 Great. Thanks very much for coming again to DEF CON. I'd like to introduce our team. My name is Mark Tobias. I'm an investigative attorney and physical security specialist. This is Matt Fidler, physical security specialist and covert entry tool designer. And Tobias Blues-Manus, who's my partner and another physical security specialist and has been a working locksmith for a long, long time. We're going to talk about today a really interesting case, very serious, little bit different topic for DEF CON. We always talk every year about physical security. Today we're going to talk about some ramifications of defective security designs. And we call this insecurity engineering. Today we're talking about gun saves. Design defects and security products that have real consequences for protecting lives and property. We'll go through how we got involved in this case. And then we're going to show a number of video segments that will probably surprise if not shock you as to the simplicity of opening a lot of very popular gun saves that everybody relies upon to protect their weapons. So we're going to talk about design deficiencies, the analysis of defects, methods of attack, consumer products that are not secure, electronics does not mean security. And as I said, we're going to run some video clips. And hopefully if we have time at the end of our presentation, we'll solicit comments from everyone. And then we're doing a Q&A in room three. We brought a number of small gun saves. These are not large saves there like that to mount on a shelf. These are the saves that we analyzed for this presentation and more importantly for an investigation that we're involved in involving a death of a three-year-old child. And so in our world we deal with design defects and deficiencies all over the world in locks and saves. This has no more importance than anything we've ever done. So today we're going to talk about gun saves, a case study. Gun saves and property saves are sold in stores to store weapons. A lot of commercial stores, sports stores, Walmart, Shields, Cabela's, Amazon.com, all of the online and in-store vendors that you're all familiar with. The problem is that a lot of these small saves we found are not secure. So we got involved in an analysis of insecurity and how these saves are not engineered properly. We looked at and what we're going to talk about today is bolt works and mechanisms, biometrics and the key locks. So these manufacturers and we looked at the major manufacturers in the industry in the United States and they also sell some of them sell up in Canada. The security representations on the box and the picture that you're seeing is one of the stack-on gun saves. Stack-on is a company near Chicago and we'll get into them as we go through this presentation. What they're representing to you as a consumer to your parents, to your friends is that these are secure for storing weapons. They're certified by the California Department of Justice and they can protect kids from guns and that's what they are representing in these containers. We can show that these are not true statements and let me just make a comment before we go through this about the California Department of Justice regs. Several years ago California led the country in developing standards for gun locks. In 2007 the three of us did an analysis of a number of gun locks and we're very neutral about weapons. Matt was in the Marine Corps, I worked in law enforcement a long time ago in South Dakota and my former life. We've all handled weapons but we're not pro weapons, we're not against weapons. This has nothing to do with politics and the politics of gun control in the United States. That's not our issue. What our issue is is the design of locks and saves that are made to protect these weapons. And after our investigation and we're not done because we're looking at other manufacturers now, these products are woefully inadequate in our opinion. Again, the Department of Justice in California led the United States and they really set the standards for gun locks. Unfortunately in our view and in the view of a lot of the folks were on the original standards committee, they don't protect anything really. They protect against certain methods of forced entry but we're not talking about smashing these things apart. We're talking about covert entry and things that kids, young kids, teenagers, even a three-year-old can accomplish. So manufacturer security and engineering. Matt? So we've talked about this for the last seven years while we've been at DEF CON and thanks again for having us back. But the manufacturers don't comprehend or understand the bypasses from an engineering perspective. It talks about junk being reported here. The most interesting note is back to the previous slide that depicted the secure gun safe and ultimately protecting your child from that. The advertisements and the photographs and the details on these packages indicates that this box, this strong