Navigating the Convergence of Physical Security and Digital Access | Daniel

Hi, everyone.

Welcome back to another episode of the Security By Default podcast.

I’m the host of the show, Joe Carson.

It’s a pleasure to be here and one of my favorite times of the week is to get to chat to amazing, great people who really make the world a safer place.

And today is going to be exciting episode.

I have got a guest today.

It’s first time on the show.

Daniel.

Daniel, do you want to give the audience a bit of a background about yourself, your origin story, how you got into the industry?

Did you choose this path or was this path kind of, you know, taken for you and you kind of fell into it?

So if you want to give.

Tell us a little bit about yourself and your story.

Okay.

Yeah.

So my name is Daniel Raines.

I’ve been in the electronic security industry as a whole for approximately 30 years.

For the first 15, I was actively on the tools, installing physical access control arms, cameras, et cetera.

And then for the last 15 or so, I’ve been writing software development for the same industry, but around construction for access control, biometrics.

Basically, I started looking at the security research side of things because I was finding there was like bugs in some of, like the local SDKs and APIs.

And I was like, I can’t continue or I can’t get it to do what I want it to do the way it should function.

So obviously you reach out initially to the companies and go, there’s a bug here.

This doesn’t work.

I do this, it crashes the server or whatever the case may be.

And then obviously, then it takes them time, sometimes months and months to obviously implement fixes.

And I’m like, well, let’s just take a deep dive and just see where the problem lies and see if I can fix the problem myself temporarily until I roll out an official fix.

And then whilst I’m there, I’m like, hold up, what, what’s this doing?

Why is this here?

I found these encryption keys that hold up, these are, these are hard coded and et cetera, et cetera.

And then it got to a point probably about 18 months ago where I sort of decided to sort of.

I’m not this on the head now.

I’ve sort of had enough of it and I’ve just, I’ll put a post up on LinkedIn just saying like, time for changes to sort of just move on and just go back to the.

Just, just doing software development.

And then there was a group of people, which I’m now part of a group on Signal that reached out to me and said, do you want to join our group?

And I was like.

So I was like, okay, yeah, I can do.

I mean, I’m not sure how much I’ll contribute because I’m sort of decided to just go back to software dev.

And then that just opened a can of worms.

And I’ve just been looking even more at different various products since then.

Yeah, there’s a, a good and a bad influence all at the same time.

So, yeah, so it was for a necessity to begin with because there was sort of problems, small bugs.

And then I just fell down a rabbit hole looking at stuff and thinking, this ain’t right, hold up, I can do this, I shouldn’t be able to do that.

And then I just started reporting stuff and some were open, some not so much, some threatened to sue me.

And it’s just been a roller coaster since then really.

So question on that.

You know, that’s something, you know, we obviously on the, in the software side, we’ve got the vulnerability disclosure programs.

You know, that gives some level of way of notify on vulnerabilities and bugs and so forth.

More on the access control, which does tend to be that it’s a convergence.

It’s.

It’s almost that kind of bridge between the physical world and the digital kind of, you know, you got the physical machines for accessing whether RFID readers, nfcs and so forth, or even the physical cards.

How is that industry specifically, how has it been for vulnerability disclosure?

Is it still catching up?

Made lots of events as well.

Where would you see in the access card kind of world how they’ve been responsive to the type of work that we would typically do?

You know, finding vulnerabilities in software and hardware.

I mean, as per.

I did another podcast a little while ago and as per, the same sort of question arose from that and I sort of defined it as sort of three separate categories.

One where companies were open and have been open initially from day one, they accept the report, they give you feedback and updates, and then they determine themselves the severity of what they deem as a fix.

And then when they’re going to fix it, and they keep you in the loop.

And then you’ve got like the middle ground, the gray area, so to speak, where you will submit something, they’ll say, you know, thanks for submitting that, and then you just won’t hear anything back.

And then you check for future versions and nothing’s been fixed and it’s exactly the same as it was.

