So, now to our next talk. Lockpicking has been connected to hacking for quite a long time. For example, I picked my first lock four years ago at the OHM 2013 here in the Netherlands. And it was quite fun. There were a huge group of people interested in lockpicking. But interestingly enough, I've never really heard a talk about lockpicking, especially about the darker side of lockpicking, about the attacks that you can do. Our next speaker has been a black hat locksmith for some time in the past in his life. Now he changed. Now he helps companies figure out where there are the holes in their systems. He claims there's no lock that can't be picked. He claims there's no side that is completely secure. So now he's going to tell us a bit about the darker side of lockpicking. Please welcome to the stage Huxley Pick. Thank you. Okay, welcome to black hat locksmithing. So before we start, everyone knows the difference between a black hat and a white hat, don't we? Yeah, just in case you don't. A black hat is someone who uses their skills to steal and be generally naughty. And a white hat is someone who uses them to protect and to help people. And this is the black hat variety. The obligatory waffle about me first. I'm Matt Smith, otherwise known as Huxley Pick from Off of the Internets. My first love of security subversion came with social engineering. So very often this involves making things like this, amongst other things, and getting into big sporting events and music festivals and hacking events, that sort of thing. And never worked for Oxman, just in case you were wondering. Then it was more about IT security when I was a software developer and scarter systems engineer. And about 13 years ago, I got into lockpicking, which turned into locksmithing, which turned into tool making. And now I make very specific tools to open very high security locks. The picture we can see here, this is lockfall towers, this is where all the magic happens. It's actually my cellar. It is my cellar, not my parents, just in case. And I like to look for things called physical odays, what I call physical odays at least. And that's exactly what it sounds like. So it's an undisclosed vulnerability in a physical locking system that no one knows about yet, so the public or the vendor. That's enough about me. So on locksmiths the good guys, not always. I'm going to go through some examples of thieves and prison breaks and some secret locks, some secret tools. I'm going to show you some stuff that I've not released before, but this is all my work. So I'm not going to show you practically how to steal things. That'd be irresponsible. And I'm not going to be showing anyone else's tools or techniques. Anything I show today has been on the internet at some time, if not anymore. So locks or security devices, they exist to stop people breaking into your house, stealing your car, stealing your bike. So if you had nefarious intent, you'd be really, really interested in getting through these things. And it brings us to the age-old adage that locks only keep honest people out, which by and large is very true. If someone wants to get through your lock badly enough, then they're going to do it. This is an example of a very old lock. This is 4000 BC. It's an Egyptian lock. Now we changed the design of this lock at some point. We still don't use wooden locks today. So I think it's fair to assume that this wasn't the most secure lock in the world. And so I think it's also fair to say that these were picked and blackout locksmiths have been around ever since locks have been around. So what motivations might someone have for picking a lock that doesn't belong to them? Any ideas? Anyone? Money! Theft! Yeah, treasure, of course. Built the money. Other motivations? Freedom? By this, I mean escape from captivity, not overthrowing your oppressive English overlords. Of course. These guys, the alphabet soup authorities, so the KGB, the CIA, you know the ones. These guys have been into lock picking ever since they've existed. And these guys have got lots and lots of public money to spend. Very often their tools are the most amazing, intricate works of art. But because of their very nature, we very rarely get to see them, which is a real shame, I think. They have enough money to use the very best manufacturing techniques, the very best materials, so they should be good. Later, I'm going to be showing you a couple of the stars' declassified tools. Well, I'd say declassified. The stars, you don't exist anymore, of course. But it gives you a useful insight into where the secret world of lock picking was 30 plus years ago, and it's quite scary. So if these guys are going to want to get through your lock, they're going to want to do it in one of two different ways, surreptitious or covert. So covert is when the lock's been picked. But if you remove the lock and take it to a forensic locksmith, they can look at it under a microscope, and there will be telltale scratches and signs that tell the forensic locksmith exactly how that lock was opened. Surreptitious, on the other hand. This is like the holy grail of entry for these guys. It leaves no trace at all. It's as if you've used the key. No one would ever know. And they love tools that do this. And it brings into question, what are these guys anyway?  It depends on your nationality, I guess, or your political motivations. It's a very hard line to define in this case. I can attest to this. A lot of lock pickers do it just for the challenge. It's like a mechanical puzzle. And there are always harder locks to try yourself against. So it never gets boring, which is good. And somebody's always going to have some crazy motivation for picking a lock that doesn't belong to them. We all know what one of these is, all right? Look at the teeth on that. OK, so first up, to say confession is good for the soul. And a long time ago, in a former life, this is my confession, at least, I had a penchant for taking money from vending machines. Now, I saw this as very low-hanging fruit. It almost seemed too good to be true that there was this big box of money behind this lock, very often unguarded. But my career as a vending machine bandit didn't last long. It soon, to me, became about the challenge of opening the locks, which turned into locksmithing and so forth. So my hat was changed, just like that. Now, I shouldn't have to say this. Standard disclaimer, don't steal from vending machines. Don't steal. Full stop. And just to reinforce this, there was a guy in the UK a couple of years ago. He was stealing from the parking meters, we can see here. Now, he wasn't picking the locks, he was forcing the locks, but he was definitely stealing the money. And he got arrested, he got convicted. Got a five-year suspended sentence, but in a first of its kind in the UK, he got an injunction banning him from going anywhere near any coin-operated machines. No. This came with strings attached. So if he wanted to go on holiday and he had to drive his car to an airport, then he could use the parking machine, but for a maximum of 30 seconds, and he couldn't return to the parking machine for a minimum of four hours. This could make life very difficult. So don't let it be a... So let's have a look at some lock-picking thieves. Lock-picking theft brings with it a set of unique issues that you don't really get with other theft. We can say that the vast majority of thefts are forced entry, that's a fact. But the exact number that are done by lock-picking methods, it's kind of fuzzy. This three to six percent, I think I checked maybe seven or eight different police forces. Certain police forces say snapping, for instance, is a lock-smithing technique, or they say it's destructive entry. So this number is really hard to pin down, and there are other reasons why it's hard to pin down as well, which I'm going to go into. So the very nature of lock-picking means that there's no obvious sign. Like I spoke about earlier, you can find signs if you look at it under a microscope, but ostensibly to the layman, you probably have to do it on lockdown, they have the key. Lock-picking is going to feature very low down the list of potential reasons for your house getting burgled, and that's going to keep this number down. The amount of locks that get forensically examined is tiny, tiny. It only happens in the most high profile of cases. So if your shed gets robbed or your house, chances are the police aren't going to spend a lot of money forensically examining that lock, so it's going to go unnoticed. There's also insurance issues. So if you come home and you see that your door is open, everything has been stolen, you don't know what's happened, and people always tell you in this case, smash a window or kick the door in so that the insurance company don't try and worm out of the claim, because that's what they will do. They'll say you must have been negligent with your keys, left them under the mat, or maybe you just left the locks unlocked. Your fault. And again, that's going to keep this number down. Every time that plays out, that's going to keep this number down. You also get skimming, so let's go for a hypothetical here. Let's say there was a thief that could pick some parking meters near his house, and let's say that instead of emptying that parking meter at the end of a very busy day, what if that thief just takes maybe 5% out of every meter and locks it back up? Very often, this can go unnoticed for years. It can fly completely under the radar sometimes. Sometimes it never gets noticed. I can guarantee you. And again, it's a hypothetical. It's a hypothetical. And that's going to keep this number down again if no one notices. And let's say you're the manager of this parking company. You know that the locks have been picked. You know that they've been opened. You know that they've been locked back up again. And you know that the money's been going missing. So your first port of call is going to be someone with a key or maybe someone who had access to the key and copied it. Again, lock picking probably isn't even going to enter the heads. It's going to keep this number down. But I do want to caveat this by saying, again, most thefts are forced entry, so don't worry too much. Lock picking is rare, I don't think it's quite as rare as it's made out. So this is our first lock picking thief. Deacon Brody, this guy was from Edinburgh. His florewit was in the late to middle 18th century. Apparently Robert Lewis Stevenson based his character Dr. Jekyll and Mr. Hyde off this guy. Because by day, Deacon Brody was a pillar of the community. This guy used to organise church fates. He was a town counsellor. He used to bless babies. You know everyone loved this guy. But by night, Deacon Brody changed completely. And he was also a talented locksmith. So his high status in society and the fact he was a locksmith got him jobs servicing and installing locks on rich people's houses. So Brody's favourite trick was before he'd install the lock, very simple, he'd take a key, make a copy, and then at some convenient point in the future, he'd go and rob the house. If he didn't already have a key, he'd use a method of impressioning. So pretty much exclusively, he'd have been up against what we call warded locks. Now this is old technology now. It's not really employed anymore. But how he'd get through it, is he'd take a blank like this one here, or these ones here. These are actually his tools. So he'd take a blank, and he'd put an impressionable material on the side of it, either wax or soot, introduce it into the lock, and turn it. Now it wouldn't open because it was a blank, but when it stopped, it'd leave an impression on the soot or the wax. And when he removed the key, he'd be able to see where he needed to file material away in order to make that key work. This is where we get the term skeleton keys from. So you've removed as much meat as you can off the key, and you've just left the bare bones skeleton keys. Another one of Brody's favourite tricks, this is crafty. You'd often carry a blob of putty in his pocket, and