"Through the Eyes of a Thief" - LMG Basement, 2019-10-10

This is a talk I presented back in the fall of 2019 -- what a simpler and more innocent time when we could all travel and gather easily! -- and I'm sharing it with you all now because a recording of it turned up and, while it's not an ideal capture of the material, I like the various stories and tips that I shared in this talk.
Some material has definitely been seen before, but other elements are new. Enjoy!
-- ----- ----------
this is my personal web site. most things i create wind up online...
deviating.net
this is my company. we're good at stuff...
enterthecore.net
this is where i train. come and learn badass skills...
redteamallianc...
-- ----- ----------

[@DeviantOllam]

As mentioned in the doobly-doo... this was an impromptu recording that isn't my usual caliber of capture but since a camera showed up, I was glad they gave me the footage. There was one battery change that took place about 80 minutes in (and we lose maybe a minute of the talk) but other than that and the imperfect audio... I'm still happy to share this with you folk!

[@brickchains1]

Love the long form lectures. You are a gifted speaker!

[@DeviantOllam]

@@brickchains1 thank you so very much :-)

[@northwiebesick7136]

LMG??? I'm new here and I'm wondering, what is that an abbreviation for??? **Edit** I read some other comments and one told me what I wanted to know

[@DeviantOllam]

@@northwiebesick7136 Lake Missoula Group

[@matthewkoch2904]

I love you vocab similarities between yourself and AvE man!

[@Bluehawk2008]

When I was in the boy scouts the cabins had generous gaps by the latch/deadbolts that you could fit a pocket knife into. With a little patience, we learned how to scrap the bolt along with the tip of the knife until it would trip and unlock the door. No pantry or kitchen was safe when the leaders were out.

[@77gravity]

We used this attack to open the top firestair door, giving access to the roof so we could parachute (BASE) from the building at 2am.

[@firefly5247]

The sequel to I'll Let Myself In that everyone knew they wanted! :D

[@DeviantOllam]

indeed... this is definitely the spiritual (and practical) successor to that talk.

[@Zedacon]

@@DeviantOllam I will pull that talk up from time to time to show to friends because its both interesting and genuinely entertaining. I have had many friends later come to me talking about stuff they noticed in their own lives that they could relate back to that talk. Might show this one to a few people at work to help nudge them in the right direction on security.

[@uberubermensch]

Had me double-checking that I still have a CH751 on my ring. It's Spectrum branded and labeled as CH751, because if you are a school and need to secure 30 laptops in a charging cart, CH751 will provide... Superb lifetime warranty though, would buy from them again if 2020 hadn't eliminated charging carts from schools. I also sadly have a Mesan 4444 key because I need it, I often have to be careful I don't pull the core out with the key :/

[@Teabagz4fun]

I’ll let myself in definitely opens folks eyes...

[@kruemel534]

@@DeviantOllam I was watching InRangeTV and wondered why you looked familiar, now I know.

[@JaxMerrick]

Be honest: How many here were listening to the video and guessing what Dev's going to talk about next? I may have heard some variation of these talks multiple times, but I just cannot ever get tired of hearing it. Thank you again for a new presentation, Deviant.

[@DeviantOllam]

i'm so glad folk didn't think of it as all redundant and needless

[@JimsEquipmentShed]

@@DeviantOllam That entire last segment was new to me. The well known material is like an old Rob White bit. “They call me tater salad.......” I half expect people to start clapping when the canned air comes out. ;-)

[@АнтонГусев-н5ю]

@@DeviantOllam Until everything you talk about (all the easy door bypasses) gets fixed in a majority of critical places, I don't think you should stop talking about it :)

[@connorhorman]

That was me as well. I've heard like 5 versions of this talk, and a few versions multiple times. Some new stuff though.

[@JaxMerrick]

@@АнтонГусев-н5ю This this this this this. The fact that Deviant has been a squeaky wheel for several years on these subjects shows just how much these security practices need to be updated.

[@KristoffDoe]

The last story - "Detailed dossier" - this was like some spy movie level stuff.

