The Future of Lockpicking

1
The Future of Lockpicking
datagram datagram.layerone_at_gmail.com Toorcon X,
2008
2
Current State of Lockpicking

• Locksport emerging
• Hobbyist/vendor interaction
• New tools more specialized
• Big name vulnerabilities
• Recently Medeco m3, biaxial

3
How Locks Work
4
How Locks Work
5
How Locks Work
6
How Locks Work
7
How Locks Work
8
Pin Binding
9
Pin Binding
10
Picking a Lock

• Apply tension
• Find binding pin
• Raise to shear line
• Repeat

11
Picking a Lock
12
Picking a Lock
13
Do High Security Locks Exist?
14
Restrictive Keyways
15
Restrictive Keyways
16
Security Pins
17
Security Pins
18
Security Pins
19
Security Pins - ASSA
20
Pin-in-pin Stacks

• Dimple lock feature
• Mul-T lock
• Michaud attack

21
Pin-in-pin Stacks Normal
22
Eric Michaud's Attack
23
Pin-in-pin improved
24
Interchangeable Cores?

• Two shear lines
• Hard to pick!
• Ease of management
• BEST/Arrow/etc

25
ICs Normal View
26
ICs Normal Operation
27
ICs Control Operation
28
ICs Normal Control
29
ICs Hard to Pick!
30
ICs Control Sleeve Attack
31
ICs Control Sleeve Attack
32
ICs Vendor Solution
33
Side Pins Schlage Everest
34
Side Pins Schlage Everest
35
Side Pins Schlage Everest
36
Side Pins Schlage Everest
37
Side Pins Schlage Everest
38
Sidebars
39
Sidebars
40
Sidebars ASSA Twin
41
Sidebars
42
Axial Rotation
43
Axial Rotation
44
Axial Rotation
45
Axial Rotation
46
Axial Rotation
47
Axial Rotation Schlage Primus
48
The Medecoder
49
Sliders

• Guided sliders activate sidebar(s)
• Medeco m3
• EVVA 3KS/MCS
• Scanlock

50
Sliders
51
Medeco M3
52
Medeco M3 Bypass
53
Medeco M3 Bypass
54
Sliders - Scanlock
55
Sliders - EVVA 3KS
56
Magnets

• Magnets activate sidebar
• Usually dimple hybrids
• EVVA MCS
• MIWA/Anker 3800

57
Magnets EVVA MCS
58
Magnets - EVVA MCS
59
Disc Locks

• Mini-safe locks
• Rotating discs
• Picks
• Falle tool
• Found
• High security installations
• Newspaper machines!?

60
Discs Falle Tool
61
Abloy PL-362 Cutaway
62
False Gates - Abloy
63
Anti-bumping

• Easy!
• Good locks already do this
• Vendor response
• Some unexpected...

64
Shadow Drilling
65
Shadow Drilling
66
Shadow Drilling
67
Top Gapping

• Stops energy transfer
• Used by Master(!)?

68
Top Gapping
69
Kwikset !??!
70
Kwikset SmartKey/BumpGuard
71
Legacy Physical Security

• What to do?
• Dealing with vulnerabilities
• Dealing with upgrades
• The American 700, a lockpicker's lullaby

72
The American 700 A Flaw

• Initial design
• Flaw w/ shackle interaction

73
The American 700 A Patch!
74
The American 700 New Flaw
75
The American 700 - Redesigned

• Brand new design
• SFIC
• Shim resistant
• Good vendor response )?

76
A note on destructive entry...

• Still highly effective
• Easier
• No skill needed
• SmartKey vuln

77
...and the future?
78
What else?

• Environmental concerns
• Surveillance
• Lighting
• Security is not just the lock!

79
Great Locks

• SFICs
• m3, biaxial (still good for personal use)?
• Penta, combo (dial button) locks
• Primus
• Twin series
• telescoping pins, G series padlocks
• Protec (most disc locks are great)?
• Granit, Diskus
• Corbin Emhart (interlocking pins)?
• MCS, 3KS (expensive, but great!)?
• armory padlocks, combo safe locks

80
Learn more!

• TOOOL EUR/USA Chapters
• http//toool.nl, http//toool.us
• Lockpicking 101 Forums
• http//lockpicking101.com
• NDE Magazine
• http//ndemag.com
• Deviant Ollam
• http//deviating.net
• Marc Tobias
• http//security.org
• Matt Blaze
• http//crypto.com

81
Thanks/Credits

• Deviant Ollam, locktoons
• N2oah, EVVA/Anker/etc pics
• Julio Caluori, Scanlock/EVVA/Abloy pics
• Matt Blaze, BEST/Everest pictures
• Toorcon, putting up with me (again!)?