Ten Things Everyone Should Know About Lockpicking ... Things Everyone Should Know. About Lockpicking...

Lockpicking & Physical SecurityDeviant Ollam

Ten Things Everyone Should KnowAbout Lockpicking & Physical Security

Deviant OllamBlack Hat Europe – 2008/03/25

1. Locks are not complicated mechanismsSimple components

Simple operation

Efficient & resilient

2. Most locks are wildly easy to pickCommon faults

Easily exploited

Anyone can do it

Picking

DemonstrationEveryone Cross Your Fingers

Think “No Demonstration Effect”

The Two Biggest Errors…

Too much wrench pressure

Lifting pins too far up

Raking

3. Unpickable doesn’t mean invulnerableCombination instead of key

Pins arranged in other formats

Different keyway orientation

Combination LocksShow of Hands

Immensely popular in the USA

Schools

Immensely popular in the USA

Schools

These Locks ProvideEssentially Zero Security

Padlock ShimsSimple

Buy Online

20-pack for $25

Shim stock metal

Homemade

Aluminum Cans

Tubular LocksStill traditional pin stacks

Pins simply arranged inunconventional patternNeed specialized tools(well… sometimes)

Low-tech Kryptonite bypass (bic_pen.avi)

Dimple LocksTraditional pin stacks

Horizontal keyway

Nearly impossible toinsert usual pick tools

Horizontal keyway

Nearly impossible toinsert usual pick toolsOther means to bypass

ImpressioningBump keying

Barry Wels & Laz impressioning a dimple lock (dimple.avi)

4. Minor changes make a big differenceSpecialized pins

Unshimable padlocks

Pick-Resistant PinsMushroom

Serrated

Europe Raises the Bar

Un-Shimmable PadlocksCollar / Boot

Double-Ball Mechanism

Key-Retaining LocksLess ConvenientLess Popular

Can still have combination dials

Size doesn’t always equal securityResistance to Brute ForceNot Always Resistant to Finesse

5. Advanced features aren’t a panaceaSidepin… the industry’s first attempt

Sidebars… good and bad

Mul-T-Lock dimple system

Abloy’s rotating disks

Side PinSchlage Everest

check pin

key (bottom) pins

driver (top) pins

pin springs

check pin spring

specialized key

specialized “finger wrench” modified Everest key

Side BarsSimilar to side pins

Restrict plug movement

Harder to pickthan pin stacks

Side BarFinger Pins

Side BarSliders

Side BarRotating Pins

Advanced Dimple LockMul-T-Lock

Developer & ManufacturerPatent HolderExclusive Distributor

Specialized DesignPins Within PinsCan’t Impression

Mul-T-LockPins within pins

Imagine the inside

In fact, this is theactual mechanism

Mul-T-Lock

see the difference now?

Mul-T-LockStandard Operation

Overlifting

Michaud Attack

Rotating DisksTremendous Security

Mimics a safe lockVery Difficult To Pick

Takes much time and great skillSpecialized tools required

Rotating DisksTremendous Security

Mimics a safe lockVery Difficult To Pick

Takes much time and great skillSpecialized tools required

Falle ToolManipulates disks individuallyDecodes cut orientationNumerical key values

Barry Wels picking a rotating disk lock with Mike Glasser (rotating_disk.avi)

6. Adding electricity isn’t magicalHotel safes

Deadbolts

Access control systemsMagnetic door locksPassive IR sensorsThe Wiegand pitfall

Malaysian Hotel (electronic_safe_spiking.avi)

Major Malfunction (majormal-paperclip.avi)

Winkhaus Blue Chip (winkhaus_long.avi)

Mul-T-Lock CLIQ System (cliq.avi)

A problematic access control doorMagnetic lock

Large gap

IR Sensor

Zac Franken… the Gecko project

7. Safe locks vary as widely as door locksMechanisms

Certifications

Resistance to other conditions

Amazing electronic models

SafesMechanism Operation

Wheels, Gates, & a FenceDirect Entry Fence vs. Nose & Cam

Insurance RatingsUnderwriters’ Labs (TL, TRTL, TXTL + ##)

Fire SafesOften terribly weak hardwareAlso not typically rated for electronic media

CompromiseManual or Robotic ManipulationManipulation-Proof Safes (S&G 8400)Electronic Mas-Hamilton X-07 & X-09

8. Bump keying is a real problem…

… but one with real solutions

The “Bump Key” AttackPopping a lock open with a special key

Takes little skill, almost no training, no special

Vast number of locks are vulnerableThe media (and public) is finally taking notice