he'd walk around Edinburgh Town City Centre. He'd go into local merchant shops, make idle chit chat, talk about the way that are nothing important. But if an opportune moment arose, he'd take a key, and he'd squish it into his blob of putty, and put it back before he was noticed. And again, he'd go home, he'd make a copy, and rob it at a convenient point in the future. He was quite successful as a criminal, in my opinion. One of his highlights was he stole £800. Again, it was his favourite trick. It was from a bank. He installed the locks, so he had a key. This must have been the easiest bank heist of all time. He'd just let himself in, let himself out with the money. He needed a lot of money, because Deacon Brody lost a lot of money on cock fighting. He had a wife, he had two mistresses, six children. So he was a very busy boy, and he was already wealthy. His dad had left him a lot of money, and they're inheritance. Another highlight was he stole the ceremonial mace from Edinburgh University. This isn't the mace. The mace was never recovered. This is just something that it might have looked like. It's a ceremonial mace. That's not Deacon Brody either. I like to think that this mace is right now sitting in someone's living room in Edinburgh, maybe being used as an ashtray or something. It has to be somewhere. Now, things started to unravel for Brody when his gang tried to burgle the revenues of Scotland. So what this means? Back in those days, money wasn't electronic. Of course, it was all physical coins and notes. And this was the building where all the tax of Scotland was kept. So this was an obscene amount of money. But it went wrong. He only stole £16. But later on, maybe two months down the line, a couple of his gang got arrested for different things. Brody didn't know what they'd been arrested for, so he assumed it was for the bungled heist. Now, as it happens, the two guys never breathed a word to the police about Brody that he didn't know. And so he fled the country, and that did bring suspicion upon him. So he was eventually found here in the Netherlands hiding in a cupboard. And he was brought back to Edinburgh and hanged in front of 40,000 people. But it's not all bad. He has a couple of pubs and a cafe named after him. This is his legacy. I love this guy. Okay, the phone ranger. James Clark, this is the best picture I could find of him.  At some point during his career, he decided he was going to stop making tools. Instead, he was going to rob from pay phones. Specifically, he stole from the Western Electric pay phones, which were all over America at the time, literally all over America. He often used James Bell as a pseudonym when he checked into CD motels as a way of giving the finger to the phone company. And he was eventually arrested in 1988 in his caravan where he went quietly. Now, these are the pay phones he was robbing from. This is where the money lives. The lock is on the side, and this is the lock here. We're going to have a closer look at this lock. This guy was the only man who ever picked this lock up to this point in time, or the only man who has ever been publicly acknowledged with picking the lock. Now, what makes this lock so secure? Ohio Bell spent a million dollars in the 70s developing this lock, which by 70s standards was a lot of money. This was the days of the $6 million man. $4 million is like his leg, his head maybe. It's the peak of technology. It has a very paracentric key way. What that means is you see these jaggedy teeth. So if you try to pick this lock, you need to maneuver with your pick around these wards, and that makes it difficult. It has eight levers, all of which have false gates, which again makes lock picking harder. There's a common spring. So in most lever locks, each lever has its own spring. This just has one. So what this does, if you lift one lever high, that holds the spring up, and all the other levers no longer have any spring tension on them, so they just flap around sort of uselessly. It makes it difficult to pick the lock. But that's not what makes this lock secure. Other locks have these features. What makes this lock particularly secure is the lever grabber. So that's this big silver thing. So on this side, we can see a locked lock, and on this side, we can see it's been unlocked. And what's happened is this C-shaped stump has gone into the hole here. But more than that, this lever grabber has engaged, and you can see it sort of meshed with the levers, and that stops the levers moving. It makes them immobile. So normal lock picking theory would tell us that we push this C-shaped thing against the levers, and that creates friction, and then the lock picker moves the levers, and it's that friction that tells the lock picker what's going on. That can never happen in this lock, because by the time this gets to here, this is engaged. And so you can put pressure on the levers, but you can never move them. Very difficult lock to pick. It shows you what an achievement it was that this guy could pick this lock. Over seven years, he stole from 32 of America's 50 states. He used to travel up and down into state 40, east to west, east to west, branching off to different towns to steal money. He got high profile. He was on America's most wanted twice, and there was a $25,000 reward on his head for capture. Now, like I say, this guy was the only man ever credited with picking this lock.  But frustratingly, we don't know what his tool looks like. The Feds, obviously, never released pictures of it. And there's no reason to think Clark isn't taking that secret to the grave. He might be dead already, I don't know. He'd be 79 now, and he's never told anyone. I've heard different reports saying it was quite sophisticated, and other reports saying it was made from piano wire and quite simple. I think it was probably quite simple. All the best tools are the simple tools. He earned, no one really knows, varies from between $400,000 to over $1 million, which is $57,000 to $147,000 a year, which is a pretty good earning and change. So if we say he stole, if we're generous and say he stole $1 million, and that the most common coin in U.S. pay phones is the quarter, that's $4 million quarters. Which looks like this. That's... Where do you keep all that? He eventually got caught tampering with pay phones. He got three consecutive one-year terms, so he did three years in total. More amusing than that. He was ordered to repay $802.50, don't forget the 50 cents, back to Ohio Bell. So if we say it cost Ohio Bell a million dollars to develop this lock, then this is a slap in the face. Ironically, modern pay phone locks in America are less secure than the lock I've just shown you. Now, they're not bad locks by any stretch of the imagination, but they're less secure than that one. If you wanted to be a pay phone thief in America now, it would be easier than back then. Let's just say that. Now, for years, I didn't make any progress at all with this lock. For years, I've been trying to emulate this guy, and I've got an example of it here. But recently, I made a bit of a breakthrough. So this is the lock in sort of half-open position. We can see they're at the right height, and this C-shape is entering into the gap. So I've found that you can overlift one of the levers higher than it should ever go. So this is one of the levers that's gone too high, and this little pointy bit on the end of the lever, is a little bit too high. You can see it keeps this grabber pushed back, which then leaves you seven other levers to pick unimpeded, which is still no easy task, but there's light at the end of the tunnel. This actually led to a better technique where I don't have to overlift anything, and as soon as I pick the lock, I'll be the first to let the world know, believe me. Was this how Clark was doing either of the two methods? Was this how Clark was doing it? We can never know. Let's have a look at some prison escapies. We like prison escapes. I love this. I love the way that the guards are just standing there taking pictures, and... This guy looks in quite a lot of pain. Look at this. So this guy wasn't a lock picker, I guess. These are all tools that have been confiscated from an American penitentiary. I love this. It attests to the ingenuity of man. When times are hard, they don't make the most creative things. We can see lock picks here made from knives, spoons, buttons, wire. I don't even know what this stuff is. Pretty cool stuff. This is the story of a Finnish borestall break. This is the Abloy Classic lock. It's a very, very secure lock. It stood the test of time. It's now been around for 110 years. So it's a good lock. But these lads in the Finnish borestall, they managed to escape. They went joyriding. They came back. They did some donuts around the car park of the prison. And then they let themselves back in. Now, the guards assumed that they must have had a key. And they did have a key. But they were never given access to any of the keys at any time. They were never given time alone with a key to copy one. So how did they copy the keys? It's fantastically simple. Pencils. This involves a method that we call sight reading. So if we look at the key again, we can see that instead of up and down cuts, like you get on a normal key, this has 18-degree angles. So you can get quite good at just looking at this key and going out, that's a 2, 1, 0, 5, et cetera. And that's what they were doing. They visually look at the key as the guard used it and make a copy from a pencil. Very good. This is what they use in the USA. So these are called moguls. You can see it's just like a normal lock, but maybe twice the size. I heard that the theory behind making these big locks was that the inmates would have to, therefore, make bigger lock picks, and therefore they'd be more easy to be spotted, which sounds like nonsense. I think being America, it was probably more a case of, being more secure than a lock. A bigger lock! Of course. Can you still pick them? Of course you can still pick them. They are very difficult to pick, but you can still do it. And these are normal tools, by the way. These aren't massive tools, they're just normal lock picks. This is the story of Mr. Doody from 1812. This isn't a real picture of him. So this guy, he was from Wolverhampton in the United Kingdom, and he invented a lock that used the secret principle. So all that means is there was a certain secret to opening the lock, either a hidden keyhole or maybe a hidden button. But as soon as you know the secret, you can open that lock. So this is otherwise known as security through obscurity. And it can work very well on the small scale. If you only have maybe one or two locks in one or two different towns, then no one knows the secret. It becomes a problem when they're mass manufactured using this principle, because, again, as soon as you know the secret, you know the secret to all the other locks. So this guy, he serviced the locks on Stafford Jail, which was useful because he got locked up in the same jail several years later. So, of course, he picked his way out. But he was worried that his family would get in trouble, or maybe he would get a longer sentence if he was caught while on the run, which he probably would have. So he picked his way back in. The story goes that he was sitting in his cell when the guard came round to the roll call in the morning like nothing had happened. And we can't talk about prison escapees without talking about this guy. We're going to come into the present time after this. Don't worry, it's not a complete history lesson. But Jack Shepard is responsible for... Well, we can thank this guy for many subsequent prison escapes, and you'll see why soon. He was only 22 when he was hanged. So, and you can see this guy was only a small man. And yet he was renowned for breaking through strong room doors, for breaking through solid oak floor, but walls, he was good at breaking through walls. He was a lockpicker, pickpocket, vagabond, ruffian, general scoundrel. This guy did everything. Gentleman Jack, as he was