Cold Open And Introductions

Eric Brown 0:00

By listening to the sound of a rotating hard drive, the way the heads moved across the platter, they could recreate what some of the data was. So my gosh, that's interesting.

SPEAKER_02 0:16

You are listening to the audit presented by IT Audit Labs. I am your co-host and producer, Joshua Schmidt. Today we have the usual suspects, Eric Brown, Nick Mellum coming from Texas, as well as Eric Osterberg we have in the studio today. Eric Osterberg works with uh Gray Duck Locks. And then we have done some work with you recently around AI projects. Um one of the things that I wanted to bring up today and get into uh after we do a little bit of a lock picking demo here is to talk about uh hugging face and local LMs. Um we've been going hard here. Eric's been doing a lot of work on cloud code. I know Nick's been dabbling, and so have I. So would love to talk about the future of hardware and local LMs. So without further ado, Eric, give us just a little background about yourself, um, what you're working on right now, and and bring us up to speed.

SPEAKER_01 1:06

Yeah, for the past 24 months or so, I've I'm an early adopter, um, just in general, whether it be uh drones or 3D printing or what you know, whatever the latest trend is. I I like to I'm a full-time learner and um I've been using AI extensively, and um we've Eric and I have known each other for for decades now. I think so. It's been a while, uh, in in the InfoSec community. Um we we got connected and discussed, you know, some of the AI projects, and so I came to IT Audit Labs here to help out on a few of those projects. But yeah, right now I'm uh doing a lot of I guess vibe coding, you'd call it, or vibrating is watching next episode. Vibrators. Um I've been focused on the locksmithing business uh a fair amount, um, trying to ensure that my identity verification processes when I when I do locksmithing are a little bit smoother, that I don't put any of my customers' data at risk, but that I have it there, you know, to survive any audit requirements. Um, and then trying to automate the the workflow. Yeah, a lot of effort goes into quoting, making a key to a car. Um, people don't realize the complexity that's in a in a modern automobile. Um, you know, they're they're rolling computers these days. If you're driving a current model car, you might have 35, 40 different computers in that thing.

Eric Brown 2:35

And Eric, you're a pilot too, aren't you?

SPEAKER_01 2:37

I am a pilot. I've not flown a lot lately, but you and I need to get out there. Absolutely. Yeah. The hundred dollar hamburger is now what, a thousand dollar hamburger or more?

Eric Brown 2:46

Gas prices, it's ridiculous.

SPEAKER_01 2:47

Insurance prices.

Eric Brown 2:49

Yeah. Have you ever made a key for an airplane?

SPEAKER_01 2:52

Uh my own airplane.

Eric Brown 2:53

Nice. Okay.

SPEAKER_01 2:54

Yeah, you had a Cessna, right? Yeah, Cessna, a 1980-172.

Eric Brown 2:58

Oh, nice.

SPEAKER_01 2:59

So just

Why Lock Picking Fits InfoSec

SPEAKER_01 3:00

get an early adopter of a glass panel, put uh Garmin stack in there before WAS was a thing.

SPEAKER_02 3:06

And let's do a little bit of a demo here. I mean, a lot of the time you spent at the office today, I know this is something that Eric Brown is also very passionate about and has been exciting and asking me to get on the podcast now for for quite some time. So today we're finally doing uh a little bit of a lockpicking demo, or maybe get some new folks interested in this this hobby, which seems synonymous with cybersecurity experts.

Eric Brown 3:27

Yeah, there's a lot of crossover. Yeah.

SPEAKER_02 3:29

Why is that?

Eric Brown 3:31

We like to break into stuff, I guess. It's a nefarious activity in all of us. I see a puzzle, and can I get in there? Can you get in? Eric came into our office, found a lot of puzzles. I think we did we we have um not not key access to the to the main space. We have um digital access with a card. So Eric's like, yeah, you know, I'll be there at like you know eight o'clock or whatever. And I think I'd kind of forgotten exactly what time he was coming. Next thing I know, he's standing in front of office because he got through the puzzle.

SPEAKER_01 4:01

After calling you, of course, and getting permission. Of course. And and you I think basically said, if you can do it, go for it. Go for it.

SPEAKER_02 4:08

That sounds about right. So you've you've 3D printed some of these uh you can do with your hands instead of having to use a tool. Um, I actually got a little bit of time with you before we started today and and was successful a couple of times. Have you tried this yet, Eric?

Eric Brown 4:21

I have not.

SPEAKER_01 4:22

Do you want one? He's got one. Okay, yeah. Yeah. So yeah, for game night, I brought this particular demo of a lock and tried to describe lock picking. And um, you know, great, great model work. Appreciate the person who designed this, but I found I was actually I printed another one, so I'd have more than one for our show. And I've I found this model. Again, I should have let me interrupt.

SPEAKER_02 4:46

Just for our audio listeners, we're looking at 3D printed locksmithing um, I guess, puzzles, right? Yeah, yeah, yeah. And they're kind of gray. They got some red keys. We have some different pins here that you can insert and kind of create different combinations just for our audio. Yep, audio only listeners.

