Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!


Forgot your password?

AT&T Identifies Widespread Security Hole - In Locks 498

__roo writes "The New York Times has an article [free registration required] about a researcher at AT&T Labs Research who has discovered a little-known vulnerability in many locks that lets a person create a copy of the master key for an entire building by starting with any key from that building, and it requires little more than a file and a few key blanks."
This discussion has been archived. No new comments can be posted.

AT&T Identifies Widespread Security Hole - In Locks

Comments Filter:
  • by mrpuffypants ( 444598 ) <mrpuffypants&gmail,com> on Thursday January 23, 2003 @08:51AM (#5142301)
    so now Master is going to have to release patches and hotfixes?

    "Hey steve, check out my new lock!"

    "pffft, is it v.3.21.7?"


    "that's like an invite for key kiddies and 1337 crackers"
    • by HermDog ( 24570 ) on Thursday January 23, 2003 @09:17AM (#5142397)
      I must have missed the CERT advisory. Which Linux distros are affected? OpenBSD, of course, is not vulnerable as long as you use the default installation inside the welded safe.
  • here... (Score:4, Informative)

    by REBloomfield ( 550182 ) on Thursday January 23, 2003 @08:52AM (#5142304)
    For those that don't want to register, here's the full text:

    Master Key Copying Revealed

    A security researcher has revealed a little-known vulnerability in many locks that lets a person create a copy of the master key for an entire building by starting with any key from that building.

    The researcher, Matt Blaze of AT&T Labs-Research, found the vulnerability by applying his area of expertise -- the security flaws that allow hackers to break into computer networks -- to the real-world locks and keys that have been used for more than a century in office buildings, college campuses and some residential complexes.


    The attack described by Mr. Blaze, which is known by some locksmiths, leaves no evidence of tampering. It can be used without resorting to removing the lock and taking it apart or other suspicious behavior that can give away ordinary lock pickers.

    All that is needed, Mr. Blaze wrote, is access to a key and to the lock that it opens, as well as a small number of uncut key blanks and a tool to cut them to the proper shape. No special skills or tools are required; key-cutting machines costing hundreds of dollars apiece make the task easier, but the same results can be achieved with a simple metal file.

    After testing the technique repeatedly against the hardware from major lock companies, Mr. Blaze wrote, "it required only a few minutes to carry out, even when using a file to cut the keys."

    AT&T decided that the risk of abuse of the information was great, so it has taken the unusual step of posting an alert to law enforcement agencies nationwide. The alert describes the technique and the possible defenses against it, though the company warns that no simple solution exists.

    The paper, which Mr. Blaze has submitted for publication in a computer security journal, has troubled security experts who have seen it. Marc Weber Tobias, a locks expert who works as a security consultant to law enforcement agencies, said he was rewriting his police guide to locks and lock-picking because of the paper. He said the technique could open doors worldwide for criminals and terrorists. "I view the problem as pretty serious," he said, adding that the technique was so simple, "an idiot could do it."

    The technique is not news to locksmiths, said Lloyd Seliber, the head instructor of master-key classes for Schlage, a lock company that is part of Ingersoll-Rand. He said he even taught the technique, which he calls decoding, in his training program for locksmiths.

    "This has been true for 150 years," Mr. Seliber said.

    Variations on the decoding technique have also been mentioned in passing in locksmith trade journals, but usually as a way for locksmiths to replace a lost master key and not as a security risk.

    When told that Mr. Seliber taught the technique to his students, Mr. Tobias said: "He may teach it, but it's new in the security industry. Security managers don't know about it."

    In the paper, Mr. Blaze applies the principles of cryptanalysis, ordinarily used to break secret codes, to the analysis of mechanical lock designs. He describes a logical, deductive approach to learning the shape of a master key by building on clues provided by the key in hand -- an approach that cryptanalysts call an oracle attack. The technique narrows the number of tries that would be necessary to discover a master-key configuration to only dozens of attempts, not the thousands of blind tries that would otherwise be necessary.