known, he escaped from prison four times. Each time he was sentenced to death. But his first escape was my favorite. So, he escaped by wiggling the iron bar on the window, and he used this iron bar to break through the floorboard. Then he broke through two walls. Then he found himself at a high window. And he couldn't get down from the high window without injuring himself. So, can anyone guess what he did? How did he get down from the high window? This is the first example I can find of this ever happening. Yeah, of course. After his cell, he tore strips off his bedsheets, made it into a rope. Jack the lad, as he was also known, his second prison escape was dubbed the sexiest prison escape of all time. Now, this is because he was locked up with his mistress, Edweth Bess. She was a local prostitute. And the guards had learned they didn't leave any bedsheets for Jack to pull the same trick. And yet he pulled the same trick. So, can anyone guess where he got the material from this? Yeah, from Bess. This was in a local newspaper. It's an artist's depiction. This is a lot more modest than I believe it was. She was pretty much naked, in reality. Now, the idea was he was going to tie the rope to one of the bars in the window. But unfortunately, Bess was a little too big to get through the gap. And so, he had to take all of the bars out and lower the heifer down himself, which he did, and then he climbed down the wall. But it didn't end well for Jack. He escaped four times, each time from the hangman's noose. Before he was executed, he was given the option of giving up his accomplices. But apparently when the judge asked this, he scoffed at him and mocked the judge. So that confirmed his death sentence. He had two plans to escape the noose. The first one was he was going to use a lockpick that he had fashioned from a nail. And he was going to pick his shackles at a particular time when the cart was going through London and there was going to be another cart waiting for him.  So he was hanged. His second plan to escape was he was going to wait until he'd been strung up and then after he'd been hanging for maybe five or ten seconds, a mob was going to rush onto the stage and cut him down and take him to a local doctor to be revived. However, we can see what actually happened. This is Jack going to the gallows saying hello to everyone. Now here we can see like there's this mob trying to get to the gallows, but they never made it, so Jack was hanged. And here we can see his body being given to the mob. Now the mob didn't take his body to a local doctor to be revived. It was more a case of ripping bits off it until there was nothing left. And that was the end for Jack, I'm afraid. He was hanged in front of 200,000 people, which was a third of the population of the whole of London. This guy was a massive celebrity. Bye, Jack. OK, we're going to come into newer times now. 1978. Jenkins and Lee. These guys were political prisoners, so they were distributing anti-apartheid leaflets, but they were doing it using high explosives, so maybe the prosecution did have a case there. But these guys escaped. They had 14 locked doors between themselves and freedom, and each of these was a different lock. So this was a massive achievement. They made the keys out of wood and later on from metal. This is Lee or Jenkins. Here we can see some examples of the keys they used. This one's quite complicated. It's got warding and lever cuts, so they weren't simple keys. But how do you get out of your cell door when there is no keyhole on the inside? These guys, this was the first door at 14. So every prison cell had a broom, and these guys took the broom apart and fashioned like a crankshaft system. We'll show you here. So this is what they had to do. There was a mirror in the cell, and they'd fish this broomstick out of the window and use in the mirror. They would see what they were doing, and on the end, you can see that they had this key, and so they'd operate it from the window. But this still left 13 locked doors. So it shows you what an astonishing achievement this was. These guys weren't locksmiths before they got locked up. And luckily, these guys are still out. They're still fine. There they are today. It's a happier ending. Bury my prison break. Daniel Luther Heiss, this guy got convicted for murdering someone else, him and another man.  He escaped previous to this. In 1991, he faked a peptic ulcer, and he got transferred to the hospital wing of the prison. But he was in a high room, so can anyone guess how this guy got from the high room down to the ground? Sheets! His particular take on it was he ripped some wires out of the wall and intertwined the wires to make it stronger. But thank you, Jack Shepherd. In 1995, he was transferred to Bury my. So when he got there, he met another inmate called Baker. Now Baker was a long-term inmate, and as such, he'd been given certain privileges, which included jewelry making equipment, bizarrely. He was a jeweler on the outside. So him and Heiss got together and thought, okay, let's make a key. Let's make a key and escape from prison. But the really good bit about this story is where he got the key from. So when anyone got transferred to Bury my, they were given an induction booklet telling you how to be a good inmate, what to do, what not to do. On the front cover with a master keys to the prison. Isn't that incredible? So they escaped. Heiss left a message in his cell saying, this bird has flown very cheesy. Baker got injured climbing over the second wall. He hurt his leg, so he got recaptured after 24 hours. Heiss was on the run for 12 days, but again, he got recaptured. But both of these guys are now out of prison. Heiss, this guy's a landscape gardener and an artist. This is an example of his artwork with the rainbows and the dragons and the eagles. I'm sure you can find him if you want to buy one of these prints. Okay, let's have a look at some secret locks and secret tools. This is the Chubb Custodial 3G222. So this is a prison lock, again. The big thing about this lock is that you can't do what I spoke about earlier with the Finnish guys. You can't look at this key and tell what the combination should be. Chubb boasts that the magnetic key is impossible to read or duplicate using normal senses alone or duplicate with standard workshop equipment. Now, I don't know about you, but that sounds like a challenge. But I've never seen this lock for sale. Chubb are really very good at keeping their more sensitive locks under wraps. If anyone has one of these for sale, I'd be super interested. This is another Chubb secret lock. It's not secret anymore. The Chubb Manifoil Mark IV was used by the UK Ministry of Defence to secure whatever you secure in safes, so documents and sensitive items. It's called the Manifoil, which stands for Mani Manipulation Foil. So it was designed from the ground up to stop you from opening it unless you knew the combination. It includes rumble strips. So have you ever seen the old movies where a guy will have a stethoscope and he'll be listening to the safe? That's actually a legitimate technique if you know what you're listening for. But this has these little rumble strips that deliberately make noise, so you can't use that. It also has lead shielding, this circle here. That's the lead shielding. And that was to stop X-ray attacks. So if someone came along with their portable X-ray device, you know the ones. And tried to get the combination. That stopped it. It also had crazy strict controls. So if you were a Chubb safe engineer and you were called out to go and work on this lock, you could do it without having someone supervise you at all times. There was also always a chain of custody on the parts. So if you took a dial or a disk or anything from Chubb, you had to sign it out. So everybody knew at any given point in time who had what parts. And there are no public successful manipulations of this. That's not to say it's impossible. I've heard rumours of people picking it, but no one's ever done a YouTube video to sort of prove it. But this has been declassified for a few years now, so it's only a matter of time. And this wasn't the end for the manifold. We'll leave that there. NATO Merzy Locks. So this was used by NATO countries again to secure documents and so forth. Instantly we can see that it doesn't look quite the same as most lever locks. You've got this sort of V-shape to the key. And the idea of this is so you can't just get a blank and maybe impression the lock. You have to manufacture your own blank, your own key, which makes it more difficult, of course. It has 14 levers. All the levers have false gates, which is a lot of levers to pick. But that's not what makes it secure, but it's not what makes it ultra secure. So this is quite unusual with a lever lock. You can see we have these two silver parts here. They're the stumps. So the idea behind having two is if you tried to drill a lock and drill one of these stumps away, the lock is still going to stay locked. You'd have to drill both of them away, which doubles the attack time. And again, this is another lock that's never been publicly picked. Oh, I forgot to mention the other cool thing about this lock. If you try and tension this lock, so if you try and push these silver stumps into the levers, what happens is the levers move away, so you'll move the stump and the levers will move away. And so you can't get that friction. Very cunning way to stop people picking it. And again, I've heard rumors that maybe it can be picked, but no one's ever come forward and publicly admitted it. This isn't a secret tool. This is a seven pin tubular lock pick. It's for these locks. I'm sure we've all seen these locks everywhere on vending machines and cash boxes. Now, why I like this tool so much is because of how effective it is. So now it's time to pray to the demo gods. I have one here. This is a very common lock that's used for securing multiple items of electronic equipment. And we're going to see how fast this tool can work.  Okay, ready? Hold on. Oh, demo gods, what have you done to me? Let's try that again. Obviously, it doesn't always work first time. There we go. Now, that was second time. That was like using the key, almost. So you can see how frighteningly effective this can be. Now, not every tubular lock picks this easy, but the cheap ones do. And this is a cheap one. This is a cheap one. So don't use that to secure your laptop is the moral of this story. Now, this tool uses a self-impressioning technique. So what that means in a nutshell is that this tool allows the lock to pick itself. It takes very little skill from the user and it happens very quickly. But it wasn't long before lock companies realized that this tool was out there. They started changing their designs. This is Baton's attempt at foiling this very tool. And I think this is a good attempt at foiling it. So one of the big things about this lock, instantly, you'll see it's got six pins instead of seven. So that tool needs to have its little arms in different places. So instantly, that tool doesn't work. Another big thing about this is it's field-recayable. So what that means is you can change the lock without actually physically removing the lock. So if you are worried that maybe the key has been compromised, maybe someone's copied it, maybe someone's stolen it, you can come along with a change key and move it to one of these other numbers and then the original key won't work anymore. They also put this shroud around it, the big hunk of metal. Now what this does is it excludes that pick from fitting in. You need a pick that sort of looks like the key here. So it needs a thin stem. You can single pin pick this lock and you can self-impression it too, but that shroud makes life very difficult. HPC are a tool maker. They did make a tool that opened these a long time ago, 30, 40 years ago maybe, I've not seen it for a long time. But this is a good example of how to stop that tool. This is a bad example. This is Camlock Systems' effort. So can anyone see what Camlock Systems did