[@DeviantOllam]

it stinks that the camera blipped (i think due to a battery change) right as i was talking about how we used vehicles and had team members act as unhoused folk

[@mirkalimaricadie160]

@@DeviantOllam haha and here I thought it was like "Oops, I wasn't supposed to talk about that!" :D

[@KristoffDoe]

@@mirkalimaricadie160 Me too! I thought it was cut for either being "too hot for YT" or simply too long video. :)

[@dafoex]

I recall seeing someone from MI5 on TV talking about catching a terrorist or something of that level of importance (I could tell they were a spy because they had a pixelated face), and they specifically mentioned how they were sleeping rough, "stinking of my own urine" he said, in an alleyway where the target walked by every day. I'm not saying you have to go as far as this guy did, but it's an actual tactic used by very real spies.

[@murdo_mck]

@@dafoex Tom Marcus tells this story, or a similar one, in his book "Soldier Spy". The clothes were a disguise only. The end of his book is salutary.

[@Zedacon]

I inherited the security role I have now only in the last year from two guys who stopped caring. End of December one of our IT guys noticed a switch room door was left open. Its not got an alarm, no access control, just a standard lock. I pull up the only camera that can see it, which is at the worst possible angle, but it just barely sees the door. I start going back through the footage trying to see when it was last opened. I go back a few hours, its open, a few days, its open, eventually I'm back over two weeks before finally finding the point it was opened. And it was one of the two guys who had been handling security before me. And he opened it for the freaking elevator guys, despite that room not handling the elevators at all. It was like 30 seconds to just point it out I guess for some reason. Fortunately with basically no one in the building because of the obvious reason, nobody else went in that room during that time until an IT guy was in the office and saw the door open and put up the alert. This is large part of the reason we are now in the middle of a project to replace our entire physical security infrastructure.

[@djsnackcakes2795]

while I love your content since it appeals to the security enthusiast in me, it also helped with a design for my architecture electives thanks to your knowledge of building codes and your view on circumventing them. it really makes you think in both a builder and breaker perspective basically thanks for giving me a leg up in architecture class

[@Acela2163]

12:51 "Walking OSHA violation" is my new favorite insult.

[@livedandletdie]

That's Deviant's Title. Deviant "Walking OSHA Violation" Ollam... because he exists where he shouldn't. Like elevators checking Twitter, or playing Angry Birds, while charging his phone, browsing youtube, camping, taking a nap, firing up the BBQ grill, inviting the entirety of Iceland to join his Elevator BBQ, all meanwhile every guard and employee of the company he is currently in are totally clueless.

[@reedr1659]

That's everybody who does construction.

[@darthmartinez]

As a former Carpenter I used to hang and rehang a lot of doors and its amazing how many exterior doors I have rehung that were improperly installed with just nails and no screws or blocking behind the jam. The door knobs and deadbolts barely lineup.

[@TheCrimsonIdol987]

These talks are both terrifying and reassuring. Terrifying, because being a musician with tons of expensive music equipment, ya tend to worry about protecting your shit. Reassuring in that I love the easy solutions to protect and secure my stuff. Love your stuff Deviant! :)

[@smittywerbenjagermanjensen7027]

In that elevator story we learn the best technique; jargon is totally key to bullshitting your way into or out of literally anything.

[@Leo99929]

Even ignoring the quality of the content, this is a master class on how to do a power point presentation.

[@skepticmoderate5790]

I was impressed when he smoothly moved to the chosen story slides.

[@512TheWolf512]

power point presentations are extremely simple, if you actually have anything to present

[@512TheWolf512]

the last story is simply fascinating. you can NEVER know for sure if a literal SPY is or isn't right next to you

[@johncage5368]

Love watching your talks. Always so much fun.

[@DeviantOllam]

thanks so much! happy to entertain and educate

[@yuhuiwan9262]

The one dislike must be from the one of the security guard chasing him in the parking lot

[@DeviantOllam]

hahaha, maybe =)

[@fearlesscrusader]

Must be, I can't see any other possibility.

[@DEATH_TO_TYRANTS]

I truly think a lot of dislikes are accidents. I've gone back to videos I watched previously and noticed I had clicked the dislike button accidentally :(

[@mareli82]

i seen like 80% of this before , and it still never gets boring !

[@Sharlawuk]

Love watching these. Whilst some of these issues won't apply or be the same in the UK. It's amazing how much you notice after watching a few of these vids. Keep up the good work sir.

[@dafoex]

Codes and regs will undoubtedly be different, but it's shocking just how much stuff made for the US market makes it's way over here virtually unchanged.