SPEAKER_01 5:02

It's a replica lock cylinder that is uh bigger than your fist. Uh, so you can actually pick the lock by sticking your fingers inside the keyway.

Eric Brown 5:11

Yeah. And and maybe just a quick level set on lock picking. The premise is you you have a key that you put into a lock, and and that key has ridges on it, and those ridges are raising pins to different heights in the lock. And when the heights are at the right level, they move the pins out of the way, and then you can freely turn the lock. And Eric, I know you can talk a lot about this, and there's different kinds of uh of locks that make it a lot more difficult to pick. But like if somebody were to go down to Home Depot and get the typical master lock with the blue ribbon around the bottom, are those relatively easy to get into?

SPEAKER_01 5:53

Uh, the padlocks, yes. Yeah. There's fewer pins, tolerances are so so. Um yeah, I think you did a pretty good description there, right? Cool. So traditional cylinder, uh, as you described, there's a key cut with particular depths. There's a matching set of pins in an inline row in in the lock that raises you and insert the key all the way. And uh, if you've got the right combination, then that uh stack of pins all line up with what we call the shear line, and that allows the plug to rotate inside of the of the lock body. Um so to pick a lock, what we're doing is we're taking advantage of the imperfections in the milling out of the of those stack of pins that that are lined up there. It's nearly impossible to get everything in atom for atom perfect row. You know, you're you're always gonna have the the drill profiles are gonna be just a little bit off center. And if you if you apply torsion uh to the face of the lock where the lock plug is, uh you can manipulate the pins and feel for which pin is gonna bind before another. Um and and that'll it will bind before another because you you can't really make a perfect row of drilling. So with a little bit of torsion on the lock cylinder, if you manipulate each pin, you'll find that one drags more than another. And if you manipulate it up just enough, you'll feel that friction change. And you essentially want to find the pin that's binding first, right? You you push up the binding pin. Um, you can kind of play with it with your finger. You want it to drop back down. If if it sticks also, then you know that you've got it stuck above the shear line. So if you're if you're pushing the pin that's binding to the point where when you let go, it still falls, you'll eventually drive the upper pin in the stack above the shear line and you can move on to the next pin that's binding. That's cool.

SPEAKER_02 8:01

I don't know if that no, that was for one of the listeners. That was amazing. Yeah. But this this particular model that you have allows you to get kind of simplified on that that concept and has four pins that are sitting in in kind of a into the uh what's it called? The tor the torsion. The key way. The key way, yeah.

Eric Brown 8:18

And maybe show that that thing there, because it's got a side cutout, the the red, the one with the red key in it.

unknown 8:23

Yeah.

SPEAKER_02 8:24

You got another model here that's more of a traditional lock and key. It looks backwards there.

SPEAKER_01 8:30

It looks like the delay, that's why it was backwards a minute ago. Yeah. There it is with the side profile. In a traditional lock picking here, you'd put some rotational tension with a tension tool on here, and you'd use another tool to reach in the lock and manipulate this stack of pins. Got it. Yeah. Josh got it.

Nick Mellem 8:52

Nice. I'm gonna need this file to print it.

SPEAKER_02 8:55

Yeah. Maybe we could share that in the show notes today. Sure. Or maybe you could tell people where to find it if they're interested to have a 3D printer.

SPEAKER_01 9:02

Well, I'm using Bamboo Labs. I've got uh Carbon X1C, and um, in the Bamboo Labs software uh on the home tab, you can just search for Lockpick.

3D Printed Practice Locks Explained

Eric Brown 9:14

Can we talk 3D printing for a second? Sure. So you have the like this has very fine lines in it, right? Uh and what's that type of printer called? Where it prints on top of itself? Uh FDM printing.

SPEAKER_01 9:28

And you're gonna make me remember that acronym. Filament something, something. It's okay. Um one of our 10 listeners or Google. Fused deposit modeling. Oh, nice. There we go. Okay. Deposition. I wouldn't have guessed that one.

Eric Brown 9:42

Fused deposition. So it kind of layers on itself. I I I I heard they were printing houses that way with concrete and and that type of thing, right?

SPEAKER_01 9:50

Yeah.

Eric Brown 9:50

But uh so that's one type, and then you have another resin type where it's kind of like dipped in the resin or something.

SPEAKER_01 9:56

Yep. So on on you have um like a plate or surface and you're using a like a video projector essentially to project an image out of that plate. It's using UV light, and the um printer's full of a fluid that uh the fuses when it's exposed to the UV light. So uh you you're projecting a picture while you slowly raise up. It's almost imagine a movie being shined on a screen that's that's sort of causing the liquid inside to fuse at those points where it made contact with the light. Um the models come out fairly sticky, and so you need to give them a wash uh and then set them under UV light or set them outside for an hour, and then then they'll cure more solid. Um because it's a video projection, um, just that that process, it it can be a much higher resolution.

SPEAKER_04 10:48

Yeah.

