Slashdot Mirror
Steel Bolt Hacking
The beginning of the book discusses the origins of lock-picking sporting groups, crews in the U.S and Europe, competition around the country, and how to become a part of a lock-picking group. One of the groups out of Colorado Springs, DC719, are a bunch of computer geeks that have taken up the art of lock picking and sponsor a lock-picking contest every year at DefCon. According to Mr. Chick, computer people are the fastest group to pick up the art of lock picking. (I must warn you though, there are also a lot of disclaimers about the author not being responsible for the misuses of the information contained in this book.)
The book is fully illustrated with pictures of different types of lock picking instruments, tools to make your own picks as well as padlocks, deadbolt, and combination locks. There are pictures of locks that have been cut open and even how to crack push-button combination locks. (You know, the kind you find on the door to a server room.) I have to say, for a little book, (114 pages) it is brimming with valuable information for a beginner. What I didn't realize was that software isn't the only thing that has security vulnerabilities; mechanical things like padlocks and deadbolts do as well. What was scary to learn is how easy cheap locks can be picked, and that 80 percent of all locks used are cheap locks. Expensive locks are just likely to take a little longer.
I liked that the book didn't exaggerate. It didn't tell me that I was going to be a master lock picker after only a few tries. It took a little time, practice and sore fingers, but after a couple weeks of practice, I could pick every lock in my house. And as a computer person, I liked all of the jargon that was used to explain locksmith techniques. There was also enough humor to keep the book interesting; it's difficult to read any type of textbook and still maintain a reasonable interest. The illustrations are good and there is a resource section to purchase the tools you need from the Internet.
What I didn't like about the book: The most annoying point, I felt, is the considerable redundancy in methods between different types of locks to be picked. Also, the book suggests that there might be a lock-picking group in every city in the U.S., when in fact I am having a difficult time finding one in my are. And I live near D.C. -- You'd think there would be one on every corner around here. I think that the sport is still in its infancy and Mr. Chick is hoping his book will draw more people to it. The author put his e-mail address on the back of the book. He hasn't responded to my e-mail yet, but I suppose that he's probably a busy man.
All in all, I found the book informative, entertaining and worth the purchase price of 19.99.
You can purchase Steel Bolt Hacking from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.
Some other interesting discussion. Small wonder I scarcely let my racing bike out of my sight.
"may I borrow your pen? I need to pick up some transportation."
A feeling of having made the same mistake before: Deja Foobar
Erick
http://www.busyweather.com/
I first read about serious lock hacking in the book Hackers by Steven Levy. The early hackers at MIT were notorious for hacking locks on office doors, toolboxes, safes, etc. to get to tools and information.
Lockpicking and an interest in computers seem to go hand in hand. A number of the people in my college are seen practicing picking locks during boring lectures.
One guy picked the lock on a projector and cabled another person to the projector cart
No, he just lost his password for checking his email.
You know what?
quicktime movie of the same.
-knowles
In DC, basic possession of lockpicking instruments is illegal, unless you are a licensed locksmith. You don't have to prove intent. This is the same in many other states. Be careful and don't do anything stupid.
It was on a removable HD tray that jammed, but the story's better when I leave that part out.
You believe me, right? I posted it on slashdot!
the preceding comment is my own and in no way reflects the opinion of the Joint Chiefs of Staff
Like computer hacking, the primary value to most people is not learning how to hack, but learning how to make things more hack-proof.
So does this book have any recommendations along those lines? What door locks, deadbolts, padlocks, bike locks, etc, follow the locksmith version of "best security practices"?
That, IMHO, is the REALLY important thing to discuss!
Everyone in the room goes "Ooooo! how did you do that? Are you really that good?" And he had the presence of mind to say, "Yes." =)
"A witty saying proves nothing." ~Voltaire
"d'Oh!" ~Homer
If you're interested in learning a bit about lock picking, but aren't sure you want to spend $20 on this book yet, take a look at this article at Howstuffworks.com.
It offers a great introduction to lock picking, and has some nice graphics that really helped me understand how locks work, and how they can be circumvented. If you really get into it, then I'm sure this book would offer a lot more information to help you along.
I've found over the years, simply being self-taught, that there are very few locks I can't get into using stuff I carry on me or stuff that's easy to find (leatherman tool, paperclip, sewing needle, whatever.)
There's a much larger number of locks that I can't get into without making it patently obvious somebody broke in. This is something I haven't been as successful in teaching myself.
The former is engineering. The latter, that's art.