[@johndododoe1411]

@@dafoex Fortunately, most brands of physical install gear keeps separate product lines for US compliance rules, accidentally limiting the spread of US stupidity. But we in Europe still suffer from a few things like Master lock and Yale products. Plus random US imports and our own bad products, that those of us in the know routinely replace.

[@RowenStipe]

I'm an irrigation tech and I often don't have access to certain areas but your vids have taught me many great ways to by-pass access with a 5 foot long piece of 1/2 inch pvc pipe.

[@Drunk-Mosquitos]

You are a great speaker. I love they way you setup your presentations. It shows that you truly love to teach people these things.

[@MarvinCZ]

I got to this video a bit late. It's a great talk and I love the lively audience. You also interacted with them nicely. I'm sure it must have been fun presenting for this crowd. I definitely second the idea of putting the untold stories (and the told ones, too) into separate "storytime" videos. Those stories are great fun and they illustrate how the individual weaknesses combine in a complete breach. They also illustrate the human aspects the best.

[@Kenionatus]

Also a KZbin friendly short format that could get a fair bit of love from the algorithm.

[@77gravity]

I could listen to his stories all day. What a life he has.

[@BlackSoap361]

My favorite is the security protecting the key that opens most city property in my city - the key most city employees carry is stamped “do not copy” and has a logo for the local locksmith who made them. Even that specific locksmith would make copies.

[@el7440]

its like stand up except the crowd is also partly terrified and are gonna call their contractors after the show

[@UncleButterworth]

It seems like the more "safe" we try to make everything, the less secure it becomes. Interesting stuff. Thanks for teaching me a few ways to not be victim to this so easily.

[@DangerfieldChris]

Every time I watch this I see something I forgot the first time, and it's been a few times now. great work, Mr Ollam.

[@fission1110]

Every time I watch one of your talks it's the best talk I've ever seen haha

[@TesserId]

Somebody needs to do a montage of LPL saying "this lock is shim-able".

[@inund8]

Or anything along the lines of "crucial flaw" or "vulnerable to low skill attacks"

[@TesserId]

@@inund8 Yeah, including the gun lock that can be defeated with a Lego toy.

[@AflacMan13]

Yikes! Can you imagine getting Dev's team and LPL together in a room?!? CHAOS! WELL OILED CHAOS!!!

[@Atlessa]

@@AflacMan13 Already happened. watch?v=O74Q1VTz4j4 (2 years ago even)

[@MikkoRantalainen]

@@Atlessa You probably want to see this video, too: LockPickingLawyer, BosnianBill, LockNoob and Deviant Ollam at Circle City Con 2020 kzbin.info/www/bejne/Y2WWg3iaZ9V0irM

[@MichaelBehrnsMiller]

So directly to the heart of the matter. Brilliant.

[@kdawson020279]

As a guy who used to have an instantly recognizable federal uniform [civilian], I will attest to the fact that looking the part and being confident are half the battle. All of the talks I've seen so far are incredible and exploit things I knew existed but I never knew how broad some of the implications were. Fascinating stuff.

[@handydigits1846]

Amazing! Should be a Netflix Docu. Comedy. Thanks Deviant.

[@DeviantOllam]

that'd be fun =)

[@TCFamas]

I can't iam dead when you tell old war stories it cracks me up!!! 🤣🤣🤣

[@PongoXBongo]

That towel in the hotel room door handle is a great trick! 👍

[@jayashrishobna]

This is so so good, thank you for sharing. Please consider aggregating the other stories and sharing them here too!

[@DeviantOllam]

I will!

[@ryanwilson_canada]

Excellent talk Deviant. Really enjoyed the deep (but not too deep) dive into all the topics. Even learned a few things. Hope everyone is staying safe, take care.

[@DeviantOllam]

thanks! hope you're staying safe, too

[@neruneri]

Oh you spoil us Deviant! Christmas came late, but it sure as heck came nonetheless!

[@TheMinecraftACMan]

If I ever run a high security building, I'm using your videos to train guards.

[@henrikoldcorn]

I've heard all about the under door attacks and all that, but man, every time there's a new story...

