 1,4,(23). Try the handle to see if it's open. No? Okay, now leave one of the unknowns down at 1 and mix the other one around. For instance, for 2 at 1 and 3 at 2, you do 1,(34),2 -- nope. Advance 3 one more; (13),4,2 *click* -- huh?? Oh, hey, it's *open*!! Well, when you are quite through dancing around the room, you should know that your further possibilities here ran as follows: 3,1,4,2 ; to end the permutations with 2 at 1 1,(24),3 ; and permutations involving 3 at 1. (12),4,3 2,1,4,3 One may see how things like 2,1,(34),x are eliminated by the fact that 1 must get to 3, and 5 must stay still. Since only 4 buttons could be used, no tumbler can get to position 5 in this particular combination. Note also that the farther *in* a tumbler has to go, the earlier its button was pressed. If all this seems confusing at first, go over it carefully and try to visualize what is happening inside the box and how you can feel that through the buttons. It is not very likely that you can set up your lock exactly as the example, since they are all slightly different. Substitute your first- pressure button for the 1 in this example. You may even have one that exhibits pressure against two or more tumblers initially. Just apply the differential-pressure idea the same way to find their most likely positions. The example is just that, to demonstrate how the method works. To really understand it, you'll have to set your lock up with some kind of combination, and apply the method to opening it while watching the works. Do this a few times until you understand what's going on in there, and then you'll be able to do it with the lock assembled, and then in your sleep, and then by just waving your hands and mumbling.... A 5-press combination makes life a little tougher, in that you lose versatility in your freedom of test positions, especially if your first- pressure tumbler is at position 5. Here you can use the "almost" feature to your advantage, and advance the errant tumbler to one before its proper spot, and hope to see increased pressure on other tumblers. When a tumbler is one away from right, the locking bar tab is hanging a large section of itself into the tumbler notch, and the tab's top is slightly rounded. So it can rise a little higher than before. If you twist the handle fairly hard, you can distort the locking bar slightly and make it rise higher [but don't twist it hard enough to break away the safety clutch in the shaft!] The chances of someone setting this sort of combination without prior knowledge about the *specific* lock are almost nonexistent. As if that wasn't enough, the next thing to deal with is the so-called "high-security" combinations involving half-pushes of buttons. The long initial travel of the tumbler permits this. If you look at your open mechanism and slowly push in a button, you'll see that the tumbler actually travels *two* positions before landing in the detent, and further motion is over one position per press. There is no inherently higher security in this kind of combination; it's just a trick used against the average person who wouldn't think of holding a button down while twisting the latch release. It's quite possible to defeat these also. When you are testing for pressure against a tumbler set at "one-half", you'll feel a kind of "drop-off" in which there is pressure initially, and then it disappears just before the detent. Before testing further buttons, you'll have to "half-enable" the appropriate "one-half" tumblers so the locking bar can rise past them. Set your lock up with a couple of combinations of this type and see how it works. Note that you must hold down the "half" buttons just before the detent click while setting or opening. This makes an effective 7 positions for each tumbler, but in a standard [no "halfs"] setup, it's effectively 6. This is Simplex's "high-security" trick that they normally only tell their high-dollar military customers about. After working the lock over for a while, it's intuitively obvious. The Unican type has no direct pressure direction of twist; if you turn too far to the right you only reset the tumblers. What you must do is hold the knob against the detent release just tight enough to press the locking bar against the tumblers inside the box but not hard enough to slip the detent. There is a fairly large torque margin to work with, so this is not difficult to do. Unicans do not twist to the left at all, so ignore that direction and work clockwise only. Possible fixes The obvious things improvements to make are to cut notches of some kind into the locking bar teeth and the tumblers, so that the pressure can't be as easily felt. Another way might be to have a slip joint on the locking bar that would release before a certain amount of pressure was developed against it, and thus never let the tumblers have enough pressure against them to feel. The future may see an improved design from Simplex, but the likelihood does not seem high. They did not seem interested in addressing the "problem". Automotive Protection Systems ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ There are several types of locking devices found on cars today. Standard window locks, exterior locks, ignition locks, and the famous third party "club" type steering wheel locks. Wing or vent windows have several types of locking devices. The most common is simply a lever that turns to prevent the window from opening. Another type of wing window lock has a lever latch equipped with a plunger at the pivot of the latch. The plunger deadlocks the latch against rotation, unless the plunger is first pushed in and held until the initial stage of rotation has been accomplished. Naturally, these are a bit more secure. The most popular auto locks for the exterior and ignition are a derivative of the wafer tumbler locks called the "side-bar wafer lock." Side-bar wafer locks offer more protection then either the wafer tumbler or pin tumbler (of course they cost more.) When all of the tumblers have aligned to their breaking points, a spring-loaded bar falls into place, allowing the cylinder to turn. Ford auto locks are an exception, as they have pin tumbler locks. Club Type Locks One of the "club" type auto locks is an extensible bar that has opposing hooks that nominally wedge between spokes on the steering wheel. The bar itself is notched at 1" intervals or so. The key on these is rather impressive; it's a brass tube with at least three sets of chamfers drilled into their sides. Defeating Club Type Locks The weak part of these locks is not the keyway; it's the extensible bar. The notches provide built-in weak spots. The lock can be forced in about three seconds. Do as follows (it helps to be relatively strong): 1) Put on weightlifting gloves. 2) slide driver's seat all the way back. 3) tilt driver's seat all the way down. 4) tilt steering wheel all the way down. 5) put your feet on ends of "club" (past the rim of the steering wheel) 6) grasp center of the notched extension bar. Don't interlace fingers, just grab with your dominant hand and then grab over that hand in the other direction with the other hand. 7) Take a deep breath 8) While smoothly exhaling, hold on tight with your hands and straighten your legs. (classic leg press -- even Joe Average can exert twice his body weight in this mode.) 9) "Club" will conveniently bend into a horseshoe or shatter at a convenient notch, depending on the mood of the guy running the tempering furnace. This is why you wear weightlifting gloves while doing this trick- it keeps the steel fragments from cutting you. There is another "club" that has a collar that wraps around a segment of the steering wheel; these cost more, are much less common, and the above technique does not work for them. However, you can hacksaw the wheel in one place and "spring" the wheel enough to allow the collar to pop off the wheel. Bend the wheel back, add some tinted epoxy, and you're clean. Auto Alarms More and more, people are using auto alarms to try to protect their vehicles. Unfortunately, if somebody wants to steal your car, they will. No amount of protection will prevent this. The strategy behind an auto alarm is to make your car more of a pain to steal then somebody elses. Here are the basics of car alarms. The Brain The main alarm unit, sometimes called the "brain", is mounted in the most secure place that can be found. Up inside the dashboard for instance. They basically took the whole dash apart, install the alarm, and then put the whole dash together around it. Some places install the brain under a seat or even up under the carpet on the passenger side ("so they can adjust it easier"). This is incredibly stupid. Starter Kill Basically, when the alarm is armed, the starter is electronically disconnected so the car cannot be started or even hot wired. Most alarms have this as a standard feature. Valet switches This is a toggle switch that can be set to keep the alarm from going off if the owner has to leave it with a valet or for car repairs. Most of the systems have this feature. Passive vs Active Arming With passive arming, the alarm becomes armed after a given time period after the last car door has closed. To disarm, you can either get in to the car and place the key in the ignition within a certain time period or press a button on a remote transmitter to disarm the alarm. With active arming, you have to press a button on a transmitter to arm the alarm. To disarm, you press the transmitter button again. Arming and Disarming beeps Most alarms give you an audible alert when the alarm is armed or