And then the last one is like you just don’t hear Anything you submit stuff, you follow up and you just get no response whatsoever.

And then you just, after 90 days you just send that email, send up, I’m going to talk about this now.

And in the hope they’re going to do something.

And some do and some don’t.

So it’s.

Yeah, it’s, it’s very sort of up and down really.

Some take it on board, some just say thanks and some just don’t do anything.

So very mixed bag.

Yeah.

So sometimes even, you know, in some countries we do are fortunate, you know, where it’s the national security agencies who tend to maybe also contact them and kind of force them, you know, to doing something.

Especially if their devices and technologies being used in government agencies, they tend to take a much more, let’s say, you know, persuasive approach we might find it, but they tend to be the ones that’s like, well we’re using it, we’ve got it deployed.

So sometimes you get a little bit more force.

But it sounds like it’s very much similar to other industries as well, is.

I think those categories, you know, are very aligned.

It just comes to the maturity sometimes or the acceptance to change and to fixing things.

And what, what, what do you kind of enjoy the most?

Do you like still the physical side of things?

You know, the access cards or.

You said you were kind of more moving into the software side.

What was, what was kind of, do you still kind of enjoy the kind of more hardware side?

Because for me it was a hobby that started for me probably about a little bit over 10 years ago and I bought so much tools to help me with that side that it became a bit of an expensive hobby.

But where’s, where’s your passion lies?

Is it in the software side more these days or is it you still enjoy the hardware piece?

Yeah, I mean, so predominantly all of the work that I do, software development and the hacking stuff, is all around physical access control.

That’s where my passion lies and that’s the whole spectrum.

So that’s the software that you would either install, you’re communicating, you know, in the cloud, the physical controllers, the readers.

So I do a lot of stuff as well with biometrics for like face recognition, fingerprint stuff.

But it was more sort of fingerprint pre Covid and then Covid came and then everyone, it just sort of switched and now sort of predominantly in the area that I’m working with, it’s full face recognition.

So.

Yeah, so anything and everything associated with physical access control, whether that be the software, the Hardware, hacking, cloning, physical credentials.

I’ve actually written software and firmware.

There was actually a project called Paxton and Reader that was for capturing and decoding, logging stuff for Paxton Net2 switch to that sort of thing.

And that all sort of arose from the group that I joined.

I spoke about when I sort of just said I’m out sort of thing and then they sort of dragged me back in.

It’s great to have that, you know, you know, the need for, you know, it gives you some motivation as well in those situations.

It is good to feel kind of like, you know, your skills is adding value and needed and contributing.

So yeah, I mean, we aim, or at least me, you know, and the industry as a whole to do stuff responsibly and ethically.

But yeah, when you, you sort of join a group and then they were said, oh, we’re trying to do this, and then you think, oh, maybe I could help in some way, some part to do that.

And then you end up writing firmware for it first a lot in ESP module and.

And then, yeah, I mean, it wasn’t 100% sold in me.

There was contributions from the group as well and said we could add bits and we can do that.

And they supplied some source code like firmware and that got integrated and merged.

So, yeah, so very much sort of a group effort to.

To get the device where it needed to be so they can do their job, like sort of black team engagements.

So, yeah, and you know, and they’ve told me stories, obviously I can’t speak about them, but they’ve said we’ve managed to break into ABC because of the device.

So.

Yeah, definitely.

And obviously they did it ethically, responsibly.

It was part of an official engagement.

So.

But yeah, to, to create something and then have it used on an engagement is sort of just awesome.

It’s fantastic.

So, yeah, it might go far.

So what type of skill sets do you need?

What would you say?

The skills in your area that are valuable to be able to kind of, you know, contribute in this area.

What types of skills or knowledge is essential, really?

I mean, for me it’s just.

It’s all about just being able to read, write and reverse software, you know, regardless.

Obviously there’s loads of different languages involved.

A lot of the physical access control, like desktop software that you can install on prem predominantly is written like C Net.

So that makes my life so much easier.

Obviously there are tools for like opsification and some use good tools and some use mediocre tools and.