[@nickm9102]

I love all the talks about the common key cuts. For my job I have four keys that cover 90% of what I do CH751 is about 40%, an Abloy (I'm guessing master key) 40%, C415A 10%, the last may be a bit more secure as it has no name in the key but it has a code on the side 10%

[@gothops154]

In the past 24hrs I’ve watched so many of these videos and this was definitely the best delivery of the Armed Guards story

[@wobblysauce]

Every time... too short, love the work.

[@antonyloc]

Absolutely brilliant!

[@TrevorDennis100]

Goodness! I sat through the entire video first thing in the morning, because it was all so fascinating I could drag myself away. I've hear the armed guard story before, but it was just as good second time round, although Deviant put more detail for the cop aspect of the story last time.

[@narutowindel]

I've watched you do similar talks online but you were really in the flow state on this one for sure. Great work man ty!

[@Theminecraftian772]

I've seen this guy's presentation probably a dozen times over the years, and it's entertaining every time.

[@I0NE007]

Every time one of these videos pop up in a recommendation or by a friend sending them to me I always love watching the different techniques on display. Not just those by the pen testers, but also the recipients, the plastic scoops and the trackdoors. Always in awe of how calm you are during confrontations/interrogations while on the job and truly envy the level headedness. Definitely wonder if you've ever responded to "Who are you guys, why are you here?" with the "yeah, the building owners requested a pen test observation. Just checking any obvious egression flaws that should be remedied before the next annual progression meeting. Don't mind us, this is some basic stuff. Oh, speaking of, do you mind showing us to the guard post? It's a critical site to harden." And then ask for any guards to step outside for a while "to really get a good look at all the angles." Plot twist: this isn't a job hit.

[@joelnewman4839]

Thanks Deviant. Your explanation of the guard bolt got me looking at my front door, and yep, it was installed so poorly that the guard bolt wasn't engaging and I could open the locked deadlock (a decent quality Lockwood 001) from the outside with the first piece of plastic I grabbed. Took an hour or so to reposition the catch plate and install longer screws, but for the first time in years my house is actually locked :)

[@johndododoe1411]

Don't reposition the strike plate, buy the real one with the smaller hole that the deadlatch can't go in.

[@joelnewman4839]

@@johndododoe1411 thanks for the tip, but it's the correct strike plate. They are aligned ok, but the gap between the deadlatch and the strike plate was too wide, so I packed out the wood under the strike plate to close up the gap. Now there's only 2mm between them and the guard bolt engages properly.

[@Kanathil]

Hey Dev! I really, really love your talks. If not for covid, I would have tried to get to listen to one in person, though since I'm from Europe, it would probably be hard to get to one of these smaller talks, timing wise. Thank you so much for uploading these talks to YT, I'm looking forward to new talks from you!

[@TeddyRoooosevelt]

Thanks for uploading this. It was a delight to watch

[@DeviantOllam]

Glad you enjoyed it!

[@Rustmountain]

The Amanda Palmer quote is the most beautiful way you could have ended your talk with. Keep being awesome, you're making the world a less scary and better place to live in.

[@KelnelK]

The room that we had robotics club in at my old high school had a door that had a solid inch and a half of space under it. One day we were trying to get in and we used a piece of bamboo from outside and a bit of string we found somewhere to make an under-door tool, which we then left hidden on top of some exposed ventilation stuff on the ceiling outside in case we ever needed to let ourselves in lol. The worse the door fitment, the more options to open it with random garbage you find lying around.

[@fnerXVI]

I'm convinced y'all could pull off a heist after listening to a few of these talks. Glad you guys use your knowledge for good haha

[@joeb3300]

One of my favorite videos. Although commonly called motion detectors, I believe that PIR sensors do not, rigorously speaking, "detect motion". They detect changes in total infrared luminosity in the field of view. A person walking into that field will typically radiate more energy in the infrared part of the spectrum, brightening the field (increasing total luminosity), and triggering the sensor. In contrast, the dust-off spray creates a dark cloud (in the infrared) due to its lower-than-ambient temperature, resulting in less radiation in the IR. This is also detected as a change in total luminosity, a reduction in this case, which, if the change exceeds a threshold, also causes the PIR’s switch to open (if NC, or close if NO). The PIR’s switch is in turn wired to the doors electromagnet controller, perhaps a door control system like a Linear, momentarily shutting off current to the magnet.