to stop that tool from working? I've highlighted it in red just in case it's not immediately obvious. They changed the circle to an octagon. And that's it. This was the whole model of security for this lock, was changing the circle to an octagon. That's simple. So this does stop the tool from fitting. It won't go in. Those little sharp corners stop it working. But luckily it's a very cheap and nasty lock. There's nothing stopping you getting direct access to the pins and single pin picking it. And it does self-impression too very easily if you had the obvious tool. So how do you think you might modify this tool to work in this lock? Do you think maybe if we change the circle to an octagon that might work? Well obviously, yeah, and it does. But this tool doesn't exist. Now I found this really crazy. I thought, well, if I can see the obvious tool, surely other people can. And other people did. This is a way that lock makers keep tools secret. It's quite an outdated method, but this is how they do it. So I was on key picking, which is a really cool lock picking forum on the internet. Now I put a post up saying at some point in the future I would like to make tools for this lock and this lock and this lock. And their lock, that one I just showed you, happened to be in that list and that was all. Their lawyers saw it, didn't like it. They got on to key picking's owner and threatened him with prosecution if he didn't give up my IP address and any other identifying information. And their intention was to serve a cease and desist order on me in order to get this prevent potential future patent breach. Now that covers everything, doesn't it? Potential future patent breach. And then I found out, they've done it before, they've done it several times, well, I know they've done it several times before, so they've probably done it many, many times. I've spoken to several tool makers from the UK and they've all said the same thing. They've said they've either made the tool or put the tool onto the internet to sell and every time Camelock systems have jumped on them and said, no, you're not doing that. And I get why they do it. They do it so you can't get an off-the-shelf tool that opens their lock. So I understand it. But this is security through obscurity again. And the problem is this lock is everywhere in the UK at least. You'd think if it went to court that they wouldn't have a leg to stand on. And a lot of the guys I spoke to said they would have loved to afford it. But nobody wants a long, expensive legal battle with a lock company. And then I noticed the Camelock systems had tried to patent the obvious tool. And here it is. You can see they've changed the circle to an octagon. Now, the reason they did this is a little fuzzy. I don't know the intentions behind it. Maybe they wanted, in the future, to make this tool and sell it to locksmiths. But that isn't what happened. I think it's more likely this was a purely defensive patent. They never intended to make this tool. They just had the patent ready so that if anyone did make it, then they could jump on them and say, no, that's not happening. And then I found out it never actually got granted. But whatever reason, the patent for the tool doesn't exist. I tried to patent it and it didn't work. So maybe they wouldn't have a stand-on after all. Now, like I say, this is an outdated protection method. It's been used many times in the past. But now we have the internet. Your secret can be everywhere in a matter of a day or two. And this wouldn't fly in digital security. If Microsoft make Windows 28 and any old fool can look at it and go, oh, I can just change an existing tool and totally subvert their model of security that either have to patch it extensively or change everything from the ground up. And this is what we want. We want security through design, not obscurity. And this doesn't help anyone, this type of behavior. All it actually does is keep the vulnerabilities inherent within the lock. It keeps them there. This is another tool that was secret once. This is the Sputnik or Yugoslav. I think that's how you say it. It was invented by Mladen Perchich. This guy was a Yugoslav burglar who was stealing things in Germany. It's a really cool tool. You can see that you have these five little wires and each one of the arms moves one of these wires independently. So it's like having a movable key inside the lock as you pick it. You can buy these now, but they're not cheap. This is Abloy Classic. I said we were going to look at this lock again. So sometime in the 70s, a Finnish sex pest made the Vempele, which is this thing we can see in the bottom right corner. All that means is thingamajig or contraption in Finnish. This guy, he was picking the front door locks on young ladies' houses, hiding under the bed, and then waiting until the middle of the night before he'd come out and attack them. So he wasn't a nice guy. He got caught. The Finnish police wouldn't believe that he could pick the locks until he demonstrated it. The first example of Abloy Classic being picked in 75 years. Before Hanne was a reward, Abloy were giving a one million fin marks reward if you could pick this lock, which doesn't exist anymore. I could use a million fin marks right now. And this forced Abloy to change the design of the tool. So this tool was using this front disc to tension the lock. Abloy changed it so that front disc just spun freely and you could no longer use it to tension the lock. And since then, it went unpicked allegedly. So as soon as I heard about this, it became like a locksmith in ambition, more of a locksmith in obsession. I didn't work on it for six years constantly. It was often on making prototypes, realizing it didn't work, repeat, rinse, repeat. And then I settled on a design that I thought might work, but I realized I couldn't make it by hands. I needed something more accurate. So I saved up for a year to buy this million machine. And to cut a long story short, it worked. Here's the tool. You can see two examples over here. I'll have it with me if anyone wants to see it. There's the lock open. No way. This is the good bit. I was really happy. But then within three weeks, a friend of mine got in touch and said, oh, I see your tool. It's for sale on that popular locksmith supply website. And I was like, I don't think it is. So I went and had a look. And it turns out when I spoke to the owner of the website, this tool got developed eight years previously by an unknown government agency. And for eight years, it existed and been used in complete secret. And then once they saw mine on the internet, they realized the secret was out because it's almost identical. They realized the secret was out and they declassified it to sell it publicly. So I'm not interested in reinventing the wheel. If I'd have known that this tool existed all those years ago, I wouldn't have bothered spending so much time and effort and money in making this thing. Who would?  And so I found it a little vexing is an understanding. See, it was a little more soul-destroying. But this led me to make it better. I used what I'd already learned to make the tool better. So I'm going to show you the video of that tool. I'm not going to show you the tool itself because I'm not risking a repeat of before. But here it is in action. So this is me zeroing the discs. This is the tool going into the lock. This is the tool doing its magic. See how long it takes. Is that open? 13 seconds. Yeah, that didn't work, did it? Thank you, PowerPoint. Okay, let's have a quick look at some of the stars' declassified tools. Thanks to ArtemEister for letting me show these are his tools. This is quite an interesting one. We have these six plungers, each of which operate one of these six little arms on the end. And once you've picked the lock, you've got the thumb screws that you can then tighten down and it'll act as a key. The stars, they didn't invent this method, but this was their take on it. So this is a comb pick. It's not really a lock-picking device. It's more of a bypass tool. So instead of lifting these pins, see the gap here in the pins? Gap, gap, gap, gap. Whereas this tool lifts everything up high, high, high, so that there's nothing here stopping the lock from opening. It's actually quite an old technique. This is a picture from a patent from 1934. So it's older than the Starzy, but this is quite an interesting take on it. This brass box, this is for using this tool one-handed. So the end here sort of slides in and out, and you can slide it out, and it looks anyway like you're using the key. Very sneaky. This is another tool I developed maybe three or four years ago. It's for picking lever locks. And you can see there are four little ends here, and each one moves independently. Now I was really proud of this, and once again, as soon as I saw the Starzy tools, I realised that it had been done better 35 years ago. This is a five-in one. Is there anything unique left to build, I wonder? Can anyone guess who this belonged to? This is a make-up key. What this means is you can change the little bits on the end to form any key that you like. Can anyone guess? Anyone seen this before? No? Harry Houdini. He was a great lock picker himself. This is one of his tools.  This isn't a secret tool, but I'm not really sure what it does. Any ideas? A bit of a plug. And from the ridiculous to the sublime. Look at this. How nice are these? So the story about these was a couple of months ago on the subreddit, lock picking subreddit, some guy posted this picture and said, does anyone know how these work or what they're for? And within 24 hours, he'd deleted the post and he'd deleted his user account. You only have to look at these to see that these are scream government at you. Really. I'd love to know how these work. There's a bit of wire here. What's that for? And finally, let's just have a quick comparison between the digital and the physical world in terms of security. So in the digital world, we have Vault 7, WikiLeaks, Snowden's work that expose secret government digital tools. There's nothing like that for the physical world. No one's ever released a database of pictures of physical tools. The closest we ever get is when lock companies refuse to acknowledge that a vulnerability exists and so someone might put a YouTube up shaming the lock company. In the digital world, we have formalized structures for declaring vulnerabilities like bug bounty programs. Again, there's nothing like this in the physical world. In my experience, lock makers tend to want to know the vulnerabilities and give you nothing more than a pat on the head as compensation. It's not a thing in the physical world. There's a huge number of researchers looking at digital problems. Relatively, it's a growing number in the physical world, but it's tiny in comparison. And if you find a problem, nowadays, most software can be patched remotely. How do you do that with a lock? If someone finds a vulnerability in a lock and there are 3 million of those locks out there in the world, the lock company isn't going to be interested in going and replacing all those locks. That's going to cost money. They don't care about that.  But I hope one day that the physical world will catch up with the digital world. I think they have to copy the model at some point, because we've got the internet now and information is so freely available. And hopefully, that's where things will go in the future, fingers crossed. That's it. We're done. Thank you for listening. I kind of feel scared now. Don't be scared. I mean, if a government wants to get into your house, they're going to do whatever. Are there any pressing questions? We have about 2 minutes left for questions. I think you can ask them directly afterwards. Three hugs afterwards. I would say, if there are any more questions, there's a lock picking village. You can always find me in the lock picking village. I've got a selection of my tools with me. If you want to talk about it, I don't mind sharing it. Okay. So please, another round of applause for an awesome talk.