box or safe can protect your child and the reality is it's just not true. And note the picture if you can see it. Every one of these boxes that contain these safes shows weapons and valuables inside the container. So for a reasonable consumer that says oh I can store my weapons but we've gone a lot farther than that because we've done a number of undercover interviews at Cabela's and Shield's. These are two sporting goods chains throughout the country. They operate a lot of stores and all of their sales people, all of them, when we ask them as potential purchasers are these safes good? Yeah, no problem. Are they secure? Absolutely. Can we put our weapons in these safes and not worry about our kids getting them? No problem. Is there any way kids can open them? Not in a million years. Not in a million years. And we're going to show you a video later of how that statement doesn't quite work with a three year old. So and a lot of you probably know us, seen a lot of our presentations. We use a lot of kids for opening locks because everybody instantly understands if a kid can open it there's a problem. I don't care where the kid's Einstein. It doesn't matter because in the internet age with YouTube and Flickr and all the rest, if somebody figures something out everybody's going to know about it. So there's no more secrets. Okay, so the bottom line is most of these most of these containers are made in China and in our view honestly most of them are junk. A lot of American manufacturers are designing and importing from China and manufacturing in China and you really often get what you pay for. The problem is all this stuff really looks secure, it looks good but it's really not when you start looking at it. So the problem is that the dealers, the manufacturers and the retail outlets they don't know or they're not telling you the truth. Matt? So again, I mean we're talking about the intersection of mechanical and security engineering. You'll see in some of these safes both capacitance and optical based fingerprint readers and some pretty high technology associated with the electronics merging with the physical space. What we've come to understand is we don't focus typically on the electronic side. We focus directly on the physical side and understand and develop ways through covert entry and other means to bypass those electronics and get direct access. And we've talked about this through the past seven years with Kryptonite, with Kensington, with Kwikset and Medeco and others and the engineers that are developing these products whether it's here in the U.S. or overseas in China don't contemplate and don't understand how to break and bypass these systems. The real problem and we all have a security laboratory that we do work for lock companies all over the world. We figure out how to break their locks that can't be broken and then we figure out how to fix them. And the real problem that we find and we train engineers everywhere. The people that make these locks a lot of times they don't know how to open their own locks. And that's really true when we're talking about these gun safes that we're looking at today. So let's talk about myths about security and product design. It's patented. In our world that doesn't mean anything. Patented has nothing to do with security. The patent office doesn't test for security. In order to get a patent you have to meet criteria that it hasn't been done before, that it's unique, it's not obvious and it has utility. Those are the three criteria for a patent. And if you can meet those you get to get a patent. But it has nothing to do with the security of the product. Engineers think that the product is secure. Again, most engineers think what they make is secure. They don't understand a lot of the rules that go into security engineering. The product has been sold for many years. Again, just because a product hasn't had problems doesn't mean that it's secure. No known bypass tools or techniques. Matt, why don't you talk about that for a minute? Because you run a company that develops very high tech tools. Yeah, so for the past 10 years or so I've been specializing in creating covert and surreptitious entry tools for the military and law enforcement and we're often presented with locks or physical security components that we need to develop tools for. So we use a variety of very interesting production techniques, metallurgy, and come up with some pretty unique designs. And again, some of them seem to be pretty simple and you'll see one in a little bit. But it doesn't take much thought or ultimate intelligence. I'm bringing myself down here. That's why we have Matt as the head of the company. To develop bypasses for a lot of these locks. So more issues. The product meets or exceeds standards. A lot of manufacturers think because they meet a standard by underwriters laboratory, builders hardware manufacturers association, they think that that's the end of the story. It's only the beginning of the