Hacker Opens High Security Handcuffs With 3D-Printed And Laser-Cut Keys

http://www.forbes.com/sites/andygreenberg/2012/07/16/hacker-opens-high-security-handcuffs-with-3d-printed-and-laser-cut-keys/

by thebigdeluge • 14 years ago

124 49 14 years ago

forbes.com

nl2• 14 years ago

The situation with keys is actually worse than Forbes makes out.

Apparently they don't realize that (most) keys can now be copied from a photograph, from up to 195 feet away[1]. I realize that these "high security keys" are probably harder to duplicate than a normal key - but how many security officers know they should be keeping the keys out of sight as well as physically secure?

[1] http://hackaday.com/2009/09/22/photographic-key-duplication/

loceng2• 14 years ago

Time for fingerprint entry to become popular - at least until cloning specific body parts becomes a home-kit..

unimpressive• 14 years ago

You could probably build a convincing fake-finger to fool the scanner.

samstave• 14 years ago

Cloning of a specific body part has been a billion dollar industry for some time now...

Simucal• 14 years ago

Mythbusters was able to defeat several fingerprint identification systems quite easily.

At first their attempts were pretty elaborate. They lifted a fingerprint from a glass a person had held and then used an acidic solution to etch that pattern onto a mold. This mold then opened all of the high-end thumbprint readers they had.

However, if I remember correctly, they then went low-tech and simply used a photocopy of the thumbprint which also opened several devices.

grassclip• 14 years ago

Depending on the situation, I might be ok with fingerprint access (such as high secure areas and such). The problem is for normal everyday use, I wouldn't be able to tell where the data is going. Either the manufacturers themselves or governments or hackers could be storing the data about who enters which door and when which would be another attack on my personal privacy that I don't want to give up.

maxerickson2• 14 years ago

If a house/building has windows or mostly wooden walls, the lock is really only preventing people from quietly using the door.

sp332• 14 years ago

Much too late! http://www.h-online.com/newsticker/news/item/CCC-publishes-f...

nl2• 14 years ago

God no. Haven't we learnt by now?

Two-Factor authentication (something you have + something you know) is for physical security as well as online.

nrp• 14 years ago

I actually found it easier to duplicate higher security keys than the usual household SC1 and KW1 ones. [0]

What makes a lock difficult to print and difficult to pick can be very different.

[0] http://eclecti.cc/hardware/physical-keygen-now-for-disc-deta...

dsr_• 14 years ago

Handcuff locks are identically keyed so that any police officer can open them.

But it's rare that you need such compatibility; instead, "anyone in the department" is a fine size.

Handcuff manufacturers cheaped out. If they offered keys made per department, the keyspace would go from approximately 5 to tens of thousands. That won't stop someone from duplicating a key, but it will change the cost proposition for mass-duplication.

Plastic ties don't have the key issue, but they are vulnerable to a knowledgeable (semi-) brute-force attack.

Hoff• 14 years ago

In large-scale and homogenous departments, yes, that might sometimes work.

Through what is known as mutual aid, it is routine for various smaller police agencies to interoperate with other law enforcement agencies; with county, state and federal agencies with direct jurisdiction, and police departments from neighboring municipalities through mutual aid.

Finding a half-dozen police agencies at various calls is not uncommon.

This isn't only a factor with small departments, either. In some areas within cities with large established police departments, there can be a dozen law enforcement agencies with direct jurisdiction for a particular location and/or event.

And yes, this can be why officers at large events are often issued plastic cuffs. No keys.

Paralleling the problem that would arise with using multiple different cuff keys, simple radio communications among the various police and municipal agencies can be an issue. Everything from the frequencies and bands and encoding to the individual radio codes used by officers can lead to confusion.

When the hits the fan, a police officer needs equipment that works reliably, and the officer doesn't want to even have to think about using the equipment, nor about different cuff keys, radio protocols or codes.

shabble• 14 years ago

There was a usenix paper I recall from last year: Why (special agent) Johnny (still) Can't Encrypt[1], which I think includes some of the issues of trying to run these sorts of ad-hoc radio networks securely.

[1] http://www.crypto.com/blog/p25/

ldayley• 14 years ago

Interesting story. My larger concern is that incumbent businesses and political interests will use this type of story to spread FUD that enables them to enact fear-based regulation before the benefits of cheap 3D printing can be realized by the general population. One simply has to look at piracy concerns and asanine infosec and privacy regulations for previous examples.

gcb• 14 years ago

tomorrow: handcuff manufacturers call the DMCA over reverse engineering and subsequent pirating of their keys copyright.

everyone with a key is considered suspect. EFF suggest you walk around with several keys to your neighbors houses to enable a doubt defense.

Feds waste millions of tax dollars on 3D printers crackdowns trhu the country, since they can't be used for anything else other than pirating handcuffs keys copyrighted material. Seizes thingverse servers and demand CEO extradition.

