A terrible war between Russia and Ukraine has started on the territory of Sudan. When Lieutenant General Abdel Fattah al-Burhan, Sudan's military ruler, found himself besieged by rebel forces in the country's capital last summer, he called an unlikely ally for help, Ukrainian President Volodymyr Zelensky, according to the Wall Street Journal. It is noted that Zelensky had reasons to take the request seriously. Burhan had been quietly supplying Kiev with weapons since shortly after Russia invaded Ukraine in 2022, according to Ukrainian and Sudanese military officials. In addition, the Sudanese rebels were backed by Russia's Wagner paramilitary group, which has also mined gold in the country and used it to fund Moscow's war in Ukraine. Ukrainian Timur special forces are active in the civil war in Sudan. Not much information is available in the public domain about the Ukrainian military's presence in Sudan. Matthew Orr, Eurasia analyst at the Risk Intelligence Company, Reign, told the New Arab. Sudan's brutal war between the Sudanese armed forces under Abdel Fattah al-Burhan and the paramilitary rapid support forces led by Mohamed Hamdan Hemedti Dagalo erupted last April. It has since killed over 10,000 people, displaced 6 million within the country, and caused another 1.7 million to flee to neighboring countries. Less than a week into the war, reports emerged that Wagner Group supplied the rapid support forces with surface-to-air missiles. There were also indications in September that Ukrainian special services were operating in Sudan, targeting Wagner and the rapid support forces. Sudan would be a strategically logical target for Russian mercenaries' activities as neighboring Central African Republic is one of the places where Russian mercenaries under the Russia's main directorate of the General Staff of the Armed Forces are most active while ensuring access to Sudan would fit within Russia's broader Sahelian strategy, or, said. On the other hand, the strategic usefulness of Ukraine's activities is dubious since it needs all available resources to defend its own territory. Nevertheless, Ukraine doesn't necessarily see it that way. Kiev likely believes that the few resources spent exaggerating the mere threat of such attacks on Russian interests in Sudan opened the possibility of similar attacks across Russian activities in the Middle East and Africa, forcing Moscow to expand disproportionate resources to secure against such activities in new geographies, or, said. Risk of Russian tactical nuclear strike, higher than thought. Russia's threshold for using shorter-range tactical nuclear weapons may be lower than defence experts in the West believe. The Financial Times has claimed cited purported Russian military documents. The materials, which were allegedly presentations for Russian naval officers, discussed operating principles for the use of nuclear weapons the Financial Times reported. They were supposedly produced between 2008 and 2014 and shared with the British outlet by Western sources. Kremlin spokesman Dmitry Peskov told the newspaper that Russia strongly doubts the authenticity of the documents. Moscow's military doctrine allows for the deployment of nuclear weapons in retaliation to a first strike against it, or its allies, or in situations where Russian statehood is threatened. Senior officials including President Vladimir Putin have drawn attention to the country's nuclear arsenal amid the Ukraine conflict. The US and its allies have accused the Russian leader of nuclear blackmail, although Moscow has rejected that allegation. The criteria for the use of nuclear weapons in the documents reviewed by the FT included losses by Russian forces that would irrevocably lead to their failure to stop major enemy aggression and a critical situation for the state security of Russia. The destruction of 20% of Russia's strategic missile submarines, 30% of nuclear-powered attack submarines, or a simultaneous hit on main and reserve coastal command centres were cited as specific examples. France insists on sending Western troops to Ukraine, Russia promises catastrophic scenario. The Elishe Palace, after French President Emmanuel Macron's statement about the possibility of sending troops from Western powers to Ukraine, insists that Kiev's allies should discuss this issue. As the source explained to CNN with his statements, Macron signalled his Russian counterpart Vladimir Putin about his determination and desire of France to prevent any victory of the full-scale Russian invasion. The source stressed that the French President did not talk about the actual departure of troops and no decision was made on this, but there are all sorts of things that were ruled out two years ago and which are no longer ruled out. Macron has not ruled out the possibility of sending Western troops to Ukraine in the future after a meeting in Paris emphasising that there is currently no consensus among allies. A number of European states and NATO have since stated that they do not plan to send any troops to Ukraine. The potential deployment of NATO troops to Ukraine will lead to a catastrophic scenario and could be interpreted as a declaration of war on Moscow, top Russian senator Konstantin Kossachev has said. The vice-speaker of Russia's upper chamber, the Federation Council, offered his take on remarks by French President Emmanuel Macron on the possibility of sending troops in a telegram post. The approach exhibited by the French leader carries a risk of the situation developing into a catastrophic scenario, Kossachev warned, stating that the move would not be tolerated by the Kremlin. This is the line beyond which it's no longer just NATO's involvement in the war. This has been happening for a long time, but can be interpreted as the alliance entering direct hostilities or even as a declaration of war, Kossachev wrote. The senator's comments echoed a statement made by Kremlin spokesman Dmitry Peskov who said the move would make a direct collision between the US-led bloc and Moscow not only possible but actually inevitable.