Yeah, but then I’ve also got my own tool set stuff.

I’ve either that’s free or I’ve purchased or I’ve written myself to sort of aid in the ossification and running through the binaries, et cetera.

And really it’s just that determination, it’s the, it’s the drive.

It’s like not giving up.

Even when you’ve tried and you try and you fail and then you just put it on the shelf and I’ll come back to that, and then you come back to that and then you get that light bulb moment.

Oh, damn, I can just do this and that’s it, I’m in sort of thing.

So yeah, it’s just being interested really.

I mean, you know, anyone can learn how to do stuff if you’re interested in learning how to do it really.

And what’s, what’s your go to application for doing reverse engineering?

Is it something like Ghidra or using IDA Pro or what’s, what’s your.

Yeah, so a mixed bag like IDA and Ghidra, um, got DNSPY Peak, netspy.

Net Reflector.

I’ve got some, some stuff I’ve come across is like VB6.

I’ve got some tooling to sort of reverse engineer all that stuff.

So yes, it, it really is sort of a mixed bag.

Even like the, a lot of installers, like Phys, like software installers, we use our MSI packages and then you’ve got like MSI extracts to sort of look into that, look at custom actions, see if there’s sort of embedded stuff in that.

As part of the installation I found a load of passwords hard coded in there when it first gets set up and then you can just extract that and go.

Right now I’ve got, I’ve got the sa, it’s hard coded, voila.

And it’s open.

TCP IP is enabled over the network.

I can just now connect to it.

Execute command shell.

I’ve now got my code execution.

Away we go.

So things will trigger some old memories for me because I used to be on the team of the Wise Package Studio for the installers.

That was a team that I had.

So it brings back a lot of memories for the installers and being able to understand about how they’re packaged and made executable.

So one question I’ve got for you as well is around what’s the most common types in the spaces?

From the vulnerability side of things, what’s the most common things you see is it weaknesses in the encryption are the keys are Just hard coded.

What’s the most common areas that you experience?

Yeah, I mean it’s just that it’s hard coded encryption keys.

We are literally hard coded into the binary.

I have seen a shift in some companies since you sort of point that out to them and go, you should to do this.

Because once I’ve got them, I’ve got them and that’s it, it’s game over.

At least create a random unique key for every install, every time you install the software.

So that means I need physical access or I need to gain remote access to the machine to extract the keys, in which case I’ve already got physical access to the machine anyway.

So.

But yeah, predominantly a lot of it is hard coded encryption keys and once you’ve got them, you’ve got them and that’s it, it’s game over at that point.

And Also hard coded SA passwords like sip, MySQL like Microsoft SQL Server and it’s just enabled like TCP IP is just on and it’s accessible and browsable over the network by default, even when sometimes it doesn’t need to be because the desktop software client is talking to its own custom server and not necessarily directly to SQL Server.

So just turn that off, just disable it and just run it localhost if you’ve got your own server anyway.

So yeah, hard coded stuff, SA passwords, encryption credentials and all that stuff is, is like the holy grail basically.

Okay, and what’s some of the best practices?

Are you also seeing a shift in technology as well as you mentioned, you know, used to be fingerprint readers and physical cards and it’s moving to more biometric, you know, facial recognition side and of course that was to get it more touchless based.

And we’ve also seen here, even in the Estonian national ID they moved to things like nfc, near field communication more or mobile based, let’s say authentication.

Are you seeing a shift in technology and moving away from the older kind of old, let’s say, let’s say the old 125khz cards which had very basic functionality to much more modern technology?

Yeah, I mean when I first started obviously like many, many years ago, it was just basic cars, 125 kilohertz.

And then yeah, then you obviously you’ve got lots of different car technologies and different levels of protection.

Then you’ve got obviously the NFC side of things, but you do have a lot of backwards compatibility.

So the reader itself, although it can support best file for example, it can also just read the uid and you can use that as the credential.

Okay, then, cool.

So I just, you know, just clone the card and use the UID and boom, you’re in.