story. The problem is that a lot of these standards, including those from California, they do not address most of the methods that we use to attack locks and safes and open them. And in my world, especially as a lawyer, if they don't address the issue, they're meaningless. They don't protect you. And in this case, one of these manufacturers is hiding behind the California department of justice standards and saying, well, we're very proud of our containers because we meet the DOJ standards. So what? The DOJ standards don't test for certain methods of bypass. And the other thing is they've said the testing labs have certified the product. Because the procedure is the testing labs actually do the testing. They send the certification for example to California DOJ, California DOJ says, okay, you're now certified. Just because they tell you that a lock is certified, for example, Kwikset, one of the most popular junk locks in America, there's millions and millions, maybe a billion of them in the United States on doors, they're junk. And we can open them in 15 seconds with a four-inch screwdriver. Yet they have the highest commercial grade of security you can get. Grade one, 15 seconds. In our world, that's not, and it doesn't hurt the lock. In our world, that's not security. The government labs say it's secure, Matt. So we'll see that in a few minutes. Yeah, okay. And no consumer complaints. That's great. That means it's secure. Okay, so as I said, standards are the problem. You meet all the standards, but we can still open the locks in 10 seconds. So I've been on the underwriters laboratory panel for locks and safes for a long time. The standards essentially are not looked at for five to seven years. There's a review process. It's very slow. It's very cumbersome. And at the end of the day, the standards really, really don't protect you. Now in other areas, for example, in electrical appliances, underwriters laboratory does a great job for the last 125 years. But in security, that's a different kind of issue. So let's talk about the California Department of Justice. In our view, they're essentially worthless. So yes, they set the standard in America, but you have to understand it was essentially the lowest common denominator that law enforcement manufacturers, public interest groups could arrive at because standards are a collaborative process. Matt, why don't you talk about this for a little bit? As far as what these standards talk about? So 977.50 denotes a whole host of basically construction level physical enclosure requirements associated with safes. They have to have either an electronic or a mechanical locking system with 10,000 possible combinations. They have to be adhered to a certain thickness in order to bypass drilling or forced entry for a period of time. They have a Rockwell hardness of 60 plus requirements. So there's a host of physical security standards that they've developed and assigned to address the requirements. And then we have bolt work standards. Now what you have to understand is every safe you're going to see in the videos in just a minute, we opened mechanically by bypassing the internal mechanisms. We didn't hurt the safes, we didn't damage the safes. It has nothing to do with these standards and nothing to do with physical entry. So when they talk about the bolt work, the bolts that keep the doors shut, must consist of a minimum of three steel locking bolts of at least a half inch, we don't care because we're bypassing these mechanically and getting around what controls the bolt works. Shall be capable of repeated use, the exterior wall should be constructed of a minimum 12 gauge thick steel. Okay, we have no problem with these safes essentially for forced attack. Again, our problem is the insecurity engineering of the way they develop these safes and the vulnerabilities that they created in their designs because they want to maximize their profits. They don't spend the money on engineering, they don't manufacture them to high tolerance standards. Again, the door hinges, again, it's the same issue. All this stuff works. It's not that engineers do not know how to make things work. They don't have any problem making things work. The problem is they don't know how to break the stuff they make. So gun safe standards, not real world test. The standards do not protect the consumers. There's no testing of real covert entry or mechanical bypass techniques. There's no real testing with kids. And that's the real issue here because his Tobiola test, his three-year-old taught us a lot about a couple of these safes, especially how to open them. So again, the lowest common denominator for testing are what standards are all about. So we went to major retailers in the United States, Amazon.com, Cabela's. They operate about 40 stores, Dick's Sporting Goods, 450 stores. Walmart sells online. Everybody knows who Walmart is. So retailers don't know and they don't care. It's all about money. Now they'll tell you