Slashdot Mirror
11-year-old Proves Locks Not So Secure
An anonymous reader writes "A new security column at Engadget details the new 'old' threat of bumping locks. The article goes on to describe and demonstrate an 11-year-old girl bypassing a standard 5-pin lock at a recent DefCon Hacker Convention. The girl had no prior experience and didn't even understand the theory she was applying. Scary!"
. The girl had no prior experience and didn't even understand the theory she was applying.
Sign her up as a /. editor, quick!
A feeling of having made the same mistake before: Deja Foobar
So now we have to worry about the lockpicker's equivalent of a script kiddy.
The girl had no prior experience and didn't even understand the theory she was applying.
Reminds me of high school.
The concept of security is as much about perception as effectiveness.
This article's enlightening example just drives deeper a little concept I recently heard called security theater,
Human psychology is certainly interesting - because on one hand we have people scared of box cutters, but on the other hand we drive 70mph mere feet away from each other every day.
Maybe it could be argued that security is primarily about perception.
My Computer Music Tutorial Videos
Here is a video of Key Bumping: http://www.youtube.com/watch?v=7Uv45y6vkcQ&search= bump%20key
Quite fascinating how easy it is, and in the end of the video they even show a 17-pin lock being bumped!
If you are interested in the guys in the video, here is their URL http://www.toool.nl/index-eng.php
Round and round we go.
Either way, Windows are still vulnerable.
Look. There's no reason to bring Microsoft into this.
I'm against picketing, but I don't know how to show it.
The thing that is most scary about this attack is that it leaves no trace of the crime, unlike a broken window. This means that some unfortunate people won't be able to convince their insurance company to pay up because there is no evidence of forced entry. The insurance company will try to claim that you forgot to lock your door and refuse to pay up.
I'll probably be modded down for this...
A number of systems will resist this type of attack. Probably the best is the Abloy, which I understand was bought out along with ASSA by Medeco. Alboy relies upon a sidebar; the discs need to be aligned, a sidebar drops into place, and the lock opens. I also understand there is a way to bypass this system, although the tools are pricey, resticted, and since Abloy locks are relatively rare in the United States, they remain relatively secure.
ASSA also relies upon a sidebar, with the code being cut into the side of the blank. The blanks are heavily restricted, and locksmiths have to account for all of them- even ones that are mis-cut. Of course, a sidebar can be regional, which is its biggest flaw; apparently they are more popular in Europe. If a local locksmith uses a given key profile, then it is simple enough to turn a given cut key into a "bump" key.
It would seem- although I have not tested it- that Medeco locks are immune; they require that the pins be brought to the correct height and that they be rotated (left, center, right- only three possible combinations) before the lock will open. Last I checked, it was still much easier to grind a Medeco out of existance than it was to pick it; they *can* be picked, but it takes many hours. I never liked Medeco, but since Abloy and other types of locks that offer higher security than hardware-store junk were either insanely expensive or no longer available, as their keys tend to be brittle and break right at the bow. But that's what I installed on the house; each door cost me $160 for a single-cylinder lock, but at least I know the lock is secure. Entry would have to be made in some other way than bumping or picking; further, high end locks also offer crush-resistant collars (to avoid "pipe wrench" attacks), better bolts (to prevent icepick and cutting attacks), and so forth. They just *weigh* more- it's not pot metal and good intentions in every box, unlike some makes.
True story: in the early 1990's, some genius figured out that every high-security door lock on the market could be attacked in seconds- sometimes faster than using the key- with an ice pick or a bit of wire or welding rod. Pierce the door in the right way that the tool can be used to push back part of the bolt, and you're in. Ice pick attacks were popularized, but the wave of thefts never manifested. Newer generations of bolts were issued that prevent this type of attack.
"Bumping" presents a somewhat higher threat level given that it works on more commonly available locks, which are used on probably 95-99% of homes in the United States. Given that a "Kwikset" can be bypassed with a sheet metal screw, a screwdriver, and a pair of "Vice Grips," it's a wonder more homes don't succumb to this sort of stuff every day. Fortunately (?), thieves rarely look at a home the same way we do; a good burglar or a drug addict desperate for a $20 fix will use whatever tools and techniques are handy, at great expense to society. Given that these individuals might be able to sell their gains for perhaps 10% of their value, the amount that either has to steal and re-sell to get by is quite remarkable. They don't pick locks, and they probably won't use "bump" keys.
Insurance companies (at least on the west side of the pond) haven't required proof of forced entry in decades. Burglary coverage was changed to theft eons ago.
Plus, any half-decent residential insurance policy will insure you for straight loss of contents, anyway. No need to even file a police report.
Anyone who's had a claim denied because they forgot to lock their doors really needs to shop around for better coverage, and possibly talk with a lawyer.
Note: this doesn't apply to commercial entities. If you're running a business and all you've got is an easily defeated lock to protect your interests, well...
Endless arguments over trivial contradictions in books written by ignorant savages to explain thunder in the dark.
Oh, absolutely. Auto insurance is a whole different ballgame - however the discussion seemed to revolve around breaking into your average house lock. Anti-theft systems on your average car are more than good enough to stop "bumping" these days, but I guess if you still have your 1984 K car and are worried your insurance company might not reimburse you the $500 you're out... :)
:)
Mostly I respond to posts like the GGP because it's a common insurance myth, based on what our grandparents faced. It's much like the ever-popular "Acts of God aren't covered!!!" Yes, 100 years ago proof of forced entry was required, and "Acts of God" was a legitimate exclusion clause. However, these days neither is really true. Hail, lightning, windstorm - these are all "Acts of God" that have been covered for decades. Catastrophic natural disasters aren't.
I used to be an insurance geek. So, much like 5,000 Slashdotters scream when CNN gets a tiny detail wrong about technology, I try to correct these decades-old insurance myths whenever I can. Especially when people start advocating insurance fraud
Endless arguments over trivial contradictions in books written by ignorant savages to explain thunder in the dark.
She actually had quite a bit of interest in locks. I taught her how to pick locks the day before. Matt Fiddler taught her how to bump them the day that video was taken, and Mark Weber Tobias thought it was really cool to see. She enjoyed picking way more than bumping (it's more of an intellectual challenge).
Now, she didn't seem to be that interested in the interviews (yes, there was more than one)... She wanted to get back to the locks.
What do you believe is a better place my daughter could've been that weekend? The mall?
She wasn't too happy when we mentioned getting someone to watch her for Defcon 15, so I think we all had quite a good time there.
-- The world is watching America, and America is watching TV.