Here to discuss you about three stuff. First, that big stuff here, the flip-paper, which was a project that I did with Jeremy Cortal, who unfortunately couldn't be here today. The second stuff, the most important, is actually the library we've been using to create this stuff. And the third stuff is the lessons we learned from using the flip-paper on the library. So what is at the center of everything is actually drawing. The point of this script was actually you have something you could draw on and you can play on to have a mix of both. So also, inspiration for that was mud. Mud is dirty, mud is a mess. You don't want that inside, you want that outside. When you're past 18 years old, you say no to mud, and you should not. You should not. You should say yes to that, because mud is reality, and your computer would be virtuality, let's say. If you can, virtuality is making a lot of buzz lately, and it's pretty good. But for instance, if you want to create interaction in your virtual world, you need to define all the rules. If you didn't think of one rule, then it can be used by the user. But in reality, in the world of mud, you have already a lot of rules that have been already pre-made, like gravity. We won't test it out today, but it should be working. So you can already actually bet on a lot of stuff. You don't have to construct everything from scratch. You can actually work from something that is, well, for one, amazing, and that people know already. It's already an idea of making the best pen so that everybody would know how to use these tools in a specific way. But if you're based on reality, then it's obvious for everybody. So coming from reality, what we wanted to have as an interaction was drawings. It was really, actually, more than drawings. We will speak a lot about drawing, because it's more common to the mind, let's say, but it's just canvas and pigments. It's just colors. It's really just colors. But usually, when you apply colors, you think of drawing. You think of felt pen and stuff. So what we wanted to have is to have actually drawings as entry points for a gameplay. Well, maybe not even just a video game, but something to interact with, something that could be augmented. And by the way, if this is me, this is Jeremy. So you have an idea of who he is already. So we tried to think about, OK, how can you actually use a drawing to interact? What sense can it make? What we thought, actually, was to first use a video game. So it would be better, actually. It's easier. It's like, I need to read. I need to do something. The interaction is pretty clear. We thought about many stuff, and we ended with pinball. Pinball is fun. Pinball is pretty easy to start with, but very hard to master. And so we created this speed paper, which was a mix between a pinball machine and a draft table. So you have something nice to draw in, and something nice to play in already. You have little buttons of style. On the side, left and right, the launch, and all that. So it's something you can really interact with. Hop, and loops. Next one, yep. So the result is that, actually. You have the sculpture itself. Kids, older people, draw on it. You have a video projector that projects on top of the drawing. You have a web camera that analyzes actually the drawing itself, and then you have some little objects that are drawn on top of it to be able to play. So to get a better view of how it's working, here you see, for instance, a drawing that is already scanned. So hop, you have a scan for the video projector. Analyze this of the outcome. Oh, no, boom. So there is an issue here, but it's all right. It's all right. Because I'm not sure if it was made on purpose, but it's very nice, actually, that he did that. And ta-da, now it's working. So the easy thing is that you have, so of course, these two are added on the flyer. You have the drawing. You have the scanning, the analysis, that we'll see a bit later. And then you can just play. And you can add whatever you want. So for instance, this one was a late edition, pretty fun. When you have a little blue dot, you can have a flipper, and then you can just play it as the common ones on the back. So the fun part of it is both, actually, and of course, it's on paper. The point of it is that's not to use, I don't know, like a whiteboard, not to use a screen or something, but to have something real because of, well, second slide, the mud. Which later, while he was basing on reality, he was really, really useful and created amazing results really past what we expected. And yeah, you can help. Oh, it's done. Oh, it's done. Well, there we go. Yeah, sure. There you go. One, two, one, two. Yeah, well, OK. So anyway, next slide. So yeah, we start always with a blank sheet of paper. Those actually are pictures taken straight from the sculpture itself. So then you have people starting drawing bits by bits. And it's very interesting because it's not just the point of having one drawing and that's it. You're done. Although it's always a matter of you try a little bit and you check that now it's not working well actually. And then you make modification, as we saw already, actually, in the video. So the point is that you repeat.  And in the end, and we'll see that later too, there is some kind of loop between playing and drawing. And you're not even sure actually in the end if you're drawing, playing, or actually both are the same stuff. And this is really, really, really one of our aim actually, to really mix both.  So after that, you will come and you will play the stuff. No, no, it's both at the same time. Which was pretty fun because some people actually had no idea about how to draw. And I said, ah, but I don't know how to draw. It's like, OK, just launch the ball. It will just fall. So you know that, since you've played already pinballer, you need to put stuff on the side. And bam, the person that didn't want to draw is already drawing. And of course, as soon as you start drawing, then it's just a matter of continuing, it's way easier. And the opponent is true. Somebody that is naturally into video games or even less pinball, but likes to draw, will start drawing and be very curious actually to see his drawing, his or her drawing come to life and what can be the gameplay that can be from it. So for that, we needed some inner tech. And I wish, I wish I could tell you, it was like super complex, super complicated that we use cutting-edge technology. Not at all, not at all. We use like, actually not so cheap, but good webcam. But at some point, we tried to get a pretty expensive one, which was very, very nice but harder to use. In the end, a webcam is way enough. Video projector and a mirror for projection too. So pretty easy actually. And the point of it is that it can be used by, well, anybody actually at home. So that was one of our aim in doing the library and in releasing it in the end. So that's what the cameras see after making some kind of geometrical correction on the picture in order to have one fair rectangle and not some trapezoidal shape. So this is what we see. Then we just do some very simple foreground, background to get what we really want from the picture. Then we do some supervised analysis of the drawing based on color.  At first, we tried to have some kind of local and supervised separation of colors, which was very fun because you could use any color you want and hopefully the computer by itself would separate the colors. But it didn't make sense because, yeah, you have separation that's all right, but you don't really know what to apply on those colors as a set of rules. So in the end, it made way more sense for the designer of the game to choose himself, herself, the color, actually, and then to apply the rules on them. Here, for instance, we have, well, it doesn't really show here that this is supposed to be green, blue, red, and yellow. So we have already separation based on color. Here we have four. Sometimes in the past, we have three. We can use as many as we can have separation already on the graph, depending on what you want to do. Then we have already separation and you can already put meanings on the colors. For instance, in the first iteration, what we had was not even yellow yet. We had red that was the bumpers. We had blue that were the walls, that's it. And we had green which was for the acceleration. And it was already pretty fun. But then you can add a little more stuff with the contours, little contour analysis. And then based on the surface and on the perimeter of the shape, you can know if it's a big one, a small one, more like a circle, more like a disc, more like a straight line, something like that. And you can add some stuff on top of it. For instance, let's go back to the previous one now. Yep, yep, yep. Those were our shootables. You can kill them, actually. And they revive after a while. Those ones are bumpers and they stay. And you have, well, here you have acceleration but at some point you can either or more close to a disc, you have a warp