they're really concerned about the safety and security of their customers. That's what Walmart's statement was to me when we finally got them to make a statement. But you know what? They saw the videos, they looked at the videos. Three months later, they finally issued a statement when I told them I was writing an article that I was going to put on Forbes. So they finally issued a statement. What did they say? Their statement said they talked to the manufacturer stack on the stack on said there's no problem. End of story, they're still selling the states. Only one of the four vendors that I talked to was even mildly concerned. No action at all was taken by any of the vendors that we talked to, which would be Cabela's, Shields, Dick's Sporting Goods, Walmart. No safes were taken off the shelf that we were aware of. We went and checked their stores. We went and did undercover videos to talk to their employees. Nothing changes. Stack on, they had absolutely no interest in talking to us. They didn't want to know what the problem was, how we could open the safes. We offered to go to Chicago. We offered to show them the videos. Four months we gave them notice before we went public. So misrepresentations about security. California DOJ certified. In their world, they think that's secure. Can be right. Light upon is secure. Are safe to secure. Guns cannot be opened by kids. And what we were repeatedly told, the only way to open these safes is by breaking them. Otherwise, when we asked both Toby and myself went to different stores, can kids get into these safes? Absolutely not. Not in a million years. Well, it's really amazing how quickly a million years goes by. And the other one, the really good one is that Stack On issued a press release after I was on television in May. They said, some of our containers are TSA approved. Oh, yes. That's a real endorsement. So you're going to see how that works also. So dealers mislead the public about security. Now we're going to talk about little Eddie Ryan Owens because that's the point of this whole presentation. And this is with the family's permission. They're fully engaged in this process and they wanted us to go public. November 27, 2006 to September 15, 2010. Detective Owens was an undercover agent for the Sheriff's Office in Vancouver, Washington, Clark County Sheriff's Office. He was a Iraq veteran. He was on the Joint Terrorism Task Force, longtime detective. The Sheriff's Department in 2003 had another tragedy where a deputy's son shot his 10-year-old sister with a service weapon that he got from his father. So the Sheriff's Department as they should have mandated that all personal weapons were in gun safes when they were at home and not on their officers. So the Sheriff's Department purchased 200, ultimately 400 Stack On safes, $36 apiece. Now, most folks understand you can hardly go to McDonald's for $36. Much less by a safe that provides any level of security. So and then the state purchased thousands of them. They store evidence in them. They store weapons. Even TSA, the same folks that certified this, they store materials at their TSA checkpoints at the airport. So and the Sheriff's Department mandated the use of these safes for all weapons at home. So undercover agent Eddie Owens had his weapon in his lock safe in his bedroom on September 14, 2010. The safe is accessed by one of his four kids. Ultimately, one of his kids either shot himself or shot the three-year-old. Four hours later, he's dead in the ER. So we were contacted and the problem is the criminal and the investigation at the scene, there was no DNA tests, no gunshot residue tests to figure out who fired the weapon, no forensic analysis of the safe, no expertise by the local crime lab, no understanding of how the safe was opened and they didn't know who fired the weapon. It was just a tragic accident. So and they had a review committee look at this safe. So what did the lead officer do? And I don't know the lead officer, you know, he's a sergeant. He didn't have a clue about security, which is typical of law enforcement, unless they have specialists. He looked at the keypad to see if the buttons would stick, to see how long the keypad would be active, but they never got to the mechanism in what the real problem was. So we were contacted by the family and the family's lawyer to figure out what was wrong with the safe. So we got one of the safes that had been in the same batch that had been purchased by the Sheriff's Department. We examined two safes from the batch. We examined the bolt mechanism and the solenoid that controls it. We did a high-speed video at our lab from inside the safe to document the problem. We analyzed similar stuff. Once we figured out what the problem was, we were so concerned that we analyzed other safes made by Amsec, Gun Vault, and Bulldog. Now, Amsec makes large gun safes. They don't make small gun safes, but they're a very reputable manufacturer in the United States. We contacted Stack