Archive for the ‘bumping’ Category

Assasination and hotel door security

Monday, February 22nd, 2010

I am reading up on the assassination of Hamas leader Mahmoud al-Mabhouh with red cones. Never ever have so many operational details come out about missions like this. Twenty years ago this would have gone on file as a ‘highly suspicious death’, but in this day and age of CCTV camera’s it did not go unnoticed. What is special this time is that a (must see) video just was released by Dubai police, and it looks like a hollywood production. The link to this blog? … since the murder took place in a hotel, I was immediately interested to read details on how they gained entry. And there still are some things unclear about it, even though this article speaks about “They entered the room using copies of keys they had somehow acquired.”

electronic hotel locks with a mechanical override

This could point to the fact a lot of electronic hotel door locks have a mechanical override. Most of the time there is a mechanical lock mounted under the handle of the door that can be opened with a master key. In some cases the lock is even hidden under a sticker or label, but in most hotels I visited there is a lock present in case the electronic lock fails (in some countries it is not legal to rely only on the electronics). I know that in some hotel locks a mechanical opening is still recorded by the electronics in the lock and will end up in the log files. To get hold of the masterkey, one could rent a room in the same hotel and simply (for an intelligence agency that is) take the mechanical lock out the door, take it apart and make the master key based on the now known pin lenght. (Or if you believe the myth, ‘they’ already have done all the fieldwork and collected the mechanical master keys to all important hotels in advance anyway …)

Another way to open some hotel doors would be to simply go under the door and grab the handle from the inside using a special tool. As you can see in this video, it is not so difficult. And the tool used to go under the door is even available in a ‘government only’ version. This version can easily been taken apart into small segments but is only sold to government agents.

And I suggest a slightly modified tool like the one on the video was used for the finishing touch of the murder. To make it look like a natural death, they locked the chain on the inside of the door …

It is all a funny coincidence as the video of the tool was just shot a couple of weeks ago when Han Fey and I did a presentation at the famous IT-Defense security congress Germany. It is a congress where we always meet lots of interesting people and always get a lot of invitations to give more presentations and/or workshops. We were originally invited to just do some hands on workshops and teach people the basic locksport/lockpicking skills, as well as a few simple opening techniques like shimming doors etc. But when some of the conference speakers missed their plane, we were asked to give an ‘emergency presentation’ to fill the gap. And as we do not like to give the same presentation twice, we shot some video (using a mobile phone) on the spot late at night about the door opening tool (and how to protect yourself against it) and inserted it into a compilation of existing presentations. Originally I did not intend to release the video as it shows me opening a door, but in this case I make an exception …

And for those of you who want to know more on the inner working of hotel locks, I have blogged about it before (including a video of ‘how it is made’)….

What is the lifetime of a ‘public secret’?

Monday, September 28th, 2009

I wrote about public research before. As far as I am concerned research should be done out in the open. And all parties involved should know the vulnerabilities in detail. And parties involved for me are: the (potential) customers, the manufacturer and the rest of the research field (in other words: everybody). It is a fact that if you make a public announcement revealing eighty (or more) percent of your discovery, some clever person will stand up and fill in the missing part. And the more common a lock is, the sooner this will happen (as people have hardware to compare and try attacks on).

Bi-Axial pins

The greatest and most clever ‘lock hack’ I have even seen is a method to bypass some Medeco sidebar locks (on locks with bi-axial pins, filled by the official codebook, manufactured before Q4 2007). Marc Tobias and Tobias Bluzmanis hacked the lock and even wrote a book about it … an all time classic and ‘must read’ if you ask me (and I wrote the foreword). However, the book does not reveal the last twenty percent needed to actually make the so called ‘code setting keys’ that are needed to bump and/or pick open the locks.

I learned some time ago someone did his/her homework and published the findings on the net. A document called ‘code set.zip‘ appeared on a site called ‘mega upload’….

I wonder how long it takes before someone will post a cliq.zip there ….

Defcon17

Wednesday, August 5th, 2009

Just got back from Vegas and will share some experiences with you….

Lets start with the US lockpick championships:

Jgor ... US lockpick champion

And the winner is … JGOR!