zone. So it was really a matter of trying to get a gameplay language on top of the drawing. The colours of course and the shape. And later we're trying to have to add more and more and more, say, much more descriptions on the shapes and on the drawing itself in the library by bits. For instance, it would be very nice for all of those to display as one block. They would know that, okay, all are the same. So the library itself opened for drawers, for galore, for makers, all of the above. Meaning that, well, I'm already very happy to be here and presenting it to everybody here. If you're curious about choosing the library, we are very eager actually to speak with drawers, with programmers, with coders to either play or what you've done, but more especially to actually use it to create other projects. So please get in touch with it. And very quickly, because I don't have much time left. Good? Perfect. It's the lesson learned. So while it might not be very, very technical, let's say, for me it's the most important and most interesting part, actually. So I told you about the library, but it could have been used like, wow, a decade ago, something like that. But no, this is pretty amazing, actually. But the lesson learned are the most important. It's how to use well the library itself. First, we saw that you need to be close to the drawing. Like, the flip paper is very nice because you actually, you play and you draw and you don't have to move to switch from one another. And the time of switching from one another is paramount. Really is very, very important. Because if it's not, if it's too much, like at some point, anybody could have, I mean, had to move for two meters, which takes one second if you're slow. So it was very, very short and yet nobody would make back and forth between drawing and playing. Because the activation energy to actually go to drawing when you're playing and to switch was too high somehow.  So being closer to drawing was very, very important. And sometimes you have weird results. It's actually playable. The point was that you really had two kind of people, people that tried to get really opinionable and I know what is happening. I know this stuff. Let me draw like my dream pinball and all that, which was pretty fun. And sometimes you had just people going by cheating sale and drawing whatever path through their mind. And the fun part was that both were really fun. Really, really fun. You might want to stay more on the pinball one because, wow, you really want to get a better score. You might want to just experiment. A lot of those are really fun parts. But the best one in the end is when you mix both. As I told you, it's so much of playing and drawing and closing the loop together while in the end it should show the result. It's like having a fun free paper to play and having an amazing drawing that not just is nice when it's static when in lights when you play it. This is mine, I love it. This one is a fun one actually because the yellow lights when the ball goes on top of it. So it's just like, I don't know, it's like firework, a nice one. Anyway, I wanted to have it here. So yeah, and when you have a disclaimer I don't know how to draw. When you have people that know how to draw, come back please. Hello, perfect. So this is the kind of stuff you can have. And okay, this one is actually a bit hard to play but it's really nice when you see it light up pretty cool. So you can have a lot of kind of drawings. For instance, this one is really more like playing like a pinball. And the very fun part actually, when we are wondering about what we are, Jeremy and I, about this work, we are not game designer.  Meaning that we will design rules for game designers to use for players to then use again. Meaning that we will define that, for instance, the red will be bumper, the yellow will be acceleration, and all that. Your other game designer too actually, that will design his own level. So you have indeed this loop between player and game designer. And this creates an amazing result for me. Very, someone, I mean, one that is very, very fun, which is next. Meaning that when you, if you think about it actually, when you play a game, you always have an excuse, a motivation. It's like why are you playing against this game? Oh, I want to top my score. Okay. So what do you, why are you still playing at this hour of the night?  You always have a motivation. And usually, motivation or an excuse. And having fun is not on the top of the list usually. As if you need an excuse to have fun. And here, the fact is that since you're the player and the game designer, there is no real end objective. You can't win the game in the end. You could even get, trying to get a high score. But in the end, since you define where the points are, and usually when you have kids playing this stuff, they put points everywhere to almost breaking the system actually. So it doesn't really make sense anymore. So it's really a pretty, pretty fun exercise actually to almost then like to be a, well, god and the human, both at the same time. So this would be actually, lesson to be learned, rather than lesson learned, because we are not sure yet exactly what to make of it, to be honest. Anyway, so, and yes, back to the mud, the reality. This was sometimes the stuff that we were pretty surprised about. The kind of gameplay you could have. Meaning that at first, since we were just Jeremy and I, oops, and Jeremy. Okay, thank you. Since we were just working together, so one would be trying the free paper alone. He would draw, he would play, and that's all right. But we really start to exhibit the free paper. We had many, many, many people on the same free paper. And you had groups of friends, one playing, the other one just like bothering and drawing while the other one is playing. You scan and pock in real time, almost real time, at the ball with tail in piece, and you would continue actually the new drawn pinball. So it was really a big surprise, actually, to see people playing the stuff and drawing the stuff with, I mean, not alone, but with people alone.  And then again, back to the mud, because if we had used a whiteboard, or I don't know, a touchscreen, it would have been probably easier actually to do, but not as fun in the end. So here you can actually take, hop, another world cartridge, another game level, from any other people, and just play it, start again, and get inspiration. For instance here, we were at an exhibition about comics. So you had comics drawers that went on the free paper and made a lot of stuff. So it was really nice for other people to be able to actually play on some game designed by some of their favorite authors. And another fun stuff is that since it's paper, you can really cut it, pass it again, so it really finds cut, copy, and past. We have it, and we have it live, real. So it's really fun. You can, if you have an object in your pocket that is blue, yellow, red or green or something, you can put it on top of the free paper to recognize the color. So you have many, many, many ways that you need to interact, not just the one we expected at first. And to finish on that, the first two are yes. Look here, you see it. A few ones, but you might wonder what actually is the one on the top right, and if you can read from afar, sauce. It was indeed with, let me remember, Okonomiyaki sauce, I think, some kind of Japanese sauce, and it worked. A bit weird, but it worked. And you can imagine, actually, using for the three kinds of blueberry, maybe, and wasabi. So if you like eating paper, you can eat your drawing after that. So it can really open up to a lot of crazy interactions. And the fun part is that it's not crazy, meaning I need one year of work crazy. It's crazy, that's like, let's do it tonight, crazy. This is the real fun part of it. And the last, because it's a matter of doing with, but also a matter of doing on. It was an exhibition. The guy had exactly the perfect colors, actually, we are using at this point.  And here is it. So if you see me here, thanks. I took the pictures. Yes. So, so here you go. And all that, of course, it's mostly for fun, but I mean, it's really, you have a lot of stuff to explore with it. This is the point. It's, I never expected, I was not looking for someone to have the right t-shirt and say, ok, you come here and say, oh man, but we can do it. Let's do it. And I'm sure that's what we discovered in the past year or six months, something like that. I'm sure we discover a lot more. And I'm sure in the coming years there will be a lot more that we won't be able to discover because there is too much actually for both of us, Jeremy and I. So this is why we really won't slash need programmers, coders, people that want to prototype some games, some interaction, something that would be another game, something using the business world with it, I don't know, or a drawer, something like that to really show us how even further we can push this idea of interacting with big men's canvas. There you go.


