Dolla Dolla Bump Key

Chris Sistrunk, PE

Electrical EngineerICS/SCADA– Mandiant, Entergy– Project Robus (ICS Protocol Fuzzing)

Physical Security– Substation Security Team– Fun & education

@chrissistrunkchris.sistrunk@mandiant.com

Disclaimer

The information in this presentation is intended for educational purposes. I am a security professional, but I am not a legal expert. Please be aware of the laws in your area that may pertain to bump keys.

+ +

=No-questions-asked, $2 Bump-key-o-matic

Key Kiosks

minuteKey

Does notaccept cash!

Window forviewing

Scans onlykey shaft

Emails receipt

FastKey

Does acceptcash!

Scans entirekey

Prints receipt(no email)

KeyMeapproved keyiPhone App

• Take pic of key• Store keys in the CLOUD• Displays key type + code• Mail orderOnly 5 Kiosks in NY• Requires fingerprint for

key from cloud• Duplicates keys as well

KeyMe - Prior Art7/25/2014http://www.wired.com/2014/07/keyme-let-me-break-in/

“I spent about 30 seconds in the stairwell scanning his keys with software that would let me reproduce them with no specialized skills whatsoever. The iPhone app I used wasn’t intended for anything so nefarious: KeyMe was designed to let anyone photograph their keys and upload them to the company’s servers. From there, they can be 3-D printed and mail-ordered in a variety of novelty shapes, from a bottle opener to Kanye West’s head. Or they can be cut from blanks at one of KeyMe’s five kiosks in the New York City area.”

Kiosk Key Types

• Schlage SC1• Kwikset KW1• Master M1• Weiser WR5• Mailbox NA14• Other keys may vary• KeyMe has biggest selection

Will it copy a bump key?

Let’s try bump keys:• Machine-made brass• Hand-filed brass• Hand-made plastic• Printer paper• Paper plate• Brass key with large paper cover• Brass key with small paper cover

Success!

Detail

Machine-made brass Hand-filed brass Hand-filed plastic

Detail

Failure is always an option!

Results

Bump key type Kiosk Copy? Works?Machine-made brass Hand-filed brass Hand-made plastic Printer paper   n/aPaper plate n/aBrass with large paper cover   n/aBrass with small paper cover

Conclusions

FastKey Kiosk copies bump keys!– Original “key” doesn’t have to be a key– Cheaper than buying bump keys online– Must align key carefully in the scanner– Tries to copy the key as close as possible– May correct errors in original key– Has trouble duplicating small teeth on end of keys

A crappy bump key may still work!

Further Study

• Will kiosks copy 3D printed keys?• What other materials will the kiosk copy?• Key Kiosk vulnerabilities?– Windows?– Cell radio

• Is the KeyMe iPhone app secure?I recommend coordinated disclosure.

Someone might get your key n00dz

CENSORED

Whoopsie

http://vendingadventures.blogspot.com/2013/05/fast-key.html

Questions/Ideas?

Related YouTube Videos

https://www.youtube.com/watch?v=O6UqrQwTbgYhttps://www.youtube.com/watch?v=Fu74iwq224whttps://www.youtube.com/watch?v=TrDlyTAIByghttps://www.youtube.com/watch?v=kAYTKwPG6a0