    The research paper might seem an odd choice of topics for a computer scientist, but Mr. Blaze noted that in his role as a security researcher for AT&T Labs, he examined issues that went to the heart of business security wherever they arose, whether in the digital world or the world of steel and brass.

    Since publishing Mr. Blaze's technique could lead to an increase in thefts and other crimes, it presented an ethical quandary for him and for AT&T Labs -- the kind of quandary that must also be confronted whenever new security holes are discovered in computing.

    "There's no way to warn the good guys without also alerting the bad guys," Mr. Blaze said. "If there were, then it would be much simpler -- we would just tell the good guys."

    Publishing a paper about vulnerable locks, however, presented greater challenges than a paper on computer flaws.
    The Internet makes getting the word out to those who manage computer networks easy, and fixing a computer vulnerability is often as simple as downloading a software patch. Getting word out to the larger, more amorphous world of security officers and locksmiths is a more daunting task, and for the most part, locks must be changed mechanically, one by one.


    But Mr. Blaze said the issue of whether to release information about a serious vulnerability almost inevitably came down to a decision in favor of publication.

    "The real problem is there's no way of knowing whether the bad guys know about an attack," he said, so publication "puts the good guys and the bad guys on equal footing."

    In this case, the information appears to have made its way already to the computer underground. The AT&T alert to law enforcement officials said that a prepublication version of the paper distributed privately by Mr. Blaze for review last fall had been leaked onto the Internet, though it has not been widely circulated.

    "At this point we believe that it is no longer possible to keep the vulnerability secret and that more good than harm would now be done by warning the wider community," the company wrote.

    There is evidence that others have chanced upon other versions of the technique over the years. Though it does not appear in resources like "The M.I.T. Guide to Lockpicking," a popular text available on the Internet, Mr. Blaze said, "several of the people I've described this to over the past few months brightened up and said they had come on part of this to make a master key to their college dorm."

    Mr. Blaze acknowledged that he was only the first to publish a detailed look at the security flaw and the technique for exploiting it.

    "I don't think I'm the first person to discover this attack, but I do think I'm the first person to work out all the details and write it down," he said. "Burglars are interested in committing burglary, not in publishing results or warning people."

    Mr. Tobias, the author of "Locks, Safes and Security: An International Police Reference," said that the technique was most likely to be used by an insider -- someone with ready access to a key and a lock. But it could also be used, he said, by an outsider who simply went into a building and borrowed the key to a restroom.

    He said he had tested Mr. Blaze's technique the way that he tests many of the techniques described in his book: he gave instructions and materials to a 15-year-old in his South Dakota town to try out. The teenager successfully made a master key.

    In the alert, AT&T warned, "Unfortunately, at this time there is no simple or completely effective countermeasure that prevents exploitation of this vulnerability, short of replacing a master-keyed system with a nonmastered one."

    The letter added, "Residential facilities and safety-critical or high-value environments are strongly urged to consider whether the risks of master keying outweigh the convenience benefits in light of this new vulnerability."

    Other defenses could make it harder to create master keys.

    Mr. Blaze said that owners of master-key systems could move to the less popular master-ring system, which allows a master key to operate the tumblers in a way that is not related to the individual keys. But that system has problems of its own, security experts say.

    Mr. Blaze suggested that creating a fake master key could also be made more difficult by using locks for which key blanks are difficult to get, though even those blanks can be bought in many hardware stores and through the Internet.

    But few institutions want to spend the money for robust security, said Mr. Seliber of Schlage. His company recommends to architects and builders that they take steps like those recommended by Mr. Blaze, measures that make it more difficult to cut extra keys -- like using systems that are protected by patents because their key blanks are somewhat harder to buy, Mr. Seliber said. Even though such measures would add only 1 to 2 percent to the cost of each door, builders were often told to take a cheaper route. He said that they were told, " `We're not worried about ninjas rappelling in from the roof stuff -- take it easy.' "

    That is not news to Mr. Blaze, who said it was also a familiar refrain in the world of computer security. "As any computer security person knows," he said, "in a battle between convenience and security, convenience has a way of winning."

