Security References & Educational Links
Curated collection of foundational literature, industry standards bodies, community lockpicking organizations, and conference presentations in physical penetration testing.
Organizations & Standards Bodies
- TOOOL (The Open Organisation Of Lockpickers - USA)
Non-profit educational association advancing public education in lock picking, mechanical security, and responsible disclosure. - TOOOL International (Netherlands)
The original European branch of TOOOL, providing research papers on lock mechanics and forensic examination. - ALOA Security Professionals Association (Associated Locksmiths of America)
Primary trade association and educational organization for professional locksmiths, safe technicians, and physical security specialists. - BHMA (Builders Hardware Manufacturers Association Standards)
Standards developer for ANSI/BHMA building hardware standards (ANSI/BHMA A156 series) governing locks, deadbolts, and egress panic devices. - ANSI Standards Store
Coordinates national commercial hardware standards including door assemblies, fire ratings, and security grades (Grade 1, 2, 3).
Foundational Literature & Guides
- MIT Guide to Lock Picking (Theodore T. Tool)
The seminal 1991 paper breaking down the fundamental physics and tolerances of single pin picking (SPP), pin binding order, and shear mechanics. - Practical Lock Picking (2nd Edition) - Deviant Ollam
The definitive modern field training manual on mechanical lock picking, pin tumbler manipulation, security pin navigation, and bypass tooling. - Keys to the Kingdom: Impressioning, Privilege Escalation, and Key Duplication - Deviant Ollam
Comprehensive study on key duplication, over-the-shoulder decoding, optical decoding, casting, and blank impressioning. - The Complete Book of Locks and Locksmithing (Bill Phillips)
Authoritative reference covering commercial cylinder servicing, keyway coding, master keying charts, and electric strike installation. - High-Security Mechanical Locks: An Encyclopedic Reference (Graham Pulford)
Exhaustive engineering and forensic analysis of sidebar locks, rotating pins, high-security disc detainer systems, and bypass vulnerabilities.
Security Conference Talks & Video Breakdowns
- Deviant Ollam: "I'll Let Myself In: Tactics of Physical Pen Testers" (Wild West Hackin' Fest 2017)
High-level breakdown of architectural bypasses, under-door tools, latch slipping, Request to Exit (REX) PIR sensor evasion, and elevator bypasses. - Deviant Ollam: "The Search for the Perfect Door" (Shakacon 2016)
Deep analysis of exterior and interior door geometry, commercial latch weaknesses, security astragals, and physical gap vulnerabilities. - Howard Payne & Deviant Ollam: "This Key is Your Key, This Key is My Key" (HOPE 2016)
Technical analysis of master key systems, systemic cross-keying flaws, key interchange attacks, and institutional key control degradation. - Deviant Ollam & Howard Payne: "Elevator Hacking: From the Pit to the Penthouse" (HOPE 2014)
Explores the operational and architectural security of elevator banks, standardized fire service keys (Phase I/II), and mechanical hoistway access. - Deviant Ollam: "Through the Eyes of a Thief" (DakotaCon 2023)
Physical penetration testing methodology focusing on target reconnaissance, environmental profiling, security guard interaction, and opportunistic entry points. - Deviant Ollam: "You're Probably Not Red Teaming... And Usually I'm Not, Either" (SANS ICS 2018)
Critique of realistic adversarial emulation versus standard vulnerability assessments, specifically tailored for critical infrastructure and ICS/SCADA facilities. - Deviant Ollam: "All About NFPA Fire Code and a Red Team Cover Identity" (CackalackyCon 2024)
In-depth guide to NFPA Life Safety Codes, emergency egress compliance, magnetic lock release triggers, and leveraging fire safety inspection pretexts. - Deviant Ollam: "A Totally Tubular Lock Lesson" (DEF CON 31)
Comprehensive workshop on tubular lock mechanics, 7-pin and 8-pin configurations, tubular picks, impressioning, and decoding methods. - Deviant Ollam: "Getting the Right Rotation: Safe Locks and Sushi Rolls" (PancakesCon 2024)
Introduction to mechanical safe locks, Group 2 combination wheel packs, drive cams, contact point reading, and manipulation fundamentals. - Karen Ng & Matthew Cancilla: "Intro to Physical Security Bypass" (DEF CON 33)
Practical overview of non-destructive physical bypass techniques, door latch dynamics, crash bars, and addressing common hardware installation blunders. - LockPickingLawyer: "Keynote Address" (SAINTCON 2022)
Keynote detailing the landscape of consumer and commercial physical security, marketing claims versus mechanical realities, and defensive improvements. - Deviant Ollam: "Mastering Master Keys" (HOPE Number 9)
Step-by-step breakdown of pin-tumbler master keying theory, mathematical cut progression, decoding shear lines, and generating change keys. - Mark Omo & James Rowley: "Cash, Drugs, and Guns: Why Your Safes Aren't Safe" (DEF CON 33)
Forensic examination and vulnerability demonstration of consumer and commercial electronic and mechanical safes, solenoid manipulation, and bypass vectors. - Grey Fox: "Tactical Flipper Zero: You Have 1 Hour and No Other Equipment" (DEF CON 33 - RF Village)
Field-focused assessment workflows utilizing sub-GHz, RFID, NFC, and infrared capture tools during constrained-window physical red team engagements. - Babak Javadi: "Basics of Hacking Physical Access Control Systems" (DEF CON 27)
Explores vulnerabilities in electronic strikes, magnetic locks, credential cloning, and sensor defeating techniques. - LockPickingLawyer (YouTube Channel)
Concise, technical demonstrations of non-destructive picking, decoding, shimming, and bypasses across hundreds of lock models.