disarmed. This serves two purposes. One is to let you know the alarm is working and on the job. The other is to let others know the car has an alarm. Motion Sensors Some alarms like the UNGO box and others have a motion sensor. In the UNGO Box's case, it is a tube filled with mercury surrounded by a wire coil. When the car moves, the mercury moves within the tube causing current to flow in the coil. This is what sets the alarm off. Other have some type of spring with a weight on it so when the car moves, the weight bobbles back and forth and makes contact with the casing causing the circuit to be completed. The former method has a patent, the latter has no patent because it is worthless. If you have ever heard a parking lot full of alarms going off at an airport or a parking deck, it is because of this type of sensor. These are prone to false alarms from passing trucks, thunder, airplanes, etc. The UNGO Box's sensor is highly adjustable, however, if you adjust it to eliminate all false alarms, then you have basically disabled its usefulness for triggering real alarms. Shock Sensor This is what comes standard on most alarms. It basically senses motion like a motion sensor but scans a very short period of time. You can rock the car and push up and down on it and the shock sensor will not go off. If you kick a tire or hit the window or door with your fist, the alarm goes off. Glass Breakage Sensor What this is supposed to do is pick up on the particular high frequencies of glass being broken or cut and to trigger the alarm. It is basically a microphone placed somewhere inside the car. Field Motion Sensor (Perimeter Guard) Basically this is the type of sensor which sets up some type of field around the car and inside the car to detect masses coming close to the car. It is a must for convertible owners. These aren't as common as most other types because of the extremely high cost. There are many cheap ones available to add to any alarm, but they have nothing but problems with them (i.e. false alarms). Some Alpine systems are designed especially for this type of sensor and have a price tag to match. They are basically useless on hard top cars. Some cheap units are set off by anything. There is a car parked right outside of my classroom which is always being set off by falling rain and passers by. Very annoying. There are other fancy alarms which have a pre- recorded message like "Please step away from the car ...". These are really stupid and a waste of money. I heard of a new BMW being tortured by a group of kids throwing rocks at it just to hear the little voice go off. Current sensor This basically monitors the current drain on the battery. If it changes, i.e. a door is opened causing a light to come on, the alarm is triggered. This is how many cheap alarms are triggered. They just monitor the current. The doors and trunk are all protected because they have lights which will come on when opened. The problem is, most newer cars have a fan inside the engine compartment which comes on even after the car is turned off. The resulting drain on the battery will trigger a current sensor. Seat pressure sensor If someone sits in the seat, the alarm is triggered. Not very practical unless on a convertible. By the time the thief is in your seat, your car or your stereo is history anyway. Backup Battery This is an emergency backup battery for the car alarm. It charges off of the car alternator just like the car's battery. If the car's battery goes dead or if the power cables are cut, the battery can still run the alarm and the siren. The alarm will remain armed. With cheaper alarms and/or poor installations, some systems might end up wired into the car in a haphazard way. Most alarms flash the car's parking lights when activated. All a thief has to do is short out a parking light, set your alarm off and whammo, your car and the alarm goes dead. Thief gets in, replaces the right fuses and off he goes. Automatic Door locks/Unlocks Another neat feature is automatic door locking. This is an option on most alarms. It uses what they call an "output" from the alarm which can be programmed to do various things. Most installers set this up so that when the alarm is armed, all doors lock and when the alarm is disarmed, all doors unlock. Pagers A pager (sometimes called Autopage) is used to page the owner's beeper when the car alarm goes off. This way they can run to the parking lot and chase a potential car thief away or catch the person who just rammed in to your car before they speed away. Pagers may also use up an "output" on the alarm unit. Some hook on to the siren and are triggered off of the vibration when the alarm goes off. Transmitters These of course are used to remotely turn the alarm on and off. It seems that with cheaper and/or older alarms, it is possible to transmit all of the codes in rapid fire sequence to a car alarm. Eventually, you will hit upon the right code combination to disarm the alarm. The average alarm has around 2 to the 29th codes which is not very many. Newer (and probably more expensive) alarms can sense this and lock out any further attempts for a given time period. The Marlock System ~~~~~~~~~~~~~~~~~~ The Marlock System uses a key consisting of a piece of metal with holes bored in it, and then covered up with strips of IR-invisible plastic. Thus, you can't see anything in the plastic, but IR in the keyhole reader can see thru just fine. It decodes this, sends it to a controller interface box, which sends it to a controller PC, which says "cool or uncool", and if cool, then the interface box sends power to the strike on the door, and turns the LED on the reader green. Each area that is to be accessed via Marlock must have some sort of reader device. This can be either a "keyhole" in the knob, a plate on the wall with the keyhole in it, or whatever. The reader is hooked up to a controller interface box. this box is locked with a really poor lock (like you'd have on your diskette box) and is located close to the area being secured, often in the ceiling. The controller interface box simply provides power for the reader, the little LED over the top of the reader, and the electric strike locking the door. The whole thing is controlled by an IBM PC with a reader keyhole mounted on the front of the PC which runs to an interface card inside the PC. To program a key into the system, one simply inserts it into the keyhole on the front of the PC, and then tells the program when and where this key can work. This is stored in its database, and recalled by the reader as needed. Also the PC keeps logs of when and where a key was used -- whether or not it worked! There are audit trails all over the place. If the power goes out, then whether or not the door opens is dependent upon the strike which was installed. IT can be either fail-safe (i.e. no power -- open!) or fail-secure (i.e. no power- lock!). However, for fire safety code requirements, companies often install it on the side of the door which allowed entry to a restricted area -- not exit. Some of the Marlock cylinders have a small brass spot in the middle of the LED. This is an emergency override. One would insert a marlock key, and use a 9V battery between the key and the pin to provide a signal to the interface controller to pop the strike. This may not still be the case however. Defeating the Marlock System Since there's an electric strike all you have to do is provide power to the strike so it'll release. This is usually 12-24 volts DC, and is easily obtained from some lantern batteries. The activation wires for the strike usually run down inside the door jamb from the controller interface box. And if you have access to the controller interface box, then just pick the lock on the front of it. The heavier wires are for the electric strike (the thin wires are from the reader). Then just apply power to the thing -- use jumper wires to get the power from the controller interface box... VingCards ~~~~~~~~~ These cards are used primarily by hotels, and our quite unique. The lock is a matrix of 32 pins which have two possible positions each [sort of like a vax...]. Two of these are special and aren't really used in the keying. The remaining 30 are constructed out of standard pin and driver parts, except that all the drivers are the same length and all the pins are the same length. The pin-driver combinations sit pointing upward [the springs are underneath] in a sort of matrix about 1.5 inches on a side. Above each pin-driver combination sits a steel ball. The entire matrix is enclosed in a *plastic* assembly, part of which can slide "forward" [i.e. away from the user]. Some of you may be familiar with the keys: white plastic cards about 3 inches long with a bunch of holes in one end. Pushing this into the slot until it "clicks" forward opens the locking mechanism. The lock combination is set by inserting a similar card, only half as long, into the *back* of the lock. This card is the same thickness as the opening card and has part of the hole matrix cut out. A juxtaposition of this combination card from the back and the key card from the front closes the matrix: i.e. if you overlay the combination and key cards in their opening configuration, there are no open holes left, *exclusively*: i.e. where there is a hole on the combination card there is solid on the key card, and vice versa. Thus the complement of the proper key card is the combination card. This is enforced by the placement of the ballbearings and pins in relation to the sliders and top plate, so a workaround like a card with all