On, as I noted earlier, and they had absolutely no questions, nothing to say. So this is the, I think this is the first video. This is the safe that we looked at, and this was from the original batch. There were two recalls that Stack On Corporation had. One of them was in 2004 involved the same class of safe. Hold on. That was the safe. Okay. Anyway, we don't have audio. We're going to use the same results. Nobody doing the keypad. We don't do anything with the key. We're just going to drop the safe like that. Okay. That was the same safe that they sent us for analysis. We just dropped that. We did an analysis, and it was, as you saw, less than an inch. That's all we need to open that safe. And the mechanism, very simple, is a solenoid, that when you put power, that solenoid drops and allows the bolt work to slide and open the door. Now, when you drop that safe, that solenoid just drops, and the bolt gets on top. So the safe is on lock, but it's not open. So the only thing that you have to do is turn the knob, and the safe is open. So this is one way that a three-year-old can open and access a safe if the safe is not bolted down. Now, some people just can put it in a shelf, but if you can lift the shelf and drop the shelf, you can accomplish the same result. The problem is the manufacturer evidently didn't contemplate this, and the slide you see now, which is a high-speed video that we did inside the safe. If you look really carefully, what this slide is is a bolt work, and the bolt work is locked. It's extended because there's a little solenoid, a magnetic solenoid with a pin in the center of the photograph, and that pin has to retract before the bolt can move to the left. So this is from inside the safe. This is what happened when we bounced that safe. Watch the little pin go up and down. You see that? And now that bolt is cleared, and you can see it move. Yeah, a little scary, isn't it? No, no, no. I certainly led into that one. But the demonstration is really scary because the manufacturer never contemplated this, and what we found, as you'll see in a couple of videos, it's not just this safe. It's a lot of them. So our investigation, we looked at AMSEC, Stacon, Gun Vault, and Bulldog. We analyzed 10 safes. They were all defective security designs in our opinion, and these were security designs using push-button keypad locks, fingerprint swipe readers, fingerprint image readers, multi-button combinations, and key bypass either a wafer or a tubular lock. All could be bypassed easily with no special tools or expertise. So we turned to Matt Fiddler, our resident genius in tool manufacturing. To develop, we said Matt, we need a very sophisticated tool. It has to be covert. It has to be easily concealed. It has to be small, lightweight, inexpensive, and Matt Fiddler was tasked to make it. And he told us, and correct me if I'm wrong, Matt, it was very complicated to develop, hundreds of hours of research, expertise, and a lot of imagination involved. I missed anything, Matt? No, so I mean, it really took a ton of time. I focused, again, law enforcement, military, the special operations community developing tools for operators that they don't need to understand how to open or bypass a system, but that they can gain rapid entry. So it clearly took a very long time. We played with some different exotic metals, and ultimately what we came up with was what we believe is a patentable design. No, actually. We filed for the patent. We're waiting to see what's happening with that. The problem is there may be some prior art in Norway from 1922. There's the tool. Now, the tragedy is that maybe Mr. Stack-On ought to understand this, because this is a real problem. Bypass techniques. Now we're going to show you what we did. Covert entry with methods. None covered by the DOJ standards. Shims, straws from McDonald's, screwdrivers, pieces of brass from Ace Hardware, paperclips, and fingers. Yeah, we do not follow any rules. No, we really don't. So that's the problem. Okay, Toby, so let's talk about this first one. The Stack-On PC650. The 650. And notice there's a gun in the container. Yeah, that was for Stack-On catalog. This is a three-button, very small container. This is the one that Mark was talking about that has a TSA-approved rating. Yeah. You can put this in a small briefcase, and it's approved for TSA to be carried on board planes. It's a three-button combination lock with, I don't think it's two convenience, only use three buttons, but anyway. And you can program it in any sequence. That's a trick. And they all have, it doesn't matter if it's a biometric, if it's a fingerprint, if it's remote control, they all have also a bypass key. So in this one, I think we're going to run. Oh yeah, so let, no, I don't think there's a video on this. There's no video. Okay, this is what we do. The container, because we cannot say this is a safe. We just, on the top, they have a rubber cover. So we, as curious, say, well, what is behind