Replication Prohibited: Attacking Restricted Keyways with 3D Printing [pdf](usenix.org)
usenix.org
Replication Prohibited: Attacking Restricted Keyways with 3D Printing [pdf]
https://www.usenix.org/system/files/conference/woot15/woot15-paper-burgess.pdf
22 comments
> especially as the guards often assumed their security was unbreakable
It's surprising how often people forget (or never learned) the guideline that thinking a thing is "secure" is itself a security vulnerability.
It's surprising how often people forget (or never learned) the guideline that thinking a thing is "secure" is itself a security vulnerability.
Not sure if I read that book or another one, but I don't recall discussion about the mail room so probably a different one. Colditz is a great story, highly recommended reading. Also recommend Between Silk and Cyanide.
Guarding the mail-room 24/7 was not an option?
This is very interesting. I'm wondering why not print the blanks with a gap at the bottom so there's room to insert a lock-pick tension wrench to apply the torque instead of using the keyhead.
That way the torque capacity of the plastic is basically irrelevant, just print with the best quality and/or cheapest material.
That way the torque capacity of the plastic is basically irrelevant, just print with the best quality and/or cheapest material.
This must be an old paper. No visible date. (Put a date in your PDF file, please. The papers are not being delivered bound into a magazine or proceedings any more.) People have been 3D printing keys for years.[1][2]
Most of that is overkill. If it's just a pin-tumbler lock, simple picking techniques will usually work.
[1] https://www.youtube.com/watch?v=cexGEYxoMe0
[2] https://www.instructables.com/How-to-make-a-3D-printed-keyFU...
Most of that is overkill. If it's just a pin-tumbler lock, simple picking techniques will usually work.
[1] https://www.youtube.com/watch?v=cexGEYxoMe0
[2] https://www.instructables.com/How-to-make-a-3D-printed-keyFU...
That's what metadata is for! Created and modified: 7/21/15.
"woot15" in the pathname may also be a clue for us: https://www.usenix.org/conference/woot15
tptacek is listed as co-chair and committee member. Hi there!
"woot15" in the pathname may also be a clue for us: https://www.usenix.org/conference/woot15
tptacek is listed as co-chair and committee member. Hi there!
Metadata is often stripped out or mangled, though, so including the date in the document itself is still a useful thing to do.
having the key and/or at least the ability to quickly make a key is far quicker than picking and much better if you are intending on being surreptitious. It also aids in less forensic evidence behind.
The paper explains how to get the profile of the key to 3D print the equivalent of key blanks. But one needs the cuts in the key and that part is secret that cannot be easily detected from a photo of the key hole.
Restricted keyways try to protect against the following threats:
* Unauthorised key duplication. Think of a college dorm where residents all have keys, but you don't want them making copies, and keeping access to the dorm after they move out. So they use a design that most locksmiths don't have key blanks for.
* Basic keyholders getting masterkeys by taking locks apart. Think of a college dorm where they want every resident to be able to open the front door, but not each others' dorm rooms, and they want the fire department to have one key that will work for all the rooms. Because of the way masterkey systems work, a resident can take the lock off their dorm room door, measure some internal components, and figure out the cuts on the fire department master key. Restricted key blanks make this a lot harder.
Of course, this doesn't provide perfect security. Restricted keyways don't protect against someone with a CNC milling machine, or someone with a set of files and a lot of patience, or someone willing to break a window.
Modern buildings rarely install new masterkey systems these days - electronic locks are a much better system.
* Unauthorised key duplication. Think of a college dorm where residents all have keys, but you don't want them making copies, and keeping access to the dorm after they move out. So they use a design that most locksmiths don't have key blanks for.
* Basic keyholders getting masterkeys by taking locks apart. Think of a college dorm where they want every resident to be able to open the front door, but not each others' dorm rooms, and they want the fire department to have one key that will work for all the rooms. Because of the way masterkey systems work, a resident can take the lock off their dorm room door, measure some internal components, and figure out the cuts on the fire department master key. Restricted key blanks make this a lot harder.
Of course, this doesn't provide perfect security. Restricted keyways don't protect against someone with a CNC milling machine, or someone with a set of files and a lot of patience, or someone willing to break a window.
Modern buildings rarely install new masterkey systems these days - electronic locks are a much better system.
> * Basic keyholders getting masterkeys by taking locks apart. Think of a college dorm where they want every resident to be able to open the front door, but not each others' dorm rooms, and they want the fire department to have one key that will work for all the rooms. Because of the way masterkey systems work, a resident can take the lock off their dorm room door, measure some internal components, and figure out the cuts on the fire department master key. Restricted key blanks make this a lot harder.
You can actually do it without disassembling the lock with N+1 keyblanks (where the lock has N pins).
Master keys work by having two[1] setpoints for each pin. So you copy your key N times, leaving a different pin uncut in each copy. Then just slowly file down the key until it unlocks. It will unlock in the pin-set position for your key and the pin-set position for the master key. This allows decoding the master key position for a single pin.
Finally, copy the master-key positions onto the last keyblank.
Basically it lets you turn a M^N problem (M positions, N pins) into a MN problem.