In this screencast, we would be describing system calls. A system call or syscall is an API that the kernel provides to user programs. What do system calls do? Almost everything. When you hit control S to save a file, you're actually invoking a system call. When your browser is trying to send data over the network, also invoking a system call. Since the kernel does not allow user space programs to access any hardware resource directly, it is always done through system calls. We will now see what a system call looks like. To do so, we first disassemble one of the simplest programs and see what it is doing. In this case, the program we have chosen is a program named Bintrue, whose source code can be found under the following directory. As you can see, Bintrue is really simple and it just invokes one function named exit passing a code of zero. Now let's look at what Bintrue looks like disassembled. To disassemble the program, we first need to navigate to the root directory and the bin directory under root. To disassemble true, we invoke the program os161 obj dump using the dash D flag and pass the program name, which in this case is true. Object dump generates quite a bit of output. This can be seen here. Now given that this is difficult to navigate and search in, we're going to pipe the output of object dump into a file named true.s. Now opening up true.s in the editor of your choice, we quickly jump to main function and find the call to exit, which can be found here. Now given that exit is a function, let's quickly look at what exit is doing. Exit in turn immediately jumps to another function named underscore exit, which is also found in this file. And as you can see underscore exit jumps to another function named underscore underscore syscall. Now let's look at this a little more closely. Although the li instruction lies below the jump, it lies in a special place known as the jump delay slot, which ends up executing before the jump itself. So for all practical purposes, you can assume that the order of instruction execution is like this. Now, given that we are jumping to a function named underscore underscore syscall, which is also found here, it raises the question as to where the content of this syscall function came from. To find this out, we're going to open a new terminal and search for underscore underscore syscall. There are two results to this. One is in the build directory or the compiled output and the other is the source. We're going to open up the syscalls.s file, which is in the build directory. We can quickly find the syscall function here, which contains quite a few instructions in assembly and each of these instructions have comments. So clearly the first line of underscore underscore syscall is syscall, which is an instruction that invokes a software interrupt in the kernel. Now, because this is invoking a software interrupt, we cannot execute this line until the kernel has finished servicing the interrupt. And as we can see from the comments, clearly once the interrupt is triggered, the kernel services it and then we check the return code after the kernel has serviced our interrupt. If it is zero, then the call succeeded, as the comments say. However, if it fails, then we store the error code into this global variable inside libc called erno and then we return minus one to the calling function. This is how the system call works in user space. In the next screencast, we will describe how the system call looks like to the kernel.


Welcome to All Hands Update, I'm Petty Officer Ian Cotter. These are your headlines from around the fleet. Officials at the USPS Mail Recovery Center hope to assist service members in recovering their lost items and offer tips to prevent mishaps. The center processed 88 million pieces of mail last year. You can help prevent lost mail by securing labels using tape and providing accurate and full addresses. Also consider adding your phone number and email address inside the package. For more information on getting your mail, visit the USPS's website. A Workplace and Gender Relations Survey may be coming to your inbox next week. The Active Duty and Reserve Survey will be sent out August 7th. The DOD Hosted Survey is designed to help better understand the military workplace, environment and personal interactions. 25% of males in the Navy and 100% of females will be contacted via email. The survey will be available until mid-September.


Greetings. Welcome to Track 4. This is the 4.30pm talk. You're going to hang out a while with Bill Graden, and he's going to talk about physical security, which is something that should get more attention, I think. So he's going to talk about defeating moving elements and high security keys. Awesome. Thanks, everyone. Thanks, Flicktid. So to get started, we'll give a brief overview of what we're going to talk about and then go through it. So we'll first introduce what is a moving element and why it's used. Go over some of the more naive ways to hack them, like a 3D printed cap development, a compliant mechanism, and then we'll get into sort of what the abstract said is the big reveal of this talk, which is a way to do it without using those, with having a static non-moving piece of metal that will actually actuate these mechanisms. We'll talk about the vendor disclosure process and how that went, and some of the implications and defenses. That's a very high level. So what is a moving element? So here's sort of some of the four most common, at least in North America, keys that use them. It is a piece of the key that moves relative to the rest of the key. So with multi-lock interactive, you've got this what's called the interactive component, and it slides in and out. With the multi-lock empty five, you've got a spring within the key so that can compress down, and otherwise it will spring out and have a little bulge at the end here. Medical M4, which is just rolling out now, it's got a similar thing. It's a pin that slides back and forth, and with Abloy Protect 2, they've got a ball bearing, and that ball bearing will move, it's captive within the key so it can't fall out and it moves side to side. And so that creates a protrusion on the key there, and that protrusion will then interact with an element in the lock, and it has to be sticking out in order to work. Now, why can't you just make that, or why does it have to move? Why can't it just be static? Well, because it won't actually fit in the lock if that happens. And we'll show a couple examples of that in a bit. So what does this protect against? Well, it protects against casting of keys, because if you cast a key, it's going to be completely static. It won't move, and so that solid cast is not going to work to operate this lock. It also provides some protection against 3D printing, because a 3D printed key, same thing. We'll talk about some ways around that, but generally 3D prints are a solid piece of material. So let's start our discussion by looking at the Abloy Protect 2. So we've got three main generations of Abloy, the classic, which was the original mainstream disc container lock. And then we added the Protek, which is a bit of a twist on disc container, really a beautiful design. And then Protek 2 came out a couple years ago and now adds that captive ball bearing element. And that element makes it a lot harder to, you know, the patent protects that element. So it means that you can't mass produce blanks for this. And so it helps with their key control in general. So this is sort of what it looks like when sliced open. So you've got the two halves of it there, and then this channel that contains that ball bearing that goes in the middle of it. And the mechanism works like this. So the ball bearing within the key is this one we can see on the left. And then there's a spring that pushes it up, and this is within the lock. And that pushes up this little shaped piece of metal here that then allows it to move within this channel. If that were not present in the key, this would fall down, and this channel would block it, and it would not open the lock. So we need to find a way with casting or 3D printing or whatever technique we're going to use to actuate that little piece of metal and allow it to go up in that channel. So sort of a naive approach is if we take a protac one that doesn't have the ball bearing and make a little slot for it to allow us to stick a lock pick in. And then we have this little tool here we made that works, and a lock pick works as well. And so if you have that channel, you can stick in a key and use a lock pick to actually actuate that and make it open. That's not the sort of thing that Abloy is all that concerned about because it's not something that you're going to be able to do as, you know, selling to consumers. Here's a blank that will work on Abloy Protac 2. We'll know you've got to also stick this lock pick in. And that video is also a bit deceptive because that was one of many takes, and that was the best one. So, you know, it takes a bit of skill to get the exact right position on it