What is up everybody? This is Chris from the Rewire Soul where we talk about the problem, but focus on the solution. And if you're new to my channel, my channel is all about mental health, mental health awareness, addiction, addiction recovery, and all of that. So if you're like me, always trying to improve your mental and emotional well-being, make sure you subscribe and ring that notification bell. All right. So I do want to get back to sharing some of my personal stories on here. I've been, for those of you who don't know, I've been clean and sober for a little over seven and a half years. I got sober on my 27th birthday, June 23rd, 2012. And yeah, hopefully bits and pieces of my story can inspire people struggling with addiction, people new in recovery, or if you have a loved one who is struggling with addiction. So yeah, I, whenever I make a video like this, I have to think long and hard before I make it about how I'm going to share this story, because I want to make it very clear, like the last thing I ever want to do is glorify or romanticize these drugs. Okay. Like that is just my worst nightmare.  Right. And like some people like put this emphasis on like the good feeling it gives you and all the fun and everything like that. Like there are these like glimpses of fun in there, but it can destroy your life. Right. It's kind of like, it's kind of like, you know, you know, that toxic relationship that you were in and you break up, right? You break up because it was so toxic. But then afterwards you look at it and you think about like the good times you had. Our brain has this weird way of just getting rid of all the negatives that happen in that relationship. And we're just like, well, it took me on a nice date that one time. Like now, now it was toxic, terrible relationship. All right. So anyways, this is not to romanticize. This is just to share my experience. And you'll see how my cocaine addiction was kind of this tipping point that almost killed me. So anyways, my addiction started out with alcohol. Okay. My mom's an alcoholic. I swore off alcohol. I was like, I'm never going to drink. But at the end of my senior year of high school, I went through a bad breakup in my high school sweetheart, who I thought I was going to marry and we're going all that stuff. And I just didn't want to feel anything. And I got drunk for the first time and I was hooked. All right. So for years after that, like my alcoholism just progressively got worse, lost jobs, lost a lot of money, just I was in a bad place. And then when my son, when he was born, his mom was prescribed a bunch of prescription opioids because she had a C section and I started taking those and I fell in love with prescription opioids. Fast forward, things get worse. Her and I split up because I can't get my act together. I become the single father and eventually got to a point where it was so bad that I was no longer allowed to see my son. And I hated her for that. I resented her for that, even though that was one of the best things to ever happen to me. And to give some people some hope out there who are struggling with addiction or you're in early recovery, she's one of my best friends today. We have an amazing relationship. In fact, like, look, it brings a smile to my face. In fact, this weekend, because we share custody of my son, this weekend, my son is actually staying there because it's his cousin's birthday party and everything like that. But we're going to go see that new Pixar movie onward and she has another son, my son's little brother. She has another son with her now husband who she's been with since about a year after her and I split up. But anyways, I'm taking my son to this movie and she said her other son, he's like five, wants to go and I absolutely love that kid. And yeah, I'm taking him with us. And like, I don't know, it is just such a beautiful thing that her and I went from hating each other, her hating me a little bit more so because of my addiction.  But anyways, anyway, it's the cocaine. So yeah, I was in a really dark place after I wasn't allowed to see my son anymore. And I live in Las Vegas.  And every weekend, we would go to the casino, cash our checks, get super wasted, then go to this bar and get even more wasted. And my thing was alcohol and pills, but all the people I was hanging out with, they loved cocaine. Like, the cocaine dealer was actually the doorman at the bar that we would go to. So we'd go there when it was his shift. So my friends can get cocaine. And they were always trying to get me to do it, always trying to get me to do it. And like, even in active addiction, I knew I was an addict. Like, I knew, you know what I mean? I knew that once I find a new substance, I get hooked. And I always turned them down when they offered me cocaine, because I'm like, listen, I know I'm going to get hooked. And I'm overweight. I have heart issues because of my drug and alcohol use. I'm like, if I start using cocaine, like, it will kill me. And I don't know what it was. I can't remember exactly why it was. Maybe I was just so wasted. I finally agreed. And I was like, they offered it to me, like you keep offering, like, eventually I'm going to try it. So I finally said, yeah, I was like, okay, cool, I'll try it. So we ended up going out to my buddies. He had a minivan for some reason. We ended up going out there. And I hated weed. I hated weed too.  It gives you this nice little balance, right? Because cocaine brings you up, weed brings you down or whatever. So I smoked a little and then I snorted coke. And it gave me what I thought was the best feeling of my entire life. I remember going back into the bar and running around to all my friends who were all over the bar and just like, I was like, I feel amazing. I was like, this is the best I've ever felt.  I'm like, you love this way too much. Like, this is going to be a problem, right? Like, a part of me knew that this was going to be a problem. And spoiler alert, it never felt that good again. All right. But that's what we do is drug addicts, right? We get that first high, and we chase it. We chase it. I did everything, everything I could in the coming months to, you know, like I would go back to smoking weed and then snorting coke, never got that feeling again. But anyways, once I once I started, it became just a normal thing. Every weekend when we went out to that bar, we do that, we'd go into the bathroom, we'd, you know, do some coke together. Then I would just, I would start doing it at work with my friends.  And they'd give me a little bump and I'd go in the bathroom or whatever it was. I remember it was around the time that the new, the newest Diablo, what was that, 10 years ago, came out. And my buddy who got me in the Coke, he came over and all we did was snort coke and play Diablo all night, right? Like, it was weird. But anyways, that was one of the things that finally led, led me to having major health problems. I already had health problems. My heart wasn't pumping fluids the way it should be. So I kept swelling up for my, for my feet, like all the way up to my abdomen and I kept going to the emergency room lying to them about the drugs I use. They would give me diuretics to get all the fluid out. They would give me some painkillers and I would go back there every other week, right?  We need to check you out and see what's going on. And I had congestive heart failure. I was 26 years old. My heart was the size of my lungs. It was working at like less than 20%. They gave me a 10% chance of living. In fact, they even called my mom in California and said, yo, you should come down to Las Vegas because we don't think your son is going to live through the night, right?  And yeah, it's crazy how addicted I became to it.  One of the reasons I justified, one of the ways, because like us drug addicts, we can justify just about anything. I justified it. I'm like, oh, well, cocaine will help me lose weight. It'll help me lose weight. No, no, because I also had a major food problem. I would get high and I wouldn't even be hungry. And I would go to like the Del Taco drive-thru or Jack in the Box drive-thru and I binge eat and then I would puke my brains out. Like, I don't know. I like times like this, when I get to share my story, I'm just so grateful I don't live like that anymore, you know, like just taking whatever we can to escape the feelings that we don't want and it's only making us feel worse, but we keep doing it anyways. It is complete insanity, right? And I lived that way for almost a decade, but me and millions of other people are living proof that recovery is possible, right? Like, all it takes is this willingness to get better and this open-mindedness to do some stuff that we don't want to do. And for me, that was 12-step programs when I first got sober, because I didn't have insurance to go to rehab, all right? But anyways, I just wanted to come on here and share my story with all of you. If any of you have stories of recovery that you would like to talk about down in the comments below, let me know. All right, so in the last video where I did eight mind-blowing stats about mental health, I asked you guys a question. I was like, what's your favorite like mental health helper and things like that. So this one comes from, I think it's pronounced Kila or is it Kyla? I apologize if I don't know how to pronounce your name. Anyways, she says my favorite is my medication because it's like Dr. Jekyll and Mr. Hyde. If I'm off my meds, I'm taking everyone down with me versus when I am a saint, when I am on them. And yeah, I try so much to not take medications just because of side effects and everything like that. But I go through different stages of when I need them, when I don't need them. For example, I might make a video on this. I've been off my Prozac for about a month and a half, but I'm on a mood stabilizer. Mikthal, I'm just trying it out. Far less side effects, it's stabilizing my mood a little bit more. But yeah, like, listen, first off, always work with a doctor if you're going to come off your meds. But second off, like be self aware of something I do. This is the best advice I can give anybody out there about medications.  All right, for me, that's my beautiful girlfriend Tristan. If I'm ever getting off my meds, I tell her straight up. I say, Hey, I'm coming off my meds. I just got back from the doctors.  I said, but if I start acting crazy, you need to tell me because part of mental illness is that we don't even recognize when we're acting nuts.  You know what I mean?  I'm like, what's changed in my life? I'm like, that's it. All right. So thank you, Kila or Kyla for your response. And for the next video, I'll pick another one of your responses. But, but let me know your stories of recovery or if you know somebody who has gotten sober. It's a little bit inspirational. Let's do that. All right. Anyways, that's all I got for this video. If you liked this video, please give it a thumbs up. If you're new makes you subscribe and ring that notification bell and a huge, huge thank you to everybody who supports the channel over on Patreon, as well as everybody who supports the channel by buying the mental health books at the rewiredsoul.com or the rewiredsoul merch like this shirt with my adorable kitty Maya. All right. Thanks again for watching. I'll see you next time.