And then there was a lot of push for fingerprint readers, at least in my experience in the field that I was working in.

So a lot of people were like, oh, we can use fingerprint readers, it’s more secure, et cetera.

I mean, the ones that I’ve tested aren’t.

We’ve managed to spoof them just with wax impressions like pva, Covid.

I did some stuff with Matt Lewis on fingerprint and Face Rec, like spoofing all of these readers that I had in my collection over the years.

And I think we pretty much spoofed all of them apart from one manufacturer.

And then, then obviously Covid come along and then it was like, okay, we don’t touch fingerproof readers anymore.

We now use face recognition.

And then the industry sort of got to realize actually this is, it’s better because it’s quicker.

As soon as I walk up to the door or turnstile, even sort of get right to it, it’s already detected me, the turnstile, the doors open, I just walked straight in.

And obviously now we’ve sort of got a push for mobile credentials, especially sort of, you know, in the advertisement of Apple and in the wallet and all that sort of things.

So, yeah, I mean it’s, the paradigm is shifting, but then I think it always does.

There’s always something new that will come along.

You know, it’s just the nature of the beast, so to speak.

Absolutely.

I think it’s.

You made a good point as well that backwards compatibility, you know, not everyone can shift immediately and we always have to have some way of dealing with the older technology.

And I see that sometimes as many of the failures, you know, the ones that gets exposed.

Exposed is because of the backwards compatibility or the need to support legacy means that your, your, your level of basically security is as low as those, you know, those technologies provide as well.

So when, when, when you’re doing assessments.

So what’s a typical tool?

What’s, what’s the tool tool set that you have?

Do you use Proxmarks or what’s, what’s your go to set of tools?

Yeah, so obviously I’ve got the, the Proc Spark Iceman firmware.

So I use that.

I don’t do tons of stuff with sort of the cars themselves.

I’m all that to the group that I’m in because they’re the ones that’s for the Black team engagement.

So I don’t, I don’t physically break in anywhere.

I’m doing this sort of part time, spare time as a hobby because so really sort of tooling is, it’s just basically is.

I try to look at it from a perspective like, is it, is there a problem that needs to be solved in respect of any tooling that might be missing, whatever that may be.

And then if I can and I’ve got the time, then I’ll try and create something for that.

I’m actually working on another project with firmware for sort of the Wigan side of things, like a hid R90 reader.

And I’ve got a whole list that was provided to me of all like 60 different sort of encodings for all the different types of CAR technologies.

I’m writing firmware that will not only log that data, but then try and do all the decoding based on how many bits it was, et cetera, et cetera.

And this is for me, it’s just for fun.

Yeah, Got my full time job and obviously I know there’s tools out there that will already do some of what I’m doing or if not all of it, but I’ll be.

So I’ll do it for myself because I, you know, put my own spin on it.

And it’s also, for me, it’s education, it’s learning.

It’s like, you know, keeping your finger sort of in that pie, so to speak, to keep yourself sort of sharp.

And how do you do this?

Now there is a lot of stuff that I come across and go, oh crap, how do I do this?

How do I figure this out?

And then you sort of just, you know, you fall down this rabbit hole and then six months later you’ve figured it all out and you’ve got this product, software, piece of hardware, firmware, whatever the case may be, and you’re like, oh yeah, that’s cool, that’s another check mark.

And then you’ve got that code to refer back to later should you need to use it for anything else.

Yeah, for very, it’s very much for fun and for learning for me.

So.

Absolutely.

Same same for me in this, in this area.

Because I mean, my specialty focuses on identities and credentials and you know, a lot of the software side of things, infrastructure and cloud.

And it was actually the, the physical access side of things.

I think I did years ago helping with an assessment for a ship management company.

And you know, we got into the physical side of things then and that’s where I really got the Interest and I end up going down this path as well where it’s become a very, very long passion hobby with the Proxmarks and everything else has came with it.

And I end up even just sitting here.

I’ve got a whole package sitting of cards that is to be delivered to Iceman.