TheGateKeeper• 14 years ago

Don't you dare give them ideas!

mtgx• 14 years ago

You do know they'll use your suggestions as their playbook now, don't you? These days, the US Government seems to be using 1984 as their playbook, so why not this, too.

sev• 14 years ago

Ya. (FATA) Federal Anti-Technology Act coming right up!

drivebyacct2• 14 years ago

It's sad that it seems any story can be twisted into some way that entrenched powers can exert themselves, particularly over information. Such a shame.

ktizo• 14 years ago

The thing is that certain forms of 3d printing technology brings the costs down so far for manufacturing certain technologies, that not restricting it as a society means that you will win technologically overall, compared to more restrictive societies.

They are in basic form, the first generation of digital replicators and some of the open source variants are already under $500, with dirt cheap print costs.

Who only knows what the patent industry is going to do, because certain sections of it are now screwed far, far worse than the recording and distribution industry ever was over people downloading MP3s, especially given that the mashup and resharing of different objects will probably be an extremely common use of desktop manufacture-to-order technologies and is easily accomplished over many existing and popular MMORPGs, alongside all the standard web channels, so is an absolute nightmare to try and police.

And that's without even considering the issues raised by laser scanning, photographic 3d, or just artists with a good eye and memory.

m0nty3• 14 years ago

Just wait until you can download a handgun. Just wait until someone attaches explosives to a DIY drone and sends it into a shopping mall. Just wait until someone hacks the firmware on your self-driving car. It's going to get ugly.

Bakkot• 14 years ago

Re "download a handgun", that debate is already happening:

http://boingboing.net/2011/09/20/3d-printed-ar-15-parts-chal...

wlesieutre• 14 years ago

I don't see how a DIY drone is any different from using an off the shelf RC plane and a wireless camera. The car one though, I have serious concerns about. There's an urban legend about cell phone viruses infecting cars via bluetooth, and while I don't know of any real cases of remote car hacking, it's not a happy thought.

One would hope that self-driving cars will have their driving system disconnected from any networks, but I don't know if that's even practical.

DrWhax• 14 years ago

Old news, this has already been done at http://har2009.org/ read more here -> http://blackbag.nl/?tag=har2009

sesqu• 14 years ago

Yes, that was mentioned in the TFA, because it was done by the same guy. Did you not read it?

eumenides12• 14 years ago

I don't understand why we are making handcuff with keys. Wouldn't it be better to have cuffs that lock but can't be unlocked. The only way to get them off would be to destroy them. Think zip ties that are structurally stronger.

Maybe the destruction method would be something like UV light to melt the cuffs.

Is it so important that we have re-usable cuffs?

crusso2• 14 years ago

Think zip ties that are structurally stronger.

Zip ties themselves are easily circumvented with a razor. If stronger, how much stronger? Do you need heavy-duty bolt cutters to get them off?

UV light to melt the cuffs.

Wouldn't a UV light source then be an easily-producible key?

michaelbuckbee• 14 years ago

You don't even need a razor, in the video below a teenage girl is able to pop them off her wrists with applied force:

http://www.youtube.com/watch?v=HfmOD5jImOs

eumenides12• 14 years ago

I was thinking like 3/4 to 1/2 inch tubes of solid plastic. So maybe heavy-duty bolt cutters would be a good idea to get them off.

The crux of the idea is that only way to get the cuffs off is to break the cuff with a specific brute force that requires a large unconcealable device. Even with the device, you still need time/space to use it (5-10 mins).

So pretend that we would need a large UV lamp and 5 mins to melt through.

egypturnash• 14 years ago

"Even so, Ray says he won’t post CAD models of the Bonowi or Clejuso models online, given that those keys are harder to obtain and providing blueprints for their reproduction could in fact reduce their real-world security. "

But in the very same article, there's a lovely photo of the Bonowi key next to a more readily-available Chubb key[1].

And I suspect most of the kinds of people with access to laser cutters and 3D printers have heard that it's pretty easy to dupe a key from a photo. Googling for "duplicate key from photo" brings up any number of articles that outline the techniques.

I can only assume that the Chubb key was provided for scale, to allow anyone with the tools to reproduce the Bonowi as well!

[1]http://blogs-images.forbes.com/andygreenberg/files/2012/07/S...

HeyLaughingBoy• 14 years ago

Not knowing much about keys, but knowing a bit about machining materials, I dare say that skilled people with access to a hardware store to buy a hacksaw, a few files and some metal could also duplicate a key without much trouble.

For all their high-tech trappings, laser cutters are still doing what humans do by hand all the time; they just do it faster.

jwatte• 14 years ago

I wonder if someone patented an actuator/microcontroller based cuff. The "key" would contain a battery and the cuff would challenge the key for the right password. There's lots of cryptography that could be used there, from shared secrets to public/private signatures. If it's not patented yet, I guess this description of the idea (that I might have thought of 364 days ago) counts as prior art :-)

xbryanx• 14 years ago

Zip ties.

Hacker Opens High Security Handcuffs With 3D-Printed And Laser-Cut Keys

Related Stories