Slashdot Mirror
MIT Students Release Code To 3D-Print High Security Keys
Sparrowvsrevolution writes "At the Def Con hacker conference Saturday, MIT students David Lawrence and Eric Van Albert released a piece of code that will allow anyone to create a 3D-printable software model of any Schlage Primus key, despite Schlage's attempts to prevent the duplication of the restricted keys. With just a flatbed scanner and their software tool, they were able to produce precise models of Primus keys that they uploaded to the 3D-printing services Shapeways and i.Materialise, who mailed them working copies of the keys in materials ranging from nylon to titanium. Primus high-security locks are used in government facilities, healthcare settings, and detention centers, and their keys are coded with two distinct sets of teeth, one on top and one on the side. That, along with a message that reads 'do not duplicate' printed on the top of every key, has made them difficult to copy by normal means. With Lawrence and Van Albert's software, anyone can now scan or take a long-distance photo of any Primus key and recreate it for as little as $5."
Until somebody offends the G8. Vladimir Putin subsequently has him bound to a rock, where each day an eagle is sent to feed on his liver, which is re-printed and re-installed each day, almost like an old Windows version. .is bound to the same rock, and subjected to Barack Obama speeches in an infinite loop.
OR
. .
Unclear which is worse.
Get thee glass eyes, and, like a scurvy politician, seem to see things thou dost not.--King Lear
Really? That makes them difficult to duplicate? On which planet?
I'd hardly call any industry that uses a physical key "high security" in an age of individually-revokable key card technologies.
How secure can a facility be when the loss of one key means that everyone's keys have to be replaced in order to recode the lock?
I do not fail; I succeed at finding out what does not work.
I don't think so. A long distance photo is not going to give enough detail. You'll need a high resolution photo of the key.
Make the keys so that there are sheaths around them, which can bend away on a spring when you need to use the key, or the key can come out of the end of the sheath. Or some other way to hide the tooth pattern when the key isn't being used.
Technoli
Locks don't make secure doors, doors do. If you wish to enter, the type of lock on the door is not going to deter you. Electronic locks are not more or less secure, it is just a different set of crooks that are able to get through them without leaving traces.
... whatever
Former locksmith here. The Primus (and nearly all of the other high security keys) are simply relying on patent protection to keep people from duplicating the keys. Any locksmith worth his/her salt already has key machines that could reproduce them onto a chunk of brass (worst case) or just onto a normal key blank.
If you want to see something that would impress me, look at a German company - DOM - that has a design that includes a floating ball bearing in the key, which is integral to making the lock work. If they could make THAT with a printer, I'd be impressed.
One model:
http://www.dom-sicherheitstechnik.com/DOM-ix-Saturn.667.0.html
For us carnivores, "Sucking the marrow out of life" isn't a transcendentalist philosophy but a practical instruction.
have 24 hour surveillance and use "man traps" which require multiple access keys, electronic or otherwise.
No, no, you're not thinking; you're just being logical. --Niels Bohr
what the lock companies do is they patent the blanks.
that's why lock companies come up with a new scheme every so often. and to buy those blanks you need to sign a contract that you wont copy without permission of the lock owner.. which is hard to check anyways.
world was created 5 seconds before this post as it is.
Not true. I used to work security in a building that had a lot of electronic locks. And ultimately, you can't enter them without leaving a trace. Sure, they might not know who it is that entered at 2:26 AM, but we would know that somebody entered at that time. Whereas with regular keys, we would at most know that somebody went to that floor around that time, but we'd have no clue as to which door they went into.
In other words, we could probably get video footage of the person that went into the door secured by an electronic lock, or at least narrow it down substantially, but would have no way of doing that with a traditional lock as we would have to have video of them getting into the elevator, not at the actual door.
What's more, with electronic locks, there's the ability to lock people out during periods of the day that you can't do with a traditional lock and you can change the key much more rapidly.
Yes, they aren't perfect and can be prone to attacks that a normal lock and key aren't. But, ultimately, suggesting that they're not any sort of improvement ignores reality.
A lock will only ever serve to keep an honest man honest.
I my jurisdiction it is (or was, a decade ago) against the law* for a locksmith to copy keys that are both marked "do not duplicate" and which used blanks available only to locksmiths required the locksmith to go through paperwork to make sure the person requesting the copy was authorized by the lock-owner to do so. This typically involved asking the requester to provide the lock's "number" which presumably the lock owner had but which was not on the key or lock itself.
