Slashdot Mirror
TSA Luggage Lock Master Keys Are Compromised
An anonymous reader writes: As the FBI demand encryption master keys for Apple, Microsoft and Google made devices, photographs of the master keys for the TSA Travel Sentry suitcases have now been published in multiple places online (more links in later articles). Cory Doctorow points out this makes it much easier for thieves to open luggage undetectably, without leaving any signs of lock picking. Whilst many have argued that the locks aren't designed to provide real security, the most important thing is that this shows the risk of backdoors in security systems, especially since the TSA has not given any warning about this compromise, which seems to have occurred in 2014 or earlier.
I always assumed that these keys had been figured out long, long ago. If there's people in Afghanistan who can make you an AK-47 by hand, there must be people in China who can just not assemble the locks and take the parts to a smith (where do you think TSA locks are made?) and get a key made. I'd be surprised if you can't just buy the keys on aliexpress.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
al bundy would be a tsa screener...
seriously - is there ANY job you'd be more embarrassed to say a spouse, child (they actually BREED?!?), etc had? "hey, joe, did I see your boy in a blue shirt at o'hare the other day" "naw, man, my boy cooks meth! he's the next jesse pinkman!"
I always just "lock" my luggage with a basic zip tie. Not meant to stop the TSA from getting in, but lets me know they did.
Every time I hear a government official saying that we should trust them with secrets. I think to myself... but do I trust your 2 million other colleagues. Even in the classified space, there are going to be dozens of people with access to even the most classified information. To lesser classified information that number can be thousands or tens of thousands even. Our adversaries with any intelligence capabilities will almost certainly know a great deal more than the American public will. That doesn't mean secrets aren't important to keep. It just means if your system is relying on keeping secrets for any length of time that is a fundamental security risk and flaw in the system. With luggage you still have to have physical access to the luggage to gain access... which can be mitigated with security cameras in luggage handling areas. With software encryption for communications it is far easier to intercept without being observed.
Actually, if you travel with a firearm - and the action from a sub-$100 single shot shotgun qualifies as such - you can use real locks on your luggage, it will be inspected in front of you, and then you can properly secure it. And, the airline can't flag it as having a firearm in it...
Bonus is if the luggage doesn't make it you get to ask "You gonna call the BATFE or am I?" and stuff gets found really quick.
https://www.tsa.gov/travel/tra...
Recommended to print out the policy for whatever airline you are traveling on as well... but this works for lots of folks.
Don't blame me, I voted for Kodos
These locks or combination bypasses have three pins and just a few possible heights for each. In comparison the cheapest residential locks have five pins with five heights. If that was not easy enough there are a very limited number of combinations used and the TSA was kind enough to require a number indicating which one on every lock face. Finally these locks are of so poor quality just about anything that can apply light torsion and move in the keyway can be used to open them.
Despite popular belief lockpicking leaves very little trace at all. There are few experts available that even know what evidence looks like and just looking for evidence requires the destruction of the lock. For the curious. Don't be fooled into thinking that a lock returned to a closed state leaves signs of lockpicking that can be readily seen by a layman.
.
When I got home, I looked at the lock and the flag was still green. When I opened the suitcase, there was a sheet of paper left on top of the contents. The paper said something to the effect, "this baggage has been inspected by the TSA".
So much for the red flag on the lock.
for those of us in locksport (the art of lockpicking purely for personal enjoyment and challenge) some of these key masters are just criminally bad...the TSA probably asked for masters because they didnt want to break the lock during picking. for example
TSA004: Just a tipped ward. you neednt make a master for this, its already in pretty much everyones kit or some old womans hair serving as a bobby pin. handcuffs have better wards.
TSA003: how many pins is this? who cares, it came off a chinese assembly line and some 7 year old is setting the mechanism. a longing glance is good enough to pop this, but a master is probably an exercise in compliance more than a tool the TSA uses.
TSA001: rinse and repeat, this pin set was determined by the cost of pot-steel, not the security of someones goods.
among the winners however we have...
TSA007: nice...bidirectional pinsets (albeit just 3) will occupy most people for another 2-3 minutes before they pull out a jiggler set/rake and just bitch pick it.
TSA006: I want this. TSA006 has something very, very nice in their luggage and they take it seriously. transverse (lateral) pins, probably a trap pinset in there somewhere. and those rails along the end? what are those, guides? do i have to pick THOSE too? NEAT!
then again, the TSA Dont seriously need masters because theyve been using the ballpoint zipper trick for decades now. its traceless, harmless, and quick. demanding masters seems like a power trip designed to test the limits of what consumers and manufacturers were willing to actually tolerate.
Good people go to bed earlier.
Declaring a firearm in your luggage has always gotten me first-class VIP treatment.
The last time the counter agent closed the line behind me so she could get her supervisor to make sure everything was handled correctly (and probably to keep the people behind me from flipping out, they want to SEE the firearm).
Then they usually walk me over to TSA where my bags are hand-inspected by the TSA before letting me apply my own, high-quality locks to my bag. I'd swear its saved line-standing time.
The only marginal experience was in Laughlin/Bullhead City, which is barely an airport.
There the gate agent wanted some county sheriff to verify the weapons were unloaded. Since I don't want to make anything easy for a thief, I use trigger locks AND cable lock through the action and/or cylinder, yet Deputy Fife wanted to try to open the cylinder on my revolver AND work the action on my Glock, despite the fact the loading or firing of the guns would have been physically impossible. I actually had to say "Careful, I don't want the action damaged from the locking cables!" before he realized how stupid he was.
Then I had to argue with the TSA agent who didn't want to let me lock my luggage with a secure lock. Fortunately I also carry a recent, laminated copy of the TSA web pages requiring secure locking of checked firearms. "You can't use your own lock." "Yes, I have to, it's your own TSA requirement. Read this." He was pissed, but less pissed than he would have been telling his future colleagues on the Laughlin casino janitorial squad about his past job as a TSA agent.
Strangely the Vegas airport seemed less interested in hand-inspecting my gun case and just ran it through the machine. I told the agent "Those firearms will glow like Christmas on the screen" and the TSA guy said "If we had to hand inspect all firearm luggage at this airport, the lines would extend into the parking lot."
The craziest experience of all traveling with a firearm was trying to check into the Venetian in Vegas. I wanted to check my weapon with security and asked the woman at the desk and she said "Oh, security is just across the casino floor." I wondered how far I would get across the casino floor with a locked aluminum case without being tackled or answering questions from Clark County Sheriffs. As it turns out, I made it with five feet of the entrance before being stopped by two armed guards. They were really nice and took my down to security, checked my weapon, gave me a receipt and let me ride the VIP elevator to my room. On check out, the head of security released my weapon and I asked him if I had broken any laws bringing it on property. He said it wasn't a problem at all, happens all the time but was concerned the check in desk wouldn't page security for me. I thought the armed escort to my cab was a bit much, but again, VIP treatment!