SPEAKER_01 10:49

Um and they're the the resolution on all these are getting better every year. Yeah, the the accuracy of the of the 3D printers itself. Their their ability to move to a coordinate and stop at an exact point, uh, is it's just phenomenal. They're and you can 3D print 3D printer. I think my first 3D printer was um the the idea was that you need vitamins. Those are the circuits and wires and and bearings and things like that. You'd you'd use vitamins, you'd feed vitamins into uh an existing 3D printer, and uh that that's how a new 3D printer was born. That's cool. Um I went to a local maker space and um printed the components for my 3D printer and uh assembled the vitamins and again being an early adopter there. Uh Joseph Prusso was still in high school at the time. Um some folks may know his name. He's well known in the in the rep rep community.

Eric Brown 11:50

Oh um Josh forgot to get him on the podcast.

SPEAKER_01 11:53

Yep.

Nick Mellem 11:53

Well, Pro Prusso, isn't that one of the that's the one of the bigger printers that people use that you can print like you were talking about, printing your own printer. Yeah.

SPEAKER_01 12:00

Yep. So uh Joseph Proofsa would be uh at home at his parents or grandmother's place, and uh in the middle of the night for him, you know, it'd be my evening, but in the middle of the night for him, he'd be chatting on IRC and we could discuss how the print went or what would make a print better, or wouldn't it be nice if we had. And um early on he was a great you know, CAD person. So if you the in the early days of 3D printing, most of us didn't know CAD, but we liked assembling stuff. We could if we could borrow a printer, we could make stuff and and bolt stuff together. Uh learning the CAD skill is where it really got cool. Um you know, right now, if if you're just starting a 3D printing, you see something online like this lock we're looking at, and decide that you want one, you can get a 3D printer, take it home, download the file, and you know, boom, you've got this thing. But it is so much more powerful when you imagine, wouldn't it be great if I had and could sit down with the software app and and draw it up and and then send it to the printer. That to me, that's very related to um AI as well. I think now you could probably have an idea that you want. If you can describe it to an AI agent, these large language models will generate the file for you. Now you can send that to your printer. So if you're a Star Trek fan, we're moving closer and closer to that idea of a replicator. Ah, nice.

Nick Mellem 13:27

So now I know what I'm doing this weekend. Now you're printing. I have uh bamboo labs also. It's uh Eric probably knows it's a P1S, I think. Yep. Uh yeah, so but it's not uh I haven't been using it very much in the past, you know, few months, but now I've got a project for this weekend to work with uh Claude to think up something cool.

SPEAKER_01 13:47

Yep,

3D Printed Keys And TSA Risks

SPEAKER_01 13:48

fire it up.

Eric Brown 13:48

And Eric, are you seeing now in the lock picking industry being able to print keys to to maybe get through a certain lock?

SPEAKER_01 13:56

I have heard of that. I have not I've not attempted that myself. Uh uh a very high-quality lock is gonna have tolerances that are greater than that of most 3D printers. Oh, okay. But I say most 3D printers and most high-quality locks, there's always the middle ground there. If you have a um we shouldn't name names and quit you know, pick on them, but let's say something manufactured in a country starting with C that's in the blister pack at your local hardware store and costs less than 35 bucks, odds are the talents are really quite low. And sure, you take that to a 3D printer and make yourself a key. Right. I'll give you an example. If you want to open any luggage lock that's compatible with the TSA's plan, uh years ago, somebody took a picture of a TSA officer's keyring, made a couple measurements, and went, hey, I can replicate all those keys and and published a set of keys. So, you know, TSA 001 through TSA 014, uh just download and print it, and there you go.

Eric Brown 15:02

There you go.

SPEAKER_01 15:03

Wow. And of caution, anybody who has typical security or I would say lower security locks, if you have your keys exposed, if you leave them on the uh the the table at uh Chipotle, you guys had Chipotle for lunch, right? Um, leave your keys out on the table, um a quick photo and and you're done for.

Cameras And Acoustic Lock Attacks

SPEAKER_02 15:27

We're gonna share this comment real quick. Are we close to seeing AI-powered robotic lock picks that can decode a lock in seconds just by analyzing the acoustic or haptic feedback of the of the pins? That's interesting. We are well past that. Are we? Can you give us a little bit more context there? A little bit more uh what's going on?

SPEAKER_01 15:45

Sure. Um we have micro cameras that are the cameras essentially the size of the key. So you you just basically are shooting a video as you put your key into the lock. And certain locks have been designed in a way where if if you could be small and be inside and look in a particular direction, you can actually see in in particular. I'm talking about those keys that allow you to re-key them yourselves. You may have one, I think both Schlag and uh QuickSet have this where you you you put in the key that works right now, and then you insert another tool, uh rotate the lock to a certain position, allows you to pull out your old key and then put in the new key that you want to be the key for your house, and then you pull out that special pin and and reset the lock, and now the lock's been re-keyed without hiring a locksmith. It it's good to go. Well, the the design of that has a bunch of serrated uh columns essentially. When you're when you're inserting the tool, you're separating the serrated columns so you can you can realign the points. When you insert the new key, that that's how everything kind of lines up. Anyhow, there's um there's now an app and a camera where you just slide that into the lock, and then I can go back to my machine and say, cut my one of these five three five one threes and uh you know I've I've got the new key.

