Slashdot Mirror
TSA Luggage Lock Master Keys Are Compromised
An anonymous reader writes: As the FBI demand encryption master keys for Apple, Microsoft and Google made devices, photographs of the master keys for the TSA Travel Sentry suitcases have now been published in multiple places online (more links in later articles). Cory Doctorow points out this makes it much easier for thieves to open luggage undetectably, without leaving any signs of lock picking. Whilst many have argued that the locks aren't designed to provide real security, the most important thing is that this shows the risk of backdoors in security systems, especially since the TSA has not given any warning about this compromise, which seems to have occurred in 2014 or earlier.
I always assumed that these keys had been figured out long, long ago. If there's people in Afghanistan who can make you an AK-47 by hand, there must be people in China who can just not assemble the locks and take the parts to a smith (where do you think TSA locks are made?) and get a key made. I'd be surprised if you can't just buy the keys on aliexpress.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
al bundy would be a tsa screener...
seriously - is there ANY job you'd be more embarrassed to say a spouse, child (they actually BREED?!?), etc had? "hey, joe, did I see your boy in a blue shirt at o'hare the other day" "naw, man, my boy cooks meth! he's the next jesse pinkman!"
I always just "lock" my luggage with a basic zip tie. Not meant to stop the TSA from getting in, but lets me know they did.
So this was kind of inevitable with a master key.
Now we have the choice between having our luggage effectively vandalized as the morons at TSA cut off locks ... or having massively insecure locks to prevent the morons at the TSA from cutting off the locks.
Thanks a lot, assholes.
And, now, tell us ... just how much scrutiny are the luggage handlers under while they work? Because between the opportunity for smuggling (which they've done) those guys have a better chance of putting a bomb on a plane than anybody else.
So much security theater, so little actual benefit.
Lost at C:>. Found at C.
since 2003, i've shipped what i don't carry on. so far, so good.
Every time I hear a government official saying that we should trust them with secrets. I think to myself... but do I trust your 2 million other colleagues. Even in the classified space, there are going to be dozens of people with access to even the most classified information. To lesser classified information that number can be thousands or tens of thousands even. Our adversaries with any intelligence capabilities will almost certainly know a great deal more than the American public will. That doesn't mean secrets aren't important to keep. It just means if your system is relying on keeping secrets for any length of time that is a fundamental security risk and flaw in the system. With luggage you still have to have physical access to the luggage to gain access... which can be mitigated with security cameras in luggage handling areas. With software encryption for communications it is far easier to intercept without being observed.
I didn't know it's hard to pick a lock without leaving evidence of lock-picking.....what kind of evidence are they looking for? Scratch-marks on the pins?
"First they came for the slanderers and i said nothing."
FedEx's and the airline's shareholders thank you for their increased profit. However this is not a viable option for many people.
Also, it's not as if FedEx is much better than the airlines. Personally, I have had more problems with FedEx than with the airlines.
These locks or combination bypasses have three pins and just a few possible heights for each. In comparison the cheapest residential locks have five pins with five heights. If that was not easy enough there are a very limited number of combinations used and the TSA was kind enough to require a number indicating which one on every lock face. Finally these locks are of so poor quality just about anything that can apply light torsion and move in the keyway can be used to open them.
Despite popular belief lockpicking leaves very little trace at all. There are few experts available that even know what evidence looks like and just looking for evidence requires the destruction of the lock. For the curious. Don't be fooled into thinking that a lock returned to a closed state leaves signs of lockpicking that can be readily seen by a layman.
never put anything valuable in checked in luggage.
I have one of the old "non-TSA" locks on my suitcase. I have a label on it where it states "code is 0000 while in transit", since I want to set the code wheels to something else in order to avoid accidental openings.
I'd never dream of going on a flight with something of real value to me anywhere but in my carry on. If they want to steal my socks or razor, they're welcome to them.
.
When I got home, I looked at the lock and the flag was still green. When I opened the suitcase, there was a sheet of paper left on top of the contents. The paper said something to the effect, "this baggage has been inspected by the TSA".
So much for the red flag on the lock.
Of course they are compromised and this is by design. Why else would you purchase a combination lock with a master key?
The only reason I use these locks is because too many suitcases and travel bags are prone to opening when handled by the airline's gorillas that toss your baggage around. The locks can serve as one more item that needs to fail before the contents of your baggage cascades around the luggage carousel.