Good day, fellow investors. I often get questions about safe investments, about safe long-term investments, good dividend payers, growing dividend stocks. And in this video, I want to discuss Rio Tinto, which is, I believe, a very, very strong investment at this period in time, especially a very strong investment to average in over the long-term and to reinvest the strong dividends. The dividend yield is at 6%, which should be okay for most of you. The scale of the business, the diversification, the global, global, let's say, exposure to growth, to emerging markets, to Asia, to what however the world will develop over the next decades is what Rio Tinto brings to you. And over the past 40 years, Rio Tinto has really done well with double digits yearly returned to shareholders. I believe it's something about 12% over the last 40 years. That's what Rio Tinto is. And in this video, I want to discuss a little bit, my view, I want to analyze the company, especially the iron ore part of the company, as it leads to the highest EBITDA. But then don't forget, there is also copper, there's also other things that will balance out over time, depending on how those commodity prices are volatile. So let's start with the analysis of Rio Tinto, and then I'll give you my conclusion on it and how I see that when it comes to investing. So over the last years, we have seen iron prices, iron ore prices as very, very volatile, from $175 per ton going down to below 40 in 2016 and spiking up in 2019. There was the Vale Dam disaster in 2019 at the beginning. It spiked iron prices, but then over the long term, this is very important. I always like to look at cost curves, and this is a 2016 Fortescue presentation that I found. And you see how the cost curve got flatter, more production, and actually the cost of producing iron ore went down. This is continuing to happen. If you look at the 2018 cost curve, it's flatter, flatter, and flatter. So according to my calculations, when things normalize there, more operations are added, more production, iron ore prices should settle around $60, $50, $60 per ton. Rio Tinto will still be profitable over the long term, but not as much as currently, but there are also other metals. So this is something we have to expect. As I said, iron ore price spiked because the Vale Dam disaster that removed approximately 75 million tons of the company's supply and the disruption is expected to last until 2024. However, they are increasing production. Vale wants to bring production as soon as possible back to the previous levels. Fortescue announced the 1.6 billion, 20 million tons expansion of Iron Bridge and a 30 million ton, 1.3 billion new mind, Eliana. BHP, the same 4.7 billion South flank project. Rio will invest 3.5 billion in could-die-dairy mine, and their possibility of projects is really endless. This is from Rio Tinto. There is so much iron ore, so it's all about the cost and what happens to that cost. If they expend too much, then the cost will go down, they will not be profitable. The marginal producer on this cost curve sets the price for the whole sector because that simply demand, how demand and supply works. But don't be surprised if those costs, those prices of iron ore over the long-term go down. However, margins are really strong. Even if prices go down and they are working a lot on lowering costs, Rio will be still extremely profitable and that is what you invest over the long-term into the iron ore margins. And I have made some calculations. Average iron ore, EBITDA, should be around 11 billion total operating cash flows in 2018. We're 14.6 billion. We have to deduct 6 billion of CAPEX. And 2018 is the year I take for an average for iron ore prices and other metals over the next years. So you have 6 billion in free cash flow that can be distributed to shareholders that goes into dividend that goes into buybacks. So you have to compare the 6 billion in free cash flow because that is your shareholder reward to the price of the company. 6 billion or 97 billion is not 10, 15% return but when you add the growth and when you add the potential over the long-term then this is what you get. BHP is just in a similar situation to Rio. Free cash flows have been 10 billion. The market cap is a little bit higher. So we are on a similar return there. Now, there is something that we have to discuss here the long-term outlook. Despite the short-term threats of lower iron ore prices, lower commodities prices, when it comes to investing in companies like Rio, the world develops, the demand for metals will increase and consequently companies like Rio will do extremely well, like they did in the past and I'll show you that in a second. So we have here iron ore, steel versus GDP. You can see how it is a correlation and China is still below the curve, India is still below the curve. So there will be a lot of demand for iron ore and Rio Tinto has the know-how and the ore to produce that at a low cost with a high margin. So just imagine what will Rio's margins be 2025 if there is another bull market in commodities or in 2030, that's what you are investing in. So it's normal for iron ore to be consumed by the growing countries. We have China, we'll have India and we'll have still 4.5 billion people in Asia and 1 billion people in Africa still demanding large quantities of that to grow their economies as they are still growing very, very fast, no matter what's going on in the developed world. The UN predictions lead to an additional 200 billion tons of iron ore so the outlook is very positive for Rio Tinto. They don't know if the demand for steel will grow between 2% and 5.5% per year by 2030 depending on the scenario. But whatever happens, Rio Tinto will do well like it did in the past. Since 1998, Rio Tinto investors have achieved returns of about 3,000% and given the current situation is likely that you can achieve similar returns over the long term. So did beat the FTSE index, did beat also the S&P 500 by significant depending on the currency but still it is a very, very good return and this is also what Rio Tinto is. So as I said, I require a 15% investment return. Rio Tinto is currently at 9, 10, maybe going to 15 in that exuberant part of the commodity cycle that happens every 5, 10 years but that is a little bit too little for me. I have other investments that give me better rewards on let's say the same or even lower risks but still those who look for those big companies, those that want to have a portfolio of 20, 30 strong companies in a portfolio of 30 companies, Rio Tinto really fits well because you can average down if it goes down, you can add more true time because you know that over the next 30, 40 years Rio Tinto will be there. From my perspective, I would wait that Rio Tinto falls to a 15% business yield, the average business yield over time as we have seen that those things are always volatile and only then invest. Is that too crazy to ask? Well, no, because just a few years ago in 2016 when I was long Rio Tinto, I bought some stocks in the 20s, Rio Tinto offered a 15% long-term yield, business yield and that's also the story when it comes to these cyclicals. If you are like me, following a lot of companies constantly following the markets, then you can wait for things to be bad in the environment. Rio Tinto's stock, if there wouldn't be the Vele disaster would be much, much lower now and offering a much, much higher yield over the long-term investment return. But thanks to higher iron ore prices, the stock has also rebounded. So that's something to keep in mind. I'm following the market over the long-term and then investing when that particular stock is below my investing threshold or below a certain set price. That's me. If you can't follow the market like I do, then you can always invest in such stocks, have 30 of them, see which one is let's say below an average growth rate which should be for Rio Tinto, an average return of around 10, 11%, 6% dividend plus 2%, 3% growth plus the reinvestments. And then you see, okay, buy what is low and Rio Tinto at the current moment, it might go lower, but it already fits that perspective for a 10%, 11% long-term return. And as always, as we discussed in the long-term thesis, Rio Tinto offers you exposure to those commodities if those and when those, as those always boom sooner or later, then you find yourself really at a higher exposure and then you might think about trimming it in your portfolio. So Rio Tinto is definitely a stock to be in a 30, 40, 50 stocks portfolio over the very long-term and it surely will do good as it did in the past because compared to the SAP 500, maybe it didn't beat it or it beat it slightly, but over the next 40 years, Rio Tinto is still fairly priced while the SAP 500 is overvalued. Thank you for watching, looking forward to your comments, check my stock market research platform for many other miners research if you like this kind of commodities investing and commodities exposure to global growth. Ask me any questions in the comments. Thank you and I'll see you in the next video.


is Aldebaran. He's from DCG 613. That's 11613, the same one that Hoodie Pwn is from in Melbourne, Australia. He's presenting, what is GRC hacking anyway? Alan is a self-proclaimed triple-A rated GRC hacker, having presented similar talks at Defconn Villages and PCI Council events. So take it away, Alan. Oh, by the way, after this talk, we're going to be open for just general socializing, hanging out, and talk. So take it away, Alan. Sorry, I'm one of the Defconn Villages volunteers like four years, I think. Is Alan AFK for some reason, or is his audio broken? Oh, he disappeared. I'm guessing he's refreshing us. Yep, I'm guessing that's happening too. Because technology, technology. We call that the crunchy roll. Yeah, my browser quick, but this is me. I found most problems are fixed by refreshing the browser. Yeah, I found that. Welcome, welcome, welcome back, Aldebaran. Can anyone hear me? Oh yeah, we can hear you fine. We can hear you now. All right, yeah. You couldn't before I was, I started and it didn't seem to, no one seems to be. Make sure you turn on megaphone too. It is on. Okay, let's just try to share the slides again. Remember to turn it up. All right. Okay, great. Thank you very much for the introduction. And yeah, thank you very much for having me once again. It's an honor to stand on. I was going to say this virtual stage once again, but this is a new stage. Sadly enough, the old one has been destroyed. But yeah, always good to talk to the Defconn groups, peeps. Some of the nicest people you'll ever meet.  My name is Alan Baranov. Also known as Aldebaran. This is my first stop of my, what I've called my Excel tour. A blatant rip off of someone else's era tour, but we won't go into this. And yeah, the first stop is Vegas baby in a manner of speaking. So I'm going to present a few stories from my life, which I hope will be slightly entertaining to some of you, maybe a bit inspirational. And yeah, so I've started, I'm going to start it off with some of my talk with really digging into one of the best talks I've seen and one of the kindest and smartest people that I know, Mr. Ray redacted. He didn't pay me to say that, but I did steal some of his talks. So I've got to tell, I've got to say that he's a good, good person. And yeah, good, good, good talk. And I'll give you the details of that, but I'll go through what I got out of it. I'm also going to go through, if there's time, my April Fool's experiment, some of the stuff that I've done with the confecon stuff and where my life has taken me in the last couple of years because of that. And yeah, just a few thoughts about what I believe from what it means to me to be a hacker. And yeah, as per the title, I am a GRC consultant, which is probably the last person that you would think would be a hacker. And also, it was something that I really needed to consider because I was very keen on starting up DCG 11613, Melbourne. And my question to myself is, am I the person to do it? Am I a hacker? And it took me a bit of thinking, a bit of internalizing to think about that. So let's jump ahead. For what it's worth, yeah, I've become quite famous for most of my presentations, I've done in Excel. And the ones that I don't do in Excel, people don't seem to remember. So that's why I stick with you. Yeah, okay. So yeah, I'm not going to give you any more background about myself. These are all my different social networks. I guess when I was setting up my blue sky one, I really didn't think that people might actually ever want to take it down and see what it's about. But