Eric Brown 17:10

With with that vibration question and and kind of continuing on with what Eric was talking about, I I had read somewhere maybe a couple of years ago that they were able to pick up the vibration off of the glass using like a la laser from far away and be able to reinterpret what the conversation was from the sound waves that resonated on the glass. And then I think maybe it was two years ago, I saw that by listening to the sound of a rotating hard drive, the way the heads moved across the platter, they could recreate what some of the data was. So that that's interesting.

SPEAKER_02 17:52

That reminds me of that Operation Ghost Murmur where they found the guy in Iran, the pilot using AI to listen for his heartbeat, and they probably had his personal heartbeat signature on some uh kind of uh of a info sheet and compared it to what they were listening to in the environment in front of them.

SPEAKER_01 18:12

But yeah, uh you've probably seen the mapping with Wi-Fi also. Yeah. Another one. There's quite a few things like that. I I don't know how practical it is. I I don't fear that a whole lot.

Eric Brown 18:24

What's Eric? So one of the things that maybe you've seen that's kind of crazy when you get called out to say, you know, like, oh hey, I can't get into whatever, and they call you out. You've you've had to show up and there's some weirdness going on or something interesting. Yeah. Eric, didn't you tell me that for game night we were going to break into somebody's car? A volunteer's car. Right. Right? We're gonna do that. Sure. Are you volunteering now? That's a cool story that that you know, I think most people don't know the capabilities of what a locksmith can do.

Safe Cracking Machines And Hotel Myths

Eric Brown 19:00

And you can get into just about anything with the right tools and equipment, right?

SPEAKER_01 19:05

Sure. And there's different specialties as well. So I I specialize in automotive. Um, I've got friends that are in the commercial lock and safe sort of business. Safes are another good example. You you mentioned the robotic, you know, can you open a lock? There, there's a device called the soft drill. Everybody's Googling for that one as well. Those are um are very rare to find now. The manufacturer basically said I sold enough of these. I think uh certain agencies of our government that may or may not have three or four letter acronyms uh kind of controlled that because they're very good. Safe manipulation uh is is a skill that you can learn, and so can robots. And so the soft drill can open a safe much, much faster than um than most people need to be able to open a safe. Uh if you're a locksmith, of course, you're making money if you fix price to open a safe, right? You'd you'd rather be gone in 15 minutes and make a boatload of money than attach a machine and wait 13 hours. But um there's a TL2000 dialer. Most of the safe people that I know are are using that. That literally just manipulates every combination until it senses the lock is open and it stops. Um but for electronic safes, you most of the electronics are inside the safe, just the battery and the keypad is on the outside. There are devices on the market that will plug into the keypad bus. And uh, you know, five, four, three, two, one, she's open.

SPEAKER_02 20:35

Looks like peep people are making uh these uh soft drill brushes by using a uh electronic toothbrush. Different thing. Totally different thing. Okay. It looks like this is a lockpicking mechanism, though, yeah.

SPEAKER_01 20:46

Yeah, yeah. The the soft drill has a um a microphone and a uh servo with feedback that attaches to the dial on the safe. And it it will swing the dial around, listening to the acoustics, and can detect when components within the lock are bumping other components within the lock that allows it to decipher how things are aligned. If you know how things are aligned and where where the contact points are, uh it very quickly knows, like, okay, here's the combination.

SPEAKER_02 21:21

I gotta I gotta start hold that thought, Eric. I gotta share this comment. This is my this is why my door has uh porticules and draw bars installing a drawbridge next year. That's from Faye 9915.

Eric Brown 21:32

Faye's a regular listener, I think.

SPEAKER_02 21:34

Yeah, we'll get to all your questions, but Eric, you had to do it.

Eric Brown 21:36

Yeah, no, I did. So with Eric Hotel Safe, right? Like you go into the hotel and I think there's a Darknet Diaries episode where the guy um was a poker player and um they they got his laptop and installed some stuff on it and what have you. But it how do those is that just an illusion of safety?

SPEAKER_01 21:54

Uh yeah, if if that a lot of the safes in hotels are You know, bulk manufactured, another country starting with C. Maybe that other one, same one. Uh many of these are opened with just a uh a magnet. You know, there's there's an electromagnet inside of it to release the lock. Carry a big fish. You can go fishing. You can you can do magnet fishing. The lake fishing. You just drag a large magnet behind your boat.

Nick Mellem 22:22

You go like go over a bridge and drop it down on the rope and yeah.

SPEAKER_01 22:26

Yeah, totally. But you could you can pick up all the the safes and the firearms and the every other piece of metal that's discarded in the middle of the night over a bridge. Have you guys done this?

Nick Mellem 22:38

Eric's acting like he hasn't done it before. That's the kind of fishing that might be might be interesting.

Eric Brown 22:42

We may have to do an expedition this summer, Eric. I uh now I've scuba dived, and when when I was scuba diving uh in in rivers, like this is you know back in high school, they would say if you see a um bag underwater, do not open the bag. Um because you're not you're probably not gonna like what you find. We we found a bag. We did not adhere to the guidelines. We opened the bag and it was just full of sand from a construction thing. Uh okay.