holes cut out or a solid card does not open the thing. The combination card slides in between the conical pin ends and the steel ballbearings [and is thus harder to push in than the key card]. The key card comes in over the balls, and its thickness pushes the balls under its solid regions downward. So each pin assembly is pushed down, when the lock is open, the same amount, be it by the key card hitting the ballbearing or the combination card wedging the actual pin downward. Clarification: Let us define a "1" pin as a hole in the opening card. Thus a "0" pin sits under a solid portion of the opening card and a hole in the combination card. A 0 pin opens as follows: Since the combination card lets the pin rise up against the steel ball, the keycard pushes the ball [and its pin] down to the bottom of the keycard slot. This brings that pin to its shear line. Simple. Here's the magic -- a 1 pin opens in the following fashion: Since the combination card is solid there, the steel ball is sitting directly on the combination card, and the pin underneath is *already* at its shear line. If a solid keycard portion arrives over this ball, the ball is pushed down against the combination card and *pushes the entire area of the combination card down under it*, lousing up not only that pin's shear line but probably a few around it. Although a clever mechanism, this depends on the elasticity of the combination card to work. Note that as the key card is inserted and removed, the combination card will be flexed up and down randomly until the keycard comes to rest at its opening position. [Correction to above: each pin really has *three* possible positions. Hmm.] All this happens within the confines of the sliding *plastic* frame; this part carries the two cards, the balls, and the top halves of the pins. The stationary part underneath this contains the drivers and springs. A metal plate bolts down on top of the sliding piece, leaving a gap just big enough for the key card. If the screws holding this plate were to become loose, the plate would rise up, the key card would sit too high up, and the lock would not open. All the positioning is done by the thickness of the keys while they rest against the surfaces of their slots. Therefore a piece of thin cardboard will not serve as a duplicate key. We found that two pieces of plastic "do not disturb" sign, cut identically and used together, were thick enough to position things correctly and open the lock. A rough top view: Pin mechanism: Back _ = top plate Front Back o o o o <> = balls ________________________________ o o o H = keycard HHHHHHHHHHHHH<>HHHHHHHHHH<>HHHHHH ## QQ o o o o O = comb. card --> QQ OOOOOOOO<>OOOOOOOOOOOOOOOOOOOOOO o o o # = slider QQ# [] [] [] ## QQ @ o o @ [] = pins QQ###[]####[]####[]################# o o o || = driver/ QQQQQ||QQQQ||QQQQ||QQQQQQQQQQQQQ o o o o spring asm QQQQQ||QQQQ||QQQQ||QQQQQQQQQQQQQ o o o Q = stationary QQQQQ||QQQQ||QQQQ||QQQQQQQQQQQQQ o o o o housing QQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQ Front It is hoped that the diagram on the right, with its three example pins, will show sufficiently that if two holes coincide the pin will rise too far, and if two solid places coincide, the entire combination card would be pushed down by the ballbearings. There is sufficient space underneath the combination card for it to sag down and foul the shear line; it is normally held upward by the pins' spring tension against the underside. This diagram may be misleading if it is not understood that the balls are actually larger than shown; i.e. the height of approximately three cards stacked up equals the diameter of the ballbearing. There is a thin layer of slider plastic between the keycard and the combination card, which separates them and retains the ballbearings. The @'s in the top view are the two magic pins. These prevent the lock from working at all unless a combination card is inserted. They are a bit thicker than the other pins and do not have ballbearing parts. The slider above the combination card slot here is solid, so these pins have nothing to do with the keycard. They simply hold the lock shut if no combination card is installed, regardless of what is done with a keycard. Therefore if one were to make a combination card that only pushed down these pins, a solid keycard would work. And if one inserts a solid combination card, the lock is already open before you insert anything. [This is a useful hack that will allow anyone to open the door with just about any tool, in case you are crashing lots of people in a room, don't have enough keys, and don't feel like making more. Naturally your security is compromised, but only those who know what's going on will be able to get in.] The slider has a bracket bolted on to it, which reaches down toward the doorknob and pushes a moveable sleeve with a square hole through it. This joins two sections of a three-section split shaft together, which allows the outside knob to retract the bolt. The inside knob is "hardwired" to the bolt action and always opens the door. The extra split in the shaft is so that with the card in place, the lock will still behave like a regular split-shaft knobset [and disable opening if the deadbolt is shot]. There is a hinged plastic door on the back [inside] of the lock, which is held shut with a screwdriver tab inside a slot. This is where the combination card goes, although this door exposes enough to see the entire slider mechanism [except for its inner works; the entire back must be taken off to get the slider out]. Now, the security evaluation: I see no clear way to "pick" it. The rear pins are hard to get at without touching the frontmost ones. However, this lock would be *very* easy to defeat, in the following fashion: A thin tool about the thickness of a keycard and about .2 inch wide can cover one column of ballbearings. If this tool is slowly slid straight into the slot along each column in turn, the resistance encountered as it contacts each ball indicates whether there is a hole or not underneath it in the combination card. The combination card presses upward against the ball more strongly than the pin's spring does, so this would allow one to map the combination card and then construct the keycard complement. This process wouldn't take very long. I therefore recommend that these locks be considered less than high-security. Furthermore, come to think of it, a small hole drilled in the front plate [which I doubt is hardened] would make it easy to frob the slider or split shaft. Electronic Hotel Card Locks ~~~~~~~~~~~~~~~~~~~~~~~~~~~ These are wonderful little microcomputer projects masquerading as door locks. Inside there's a processor running a program, with I/O leads going to things like the magnetic strip reader, or the infrared LEDs, and the solenoid, and the lights on the outside. They are powered entirely by a battery pack, and the circuitry is designed such that it draws almost nil power while idle. The cards are usually magnetic-strip or infrared. The former uses an oxide strip like a bank card, while the infrared card has a lot of holes punched in it. Since IR light passes through most kinds of paper, there is usually a thin layer of aluminum inside these cards. The nice thing about these systems is that the cards are generally expendable; the guest doesn't have to return them or worry about lost-key charges, the hotel can make them in quantity on the fly, and the combination changes for each new guest in a given room. The hotel therefore doesn't need a fulltime key shop, just a large supply of blank cards. Duplication isn't a problem either since the keys are invalidated so quickly. The controlling program basically reads your card, validates the number it contains against some memory, and optionally pulls a solenoid inside the lock mechanism allowing you to enter. The neat thing about them is that card changes are done automatically and unknowingly by the new incoming guest. The processor generates new card numbers using a pseudorandom sequence, so it is able to know the current valid combination, and the *next* one. A newly registered guest is given the *new* card, and when the lock sees that card instead of the current [i.e. old guest's] card, it chucks the current combination, moves the next one into the current one, and generates the new next. In addition there is a housekeeping combination that is common to all the locks on what's usually a floor, or other management-defined unit. There is no wire or radio connection to the hotel desk. The desk and the lock are kept in sync by the assumption that the lock won't ever see the "next" card until a new guest shows up. However if you go to the desk and claim to have lost your card, the new one they give you is often the "next" card instead. If you never use it and continue using your old card, the guest after you will have the wrong "next". In cases like this when the hotel's computer and the lock get out of sync, the management has to go up and reset the lock. This is probably done with a magic card that the lock always knows about [like in ROM], and tells it something akin to "use this next card I'm going to insert as the current combination". The pseudorandom sequence simply resumes from there and everything's fixed. If the lock loses power for some reason, its current memory will be lost but the magic "reset" card will work. Rumor has it that these locks always have a back-door means of defeating them, in case the logic fails. Needless to say, a given manufacturer's method is highly proprietary information. In theory the