From the fifty participants that attended the US lockpick championships at the Defcon17 conference, JGOR stood out. It was impressive to see his ‘cool’ way of picking. While his opponents were nervously raking and rapidly moving the tools in and out the lock he was just calmly picking. Setting one pin at the time yet opening locks in impressive times (like 17 seconds in the finals on a lock others did not open). To me it is clear the best man won. Second best was Schuyler Towne, third was a draw between Chris Pentacoff and Tokey (from France!).

By winning the US lockpick championships Jgor won a full paid plane ticket to the European lockpick championships in Turkey next year. It will be interesting to see how well he does there.

Deviant and Babak (Toool.US) did a great job organizing the lockpick village and the various lockpick games. One of the things I admire from Babak and Deviant is their eye for detail. Take for instance the locks used in the games. These locks are connected to an electronic timer that stops when the lock is opened!

Fun:

It is always fun in Vegas. Renderman introduced me to one of his friends who had a little problem with some of her locks. I seem to be losing my touch as I was not able to open the simple lock. Maybe it was the jetlag? After hearing the story, my dear wife Charlotte found an appropriate t-shirt for me at the vendor area two days later. Other fun was meeting some famous people in vegas.

The vendor area:

As you can see on the video above, there was lots of activity at the vendor area. There even was a stand selling bumpkeys (using a slightly NSFW booth-babe). Check the youtube video for details (and a good laugh).

Public and private talks:

I only visited one presentation. Obviously it was the one by Mark Tobias and Tobias Bluzmanis. Han and I spoke with them before the presentation and learned about the details of their attacks on some of the electromechanical Cliq locks. Pretty impressive things they have come up with. They did not go publicly into details on how to bypass these expensive ‘top of the line’ high security locks. Han and I know the Cliq system well as we did conduct our own research for a year now too. And we will go into details when we discuss our research at our presentation at HAR next week. Interesting times we live in ….

Dangerous place:

Defcon is a dangerous place. At least for those that are not computer savvy. The famous ‘Wall of sheep’ was showing (parts of) login data of those not using SSL or other types of encryption when popping mail or transferring files etc….

But even when Defcon is a dangerous place … we all made it back safe. Now preparing for HAR! Hope to see you there!

Wired on Marc Tobias and picking/bumping Medeco locks

Friday, May 22nd, 2009

*NewsFlash*

Wired on Medeco

Wired just came out with an interesting article on Marc Tobias (and Tobias Bluzmanis). It also contains great video of them picking and bumping Medeco locks (in as little as 9 seconds, not including selecting the correct side-setting key …). As I am in the middle of something else here, I keep this post short for now. Just go read the article now ;)

special deal in ‘off the hook’

Wednesday, May 21st, 2008

Tonight Marc Tobias will be the special guest in the “Off the hook” radio show.

Topics covered are his new book, and the role lockpicking is going to play at the ‘last hope conference’.

And on top of that, some special offers will be made that are only valid during the show!!

“Off The Hook” airs every Wednesday night at 7:00 PM EST in New York City on listener supported WBAI 99.5 FM. It can also be followed by this audio stream, or as a high quality podcast (only available one week from now).

Silly experiments

Monday, May 19th, 2008

silly experiments

Even tough I never met him, I am starting to like Ian Cecil.
In the comments of the previous posting read had a different theory about what actually happens when you bump a lock.

This is what he wrote:


Every theory even so called facts have to be challenged.

So here is an experiment everyone can do.

1. Make a cutaway cylinder so you can see the top pins.

2. When you hit the Bump Key, what would you expect to see? The current theory would suggest you would see the top pins fly up above the shear line, just for a millisecond. Also you would see the top pin with a large bottom pin fly up further?

3. So keeping the cylinder perfectly lined up bump away…

4. Anyone with a high speed camera should be able to photograph the pins separated. (personally i have not seen this). They only separate when slight turning pressure is applied no matter how hard you hit it.

I would also suggest that the practice of turning the bump key just at the right time is also not correct. It is better to have a constant pressure like picking.
No pressure at all dose not cause any separation of the pins. so no point trying to get the timing correct.