    • Is this a joke? (Score:3, Informative)

      by Isle ( 95215 )
      Everybody knows that. It's the way master-keys systems works, you take of pieces until you have the most generic key, the most generic keys needs inherently to be the smallest and thus the least safe.

      Not that it can't be news and research for security people, but I can't see how this can "make it easier for buglers and terrorists", anyone in the business or anyone thinking about it for a few minutes knows thats how it works and have always worked, and how it has to work if you really wants a master key system.
      • Re:Is this a joke? (Score:3, Insightful)

        by jonadab ( 583620 )
        > Everybody knows that.

        Indeed. I knew it when I was ten, and I'd never even met an actual

        The solution is equally simple: if security actually matters, you
        sacrifice the convenience of having a single master key and install
        locks that use a completely different key in the places that matter.
        Your "master key" is then a whole ring of keys, but hey.

        Next they'll start talking about how the social engineering technique
        used by computer crackers can be used in the real world too...
        just phone up the front desk and ask 'em to unlock the side door
        and let in the plumber...
      • I don't think this was a joke. I think the two pointst that the article really made was that this is the first comprehensive analysis of the problem and that it provides a formula for building a master key without disassembling the lock. Anyone given enough time and an actual lock to work with can certainly make a master key. The article indicated that using this approach it was not necessary to dissasemble the lock and that the number of iterations needed to arrive at a solution has been reduced when compared to a brute force attack. The article indicated that the attack has been executed by others but that this is the first formal analysis of the vulnerability.
      • Re:Is this a joke? (Score:5, Insightful)

        by raddan ( 519638 ) on Thursday January 23, 2003 @11:38AM (#5143202)
        It's a big deal because regular people, people that trust the system, *don't* know about it. I didn't know about it, and though I knew locks could be picked, I didn't know that they could be circumvented so easily.

        Sure, locksmiths knew this. A good sysadmin also knows the weaknesses in their systems. But as a user of both locks and ecommerce, I blindly put my trust in those systems in part because I *don't* know their weaknesses!

        How many sysadmins know that the door to their server closet can be opened by an employee with a regular key?

        It's like with PGP: what can you trust? Regular people know now that you cannot trust master-key systems.
        • Re:Is this a joke? (Score:3, Insightful)

          by SamHill ( 9044 )

          How many sysadmins know that the door to their server closet can be opened by an employee with a regular key?

          How many sysadmins keep trying to convince their bosses that security is important, only to discover that the custodial staff routinely pops in the server room to empty the trash?

          Sadly, not everyone understands that security is an issue.

      • Re:Is this a joke? (Score:5, Informative)

        by BlueWonder ( 130989 ) on Thursday January 23, 2003 @11:50AM (#5143266)
        It's the way master-keys systems works, you take of pieces until you have the most generic key, the most generic keys needs inherently to be the smallest and thus the least safe.

        The master key is usually the largest, [lysator.liu.se] not the smallest, so that people cannot file down their keys to master keys.

  • by elodan ( 601886 ) on Thursday January 23, 2003 @08:53AM (#5142309) Homepage
    • by goombah99 ( 560566 ) on Thursday January 23, 2003 @09:44AM (#5142534)
      Cryptographer Matt Blaze [crypto.com](of AT&T),previously known for cracking the backdoor of the vaunted 'clipper chip' has submitted a publication [crypto.com] to the IEEE journal "Security and Privacy" which demonstates that given an ordinary building key (like your office key or one borrowed for the rest room) you can get 'root' access to the entire building (i.e. a master key) with no more that about 30 guesses and $2.00 at the hardware store, and typically much less than that.

      The crack works on virtually all locks and was inpsired by parallels to cryptographic analysis, reducing the search from exponential to linear, and exploiting 'key" generation weaknesses. Virtually all master-key locks are vulnerable.

      There is also a story [nytimes.com] on the front page of the nytimes covering police verification of the threat including giving the instructions to a 15 year old.

      • HOW TO DO IT (Score:5, Informative)

        by goombah99 ( 560566 ) on Thursday January 23, 2003 @10:06AM (#5142666)
        Here's the method in a nutshell.