[@Haplo-san]

It was fun, informative and illuminative. Thank you KZbin algorithm and DeviantOllam.

[@liesdamnlies3372]

Absolutely wonderful talk. I'm going into cybersec, and this is very useful information (can't have cybersecurity if your infrastructure isn't secure).

[@KylejvT]

Ive heard those stories a dozen times but they always get a smile and laugh from me. [Toasts some Bushmills steamship to ya]

[@MrFeupinha]

Once I was in Italy really drunk with some friends and the hostel locked us out because it was too late and we were able to open the main door with a credit card, didn't even took us a minute, first time ever trying to get into a building.

[@TrystyKat]

Hotel room deadbolts are even more interesting because they often aren't doing anything mechanical. On a certain brand (that will remain nameless until I get through the responsible disclosure stuff) the deadbolt thumb turn operates a switch that tells the controller that the deadbolt is set. The controller then denies access to valid credentials unless the credential has the deadbolt override bit set. If you have the ability to program your own credentials, you can set the deadbolt override bit yourself.

[@DeviantOllam]

Yeap... You can hear it when the interior thumb turn isn't doing much mechanically

[@jdcrow1982]

I am excited to watch, I'll probably be going to be when this premieres, but I will definitely watch it.

[@jpfeif29]

Def one of my favorite talks that you have done

[@tyleremery3246]

What kind of pointer are you using that allows that zoom in / highlighting of the slides? Thanks!

[@DeviantOllam]

isn't it great?! that's the Logitech Presentation Tool also called the Logi Spotlight.

[@ThomasAndersonPhD]

A master storyteller!

[@grapefruittango4707]

The door servicing story had me ROLLING on the floor

[@Redstoneghost133]

I found this video randomly and I had just finished some coursework and thought why not.. Well time to test this on my flat and surprise everyone

[@BlackRabbitVW]

I love your videos! I am thinking about doing pintesting because of your great videos.

[@Lintary]

A good eye opener for sure, this was a great watch.

[@cemprotecta]

Love it! Nice stories for rethinking security as a whole.

[@MeriaDuck]

21:39 that has to be one of the most literal security by-passes I've seen :-D

[@mjengel84]

Thanks! Ah, yes. The Olden Days when we used to blow on our cake before giving it to our friends.

[@freddoto]

Dev is such a great speaker.

[@AflacMan13]

You are not afraid of the darkness. You are not afraid of the darkness because it feels lonely. You are afraid of the darkness... because you fear NOT being alone in it! You fear the unknown. ;-) I love these talks. THANK YOU @DeviantOllam for making your channel!!! :-D :-)

[@DeviantOllam]

you are so very welcome!

[@ChildofGravity]

Great movie well worth the watch.

[@Citt1]

Nothing short of amazing!!!

[@Minionz]

I love watching these. This is great.

[@DeviantOllam]

Thanks for enjoying!

[@thsscapi]

You remind me of Scotty Allen from Strange Parts... You two kinda look alike (especially this bit @24:26), you're both passionate about your subject, love sharing and teaching your subject...

[@mosquitoskeet2189]

This was so informative! Thank you!

[@chrisherbert4454]

Here to hoping the end of 2021 brings back the Cons thanks for sharing the vid

[@dawnhero6439]

This was really entertaining, you're a great storyteller!

[@Gamer-ec8dv]

Hi! I loved the stories you told near the end. Are you planning on ever telling the rest of them? Maybe as a Storytime video?

[@DeviantOllam]

i could see doing that as future videos on my channel, if folk would like that

[@LinkTheSkyper]

@@DeviantOllam they definitely would

[@MarvinCZ]

@@DeviantOllam Absolutely! The stories are great fun and they provide better insight into how the individual aspects combine in an actual attack. They also show the human interactions the best.

[@KingBowserLP]

@@DeviantOllam I would love to hear them!

[@witmoreluke]

@@DeviantOllam Yep, that would be WONDERFUL!

[@punkymeadows5329]

The Amanda Palmer bit at the end was a nice touch.

[@DrTune]

incredibly action-packed.

God, latch slipping is so common. It became common knowledge in my middle school back in the day that you could open basically any locked door in the school by slipping a credit card in the crack, tilting it down, and pushing down to shove it between the latch and the frame. At least a dozen times I used that to get a jacket I forgot in a classroom after school, lol. The same tricked worked in my high school's interior doors iirc.