Now, I like this way of thinking. Never assume anything, test and see for yourself. It is the only way to learn and find out new ideas.

So I followed Ian’s advice and assembled a cut-away lock.

And Ian is right. If you just hit the key, you do not see the pins move. But …. does this mean the pins do not move?
I think it just happens too fast for you to see, and maybe the blow of the hammer on the key causes your eye to close for a split second …

Unfortunately I do not have access to a high speed camera, so now I had to figure a way to ‘capture’ events that occur in a split second.

In my first experiment I used a thin piece of wire and bended it in a L shape. Then I just hung it in the top of the spring, the
The little wire was so short it did not made contact with the top pin. Yet, when I bumped without turning pressure, the L shaped wire jumped right out of the plug.

So something was moving, and I suspected the pin to push it out. But in theory it could also be the spring.

My next experiment was using grease. I greased up the springs and clearly photographed the cut away lock. This is the ‘before’ picture.

After that I hit the key ten times (without tensioning the key), and the result is the image on top of this posting. As you can see, all the grease was pushed out severely (here is a ‘before/after’ image). And most interesting on pin 1 and 5, there was now grease on the side of the top pins!

The fact there is a grease residue on the pins prove to me the pins did travel. And you can also see by the way the grease was pushed out of the chamber.

Of course I could be wrong, but for now I am still convinced the bumping theory works as advertised ….

Golden (bump proof) pins

Monday, May 12th, 2008

bump proof?

For a long time Han and I are doing tests for various lock manufacturers. At the beginning, most of the requests were concerns if the ‘bump proof’ pins they came up with were really bump proof. And most of the time they were not.

On average it took three rounds of testing (and back to the drawing board) before we could not bump open the lock anymore. In some instances we supported the manufacturer with some technical advice to really make the lock bump proof (or highly bump-resistant).

And of course we have been thinking about designing our own bump-proof pin. We labeled it ‘the search for the golden pin’.

In our view, the golden pin has to have (at least) the following properties:

1) Prevent bumping one hundred percent (bump-proof, must withstand ‘advanced bumping’)
2) If possible, make other kind of attacks more difficult (like picking, impressioning and decoding)
3) The solution must contain not too many parts and must be easy to manufacture
4) Easy to Add to a classic 5 pin tumbler lock without modifying the core or house (too much)
5) If possible the ‘golden pin’ must be implementable in dimple and or other pin-tumbler style locks
6) Free of patents

Han and I have been partly successful in this search. And still we are having new ideas and brainstorm/try out sessions on a regular basis.

But ever since our trip to Vienna, our way of looking at the problem has changed.

We learned that if you ever want to have your invention implemented by a lock manufacturer, stop searching for a ‘golden pin’, and start searching for a ‘golden key’!

That is right, lock manufacturers are under constant pressure to come up with new patents on keys. A ‘patented key’ is required in all serious projects, and when a patent is ‘end of life’, so is the commercial success of the lock. Or actually a couple of years before the expiration of the patent (after all, who wants to buy something that will lose it’s ‘copy protection’ in three of four years?).

In a way it is a very healthy system. It keeps lock companies innovative. They can not just design a lock once and live of that design for ever. It forces them to keep investing in engineering.

The flip side it that great locking systems all of a sudden become ‘worthless’ because of the patent expiration. And in some instances that is not fair if you look at the level of security the lock and keys are still providing.

Looking at our mailbox, we are not the only ones looking for the golden pin….

A couple of times per month we receive mail from people who came up with pins or solutions against bumping. In almost all cases the six above properties are not met.

One of the last mails I recently received was from a gentleman called Ian Cecil from Australia. His invention is somewhat smart and makes use of the ‘floating pin’ principle. With that I mean that one of the pins is not reaching the ’9′ position. We have first seen this solution in CES locks where they simply did not drill the hole in the plug all the way. And other floating pins can be found in systems like GeGe Pextra, Nemef and Master padlocks.