        1) get a normal key that opens a lock.

        2)count the notches, if its a 5 pin tumbler, then buy 6 more blank keys. ($2.00)

        3) cut 5 keys to be identical to the original except at one of the pin position, let it be full height. SO that you now have 5 keys each with a full height blank at a different pin postion.

        3.b) reducing the complexity. it's not physically possible to have a full height position adjacent to a deeply cut position. No problem, just cut it as high a possible, the master key suffers the same limits too, and this reduces the complexity of the pattern.

        4) insert the first key. does it turn? No then file off 0.010" of metal and try again. within 7 tries, usually only one or 2 it will turn. congatulation you now know the pin 1 master height.(duh: ignore the turning at the original height.)

        5) insert key2, rinse, lather repeat.
        the beauty of this crack twofold. first, you are discovering the master heights of each pin independently, so the combinatorics is just linear in the number of resolvable pin heights not the product of pin-positions times pin heights. Second, you are also simultaneously factoring the ordinary key out of the master key combination, thus only discovering the master key not some useless key that is part paster and part ordinary key (that would only owrk on that particular lock).

        6) Exception: if you cannot find the a pin height that opens one of the tumblers (ignoring the obvious one for the original key) then the original key height is the one for the master too.

        • Re:HOW TO DO IT (Score:3, Insightful)

          by parkrrrr ( 30782 )
          3.b) reducing the complexity. it's not physically possible to have a full height position adjacent to a deeply cut position. No problem, just cut it as high a possible, the master key suffers the same limits too, and this reduces the complexity of the pattern.

          The master key does not necessarily suffer the same limits. Consider a lock where your key has a (trivial) code of 11111 (minimal cuts) and the master key has a code of 99999 (all cut to the maximum depth; I'm using Schlage codes here, just because the only key I have handy with a code stamped on it happens to be a Schlage.) In that case, none of your test keys will open the door because they will all have a 9 next to a 1 and wouldn't fit into the lock (or worse, would stick in the lock and not come back out) but neither the individual key nor the master key will have any large transitions (in fact, they won't have any transitions at all.)

          I would guess that ensuring a condition like this exists is one of the suggested workarounds in the original paper.

          • Just offhand:

            (1) cut 6 identical keys to the original
            (2) In one slot, cut as far down as possible, and drill a hole in that location, where you can put a mobile pin on a spring and a wire.
            (3) drill a hole along the base, as well, and run the wire through.
            (4) Now pull on the wire to find the alternate height. No filing required [prework necessary].
            Just write down the numbers you get
            (5) Go home and cut new key.

            Also: to get around the lack of a blank:playdoh; wax; metal; plaster; small metal casting. Or digital camera; ruler; grinder; piece of small metal.

            I don't take much comfort in those workarounds.

            At this point, I think that digital locks with varying codes might be a tad more secure. For example, to get the day's code, the admin takes his phone number [or street address, though a random memorized number is best], adds the date to each digit and the time on the lockbox to the last 4 digits, and that's the code. Before he gets up to go in, he figures out what it will be, in his head. Of course, if he forgets entirely, he can take a blowtorch, melt the plexiglass, and let secretary out. Then call in work crews to replace the plexiglass, and stays there, meanwhile, memorizing the *new* number, and keeping an eye out for ninjas rapelling down from the roof.

            Or he can write the code on his desk, the front of his pocket protector, or whatever.

            Or how about this? Specialized beeper tied to lockbox, on continuous recharge. Beeper takes incoming code, checks it against security code, checks source phone number against President's code -- and authorizes computerized lockbox to open upon access key, within the next 1 minute.

            Now, to go in, you pull out your cell phone, call the company president -- he pulls out his video cell phone, calls a video cell phone watching the hall; makes sure that it's you, and then calls the beeper, enters the code [encrypted, of course], and authorizes you to go in.