and to do it consistently every time. So, you can do it, but that is a good illustration of why when making moving elements and keys, it is a good idea to not have your moving elements be the first thing right closest to the keyhole because if there's some pins and whatnot in the way that prevent you from sticking that lock pick in around them, that would prevent this attack. Right, but that's old news. And specifically, it's three-year-old news. My brother Bobby and I, we talked about this attack amongst many other things. At DEF CON 27, we talked about duplicating restricted keys in general. And so this talk is sort of a part two of that, if you will, to talk explicitly about the moving elements because those are being sort of the industry trend right now, particularly a number of patent courts have started saying, well, you can't just patent a piece of metal. You can't patent a static shape. It must have something else to it. And this moving element is the solution that lock makers are converging on there. So it is a trend that we're seeing. Okay, so let's take a look at what we can do to actually make an Ably Protect 2 key and 3D printing is one way. So there's this really excellent library on GitHub that lets you generate a Protect 2 key to a certain code and then print one. And 3D printing keys in general they're terrible, honestly. They don't work well, right? The material's not strong. It doesn't let pins glide across them very well. 3D printing is it works for keys, but don't think you're going to 3D print your house key and use it every day. This, though, actually works pretty well. Like the nature of Ably Protect locks and disc detainers in general is there's springless designs. There's nothing dragging on anything else. 3D printing in this library does it extremely well. So kudos to them. And so I forked that and did a find and replace of everywhere that said Protect with Protect 2 and the documentation. And on this fork I've been adding everything that I've been working on that we're talking about in this talk to make Protect 2 keys 3D printable. And I do want to give a quick shout out as well to Molex Incredible Def Con 26 talk that goes much more in depth about 3D printing high security keys in the context of Noxboxes. So check that out if you're interested. So the first technique and sort of the naive approach that we're going to try with 3D printing, a key with a captive element is to just 3D print the captive element. So we'll take our 3D printable model of an Ably Protect key and we'll add a spherical hole in it. And then within that spherical hole we'll add a sphere. And so in theory this will simulate that captive ball bearing and we print it and that sphere is able to move but it's stuck within there and it will work in the lock. And not so much because the nature of 3D printing is you don't get perfect tolerances and especially with resin printing you get things if they're too close together they stick. And so trying out different spacings between that sphere and the hole that it's in if it's too close they stick together, they merge and it's just a static piece of material if it's too far the spherical ball bearing simulator falls out and it turns out there is no happy medium it's one or the other so I was not successful in getting a 3D printed captive element to work that doesn't mean you won't be but it's not as trivial as you might think. Okay so if we need a certain minimum space but we also need something to keep this sphere from falling out we could try adding a thin piece of material to hold it in and make a compliant mechanism. And so that's a nice thing with 3D printed materials is that they bend a little bit without breaking and so we try this design and so it's got that ball bearing in the right place and then just a long thin tongue holds it in place and lets it spring back and forth and it turns out that works fairly well actually. So here's what it looks like when printed. You can see that the printer really had a problem on the head it doesn't look very pretty but it works so we got this captive element and it's able to spring back and forth and simulate that key so we'll just take a look at that in operation so there it is we stick it into the lock and it works really nicely now this was again one takeout of multiple and it took a lot of like little tweaks and filing on that key because the supports add little elements and 3D printed keys they really don't work very well the first time out but it does work and so it is a cause for concern there right and so I added that to the GitHub repo as well that you're welcome to check out and print your own another thing that's worth mentioning about this you can 3D print them you can 3D print a whole bunch at once and so I gave a talk two years ago at DEF CON SAFE mode about what you can do with information theory and key codes and sort of brute forcing mechanical locks and so that's something that this allows you to do pretty effectively with something as high security as an Able to protect too now and so if we turned these keys vertical we could have fit hundreds of those on that one print bed so before we get into the big reveal of how to do it with a static piece of material let's switch gears a little bit and look at multi lock multi lock is sort of the the one that really popularized these moving elements and was I don't know if they were the very first ones to do it but they got a patent on it so if they were not there was no prior art that the patent office found not that they ever try very hard so multi lock interactive there it has these telescoping pins which was was a holdover from the previous design but it's not particularly important for what what we're doing today what's important here is that one of those pins on the key it moves and it has to move a little bit higher than the plane of the top of the blank in order to actually set that pin right so the pin looks identical the pin looks identical to all the other pins except it is shorter and that pin is too short to be actuated by anything but a key with a moving element that sticks up beyond the plane of the key alright and then we've got the moving element and the key that we can see here and in the bottom of the plug there's this little spring loaded um piece of metal that pushes up and pushes this moving element which pushes this pin up and allows the key to operate the lock so looking at sort of a cutaway version we'll ignore the pin and pin design of multi locks for now this is essentially what's happening right we've got the key protruding above the head of the key um and so let's take a quick look at a demo for that actually I'll see if we can do a courtesy zoom here right so here is an example what that lock might look like and just a blank so I'm inserting this blank in and blanks are cut as high as you can possibly cut them and notice that when the blank is inserted in this one pin here is still too low so even the blank with the highest possible cuts does not put that pin at the shear line if we add a little protrusion to the blank then it does right and so that sets that to the shear line and then of course if we add all the rest of the cuts we're now going to open that lock right so we have those cuts but here's a problem is that if I now try to take this key out of the lock well it won't fit you know this metal is getting in the way of the actual lock plug so this doesn't work you can't just add a protruding element over top of it because it is thicker than the keyhole is and so that's sort of been the conventional wisdom behind interactive elements you need this moving element to open the lock but you need it to move back to the other position to insert and remove the key right and so so that's what's happening in multi-lock we've got the moving element is able to move up and down when it's pushed up by that little spring-loaded element inside the core and that lifts this key or that pin to the shear line okay here's the big reveal and it's so stupidly simple I, someone else has got to have thought of this before but I'm the first one that has published about it that I can find here's the big reveal to avoid that problem we just take a bit of metal off the back of the key that's all it takes and with that we can move the entire key and so now it fits in and we move the whole key we angle it up a little bit and it sets that pin to the correct height and again like it's so simple there's, I can't be the first person who's thought about this but I couldn't find anyone else that's published on it and lock makers are putting out designs as if this as if they haven't thought of it either so we're getting it out there now and this is something to start thinking about when doing new iterations on lock designs right so to actually fabricate this we talked about how you can do the regular cuts on a multi lock on a drill press right so you can check out that talk if you're interested right so we can add the cuts but then we have to add this element protruding out as well so what can we do about