But before I take you to all the solutions we found in various locks, back to Ian:

Ian cam up with the following idea: Use a short spring that is connected to the ‘stopper plug’ and the ‘bottom pin’. And the bottom pin is by magnetic force attracting the top pin. If you keep the top pin small (0-3), the bump key can not make contact and obviously does not work. As I said, a nice invention but far from ‘bump proof’. The lock can still be opened by ‘advanced bumping’.

How does advanced bumping works? If I know there is a floating pin inside a lock, all that is required is a set of probe keys to determine the position and minimum depth of the floating pin. And once that info is decoded all I need to do is cut a 99949 key and open the lock.

Still, Ian makes a lot of sense on his website and shows he does know what he is talking about. Who knows, maybe he will come up with a ‘golden key’ one day ….

Newsparkling toools

Wednesday, September 26th, 2007

I had noticed the site of newsparkling tools in Singapore some time ago, but have just been too busy to look into it and order anything.

video of mul-t-lock pick by newsparkling.com.sg

But ever since someone demonstrated me their nifty tool to open some models of Mul-T-lock locks I am going to place a big order soon!

So first of all there are picktools for mul-t-locks, but also tools to pick disc locks, cut-away locks and even a special bump-key set for dimple locks.

In other words: interesting stuff … I will keep you posted on what I order and if it is as good as it looks like.

I was very pleased to be able to play with one of their mul-t-lock picks for 30 minutes and shoot some video (youtube or quicktime 22 MB) of it. Unfortunately there were only two locks available, to test this tool on. I was told one of the locks was a brand new and certified one, the other was a cut-away model. And both could be opened relatively easy.

And I am not sure how long this tool will be effective. What I have learned about the Mul-T-lock company (and its engineers) is that they are continuously improving their product. So a trick that might work on a lock produced yesterday, will not work on a lock that is produced tomorrow. And that is the way it should be. You can not prevent people finding exploits to your locks, but you can do all you can to prevent the exploit to work on future locks.

Time will tell ….

* Update 27/09/2007: Time did tell, and fast!

Yaron from Israel wrote in the comments that the tool seems to work well ‘in the field’ and that already burglars have been arrested in possession of this tool. Yaron was kind enough to scan the newspaper article (in Hebrew) and translate it in English. Thanks Yaron!

who are you gonna call?!? Pickbuster ?!?

Friday, April 13th, 2007

Over the years Han Fey and myself have seen many solutions to the
bumping problem. Sometimes the lock companies engineers came up with a
good solution, sometimes they failed miserably.

pickbusters 'shots'

I am not sure in what category ‘pickbuster’ belongs. Looking online
and on their website, their solution sounds a little bit too good to be true :

Lock Bumping – The Solution

Almore Ltd has developed a radical solution to this threat, which
renders any existing cylinder far less susceptible to this Method Of
Entry. This is done without replacement, leaving the existing cylinder
and keys in place whilst acting to greatly increase the effort
required to access the cylinder.

Applied in a solvent carrier, PICKBUSTER is non–toxic and provides
excellent long term corrosion resistance. A single application will
provide protection for the life of the cylinder.

Today I have received two ‘shot’ of pickbuster and will give it a try
over the weekend. Needless to say I will shoot some video of the test…

Dutch Video available

Wednesday, March 7th, 2007

The Editie NL video is available now …

http://www.toool.nl/blackbag/video/editie-nl.wmv (10 Mb)

Or on youtube (for those having problems with WMV files)

http://www.youtube.com/watch?v=C_Re5GOARjc

Oh Shit ….

Tuesday, March 6th, 2007

Those were my words when someone pointed me to the new and improved
website of multipick in Germany. Previously they offered a set of 10
or 12 bumpkeys. We tested these keys in our consumer reports test in
2006, and found they were of very poor quality.

However, multipick now seems to have invested seriously in their
bumpkey division.

You can now order individual keys online, and to make things
convenient they included the images of the profiles of the keyways.

Life for criminals have never been easier … Just examine the lock
you want to open (or make a picture), compare with the profile
sketches on their website and order the correct key online.

We have not tested any of multipick’s keys yet, but looking at how serious
they invested in their website I fear for the worst….