security of these things is very high against a "random guess" card since there are usually many bits involved in the combination, and of course there is no mechanical lock to be manipulated or picked. The robustness of the locking hardware itself sometimes leaves something to be desired, but of course a lock designed for a hotel door probably isn't the kind of thing you'd mount on your house. Security Alarm Systems ~~~~~~~~~~~~~~~~~~~~~~ Security alarm systems are becoming more and more common in the home and small business. They will become more and more popular in coming years as their prices continue to fall. There are basically two types of systems, the open circuit and closed circuit system. The Open Circuit System An open circuit system is composed of magnetic detectors or contacts that are "normally closed." That means that their contacts are separated when the door or window is in the normally closed position.When the door or window is opened, the contacts are released, causing them to close. This allows current to flow through the wires, and the alarm sounds. All the contacts and detectors are wired in parallel. This means that current flows ONLY when any contact or detector switch makes contact. Let me illustrate: switch is open switch is closed wire ----#############1############# ----#############1############# #############2#############--- #############2#############---- ########## wire ========================== | MAGNET | (Magnet has been removed) ========================== A Normally Closed Switch Assembly In the first figure, the "normally closed" switch assembly, which would be mounted about the door, is help open as the lower portion (#2) is pulled to the magnet which would be mounted on top of the door. The magnet has an attractive force greater than the force of a spring which normally holds the two parts of the switch closed. In this position, no current flows through the switch. In the second figure, the door would be open, and thus the magnet not aligned under the switch. Both halves of the switch have been returned to their "normal" position, closed, by the spring. The obvious disadvantage of an open circuit system is that it become inoperative if a transmission wire is cut, a contact or terminal wire becomes loose, or some similar condition. For this reason, circuit wiring for this type is often concealed. The vulnerability of the system is minimized by a test switch or key position which sends current through the main circuit wiring and reveals any line breaks. This test lights a small warning lamp on the main panel, bypassing the main alarm. This will only test the integrity of the circuit, not individual detectors. When the open circuit system is engaged, an alarm will occur immediately if any doors are windows have been left open. Of course the alarm will also sound anytime a door is used while the alarm is in operation. Many times a bypass switch will be placed next to frequently used access ways. This can be dangerous because someone can break a door or window pain, activate the bypass switch, and have free access to the entrance. The Closed Circuit System In a closed circuit security system, low amperage current continuously flows from the power source, throughout the detector switches, to the supervising relay (a type of switch) in the control panel. The detector switches are of the normally open type. This is the opposite of the normally closed type. The magnet holds the normally open switch assembly together, so current flows through the switch. When the magnet is removed, the switch springs open, and current ceases to flow throughout the circuit. The supervising relay monitors the current in the circuit, and should it be interrupted (by a door opening and causing a detector switch to open), it will activate the alarm buzzer, telephone dialer, siren, or whatever. Note that in the closed circuit system, any attempt to cut the wires would have the same effect as opening a detector switch. The current would be interrupted and the alarm would sound. This makes the closed circuit a much more secure system than the open circuit type. The closed circuit system requires more sophisticated equipment and the circuit installation must be precisely wired. Closed systems are also prone to more frequent false alarms. Security Alarm System Power Sources The current for most systems comes from battery, transformer, or a recharging pack. The recharging pack is a complete power supply providing 6-12 volts of power. This is enough to run several separate alarm circuits and even a six volt telephone dialer. It is usually equipped with nicad backup batteries in case of power failure. Magnetic Detectors I used the "Magnetic Detector" when explaining the closed and open circuit types of security systems. These are by far the most common type of detectors used. As discussed before, they are a two part assembly consisting of a magnet and a switch. Both are encased in a weatherproof plastic case. Tamper Switch or Plunger Contact Another popular type of detector is the tamper switch. It may be used on windows, alarm boxes, or control panels. It consists of a switch assembly with a spring loaded "plunger" protruding from one end. It is available in both the normally open and normally closed configurations. All-Purpose (Bullet) Detector This is a beveled button used primarily on doors or double-hung windows. The button is installed in the hinged side of the door frame, recessed into the frame. When the door is closed, the button is depressed. When opened, it of course pops out. Floor Mats Pressure sensitive mats wired with open or closed circuits to make or break contact when stepped upon are used as backup to perimeter security systems such as rear entrance doors. They can be placed under regular carpeting or loose rugs. Door and Window Traps These are basically "trip-wires" and aren't used too often. They do work well in areas where conventional detectors would not work, and are substantially cheaper than infrared. They can be placed in either a horizontal or vertical configuration. For open circuit systems, an insulated plug is placed between the contacts of the detector. When it is tripped, the plug is pulled out, causing the detector's switch to close. For a closed circuit system, one end of the trip wire is attached to one end of the switch, and the other end of the trip wire to the other half of the switch. This way current still flows in the circuit. When the wire is tripped, the circuit breaks. Photoelectric Systems Photoelectric systems transmit invisible pulse modulated beams from projector/transmitter to receiver. Interruption of the beam sets off the alarm. Although the system is designed primarily for interior used, military systems have been developed for use on the exterior, even in dense fog. Emergency Panic Button This permits an alarm to be activated by use of a pushbutton located near a front door, in a bedroom, or hidden under a counter. In a business, such a button could be used as a "holdup" button, silently summoning the police or activating the normal store alarm system. Automatic Telephone Dialer This is a device that will automatically call the appropriate telephone number and relay a prerecorded message. These devices are often used to contact the police, private security, or store officials. Of course, the system is at risk if the exterior phone wires are accessible. For this reason the phone wiring will be either incased in a steel sheath or wired for alarm. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - ---------------------------------------------------- --- US Secret Service Radio Frequencies --- -- -- - [From information gathered from Miles Barkman] - ---------------------------------------------------- President, Vice President, or other notable coming to town? Like to know whats going on? Here is a handy reference guide to some of the known frequencies used by the Secret Service. Should provide some interesting scanning for you radio jocks out there. Note: USSS=US Secret Service WHCA=White House Communications Agency Designation Frequency Primary Usage ------------------------------------------------------------------------------ Alpha 032.2300 MHz WHCA-Transportation 166.5125 MHz WHCA-Transportation Able 032.2300 MHz ??????????? 