The Real Talk:
- Why lock picking and cybersecurity attract the exact same kind of mind (hint: it’s the puzzle, not the crime)
- How locksmiths are now cloning car keys with micro cameras, cloud databases, and reverse engineered encryption, and why a Volvo is a much harder target than an F-150
- The driver monitoring debate nobody fully agrees on, and why the whole argument comes down to whether the data stays on your vehicle or ends up on a manufacturer’s server
A Closer Look:
The Crossover Nobody Planned Eric Osterberg, founder of Gray Duck Locks, joined Eric Brown, CISSP, Nick Mellem and Joshua Schmidt, to explain why lock picking and infosec pull from the same crowd. Both disciplines chase the same question: how imperfect can a system be before someone finds the gap. Osterberg broke down how tiny manufacturing imperfections in a pin stack are exactly what makes picking possible, the same logic that drives vulnerability research in software.
Key Cloning Has Gone High Tech Micro cameras the size of a key, cloud databases that calculate cuts, and CNC machines that carve replacements with precision. This isn’t a guy with a pick gun anymore. Osterberg mentioned how a photo of a TSA officer’s keyring years ago led to a published set of master keys for luggage locks, and the same risk applies to anyone who leaves their keys sitting out at lunch.
Why Your Volvo Beats Your F-150 Domestic and Asian vehicle keys typically rely on a serial number and a basic trust handshake during programming. European manufacturers use public private key encryption with challenge response authentication running between multiple onboard computers, which means cloning one requires desoldering chips and brute forcing keys in the cloud instead of a quick relearn. Ford started closing that gap in 2021 with the Mach E era architecture, then added encryption between vehicle modules in 2025.
The Surveillance Question With No Clean Answer New federal rules will require passive driver monitoring systems in new vehicles to detect impairment and fatigue. The hosts and Osterberg landed in different places on the debate, but everyone circled back to the same condition: it depends on whether that monitoring stays local to the car or becomes another data stream sent back to the manufacturer.
Bottom Line:
Physical security and cybersecurity keep converging, from 3D printed lock picks to AI generated CAD files to cloud connected key cutting machines. The real lesson from Osterberg’s shop is one every security team already knows: the weakest link is rarely the lock itself. It’s the exposed key on the table, the unpatched module, or the process nobody thought to lock down. Whether it’s a $35 padlock or a six figure car, physical security is just cybersecurity with better lighting.
Tune into the full episode to hear about the device that can crack a safe by listening to its own internal components, why magnet fishing has become an unexpected way people recover lost firearms and safes from lakes and rivers, and the debate around comma ai’s open source driving assistant and who’s responsible when the code takes the wheel.
🔗 Ep 93 – Lock Picking Secrets: Key Cloning, AI Coding and Safe Cracking
Listen wherever you get your podcasts – Subscribe to our YouTube channel to stay up to date on breaking cybersecurity news.
Learn more at www.itauditlabs.com