            Of course, I'm not a cryptologist. I'll be a cryptologist could find a dozen ways to break my idea apart. After all, the more complex a system is, the more flaws it has (doesn't it?)
        • Re:HOW TO DO IT (Score:5, Informative)

          by Reziac ( 43301 ) on Thursday January 23, 2003 @12:07PM (#5143398) Homepage Journal
          And for one-shot keys, the simple method I've personally seen used by locksmiths when presented with a lock for which there's no key pattern in their books:

          Locate the approrpriate blank. Put it in the lock. Twist it good and hard a few times. Remove blank. Note scratches left by lock innards. Cut to match scratches. Voila, working key.

          Waitaminnut... under the DMCA, isn't this reverse engineering?? ;)

          • Re:HOW TO DO IT (Score:4, Interesting)

            by gr8_phk ( 621180 ) on Thursday January 23, 2003 @02:13PM (#5144462)
            I had a friend in high school who carried a set of masters for every type of lock he could find. I seem to recall he'd use a flame (match) to scorch the blank before he put it in a lock. The soot scapes off easier than the key scratches :-) I never did understand his full method, so thanks for the insight. BTW, that was about 15 years ago.

            Locksmithing is a closely guarded profession. They have more secrets too, but they'll be mad enough at this guy and the NYT for letting the cat out of the bag on this one.

        • by Bruce Perens ( 3872 ) <bruce@perens.com> on Thursday January 23, 2003 @12:14PM (#5143471) Homepage Journal
          This is a variation of making keys "by impression". It takes advantage of the fact that master-keyed locks (not Master brand locks) have split pins, and that the master usually is the lower part of the split - although I don't see that this always has to be true. If the master used either the upper or lower part of the split, at random, it would take longer to figure this out - first you'd have to find all of the splits, and then figure out which side of the splits is the master for each pin.


        • For one thing, building up solder in each position makes it a lot easier to see the indentations. But the real reason this works is that if you apply a back and forth motion as your attempt to turn the key, the indentations can be made even if the other positions are not cut properly at all. So this can be done with one key, and it doesn't even have to be a blank (but it does get modified in the process, so if you can get a blank, that's better).

  • by angelsdescent ( 627539 ) on Thursday January 23, 2003 @08:59AM (#5142327)

    In the cert advisory, The Microsoft Corporation are quoted "Those who upgrade to Windows XP Service Pack One should be unaffected by this exploit"

  • PDF Download (Score:5, Informative)

    by Anonymous Coward on Thursday January 23, 2003 @09:02AM (#5142337)
    You can get the paper here [crypto.com]
    Paper's homepage is here [crypto.com]
  • Locks keep the honest person honest... Registration, on the other hand, keeps the pareniod parenoid.
  • The paper itself (Score:4, Informative)

    by elodan ( 601886 ) on Thursday January 23, 2003 @09:02AM (#5142341) Homepage
    Not linked in the NYT article, but it's here [crypto.com] anyway.
  • by DeadSea ( 69598 ) on Thursday January 23, 2003 @09:06AM (#5142355) Homepage Journal
    Here is the original research paper [crypto.com] (in pdf) by Matt Blaze. There is also an article [crypto.com] about this on Matt Blaze's website [crypto.com].
  • by hcdejong ( 561314 ) <hobbes&xmsnet,nl> on Thursday January 23, 2003 @09:06AM (#5142356)

    I see several problems with the article.

    He said the technique could open doors worldwide for criminals and terrorists.

    • Surely, any place that's a likely target for terrorists has more security in place than cylinder locks? Like keycard access systems, or Marine guards with machine guns? This is more a criminal than a terrorist problem.
    • Most types of terrorist attack don't require access to keys. Just park a truck full of explosives in the general vicinity.
    • If the technique has been known to locksmiths, what makes the author think lockpickers haven't known about it, too?
    • This technique is only marginally safer (less detectable) than an attack with lockpicking tools.

    All in all, the article sounds more like fearmongering than a real concern.

    • by GigsVT ( 208848 ) on Thursday January 23, 2003 @09:33AM (#5142474) Journal
      It's not even a criminal problem in reality. I've be willing to bet that 99.9% of criminals don't know how to pick locks, and don't care. There is usually little point in picking a lock when a door can be kicked in, a window broken, a lock drilled, or a padlock cut.
      • You are right. Most criminals out there do not want to waste time with this. But I would think the "smart" ones would actually want it to appear as if nothing is wrong.

