DEFCON SLC combo laptop locks

[RobbieF]

We hand these out to our laptop users at work. Occasionally, when we need access to a laptop that's tethered to someone's desk, we would love to be able to non-distructively bypass the lock.

Do any of you know a way to defeat the lock without damaging anything?

[ToolyMcgee]

So, you need access to someone elses laptop without them around to put in the combo? Doesn't that eliminate the purpose of the lock? People don't lock up things they want to walk off.

[AlexMHH]

There's a Tobias whitepaper here on bypassing the Defcon series. Incidentally, my Defcon CL jammed today and wouldn't unlock. I tried all combination one digit above and below my code, decoded it, and came to the conclusion that it was just an internal mechanical failure (Targus told me the defect was common) and eventually had to cut the cable with a pair of wire cutters to get to class.

[RobbieF]

LOL

You're half right. They are our laptops, and we control the inventory. We assign them to our (government) employees.

The employees are told to lock them when they leave for the day or take them with them.

I'll give you a recent for-instance: There was something wrong with a customer's HP (imagine that)... we coordinated HP to come on site to work the issue. The customer's laptop was there, but the customer was not.

There are many many cases like this, and I thought that since this is my new hobby, I could lend a hand when need be at the office.

[ToolyMcgee]

I see. If you can get the above link to work for you then that should help. I usually just take 5 or 10 mins to decode this type of lock, but most have a method to speed up the process. Good luck.

[RobbieF]

Thanks, guys. and thanks for the Tobias paper. I'm going to fool around with that method on my own cable lock tomorrow at work.

<3 this new hobby:)

[Arcturus]

Thanks, guys. and thanks for the Tobias paper. I'm going to fool around with that method on my own cable lock tomorrow at work.

<3 this new hobby:)

Don't forget to report back here and tell us all how it went.

[MacGyver101]

Without intending to cast any comment on the original poster's intentions, is a discussion of "I'd like to know how to quickly bypass the locks on unattended laptops?" really an appropriate conversation topic for the open forums?

[MacGnG1]

bubble gum, a straw, and a twist-tie.

im sure you have a way to contact the employee's on their cell phone/ house phone to get the combination.

[RobbieF]

It's against our security policies to ask for any password or combination, or keys or anything like that.

We also don't have most employees' personal numbers in our database.

[ToolyMcgee]

So then it is definately against security policy for you to bypass the lock entirely then isn't it? You are digging your hole even deeper by saying so. It does seem to be a valid enough reason though for me not to get all... language filtery, but know as a general rule it is bad form to violate such boundaries just for the sake of convenience. Even if it is to save a lock getting snipped, it is a bad habit to start bending ethics.

The problem with posting a solution on the open forum is anyone with internet access would be able to view it. You see? That's not good for security. I'm sure if you read the literature you have it figured out anyway. Peace.

[RobbieF]

The physical security folks have master keys to every lock in the building... Why shouldn't we (Computer Security Incident Response Center, our division) have our non-destructive way as well?

I suppose you have a point about the "anyone can read it" stuff... but isn't that what free speech is about? Mixed emotions on that I suppose.

[ridinplugspinnaz]

The physical security folks have master keys to every lock in the building... Why shouldn't we (Computer Security Incident Response Center, our division) have our non-destructive way as well?

I suppose you have a point about the "anyone can read it" stuff... but isn't that what free speech is about? Mixed emotions on that I suppose.

I think the appropriate answer to your problem here is to employ the use of laptop locks that will allow you to set up an analagous entry method to your physical security group's use of master keys. In other words, buy laptop locks that are hybrid combination / key lock (you know, like most locker systems in high schools), so that you have a legitimate route to non-destructive access to the laptops. Systems bypass as the first option for someone who is supposed to have access to said system is a terrible security policy, IMO.

[ToolyMcgee]

I would let the free speach thing die here. I'm not touching it with a ten foot pole.

[RobbieF]

I would let the free speach thing die here. I'm not touching it with a ten foot pole.

Oh, is that a sore subject around here? I guess I can understand.

Forgive a n00b.