Archive for the ‘picktools’ Category

Electro picks, lockpick competition and back from Poland

Monday, December 3rd, 2012

Toool lockpick competition

Interesting news. The Dutch Toool division just released the locks for tenth Toool lockpick competition.

It does contain some interesting locks. A lot of people donate to the collection and my contribution are locks picked up in south-Africa and other countries.

Not all locks have been identified by Jos Weyers (who photographed all the locks). If you can help him identify some of the unknown locks that would be appreciated.

multipick electropick

At the competition only manual hand picks are allowed. Electro-picks are not allowed. If they were, I know what tool to use. By far the best electro-pick on the market is made by Multipick in Germany.

I spoke with one of the developers at the Interkey locksmith show in Poland last weekend and got some impressive demo’s. They make the smallest, most powerful, most silent and (unfortunately) the most expensive electro-pick on my wishlist.

I hope Santa will not forget about me this year…

(more info on my trip to Poland via twitter: barrywels )

* Update 12 December 2012 VIDEO of the electro-pick

Czech lockpick championships

Thursday, November 22nd, 2012

czech lockpick championships

Just a short blogposting this time to get me starting blogging again :)

Last weekend had a great time near Prague at the Czech lockpick championships. The Czech are friendly, well organized and sure have a lot of very exotic locks.

Our German friends from SSDeV kept scores on their blog (in German).

Below a small video of one of the rounds in ‘freestyle’. Many electronic pickguns and very fast opening times.

Impressioning champion … of the world?

Saturday, July 28th, 2012

There was a little confusion how to call the championships at LockCon. Should we call them US open or World Championships?

Barry Wels impressioning champion 2012 ... of the world?!?

To keep a long story short: I won the first US impressioning championships. And it was a close call.

The close call was whether or not I would participate. I did not prepare and did not even bring gear (suitcases were full of heavy stuff anyway). It was my new friend Ben Sherman who persuaded me to participate and generously gave me his file. And Jord gave me his spare handle. What followed was me winning all three rounds. And in the third round I was nicely focused and the only finalist to open the six pin lock in 60 minutes. We are all happy the title goes back to the Netherlands.

Even though I won a number of international championships, I am not really much of a competitive player. For me it is more important to be able to open a wide variety of locks in a decent time. This is what I teach at Lock-Experts (PDF) and rely on as a locksmith at intact-noodopening.nl. But I can not deny it is a good feeling to win.

LockCon 2012 LockPick championships … of the world?


Lockpick champions ... of the world?

Torsten Quast won the lockpicking games, followed by Julian Hardt and Jord Knaap.

I ended sharing the fourth place with “handcuff Ray”. And that is a pity because after a long number of elimination rounds both Julian and I were the only ones who were not defeated. But then I got into a pool of three people and lost, followed by a battle to the finals with Ray. And we both did not open any of the US Corbin locks ending us both at the fourth place.

All fun aside, Torsten seemed to like the idea of being the ‘unofficial’ world champion lockpicking. The Toool board had long discussions on how to organize the first “official” world-championships of LockPicking and Impressioning in the future (in corporation with other sportgroups like SSDeV, Fools etc). The way we envision it is that every locksport and (possibly) locksmith community in the world should organize their own championships and the winners of each of these competitions will be sponsored to fly to LockCon for the first official world championships. But don’t hold your breath for it to happen soon.

What else happened at LockCon?

Besides the warning for tornado’s all went fine.

tour trough the S&G factory

LockCon was held at the LSI facility. A great place with its own museum. Good for ours of looking at special locks. There were unique locks and keys all over the place.

We organized some workshops on interesting topics. At the tour trough the S&G factory we learned they had the ultimate safe to protect what is precious to you.

Lots of networking was done at the late night parties. People would show off their latest tool development, reverse engineer interesting hardware, make new friends and drink till all becomes blurry.

Just google for lockcon and find lots of interesting archives full of nice pictures.

Thanks everyone for making LockCon possible and hope to see you soon at a new event!