that well we'll start with a classic key blank and so those you know that gives us the overall shape it gives us everything we need except that element protruding out one thing is the classic key blanks are ludicrously expensive you know seven dollars a blank that's not something that we want to be spending so we go to our old friend AliExpress and this is if you search for multi lock key blank on AliExpress you're not going to find this it's just a very generic name key tool, home door key blanks, locksmith supplies, blank keys but I was browsing around looking for other things and happened to stumble upon this and I'm like, huh that looks a lot like a multi lock and so I ordered some and it turns out they actually work perfectly they actually got extra metal taken away so they fit in a number of different sections of multi lock locks okay so we take this not nearly as expensive key blank and when we insert it into the lock we'll see that this pin here is too low it doesn't have that element protruding out and to fix that I'm just going to shave away a bunch of metal on the pin side of the key except for that one place right and so I'm leaving now a little bit poking out in that one part of the key that's got to be poking out to actually that element and shaving away the back right and so now the entire key is able to move within the lock right so you can see that the whole key can bounce back and forth and the pins are too low when it's in the position that'll allow it to insert but that that moving pin that pin that's too short does get set when it's pushed up right you'll notice it's a little bit lower than the others it is still within tolerance and it does open that lock alright so then we have to add the cuts to it right and so if we're doing that we just got to put a little piece of metal to shim the back of the key and it doesn't move up too shallow this happens to be on an actual multi lock machine but you can do it on the drill press as well right and so we add this cut these cuts to our surrogate key and now we have one that will actually work right so you can see on the side all of those bidding cuts there and then the little element that's sticking out beyond the top plane of that key and it doesn't work perfectly and you have to know to move it when you insert it right so it's a little bit of a back and forth but it works well enough right like this if my house key were a multi lock I would be perfectly fine using this every day right so that is a bit of a problem something that's worth dealing with multi lock interactive is long since out of patent so it's not stopping anyone from manufacturing key blanks that have that moving element no one has that I've been able to find but a bit less of a concern because it's out of patent so you can go print your own so I polished all of this on my github as well as some elements that you can use with JSCAD so it's a javascript version of the OpenSCAD and so you can play around with it and do it entirely within your web browser as well right so I was mentioning patents patents last 20 years and so this is why we see these many generations of these major lock designs that we see out there right so with multi lock the classic came out in 1977 and then in 1994 the patent was getting close to expiring and they released the interactive to keep that in patent and allow them to maintain control over their key control alright and then in 2007 another almost 20 years later they released the MT5 same thing they're changing up how that moving element is done to a spring instead of a solid element and that's primarily done to keep things in patent and maintain legal enforcement ability over their key control alright so let's take a look at how we can apply this to the multi lock MT5 alright so the MT5 works similarly to the others except it has this spring in the tip of the key and it's in the center not collinear with the rest of the cut so the pin for it has to be this funny little thing that's got a little secondary pin stuck to it over the side it's an interesting looking pin and I shuttered to think the expense at which they manufacture that but they do and so we've got to push this pin up by having a protrusion on the top of our key so we do the same thing right we add that protrusion just with an open SCAD which is the software that this was created in just a cylinder and you rotate it and position it correctly and union it with the rest of the key and then we just knock off the back of that key so that it has space to fit in the lock and that will work for us it is worth noting that the MT5 has a variation called MT5 plus that has a track to it so it's also got a slider track and so we just have to add that to the back of the key as well but nothing about this technique prevents us from doing that so here's one that's 3D printed and we can see a protrusion at the end of the key and then on the backside we've got that slider track printed as well so in one place it's actually so thin that there's no material in between them but that's okay, the rest of the key supports it just fine and so it operates it just fine there so we can see this protrusion from the 3D print sticking out there so when we insert this into a lock we're now it's at the end rather than the base of the key that's moving as I tilt it back and forth this pin here at the far end is bouncing up and down and so I am successfully setting that pin that should be set by the moving element as well so you can print your own of these as well at the same URLs and try it out for yourself so now that we've got both interactive and MT5 and MT5 is still in patent so this is something that they would be potentially concerned with I reached out to them so part of the responsible process of discovering this sort of thing is you reach out to the manufacturers and let them know in advance of publishing it and give them a chance to fix things or at least respond and be prepared for it so I reached out and the response crickets so I sent multiple emails to their online forums I even reached out to some people I knew and I just could not get on the phone with the right person so if you happen to be watching this video on YouTube after or in the audience and you're from Multilock and you are the right person please reach out to me I would love to work with you to help mitigate this and there are mitigations available which I'll talk about at the end so hopefully we can see that happen now that this is actually being released but it does give attackers a bit of a head start now alright let's talk about Ablai so we talked about that a bit at the first first part of this presentation we're going to come back to it it's a bit more complicated geometry which is why I covered Multilock first alright so we've got the disc detainer cuts are a bit more complicated we have to treat those with a little bit more care when we're removing the metal from the backside of it but otherwise the process is pretty similar right so we've got in OpenSCAD which is this really awesome software that does this and you'll see why in a second we add a sphere to it which adds that element that's sticking out and we've got to remove material from the back of the key so it will actually insert and fit within that lock now we can't just chop it off the way we did with the Multilock because this is a disc detainer and it has to be able to interact on both sides of the key with the material so what we can do is draw a second one alright so I'm just doing Ablai Protect 2 twice and then I'm rotating it so in this case I'm rotating it by 2 degrees in the y-axis so you can see here that this is two keys that are rotated and one of the beauty of this software is that I can take the intersection of those two and so there's the intersection and so that pretty perfectly chops off metal from the back in exactly the way that I need that to happen in order for it to actually fit into the lock right and so you can see I'm doing this in the code drawing one Ablai Protect 2 and another that's rotated and just taking the intersection of the two alright so this is what it looks like when 3D printed and we can take a look at it in operation alright so there's the key with the element... there's the key with the element poking out and you can see when I turn it it's thinner at the base of the key I insert it in and I push it to the left and then I quickly defeat that element detecting the moving element and then after a bit of wiggling I turn the discs as well and get those all to set in the sidebar to go in so this works now with Ablai Protect 2 and it allows you to 3D print not just with a compliant mechanism but also a completely static mechanism and so that's not just 3D printing that that interacts with but also you can make this out of metal right so we can now make a metal key that will work for Protect 2 so again something that we want to potentially mitigate if there's a good way to do it so I reached out to Ablai with the same process and Sponts Crickets so same deal if you are with Ablai and you