ten things everyone should know about lockpicking ... things everyone should know. about lockpicking...

Lockpicking & Physical SecurityDeviant Ollam

Ten Things Everyone Should KnowAbout Lockpicking & Physical Security

Deviant OllamBlack Hat Europe – 2008/03/25


1. Locks are not complicated mechanismsSimple components

Simple operation

Efficient & resilient


2. Most locks are wildly easy to pickCommon faults

Easily exploited

Anyone can do it

3:00


Picking


DemonstrationEveryone Cross Your Fingers

Think “No Demonstration Effect”

The Two Biggest Errors…

Too much wrench pressure

Lifting pins too far up


Raking


3. Unpickable doesn’t mean invulnerableCombination instead of key

Pins arranged in other formats

Different keyway orientation

7:00


Combination LocksShow of Hands



Immensely popular in the USA

Schools

Gyms

Etc.



Immensely popular in the USA

Schools

Gyms

Etc.

These Locks ProvideEssentially Zero Security


Padlock ShimsSimple

Cheap

Buy Online

20-pack for $25

Shim stock metal

Homemade

Aluminum Cans


Tubular LocksStill traditional pin stacks

Pins simply arranged inunconventional patternNeed specialized tools(well… sometimes)

Low-tech Kryptonite bypass (bic_pen.avi)


Dimple LocksTraditional pin stacks

Horizontal keyway



Horizontal keyway

Nearly impossible toinsert usual pick tools



Horizontal keyway

Nearly impossible toinsert usual pick toolsOther means to bypass

ImpressioningBump keying

Barry Wels & Laz impressioning a dimple lock (dimple.avi)


4. Minor changes make a big differenceSpecialized pins

Unshimable padlocks

13:00


Pick-Resistant PinsMushroom



Spool



Spool

Serrated


Europe Raises the Bar


Un-Shimmable PadlocksCollar / Boot

Double-Ball Mechanism

Key-Retaining LocksLess ConvenientLess Popular

Can still have combination dials

Size doesn’t always equal securityResistance to Brute ForceNot Always Resistant to Finesse


5. Advanced features aren’t a panaceaSidepin… the industry’s first attempt

Sidebars… good and bad

Mul-T-Lock dimple system

Abloy’s rotating disks

15:00


Side PinSchlage Everest

check pin

key (bottom) pins

driver (top) pins

pin springs

plug

check pin spring

specialized key



specialized “finger wrench” modified Everest key


Side BarsSimilar to side pins

Restrict plug movement

Harder to pickthan pin stacks


Side BarFinger Pins


Side BarSliders


Side BarRotating Pins


Advanced Dimple LockMul-T-Lock

Developer & ManufacturerPatent HolderExclusive Distributor

Specialized DesignPins Within PinsCan’t Impression


Mul-T-LockPins within pins



Imagine the inside



Imagine the inside

In fact, this is theactual mechanism


Mul-T-Lock

see the difference now?


Mul-T-LockStandard Operation



Overlifting



Overlifting

Michaud Attack


Rotating DisksTremendous Security

Mimics a safe lockVery Difficult To Pick

Takes much time and great skillSpecialized tools required


Rotating DisksTremendous Security

Mimics a safe lockVery Difficult To Pick

Takes much time and great skillSpecialized tools required

Falle ToolManipulates disks individuallyDecodes cut orientationNumerical key values

Barry Wels picking a rotating disk lock with Mike Glasser (rotating_disk.avi)


6. Adding electricity isn’t magicalHotel safes

Deadbolts

Access control systemsMagnetic door locksPassive IR sensorsThe Wiegand pitfall

Malaysian Hotel (electronic_safe_spiking.avi)

Major Malfunction (majormal-paperclip.avi)

Winkhaus Blue Chip (winkhaus_long.avi)

Mul-T-Lock CLIQ System (cliq.avi)

25:00


A problematic access control doorMagnetic lock



Large gap



Large gap

IR Sensor


Zac Franken… the Gecko project


7. Safe locks vary as widely as door locksMechanisms

Certifications

Resistance to other conditions

Amazing electronic models

35:00


SafesMechanism Operation

Wheels, Gates, & a FenceDirect Entry Fence vs. Nose & Cam

Insurance RatingsUnderwriters’ Labs (TL, TRTL, TXTL + ##)

Fire SafesOften terribly weak hardwareAlso not typically rated for electronic media

CompromiseManual or Robotic ManipulationManipulation-Proof Safes (S&G 8400)Electronic Mas-Hamilton X-07 & X-09


8. Bump keying is a real problem…

… but one with real solutions

38:00


The “Bump Key” AttackPopping a lock open with a special key

Takes little skill, almost no training, no special

tools

Vast number of locks are vulnerableThe media (and public) is finally taking notice

Exploit closely related to physics of a pick gunBest explained via billiard ball analogy…


The “Bump Key” Attack


Countermeasures to BumpingCertain High Security Mechanisms

Sidebars in Schalge PrimusSlider-based sidebars in Evva & ScorpionPins Within Pins (newer Mul-T-Lock models)Rotating Disk locks (Abloy & clones)

Other High Security Locks Don’t Help As MuchAssa V10 Twin is “exploitable” geographicallyIt is theoretically possible that Medeco locks could bebumped (given adequate knowledge beforehand)There is a risk of information leakage in mastered systems

New ApproachesTrap PinsShallow DrillingTop GappingFluids & Gels


Trap Pins


Trap PinsNormal Key Operation


Trap PinsAttempt Without a Key


Trap PinsA Double-Edged Sword

Absolute evidence of anyany attempted pick or bypassOnly one course of actionafter trap pins have firedRemove lock from door andreplace with a new oneShallow drilling is simpler andoffers more elegant protection…


Shallow DrillingNormal pin stack chambers being drilled…


Shallow DrillingNotice the difference with shallow drilling…


Shallow DrillingPin stacks have differing heights in their default position


Shallow DrillingAttempts at bumping will fail, not all pins touch the key


Shallow DrillingNo easy, outward evidence of this protection


Shallow DrillingConceivably possible to examine for shallow stacks…

… but what then, carry a whole ring of bump keys?