What I do on vacation …

Sunday, August 1st, 2010

It has been a little slow with my weblog. Maybe it’s because I now use twitter to burst short messages instead of blogging, but the silence here does not mean nothing is happening. On the contrary, a lot is happening….

combination safe lock manipulation minor difference

First there was the safe opening weekend. I am sorry to be repetitive, but the weekend was a great success. Julian picked open four safes, amongst them yet another couple of real monsters , and lots and lots of other safes were opened in more destructive ways. I really was eager to try to open a safe by manipulating a combination lock, but failed as the only lock around was a four wheel lips lock. I am by now reasonably experienced in opening three wheel ‘group two’ locks, but this four wheel lips lock was just a little too much for me. We ended up drilling a hole in the safe and using a scope to read the combination.

I like a challenge and am using the vacation I am in now to study the four wheel lock(s). Jord Knaap was kind enough to let me use one of his cut-away demo locks for this research/test. The lock is neatly mounted on a stand, and as Jord had an eye for details, he even included the anti-drill ‘hard plate’ on the stand (it’s the yellow layer between the dial and the house of the lock). The interesting part is that these locks have false cuts in their wheels, and the position of the false cuts seems to be different on some wheels. Maybe there is a pattern, but it is too early to say … It’s just the first day of my holiday today ;)

false cuts on four wheel safe combination lock to make manipulation more difficult

Behind the scenes we are busy preparing lockcon (October 8-9-10). It’s gonna be good as more and more people from all over the globe are attracted to it, and the presentations will be high quality as always. And I will use this two week vacation to reply to some mails people have send me. I am running a little behind but will be back on track before the holiday is over …

When every second counts: formula 1 impressioning tool

Sunday, June 6th, 2010

impressioning speed up tool

Our German friends from SSDeV decided to change the rules of the impressioning games. Instead of the fastest time on one lock, now more locks need to be opened and the person opening the most locks in the least amount of time wins. In the comments of this Hackaday post Jos explains the exact rules:

“First round everybody gets a keyed alike lock (so same amount of work) this round takes an hour. The six fastest go to the finals: during six rounds (20 min. each) all the contenders open one lock, which then gets swapped. So all finalists open the same 6 locks. The used keys are put in closed boxes so there is no way you know the key is supposed to look like.”

And with opening times of less then a minute these games are more and more looking like formula 1 pit stops. And so people are trying to come up with ideas and tools to shave off a few seconds left or right. The expert on the field of impressioning is Oliver Diederichsen. It was his research and book that really got us all started at this. And he came up with a new tool. It is a modified euro-profile cylinder that contains five sharp solid pins that will scratch the blank at the position the pins will make contact with it. Once these marks are on the blank, it is just a matter of filing them down to code 1-1-1-1-1 and start impressioning.

Before and after

As Oliver is one of the most fair people I know, he shared the design and allowed others to copy it for future games. So Jord Knaap made a nice handle that contains a half euro profile with the steel pins. And the euro-profile core in Jord’s tool is interchangeable. At the back of the tool there is a small hole that will allow you to push out the cylinder and change it for another brand.

To come back to the games: they were won by good old Atrhur Meister, followed by Oliver Diederichsen and Jos Weyers. Congratulations guys. Looking forward to the impressioning games at Lockcon in a couple of months …

the champs

“self impressioning” attack on the Abloy Protec?

Friday, May 7th, 2010

Times are interesting. It is busy, but mostly with things I really enjoy doing. So fear not if you did not see a posting for a little while here :)

Still working on my LockCon posting but in the meantime an interesting link came in I could not just let pass by. An interesting video on what seems a ‘self impressioning’ attack on the Abloy Protec lock!

I will examine it more closely over the weekend but for now just wanted to share it with you … seems very interesting and very promising! Enjoy the video!