are the correct person to talk to about this please reach out to me I would love to work with you to help get this mitigated let's talk about Medico right so when we started this work right Medico did not have any keys with moving elements he had the classic and the biaxial and the M3 just added a slider there but soon after we were starting this work they announced the M4 and so the M4 has this sidebar with finger pins that get set as well as a moving element okay so this is a pretty good opportunity right we now have a lock that is not yet out to the public and we've got a potential vulnerability with it and so we've got an opportunity to actually get this vulnerability fixed before it's released that's pretty awesome right so how does the moving element work within Medico well we've got this the moving element for that the M4 is called a shuttle pin and it interacts with one of these finger pins called the lift pin and that lift pin just doesn't have a protrusion deep enough for anything else in this sidebar track to operate it and so the shuttle pin has to be sticking out in order to interact with that lift pin right and so reached out to Medico with now this potential vulnerability of course untested because we didn't have an M4 to test with at that point because it wasn't released yet and said hey let's see if we can talk about this and so the vendor response was actually incredible they got back the same day and they emailed me and then I got a phone call and you know this is like the day before New Year's and the guy that reached out to me his name is on many of their patents so they took it quite seriously and actually reached out promptly and were very responsive with that so this is a good response right and so we had a number of calls with them we discussed the technique and made sure they understood how it might potentially operate on the Medico M4 and Medico's team tried it without success right and so it's now our turn to try it but before we were able to do that before they were able to send us any information or even a lock about about the M4 so we could try it out we had to deal with the NDA process right so I'm sure most people in this room are familiar with that and that's something that when you're a hacker that discovers something and you're requested to do this it's kind of a big decision right and so we took this to our legal team and they looked at it and said like NDAs in general are fine the problem is when it's you, the little guy in a contract with a giant conglomeration like ASSA Abloy Group even if you are totally legally in the right they can put hundreds of thousands of dollars after lawyers to just make the process drag out and bankrupt you on the legal process so that was one of the warnings that we got and based on honestly it was pretty heavily based on how responsive and reasonable the gentleman from Medical we've been talking to had been, his name is Clyde Roberson by the way he was responsive and reasonable and we decided to take a leap of faith and do it solely based on his demeanor and our read on the situation based on that but do beware before you sign these the other important thing to keep in mind is make sure you read it and if you can make sure you send it to someone with some legal expertise to get it reviewed right so we've worked with NDAs loads of times before and we know what's standard and we noticed one paragraph in there that wasn't completely standard so foreground intellectual property is within a contract it is intellectual property that's generated as a part of that contract and this was an NDA it's supposed to be non-disclosure it's also said well by the way anything that you or us develop as part of this communication we now own so we being the ASA Abla group and so we looked at this and we're like we don't want to do this we want the NDA to be about non-disclosure and not intellectual property ownership as we got back to them about that and said we got a concern with this paragraph the response was okay here's a new version that paragraph deleted and this is actually pretty standard with NDAs right if you don't like an NDA that someone sends you you express your concerns and companies are usually very happy to modify it for you and so that happened here and it worked out quite well right so we're all signed we're good to go we're NDA and we can now actually test this thing right and so Clyde got a sent a couple of the M4 locks right some of the early production versions and we were able to actually start testing this and see if we could find a way to make this new method work with the M4 so attempt number one we took a Schlage SC9 blank and when you file off enough metal on it it will fit into that M4 key way and we also press fit in a piece of metal to have it stick out on the other side right so it's sticking out here and that's simulating the static component of where that shuttle pin would be moving out the problem with this is the sidebar and these finger pins here which is that the entire key has to move right so the entire key has to move to insert it and then to actually actually that interactive component or not interactive that's the multi lock term that moving component which medical calls the lift pin and we also need to have these standard finger pins riding along this sidebar here and what happens is when you move it to the side to insert it the finger pins are all now down here and they're spring loaded and so those finger pins act like a ratchet mechanism and it prevents you from actually moving the key over and actuating that okay so that doesn't work so we need a way to get those finger pins lifted to the correct height and give them a little ramp to do that and our solution was to create individual ramps right so we added this these channels here and so now we have a ramp for the first the second and the third finger pin individually and so now we can get all of those lifted up to the correct height right so that's oh there we are that's a bit of a close up there and so we can see this in operation and it works fairly nicely right so it's interacting with those finger pins and pushing them up to the correct height meanwhile the protrusion we press fit in is pushing the lift pin up to the correct height the problem is the old problem with with keys with moving elements it will not insert or remove from the lock right so this protruding element it just is binding with these finger pins right so it fits in the keyway just fine but now these finger pins are in the way and we could make it thinner on the backside and mitigate it that way but there's just no more metal to remove this thing was paper thin already so because of the particular shape of the M4 keyway we couldn't make that happen if the keyway were ever widened right and so this is a bit of wisdom with the M3 that did have the keyway widened from from biaxial if the M5 has a wider keyway this attack will start to work so it's now something that they can be aware of which is good the other element is that corallity matters with this and so for anyone who's ever tried to pick a medico before you know that if you tension it one direction the top pins bind first if you tension it in the other direction the sidebar binds first and what was happening with using this technique is that when we inserted this surrogate key the direction we had to twist it to move it in and cause this lift pin to actuate is actually the direction that causes the sidebar to bind hard against these finger pins so we're now trying to turn it in a way that will set that finger pin while we're binding the sidebar hard against it it made it not really a viable attack for that reason as well okay so let's look at what we pivoted to when those didn't work we started to think out of the box a little bit and looking at the actual design of the lock this is the lift pin and there's this element here that can be pushed down and it's within the plane of where that key would insert without a moving element sticking out it's just it has to get pushed down deeper than the plane of the cores milling there so we need an overhang on our key to cause that to happen and so to make one we took pieces of metal and bent it so we have this little J shape and that allows us to create an overhang and then we added this little little peak to it and so that peak, the finger pins are able to ride over that peak just fine but it can push in and hit that little part and push it down to get the finger pin to the correct height and it works badly, it honestly doesn't work very well it's like you got to try it a bunch of times and two times out of ten you're able to get it to work and it's got to get perfectly positioned but it does in theory allow a blank to be mass produced that might not work great but does work so it's something that's potentially worth mitigating and this last element we just sort of had a stroke of the idea there fairly recently so this was only presented to medical fairly recently and so they're still in the process of deciding if and whether they're