        For instance, let's say someone robs a house. It's obvious right away if the door is kicked in and the jamb is busted. However, if the thief is selective about what is taken (which, they never are) and also has the skills to not cause a lot of damage on the way in, then those "selective" stolen items may go unnoticed for some time, which gives the thief more time to fade into the noise.
    • by Peter Greenwood ( 211400 ) <peterg@reel.demon.co.uk> on Thursday January 23, 2003 @09:36AM (#5142482) Homepage
      Don't forget, terrorists do research. Imagine an office building where someone can get taken on as a cleaner in one of the less sensitive office suites, without security checks. Obviously they get a key to that suite.

      Now imagine you work there, in a different suite, in some counter-terrorism capacity. Do you start looking under your car for plastic explosive, or not?

      Or imagine you work elsewhere, but a colleague has an office there and keeps your name and address handy ...
    • by sql*kitten ( 1359 ) on Thursday January 23, 2003 @09:39AM (#5142502)
      Surely, any place that's a likely target for terrorists has more security in place than cylinder locks? Like keycard access systems, or Marine guards with machine guns? This is more a criminal than a terrorist problem.

      You might think so, but consider this example. There are no litter bins in British railway stations, and very few in the centre of London, like the Square Mile. This is because IRA terrorists would leave explosive in them, in order to kill or main as many noncombatants as possible. I think that clearly illustrates that a terrorist can turn the most ordinary, everyday objects into weapons. Maybe there's nothing important in the janitor's closet, but the lock is still there for a reason.

      If the technique has been known to locksmiths, what makes the author think lockpickers haven't known about it, too?

      True, but there's a difference between gaining a skill yourself and having step by step instructions. For example, any Chemistry graduate could make explosives from scratch, working from basic principles. However, anyone with step by step instructions could make it from everyday items, and those are the ones to worry about.

      • by magarity ( 164372 ) on Thursday January 23, 2003 @11:16AM (#5143082)
        IRA terrorists would leave explosive in them, in order to kill or main

        It must be pointed out that nowadays IRA terrorists have a habit of telling the police the general vicinity of said bombs so that civilians can be evacuated. Traffic gets snarled and countless commuters are late, but when was the last time lots of people were killed or maimed by an IRA bomb?
        You must be thinking of the Basque.
        • by ckd ( 72611 ) on Thursday January 23, 2003 @12:09PM (#5143427) Homepage
          It must be pointed out that nowadays IRA terrorists have a habit of telling the police the general vicinity of said bombs so that civilians can be evacuated. Traffic gets snarled and countless commuters are late, but when was the last time lots of people were killed or maimed by an IRA bomb?

          How about the Omagh bombing [bbc.co.uk] in 1998?

          Police were clearing an area near the local courthouse, 40 minutes after receiving a telephone warning, when the bomb detonated.

          But the warning was unclear and the wrong area was evacuated.

          Instead, people were being directed towards the device when it went off shortly after 1500 (BST).

          Women and children - one just 18 months old - are among the dead, many of whom, only moments before the blast, had been standing behind white tape which police had erected when clearing the streets.

          29 dead. (In other words, about 1% of the September 11th attacks.)

    • by swb ( 14022 ) on Thursday January 23, 2003 @10:38AM (#5142835)
      When I replaced the locks on my house, the lock company advertised a series of locks with a restricted keyway, which meant according to the locksmith that their company was the only one in the region where you could get key blanks, cyliners or other hardware associated with this series of locks.

      I ran into this phenomenon in college; I tried to make a copy of my girlfriend's dorm room key at several hardware stores. I actually milled off and polished the head of the key where the "DO NOT COPY" and "UNIVERISTY AABBCC" info was on it so it looked like an ordinary key.