Assasination and hotel door security

Monday, February 22nd, 2010

I am reading up on the assassination of Hamas leader Mahmoud al-Mabhouh with red cones. Never ever have so many operational details come out about missions like this. Twenty years ago this would have gone on file as a ‘highly suspicious death’, but in this day and age of CCTV camera’s it did not go unnoticed. What is special this time is that a (must see) video just was released by Dubai police, and it looks like a hollywood production. The link to this blog? … since the murder took place in a hotel, I was immediately interested to read details on how they gained entry. And there still are some things unclear about it, even though this article speaks about “They entered the room using copies of keys they had somehow acquired.”

electronic hotel locks with a mechanical override

This could point to the fact a lot of electronic hotel door locks have a mechanical override. Most of the time there is a mechanical lock mounted under the handle of the door that can be opened with a master key. In some cases the lock is even hidden under a sticker or label, but in most hotels I visited there is a lock present in case the electronic lock fails (in some countries it is not legal to rely only on the electronics). I know that in some hotel locks a mechanical opening is still recorded by the electronics in the lock and will end up in the log files. To get hold of the masterkey, one could rent a room in the same hotel and simply (for an intelligence agency that is) take the mechanical lock out the door, take it apart and make the master key based on the now known pin lenght. (Or if you believe the myth, ‘they’ already have done all the fieldwork and collected the mechanical master keys to all important hotels in advance anyway …)

Another way to open some hotel doors would be to simply go under the door and grab the handle from the inside using a special tool. As you can see in this video, it is not so difficult. And the tool used to go under the door is even available in a ‘government only’ version. This version can easily been taken apart into small segments but is only sold to government agents.

And I suggest a slightly modified tool like the one on the video was used for the finishing touch of the murder. To make it look like a natural death, they locked the chain on the inside of the door …

It is all a funny coincidence as the video of the tool was just shot a couple of weeks ago when Han Fey and I did a presentation at the famous IT-Defense security congress Germany. It is a congress where we always meet lots of interesting people and always get a lot of invitations to give more presentations and/or workshops. We were originally invited to just do some hands on workshops and teach people the basic locksport/lockpicking skills, as well as a few simple opening techniques like shimming doors etc. But when some of the conference speakers missed their plane, we were asked to give an ‘emergency presentation’ to fill the gap. And as we do not like to give the same presentation twice, we shot some video (using a mobile phone) on the spot late at night about the door opening tool (and how to protect yourself against it) and inserted it into a compilation of existing presentations. Originally I did not intend to release the video as it shows me opening a door, but in this case I make an exception …

And for those of you who want to know more on the inner working of hotel locks, I have blogged about it before (including a video of ‘how it is made’)….

Electronic lock decoders

Monday, February 15th, 2010

A lot of people asked my opinion about the “Electronic Key Impressioner” that has been in the news lately. The device is not for sale yet and the only thing people have seen so far is a computer model of a device. Technical details are not out yet (as far as I know). This being a news item triggered a lot of people who are now curious if a device like this could really work, and if so, what is the technique behind it.

The automatic key impressioner reminded me on something I saw at a trade-show a couple of years ago. At the stand was a person with a some sort of ‘lock probe’ that could electronically read out the combination on some car locks. This lock probe was connected to a laptop, and after inserting the lock probe in and out of the lock a couple of times, the code of the lock was on the display of the laptop.

lock probe

Curious on how this technique worked, I spend some time talking with the developer of the system. As we all know, most car locks are wafer locks. These wafers all have the same outer dimensions and the only thing that differentiates (for example) a ‘cut one’ from a ‘cut four’ is the position of the hole in the wafer. To make it a little more clear for people who are not into locks, I took wafers one, two, three and four from a car lock and stacked them on top of each other. You can clearly see a ‘stairway’ pattern if you stack them in incrementing order.

stacked car lock wafers

The lock probe I saw at the show used electric current to determine the position of the opening in the wafer. The idea is to put some low voltage on the body of the lock and ‘look for it’ with the contacts in the isolated tip of the lock probe. A high cut wafer will only make contact with the higher contact points in the tip, while a low cut wafer will give a reading on more contact points as the tip slides trough it. And there were a number of different probes for various lock models (variations in the spacing and position of the contact points on the tip of the key). The theory behind this may all look easy and straight forward, but it took them quite some effort to write a decent piece of software to convert the data into a key-code. The developer told me errors could be introduced if users insert the probe too quickly, and sometimes locks ‘in the field’ were so dirty/greased up that contact with the wafers was not reliable.


lock probe

Of course I can only guess, but I imagine the “Electronic Key Impressioner” works on the same principle. I can’t wait to see the device in real life and be able to test it under some real world conditions. As I can imagine there is a range of wafer locks this technique does not work on. And I wonder if it can compete with some of the more sophisticated mechanical car lock decoders that are out on the market for many years now …