that rubber cover. So, and it shows a couple of holes. We can just use paper clips and poke those holes, and actually the mechanism to open this, the container. So, and this is the other one that is genius on all of them, that you need the container open in order to program your combination. So if you access that button, you can program any combination that you want. So it doesn't take a rocket science to say, well, how do I get to that button? Can I put a piece of wire, a shim? I just have to trigger that red button that is there in order to program my, my, any combination that I want. Once I get the combination, I can open the safe. So we were able to do, we don't have the video on this one, but we do have this safe. If somebody wants to see it, I think tomorrow we're going to be on, oh yeah, let's mention that. Tomorrow morning, 10 or 10 30, we're going to be up in the lock picking village. Deviant Olam did a presentation last year on a specific model of gun safe. We're going to continue with that tomorrow and have a workshop on insecurity engineering for an hour, thanks to Deviant and lock picking, I think, 101 and tool. We're going to be up with all the safes and let everybody look at this, these brilliant jobs of engineering. Okay, so, and there, if you pry it apart with no damage with a screwdriver, you can also get to the programming button. So this is the one that, oh, the, the key was amazing because we were using the same type of shim that we were using to try to trigger in the reset, to get the combination, we were sticking that piece of metal in the keyway. This is the bypass lock. This is the sliding mode torque, removing that piece and the safe was open. Yeah, so that's, that's an overlifting attack that's been used for many, many years. It's actually just picking it. Right, but you just, basically lifting all, all the wafers to their highest point as you remove your applying turning pressure and the lock opens. It actually picks the lock. Okay. Reverse picking. Right, reverse picking. Okay, here's the next one, Toby. The PDS 500 safe. Well, this one is a little bit more rough. The container really is heavy. Good container, but plastic. We have a rule, well, many rules, but one of the rules is we don't believe in plastic. Not in a security container. You don't put, it locks and saves. It's a problem. So we don't think that you should put plastic. But we understand the point of the manufacturer. They need to cut costs. The problem with this one is when I'm actually, I use a kitchen from the knife for the kitchen and I cut one corner and then it's the ribbon from the keypad that goes through the door. Sideways, we can, actually you can see, you can see the solenoid from the outside and we just have to drop that solenoid and open the safe. Now we're doing some damage on the safe, but for us it's engineering 101. You know, cover the entrance. Everything that you want to protect is inside that safe. The mechanism, you don't want to get to that mechanism. So they should cover at least the holes or get the solenoid protected. So the key is same thing. Oh yeah. Oh yeah. This is, and these safes are used at TSA checkpoints all over the country. And this is a double bitted wafer lock key, as we said, and here we did two shots. We took a paper clip, inserted it all the way. It just turns out that the width of the paper clip is perfect for the wafers. And you just put torque, you pull it out and you basically trap each wafer at your line as you're removing it. And when you remove the paper clip, the lock is picked and you turn it. Yeah. Matt really did a good job on that one. Yeah. Matt, we really want to congratulate you. Because it's a multi-purpose tool. Let's hear it for Matt. Okay. This is the next brilliant design. The stack-on biometric. There's three different sizes of these safes. And the perception is that if you use a fingerprint reader, that somehow that increases or augments the security of the container and makes it more convenient to open. Now the last part of that statement we would absolutely agree with because they certainly made it more convenient to open. So note the design. This is the false perception of security for the fingerprint reader. So you see the little angled image sensor on the safe. So you put your finger in, the little light comes on. It reads your fingerprint. And if it validates it, you turn the knob. Okay. Fingerprint reader and wafer lock, which is the bypass lock equal the security of this product. Okay. So this is now a shot inside the safe. And very cleverly, and I'm sure the Chinese came up with this design because it saves money, of course. This is a modular fingerprint reader. So they snap it into position. There's no screws. It's snapped into position. Everybody's laughing already because you know what's coming. Okay. So what's the bypass tool for this piece of equipment? Your finger. Not that finger, but yeah. Not that finger. Okay. So you put a little bit of pressure