Introduction to Lockpicking

1
Introduction to Lockpicking
Deviant OllamSummerCon 2009/06/06
2
a.k.a. How to impress girls and scare cops
Deviant OllamSummerCon 2009/06/06
3
Locks are not complicated mechanisms
4
(No Transcript)
5
(No Transcript)
6
(No Transcript)
7
(No Transcript)
8
(No Transcript)
9
(No Transcript)
10
photo courtesy of datagram
11
(No Transcript)
12
(No Transcript)
13
Most locks are wildly easy to pick
0300
14
(No Transcript)
15
(No Transcript)
16
(No Transcript)
17
Picking
18

• Demonstration
• Everyone Cross Your Fingers
• Think No Demonstration Effect
• The Two Biggest Errors
• Too much wrench pressure
• Lifting pins too far up

19
Raking
20
Its typically as simple as that
Lifting TechniqueRaking TechniqueHybrid
Technique
21
And what about the torsion tool?
22
Half-Diamond
23
Half-Diamond
24
Half-Diamond
25
Lack of pins doesnt equal invulnerable
0600
26

• Combination Locks
• Show of Hands

27

• Combination Locks
• Show of Hands
• Immensely popular in the USA
• Schools
• Gyms
• Etc.

28

• Combination Locks
• Show of Hands
• Immensely popular in the USA
• Schools
• Gyms
• Etc.
• These Locks Provide
• Essentially Zero Security

29
(No Transcript)
30
(No Transcript)
31

• Padlock Shims
• Simple
• Cheap
• Buy Online
• 20-pack for 25
• Shim stock metal
• Homemade
• Aluminum Cans

32
Homemade Shims A Real-Life Example
33
Homemade Shims A Real-Life Example
34
Homemade Shims A Real-Life Example
35
Homemade Shims A Real-Life Example
36
Homemade Shims A Real-Life Example
37

• Combination Locks
• Also possible to decode
• Find the sticking points
• Eliminate half numbers
• Eliminate same numbers
• You have the last number
• Simple math from that point
• Calculation tools available

MasterLock.xls
38

• Combination Locks
• Also possible to decode
• Find the sticking points
• Multiple dials stick, too

39

• Warded Locks
• Inexpensive
• Simple Design
• Popular Outdoors
• Rudimentary Mechanism
• Resists Dirt Fouling
• Internal Latch
• Cant Use Conventional Picks
• However, Other Tools Exist

40

• Warded Innards
• Simple latch spring mechanism
• Unlike pin tumblers, where every
• segment of the key is important,
• warded keys have only one
• useful segment
• The rest of the key simply gets in
• in the way

41

• Warded Picks
• Store bought
• Homemade
• All very simple

42
(No Transcript)
43
(No Transcript)
44
(No Transcript)
45
(No Transcript)
46
(No Transcript)
47
(No Transcript)
48
(No Transcript)
49
(No Transcript)
50
(No Transcript)
51
(No Transcript)
52

• Tubular Locks
• Still traditional pin stacks
• Pins simply arranged in
• unconventional pattern
• Need specialized tools
• (well sometimes)

Cormu picking tubular locks Low-tech Kryptonite
bypass
53
(No Transcript)
54
(No Transcript)
55
(No Transcript)
56
(No Transcript)
57
(No Transcript)
58
(No Transcript)
59
(No Transcript)
60
(No Transcript)
61
(No Transcript)
62
(No Transcript)
63

• Wafer Locks
• Compact Design
• Popular in cars, cabinets
• Totally Different Mechanism
• No pin tumblers
• Difficult to pick traditionally
• Raking and jiggling attacks

64
(No Transcript)
65
(No Transcript)
66
(No Transcript)
67
(No Transcript)
68
Minor changes make a big difference
1500
69

• Advanced Keyways
• Simple straight and wide

70

• Advanced Keyways
• Simple straight and wide
• Medium straight but narrow

71

• Advanced Keyways
• Simple straight and wide
• Medium straight but narrow
• Complex thinner and curvy

72

• Advanced Keyways
• Simple straight and wide
• Medium straight but narrow
• Complex thinner and curvy
• Harder lots of angles

73

• Advanced Keyways
• Simple straight and wide
• Medium straight but narrow
• Complex thinner and curvy
• Harder lots of angles
• Fiendish overlapping wards

74

• Un-Shimmable Padlocks
• Collar / Boot
• Double-Ball Mechanism
• Key-Retaining Locks
• Less Convenient
• Less Popular
• Can still have combination dials
• Size doesnt always equal security
• Resistance to Brute Force
• Not Always Resistant to Finesse