032.3200 MHz ??????????? Baker 165.7875 MHz USSS-Field Offices Charlie 165.3750 MHz USSS-Field Offices/Protection Delta 169.9250 MHz WHCA-Marine Security Detachment Echo 407.8500 MHz WHCA-SAM Uplink Foxtrot 415.7000 MHz WHCA-SAM Downlink Golf 166.4000 MHz USSS-Field Offices Hotel 167.9000 MHz WHCA-V.P. Staff/White House Garage 165.6875 MHz WHCA-V.P. Staff/White House Garage 166.2125 MHz WHCA-V.P. Staff/White House Garage India 407.9250 MHz USSS-Headquarters 166.2000 MHz USSS-Headquarters Juliett 170.0000 MHz USSS-Paging/Camp David Kilo 167.8250 MHz Duplex Phone-Pres Res/LBJ Lima 168.7875 MHz Duplex Phone-Pres Res/LBJ Lavender 418.1250 MHz WHCA-Transportation Mike 165.2125 MHz USSS-Dignitary/Former Pres Protection November 166.7000 MHz WHCA-White House Staff Oscar 164.8875 MHz USSS-Presidential Protection Papa 164.4000 MHz USSS-Field Offices/Protection Quebec ???.???? MHz ??????????? Romeo 166.4000 MHz USSS-Repeater Output 164.4000 MHz USSS-Repeater Output Sierra 166.5125 MHz WHCA-White House Staff Tango 164.6500 MHz USSS-Field Offices/Protection Uniform 361.6000 MHz AF-1 Communications 165.0875 MHz AF-1 Communications Victor 164.1000 MHz WHCA VP Protection Whiskey 167.0250 MHz WHCA-Paging X-ray 166.4625 MHz Treasury Common Yankee 162.6875 MHz WHCA-Presidential phone uplink or downlink Zulu 171.2875 MHz WHCA-Presidential phone downlink or uplink Pres Nighthawk Aircraft Fleet (HMX) ----------------------------------- Frequency Primary Usage ----------------------------------- 046.7500 MHz Transport 375.0000 MHz Transport 034.3500 MHz VIP Transport Net 142.7500 MHz Command Post 265.8000 MHz Squadron Common Other Phone Patches ------------------------------------------------ Frequency Type Primary Usage ------------------------------------------------ 407.4750 MHz (uplink) Nationwide-2 415.8000 MHz (downlink) Nationwide-2 407.4500 MHz (duplex) Limousines (Local/DC) 408.2000 MHz (duplex) Limousines (Local/DC) USSS Uniform Division --------------------------------- Designation Output / Input Freq --------------------------------- Gray 418.350/407.750 MHz Orange 418.775/414.950 MHz Brown 414.850/418.800 MHz Red 415.975/419.725 MHz Silver 415.650/419.100 MHz Yellow 414.675/418.150 MHz Training Division: Beltsville, MD --------------------------------- Designation Output / Input Freq --------------------------------- Green 415.750/407.875 MHz Black 415.100/418.325 MHz Blue 414.800 MHz Violet 415.800 MHz Communications Division --------------------------------- Designation Output / Input Freq --------------------------------- Gold 415.675/419.075 MHz Technical Security Division --------------------------- Designation Frequency --------------------------- F-1 408.000 MHz F-2 411.000 MHz F-3 408.500 MHz F-4 408.975 MHz Other Reported USSS Frequencies --------------------------------------- Frequency Primary Usage --------------------------------------- 163.7375 MHz 164.6500 MHz 165.2250 MHz 165.6875 MHz Washington Field Office 166.2000 MHz Washington Field Office 406.2625 MHz 407.8000 MHz 407.8250 MHz Suit Radios 407.8750 MHz Suit Radios 407.9750 MHz 408.9750 MHz Hints for monitoring -------------------- Most of the interesting frequencies are USUALLY scrambled during actual operations. However, 407.850 and 415.700 are never scrambled. Sometimes, the best info on plane landings and limo locations and such can be obtained through regular airport communications and local police. The Secret Service has been known to occasionally use cellular communications. The PL used extensively by USSS is 103.5 Hz. Hearing the callsign "Air Force 1" means the President is on the plane. "Air Force 2" is the Vice President's plane. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Cellular Update Well, they've done it again. The high paying special interest groups have gotten yet another law passed. Now it is not only illegal to listen to cellular communications, but illegal to even MAKE a tuner capable of tuning them in! Never mind thats its just EMR floating through space, your body, your house. It is ILLEGAL to tune a crystal to such and such frequency converting the energy to audio. Ridiculous. People who broadcast their conversation across the country side should have no expectation of privacy. Does everyone have to cover their ears when I yell out the window to my friend? No, of course not. The question of it being immoral or not should not be confused with legality. Heres the new law. SEC. 408. INTERCEPTION OF CELLULAR COMMUNICATIONS. (a) AMENDMENT -- Section 302 of the Communications Act of 1934 (47 USC 302) is amended by adding at the end the following new subsection: (d)(1) Within 180 days after the date of enactment of this subsection, the Commission shall prescribe and make effective regulations denying equipment authorization (under part 15 if title 47, Code of Federal Regulations, or any other part of that title) any scanning receiver that is capable of -- (A) receiving transmissions in the frequencies allocated to the domestic cellular radio telecommunications service, (B) being readily altered by the user to receive transmissions in such frequencies, or (C) being equiped with decoders that covert digital cellular transmissions to analog voice audio. (2) Beginning 1 year after the effective date of the regulations adopted pursuant to paragraph (1), no receiver having the capabilities described in subparagraph (A), (B), or (C) of paragraph (1), as such capabilities are defined in such regulations, shall be manufactured in the United States or imported for use in the United States. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - The HP3000's 'SECURITY/3000' system (part 3) by Sterling The third and final part of our series on HP3000 Security. STREAMX/SLEEPER -- LINKS STREAMX WITH SLEEPER ********************************************* INTRODUCTION ~~~~~~~~~~~~ A very popular program from the Contributed Software Library (CSL) is SLEEPER, which can stream a job, run a program, or execute a command or any combination of these at any specified time and repeat this action at specified intervals. Many HP3000 sites use SLEEPER to launch job streams at specified times during the day or night, and at regular intervals (for instance it might run a report program each night at 12:00 and stream a job which does a sysdump at 7:00 a.m. each Friday). But to stream a job using SLEEPER, the MPE passwords must be embedded in the job stream. A better solution would be to use STREAMX in conjunction with SLEEPER and have STREAMX generate the passwords. SLEEPER INSTRUCTIONS ~~~~~~~~~~~~~~~~~~~~ Those familiar with SLEEPER know that the file 'SLEEPCOM' must first be built as follows: :BUILD SLEEPCOM;REC=-72,4,F,ASCII;DISC=20,1,1 and then SLEEPERC (the SLEEPER communications program) is run to add entries to the SLEEPER file. SLEEPERC will ask the date, hour, and minute when the activity is to start. It will then ask if the activity is to run a program, stream a job, or execute a command. The name of the proper disc file is asked for next; then the repetition time in days, hours, and minutes (or 'none') is requested. The SLEEPER communication program may be used at any time to add, delete, or list the current SLEEPER entries; even when the SLEEPER program is running. (If you are having trouble adding entries, make sure the SLEEPCOM file is not full.) After the SLEEPER communication file is set up you may run the SLEEPER program (either type ':RUN SLEEPER', or let OVERLORD [also from the CSL] run the SLEEPER program automatically). SLEEPER will then determine the earliest time that any activity must be executed, then "go to sleep" (via the PAUSE intrinsic) until it is time to schedule that activity. In this way the SLEEPER program is little load upon the system, as it is sleeping most of the time. If a repetition time is specified for an activity then SLEEPER will update the time to schedule that activity after it has been scheduled by adding the repetition interval to the scheduling time. If no repetition interval is specified then that activity is deleted from the communications file after it is executed. SLEEPERC is a program used to communicate with the SLEEPER program as it runs. The OVERLORD program may be used to run SLEEPER or SLEEPER may be run alone (usually as a batch job). HOW STREAMX/SLEEPER WORKS ~~~~~~~~~~~~~~~~~~~~~~~~~ As you know, STREAMX gets passwords for job streams by prompting for them at :STREAM time; but because SLEEPER is streaming the job, there is no one to answer the passwords. Fortunately, SLEEPER is generally run by MANAGER.SYS (or a user with SM capability), so STREAMX will automatically generate the passwords for all job streams streamed by SLEEPER, since STREAMX's logic dictates that an SM user never needs to answer any passwords because he can retrieve them anyway. To link STREAMX with SLEEPER, we need to run STREAMX in immediate mode, equating the file we want to stream with STRMFILE and invoking STREAMX with PARM=1. Unfortunately, SLEEPER cannot run programs with parms, so instead of running STREAMX, we run STRMSLEP, which simply invokes STREAMX with PARM=1. LOGOFF -- LOGS OFF INACTIVE SESSIONS ************************************ INTRODUCTION ~~~~~~~~~~~~ Users often log on to the system, do some work, and then leave the terminal unattended (coffee break?, lunch?) without logging off. Sometimes users even go home for the day without logging off. * SECURITY THREAT: WALK UP TO TERMINAL TAKE ADVANTAGE OF CAPABILITIES DISCOVER MPE PASSWORDS TO SENSITIVE ACCOUNTS This can be a security problem because this means that anyone can come up to a terminal and use it without having to go through any security system. This can be an even greater problem if the logged-on user is an Account Manager or the System Manager because the would-be thief could take advantage of the extra capabilities and gain access to sensitive information. (It's fortunate, though, that you are using SECURITY/3000 because the personal profile answers which must be known to gain access to the system are one-way encrypted--otherwise, the would-be thief could do a :LISTUSER, :LISTGROUP, and :LISTACCT, retrieve all the MPE passwords, erase all evidence that he did so by clearing the screen, and then log on as that user at some later date. * SYSTEM RESOURCE WASTE: SYSTEM TABLES MORE TERMINALS THAN PORTS Another problem posed by having an idle terminal is that certain system resources are being used unnecessarily. This can be of particular concern if you are short on CST and DST entries, and especially if you have several users contending for a limited number of ports through data switches or port selectors. Why should an inactive session consume valuable resources? Logged-on sessions at the end of the day also prevent you from doing your backup. LOGOFF remedies these problems. It permits the System Manager to ensure that any terminal which