Equipment & Tooling Manufacturers
- Red Team Tools
Specialized physical penetration testing hardware, under-door tools (UDT), latch slips, crash bar wires, decoder cards, and covert entry gear. - Sparrows Lock Picks
Professional lock pick sets, flat TOK tension bars, bump keys, and bypass tools (shove knives, Halligan tools). - Peterson International
Government-grade pick steel (0.025", 0.018", 0.015") and specialized hook profiles. - Multipick (Germany)
Precision German-engineered picks, tubular lock picks, dimple picks, and destructive/non-destructive entry tools. - Original Lishi Tools
Direct 2-in-1 decoding picks for automotive, residential, and commercial keyways (e.g. KW1, SC1).
Manufacturer Technical Manuals & Public Service Archives
Openly accessible factory engineering guides, cylinder service manuals, and key blank directories:
- Kaba Ilco Key Blank Directory & Support Resources
The definitive industrial directory for key blank identification, section profiles, cylinder warding cross-references, vehicular keys, and heavy equipment blanks. - Allegion Document Library (Schlage Service & Key Systems)
Factory service manuals for Schlage Classic, Everest, and Primus cylinders, rekeying technical documents, and multiplex key system hierarchies. - Corbin Russwin Cylinder Manual (Public Archive via Internet Archive)
Comprehensive 9506 cylinder manual covering System 70, Pre-System 70, interchangeable cores, combinating tables, and master keying principles. - dormakaba Technical Documentation & BEST A2 Service Manual
Official service manuals (Doc T61803 / T35527) and basic worksheets (Doc T92841) covering the BEST A-2, A-3, and A-4 Small Format Interchangeable Core systems. - Sargent Lock Cylinders & Key Systems Catalog
ASSA ABLOY resource for conventional and LFIC cylinder pinning, bitting tolerances, and master keying rules across Sargent keyway families. - Master Lock Technical Service Manuals
Factory manuals (including Document 7000-0031) detailing commercial cylinder specifications, pinning kits (#291), and rekeying procedures. - Kwikset Support & Service Documentation
Official pin-tumbler cylinder rekeying guides, plug follower specifications, and SmartKey mechanism overviews. - LAB Security Systems Technical Resources & Downloads
Universal pinning charts, .115" standard and .108" SFIC pin dimension specifications, and kit calibration standards.
Academic & Cryptological Physical Security Papers
- Matt Blaze: "Cryptology and Physical Security: Rights Amplification in Master-Keyed Mechanical Locks" (2002)
Seminal research demonstrating mathematical vulnerabilities in hierarchical master key systems, detailing the progression search algorithm to reconstruct Grand Master Keys from single change keys. - Matt Blaze: "Safecracking for the Computer Scientist" (2004)
In-depth analysis of mechanical combination safe lock tolerances, contact point graphing, wheel pack physics, and manipulation algorithms. - Flavio D. Garcia, Peter van Rossum, Roel Verdult, Ronny Wichers Schreur: "Dismantling iCLASS and iCLASS Elite" (ESORICS 2012)
Peer-reviewed academic research exposing cryptographic weaknesses in HID iCLASS key diversification and memory dump extraction. - ASME A17.1 / CSA B44 Safety Code for Elevators and Escalators (Section 2.27 Emergency Operations)
The standardized North American life safety elevator code defining Phase 1 Emergency Recall, Phase 2 In-Car Firefighter Operation, and the FEO-K1 standard key switch.