because that's a very, very long, a very, very long one. And yeah, feel free to take a picture of the QR code. It's absolutely fine. Don't worry. It'll just take you to a recall. No, it won't. It'll take you to my LinkedIn. That's where it'll take you. Yeah, let's jump into it. So as I said, some of my talk is stolen directly from RaiseTalk. I thought it was inspirational and one of the best talks I've seen. And it starts and goes through all the different generations of hackers that they are highly recommend that you have a look at it. You can either find it by typing Ray and then generations of hackers or something to that effect or the link is there at the bottom of the slide. He breaks it down into different generations. He goes into the different ones, gives you a lot of extra information about them. I highly recommend it. But what I got out of it. So he starts off with the first generation hackers. These are the kind of pre electricity hackers. The, so the idea of a love lace that a love lace is an interesting character. I heard a story about it that while Babbage was building his machine. He kind of built it around the concept of a weaving machine. It was used a lot of the kind of technology, the ideas behind weaving machines. And in those days, weaving was was very interesting because different organizations had different ways of weaving and the methodologies that they would do it were all kind of built into cards. I'm not quite sure whether they're automated or whether they're manual, but they gave instructions on on how to actually weave in this particular way that that organization wanted it done. They were very intricate and of course very closely guarded because you know your organization did it in the way that you would want to do it. And Ada saw this and thought, hmm, okay, well maybe you could use the same idea. And you could use these cards as kind of mathematical and pretty much invented the whole idea of programming. And I think that's quite, quite amazing. You know, it was something that was there for people to see and anyone could have seen it but she did. And that I think is what makes someone a hacker is not seeing the world as it is but what could be and what they might be. I'm in the same kind of generation a little bit later or 50 years later, I think almost exactly or maybe 100 years later. I'm not sure exactly, but Alan Twerin came along and he seemed to be the father of modern computing. A lot of people were computing at the time. And, yeah, it's it but but his ideas and his completeness of vision is pretty much still used today when when we design computers. And his ability to take patterns and to understand how maths could be transferred into the real world and back again. I think is pretty much what what what he's very well known for. In his day professors, which he was we're not meant to get their hands dirty they were supposed to kind of design the machines that they needed and then give it off to to people to go and make for them. But he didn't be actually spent a lot of his time getting his hands dirty filling around with machines. And I think that that is part of the hacker culture. So I think from that the first thing I get is is, you know, the first element of being a hacker is seeing what can be not what is but what can be. One of the big things that's happened at DevCon this year is CDC, the cult of the dead cow releasing their valid network. You know, people could have just accepted that that companies run the internet today. But not them. They've released something that that is more like what they want. Right, second generation. The phone freakers. So what I get out of the phone freakers is that they were building a culture more than just the tools that they were using. And, you know, the fact that they were breaking the law and breaking into two organizations.  And they found a way to to be able to speak to each other. I once saw quotes. I'm not sure exactly where it is or who it's attributed to, but it said that nodes are people who use telephones to talk to other nodes about telephones and probably use computers to talk to other nodes about computers and internet people use the internet to talk to other people about internet. That's that's what nodes all about. And I think the second generation what it inspires is it's all about the culture finding your people. Once you have bored to death, all the people that are around you talking about the minuscule of something that interests you. You go find other people who are interested in the same thing. And back in the 60s and 70s it was not that easy to do. And nowadays it's it's a lot easier to do. And it's a hacker thing. Right. Third generation hackers. That's when BBS is hack magazines, text files and cults came out. And I think that's that's the third part is is just trying to really, really, but like really understand things. And the kind of quest and the thirst for getting information. And I think, you know, we know of a lot of the old school hackers who got into trouble. Got arrested even because they had this kind of thirst for knowledge and kind of trying to break down the barriers which today we don't need to worry about it's all out there if need be. And getting on to the fourth generation of hackers. So, the way that I summed it up was money, money, money. It's the rise of information security. You know, all of a sudden companies are worried about the fact that they have money that needs to be protected. And so they hire us and all of a sudden we're inside we're no longer outside looking in we're on the inside now, and we're getting paid, which is awesome. I'm not going to look too much into that it just makes it a lot easier to be a hacker. Because of that fact. The fifth generation, which is where nation states started to jump in. Yeah, it's war and war and war. We're getting involved in that. And I don't want to look too much in that but I do think that the fourth and fifth generation is kind of where we lost a bit of our soul. And, you know, it makes it easier makes it nicer. It means that that we have money available to to go to, you know, Vegas to go and meet up with each other. But it also, you know, it means that that we did lose a little bit of what it means to be a hacker. Sixth generation, this is the one that that I really liked out of out of the out of the talk. And I think that this is this is to me, the most important part the sixth generation, which is where we are now. So, Ray goes in that that he started understanding it from the bear farmers. But there's also the B sides. So the whole philosophy behind B sides in that trying to get people together, the whole idea of DEF CON groups, you know, around the world, people meeting up so that they can discuss and just be with with other groups and with us with with the stuff that we've been doing over the last few years where we've been getting different different DEF CON groups together and chatting amongst ourselves and then of course the Diana initiative and queer con and all the changes that have been in DEF CON that have made it more inclusive that it's not just a whole bunch of, you know, white guys with, you know, that haven't showered for for three days or whatever talking to each other. But there's different people different. Yeah, that are that are all being accepted and embraced, just because they happen to be hackers. They're one of us. And I think that's that to me is is the important bit. And the thing that that that I found very inspirational. Yeah, all of that. So, so with me, I mean I started my my, I've probably always been a hacker deep down inside but I think a lot of it came out during the covert time when everyone was kind of stuck to stuck at home. And zooming became what we all did with each other.  And and yeah and in Australia the comfy con people and all the really kind besides people that, you know, just other nicest people and people that you just want to hang out with. All different all different types of people. But all all hackers and and I think that is is something that we definitely absolutely need to embrace. Jumping from that when I jump a little bit into neurodiversity because it seems to me that that's kind of almost all everyone who's a hacker is has some sort of neurodiversity going on in their brain. The weird thing is that worldwide neurodiverse people only make up at about 15%. It's between 10 and 20%. So I've kind of settled on 15%. So it's around about 15% of all people. So, you know, in any crowds like eight of those people are not going to be neurodiverse they'll be neuro typical. But you go to a hacker meet up or whatever and it's almost always like everyone seems to be some sort of neurodiverse used usually ADHD but there are other types of neurodiversity that you'll find. And that's that's great. I think it's it's very important. Um, so kind of weird, you know, what do one neurodiversity what what makes hackers, you know, tend to be neurodiverse people. And we look at at the idea of, you know, it's a way to show your creativity neurodiverse people usually have very a lot of creativity. They have respectful rules. They have attention to detail. They have the ability to hyper focus. So people that are trying to really understand something and need to put in eight to, you know, 10 hours on it. You need you need the ability to hyper focus. You're not going to be able to do it if you don't have that ability and lateral thinking. Um, the ability to see patterns and to see what could be and what should be is is yeah is is one of the things that makes people hackers, I guess. So in terms of what organizations can do to get hackers to get people interested. Um, I was I was reading some of the stuff that that that kind of exclude people. Um, so job descriptions for a start. Um, a lot of people who are who are neurodiverse having positive syndrome, and they read all of these interesting jobs and like are really keen to do them but also at the same time, hang on. I don't think I can do that. I can do most of it, but not all of it. Um, and so therefore they just exclude themselves. Interviews or my word interviews are terrible.  Um, I don't think I've ever got a job through a job interview. Usually it's through word of mouth and I can kind of bypass the whole interview thing because where do you begin? What do you say? Like, how do you say too much? Am I saying too much?  Or is that the wrong thing? Or how do I say that? Or, um, eventually it gets down to like, I mean, I've heard of this Alan guy, but I'm not quite sure exactly who is or what he does. But, um, he seems nice. Why don't you just give him a job? Um, do I need to mask? Do I need or do I should I be myself? So I'm asking is, is where you kind of pretend not to be neurodiverse? Um, it, it's, uh, it puts a lot of stress on the person. So the whole time you're busy stressing, uh, can I, can I stim? Can I not? That's, that's kind of where you kind of tap your foot to move around in a bit to, to comfort yourself. Interviews are terrible. Um, but the, you know, they're a necessary evil. So, so how do you do them in a, in a way that, that make people more comfortable? Performance reviews.  And the question is, okay, well, you know, if I wasn't doing my job, you'd take me aside and tell me that I'm not doing my job. So why all of a sudden do we need to discuss that right at the end of the year when there's no ways I can change what I'm doing anyway? So yeah, performance reviews. You know, you get into them and well, when I do, I get into them and forget all the stuff I've done through the whole year. It's terrible. And of course, flexibility. Um, so, you know, can, you know, can people work at home or do you need them to be in the office? Do you need to watch them all the time? Do you need them to do time cards? You know, as, as, as a consultant, I need to do time cards because we need to charge my time against the projects that I'm on. But I've worked internally and had to do time cards, which, you know, in some cases we actually tested them and no one actually read them. So what was, what was the purpose of wasting time to do that? And then of course failures. Now, the image on the left hand side is, is an image that I said I will put into every single talk I ever do because it's like such a cliched picture that used to pop up in every talk and then in kind of the early 2000s. So. But I think, yeah, it's one of those things where, as I said, it's great to have hackers and to have neurodiverse people. Because of their creativity and their respect for rules and their attention to detail, but also those things can work against, against them and against any organization. But creativity doesn't always just get switched on. You can't switch on creativity like the second cartoon will show you. Sometimes it jumps in at the exact wrong moment. It jumps in at the time when you least expecting it. Respect for rules. Neurodiverse people hackers will always respect the rules if they understand why they're there. But if there's a rule that's just made up and they have no idea about it, that rule will get bypassed exactly like, like on the picture on the left. Attention to detail is wonderful until you get someone who's neurodiverse and says, well, actually. And of course, hyper focus is, is lovely, but you can't just switch it on and off. Sometimes you need, you know, sometimes it only switches on at the, at the last, last minute.  