Yeah, I don’t know if you’re like me is that when you go to traveling or hotels or you go anywhere you end up with a collection of lots and lots of actually.

Yeah, absolutely.

Yeah, I’ve got my fair share of collection of cars that I’ve collected over the years for various meetings that I’ve been to and hotels.

So yeah, I definitely collect it all.

I do get the kind of, you know, the needs.

I was like check it as well.

Yeah, absolutely, absolutely.

Yeah, scan it on your phone initially maybe just for a quick check and then stick it in, you know, on Proxmark and just find out what it is and, and then revert to the group that I’m in and go guys, what’s this?

I haven’t come across this or how did you decode this?

And they go, oh, you can do this.

Oh sweet.

So again, it’s all about earning.

I’m under no illusion that, you know, I know everything because I most definitely know that I don’t.

And it’s all about for me.

Yeah, reaching out and just asking questions and trying to contribute in any way that I can that would help the industry.

Absolutely.

It’s the same same for me.

I mean I have knowledge in it, I like to kind of explore and play around with it.

But my preference is kind of connect with the experts, yourself and Iceman and others in the field and that really help fill the gaps for me.

So you know, because it’s not nerdy that I don’t do it every single day.

I probably, you know, spend maybe a weekend a month or so forth and kind of pull it out and play around with it.

Yeah.

Even, even the point where when I, when I bricked things, I bricked my tool so many times I had to pull out things like the bus pirate in order to kind of rewrite the firmware and then was it to kind of do the chips and try to get it to work, which has been a good skill.

But Iceman’s helped me many times out of, out of a hole when I’ve got into it self inflicted of incompatible versions sometimes.

So what, what’s, what’s, what do you see, you know, what’s next in the industry?

Where do you see some of the kind of the future going, what’s some of the best practices organizations doing in order to really make sure that this is something, you know, that becomes protected much more in the future?

Where do you see the trends?

I think for me for the minute, what I’m looking at is definitely a massive push for stop using plastic cards and move to mobile credentials.

That’s what I’m seeing all over LinkedIn with various sort of manufacturers and installers and even end users saying yeah, how they’ve benefited from disregarding the plastic altogether.

So there’s no, there’s no vulnerability in cloning a physical car because they just don’t exist anymore, you know, on certain sites and they’re using mobile credentials.

But then that piques my interest.

I’m like, oh, mobile credentials.

How is there any way to sort of interact and do something you shouldn’t be able to do with those?

And so yeah, I think it’s, it’s very much sort of cat and mouse really.

But me, you know, you try to be ethical and responsible and if you find something, you report it.

What they do with it is up to the manufacturer.

But that’s the sort of shift I’m seeing.

There’s still a lot of biometrics.

People are using biometrics a lot, especially in construction, a lot of phase readers.

But predominantly the shift I’m sort of seeing is, you know, dropping plastic, moving to mobile credentials and a lot a big push as well for like removing on premises software and just having it all in the cloud.

I don’t necessarily always agree with that.

I think there should be options for companies that don’t want it in the cloud for sort of privacy and all the rest of it.

But again it’s down to the installers and the end users to decide what route they want to take personally.

Absolutely.

Sometimes there’s a regulatory enforcement to have something continually within country or within location and that can cause challenges.

Yeah.

But I do see some countries there is, they’re using face rec but there’s like, I can’t remember what country it was but you’re not allowed to store or retain the template information on the physical device or the server.

So they introduce like template on mobile or template on card, present card or mobile template gets transferred, then it does the match and disregards it.

Yeah, it just, it just depends really who your target audience is and I suppose what country you’re targeting as well.

Absolutely end up just becoming a mathematical fingerprint off the actual facial recognition or the, the image itself, which makes it much more Secure and a method of when you’re transferring, transmitting it as well.

But I do, I like the move to mobile credentials anyway because from an enablement and provisioning it’s a much more simpler method.