-JDF
the easiest way to break in is to crawl through a window.
At work we have 4 of those 8' tall cabinets with the small keys and cheap locks. My building has 80 people working in it, so it was a pain when someone used the cabinet and ran off with the key. Who could it be? I told them I could knew how to pick locks. Really I meant that I saw a tutorial on howstuffworks.com about 6 months ago. I was talking out my ass but gave it a shot anyway. In about 2 minutes I had picked their crappy lock and we could tell who took the key by the stuff that was in the cabinet. Everyone in my office kept saying "I don't want to know what you did before you worked here." I tried to keep my "skills" quiet though. Didn't want people looking to me when stuff went missing.
So now you're telling me that Douglas Chick is the master of unlocking? Well, Barry Burton told me that Jill Valentine was...
Wait until the streep sweeper comes by and follow it down the street. The bristles are spring steel that is perfect for lock picks. They fall off, just pick them up off the street.
I've never made a set of picks so I don't know if this is true or not, but there was a decent lock picking culture at MIT in the late 70s.
For locks like a Medaco lock - in which the tumblers have to be rotated to a certain angle (usually 15 deg increments) as well as lifted to a certain height - AFAIK there are no tools out there that can pick that. However, even the strongest locks uses brass for the tumblers (Medacos are no exception - at least the one that I opened up to play with :) ).
... I could probably have opened the door with just a screwdriver after the tumblers are dissolved.
Brass is primarily a copper alloy. It is extremely reactive in the presence of strong acids. A few years back, a friend of mine wanted to look at a smart card under a microscope - just curious, that's all. I was working in a research lab then, and I mixed hydrochloric acid with nitric acid to make aqua regia. We were able to dissolve the GOLD contacts off the smart card to expose the chip underneath. (Aqua regia is used for lot assay analysis of alloys to determine alloy composition - you start by dissolving the metal, then feed it through some form of spectroscopy machine to measure the quantity and the composition of the metal). If I had squirted that into the door lock and held it in place with some bubble gum
- SK
...the 'printable' version of the article.
When my father died, he left some important papers in a locked drawer in his file cabinet. The key was nowhere to be found. But the drawer above it had no lock. I just removed that one.
Older Steelcase desks with a center drawer actuated locking mechanism could be opened (well, except for the center drawer itself) by just reaching behind that drawer and lifting up the lever that locked all the others.
I'm suprised no one has linked to the (in)famous MIT Guide to Lockpicking yet.
Why is it that the proponents of "one nation under God" are so eager to get rid of "liberty and justice for all"?
Speaking of MIT, why hasn't anyone mentioned the MIT lock picking guide ?
Abloy locks employ a sidebar and rotating disks. It's very, very difficult to pick them for several reasons; sidebar locks are intrinsically difficult to pick (such as the old GM locks, which didn't have a pick set for them until the late 1980's or early 1990's, when some smartass figured out that you could use a special spring compression tool to allow the wafers to free-float. That makes them subject to move when vibrated or rapped, and the sidebar (which is then under spring pressure) can line them up.
Abloy has no such constraint. IIRC, the world record for picking an Abloy is 36 hours. That may have changed; I don't know.
For high security locks like Medeco, ASSA, Abloy, etc., the fastest way through them is a grinder. Used to be an ice pick attack to the latch, and although some locks are still improperly installed, that's largely gone the way of the dodo.
As a locksmith myself, I'd rather have Abloy on my doors more than anything else. But they're hard to find here in the US, so I use Medeco instead. Beats the hell out of a $15 Kwikset, lemme tell you.
First, the obligatory link to a mirror of the MIT Lockpicking Guide.
Second - as another poster noted, lock pins aren't typically made from high-strength alloys. A battery-powered hand drill (and a screwdriver to turn the lock when the pins are gone) is the best and fastest lock pick that there is. Didn't even leave any visible damage when I used this approach on a filing cabinet we'd lost the key to. Just pick a bit as wide as the key entryway, and drill down the line of pins.
Be advised that the lock tends to jam after closing again, as the remains of the pins fall back into their channels when the lock returns to its original position. But if you're drilling a lock, you're typically looking for a one-time solution anyways.
For that matter, most structures surrounding locks aren't indestructible either. When you get down too it, someone can break into a lot of places by driving sledgehammer or truck through the door.
However, that makes lots of noise. It's hard to protect an office building from a bulldozer attack, but then again, it's pretty hard to sneak around with a bulldozer.