Advanced foil impressioning

Monday, February 1st, 2010

In 2002 I already demonstrated the theory behind the ‘foil impressioning‘ method at the H2K2 conference in New York. The foil impressioning method is nice because it will open quite a number of high security locks and requires relatively little skill to do so. The only thing you need to have is a key cut to the deepest position (preferably a little deeper) and some adhesive aluminum tape that is used in the automotive and heating industry. You apply the adhesive tape over the holes of the key, trim the edges a bit and insert it into the lock. All you need to do now is put some turning pressure on the key and make small ‘up and down’ movements. The pins that are not in the correct position will bind and become stuck in the lock. These pins will push the tape in a little when the key is pushed upwards, and in the next round of ‘turning and rocking the key up and down’ these binding pins will keep pushing in the tape deeper and deeper until shear line is reached. The interesting thing is that once a pin reaches the ‘shear line’ (opening position), it is no longer stuck and will not push in the tape deeper. The key will fit itself …

It is a great technique that is around for quite some time. In my collection of picktools I have some impressioning kits made for the locksmith market in 1995 and 1996. These kits use either foil or candle wax to keep the pins in place. If you take a close look on this key for example, you can see they milled a small fraction of the thickness of the key to make room for the foil. The key including the foil will push all pins to the highest position (or so we hope).

This brings us to the two disadvantages with this method. First of all, if there is a high cut and a deep cut next to each other, the foil is not flexible enough to cope with the difference. In this case you must pierce the tape if the lock does not open in a couple of minutes to allow the deep pin to sink deeper into the foil. And if the pin in the lock is short (a low cut in the key), there is a chance the pin will start to bind because it is not exactly on ‘shear line’. And once this short pin starts pushing the foil in, you lost (as it will sink in deeper and deeper and you will never open the lock). One other disadvantage is that if the profile of the key is not fully flat (meaning if has a serious profile) the tape can not be applied correctly. If you try to put tape over (for instance) this profile, the edges of the profile of the lock will tear the tape when entering the lock. But that latest problem has been solved now by a Chinese tool manufacturer!

Before and after a round of self impressioning

Just brand new on the market is a kit that uses a clever technique to also open dimple locks that have a serious profile (and are not one solid square piece of metal). The kit was brought to my attention when visiting Israel with Jord Knaap and Han Fey last week. A local locksmith called Raf (well known from the UK bumpkey forum) invited us to his shop and proudly showed me this tool and technique. The way the tool works is that you first take some aluminum foil and make a ‘U shaped’ form (using the special tool to do so) and make small incisions on pre-determined positions. Next thing you do is put the foil over a special blank that already has the profile of your target lock. The clever thing about this tool is that the ‘U shaped foil tube’ is wrapped around some sort of needle, and the foil can not be pushed in when entering the lock! Once the key is inserted, the needle is taken out from the back of the tool, and the pins are now resting on the foil. Because of the cuts in the foil, each pin will stand on it’s own ‘island’ of foil, and when it is pushed in will not disturb the neighboring pin! I have played around with it a little, and the design is really very clever and works fast and reliable!

There is something to complain though. The tool itself is made from ehrm …. not the best quality steel and will break after several tries. Nevertheless it is a great tool for it’s value, and I am sure this new method of ‘foil tubing’ can be applied to many more locks too ….

Thank you Raf (and friends) for the good time, and of course for your excellent video demonstration of this great new tool!

Macbook died, key copying and transparent lock

Tuesday, September 22nd, 2009

My poor macbook died. I keep backups, so no harm is done, but it sucks to have to work on an old company windows machine for now.

So my posting is going to be a simple one today, using some images I uploaded to blackbag before the crash. One of the things I wanted to share is a couple of pictures taken at HAR from the by now famous ‘transparten lock’. These one, two, three, four images give you a much better idea how nice this lock is than in my original posting. And many people took the opportunity to play with the lock at HAR. If you have large demo locks like this please let me know!

copies made with the quick key system

One other thing mentioning was the round the clock presentations at HAR by my good friend Till. He demonstrated a system to copy mechanical keys called ‘quick key’ (made and designed in Berlin). It uses some sort of two component kind of rubber to make a mould of a key. Till showed that with a little effort almost any mechanical key can be duplicated. He even managed to copy a high security popular French safe lock key.