is logged on but has not been actively used for a certain length of time is automatically logged off. HOW LOGOFF WORKS ~~~~~~~~~~~~~~~~ LOGOFF will log off qualifying sessions that have exceeded the acceptable period of inactivity. You specify how much inactivity is acceptable and which sessions are to be monitored for inactivity. * REMOVES INACTIVE/UNWANTED SESSIONS FROM SYSTEM * INACTIVE = READ PENDING AND NO CPU USAGE RECENTLY * uses MPE :ABORTJOB #Snnnn LOGOFF decides that a session is inactive if it's had a terminal read pending for a long time (at least as long as the configured timeout period). For example, if the timeout period is 20 minutes (1200 seconds) and some program prompted the user for input 20 minutes ago and he still hasn't responded, LOGOFF will abort that user. On the other hand, if the program's been working for 20 minutes, or even been suspended waiting for a :REPLY (or anything else that doesn't involve a terminal read), the program won't be aborted. After you configure LOGOFF (see CONFIGURING LOGOFF in this section) you stream a job which runs the LOGOFF program--the program will run "in the background" all the time and monitor the system using a minimal amount of resources. LOGOFF will perform an :ABORTJOB on inactive sessions--MPE will take care of file closures, buffer posting, etc. When a session is aborted by LOGOFF, * a message saying that the session is being aborted due to lack of activity is sent to that session's terminal (the text of this message will default, but you may define your own) * if the terminal is in BLOCK MODE (e.g. VPLUS screen), LOGOFF will take the terminal out of this mode and display its message below the screen. * a message describing the logoff and identifying the LDEV of the logged-off session is sent to the system console * an entry is written to LOGOFF job stream's output spool file indicating the session number aborted and the time and date it was aborted CONFIGURING LOGOFF ~~~~~~~~~~~~~~~~~~ You may configure logoff in a number of ways. * ACCEPTABLE PERIOD OF INACTIVITY * WHICH SESSIONS TO MONITOR (BY LDEV) * SESSIONS CURRENTLY RUNNING PROGRAM * BLOCK MODE HANDLING * DS SESSION HANDLING * ABORT MESSAGE TO BE SENT First, you must specify the acceptable period of inactivity. This is done with the $TIMEOUT keyword. Next, you may optionally configure which sessions will have their activity monitored by using the $TERMINALS keyword. This is done by defining the "ldev-pool" of logical devices to be monitored. Also, you may specify additional criteria to be checked by LOGOFF before the inactive terminal is aborted (e.g. that sessions running a particular program should not be aborted). Furthermore, you may configure how LOGOFF will deal with sessions which have qualified to be logged off. This includes BLOCK MODE handling, DS SESSION exclusion, and the MESSAGE to be sent to the user. If you specify only the $TIMEOUT period, logoff will by default: * monitor sessions on any logical device * exit a terminal from block mode and then display message * not abort sessions with a DS session * display the default logoff message * abort sessions running any program If you have already configured LOGOFF and wish to change something in the configuration while LOGOFF is running, you need not abort the LOGOFF job and re-start it--just make the changes to the configuration file and they will take effect right away (or, rather, the next time the LOGOFF program reads the LOGOFF data file). The configuration information for LOGOFF is kept in the file LOGOFF.DATA.SECURITY and each time you make a change to it by KEEPing the file from the :EDITOR you must: :ALTSEC LOGOFF.DATA.SECURITY;(R,X,A,L,W:CR) SPECIFYING WHICH LOGICAL DEVICES ARE TO BE MONITORED ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ You may specify which logical devices are to be monitored by LOGOFF. The LDEVs to be monitored are referred to as the "ldev-pool". This "ldev-pool" is defined by adding a keyword and a list of LDEVs to the LOGOFF.DATA.SECURITY file. If you specify to INCLUDE a list of LDEVs, the "ldev-pool" will be that list of LDEVs. If you specify to EXCLUDE a list of LDEVs, the "ldev-pool" will be all the LDEVs configured as terminals which are not in your EXCLUDE list. Either add a line to INCLUDE certain terminals: $TERMINALS INCLUDE ldev ldev ldev ldev ldev ... or to EXCLUDE certain terminals: $TERMINALS EXCLUDE ldev ldev ldev ldev ldev ... where 'ldev' is any logical device number (e.g. '21 38 40 47') which are included in or excluded from the logoff "ldev-pool". LOGOFF will monitor only the sessions logged on to the LDEVs in the logoff "ldev-pool". The LDEV which is the system console is always excluded from the "ldev-pool" (even if it is switched from LDEV 20). If all the LDEVs you need to specify do not fit on a 72-character line, you may put them on several lines as follows: $TERMINALS INCLUDE 22 23 24 25 27 29 30 31 32 33 35 37 38 39 47 48 55 56 57 58 If neither a $TERMINALS INCLUDE or $TERMINALS EXCLUDE line is contained in the file, all LDEVs (except the console and all DS sessions) will be included in the "ldev-pool". Regardless of what you specify, LOGOFF will only monitor LDEVs which are configured as type = 16 (terminals). NOT LOGGING OFF SESSIONS RUNNING A SPECIFIED PROGRAM ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ After LOGOFF has qualified a session by LDEV and inactivity, you may additionally specify that sessions running a particular program not be aborted. This means that programs such as FORMSPEC.PUB.SYS which often have long periods of inactivity (due to screen design) may be specified to logoff as being special and that regardless of inactivity this session should not be logged off while running this program. To configure LOGOFF to EXCLUDE logging off sessions running a particular program add a line to LOGOFF.DATA.SECURITY: $PROGRAMS EXCLUDE program program program ... where 'program's are fully qualified program names (e.g. ENTRY.PUB.SYS FORMSPEC.PUB.SYS). If no $PROGRAMS is specified, this check is not performed. RESTRICTING LOGOFF BY USERS ~~~~~~~~~~~~~~~~~~~~~~~~~~~ With $TERMINALS INCLUDE and EXCLUDE, you can have LOGOFF abort only those inactive sessions which are running on certain terminals (or, for EXCLUDE, running on any terminals EXCEPT the ones given). With $PROGRAMS INCLUDE and EXCLUDE, you can restrict LOGOFF to only look at terminals that are running (or not running) certain programs. Similarly, with $USERS INCLUDE and EXCLUDE, you can specify which users should or should not be aborted due to inactivity. Say, for instance, that you don't mind people walking away from their terminals whenever they're signed on to non-sensitive accounts. The only accounts that you really want LOGOFF to work on are AP, GL, and SYS. You can just add the following line to your LOGOFF.DATA.SECURITY file: $USERS INCLUDE @.AP @.GL @.SYS Whenever LOGOFF sees an inactive session, it will check to see if it's logged on to one of those three accounts; if it isn't, LOGOFF won't touch it. Similarly, there might be some specific users that you don't want to abort. BIG.CHEESE, for instance -- your boss -- gets very aggravated when he gets kicked off the system, and the fact that he shouldn't leave his terminal inactive doesn't sway him. Rank has its privileges, after all, and you can just say $USERS EXCLUDE BIG.CHEESE Actually, you can be very specific in who you include or exclude. As the first example above showed, you can specify user identifiers with wildcards (@.AP, CLERK@.GL, JOE.@, etc.); also, you can select by session name and group name as well as user name and account name, so you can say $USERS EXCLUDE JOE,@.DEV,SOURCE which will exclude sessions signed on with session name "JOE" into the "SOURCE" group of the "DEV" account. If you have neither a $USERS INCLUDE nor a $USERS EXCLUDE line in the LOGOFF.DATA.SECURITY file, LOGOFF will abort inactive sessions regardless of their user id (although the $TERMINALS and $PROGRAMS restrictions still apply). This is a pretty good default, since usually any inactive session is not a good thing to have around. DS SESSIONS - TO ABORT OR NOT TO ABORT (THAT IS THE OPTION) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ LOGOFF may be configured to abort sessions regardless of whether they are a local or remote DS-session. By default, LOGOFF will not abort any DS-session. You may perform the abort by configuring the LOGOFF.DATA.SECURITY file with the keyword: $DSABORT This will cause DS-sessions to be aborted. SAMPLE CONFIGURATION ~~~~~~~~~~~~~~~~~~~~ EXAMPLE1: If the LOGOFF.DATA.SECURITY file contained the following: $TIMEOUT 900 $TERMINALS EXCLUDE 33 36 38 39 45 $PROGRAMS EXCLUDE FORMSPEC.PUB.SYS ENTRY.PUB.SYS then LOGOFF would abort all sessions that were all of the following: Inactive for more than 900 seconds (15 minutes) AND logged on to an LDEV other than 33,36,38,39 or 45 AND running a program other than FORMSPEC.PUB.SYS and ENTRY.PUB.SYS EXAMPLE2: If the LOGOFF.DATA.SECURITY file contained the following: $TIMEOUT 1200 $TERMINALS INCLUDE 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 then LOGOFF would abort all sessions that were: Inactive for more than 1200 seconds (20 minutes) AND logged on to an LDEV from 33 to 60 inclusive. ACTIVATING LOGOFF ~~~~~~~~~~~~~~~~~ To have LOGOFF continually monitor the system and abort idle sessions (using the parameters you have configured in LOGOFF.DATA.SECURITY) you need to stream a job which runs the LOGOFF.PUB.SECURITY program, which wakes up every so often (using a minimal amount of system resources) and