Dutch RTL just visited me to shoot some video for a TV item about this
new site and the consequences it has for security in general. It will be
aired on RTL4 around 18:15 today in a program called ‘editie NL‘.

(Video available now, WMV 10 Mb)

Slowly but surely …

Sunday, December 3rd, 2006

US locksmiths are beginning to develop a clue. For a long time I only
found negative responses from locksmiths in regard to the bumping
problem. Just as when bumping became known in Europe and the
Netherlands: denial, shooting the messenger and spreading
disinformation were tactics deployed by locksmiths and the lock
industry. It took some TV appearances and a test by Dutch Consumer
reports to change all this. Consumers are educated now and often
request locks that can not be bumped. And we even hear stories of more
and more consumers asking specifically for drill and pull resistant
locks. People seem to learn fast, and internet is a great source to
find information. To do harm but also to protect yourself….

tnl logo

It is a good thing to see people in important places in the US lock
industry are beginning to see the light. Greg Mango, Editor of leading
locksmith magazine ‘The National Locksmith’ is one of them. He wrote a
very good column in TNL. I hope US locksmiths wipe the foam of their
mouth and read it carefully…

Last day in Dubai

Tuesday, November 21st, 2006

Tonight I will fly back to The Netherlands. November 22 is an important
day after all … election day! I am looking forward to that!

Dubai and the Gitex tradeshow are very nice. In dubai security
awareness concerning locks is very very low. On almost every door you
will find the cheapest Chinese lock money can buy. Since we are going
to set up a new Toool lockpick competition next week I decided to buy
a typical Dubai lock to add. But the low end lock quality simply was
too low. The lock would not survive two weeks of picking. Do I decided
to buy something slightly higher in the chain of ‘decent Dubai locks’,
namely a ‘GEO’ lock. According to the box made by black&decker. Still
it would seriously surprise me if toool members in the competition
will need more then one second to open it.

Bumping is relatively unknown in Dubai, and so is Toool. Still a few
people visited the CryptoPhone stand to say hi. They told me local
police forces know about bumping and picking, but there is a strict
ban on this kind of information. That is why the Toool site is blocked
from Dubai! You simply can not reach it. So I decided not to inspire
locals this time to set up a chapter of Tool in Dubai. Besides
Toool.nl quite a lot is blocked, including skype … bummer.
Fortunately there are some proxies that help me trough these difficult days…

Hong Kong Economic times about bumping

Monday, November 6th, 2006

This Bump key story is getting a little out of hand. It just popped up in China! 

Headline: 80% locks can be opened by a special-made key.

PLC, one of the biggest local lock agencies, said that they learnt this 4
years ago in an international exhibition, but they tested the loophole until
last year. As the effect would be huge, they didn’t disclose it to the
public. The Hong Kong Locksmith Society said that 80% locks could be opened,
and the situation became worsen after this news is disclosed to the public.

In our test, our reporter, who had known nothing about lockpicking before,
successfully opened the first lock with a bump key in two minutes. This
method has shocked experts in the industry, because it required no
expertise, it leaves no clues that the lock was opened and the tool looks
like a normal key.

Barry Wels, chairman of Toool.nl in Netherlands, had described the
vulnerablity is one of the serious loophole in locks, but as it would affect
the interests of some locksmiths and lock companies, people tend to not to
discuss it.  In the tests conducted by Toool.nl, some police-certified locks
were opened with a bump key. (Image copyright Paul Boven)

Lost & Found: depths and spacings list

Thursday, November 2nd, 2006

Always wanted to know the exact spacing en depths of one of the
following locks? : Arrow, Corbin, Dexter, Emhart, Falcon, Ilco,
Kaba, Kwikset, Lockwood, Medeco, Medeco Biaxial, Medeco Keymark,
Russwin, Sargent, Schlage, Segal, System 70, Weiser, Weslock or Yale

Too bad. The site hosting this wealth of information decided to remove it.

Due to

 

Fortunately there is http://www.archive.org and the ‘wayback machine’. There is no escape …
Just try: http://web.archive.org/web/20050215102400/http://dlaco.com/spacing/spacing.htm

Or download a .PDF file with the exact spacings here.