on it, and there it is. And I don't know if you saw on the first shot that we have three saves, because on the first analysis we say, no way. Are you sure that this is happening? No. Let's order another one. And Matt had another one. So we put all the three saves together, and we ordered another one just to be sure. And then I went to a Cabela store with undercover video because we have a really sophisticated pair of glasses. So after I talked to the salesman at the Cabela store, I think in Kansas City, after he left me, after he answered all of my questions and concerns, they had one of these. So I opened the box, took it out, and stuck my finger through it, put it back in the box just to make sure that it wasn't an anomaly. So once that hole is opened up, you move the wire over, you trip the solenoid. Okay. This is... But I want you to notice something that you saw different saves, but they all use that solenoid, you know? So you know what attack. And one of the things that gave us the idea to look at different saves was the same concept that we had seen something like this before. Where was it? So we start getting more safe and more safe and safe and safe and open it all. Okay. The next one, let's talk about quickly the 1200B, the biometric. This is a brilliant design. So this is a flip out door safe, really looks great. Again, this has got a fingerprint reader, different kind, just like on your laptop, it's got a bypass lock, flip open door. It's from the mechanical design as far as a box, the box is no problem. But again, we have a rubber cover, we have access, and it's really easy to open. So again, we pulled the rubber cover off, there's exposing the fingerprint reader, there's holes, you stick, it's a very high tech tool. Again, the paper clip to open it, and we did this as a matter of fact, I went to Cabela's with video, and they gave me the paper clip to open the safe. And then these are the folks that were really, really concerned about it, the manager was there, have we heard anything from corporate in Fargo, North Dakota? Not one word. They're still selling the safe, no problem. Actually Mark was returning the safe. Yeah, I returned the safe, and they put it back into service and resold it. The guy calls me, the manager calls and says, yeah, I understand you had a problem with this safe, what's the problem? Oh, other than I can open it with a paper clip, perfect. This is a demonstration with Mark Tobias and Tobias Busmanus opening the stack on QAS 1200 model. This is a push button safe, programmable, three button combination to program any sequence, and it's got a bypass key. As with many of the other safes, this can be relatively easily opened with pieces of wire and wire shims. Toby, let's demonstrate what we're doing here. There's a rubber cover over the three buttons, like with all the other stack on safes, a similar design. Once we have access, there are three critical holes that are available. We can stick wires into those holes and let's do a tight shot and trip mechanisms and actuate what we need to to open the container. And just as you saw, a paper clip and a piece of wire just opened this QAS 1200E. This is Mark Tobias and Tobias Busmanus. As you can see, when you put the rubber cover back on the buttons, the safe still works, and there is absolutely no evidence of entry. So that's a little bit, and here's the 1200B, which is the companion model with the biometric which I did at SHIELDS. This next demonstration is the QAS 1200B. It's also a biometric. It's called aptly a quick access safe with biometric locks. Very true. Quick access safe, yeah. This is another failure of engineering. This is a little better design, however. It's got a Chicago lock, which is a lot better than the other safes that we've looked at. It's a little tougher to open, and this has got a fingerprint reader much like all the laptops use. Okay, this is how we're going to open the safe. You see this cover, same as the first one that we did. It's just glued in. This is our fingerprint reader. Okay, and it's mounted in two plastic poles. Okay, the promo-doses in order for them to mount that, they glue those and it has a hole. So I can use a small screwdriver and pop that little spacer that they use. After that, through that hole, I can see the locking mechanism. So we just have to go through that hole and the safe is open. It gets better. Toby, let's, because we have 10 minutes, talk about the QAS 710. This is another brilliant design with a motorized locking drive. Okay. You know, I think stock makers spend a lot of money, because this is another one that we had to buy two of them just to confirm it, because we couldn't believe it. Do we have a video? We have a video, yeah. Okay. It is supposed to, when we lock the cover, the motor is supposed to grab the door and the locking mechanism is like a scissor. So when it drops, it grabs the door and the motor is supposed to also keep that in place so you cannot move and open