aborts all sessions which should be aborted, according to your configuration in LOGOFF.DATA.SECURITY. The logoff job stream is stored in the file LOGOFF.JOB.SECURITY which does not contain any passwords on the job card, so STREAMX should be used to stream the job (see the "STREAMX" section of this manual for information about eliminating passwords in job streams). Just do this: :FILE STRMFILE=LOGOFF.JOB.SECURITY :RUN STREAMX.PUB.SECURITY;PARM=1 STOPPING LOGOFF ~~~~~~~~~~~~~~~ "A car needs to be able to do only two things -- to go and to stop." A LOGOFF job stream is just a 'plain vanilla' MPE job. If you want to abort it, you can just do an :ABORTJOB, just like you would for any job of your own. On the other hand, MPE's :ABORTJOB is sometimes rather temperamental. Surely you, as a system manager, have often encountered sessions that just won't go away -- no matter how many :ABORTJOBs are done, they're still there; sometimes you even have to re-start the system if you want them removed. This is why it's a good idea for all background tasks, like LOGOFF, to have some normal shutdown procedure, which can let somebody stop them without having to do an :ABORTJOB. To do this, you just :RUN LOGOFF.PUB.SECURITY,STOP This will send a message to the LOGOFF job stream using a message file; LOGOFF will catch this message and perform an orderly shutdown of itself. Of course, you can still do an :ABORTJOB of the job stream if you want to, but we think that the ":RUN LOGOFF.PUB.SECURITY,STOP" is a cleaner solution. Note that there's no reason why you have to abort the LOGOFF job stream when you do a system backup. Just keep it running. PASCHG-changing MPE passwords ***************************** INTRODUCTION ~~~~~~~~~~~~ To protect the security of their systems, many installations encourage (or require) MPE passwords to be changed periodically. That way, by the time a password gets out over the "grapevine," it will have been changed. Unfortunately, MPE's security system makes changing user passwords rather difficult. Since only an Account Manager--not the user himself!--can change a user password, changing passwords is actually discouraged. A user may feel reluctant to spend time getting in touch with his Account Manager about changing a password (even if he, the user, suspects it has been compromised); an Account Manager is very likely to put off changing passwords if it means changing them for 100 users in his account. A very good solution to this problem--in fact, one implemented on most other computer systems--is to allow a user to change his own password. Since the user is allowed to change only his own password (not other users'), this poses no security threat; in fact, it actually improves security by making it easier for a user to get his own password changed. HOW PASCHG WORKS ~~~~~~~~~~~~~~~~ A user may run the PASCHG program, which first prompts him for his current MPE user password (if he has one). The user must enter the correct password in order to change it--this protects against somebody walking up to a logged-on terminal while its real user is away and changing the password (although SECURITY/3000's LOGOFF program is a better solution to this problem. After the user has correctly entered his current password, he is asked for a new password. After he enters the new password, he is asked to enter the same password again, to make sure that he did not enter it incorrectly the first time. If he enters a different password the second time, PASCHG assumes that he has made a typo and repeats the new password sequence. Once the user has entered a new password (and entered the same password again, guaranteeing that it's the one he really wants), his password is changed. A user is not allowed to use PASCHG to remove his own password, since the Account Manager might often want to require his users to have passwords; therefore, if the user hits <return> when asked for the new password, an error message will be printed and the password will remain unchanged. PASCHG also forbids a user from changing his password to the same value, as that would defeat the purpose of changing the password. HOW TO SET UP PASCHG ~~~~~~~~~~~~~~~~~~~~ The PASCHG program is PASCHG.PUB.SECURITY Any user may :RUN it, and the easiest way to do this is to set up the UDC "PASCHG" so that a user may type just one word to invoke the program. We recommend that you set the PASCHG UDC at the system level so that all users may run it: :SETCATALOG CHGUDC.PUB.SECURITY, YOURUDCS.PUB.SYS; SYSTEM That way, a user need merely type :PASCHG and the PASCHG system will be invoked. Certainly, there are some HP3000 installations whose security systems operate in such a way that they don't want users changing their own passwords. A good example of this is when several people share a single user ID, and you don't want one of them to change their joint password (although for this kind of application, SECURITY/3000's security-by-session-name should be used. If you don't want your people running PASCHG.PUB.SECURITY, simply put a lockword on this file or remove it entirely from the system. No other part of SECURITY/3000 depends on it, so all the other components of SECURITY/3000 -- the Logon Security System, LOGOFF, OBSOL, TERMPASS, STREAMX, etc. -- will still function as well as always. EXAMPLE OF A PASCHG SESSION ~~~~~~~~~~~~~~~~~~~~~~~~~~~ A typical session with PASCHG might look like: :PASCHG << a UDC that runs PASCHG.PUB.SECURITY >> SECURITY/PASCHG Version 0.2 (VESOFT, Inc. (C) 1985) Please enter your current user password: << user enters it >> Please enter your new user password: << user enters 'FOO' >> Please enter the same password again: << 'FOO' again >> Password changed. Note that none of the password inputs are echoed; furthermore, if the user wanted to abort the change any time until he entered the new password the second time, he could do so by hitting <control-Y>. PASCHG/OBSOL INTERFACE ~~~~~~~~~~~~~~~~~~~~~~ PASCHG works well with OBSOL, SECURITY/3000's MPE Password Obsolescence System since with PASCHG the Account Manager isn't burdened with having to change dozens of passwords at the end of every month. However, in order for OBSOL to "know" that a password has been changed with PASCHG, PASCHG has to be told to tell OBSOL that a change is being made. If you run PASCHG.PUB.SECURITY with ;PARM=1, it will invoke OBSOL and tell it that the password is being changed. So if you use OBSOL, your :PASCHG UDC ought to look like: PASCHG RUN PASCHG.PUB.SECURITY;PARM=1 (whereas if you don't use OBSOL, the ';PARM=1' should be omitted). In fact, the OBSUDC.PUB.SECURITY UDC file, which contains all the UDCs relevant to OBSOL, contains this PASCHG UDC as well. Note that when a user changes his own password, he is not allowed to change the obsolescence period and warning period (as is normally the case when an Account Manager changes a user's password). This is done because the Account Manager might not want users altering the obsolescence period, perhaps lengthening it to the point where passwords no longer have to be changed frequently. Note: you may configure OBSOL to run PASCHG automatically when the user password is within its warning period (see OBSOL). In addition, PASCHG may be invoked automatically from OBSOL so that if a user logs on and is warned that his password will expire, PASCHG will be run automatically to permit the user to change his password at that time. This can further automate the process of password maintenance because a user does not have to know what program to run, what UDC name to type, or whom to contact to get his password changed. The following UDC may be used instead of OBSOLUDC to invoke the OBSOL system. As you can see, OBSOL will set a JCW which the UDC recognizes to run the PASCHG program. This UDC is stored as the file OBCHGUDC.PUB.SECURITY. OBSLOGON OPTION LOGON, NOBREAK RUN OBSLOG.PUB.SECURITY IF SECURITYANSWER = 1 THEN BYE ELSE IF CHGUSERPASS = 1 THEN RUN PASCHG.PUB.SECURITY;PARM=1 ENDIF ENDIF ENFORCING PASSWORD STANDARDS ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ You may configure PASCHG to edit passwords that your users specify for themselves. This editing may be used to enforce minimum password length in addition to specific alpha, alphanumeric and numeric character patterns. The edit characters used are similar to COBOL's. The 'edit pattern' is specified by adding a line to the file SECURMGR.PUB.SECURITY in the format: PASCHG-EDIT=<edit pattern> Where the <edit pattern> conforms to the following rules: 'X' is any alphabetic [a..z] or numeric [0..9] 'A' is any alphabetic character '9' is any numeric character For example: PASCHG-EDIT=AXXX enforces 4 character minimum password length PASCHG-EDIT=AXXX9 enforces 5 character minimum password length one alpha, three alphanumeric, one numeric PASCHG-EDIT=AAAAAAAA enforces 8 character minimum password length all alpha Regardless of what is specified by PASCHG-EDIT, as per valid MPE password format, the first character of the edit pattern will be assumed to be an 'A' (alpha) when editing the password input. If the new password is longer than the edit pattern specified in SECURMGR.PUB.SECURITY, those characters are not edited. If no PASCHG-EDIT keyword is found in the SECURMGR.PUB.SECURITY file, PASCHG will use the default edit pattern of 'AXXX' indicating a minimum four character password. GETPASS: A PROCEDURE TO GET ONE'S OWN PASSWORD ********************************************** INTRODUCTION ~~~~~~~~~~~~ There is an unfortunate deficiency in MPE which forbids a user from retrieving his own passwords; this necessitates programmers who are building and :STREAMing streams from inside their programs to embed passwords into those programs, which makes the necessary (mandatory?) operation of changing passwords once in a while simply unfeasible. The user-callable procedure GETPASS is designed to remedy this state with it, any user is allowed to retrieve his own passwords (which is certainly not a security threat, as he needed to know them to sign on; also, for convenience, the system manager is allowed to retrieve the passwords of ANYBODY (for he is god anyway), and the account manager may retrieve the passwords of anybody in his account. Thus, with GETPASS a programmer can call WHO, find out his user, group, and account names, call GETPASS, and retrieve his passwords; then, it is easy to insert these passwords into the job card. Thus,a hard-to-maintain embedded passwords can be avoided. GETPASS has the following parameters: PARAMETER 1: USER - The user to get passwords for. 2: ACCOUNT - The account to get passwords for. 3: GROUP - The group to get passwords for. 4: PASS-USER - The user password. 