SPEAKER_02 23:10

Sandbag. We got another question here if that the that's

Car Key Security And Crypto Reality

SPEAKER_02 23:15

okay. Um this is again from Joshua Morgan Goldstein. Comparing something like a minimalist Volvo to a high performance Porsche, who is winning the digital arms race against the uh against relay attacks and the key cloning, or are they both wide open to the exploits?

SPEAKER_01 23:27

Volvo's ahead, I would I would say. Um and I would say European vehicles in general are far ahead of domestic vehicles. Why why is that? Yeah, so uh typical key for a domestic or Asian vehicle, there's a serial number burned into the key, and during a programming session, we tell the car, okay, now I want you to trust this key, and uh the process is done. In a typical European vehicle, we have public-private key encryption and challenge response algorithms going on between multiple computers in the vehicle. Your key contains a private key burned into the the chip itself at the factory. And um, if if I as a cyber security auto locksmith open up the computers and get in there, I can extract the public key. Uh gee, what am I gonna do with that now? I mean it I I I I call it public key, but it's a little different, right? You've we've got an asymmetric key pair. Um but there's a lot of brute force cyber work necessary in order to come up with the matching key that's gonna make those handshakes work between those modules. So when you make a key to your uh we'll give Audi some credit here. When you go to Audi and order a key for the $600, they are just putting the order in the assembly line and you know, out comes a blank key. They write the codes that they knew when they built the car and its key and they send it to you in a huge profit margin. When I get the call to make a key to your Audi, you don't want to watch. It's like making sausage. Just look the other way, I'll be done in four hours. Um we're gonna open up those computers, peel back the metal on the cans for for for some of the more difficult ones, uh, desolder certain integrated circuits. We're gonna do the things we need to do to get uh MCUs or EE proms to dump their goodies. Those goodies are gonna go up into the cloud. I have subscriptions for products that also came from a company man manufactured it in a country with starts with C or R. They're very good at their work too. Um we're essentially reverse engineering the security mechanisms on the hardware and then brute forcing those keys in order to come up with the secret in your key.

Eric Brown 26:02

It seems that the Volkswagen group actually owns Audi Porsche and other brands like Lamborghini and Bentley. Yeah. So if you're getting a Lamborghini, it's the same thing as a Volkswagen. Same thing.

SPEAKER_01 26:18

Some of these cars that you might call exotic cars, the ones you expect to have the best security. Yeah. It's they put all the money in the in the paint and the polish and the delivery.

Nick Mellem 26:30

Nice. So, Eric, you're telling me my F-150 key is pretty easy to clone?

SPEAKER_01 26:35

Until 2021, when Ford totally uh changed how they go about things. Um I have a 2021 Ford F-150. The um electrical system was modeled after the Mach E, and the Mach E was designed to sort of compete with the Tesla. That was the beginning of uh self-driving and you know, much more modern architecture. So the the process requires factory tools and um a VSP, uh vehicle security professional certification from NASA. Uh Ford restricts access to those functions to folks that are vetted with uh licensing insurance and and so on. And then in 2025, it gets even more interesting. They introduced encryption between all the modules. And so um I have a self-driving vehicle. I I bought the Ford for the Blue Crews and the ability to do self-driving, but um didn't like the idea of paying the subscription fee. And there were new features that weren't available for my older vehicle, so I've got a comma AI and I run blue pilot software. That's a whole plug. But

Comma AI Driving And Human Behavior

SPEAKER_01 27:40

yeah, I've heard of that. I've heard of that.

Eric Brown 27:43

Who's the guy that started comma AI?

SPEAKER_01 27:46

Uh I can picture him and I'll walk right up to him at DEF CON and say, hey, how's it going? Yeah, but I cannot remember his name right offhand.

Eric Brown 27:53

Didn't Musk try to hire him or something, or he worked over there for a little bit? George Hotz or that's what it is. Yeah. Yeah, GeoHotz. Yes, John. So how do you like the comma AI? Because you just plug that into the bus, right?

SPEAKER_01 28:06

Yeah, it works on a number of vehicles. Um, so check it out. You don't have to have a Ford F-150. Um and and primarily he's doing hardware sales, right? And then promoting the idea of software development. Um there is open pilot, which is the the generic uh driving module for does things a little differently. So we've got blue pilot, a fork of that code. Uh, but yeah, the the wonderful thing about it um is that it will plot a course through whatever it sees. If if your truck ends up in a cornfield and you kind of want to go that way, um you can turn on cruise control and keep driving through the cornfield. Set your speed and you know, pay attention to the road, right? If you look off the road, the thing will uh refuse to drive for you. Um But but there's probably hacks around there.

Eric Brown 28:56

A buddy of mine's an airline pilot, and he he said that there's some some some of his other pilots that, you know, they're they're home-based in say Minnesota, but they live way far away, like way up north somewhere, and they've got to commute from way up north wherever they live down to MSP for you know their you know, their shift. And sometimes they'll come back, you know, late at night or whatever, and then need to go home. They have this comma AI system, and like they're sleeping on the way home. And I mean, this is hearsay through hearsay, but yeah, it's uh it's interesting.