Really an attack involving strong acids isn't much more practical. Not many thieves want to walk around with a bottle of highly concentrated HCL hidden in their pocket. (think spillage while trying to run from the police)
Your best bet in any physical security is to try and make the thief do one or more of the following:
1) make a lot of noise (defeating stealth)
2) leave a lot of good evidence about the intrusion (defeating anonymity)
3) use specialized or expensive tools (defeating any financial gain)
4) use a tool too unwieldy or impractical to transport inconspicuously. (defeating stealth)
Of course, scale the measures to fit the value of what you're hiding.
-Matt
I've participated in the Lockpick contest for the last 2 years. It's been a blast. Quite a challenge too. The book is'nt anything hugely groundbreaking (check out Security.org for a really amazing book), but it's a good thing to read if your curious or if your like me and are not very good at explaing how to do it to others.
I just find lockpicking facinating because it's yet another case of people proving manufacturers claims are often highly exadurated, or just full of BS. Knowing, and proving for yourself what makes a good lock vs. a bad lock fits well into the computer security dynamic (Physical security anyone?). That extra $1-2 for a master brand lock can buy you several minutes more security vs. a cheap look alike that can be shimmed in about 3 seconds, kind of useful to know. They can both be opened, but your less likely to have a thief willing to be exposed for several minutes than for a few seconds. The Kyptonite vulnerability now makes everyone re-think trusting the manufactureres claims now does'nt it?
It's also a handy skill for those inevitable times when someone locks the server cabinet and loses the key and you don't want to pay a locksmith through the nose. I also use my skill in security audits to very dramatically show how little security that cheap lock on ther server room provides.
I've got some descriptions of the contests and LP resources up at my site and some links to videos and the MIT guide if anyones curious.
Just remember that there is little a set of bolt cutters, a crow bar, or a sledge hammer can't get through. Lockpicking is the 'elegant solution' to that (literal) brute force.
Where are we going, and why are we in this hand cart?
Lockpicking was standard teaching for freshman the East Campus dorm at MIT. This guide has served as the standard since around 1991 iirc. During the yearly EC "Oddball Olympics" lockpicking was one of the main events. I remember a masterlock being picked in 9 seconds. Really, masterlock padlocks can be that easy. And I've seen master hackers (roof and tunnel in this case) spend an hour and a half on a Schlage and never get it.
This is a great guide and a good place to start, but lockpicking is all about feel. Like anything else, it just takes practice to get good.
Just tried it on the Krypto-Lok sitting next to my desk and once I figured out the trick, I got it open in about 15 seconds.
Basically, you have to shake the lock at the same time that you're turning the pen.
My guess is that shaking and wiggling the pen causes the interface between the pins & spacers to move around, and if you're turning the pen at the same time, the cylinder will rotate a notch as soon as the interface between the leading pin/spacer pair is in the right place. Then you just repeat the same procedure for all the other pin/spacer pairs.
pi = 3.141592653589793helpimtrappedinauniversefactory7
I've made several sets, and it really is this easy. Best way really is to follow the street sweeper. The spring steel bristles that come loose have perfect properties. I've tried making them out of other materials, and the spring steel is quite easy to shape and very resilient.
Then just find a decent pick you want to copy, and sit down at the grinder with your blank bristle. They've still got grinders in my old dorm and the lockpicking culture is indeed alive and well at MIT.
I first learned to pick locks at my childhood church, from my dad. The locks were standard household style locks, on doors that opened outward, so all I needed was a pocketknife.
During High School, I could often be found inside the locked classroom, waiting for the teacher to arrive. I knew which doors opened using which methods, and which windows were nearly impossible to lock properly.
I've learned a few things about physical security over the years. Walls don't always go to the true ceiling. Locks don't always work as advertised. The unknowledgeable don't always understand the proper ways to secure things, and a disgruntled soon to be ex-employee will occasionally just hand you a key you shouldn't have.
With my knowledge of computers, I make it clear that I look the other way when people are typing in their passwords on a PC I'm working on. I want it to be clear to them that I don't know their password. If I want to gain access to a PC, I don't need to know the password before I start anyway.
People come to me when they need to gain access to something they've locked themselves out of on their computer. They have confidence that i can help them. Quite often, I can. A little research, a little knowledge, and the ability to solve problems tends to do the trick.
I've never studied lockpicking. I've never needed to. Locks are usually either very easy to go through, or around. Around is usually the best way.
These days, it's all white-hat. That makes it even more fun.
Visit Lockjaw's Lair. He won't bite.