Up until recent decades, one of the more practical ways to duplicate many security keys was to make a mold and build a key from it, like you saw in 1960s spy movies. Yes, that required physical possession, but it didn't require a locksmith.
--
*I'm not sure if the law has any real teeth, it may be just a "civil fine" or it may just open up the locksmith to civil liability if the key is misused, much like if a bartender serves a drunk person more booze and they drive and kill someone, the bartender can be sued by the victim's family.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Can some explain to me why the only stories about 3D printing that make the news are ridiculously paranoid? Anyone can print out a secret key. Anyone can print out shitty plastic gun. What's next? Anyone can print out a bat'leth? Anyone can print out a plastic pressure cooker and make a plastic bomb? Anyone can print out plastic kiddie porn? Not one story discussing the incredible potential? Like, machines printing out copies of itself? Or the effects on a society and economy where any product can be downloaded and printed? None of that interesting stuff? Just the fear and paranoia stuff?
> printable keys, presumably with lookup tables
Stewie: (gets tired look on his face). Oh, here we go.
(-1: Post disagrees with my already-settled worldview) is not a valid mod option.
In some buildings the electronic system is for that office only and the building maintenance people have the keys for the traditional locks also traditional locks are needed when power fails or the electronic system fails. Also in some buildings when the fire alarm goes off the electronic doors unlock.
Some buildings make so that only the building maintenance people can change light blubs.
I for one would like to know when i can 3d print a buggy whip.
Huh?
I'm not sure about firemen's keys, but firemen have other ways of getting through a locked door: battering rams, axes, chain saws, diamond disks and saws. Much like criminals - if they want to get into a locked house bad enough they will get in.
In a time of universal deceit, telling the truth is a revolutionary act. George Orwell
Idiots have been saying that since before electricity was discovered.
....I do not think Les Claypool appreciates this.
I mean, there was nothing in the key which looked that difficult to duplicate, contrary to those key as you showed. Or even the round key , which have pins on all direction , not only 2 axis but on 8 axis or more (I dunno if you know what type I mean, when you look along the axis they look like a star with 8 ray and along the axis the pins at at random position and random angle). I never found a locksmith which had the way to duplicate those despite wanting a second set of key. (maybe I should have asked a crook ;)).
C. Sagan : A demon haunted world:
http://www.amazon.com/gp/product/0345409469/
visit randi.org
The electronic locks around here are powered by battery as well as mains.
After the 12 hours (or so) of battery wears out, it depends on the lock type - the electric strike locks are fail-closed (bypassable by mechanical key), the magnetic locks are fail-open.
allstate farmers and Nationwide all like buildings to have a way for Firemen to not break the door down just to do their job.
Any person using FTFY or editing my postings agrees to a US$50.00 charge
Electronic locks... now the NSA will have a backdoor into your door.
So, having read the fine article, where is the code? I didn't see any links to github or similar...
In USA, you 3d print a custom key after months of work. In Soviet Russia, you just use a sledge hammer.
stuff |
Everything is 20/20 in hindsight.
Like? more like require, at least if you want their insurance.
Sorry, teleporters just kill you and then make a copy. A perfect, soul-less copy.
Why would they do this?
Why not? Why does anyone do anything?
Is there some cure to cancer behind a locked door that they think needs to be free? Perhaps some long lost formula for turning water into gas?
The answer is "no" in both cases.
None of the reasons always offered up to justify breaking encryption applies here. How is it that civilization is made better by this?
That's a really stupid comment IMNSHO because the reasons are exactly the same. They have highlighted a security flaw: one that could already be in use by nefarious sorts. Now, as always in these cases, people can choose to protect against it. That is always the reason for breaking encryption.
And one for question for you: why do you judge what others do with their time so readily? Why must everything be a "cure for cancer" or something like that. I doube everything you do is so worthwhile.
SJW n. One who posts facts.
"If you have a blank" is a very big IF for the types of keys they are talking about. Wal-Mart doesn't sell sidecut blanks. Only locksmiths trust registered with the manufacturer can buy them.
99% of locks use the common keyways for which you can get generic key blanks. Those also have no effective key control - anyone can get copies made. In a high security environment you use high security locks with key control. The locksmiths who have access to the patented blanks will only duplicate a key after confirming with the registered contact person.
No security is perfect, but this system is alot more secure than just going to Wal-Mart. I worked as a locksmith for a little while. I've cut keys by hand. I can't do that with my office key. ( I work at a security aware agency). Being able to 3D print a key, or a blank, would be handy for me so I don't have to tell the security person that I lost my key AGAIN.
cracked the article is referring to restricted blanks. not available at Walmart or Home Depot. Those stores also do not have the special key cutting machine required to cut into the side of the key.
