1. Attack the Key Own the Lock
by datagram & Schuyler Towne
Defcon 18 (2010)‏
Las Vegas, NV

2. About Us
datagram
Schuyler
TOOOL US
NDE Magazine
Wheel of Fortune

3. How Locks Work

4. How Locks Work

5. How Locks Work

6. How Locks Work

7. Key Control
Availability of blanks
Distribution
Duplication/simulation

8. Attacking the Key Bitting depths/code Keyway Model of the lock
Additional security features

9. Physical Access to Keys
Holy Grail
Duration = Attack Quality
Wrist Impressioning

10. Copy Impressioning
Photo of those mold shits

11. Direct Measurement Key gauges
Micrometer, calipers, etc photo of key getting measured photo of fancy measurement mafs?

12. Visual Access to Key
Sight reading
Estimation
Photography

13. Visual Access – UCSD

14. Visual Access - Diebold

15. Visual Access – NY MTA

16. Key Blanks Impressioning Overlifting “Reflecting” keys
Sectional keyways
Rake keys
Key bumping

17. Impressioning

18. Impressioning
Works Forever!

19. Overlifting

20. Overlifting

21. Reflecting Keys

22. Sectional Keyways

23. Sectional Keyways

24. Universal Handcuff Keys

25. Rake/Gypsy Keys
I'm betting this is the same as Gypsy keys? They basically cut keys like this:
And then use them to rake the lock open

26. Incorrect Key Master key decoding Bumping Skeleton keys
Sidebar attacks
Passive component bypasses
Decoding attacks

27. Master Key Systems

28. Master Key Systems

29. Master Key Systems

30. Master Key Systems

31. Master Key Systems

32. Key Bumping Basic physics Specialized key Easy, effective
Vendor response

33. Pick Gun Mechanics

34. How Bumping Works

35. Creating Bump Keys Any key that fits
Cut “999” key (deepest pin depths)‏
Use key gauges
Cut with
Hand file, dremel, key cutter

36. Bump Keys

37. Key Bumping

38. Key Bumping

39. 100% Efficiency...?

40. Don't underestimate attackers...

41. Bumping Hammers

42. Side Pins

43. Side Pins

44. Side Pins

45. Side Pins

46. Side Pins

47. Regional Sidebar Attacks
ASSA Twin Combi
Schlage Primus
Fichet 480
The list goes on...
Schlage is doing it wrong.

48. One Last Way Schlage Is Doing It Wrong: LFIC
BEST SFIC
Small Format Interchangable Core
Schlage LFIC
6.5 Control Key

49. Passive Components

50. Resources openlocksport.com lockwiki.com lockpickingforensics.com
ndemag.com

51. Meet us at Q&A!