SPEAKER_01 29:35

There's a there's another whole talk there, I'm sure. Yes. There are separate teams. There's a camera that watches the driver, and then there's the camera that watches the road. In fact, multiple cameras watching the road, but the camera that watches the driver, it is open source, you could theoretically manipulate that. Um they have a practice of monitoring for all forks, and the hardware is designed by default to pull from your GitHub repo. Give it a URL. There are some safety mechanisms in there, and if you attempt to bypass the safety mechanisms, the community will attempt to bypass you because that's not good for safety in general. And the last thing any of us want are regulators deciding that they know best for us.

SPEAKER_02 30:22

We had tinfoil hat coming on here, guys. Here we go.

Driver Monitoring Laws And Privacy Tradeoffs

SPEAKER_02 30:26

Here we go. Uh I mean, this has been kind of brewing in the background, but it looks like there's just been some legislation passed driven by the 2021 Infrastructure Investment and Jobs Act, requires automakers to install advanced impaired driving prevention technology in all new passenger vehicles. The mandate directs the NHTSA to finalize rules require built-in passive monitoring systems such as cameras and sensors to detect driver impairment fatigue and distraction with the authority to limit and prevent vehicle uh operation. So uh I've been seeing this a lot on YouTube. There's been a lot of commentary on this, and in most of it negative, as you can imagine. Where do you guys kind of fall? I I kind of see both sides, right? No one wants to be we want to we want to be free, right? We want to be able to get into our car and we don't want to get shut down because we didn't get very good sleep that night or we had a cold or something like that, not be able to go where we want to go. But also, we've all seen these terrible drivers on the road that have no business being behind the wheel. And it would be great to take them off the road. So uh where do you guys fall on this one? Kind of as the intersection. Maybe this is our our transition to AI, right?

SPEAKER_01 31:32

Or or gun control or any other uh topic. Don't get us into that. I eyes expanding in the room.

Nick Mellem 31:40

I think I think a lot of people are just getting a piece of electrical tape to go over the camera.

SPEAKER_01 31:45

It will stop driving at that point. Um you're for it or are you against it?

SPEAKER_02 31:51

That's that's kind of what I'm looking for here.

SPEAKER_01 31:53

Yes. Exactly. Yes. I I think that uh taking advantage of where technology has led us is is a great thing in general. Um I I think like a lot of laws, they're great when they apply to everybody but me. Rules for thee and not for me, huh? Yeah. So I don't know, right? I'm I I'm a libertarian. I I definitely support our freedoms. I don't have to even mention Second Amendment or anything else. I've said enough. Um I think that uh the technology is incredible.

SPEAKER_04 32:34

And I think it's walking on eggshells. I think it's I think it's a good idea for most.

SPEAKER_02 32:41

Nick, do you want to weigh in on this, Mr. Marine?

Nick Mellem 32:43

Let's make it heckable and then I'm cool with it. No, I kind of go both ways too, honestly, because you know, if somebody's impaired driving, I certainly don't want them on the road if I'm on out there with my family, right? So that's the the logical thinking. But I certainly don't want my space, you know, invaded if I'm getting in the truck to run across the street to the grocery store. So I guess overall, if I had to pick, I'd say I'm against it.

unknown 33:06

Yeah.

SPEAKER_02 33:06

Eric Brown, you got some thoughts on this. I I've been curious.

Eric Brown 33:09

I do. Um what were they? I was distracted by the headphones here. About about being monitored in your vehicle. Oh, yeah. Well, so okay. I uh we've got a client that some of the people in the organization are refusing to take phishing training and they are still clicking on phishing emails, but then when they're told about it, they're like, oh yeah, I I clicked on it on purpose because it was, you know, I whatever, right? It's some excuse. And it's like just owning it, huh? Yeah, just so you know, when you have people like that that, you know, with that mentality in the public space, I I would want some sort of guidelines and structure so that, you know, I know somebody just didn't homebrew something in their garage and now they're ripping down the road at 110 and like, oh whoops, I forgot, you know, to put this on. It's, you know, I I kind of go to the aviation community that has been using autopilot for decades and it works really well. And and there's been refinements with terrain avoidance over the years and air traffic control, and it's gotten better and better. But you know, you you really could not fly in instrument meteorological conditions without autopilot. Like it's strictly it's simply safer like to to fly with with autopilot, because you can get spatial disorientation. You know, if you're if you're flying in the clouds and you're getting you know buffeted around from um weather and you've got rain or snow or whatever coming in, um there's a lot of environmental distractions. And if you're trying to fly the plane or you're getting bounced around and you know, trying to figure out where the horizon is, and your vestibular system is telling you you're in a turn, but you're really not. So you're you're straightening that out. You know, it's just it it's what happened with JFK Um Jr. up in the Cape, you know, where he where he kind of who was not instrument rated. So he he he probably wasn't aware of all of these things that can happen, but you you really want to be on the instrument system and and you want to be relying on the plane to to fly itself. And you know, we've been doing this for years in in aviation. So I would love to see it on the roads. The experience that I I have with it is it's a better driver than most. It's safer.

