Slashdot Mirror
Shrinky Dinks As a Threat To National Security
InflammatoryHeadlineGuy writes "What do Shrinky Dinks, credit cards and paperclips have in common? They can all be used to duplicate the keys to Medeco 'high-security' locks that protect the White House, the Pentagon, embassies, and many other sensitive locations. The attack was demonstrated at Defcon by Marc Weber Tobias and involves getting a picture of the key, then printing it out and cutting plastic to match — both credit cards and Shrinky Dinks plastic are recommended. The paperclip then pushes aside a slider deep in the keyway, while the plastic cut-out lifts the pins. They were able to open an example lock in about six seconds. The only solution seems to be to ensure that your security systems are layered, so that attackers are stopped by other means even if they manage to duplicate your keys."
While using credit cards and shrinky dink plastic is clever, is this story particularly surprising? The article states that a photo of the key in question is required. If I asked the average man on the street if it was possible to replicate a key from a photo of it if you were sufficiently determined, I'd imagine they would say yes.
Now what is the actual threath? Shrinky dink or easily duplicated keys?
Layered security indeed!
Maybe these locks aren't all that, but it's the Secret Service agents capping you in the head that you really have to worry about.
Silly me, I thought that men with guns protect the White House.
The interesting part is that you dont need very high quality scans or multiple images of an object to replicate the object in 3D.
You only need a fairly good image of a Medeco key and you can then cut a blank easily.
These Medeco keys are just like normal house/car keys, except they have variable slopes and spacing between peaks and troughs. Trying to cut those with normal tools would be very hard...but having a scale image to cut with an exacto knife is simple as pie.
The hardest thing about coping those Medeco keys was the difficulty in cutting the angles and the proper spacing. Now that is easy.
Open Source Intel/Security wins again.
if they are so easy to break, then the threat is the security people that choose it for so critical places.
They also had Kari wander around in a giant fluffy bird suit to get past those ultrasonic sensors, IIRC. It's not exactly practical, but it makes for great TV. I'm sure the trial of whoever tries that in DC will be equally amusing.
How are sites slashdotted when nobody reads TFAs?
It *is* the shrinky dink that matters. You can't cut a duplicate Medeco key in metal. Medeco key teeth have an angular component. They are 3 dimensional keys, whereas your usual kwikset or schlage lock are 2 dimensional.
The tumblers in a Medeco lock require some rotation to unlock, as well as vertical lift. That's why this hack is so clever - the shrinky dink or plastic can twist as you jam them into the lock and push up with the backing spline.
Until this, Medeco locks were considered to be uncrackable.
Of course you can duplicate a Medeco key in metal; Medeco keys are made of metal in the first place. Key control means you can't get the proper blanks from any legitimate source, but it's still a fairly simple hunk of metal.
Medeco locks were never considered "uncrackable". Medeco has claimed they're unpickable, but I think only the Biaxial remains unpicked. But picking is an attack that doesn't require knowledge of the key.
"I can duplicate a Medeco key blank with a piece of brass stock and a dremel tool, then cut a perfect key from a photocopy using my HPC Blitz."
So?
Joe Crook can cut a Medeco bitting key out of an old grocery store coupon card and bypass the sidebar and slider in a few seconds without any need for a key machine or any particular skill. That's what the exploit is all about.
Yeah I found it funny that the lamers in the write-up think the Pentagon is protected by Medeco locks. Sorry, no. The Pentagon is protected by men with rifles and grenades.
I'd eventually be asking for my $18 billion back.
Security professionals (and Slashdot readers) should be very familiar with two truisms: it can always be broken and it can always be copied. If you claim otherwise, you are selling something.
I know locksmith friends who can stare at a key and read the pinning combination off of it (and if they read enough of them, can deduce the master combination). For the rest of us, a key will make a great imprint on a wet bar of soap. And a locked door (just like a safe) can only ever be counted on to delay someone for a certain amount of time, never to keep them out entirely - whether they can turn the lock or not.
I don't know about Medeco 3, but one lock mechanism that was out in other countries for almost four years before making it to the US which is quite pick resistant is Abloy's PROTEC cylinder.
Trouble with those is that they're ONLY pick resistant. I can drill the face of an Abloy disc-tumbler lock, remove the sidebar, and fill the drilled hole such that no one will notice--- all in a matter of minutes. After that, the old key will still work... and so will a screwdriver. The laundry machines at the apartment I lived in years ago had Abloy PROTEC locks. I never paid for laundry, and no one ever knew the difference.
Of course, if you want the best in anti pick protection, purchase either an Abloy or Mul-T-Lock Cliq lock. It has a pick resistant mechanical key, as well as a small chip and solenoid with a challenge/response system. If someone does make a key impression, it won't help much. However, for $500 a cylinder, its pricy.
That's just electronic access control shrunk down to fit the size of standard key access components and hybridized with mechanical keys. Great if you want to retrofit existing mortise and rim lock installations, but then you're just trading labor cost for material cost. I'd personally go for a keyless prox card system before I'd field a system powered by batteries in the key. It's bad enough dealing with your average dodo trying to use normal locks. Can you imagine the service calls from those dodos who break their keys off because the battery in the key head is dead? Locksmith's dream (service call = money in your pocket), businessman's nightmare (service call = money down the rathole).
I don't understand why people fixate on "pickability". Criminals just don't pick locks. I've been a locksmith since 1995 (minus a couple years when the Army decided I should be in Afghanistan), and I have never seen a case of intrusion that wasn't either a) forced entry, or b) an inside job.
If a job's not worth doing, it's not worth doing right.
The reason why pickability (or lack therof) is important is because insurance companies will, in general, cover theft if windows are broken, doors are crowbared, or there is obvious signs of forced entry. Of course, if the person breaking in is caught, its easy to tag them with breaking and entering charges.
If a lock is picked, other than maybe some scratches, there is no evidence, so its harder to get insurance companies to cover losses if someone picks a door or padlock. Its also a lot harder to charge someone with burglary or breaking an entering if they bumped or picked a door open, then hid the tools.
Classic pinned locks are perfectly valid security devices. How about you stop pretending that a "security device" must be impenetrable to be so named? Seriously, that's like suggesting that passwords are equivalent to no security mechanism, just because some people choose bad passwords.
Even if the lock could be bypassed in 14 seconds by someone with no experience, training, or tools, it's still a valid security device. For one thing, it clearly communicates the desire to keep people out -- that alone is sufficient to turn "standing in my kitchen, uninvited" into "trespassing", not to mention the deterrence effect.
Moreover even 14 seconds spent bypassing a lock is a suspicious activity that gives my other security mechanisms time to respond -- time they would not have if there was no lock.
Finally, if I have to do any prep work like "see a copy of the key" or even "determine what type of lock is in use" that requisite preparation step adds complexity to the attack, which again, gives my other security measures time to react, and which has a deterrence effect.
OK, so the locks have a weakness. What was the point of the statement that they're used in the White House, Pentagon, etc.? You would need access to the lock and Joe Blow ain't gettin' there. Ergo, the statement attempts to create importance where there is none.
Try just walking up to any of the places mentioned in the OP. Can't be done. Layered security? T'ain't kiddin.!