With the physical cards you have to, you know, transport them and get them in people’s hands and then you’re exposing the readers to the external facing side where moving to mobile credentials it can be proximity based credentials where it could be even Bluetooth initiated, initiated where the reader can be on the inside.

So it can be done through wireless as well.

And I completely agree.

I’ve seen you know, a lot of countries shifting to the digital wallet kind of standards or it means then it can you know, just be basically an, an attribute within the wallet itself and much easier, much easier to provision.

I think the challenge has always been when you get into the mobile side of things it’s much more difficult to migrate.

Migration has always been a challenge.

How do you know new devices, how do you move it securely to a new device and so forth or, or if you have multiple devices, how do you make sure that you’re not, you know, getting it cloned accidentally with someone else?

So I’ve also seen a shift as well in readerless access control.

Well, yeah, there is no physical reader.

It’s you’re just using your phone and basically like an NFC plaque or, and, or QR code and then your phone is then authenticating you and then sending data to a server which then clicks the relay energizers and lets you through and opens the door.

So yeah, there is a company that is releasing something.

I’m not sure if I’m allowed to say anything about it yet so I won’t.

That’s releasing something of literally next month I believe.

And there’s actually another company called Door Deck that does the exact same thing and they just pop plaque on the door and yeah, you present your phone and away you go.

Yeah, I do see this.

You know the great thing is it’s going to merge with lots of different things like things like digital visas and so forth.

You know, you know when you go into countries you can already have the templates already set up beforehand.

So you’re going through immigrations and visas or you know, airport travel and stuff like that.

We need to cross borders.

Then this can also be combined with your access control too.

Yeah, definitely, definitely.

So what’s, what’s some of the ways, I mean, so this is a, you know, you said it’s a hobby passion area for you.

You enjoy, you know, you’re doing it for a long time and you have access to, to a group.

How do you stay up to date?

What’s in this area?

You know, it’s, it’s always changing.

There’s always new hardware, new technology, lots of kind of movement and what resources do you.

Do you know, how, how do you stay up to date?

How do you continue to learn?

Do you, do you do courses?

Do you go to conferences?

Do you, you have a mentor?

Do you.

Where’s your kind of source of knowledge?

Yeah, so I don’t really have a mentor, but I’ve got the group and obviously they’re a great bunch of guys, very, very knowledgeable.

The group I’m in, I don’t know why I’m in it, because I do this for fun and they do it all day, every day.

So.

But they invited me.

Sort of stuck with me now.

But yeah, so of any questions I’ve got regarding hacking stuff, like for all different aspects of it, then yeah, I can just sort of throw them a question and they can point either they know the answer or they can point me in the right direction.

And then I watch a lot of sort of YouTube stuff that’s dedicated around hacking and software and cloning, all that side of things, to sort of, you know, keep up to date.

I do read certain bits and pieces, some publications and white papers, et cetera.

It just depends whether I’m interested in that area that done.

And I’m now starting like doing sort of more podcasts and that’s the hope.

Do more sort of get the word out there about who I am and who, who the host is and what we do as an industry.

Yeah.

So.

And really as well, it’s just if you, if you just sort of reverse engineer software, then you can see what they’re doing and how they’re doing it and what technologies they’re using and how they’re implementing it and whether what they’ve done is good in the middle or bad.

And then you can sort of learn from that as well.

So, yeah, I do find a lot of learning just by simply reversing, softening.

And you get that moment, you think, oh, I didn’t think of that, that’s a good idea, or no, don’t do that, that’s bad.

So, yeah, absolutely.

So I did Atari course to write games in assembly language.

So when I was getting the reference engineering side, I would be a better understanding about what I was looking at, which actually helped.

It helped a lot.

Yeah, yeah.

Is there any bit of a, you know, for any of the audience who’s listening in and you know, decide, oh, this is an interesting area.

What would can a.

What would be the starting point?

Where would you recommend them to go to to get started?

What would be the best place to what learn.

To learn about access controls, to learn about, let’s say, you know, the devices and this technology.

What’s.

What would be the best place to get started?

What do you kind of.

Where would you direct them to?