1: Assuming the non-master keys are random, there's a chance the two setpoints will be the same on any given pin/lock.
You can actually do it without disassembling the lock with N+1 keyblanks (where the lock has N pins).
Master keys work by having two[1] setpoints for each pin. So you copy your key N times, leaving a different pin uncut in each copy. Then just slowly file down the key until it unlocks. It will unlock in the pin-set position for your key and the pin-set position for the master key. This allows decoding the master key position for a single pin.
Finally, copy the master-key positions onto the last keyblank.
Basically it lets you turn a M^N problem (M positions, N pins) into a MN problem.
1: Assuming the non-master keys are random, there's a chance the two setpoints will be the same on any given pin/lock.
Here is a video I made some years ago picking locks for Handguns... with a spinning keyway useless cover...
You can see that some manufacturers obviously take these items as a joke and its weird that something like these keyway spinner things subconsciously add a tiny thought of more security - when it may as well have been made of paper mache.
https://www.youtube.com/watch?v=u3I6lbpF68Q
https://www.youtube.com/watch?v=u3I6lbpF68Q
Would love to get /u/LockPickingLawyer's opinion on this article.
You can see that some manufacturers obviously take these items as a joke and its weird that something like these keyway spinner things subconsciously add a tiny thought of more security - when it may as well have been made of paper mache.
https://www.youtube.com/watch?v=u3I6lbpF68Q
https://www.youtube.com/watch?v=u3I6lbpF68Q
Would love to get /u/LockPickingLawyer's opinion on this article.
Gun locks are notoriously easy to pick. I think the threat model for them is "A toddler found your gun" more than anything else.
Trigger locks and pistol lockboxes are really just to prevent someone from playing with your guns. A trigger lock obviously isn't going to prevent theft and pistol lockboxes can just be carried away. Although I have seen videos of a toddler dropping a pistol lock box and it pops right open. Maybe at least mount them? A real gun safe is used to actually prevent theft when properly secured to the floor. Although the bypass keys on many safes are not terribly secure. They can be picked or impressioned with the right tools. Although the chance that the burglar actually having the right tools on them might not be very high. A few months ago, I saw a neighbor receiving their new long gun safe. I saw the model name and looked it up to see that it uses a lever lock for the bypass. You can buy very simple impression tools for this kind of lock that will open it up in about 30-60 seconds. Given that it takes at least a few minutes for police to respond to an alarm, two guys can easily search a house, find the safe, pick the bypass lock, throw all the guns in a duffel and be gone before police show up. If I had the same safe, I'd put a small piece of tape over the keyway and JB weld a piece of tool steel over it. If I lose my key, I can certainly wait a bit to drill out a new keyway, not so much for a burglar. Although it would probably be rare for a potential burglar to see a gun safe getting delivered, it would offer so much information on what valuables are inside a house and how to steal it.
A lock is only as weak as an adversary is determined.
A lock is only as weak as an adversary is determined.
absolutely, if you want to secure your gun against a determined thief then you put it in a safe.
Toddler/Child/Idiot friend is a significantly more likely to shoot you/someone you care about.
Toddler/Child/Idiot friend is a significantly more likely to shoot you/someone you care about.
If you have a blank key and access to the lock, you can quite quickly produce a working key with only a hand file. Keys can also be readily decoded duplicated based on a photograph of the key.
These aren't plausible attack vectors for domestic burglars (they'll just break a window), but they are meaningful threats in high-security environments. A duplicate key confounds a lot of the countermeasures used to prevent and detect unauthorised entry.
https://www.youtube.com/watch?v=jciQpGdAVtc
https://www.youtube.com/watch?v=AayXf5aRFTI
These aren't plausible attack vectors for domestic burglars (they'll just break a window), but they are meaningful threats in high-security environments. A duplicate key confounds a lot of the countermeasures used to prevent and detect unauthorised entry.
https://www.youtube.com/watch?v=jciQpGdAVtc
https://www.youtube.com/watch?v=AayXf5aRFTI
I tried to do this once, but despite some (small amount of) hand filing experience at the time, I was not able to produce a working key before getting bored and giving up. I even had an existing worn key to try and copy.
I reckon I could do it now (but for that matter I also reckoned I could do it then).
I would not back the average person's chances. It's harder than it looks.
I reckon I could do it now (but for that matter I also reckoned I could do it then).
I would not back the average person's chances. It's harder than it looks.
If you're using this technique to 3D print a key to match a specific keyway, you probably already aren't the average person.
It also explains that having a key blank allows for attacks such as bumping. Also cuts can be easily reconstructed from photo of the keys.
(2015)
Nice username :D
One of the prisoners was a notorious French cat burglar who prided himself in being able to pick any lock. Sure enough, every time the locks were enhanced, he'd learnt how to unlock them within about a week. Some of the details were amazing. The locks were quite advanced, using a four-way set of teeth, each tooth angled in 2D to micrometer precision. And yet, using quite rudimentary tools (often sneaked in in previous packages), he was able to reconstruct keys "borrowed" from unknowing guards.
I found it quite amusing, especially as the guards often assumed their security was unbreakable. Heard that one before, lol ...