And to keep in line with my dead macbook … at HAR I have seen the most bizarre picktool case EVER…..

Hope to be back on a Mac sunday for a new update on BlackBag ….

Back from Spain…

Monday, July 6th, 2009

Just got back from an intense weekend in Spain. The Spanish APECS locksmith organisation asked us to give an impressioning course.

APECS advanced impressioning sheet Testa T5

APECS asked us to focus on the practical part of impressioning so the members can use it in the field to open cars and doors. But still a quarter of the total time was spend on presentations and explanations. The course was a big success: In this two days we brought them up to speed to what is possible and how the technique can work in their favor. Two classrooms were formed and Han and I assisted the students in each room. Before the course we did ask them to bring a sturdy vice (so the locks do not wiggle too much), and some people took our advice very serious (it took two people to carry the vice in).

For this course I bought a Dino Lite USB microscope (with polarizing ‘anti glare’ filter) and stand, to be able to show the marks on the key on the beamer, and to shoot some nice images for my powerpoint presentation.

pin pair

Before the course we received lock samples and Han and I managed to discover some interesting things the local locksmiths never thought of before. We made the security features of the lock work against it. More about this at the lockpick village at HAR

All in all a very successful weekend. One that most likely will be followed up in a couple of months (if they manage to fill another class)….

More images on the APECS foto gallery soon I guess …

Abloy classic and trying the ‘reduced contact area blank’

Monday, June 22nd, 2009

In a couple of weeks Han and I will be giving a two day impressioning course in Spain. It is going to be the second course we organize for the Spanish APECS locksmith organisation in nine months. Last time we gave a very successful course on bumping Spanish locks (a small test proved around 80% of the pin tumbler locks on the Spanish market could be bumped). This time the topic will be impressioning.

successful impressioned key for 6 disc abloy camlock

One of the things I am focusing on lately is ‘advanced impressioning’. This means trying the technique on other locks then the standard pin tumbler locks, or modifying keyblanks to make life more easy or have a higher success range on high security locks.

The lock high on my wish list is the Abloy classic (PDF). As far as I know it is the oldest system that uses discs instead of pins, yet it still is (to me) a remarkably secure lock as it has a very high degree of pick resistance. Of course I had to try if I could use impressioning to open it.

My first attempt was to simply give it a try and see what happens. In this case I just took a classic key, smoothened it and filed down where I saw marks. I soon realized this was not going to work. I had absolutely no idea of the exact position of the discs on the blank and the marks kept wandering from left to right. So my second try was using a marker making some dots on the blank, indexing where the discs should be. Still this did not work well as the marks were sometimes appearing between the dots … and I ran out of blanks too …

I recently bought more blanks and could continued the challenge. My new strategy: reducing the contact area of the key. Using a caliper I noticed the spacing on Abloy classic is two millimeters (at least on the locks I was experimenting with). So I marked the blank and removed the material between the positions. For removing the material I used a fine metal saw, a dremel tool (with a diamond disc) and a very fine ‘blade file’ (knive file?). After some work I ended up with a ‘reduced contact area blank’ that looks like a comb.

abloy classic key modified for impressioning (reduced contact area)

Filing down the remaining teeth of the comb is done with a special file. This file is cut only on the thin side. Using this file will only remove material from the contact area of the file, and not from the side of the blade (like on a normal ‘full contact’ file).

I did not have a whole lot of abloy classic locks and was happy to have one padlock I did not know the key-combination of. I did have the key, but put it in a bag without looking at it. Using the reduced contact area key I got the idea I was on the right track … when the key broke off in the lock (grrr). And I could not get the remaining key out of the lock and was out of test locks….

It is a good thing Han managed to remove the key from the lock, and even though I was on the right track I was too deep on some positions.