the door. So we were just inserting a shim and opening the safe. So I think... So actually we happen to have lunch at McDonald's. And we look around because you have to understand our best place is an office supply store when we're trying to figure out how to break a lock. Because we look around looking for things we don't know what we're looking for until we find them. And what we found is a straw. We looked at each other and it says, no way. No way. Why isn't a straw like a shim? That's a good question. So we figured it out and here's what we did. This next demonstration is the QAS 710 Strongbox Quick Access Door Safe. Again, a very true statement. Koby, let's do it. This one, really, really, we're really concerned about the latching mechanism. In this specific one, we will just remove the back cover to show a little bit on the inside. Let's just do the first one. This is a piece of brass from Ace Hardware. Metal shim, brass shim and opens the safe to the side. Not difficult at all. No, as a matter of fact, one of the pins that they use for securing the lid against the body can be used as a guide. So it's very quickly accomplished. So they have a protection from the top so you cannot access the latch mechanism. But right here, this is what we're tripping. This is engineering that you get to pay for. And actually we can even push it or pull it, depending on what you're doing. We can use also straw to do the same trick. So let's do it. Let's open. Yeah, this is what we would call the last straw or the final straw. Except the problem is at the end of the day it's really not amusing because people are vain for security. That's open with a straw for McDonald's. Okay, the QAS-1000. This is Mark Tobias and Tobias Bluzmanis with Security Labs. This is a stack-on QAS-1000. This is a small drawer type gun safe. It's programmable with three buttons. The sequence can be programmed. There's also a bypass key that'll open the mechanism. So this is allegedly a secure container for storing weapons. It isn't. In our view, this is not secure at all. It can be bypassed by first circumventing their secondary latch mechanism that prevents the introduction of a wire or a paperclip to just force the entire latch downward, as we'll show in a subsequent portion of this video. So it's a two-step process, but it's very simple. There are three access holes plus the access holes behind each one of the buttons. There's a lot of room to manipulate here. And so, Tobias, let's show how to open this through the access holes that have been provided by the manufacturer. Let's open this safe a little. You can see the latch. I can move the latch. I have to notice that it's a pin on top of that when you close it. There is a secondary latch, but unfortunately it can be easily circumvented. I'm trying to push now, but the pin is on top. It won't let me. So you have to move that pin away and then you can... You can actually set their security mechanism so it's totally neutralized. And it's very simple to do through that hole. And now we just have to depress the latch. And the total amount of tools is one piece. Okay. This is... And we're just going to show this. We're not going to do the video. This is a competing gun vault GVS-200. We can get to that the same way. This is the Bulldog BD-1500. We can open it in a similar fashion. Now, what we want to get to is the final video. And then we'll take a couple questions. Competence security engineering matters for making secure products. So, STACON's response was, while STACON respects Mr. Tobias's proven ability to pick the most complex of security locks... Thank you for the endorsement. We strongly stand behind the safety of our products. STACON personal safes are certified by the California Department of Justice. This certification involves testing by an independent laboratory approved by California DOJ for compliance with adopted standards. We are proud of this designation and the protection we provide. In addition, our portable cases comply with TSA airline firearms guidance guidelines. So, this is the kicker and this is what we want to leave you with. Yeah, we have to hire a third party... Yeah, third... This is a little AMSEC safe. And this uses the same mechanism, a little solenoid that we were talking about at the beginning. Different manufacturer. And guess what? It gets better. This is the safe that was involved in the investigation in Vancouver. There's two. Same problem. Now, so if you think that because it's a combination and your kid cannot figure out the combination, if you put something really simple, he may be able to open it. And he just saw them open it and he remembered the combination. Now, the bypass, the security of this safe, Toby stuck a pin in before. So, part of this had already been preset, which it shouldn't be able to happen. But little Toby figured out where to stick the wire. Take it. That's it. That's a little bit scary. We hope you all take away. This is security engineer.