That’s.

That’s a really good question.

Yeah, I don’t really have a good answer for it to be fair.

I mean, yeah, there’s.

Because there’s so many manufacturers doing so many different things really are.

It really is a minefield because like you said, it’s compatibility and what reader should you choose and what access control or platform?

I mean as a, as a youngster that’s trying to get into the industry then like skills for security and you got the, the security event that happens every year in the NEC in Birmingham.

Maybe that’s a good starting point.

Obviously apprentices, trainees, that sort of stuff to get into it.

If you want to hack stuff, you just got to start hacking stuff.

You gotta learn.

That’s the thing.

It’s just dive in.

You know, we can all just sit there for six weeks watching videos, but really hands on, let’s get some example code.

Let’s just try to figure out now let’s start writing something.

It doesn’t matter if it works or not.

At least you know, that’s for me the best way to learn is by doing so.

Yeah, you could even buy some cheap physical hardware stuff off ebay and just up way with it, you know, whether you’re hacking it or just figuring out how to use it, just wire it up and you know, if you get something cheap and you break it, it doesn’t matter.

You, you know, just play with it.

Yeah, I think I.

Even when I remember starting and working, you know, getting my kids involved in it, it was the Arduino and getting the NFC kind of card reader extension to Arduino and kind of.

And then you’re creating your own.

You’re actually, you know, implementing it and doing the code and then you start understanding how it works.

I think even before that.

You’re absolutely right.

I think going to conference and, and you’ll find conferences out there, whether it be, you know, likes of B sides and other types of, you know, local events.

They might have a, you know, access control village that will kind of show you also how everything works and give you some training and knowledge.

I think I remember going back to the really early times, was even just getting my kids kind of into lock picking.

Okay.

Yeah.

Understanding about, you know, the simple locks and since starting there.

Funny story was when my son was coming to my office all the time and, and he wanted to play PlayStation.

I was like, no, you can’t.

You have to do something educational.

I was like, what have I got lying around here?

I was like, oh, there’s a couple of lock picks.

You put the controller in a box, put the lock on it, it open it, you can play PlayStation.

Yeah.

He was like sitting there and then he got really good at it.

And then one of the funny things, when I was going to DEFCON last year, he was like, do you want me to bring anything back, like a T shirt, hat or something?

He’s like, no, I want a professional lock set.

That’s it.

Yeah, okay.

But absolutely.

I think, you know, going, going to a conference and an event and, and, you know, seeing if there’s a village or, or, or a session or something.

There is definitely a great way to, to one is meet the community, is meet people behind a lot of it.

Absolutely.

For the audience, if they do want to connect with you or reach out, what’s, what’s the best place that they can connect with you, probably LinkedIn will.

Be the best place because that’s, anything that I’m doing publicly will be published.

There’s various bits and pieces on there and yeah.

So for anything physical access, whether that be development or hacking or whatever, then.

Yeah, LinkedIn is the best place.

I’ll make sure even in the show notes we can, we can add the link so people can easily find it.

Absolutely.

Daniel, it’s been fantastic having you on.

So it’s a topic that, for me, it’s, it’s, you know, it’s a hobby, a passion of mine, so.

Absolutely.

It’s a pleasure having you on.

Really excited to, kind of to keep in contact with you.

And whenever anything comes up, we can definitely share ideas and knowledge.

And for the audience, many thanks for listening in to this episode.

It’s an area which is exciting because it’s that kind of crossover between the physical and the digital world.

It’s where, you know, physical meets digital.

And having that knowledge about access is essential and critical in today’s world.

So hopefully this episode has been educational and giving you some enlightenment and also maybe give you an idea of maybe other paths or other ways and careers that you can go down and learn something new.

Daniel, many thanks for being on.

It’s a pleasure having you.

For the audience, tune in every two weeks for an episode of the Security By Default podcast.

I’m the host of the show, Joe Carson.

To everyone out there, stay safe, take care, until the next time.

Thank you.

Thank you, Joe.

Thanks.