SPEAKER_02 35:38

Aaron Powell That's a little different than uh being monitored, right, in your vehicle, like having a having a self-driving car or an automated driver.

Eric Brown 35:46

I think it's because that's where we're at level two today. But when we get to like level, what is it, four where we don't, you know, that you don't need the monitoring because the system's better than you are.

Nick Mellem 35:54

Um that's actually a question in the chat about um when are we going to get to level five?

SPEAKER_02 36:02

I hope it's Eric, how far away are we from level five?

SPEAKER_01 36:06

Ten years. Early adapters six, general population fifteen?

SPEAKER_02 36:12

It it the technology is probably close. It's just all the regulations. And then there's that conversation of who's responsible if something goes wrong.

Eric Brown 36:19

Yeah. The the litigious side of it. And then when we're gonna get into smart contracts and all of that sort of stuff, which is just a different conversation. But I I don't know, is the technology six and then the legislation's 10?

SPEAKER_01 36:31

Yeah, I'm I'm I can't predict what legislation's gonna be up to. I I was thinking we can pivot right to privacy and talk about AI here as well, the private cloud. Yeah.

SPEAKER_02 36:47

Do we want to cut this one in do a double episode? Double it up. Let's keep going.

SPEAKER_01 36:51

I think when we're talking about the the monitoring of drivers, right? If if that is totally a local thing and that data is my data, it's not going anywhere. It's just my cars keeping me safe. And I have the option to override, you know, like that. It's a safety feature that's built in. We all have it. And when the thing says you're not safe to drive, um, if I can go on the record saying I think I was safe to drive, I'm more cool with it if it's totally local. But I already do not like the telemetry that's in a lot of vehicles.

SPEAKER_02 37:26

You're saying, and that's a sober, that's a sober take.

SPEAKER_01 37:29

Yeah, I mean, you're your cars today are are sharing a lot of data with the manufacturer because manufacturers are selling that data. Sure. Um, you know, how many of us are Google customers? Uh and and I say that because you know, if you're not paying them, you're the you're the product, not the customer. I I I love the things that are built into my phone and integrated in my car, which is nice as well. You know, I had this uh had this appointment to come here for for the podcast, right? I I got in my truck and it knew where I wanted to go. I just kind of hit the button and then turned on reverse control in my driveway and and it was a fun, safe drive. But um Google knows where I'm going and follows everybody else around, and that data's useful, so that I I took the best route. If there was a traffic jam somewhere, we we went around it. So it's it's the love-hate thing. Um, and I'm rambling on a little bit, right? But I I don't like that car manufacturers are keeping tabs to the extent that they are. Um, that when you buy a car now uh buried in that mountain of paperwork, it's worse than closing out a house. And and I've done both recently. Um it there there's a license agreement with your car, and you don't necessarily own the software. And if you turn off the telematics, you've just ended your warranty after 45 days and and some other interesting things like that.

SPEAKER_02 38:53

So I don't like that.

SPEAKER_01 38:54

I don't like that. So you could ride a bike.

SPEAKER_02 38:57

Or I could buy an old used car for now. What kind of bike do you have? I don't have a bike. Yeah, you might get the telemetry to your bike uh motor.

SPEAKER_01 39:06

Do you want to pedal yourself or are you gonna hit the go button? The go button. Okay.

SPEAKER_02 39:10

It's like plow schwab. If I put my tinfoil hat back on, uh, you will own nothing and you will be happy.

Key Cutting Automation And Lock Advice

Eric Brown 39:15

I I did have a locksmith question for you around the European cars you were saying. Every time I walk into Costco, and Costco's getting ridiculous now, which is a whole nother thing, but every time you go in there, you're getting accosted by these people. Like it's either phone or I think last weekend I I went in there and like they're they're trying to like, you know, can can we clone your key or make a copy of your key? And uh you can barely walk past them and they're like, you know, they're trying to flag you now, which is ridiculous. But um, how are they doing that with the if if people have European cars?

SPEAKER_01 39:46

Aaron Ross Powell They they don't actually work for Costco. They're they're just a third-party vendor that that finds their locations convenient to work in. I'm gonna have to go to Sam's Club, I guess. Those folks have access to I mean they've got insurance, they've they've got training, I mean, they're able to get access to some of the same tools. I see. I don't think they're on quite the same level. Very few of the folks standing around in uh Costco are cybersecurity guys who play with microcontrollers that understand, you know, public-private key encryption and what the process is. They're I don't want to know somebody, but no, they're just following the colour. Yeah. Yeah, the majority are opening the app and logging in and clicking next and next and next.

Eric Brown 40:32

And you can cut your own keys now at Home Depot, I saw, right? Like you just walk up to the machine, you put your old one in, and the whole robotic process does it.