And of course lateral thinking is lovely, but it can overwhelm you. It can stop you from even jumping into something because you just have no idea where to start or where to begin or what to do. So, yeah, there are a lot of places where where you can just unfortunately fail. Okay, so finally, why do I see. And I think my answer to you on that is why not you see there's a lot of offensive security people out there, a lot of hackers that have decided to go that way which makes sense, because it is interesting it is fun.  But you should never just stop with that. There's not that many, unfortunately, hackers in GRC. But those that are in are very useful. The idea of using creativity to try and work out how an organization can meet their objectives. Sometimes you have to be a bit creative. You don't have all the budget that you need. It's easy just to say, okay, well, we'll spend, you know, millions of dollars trying to keep out people that might be breaking into our organization. But if you now got half of that, or you got like a tenth of that, or you got none of that. Well, that's where the creativity comes in. Attention to detail. Some of the standards that we use are pretty detailed. And for good reason, understanding why they're done in that way, you know, can take some attention to detail some hyper focus some lateral thinking even just to get them to work. So what I'm saying is, you shouldn't limit yourself. If you are interested in doing anything in information security, and even outside of information security, doing, you know, any, any job out there could could benefit someone who's a hacker who can think, Hang on. This isn't a good way to do this. Let's do this ever so slightly in some other interesting and new original way. So I said I would give you a couple of ideas of, you know, things that I've done in the past. So I think you can see one of the ones that are most famous for right up on screen. This whole presentation is done in Excel. So what happened was, we were running a conference called besides Melbourne one of the besides. And it was in 2020. Of course, it was getting more and more dire as to whether we actually have it or not. Eventually, we pulled the plug. And it didn't happen. A lot of people were very upset with that that created talks and wanted to present them including myself. And so basically an organization, well, a conference got stepped up called ComfyCon. The idea being it would be a conference that could be ran from home. So yeah, shout out to Ian and Shana for that. And it was one of the best conferences ever. I highly recommend you take a look at it. Some really smart people and myself are presenting there. And it was going to be an interesting one. So back in those days, 2020, it's only three years ago, but it's a different world altogether. We didn't live on Zoom like we do now. So I was a bit nervous about presenting in Zoom. I was a bit scared about how to change between the different slides that I had. So I had different slides. And then I also had Excel stuff that I wanted to show. So I had graphs and all of that. And I was a bit nervous to move between them. So I decided, you know what, I'm going to tell all my Excel stuff and put it into PowerPoint. But it didn't look good. And it didn't feel right. And then I thought, you know what, actually, I'm going to take all the PowerPoint stuff, stick it into Excel. And then that kind of made my hacker brain excited. And now all of a sudden I had a challenge. And that's where I think I got really excited about my talk. And since then I've spoken at different conferences. So KrikeyCon was one of them. Blue Team Village here at Defcon in, which one was it, 28? So the one from remote. I presented that same talk. And yeah, it really was exciting for me to be able to present on the world stage. And yeah, with my little Excel spreadsheets, which my kind of hacker brain came up with as that might be a little bit interesting. And that's the one talk. The other one that I had, this one's way back when, and I always had on my CV a little line that said I created an April Fool's Day project. My boss came to me and said, you know, we need to do a bit of education. And you need to, you know, you need to show me that you can do some education across the organization. I was working at a company at the time, a large company with a few thousand users and stuff. One of my kind of KPIs was do education and it's like, okay, well, you know, how can I do that? Back in those days, there was no such thing as as kind of phishing tests or anything like that. So I kind of came to him and said, hey, listen, I have this this kind of Linux box that you've given me. And I don't really, I'm not really using it for anything. So what if I send like fake emails to everyone and then see who clicks on the links in the emails and he was like, really, that's that's an interesting concept. So we kind of put it together. It was supposed to go live on Valentine's Day. But I couldn't quite get it together in time. So we got it together in on April Fool's Day. And the idea being that someone sent you a postcard or whatever it was, please click through. Once people put in their names and email addresses and stuff that could go through to the next page. And when they did that all of a sudden, all I really had was it was a counter. And it was quite an interesting concept at the time. And I'm really happy that that my manager at the time who was really, really good used to be okay with all my crazy ideas accepted that. And so that was the April Fool's Day thing that that that we did together. At the same time, I wanted to do what we would now call the physical penetration test. So I reached out to, I didn't want to do it myself because that would have been a waste of time. I reached out to a few organizations that said, hey, can you guys do this? And none of them were really interested. In fact, one of the kind of big consulting firms said, oh, yeah, we can do it. We can do, you know, a kind of a test for you. And I'm like, okay, but you need to send someone out here and they need to do this, that and the next and they're like, oh, no, that's absolutely out of the question. So eventually I got a small organization who was also kind of full of hackers and stuff to pick up the challenge. And so we actually did that. So what I'm saying is, you know, in GRC, you can have these crazy ideas.  And it's always going to benefit both you and the organization at the end of the day. So I guess what I'm saying is just because you're in GRC doesn't mean you don't have to be a hacker. Just because you're a hacker doesn't mean you don't have to be in GRC. I think hackers are a way of life. And I think that, yeah, we should all try and aim for not only being a hacker but also being a kind and responsible person. And I think with that, I'm done. Pretty quick, half an hour. I'll leave my details here. And yeah, if anyone has any questions for me. Could you define GRC? Okay, no, I can't hear anything. So I guess my audio is going crazy. I'm going to jump out and I'll jump right back in. So if anyone has any questions. I can hear you x-ray. Oh, good. Okay. We haven't had the complete audio failure. Loud and clear over here. Aldebaran, can you define GRC hacker for or what GRC means rather? Yeah, sure. Okay, so do you want the official definition? Do you want my definition? Your definition because I hadn't heard the term GRC before. Okay. So GRC stands for governance risk in compliance. The idea being that people that will manage the governance of an organization also do some of the work in defining what the risks might be. And then of course I deal with any compliance requirements that the organization might have. Quite honestly, there's very little governance that I do in my day to day work. So the idea being governance is taking care of the fact that the organization and the people that actually have given money to the organization are separate. So there is a way of controlling that the organization does what the people who lent the money wanted to do. So there's very little of that in my day to day. There is a lot of risk, but risk is, I think for us, for information security is a little bit new. And a little bit kind of, I wouldn't say infantile, but there's a long way to go. So that's what risk is. Mostly we define risk at a big level. So the chance of you getting a virus on your network is pretty, almost pretty certain. Whereas an asteroid hitting your data center will be very, very slim. So that's what risk is. Compliance is generally making sure that whatever standards you're required to comply with you do. And also in some cases you may elect to use some of the standards that are out there because they're actually pretty good in that they're very well defined. So for example, your NIST standards are usually very, very well defined because they've got some really smart people looking at what needs to happen. Another standard would be the kind of PCI standards. So that's the that's to do with with credit card information. So if you take credit cards, you need to to adhere to what they do. Yeah, so that's kind of an introduction. I'm not going to jump too deeply into all of that. But if anyone has any questions around any of that, I'm happy to, to, yeah, to clarify. Is that good for you extra? Oh, yeah, that was a great explanation. Thank you. It's usually kind of seen as the least exciting part of information security because we deal with a lot of detail and a lot of almost checkboxes but not quite because you know to get to to the point where you can see that a box has been checked does take a lot of work. And in some cases, as I said earlier, a lot of creativity and a lot of working with people and a lot of understanding of how things work. So it's definitely something that that hacker can get their teeth into. Right. And it would also include things on the business side more than, you know, a lot of hacker folk are focused on very technical things with the GRC side opens up to the whole business aspect. Correct. Yeah. Yeah. But also, you know, a lot of the stuff that we do is actually very technical and and sometimes when you're dealing with the technical people that will try to talk around what you're asking. So if you have a technical background, if you know how things are supposed to work, you can sometimes stop them in their tracks and say, hang on a sec. You know, it doesn't sound like you're telling me what what I need to know. Yeah, what about banana? Oh, yeah, I forgot that part. Yeah, exactly. Yeah. And I see actually you've shared the talk that I was alluding to earlier, which is good. Thank you very much for that. Someone asked, is there a group on telegram for group for what? Defcon group or GRC group or not sure what kind of group you're talking about. Thank you very much for that presentation. It's quite good. I getting people to think outside the box of what hacking is is one of the things we talk about a DC for four meetings. I describe we describe hacking as discovering what something is capable of that the original designer didn't intend. So if you use a screwdriver to open a can of paint that was not the intended use to screwdriver. You can focus on networks and computers, but hacking applies to all kinds of areas where you do things that weren't expected with the resources that were at hand. So I could see where it could apply to GRC. Yep. Yeah, exactly right. Yeah. And that's exactly what my thinking was when when I've started up. DCG 11 613 was, you know, let's let's show how hacking can be not just breaking into into stuff how it can be used in very different in very different ways. Yeah. Okay, well, thank you very much for the opportunity and yeah, thank you everyone for for watching and listening to my talk. Great talking. Yeah, thank you.