[@johndododoe1411]

You had credit cards as kids? I would have expected basic ID cards.

@@johndododoe1411 Yeah that's what they really were, or gift cards or something. Just said "credit card" out of habit but that's not technically what they were

[@jaimemunoz5920]

Would love to hear more stories. Also I have been doing this for a few years now. The apartment where I live has a call box. You dial a number for the person you want to see and the box rings their phone they press a number on there phone to let the person in. So instead of carrying my key fob I just buzz myself in. It takes a bit more time and can be a bit cumbersome but it is more secure. I mainly do it just so I dont have to carry a key fob.

[@DEATH_TO_TYRANTS]

If you've got a cloner, you can make a new credential and then carefully break it open and extract the goodies at which point you put it in between your cell phone and cell phone case. Likely this isn't necessary for your situation, but figured I'd share nonetheless

[@decnet100]

Entering a biomedical facility with an RFID reader by bullshiting guards and giving them weird hugs - and that, folk, is what you get when you let your kids play cyberpunk roleplaying games!

[@watdatdoo]

Lock Picking Lawyer: "That's what I've been saying!

[@mariusweber4990]

This is really cool!

[@Chronophylos]

What an awesome talk

[@peervermeiren8902]

Amazing content, albeit some key opening technicques are specific to the american market, the overall way of thought and especially the stories are amazing and really open the mind of the dangers and security gaps. Will recommend further.

[@arjovenzia]

excellent talk, people call me paranoid, but im quick to remind them 'security is only for the honest, there is always a way in'. we've just moved buildings, n my boss is a bit sketchy on the neighbors. Im tempted to try a few things just to really put the fear in him. but hes right to be worried, there are gaping holes all over. our 3rd day in the bilding, n I found a old school red/black bar magnet stuck to one of the door alarm sensors. obviously was giving false positives and someone just locked out the reed switch by slapping a magnet on it. and to end on an amanda parker quote, *mwah*. been putting off watching this for a while til I had time for it. rather this level camera and audio than some hollywood belch.

[@fearsomefawkes6724]

Bike story is great. I love that they didn't just grab their own bike to chase you.

[@slep1654]

That thumbnail is great! I wanted it to be a movie and the only anime I’ve watched is spirited away. Also, great presentation!

[@DeviantOllam]

Thanks!

[@lucadivine3862]

I thought this was going to be a collab video with Linus Sebastian of Linus Media Group where you help upgrade his office's security.

[@DeviantOllam]

that'd be neat. but, no, this was at Lake Missoula Group in Montana

[@p_serdiuk]

@@DeviantOllam If ElectroBoom could do it, you can do it :D

[@inund8]

@@p_serdiuk He wouldn't even have to ask, he could just invite himself in :)

[@Ryzza5]

Also that corner looks similar to the Linus MG meeting room (think when they pulled the blurry project prank) and also we know Linus makes sure that keys are blurred out in videos.

[@empoleonmaster6709]

I love your lectures like this. Could you please do a video covering the stories you didn't get to tell in this one?

[@mysteryshrimp]

I would love just a storytime series from you.

[@xzardas541]

In eastern europe where I live most residential area doors open to outside. But we do not have hingepins, hinges are usualy one piece of steel and they are quite big, and hinges like those you guys show are for wardrobe doors. And especialy in older doors there are 3-4 spikes that dig in into door frame when doors are closed so even if you grind down the hinges doors wont budge.

[@watcher333666]

Frequent travelers. Crying in 2021 lockdown tears

[@jjarechiga]

Amazing. Thank you!

[@Duende402]

Damn, this guy is a one-man A Team!

[@norigib6186]

Pizza delivery man here. Gated Communities are super easy to get into even without the keys. Just pull up to it, wait, look a little frustrated press the keys a couple time, and someone will pull up behind you, and just. Let you in.

[@hanif72muhammad]

Great talk

[@RurikLoderr]

This feels like a dream job, seriously... Even the camo stuff. I used to just do that with friends in the woods. We'd sneak up on each other, trying to get as close as possible without being seen.

[@scoo73r]

New Deviant Talk!

[@DeviantOllam]

yep! well, old talk... but newly published. =)