going to mitigate it the mitigation is fairly straightforward you just deepen this or possibly add sort of a bowl concave cut to it to prevent that from working and currently the responses are towards doing the mitigation but it requires tooling changes and things are further along the production schedule now so it is something that takes a bit of time to figure out so there's a good outcome here so we've got a not a great attack but it's something that they're still likely going to mitigate there for the actual fabrication and I've talked a little bit about how you don't want to have a stockmaker's perspective they really don't want something that anyone can make so like those ones that you could buy on AliExpress they don't want that happening for their own keys and so to make it yourself if you can't have one that anyone can make 3D printing is one option these are the two main types of printers filament printers are just not detailed enough for printing most keys when we do it we print the blank and then add the cuts using traditional methods but resin 3D printing is absolutely the way to go for making keys it gives you 10 times better resolution for making it out of metal so in this case adding that J-shape we were able to do with just a little clamp except we had to give the clamp some help with the hydraulic prints so these fabrication techniques are not necessarily something that everyone has the ability to do when adding the cuts to it because these blanks are imperfect they come out of the clamp and bend nastily and you also would need a machine that's capable of adding these top cuts which not everyone has have to do all jump through all sorts of hoops doing it so when adding the cuts to this particular version we had to put three keys together one to prevent this clamp from pushing in the press fit element and misplacing it and another to give support on the bottom side because this blank was paper thin at this point you know so it's not a trivial process and then we had to mill out a little bit at the end to allow it to insert all the way and have the tip tip warning not be a problem for it so in general these fabrications are something that you can do if you're a major lock and keener like us and have all this equipment a lot of people don't it's the sort of thing that lock makers are considering when they're deciding whether to mitigate is what is the effort required to carry out this attack and patents are effective against mass production against someone in China going and making a version that does work in China you can't really control that with a manufacturer but you can at least control it on the import side and you can certainly stop someone doing that domestically so one of their key concerns with key control here was that any attack we were able to successfully do did not allow someone to make this key in a way that bypassed the patent so a valid consideration there we'll chat a little bit briefly about some alternative attacks so things that people should consider before they're worried about this and then some defenses available to you as well so one is this is one of the gates of the New York City subway station and they've got two locks here you'll notice security medico with great key control on it one is a Yale and so Yale locks the keys are not at all controlled and it's also this which most people in this room will have heard of is this the same thing for everything in that in New York City and people are getting it so it's something that you gotta make sure that you're not gonna be doing something like that if you're worrying too hard about the key control for one of your two locks you can also attack the the code card and so in this case what we've done is taken a multi lock interactive code card and it's just got the code stamped onto it and so we've just re stamped it so on the original this 264S is the key way and we've changed it to 200S and so in this case you can see that little artifact there we didn't do it great but up here you take that to a locksmith he's not gonna know that it's been modified or anything on this and get a code card that authorizes a locksmith to create an entirely new key for us and of course the blanks are once they're out of patent they're not necessarily as easy to control the sale of so you can buy these blanks on eBay and so these are two of the ones that we bought and there's actually a bit of a story with this one up top here which is that when we received this it had one side for a locksmith that was actually local to us a locksmith that we knew and they were in business still cutting multi locks and so I reached out to them and I said guys I just bought keys on eBay coined with your business is this right? there's a bunch of things about this that don't add up they got back to me that very same day and said yeah this is not right there's clearly a problem here and so I've blacked this out to not dox them they're an honest business trying to do standard locksmithing and they don't want to deal with all of this crap that us in the hacker community get up to but yeah so we reached out to them and they did some investigation and it turned out that three years before they had a package arrived by Courier with more blanks in it and the package was manifested for 25 pounds and the delivery driver said something's wrong here and it turns out at some point they don't know when or how those keys got stolen out of the box in transit so talk about a supply chain vulnerability there so they reported it to multi lock and then when I reached out they were able to recover 9 out of 10 of the stolen boxes from the seller on eBay that was just selling all 10 of the stolen boxes and so when you happen upon stolen property there's no compensation owed to you for that belongs to them but they insisted on compensating us and so I eventually gave into that but you know that's something to be wary of when buying stuff on eBay that might potentially come from less than up-rate sources so what can we do to defend against this well the first one and one of the first ones we thought of is take the moving element put another one beside it and have it go the opposite direction and the key is actually widening and so that prevents us from moving the entire key because it's getting wider right so that's one option available to us multi lock actually has already two moving elements this isn't for that purpose it's just so you can insert the key in either direction and it's going to work but that's something that potentially could be modified to apply this attack for there's a reason it can't and I've got a nice shiny new set of medical bump keys for the first person after this talk to think of what that trivial work around is and if you're watching this talk on YouTube afterwards put it in the comments and I might send something your way so that's one option another is these sidebars this secondary locking element itself prevents motion of the entire key because it interferes with the operation of the secondary element so far as it turns out is a great example of a good defense against this particular technique right the one that actually was valid used a completely separate and happenstance vulnerability in the lock right so the multi lock MT5 would have that defense available to them with the finger pin line on the bottom except that those finger pins are not spring loaded which means that I can insert the key in one position and set all the finger pins at the bottom and then set the top pins on top and there's no spring to spring the finger pins back and frustrate me there right so the mitigation here is pretty simple just add a spring behind even just one of these and that's going to prevent this attack from working right so a mitigation that's available there to you and you know if you happen to have MT5s you can even do this yourself right get a little tiny spring and stick that in behind that pin you'll have to drill it out a bit for as well so so there are options available to you and the last thing is to defend against this you don't want to be laser focused on the wrong thing you need to make sure that there's no other glaring problems in your facility before you're worried about something as niche as this right so here's I'm sticking a key in key turns I open the door right well that's the wrong key that that key is not turning in the lock the entire lock is turning in the door and that's because there's a retaining pin that's supposed to hold that lock in from doing that that has not been properly installed there we see crap like that all the time in facilities and so you really want to make sure if you are running a facility that you get all of that looked at and fixed before you're worried about extremely niche attacks like what I've just talked about now so with that I'd like to thank everyone for listening if you have any questions I'm going to be running the physical security village in 202 right after this so please come find me there and I'm happy to take them there thank you very much folks