...and I browse /. when the sales calls aren't heavily inbound. Naturally, I forwarded the link to the other six folks in the department, and everyone's buzzing about it. We will definitely bring it up with the Kryptonite rep the next time he's in the area.
Generally, folks buying locks know that it's just a deterrent... except for the people buying exactly the retails-at-$80 lock (with heavy-duty chain) shown in the movie, who tend to be messengers and/or people with $1k+ bicycles. Personally, my bikes stay locked up in my living room when I'm not on them, and I don't take my lock with me when I seriously ride because that would tempt me to separate myself from the bike. I've got a cheap old schwinn cruiser for that. (=
The pain was excruciating and the scarring is likely permanent, but that just means it's working.
Nope. This model of lock must have either really crappy manufacturing or a design flaw or both. What they're doing is the equivalent to "raking" in a conventional lock -- that's when you put some tension on the cylinder and just run a pick along the pins without any attempt to feel the individual pins. It generally won't work in a lock with security features and tight tolerances (though sometimes you get lucky). In addition, tubular locks are usually designed so you have to turn it at least 1/4 turn to open it, which would involve picking the lock several times. The Kryptonite they show releases the shackle in an intermediate position -- bad design there. A real tubular lock pick should open those locks; a simple plastic cylinder of the right diameter should not.
there's some interesting insight and speculation on the original bikeforums.net thread regarding this.
i don't know much about lock picking, but some posters there basically speculate that most circular locks are somewhat succeptable to this kind of picking and the krpytonite happened to be especially unlucky due to the diameter of the barrel and pressure needed to compress the springs of the teeth mechanisms inside.
the bic pen happened to hit the spot, being the proper diameter and the proper softness, collapsing where necessary, but strong enough to poke down, where necessary.
i'll say that after practicing for a little while, i can pop a krpytonite EV disc lock (top of the line) in about 5 seconds.
Okay, in many states you can legally own lockpicks as a hobbyist.
HOWEVER!!
IF YOU ARE ARRESTED FOR -ANY- CRIME, POSSESSION OF LOCKPICKS WILL CAUSE YOU TO ALSO BE CHARGED WITH POSSESSION OF 'BURGLERY TOOLS'! This could even include a speeding ticket if the Officer decides to search you. So if you are going to carry lockpicks on your person, BE CAREFUL!
So I'm at a jobsite and really REALLY needed to pee.
I recalled seeing a bathroom on the floor and when I got there, I was confronted with a pushbutton lock.
The pushbuttons were some kind of polymer, with the numbers PRINTED on them.
Three of the buttons had the numbers worn away.
Needless to say, I solved the lock in a few seconds.
Funny thing, it was an executive-type bathroom, not to be used by scruffy hacker geeks like me.
Or so I was told by the executive-type that found me in there using a urinal.
"Who gave you the combination?"
"Everyone who used the bathroom since the lock was installed, that's who." (FLUSH)
Guaranteed! This comment 100% Anthrax free!
Can we PLEASE stop fixing the word 'hacking' to the hobby of ones choice where it really REALLY holds no relevance?! Hey, tonight I'm microwave hacking, so what sort of TV dinner would you like? We can talk about the sky hacking I'll be doing with my friend's RC plane over the weekend. What? You'll be doing some lawn hacking with your mower? Too bad. After our sky hacking session we were going to do some car hacking and put a spoiler ON MY DAMN CAR.
Using this word superfluously is starting to take on the characteristics of the word 'kool'; You sound like you have an IQ of 5, so give it a freakin' rest already.
You need a FREE iPod Nano
I had a bike locked with the top-end kryptonite stolen. The thief then kindly re-attached the kryptonite to the bike rack. When I tried to redeem the "lock guarantee" or whatever that ridiculous thing is called, they called me a liar. They said I didn't lock it properly or some such.
:)
I will never buy another lock, ever. I only trust my good bike ( A Trek Project One 5500/5600 (the OCLV 110 from a year or two ago) with campy record) to be within reach. My junker is a 1960s Schwin that cost about $60 and is in 4 colors of cheap spray paint. I just tie it in place with a double figure-eight knot
-WS
An operating system should be like a light switch... simple, effective, easy to use, and designed for everyone.
Lever locks have the combination component one step removed from the input component, which makes them harder to force. If you try to force a lever lock, you may trash the levers, but that won't open the lock.
Safe deposit boxes are traditionally lever locks, although not always very good ones. Jail locks are usually level locks of massive size.
Lever locks are usually big rectangular boxes, unsuitable for embedding in a door. So they're not used much unless serious security is required, as in a jail.