75

• Pick-Resistant Pins
• Spool

76

• Pick-Resistant Pins
• Spool

77

• Pick-Resistant Pins
• Spool
• Mushroom

78

• Pick-Resistant Pins
• Spool
• Mushroom
• Serrated

79

• Pick-Resistant Pins
• Spool
• Mushroom
• Serrated

80

• Pick-Resistant Pins
• Spool
• Mushroom
• Serrated

81
Europe Raises the Bar
82
Europe Raises the Bar
83
Europe Raises the Bar
84
Europe Raises the Bar
85
Europe Raises the Bar
86
High security constantly upping the ante
1800
87

• Side Bars
• Similar to side pins
• Restrict plug movement
• Harder to pick
• than pin stacks

88
Side Bar Finger Pins
89
Side Bar Finger Pins
90
Side Bar Finger PinsSchlage Primus
91
Side Bar Sliders
92
Side Bar Sliders
93
Side Bar Rotating Pins
94
Side Bar Rotating Pins
95
Rotating Pins Medeco Locks
Medeco plug exposed, key pins rotating to align
sidebar cuts Top View Side View
96

• Rotating Disks
• Tremendous Security
• Mimics a safe lock
• Very Difficult To Pick
• Takes much time and great skill
• Specialized tools required

97

• Rotating Disks
• Tremendous Security
• Mimics a safe lock
• Very Difficult To Pick
• Takes much time and great skill
• Specialized tools required
• Falle Tool
• Manipulates disks individually
• Decodes cut orientation
• Numerical key values

Barry Wels picking a rotating disk lock with Mike
Glasser
98

• Rotating Disks
• Abloy Protec
• Not just rotating disks
• Disk blocking mechanism
• False cuts everywhere
• Unpickable?
• Closest I ever come to using that word
• Falle tool cannot be used

99

• Magnetic Locks
• Miiwa
• Japanese company
• Array of magnetic pins
• Simple North / South
• Evva MCS
• Austrian company
• Axial-rotated magnets
• Interaction with sidebar

100

• Evva Magnetic Code System
• Possibly most duplication-resistant lock out
  there

101
Bump keying is a real problem
2500
102
but one with real solutions
103

• The Bump Key Attack
• Popping a lock open with a special key
• Takes little skill, almost no training, no
  special tools
• Vast number of locks are vulnerable
• The media (and public) is finally taking notice
• Exploit closely related to physics of a pick gun
• Best explained via billiard ball analogy

104
(No Transcript)
105
(No Transcript)
106
(No Transcript)
107
The Bump Key Attack
108
The Bump Key Attack
109

• Countermeasures to Bumping
• Some sidebars rock
• Slider-based sidebars
• Rotating Disk locks (Abloy clones)
• Magnetic Key systems (Evva MCS)
• Other sidebars do not help
• geographically exploitable systems
• Medeco Mul-T-Lock can be bumped
• even my beloved Schlage Primus?? Say it aint
  so! (uncertain)
• Simpler Approaches
• Trap Pins
• Top Gapping
• Fluids Gels

110
Trap Pins
111
Trap Pins Normal Key Operation
112
Trap Pins Attempt Without a Key
113

• Trap Pins
• A Double-Edged Sword
• Absolute evidence of any
• any attempted pick or bypass
• Only one course of action
• after trap pins have fired
• Remove lock from door and
• replace with a new one

114
Top gapping This design offers the most promise
for fully hardening basic pin tumbler locks
against the bump key attack.
115
Top gapping Master Lock has published on this
topic and begun equipping locks with specialized
top pins. Look for part numbers ending with the
letter N or ask a locksmith.
116
Ilcos Design Ilco (maker of many aftermarket
lock parts, keys, etc) has created their own
anti-bump top pin
117
Ilcos Design Ilco (maker of many aftermarket
lock parts, keys, etc) has created their own
anti-bump top pin
118
Ilcos Design Ilco (maker of many aftermarket
lock parts, keys, etc) has created their own
anti-bump top pin
119
Kwikset? When even this company is making locks
designed to prevent bump keying, its finally
gotten proper attention pity
that their new lock design is flawed.
120
The Bump Key Attack
dev
121

• Fluids Gels
• Pickbuster
• Invented by Mark Garratt
• Distributed by Almore
• based in Pontypridd, Wales
• Impedes Pin Movement
• Mixed Industry Reaction
• Pros inexpensive, simple, bump resistant
• Cons not permanent, not perfect, and...
• Significant concern about fouling
• Weigh Costs and Benefits Yourself