You don't have to replace all the keys.
If you're concerned, you replace one pin stack in xhe locks that key opens. You don't issue everyone identical keys. My key opens my office and the back door, only. The back door lock has a stack of pins that work as a bitmask, so many keys can open it and you can add or remove keys without necessarily affecting the others.
In re systems that use physical keys - key cards and key fobs are physical keys too. Key cards store their bit pattern in iron powder. "Regular" keys store their bit pattern in brass. There's no fundamental difference in security.
Not as convenient, but it's not as if this is new. I have easy access to a CNC mill. Pretty sure I can make any key that a key cutter can create, given the original (or very good pictures with something for size reference) and a small chunk of billet.
Just another ignorant American.
there is no place to hide. Not even in the toilet.
If this is a security flaw then so is a pair of bolt cutters.
Um yeah? If a seriously secure facility is vulnerable to bolt cutters then bolt cutters are indeed a security flaw.
And what I do is far more worth while then enabling yet a larger set of individuals to break into secure facilities.
Oh don't you pull the bait and switch on me sonny boy. You know very well that the original compairson was to "curing cancer". I very much doubt you do anything as worthy as "finding a cure to cancer". That's your measure of worth. Not mine.
This whole idea that if you find a vulnerability, you should publish it, is complete bullshit pushed by childish morons with a very warped sense of morality.
Classic invective as expeced from one who lacks a logical argument.
If you go back and read the thread there was at least one poster, modded +5 insightful no less who having not RTFA doubted that keys would be vulnerable to long range snooping. TFA proved him wrong. So clearly there are people with misconceptions who are could actually informed by such an article.
Your attitude does exactly what it claims the article does: by suppressing information on vulnerabilities, you leave the security flaws wide open for well informed criminals to exploit. Apparently criminals have few qualms about sharing "trade secrets", so your method ensures that only the criminals are well informed.
SJW n. One who posts facts.
One can get the same audit trail with dry-contact or magnetic sensors. If done well, no one will ever notice they're there.
By revealing security flaws you expose what might have been concealed or even unnoticed.
And crimes are not all committed by well informed criminals exclusively. In fact, crimes of opportunity are most prevalent. So your attitude just makes it all the more likely that someone gets their hands on something they normally wouldn't have thought of getting in the first place or wouldn't have gone to the extra effort.
Hey everyone! Serviscope sets his gate's combination lock to 777. Go steal something from him so he knows his backyard is vulnerable!
When Fascism comes to America, it will call itself Anti-Fascism, and tell you to give up your guns.
Not true. I used to work security in a building that had a lot of electronic locks. And ultimately, you can't enter them without leaving a trace. Sure, they might not know who it is that entered at 2:26 AM, but we would know that somebody entered at that time. Whereas with regular keys, we would at most know that somebody went to that floor around that time, but we'd have no clue as to which door they went into.
In other words, we could probably get video footage of the person that went into the door secured by an electronic lock, or at least narrow it down substantially, but would have no way of doing that with a traditional lock as we would have to have video of them getting into the elevator, not at the actual door.
What's more, with electronic locks, there's the ability to lock people out during periods of the day that you can't do with a traditional lock and you can change the key much more rapidly.
Yes, they aren't perfect and can be prone to attacks that a normal lock and key aren't. But, ultimately, suggesting that they're not any sort of improvement ignores reality.
So, we can spend millions to develop a way to use electronic keys, but no one has ever figured out a way to sync a series of videos so you can watch someone move from one zone to another?
Sure I'm paranoid, but am I paranoid enough?
And crimes are not all committed by well informed criminals exclusively. In fact, crimes of opportunity are most prevalent.
And you think that the opportunistig criminals are going to buy a telescope and SLR mount, sniper spot some keys on a table, write some computer vision software to rectify the image and extract the cut, 3D print or CNC mill a new key then break in?
Serviscope sets his gate's combination lock to 777
Well, most people believe those licks to be substantially more secure than they really are. I used to do a lot of lab supervision where there were long gaps between being asked a question. I used to break the codes on the locks for the computers and monitors.
Turns out that someone utterly inskilled (me) could usually break one of those in under 10 minutes.
Most people figure they can be brute forced, but if asked believe it would take an hour or two. Tell them it's less than 10 minutes and they go buy another lock, not as you think, start stealing stuff from other people.
SJW n. One who posts facts.
At some point it will require a license to purchase and own machine tools too.
---- Booth was a patriot ----