Exploit closely related to physics of a pick gunBest explained via billiard ball analogy…

The “Bump Key” Attack

Countermeasures to BumpingCertain High Security Mechanisms

Sidebars in Schalge PrimusSlider-based sidebars in Evva & ScorpionPins Within Pins (newer Mul-T-Lock models)Rotating Disk locks (Abloy & clones)

Other High Security Locks Don’t Help As MuchAssa V10 Twin is “exploitable” geographicallyIt is theoretically possible that Medeco locks could bebumped (given adequate knowledge beforehand)There is a risk of information leakage in mastered systems

New ApproachesTrap PinsShallow DrillingTop GappingFluids & Gels

Trap Pins

Trap PinsNormal Key Operation

Trap PinsAttempt Without a Key

Trap PinsA Double-Edged Sword

Absolute evidence of anyany attempted pick or bypassOnly one course of actionafter trap pins have firedRemove lock from door andreplace with a new oneShallow drilling is simpler andoffers more elegant protection…

Shallow DrillingNormal pin stack chambers being drilled…

Shallow DrillingNotice the difference with shallow drilling…

Shallow DrillingPin stacks have differing heights in their default position

Shallow DrillingAttempts at bumping will fail, not all pins touch the key

Shallow DrillingNo easy, outward evidence of this protection

Shallow DrillingConceivably possible to examine for shallow stacks…

… but what then, carry a whole ring of bump keys?

Top gappingThis design offers the most promise for fully hardening basic pin tumbler locks against the bump key attack.

Top gappingMaster Lock has published on this topic and begun equipping locks with specialized top pins. Look for part numbers ending with the letter “N” or ask a locksmith.

Kwikset??When even this company is making locks designed to prevent bump keying, it’s finally gotten proper attention

What locks have these countermeasures?

Trap PinsM&C (Mitchel & Collin) "Antiklop" model

Shallow DrillingCES (Carl Eduard Schulte) VA5 & VB7 models

Top GappingMaster Lock / American Lock (retail or re-pinned)

Kwikset"Smart Series" line includes biometric options

Fluids & GelsPickbuster

Invented by Mark GarrattDistributed by Almorebased in Pontypridd, Wales

Impedes Pin Movement

Mixed Industry ReactionPros: inexpensive, simple, bump resistantCons: not permanent, not perfect, and...Significant concern about fouling

Weigh Costs and Benefits Yourself

9. Large facilities have their own

unique set of pitfalls and concernsMaster keying

Interchangeable cores

Key control

Master Key TheoryRemember standardpin tumbler stacks?Same operation, with extrapin (or “wafer”) in the middlePotential for variedlevels of clearanceAlso potential for manyadditional shear lines

Master Pinning

Master PinningUser’s “Change” Key

Master PinningTop Master Key

Master PinningImagine a crafty user…

Master PinningThey modify their key… it doesn’t open

Master PinningThey modify their key… suddenly it opens!

Master PinningThis last chamber is now at the “master” height

http://www.crypto.com/papers/mk.pdf

Master PinningThis bitting can be measured

http://www.crypto.com/papers/mk.pdf

Master PinningThis is how “intermediate master” keying works

Keep in mind… in a large, mastered facility all doors have within them the full top master pinning. Compromise of any single door can give access everywhere.

SFIC LocksSmall FormatInterchangeable Core

BESTYaleOthers

Easy to ManagePlug and pins all eject asa single, contained unit

Hard to PickMultiple independent shear linesKeyways are worse than any nightmares you could find atthe bottom of a bottle or at the hands of the U.S. Congress

SFIC LocksVery popular in large institutions

Cores remove with a “control key”

Two independent shear linesRaising pins to one level allowsplug to rotate freelyRaising pins to other shear linelocks plug and control sleeve togetherand they turn as one, either exposingor retracting core’s retaining tab

Picking attempts typically fail with standard toolsTension binds across both shear lines

SFIC LocksPin Stacks

core housing

control sleeve

top pins

control pins

bottom pins

SFIC LocksOperating Key

SFIC LocksControl Key

SFIC LocksNormal picking attempts typically fail

Tension binds across both shear linesExtremely likely to set pins in various places

SFIC LocksThere are specialized tools

Torsion wrench with “fingers” puts pressure on only one shear lineStill very difficult, however, due to tight tolerances and keyways