Top gappingThis design offers the most promise for fully hardening basic pin tumbler locks against the bump key attack.


Top gappingMaster Lock has published on this topic and begun equipping locks with specialized top pins. Look for part numbers ending with the letter “N” or ask a locksmith.


Kwikset??When even this company is making locks designed to prevent bump keying, it’s finally gotten proper attention


What locks have these countermeasures?

Trap PinsM&C (Mitchel & Collin) "Antiklop" model

Shallow DrillingCES (Carl Eduard Schulte) VA5 & VB7 models

Top GappingMaster Lock / American Lock (retail or re-pinned)

Kwikset"Smart Series" line includes biometric options


Fluids & GelsPickbuster

Invented by Mark GarrattDistributed by Almorebased in Pontypridd, Wales

Impedes Pin Movement

Mixed Industry ReactionPros: inexpensive, simple, bump resistantCons: not permanent, not perfect, and...Significant concern about fouling

Weigh Costs and Benefits Yourself


9. Large facilities have their own

unique set of pitfalls and concernsMaster keying

Interchangeable cores

Key control

48:00


Master Key TheoryRemember standardpin tumbler stacks?Same operation, with extrapin (or “wafer”) in the middlePotential for variedlevels of clearanceAlso potential for manyadditional shear lines


Master Pinning


Master PinningUser’s “Change” Key


Master PinningTop Master Key


Master PinningImagine a crafty user…


Master PinningThey modify their key… it doesn’t open


Master PinningThey modify their key… suddenly it opens!


Master PinningThis last chamber is now at the “master” height

http://www.crypto.com/papers/mk.pdf



Master PinningThis bitting can be measured




Master PinningThis is how “intermediate master” keying works

Keep in mind… in a large, mastered facility all doors have within them the full top master pinning. Compromise of any single door can give access everywhere.


SFIC LocksSmall FormatInterchangeable Core

BESTYaleOthers

Easy to ManagePlug and pins all eject asa single, contained unit

Hard to PickMultiple independent shear linesKeyways are worse than any nightmares you could find atthe bottom of a bottle or at the hands of the U.S. Congress


SFIC LocksVery popular in large institutions

Cores remove with a “control key”

Two independent shear linesRaising pins to one level allowsplug to rotate freelyRaising pins to other shear linelocks plug and control sleeve togetherand they turn as one, either exposingor retracting core’s retaining tab

Picking attempts typically fail with standard toolsTension binds across both shear lines


SFIC LocksPin Stacks

core housing

control sleeve

plug

top pins

control pins

bottom pins


SFIC LocksOperating Key


SFIC LocksControl Key


SFIC LocksNormal picking attempts typically fail

Tension binds across both shear linesExtremely likely to set pins in various places


SFIC LocksThere are specialized tools

Torsion wrench with “fingers” puts pressure on only one shear lineStill very difficult, however, due to tight tolerances and keyways


SFIC LocksMatt Blaze’s modified sleeve

Nothing for specialized “finger wrench” to grab


SFIC LocksNew BEST design

I believe the locks are manufactured this way now


Key controlPreventing illicit copies

Using “restricted” keyways

Inability to make blanks

E-Z Entrie vs. Side Cuts


10. Security in the Real WorldTechnical Finesse or Brute Force

Common criminals do not pick locksA $100 lock in a $10 door is little help

DoorsSolid-core, heavy materialHeavy hinges, screws deep into frameDeadbolts with round core(s)

WindowsBreak glass to reach knobsShatterproof film

VisibilityMotion-sensing lightsKeep bushes & trees trimmed

55:00


So what is a “good” lock?Manufacturers whom I love…

(slider-based sidebar)(sliders & sidebars)

Primus (unique sidebar system)(SFICs)(Granit & Diskus)

(rotating disk)(shackle-less padlock)

(double mushroom pins)(X-07 and X-09 dials)

(armory locks, combo locks, safes, deposit boxes)

Good rules of thumbYou get what you pay forKeep the big picture in mindKeep tinkering and questioning


Security is only as effective…

… as the person using it


A Security FableAmerican 700 Padlock

Solid designSerrated pinsInterchangeable cores




Core OperationBack of plug… half circleControl cylinder… quarter circle





Peterson Bypass ToolSlips all the way through coreInteracts with control cylinder directly






Security Wafer






Security Wafer

Wafer Breaker Tools






Security Wafer

Wafer Breaker Tools

Shackeless Padlock… the American 2000


So what is a “good” lock?Manufacturers whom I love…

(slider-based sidebar)(sliders & sidebars)

Primus (unique sidebar system)(SFICs)(Granit & Diskus)

(rotating disk)(shackle-less padlock)

(double mushroom pins)(X-07 and X-09 dials)

(armory locks, combo locks, safes, deposit boxes)

Good rules of thumbYou get what you pay forKeep the big picture in mindKeep tinkering and questioning

ten things everyone should know about lockpicking ... things everyone should know. about lockpicking...

Documents