122
Handcuffs are fun and sexy
3000
123
Handcuffs
124

• Handcuffs
• Simple mechanism

125

• Handcuffs
• Simple mechanism
• Pawl arm

126

• Handcuffs
• Simple mechanism
• Pawl arm
• Ratchet latch

127

• Handcuffs
• Simple mechanism
• Pawl arm
• Ratchet latch
• Spring

128

• Handcuffs
• Simple mechanism
• Pawl arm
• Ratchet latch
• Spring
• Double lock bar

129

• Handcuffs
• Simple mechanism
• Pawl arm
• Ratchet latch
• Spring
• Double lock bar

130

• Handcuffs
• Simple mechanism
• Pawl arm
• Ratchet latch
• Spring
• Double lock bar
• Simple operation
• Opening closing
• Shimming
• Deviants Escape
• Rendermans Escape
• Double lock

131
Security in the real world
4000
132

• Security in the Real World
• Technical Finesse or Brute Force
• Which is more common?
• Common criminals do not pick locks
• A 100 lock in a 10 door is little help
• Doors
• Solid-core, heavy material
• Heavy hinges, screws deep into frame
• Deadbolts with round core(s)
• Windows
• Break glass to reach knobs
• Shatterproof film
• Visibility
• Motion-sensing lights
• Keep bushes trees trimmed

Window Latch
133

• So what is a good lock?
• Locks that I love
• Protec (best rotating disk)
• (sliders in 3KS magnets of MCS)
• Primus (finger pin sidebar
  system)
• (slider-based sidebar)
  
• (X-series safe
  dials)
• (SFICs)
• (Granit Diskus)
• (shackle-less padlock)
• (armory locks, combo locks,
  safes, deposit boxes)

http//deviating.net/lockpicking
134
Security is only as effective
as the person using it
135

• A Security Fable
• American 700 Padlock
• Solid design
• Serrated pins
• Interchangeable cores

136

• A Security Fable
• American 700 Padlock
• Solid design
• Serrated pins
• Interchangeable cores
• Core Operation
• Back of plug half circle
• Control cylinder quarter circle

137

• A Security Fable
• American 700 Padlock
• Solid design
• Serrated pins
• Interchangeable cores
• Core Operation
• Back of plug half circle
• Control cylinder quarter circle
• Peterson Bypass Tool
• Slips all the way through core
• Interacts with control cylinder directly

138

• A Security Fable
• American 700 Padlock
• Solid design
• Serrated pins
• Interchangeable cores
• Core Operation
• Back of plug half circle
• Control cylinder quarter circle
• Peterson Bypass Tool
• Slips all the way through core
• Interacts with control cylinder directly
• Security Wafer

139

• A Security Fable
• American 700 Padlock
• Solid design
• Serrated pins
• Interchangeable cores
• Core Operation
• Back of plug half circle
• Control cylinder quarter circle
• Peterson Bypass Tool
• Slips all the way through core
• Interacts with control cylinder directly
• Security Wafer
• Wafer Breaker Tools

140

• A Security Fable
• American 700 Padlock
• Solid design
• Serrated pins
• Interchangeable cores
• Core Operation
• Back of plug half circle
• Control cylinder quarter circle
• Peterson Bypass Tool
• Slips all the way through core
• Interacts with control cylinder directly
• Security Wafer
• Wafer Breaker Tools

141

• A Security Fable
• American 700 Padlock
• Solid design
• Serrated pins
• Interchangeable cores
• Core Operation
• Back of plug half circle
• Control cylinder quarter circle
• Peterson Bypass Tool
• Slips all the way through core
• Interacts with control cylinder directly
• Security Wafer
• Wafer Breaker Tools
• Shackeless Padlock the American 2000

142
Thank you so much. Thank you to TOOOL.us,
TOOOL.nl, mouse, Babak, Dave, Steve, JVR, Mr. E,
Barry Han, Laz, valanx the FOOLS, Matt Blaze,
jackalope, calypso, renderman, Bruce Heidi
143
Thank you, SummerCon! I came out here on a
whim just because RedPantz askedand made
promises of booze, drugs, and hookers.
144
Security is only as effective
as the person using it
145

• So what is a good lock?
• Locks that I love
• Protec (best rotating disk)
• (sliders in 3KS magnets of MCS)
• Primus (finger pin sidebar
  system)
• (slider-based sidebar)
  
• (X-series safe
  dials)
• (SFICs)
• (Granit Diskus)
• (shackle-less padlock)
• (armory locks, combo locks,
  safes, deposit boxes)

http//deviating.net/lockpicking