Talking with Han, we came to the conclusion to start easy using a simple six disc camlock. As most abloy classic locks have a cut 1 (no material removed) on the first and last disc, there were only four discs to work on. And each of these discs could have a cut between one to six (as you can see on this ‘stairway’ key that is cut 1-2-3-4-5-6). This four disc lock did not provide a challenge and was opened in a couple of minutes (without knowing the code).

After this success I did buy some new nine disc padlocks, yet I still have not managed to open them. Somehow I am doing something wrong … so I would be grateful if people would share their experiences on impressioning disc (and lever?) locks in the comments or using a private message …

Of course I will keep trying and report back if I know what is needed to successfully open the nine disc version …

* Update 22/06 21:00: hyperfocus kicked in and … voila … just opened the nine disc version …
All I did was make the teeth of the key a little more thin, and filed in small steps. I must say I am pretty pleased with this success as I have not found any other info out there on people successfully opening Abloy classic locks this way …

successful impressioning on nine disc Abloy classic lock

Wired on Marc Tobias and picking/bumping Medeco locks

Friday, May 22nd, 2009

*NewsFlash*

Wired on Medeco

Wired just came out with an interesting article on Marc Tobias (and Tobias Bluzmanis). It also contains great video of them picking and bumping Medeco locks (in as little as 9 seconds, not including selecting the correct side-setting key …). As I am in the middle of something else here, I keep this post short for now. Just go read the article now ;)

Back from Warsaw

Tuesday, May 19th, 2009

Just got back from the ELF 2009 convention in Warsaw Poland. A great event!

I did follow quite a few classes as the schedule had some interesting topics. And besides meeting old friends I made quite some new ones too. Not to mention my collection of tools also grew considerably (and my wallet is empty). I will share with you these hand made hobb’s picks, used to manipulate (simple) lever locks.

hobb's picks from the ELF meeting in Poland 2009

The most interesting tools are the one with three handles. I do not even now what specific lock these ‘three in one’ picks are used for, but I do like the technique used to make them.

close up 3 in 1 pick

I wrote in a previous posting about the popular orenco lock in spain that uses a simple yet effective countermeasure against a classical hobb’s pick. It seems the kind of pick shown above will be able to open these kind of locka because of the shape of the fingers/tensioner. Although I still I wonder why it is ‘three in one’? Is the middle feeler used to tension the lock? Anyone got an idea what kind of lock this pick was designed for?

The other hobb’s picks are regular ones that vary in diameter and shape, but nothing special.

Polish seal on a high security lock

Unfortunately we did not have much time to see Warsaw, but did manage to shoot some images of a high security door there. The door is not only protected by a Gerda high security lock, but also uses seals for intrusion detection. I did not have much time to figure out the details of the sealing mechanism, but is sure is intriguing …

(* update 19/05: MH made a nice comment: Interesting seal, it seems to use the owner’s fingerprint – for “normal” intruders there would be some kind of psychological barrier to leave their own fingerprints behind…)

Opening a magnetic lock using … a teddybear ?!?

Monday, March 2nd, 2009

This week a story about less dangerous magnets :)

I was in Spain last week and when I visited a lockshop the owner gave me a small present. It is a lock I knew for a while (named Disec), yet it’s a lock I never managed to get my hands on.

The DiSec shield is a lock that is mounted over your euro profile cylinder, protecting it against vandalism and unathorized opening attempts (like bumping, breaking and drilling). It is the kind of extra protection I like in a lock.

I was in Spain because we had a booth with CryptoPhone at the 3GSM tradeshow. During the slow hours I always like to quickscan the show to see what is new in telecomland, and collect some gadgets and gifts for the kids. One of the gifts I collected was a small teddybear (or is it a cat?) that has a small magnet in it’s head.

It did not take me long to rub the magnetic part of the bear’s head against the lock, and opened the lock in just a couple of minutes. The technique I used can be considered ‘raking’, and requires some skill and luck. The skill in this case being able to control the amount of tension on the shield while jiggling, as well as varying in speed and rotation with the magnet. But without a little luck the lock remains closed …

I did shoot some video for you, showing how I opened the lock. After opening, I did disassemble the lock and key a little.

And there are people who do not use raking but actually pick the lock (youtube) in a more clever (but less fun?) way ….

On my way to CeBit now. Lets see what kind of gifts I collect there that can be used to open locks ;)