However, if the TSA thinks that the master key system was secure, why didn't they mention the breach earlier. All agencies have policies on handling sensitive information. If the TSA does not follow their own policies, they should be held accountable at the highest levels.
There are good locks and bad locks. Most luggage locks are cheap crap, afterall an attacker can simply split the zip. TSA compliant locks are the worst of the bad locks because its so trivial to break in and leave no trace.
It means, even if you put a good lock on it, its no guarantee your luggage hasn't been tampered with, and you should have a good look at the contents before you walk through customs with it. Zip-Tie man below is probably right, its better to use a market zip-tie rather than a lock now.
You can't trust the lock manufacturers to make good locks when an agency has undermined the whole purpose of a lock.
What next, backdoors in Cisco products? backdoors in HP Storage Servers? Backdoors in IP cameras?.... Oh right, we had those already.
for those of us in locksport (the art of lockpicking purely for personal enjoyment and challenge) some of these key masters are just criminally bad...the TSA probably asked for masters because they didnt want to break the lock during picking. for example
TSA004: Just a tipped ward. you neednt make a master for this, its already in pretty much everyones kit or some old womans hair serving as a bobby pin. handcuffs have better wards.
TSA003: how many pins is this? who cares, it came off a chinese assembly line and some 7 year old is setting the mechanism. a longing glance is good enough to pop this, but a master is probably an exercise in compliance more than a tool the TSA uses.
TSA001: rinse and repeat, this pin set was determined by the cost of pot-steel, not the security of someones goods.
among the winners however we have...
TSA007: nice...bidirectional pinsets (albeit just 3) will occupy most people for another 2-3 minutes before they pull out a jiggler set/rake and just bitch pick it.
TSA006: I want this. TSA006 has something very, very nice in their luggage and they take it seriously. transverse (lateral) pins, probably a trap pinset in there somewhere. and those rails along the end? what are those, guides? do i have to pick THOSE too? NEAT!
then again, the TSA Dont seriously need masters because theyve been using the ballpoint zipper trick for decades now. its traceless, harmless, and quick. demanding masters seems like a power trip designed to test the limits of what consumers and manufacturers were willing to actually tolerate.
Good people go to bed earlier.
I don't understand what the big deal is, considering that the failure point is not the lock, but the zipper itself. Zippers are a fastening device. They were never intended to be secure, and you cannot make one secure by attaching a lock on the pull. The problem is that people think that attaching a lock to anything makes it inherently more secure.
The answer is to never put anything in your luggage that has any value to those who might want to steal it. No electronic devices or jewelry should go in checked luggage. Anything valuable must fit in your carry-on. If you *must* travel with something valuable that cannot fit in your carry-on, ship and insure the parcel ahead of time.
It's pretty much the definition of "master key" that if a master key exists for your lock, then your lock is compromised.
How much of a problem that is in practice depends on a whole whack of risk factors, but in order to make the TSA screening process any riskier, I think you'd have to outsource it to the prison system.
Log in or piss off.
To be fair, I don't think we can really blame them for not warning us about the leaks. I mean, this is the TSA we're talking about--they probably still don't know about them.
When someone says, "Any fool can see
We really do need to take a page from Israel and the methods they use.
So dump all your carry on shit out on the table, look it over for banned items, then shove it all back in your bag, and do it to everyone.
The last I was over there they had you hold on to your checked luggage for as long as possible. Also there are various stages where various people quickly question you to see if you get nervous or have suspect answers. You only send your bag through the X-Ray machine right before you go through the metal detectors your self and if they do have a question about your bag they would make you take it over to some secondary screeners who make you open your bag dig the item out in question and then they question you about it. In my case it was my old Spotmatic F and lenses. They fired off a bunch of questions to try and trip you up like:
What is in the middle of your bag?
How long have you had the camera?
Did you get the camera from anyone in Israel?
Where did you get the camera?
Do they really take better pictures than a digital?
Also when going through Israeli security they don't have the huge lines of people that the TSA is great at generating. Also all they use are metal detectors and don't make you take your shoes off even if you are wearing safety toe footwear, but in that case they will have you go and step onto a foot X-ray machine for a quick check after the metal detector. Also the Israelis like to say the don't profile but instead reverse profile. That is if you don't fit the profile then you get extra screening.
Time to offend someone