5: PASS-ACCT - The account password. 6: PASS-GROUP- The group password. 7: ERR - FALSE = everything went OK; TRUE = security violation or nonexistent user, account, or group. GETPASS needs to use privileged mode (PM) capability for its execution; however, it uses it in a safe fashion and has NEVER caused a system failure yet! Note that programs calling GETPASS need not be PREPed with PM capability; it must reside in an SL in a group and account containing PM capability (like SL.PUB.SYS). To add GETPASS to the system SL, you need merely do a CP\INDEX GETPASS.PUB.SECURITY :HELLO MANAGER.SYS :SEGMENTER VX -SL SL Z@ -USL GETPASS.PUB.SECURITY -ADDSL GETPASS -EXIT GETPASS can be called from COBOL in the following way: USER PIC X(8). ACCOUNT PIC X(8). GROUP PIC X(8). PASS-USER PIC X(8). PASS-ACCOUNT PIC X(8). PASS-GROUP PIC X(8). ERROR PIC S9(4) COMP. . .. CALL "GETPASS" USING USER, ACCOUNT, GROUP, PASS-USER, PASS-ACCOUNT, PASS-GROUP,ERROR. IF ERROR IS NOT EQUAL TO 0 THEN << An error occurred >> DISPLAY "SECURITY VIOLATION OR BAD USER, ACCOUNT, OR GROUP" STOP RUN. A real live example of a FORTRAN program calling GETPASS: $CONTROL NOSOURCE, USLINIT PROGRAM TEST GETPASS INTEGER USER(4), ACCT(4), GRUP(4), UPAS(4), APAS(4), GPAS(4) CHARACTER *8 BUSER, BACCT, BGRUP, BUPAS, BAPAS, BGPAS EQUIVALENCE (BUSER,USER),(BACCT,ACCT),(BGRUP,GRUP), (BUPAS,UPAS),(BAPAS, APAS),(BGPAS,GPAS)LOGICAL ERR DISPLAY "ENTER USER: " ACCEPT BUSER DISPLAY "ENTER ACCOUNT: " ACCEPT BACCT DISPLAY "ENTER GROUP: " ACCEPT BGRUP CALL GETPASS (USER, ACCT, GRUP, UPAS, APAS, GPAS, ERR) IF (ERR) DISPLAY "ERROR: SECURITY VIOLATION/BAD PARAMETER" IF (ERR) GOTO 10 DISPLAY "USER PASSWORD=",BUPAS DISPLAY "ACCOUNT PASSWORD=",BAPA DISPLAY "GROUP PASSWORD=",BGPAS 10 STOP END FILES IN THE SECURITY ACCOUNT ***************************** INTRODUCTION ~~~~~~~~~~~~ Lastly, I want to list some things you may see in your explorations. There are many interesting files to be found withing the SECURITY account. Here is a list and description of the common file you may find there: DATA group: Data files ~~~~~~~~~~~~~~~~~~~~~~~ ANSSCHEM - Schema of the database ANSWER (might be used to increase database capacity; default is 500 records). ANSWER - IMAGE database which contains information about PERSONAL PROFILE LOGON IDs (one-way encrypted passwords, access restrictions, menu file names, etc.). LOG - Circular disc file to which all attempted security violations and security configuration changes are logged. LOGOFF - Specifies logical devices to be monitored and the length of inactivity required prior to a session being aborted. MEMOFORM - Memo format for attempted violation listings which may be customized to provide more or less detail. OBSSCHEM - Dbschema input file for the image database OBSOL. OBSOL - IMAGE database specifying the date by which MPE GROUP, USER and ACCOUNT passwords must be changed (warning period, too). QUESTION - During SECURITY/3000 logon the user must answer a question randomly selected from this file (built by user; personal profile questions are recommended). TERMPASS - Specifies logical devices which will be protected with passwords. Protection for dial-ups, DS lines, etc. DOC group: Documentation files ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ANORDER - Contains the DOC file names in the order in which they should be printed. CONTENTS - Table of contents for the SECURITY/3000 manual. FILES - Describes the files in the SECURITY account. GETPASS - Explains how to build job stream file in application programs without jeopardizing system security. HOW2LIST - Describes how to print the documentation files provided in the DOC group with the MPEX 'USER' command. INTRO - Overview of SECURITY/3000 package. LOGOFF - Explains why idle sessions are a security threat. Step by step instructions of how to configure logoff. NEWFEATR - New features in SECURITY/3000. OBSOL - Describes how the password obsolescence subsystem insures the frequent changing of MPE passwords. ONLINE - Describes the Logon Security System which protects against online logon access. PASCHG - User (not account manager) changeable passwords. REFS - List of SECURITY/3000 published references. STREAMX - Manual for STREAMX/3000 which provides batch access security and parameter passing to job streams. TERMPASS - Documentation of TERMPASS, which allows protection of logical devices (DS line, dial-in lines, console, etc). HELP group ~~~~~~~~~~ HELPMAKE - The stream to modify USER.HELP.SECURITY file. USER - The HELP file for SECURITY/3000. JOB group: Job streams ~~~~~~~~~~~~~~~~~~~~~~~~ LOGOFF - Job stream which runs the program LOGOFF.PUB to monitor sessions' CPU usage and logoff idle terminals by LDEV. PAPERS group: Security-related papers ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ANAHEIM - "BURN BEFORE READING - HP 3000 SECURITY AND YOU", HPIUG 1983, Anaheim, CA USA. COPNHAGN - "SECURITY/3000: A new approach to logon security", HPIUG 1982, Copenhagen, DENMARK. PROFILE - "PRODUCT PROFILE: SECURITY/3000", SUPERGROUP Association Newsletter, July 1982. PUB group: Program files, USLs, UDCs, etc. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ FINDCAP - A program to list dangerously capabilitied users and show if they have an MPE password. QUITE handy... LOGOFF - Program which logs off idle sessions. OBSCHG - Password OBSOLescence database update program. OBSFILL - OBSOLescence data base initialization program. OBSLOG - MPE passwords obsolescence program. OBSOLUDC - Log-on UDC file for MPE passwords obsolescence subsystem. OBSUDC - UDC file for MPE passwords obsolescence subsystem. PASCHG - The program which lets users change their own password. QGALLEY - Program to format and print DOC files. SECURMGR - Control file containing SECURITY/3000 global parameters. SECURUDC - Log-on UDC file for users protected by SECURITY/3000. SECURUSL - USL file for the callable SECURITY procedure. SESSION - USL file for GETSESSION procedure. STREAMX - STREAMX/3000 program which provides batch access security and parameter passing to job streams. STRMSLEP - The SLEEPER/STREAMX interface program (see STREAMX.DOC). STRMUDC - UDC file containing a UDC to invoke STREAMX. TERMPASS - Program which verifies terminal (LDEV) passwords and/or interfaces with USER program for positive user identification TERMUDC - Log-on UDC file for users using TERMPASS. USER - The main SECURITY/3000 program. _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ Informatik Submission & Subscription Policy ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Informatik is an ongoing electronic journal, and thus we are faced with the ever present need for a steady influx of new material. If you have an area of interest or expertise that you would like to write about, please do not hesitate to contribute! We depend on reader submissions!! We do ask that any submissions fit the following guidelines... General Content ~~~~~~~~~~~~~~ Material for Informatik should concern information of interest to the computer underground community. Examples of this include, but are by no means limited to hacking and phreaking, governmental agencies, fraud, clandestine activity, abuse of technology, recent advances in computing or telecommunications technology, and other of information not readily available to the public. Please include a title and author name. Text Format ~~~~~~~~~~ * standard ASCII test * 79 characters per line * no TAB codes * no special or system specific characters * mixed case type * single spaced, double space between paragraphs * no pagination News submissions ~~~~~~~~~~~~~~~ * Submit only recent news items * Include the headline or title of the article the author's name (if given) the publication of origin the date of publication * Don't submit news that has appeared in other e-text journals Subscription policy ~~~~~~~~~~~~~~~~~~ We are happy to provide an Internet based subscription service to our readers. To be on our mailout list, send mail to our Internet address, "inform@grind.cheme.cmu.edu" and include the word subscription in the subject of your message. If you requested a subscription before, you need to reply again, because the old subscription list was deleted by MH. Back Issues ~~~~~~~~~~ Back issues of Informatik are available via ftp at ftp.eff.org in the /pub/cud/inform directory. The site also contains a plethora of other electronic texts of interest to the "computer underground" community including Phrack, NIA, PHUN, and the LOD tech journals.