Replication Prohibited: Attacking Restricted Keyways with 3D Printing [pdf]

https://www.usenix.org/system/files/conference/woot15/woot15-paper-burgess.pdf

by 1970-01-01 • 2 years ago

75 22 2 years ago

Animats• 2 years ago

This must be an old paper. No visible date. (Put a date in your PDF file, please. The papers are not being delivered bound into a magazine or proceedings any more.) People have been 3D printing keys for years.[1][2]

Most of that is overkill. If it's just a pin-tumbler lock, simple picking techniques will usually work.

[1] https://www.youtube.com/watch?v=cexGEYxoMe0

[2] https://www.instructables.com/How-to-make-a-3D-printed-keyFU...

NoZebra120vClip• 2 years ago

That's what metadata is for! Created and modified: 7/21/15.

"woot15" in the pathname may also be a clue for us: https://www.usenix.org/conference/woot15

tptacek is listed as co-chair and committee member. Hi there!

JohnFen2• 2 years ago

Metadata is often stripped out or mangled, though, so including the date in the document itself is still a useful thing to do.

darksim905• 2 years ago

having the key and/or at least the ability to quickly make a key is far quicker than picking and much better if you are intending on being surreptitious. It also aids in less forensic evidence behind.

feb• 2 years ago

The paper explains how to get the profile of the key to 3D print the equivalent of key blanks. But one needs the cuts in the key and that part is secret that cannot be easily detected from a photo of the key hole.

rini17• 2 years ago

It also explains that having a key blank allows for attacks such as bumping. Also cuts can be easily reconstructed from photo of the keys.

michaelt• 2 years ago

Restricted keyways try to protect against the following threats:

* Unauthorised key duplication. Think of a college dorm where residents all have keys, but you don't want them making copies, and keeping access to the dorm after they move out. So they use a design that most locksmiths don't have key blanks for.

* Basic keyholders getting masterkeys by taking locks apart. Think of a college dorm where they want every resident to be able to open the front door, but not each others' dorm rooms, and they want the fire department to have one key that will work for all the rooms. Because of the way masterkey systems work, a resident can take the lock off their dorm room door, measure some internal components, and figure out the cuts on the fire department master key. Restricted key blanks make this a lot harder.

Of course, this doesn't provide perfect security. Restricted keyways don't protect against someone with a CNC milling machine, or someone with a set of files and a lot of patience, or someone willing to break a window.

Modern buildings rarely install new masterkey systems these days - electronic locks are a much better system.

samstave• 2 years ago

Here is a video I made some years ago picking locks for Handguns... with a spinning keyway useless cover...

You can see that some manufacturers obviously take these items as a joke and its weird that something like these keyway spinner things subconsciously add a tiny thought of more security - when it may as well have been made of paper mache.

https://www.youtube.com/watch?v=u3I6lbpF68Q

Would love to get /u/LockPickingLawyer's opinion on this article.

aidenn02• 2 years ago

* Basic keyholders getting masterkeys by taking locks apart. Think of a college dorm where they want every resident to be able to open the front door, but not each others' dorm rooms, and they want the fire department to have one key that will work for all the rooms. Because of the way masterkey systems work, a resident can take the lock off their dorm room door, measure some internal components, and figure out the cuts on the fire department master key. Restricted key blanks make this a lot harder.

You can actually do it without disassembling the lock with N+1 keyblanks (where the lock has N pins).

Master keys work by having two[1] setpoints for each pin. So you copy your key N times, leaving a different pin uncut in each copy. Then just slowly file down the key until it unlocks. It will unlock in the pin-set position for your key and the pin-set position for the master key. This allows decoding the master key position for a single pin.

Finally, copy the master-key positions onto the last keyblank.

Basically it lets you turn a M^N problem (M positions, N pins) into a MN problem.

1: Assuming the non-master keys are random, there's a chance the two setpoints will be the same on any given pin/lock.

jdietrich• 2 years ago

If you have a blank key and access to the lock, you can quite quickly produce a working key with only a hand file. Keys can also be readily decoded duplicated based on a photograph of the key.

These aren't plausible attack vectors for domestic burglars (they'll just break a window), but they are meaningful threats in high-security environments. A duplicate key confounds a lot of the countermeasures used to prevent and detect unauthorised entry.

https://www.youtube.com/watch?v=jciQpGdAVtc

https://www.youtube.com/watch?v=AayXf5aRFTI

jstanley• 2 years ago

I tried to do this once, but despite some (small amount of) hand filing experience at the time, I was not able to produce a working key before getting bored and giving up. I even had an existing worn key to try and copy.

I reckon I could do it now (but for that matter I also reckoned I could do it then).

I would not back the average person's chances. It's harder than it looks.

opengears• 2 years ago

Nice username :D

kitd• 2 years ago

Semi-related: I have been reading Ben Macintyre's history of Colditz, the WW2 POW camp. The prisoners used to intercept incoming packages that contained secret information and tools used for escaping, to remove it before the packages were inspected by the guards. The guards suspected this and enhanced the locks on the mail room.

One of the prisoners was a notorious French cat burglar who prided himself in being able to pick any lock. Sure enough, every time the locks were enhanced, he'd learnt how to unlock them within about a week. Some of the details were amazing. The locks were quite advanced, using a four-way set of teeth, each tooth angled in 2D to micrometer precision. And yet, using quite rudimentary tools (often sneaked in in previous packages), he was able to reconstruct keys "borrowed" from unknowing guards.

I found it quite amusing, especially as the guards often assumed their security was unbreakable. Heard that one before, lol ...

linsomniac• 2 years ago

Not sure if I read that book or another one, but I don't recall discussion about the mail room so probably a different one. Colditz is a great story, highly recommended reading. Also recommend Between Silk and Cyanide.

JohnFen2• 2 years ago

especially as the guards often assumed their security was unbreakable

It's surprising how often people forget (or never learned) the guideline that thinking a thing is "secure" is itself a security vulnerability.

gpderetta• 2 years ago

Guarding the mail-room 24/7 was not an option?

kickofline• 2 years ago

(2015)

fargle• 2 years ago

This is very interesting. I'm wondering why not print the blanks with a gap at the bottom so there's room to insert a lock-pick tension wrench to apply the torque instead of using the keyhead.

That way the torque capacity of the plastic is basically irrelevant, just print with the best quality and/or cheapest material.

Replication Prohibited: Attacking Restricted Keyways with 3D Printing [pdf]

Related Stories