SPEAKER_01 40:40

Yeah. Let's get in there. Take a picture, it determines what the cuts are and runs the machine. My machines are that way now as as well. I take high-resolution pictures of keys, uh, goes up to a database and says, okay, what should this key have been? Um and then sends it to the key cutter, which is basically a C and C machine that that cuts with absolute precision, you know, built for that. It's it's kind of cool. Um, I've I've worked on brand new vehicles. Someone's getting the third key because their you know, kid is also going to be the user of the brand new car. And um I can actually tell from with my scanning equipment if the manufacturer had a fresh blade when they cut their you know, never used key, or whether you know, maybe they had cut 500 keys and they were just about to replace the blade. Um these are keys that I, you know, the but the owner of the vehicle didn't realize that they had a key inside their key for the mechanical lock, or that you pop the cap off to get to the to the keyhole.

Eric Brown 41:42

For for game night Eric uh in uh what are we coming up on? August here? Yep. I think it's August 1st, maybe the first Wednesday of the month. I think we got to get into somebody's car. We'll we'll pick a volunteer. Is it gonna be Cam? Who's it gonna be? I think it's gotta be Eric. It's gotta be Eric.

SPEAKER_02 41:55

August 5th.

Eric Brown 41:56

August 5th.

SPEAKER_01 41:57

Tesla gets a little more interesting. But I now do stock the cards. But uh you'll do your own duplicating. I can just hand you the card, I believe, and you do the rest of it. Interesting.

Eric Brown 42:06

Okay. We're gonna we're getting into somebody's car.

SPEAKER_02 42:09

I won't be here. Okay. You guys gonna have to find another person. Grey duck lock picking. Grey duck locksmithing? Or what is it? Which what's the name of it? Uh Grey Duck Locks. All right, gray duck locks for Grey Duck Security LLC. Duck Duck Grey Duck Corporation. Yep. You know it's not uh, you know, you know it's Minnesota because it's not Duck Duck Goose, right?

SPEAKER_01 42:29

That was the idea. I was getting a little older, a little more gray hair, and uh trying to come up with a company name, but I wanted to scream Minnesota Company. Sure. Not the guys hanging out in Costco, not the call center in New York that's you know dispatching to a guy who downloaded an app and wants to play locksmith this weekend because you know, saw a YouTube video on it. Um Minnesota, we called this pop. Soda.

Eric Brown 42:53

Soda. Eric, if somebody wanted to get a really good lock, um what's a good brand?

Best Lock Brands And Wrap Up

Eric Brown 43:00

Is it like an ambloy? What what would you recommend?

SPEAKER_01 43:04

Uh Asa, Abloy, Kaba, all of these are pretty much the same company now. Um multi-lock, medico, you know, CA commercial locksmith professional for the best locks. You you've got grade one, grade two, and grade three locks. The stuff we find at the traditional hardware store, I'd call that a grade three or three and a half. Or the the packaging is more resistant than the lock itself. Where's the opening that thing?

Eric Brown 43:33

Where do I get the grade one?

SPEAKER_01 43:35

Uh grade one you'd get from a professional distributor. Now, with today's distribution, if you know what you're shopping for, you know, I'm sure somebody on Amazon will send it to you, or wholesalers are happy to create a new account for you in the hopes of all your future business. Um you you can get the hardware in a lot of places. Um yeah, see a professional where it's not that expensive to work with somebody who knows what they're doing. You know, if you try to repair things yourself, often it costs you more than if you hired the guy who has the jiffy tool that does it in three minutes. You didn't need to spend 90 minutes packing your door frame up only to find it doesn't fit. You're here.

SPEAKER_02 44:17

Well, thanks for joining us today, Eric. It's been really fun talking about locksmithing. We got a lot of lock talk happening here today.

SPEAKER_01 44:24

Lock talk, right? Yeah, lock it down.

SPEAKER_02 44:26

Yeah.

SPEAKER_01 44:26

I wanted to extend a minute and go to AI for the we're out of time on this one. Okay.

SPEAKER_02 44:32

But uh, we're gonna have to have you back because I do want to do AI on-prem, um, large language models and local LMs too. So we'll have to schedule to come back sometime soon. But uh that wraps us up for today. My name is Joshua Schmidt, your co-host and producer. You've been listening to the Audit podcast. Please like, share, and subscribe. You can find us wherever you get your podcasts. We are now streaming with video uh on Spotify and as well as Apple here pretty soon. We've been joined by the usual suspects, Eric Brown, managing director of IT Auto Labs, and Nick Mellum. And our guest today was Eric Osterberg. Dr. Nick. Dr. Nick, yes. Eric Osterberg is Grey Luck, Gray Duck Lock. And you can find him on Google. Just uh search Eric Osterberg on LinkedIn or Google and you can find Grey Duck Lock. You've been listening to the audit presented by IT Audit Labs. We'll see you in the next one.

Eric Brown 45:20

You have been listening to the audit presented by IT Audit Labs. We are experts at assessing risk and compliance while providing administrative and technical controls to improve our clients' data security. Our threat assessments find the soft spots before the bad guys do, identifying likelihood and impact, or all our security control assessments rank the level of maturity relative to the size of your organization. Thanks to our devoted listeners and followers, as well as our producer, Joshua J. Schmidt, and our audio video editor, Cameron Hill. You can stay up to date on the latest cybersecurity topics by giving us a like and a follow on our socials, and subscribing to this podcast on Apple, Spotify, or wherever you source your security content.