SFIC LocksMatt Blaze’s modified sleeve

Nothing for specialized “finger wrench” to grab

SFIC LocksNew BEST design

I believe the locks are manufactured this way now

Key controlPreventing illicit copies

Using “restricted” keyways

Inability to make blanks

E-Z Entrie vs. Side Cuts

10. Security in the Real WorldTechnical Finesse or Brute Force

Common criminals do not pick locksA $100 lock in a $10 door is little help

DoorsSolid-core, heavy materialHeavy hinges, screws deep into frameDeadbolts with round core(s)

WindowsBreak glass to reach knobsShatterproof film

VisibilityMotion-sensing lightsKeep bushes & trees trimmed

So what is a “good” lock?Manufacturers whom I love…

(slider-based sidebar)(sliders & sidebars)

Primus (unique sidebar system)(SFICs)(Granit & Diskus)

(rotating disk)(shackle-less padlock)

(double mushroom pins)(X-07 and X-09 dials)

(armory locks, combo locks, safes, deposit boxes)

Good rules of thumbYou get what you pay forKeep the big picture in mindKeep tinkering and questioning

Security is only as effective…

… as the person using it

A Security FableAmerican 700 Padlock

Solid designSerrated pinsInterchangeable cores

Core OperationBack of plug… half circleControl cylinder… quarter circle

Peterson Bypass ToolSlips all the way through coreInteracts with control cylinder directly

Security Wafer

Wafer Breaker Tools

Security Wafer

Wafer Breaker Tools

Security Wafer

Wafer Breaker Tools

Shackeless Padlock… the American 2000

So what is a “good” lock?Manufacturers whom I love…

(slider-based sidebar)(sliders & sidebars)

Primus (unique sidebar system)(SFICs)(Granit & Diskus)

(rotating disk)(shackle-less padlock)

(double mushroom pins)(X-07 and X-09 dials)

(armory locks, combo locks, safes, deposit boxes)

Good rules of thumbYou get what you pay forKeep the big picture in mindKeep tinkering and questioning

Ten Things Everyone Should Know About Lockpicking ... Things Everyone Should Know. About Lockpicking...

Documents

Lockpicking Forensics - Black Hat Briefings€¦ · · 2015-05-28Lockpicking Forensics datagram datagram.layerone@gmail.com Black Hat USA Briefings, 2009. Agenda ... Impressioning

(Formerly titled : POLICE GUIDE TO LOCK PICKING) Intelligence Network/security/infiltration/lockpick...LOCKPICKING Definition of "Lockpicking" - The means of opening a lock mechanism

Introduction to Lockpicking & Key Bumping - layerone.org · Introduction To Lockpicking • How Locks Work • How Keys Work • Picking a Lock • Types of Locks

EN-The Complete Guide To Lockpicking - Eddie the Wire - Loompanics.pdf

Introduction to Lockpicking & Key Bumping LOCKS AND KEYS/Lockpicking Layer One...Introduction to Lockpicking & Key Bumping by datagram Animations by Deviant Ollam. About Me • Mild

Security Hole #12 Lviv SoftServe-Symphony Solutions "Lockpicking Authentication"

The Complete Guide to Lockpicking - Loompanics

lockpicking en español

Easy Pickings - A Self-Teaching Manual in the Technique of Lockpicking - C. Remington (1992) WW

The Complete Guide To Lockpicking - Eddie the Wire - Loompanics.pdf

Wirelessly Lockpicking a Smart Card Readergarciaf/publications/Wirelessly_Lockpicking... · Wirelessly Lockpicking a Smart Card Reader Flavio D. Garcia, Gerhard de Koning Gans , and

A Summary of Lockpicking - Ouverture Fine

Lockpicking - Z. Cliffe Schreudersz.cliffe.schreuders.org/edu/DSL/Lockpicking.pdfOur locks and lockpicking equipment Note we have a large selection of lockpicks, although to pick a

The Complete Guide to Lockpicking Loompanics - Eddie Wire

Impressioning Compendium - A guideline for excellent ...multimedia.3m.com/mws/media/517089O/espertise-impressioning... · A guideline for excellent impressions in theory ... A guideline

Lockpicking - z.cliffe.schreuders.org

Ten Things Everyone Should Know About Lockpicking & Physical … · 2017. 3. 13. · Popping a lock open with a special key Takes little skill, almost no training, no special tools

Lockpicking & Physical Security Deviant Ollam A Security Fable American 700 Padlock Solid design Serrated pins Interchangeable cores

Making better impressions Impressioning Trouble Shooting Guide

HackBulgaira - Lockpicking