      The last place I went to the guy looked at me and laughed and said, "Nice job, but its a university key -- the blanks and hardware are sold directly by to the University key shop. Even if I wanted to, I couldn't make a copy of it, I have no blanks that will work."

      Anyway, the technique described here requires a bunch of blank keys, which if you can't get or are extremely hard to get makes you wonder if this technique would work in places that employ limited keyway hardware.
  • news? (Score:4, Interesting)

    by electrick ( 579755 ) <cyber_siouxsie@hotmail.com> on Thursday January 23, 2003 @09:07AM (#5142357) Homepage
    Lock picking kits and expliots have been avalible for a very long time, out of the back of magazines (soldier of fortune, most notably) and there have even been text files about it. Why does it take a computer security expert to make us nerds consider "real life" attacks a possibility?
  • Proverb (Score:4, Insightful)

    by frn123 ( 242374 ) <spam@ i m elaps.ee> on Thursday January 23, 2003 @09:07AM (#5142359)
    There is an old proverb in *.ee

    Locks are against wildlife. Humans will have no problems with them.
  • Every time I go the cobblers to have a key cut I normally end up taking it back. The fresh key is cut on a professional key cutting machine by someone who has probably cut thousands of them - I still end up taking it back because it doesn't work in the lock. I've also worked in on the bench in an engineering company and am trained to use a file - detailed filing is not like filing your nails or removing huge burrs from machined metal.

    Load of bollocks I say.

  • by Talisman ( 39902 ) on Thursday January 23, 2003 @09:13AM (#5142378) Homepage
    "...a little-known vulnerability in many locks..."

    Yeah, until now.

  • Nice article... (Score:5, Interesting)

    by pVoid ( 607584 ) on Thursday January 23, 2003 @09:14AM (#5142384)
    His company recommends to architects and builders that they take steps like those recommended by Mr. Blaze, measures that make it more difficult to cut extra keys -- like using systems that are protected by patents because their key blanks are somewhat harder to buy [...]

    I find it interesting seeing that security by obfuscation is a prevalent concept throughout mankinds realm. I guess it is nurtured by the ostrich-sticking-head-in-sand effect of thinking something doesn't exist if we're not aware of it.

    It also makes me laugh how newspapers always skew stuff for sensationalism: now terrorists are one step closer to the US. They are pounding on the gates! WATCH OUT!!!. I think this security whole is mostly going to be used by 16 year old K-Mart workers.

    Anyways, very nice article in the end, and hats off to AT&T for having 'brass hats'.

  • From reading the article it shouldn't be a problem for homeowners. It requires masterkeying and getting a copy of any key in that system.

    Since I only have one key for my whole house, they would need to get ahold of that, and if that happened I'd be screwed anyway.
  • by sdo1 ( 213835 ) on Thursday January 23, 2003 @09:17AM (#5142398) Journal
    ... we'd be hearing about building owners calling for new laws outlawing the tools involved, i.e. files and blank keys. After all, their assets could be compromised by the use of these tools and therefore those tools should be banned! It should not matter that there are legitimate uses for these tools and everyone knows that anyone who owns and/or uses a metal file is a criminal and should be prosecuted!


  • If all you have between your floor network racks is a cylinder lock in a hallway, then yes you should worry about this. Think about it. How easy would it be to take out network access to a whole floor or steal access from a hall wiring closet? Not every employee who has a key is honest. I have also seen some server rooms that had a lock such as this. Server rooms and now even wiring closets should have controlled card key access at a minimum. Maybe biometric access should be looked into more closely.
  • Thankfully they haven't published details on how to break into those locks on the bathroom and bedroom doors.

    The builder gave me a bunch of those flat keys, so I have spares. Looks like I'll be picking up a bunch of those locks for my front and rear doors.
  • by wowbagger ( 69688 ) on Thursday January 23, 2003 @09:21AM (#5142419) Homepage Journal
    Any system that has a "master key" to allow access - be it a physical lock on a door, a backdoor to a program, a key-escrow system, whatever, allows this kind of attack - get the master key, game over.

    I had do design an encryption system to manage software options in a piece of gear I designed. I thought about having a "back-door" to enable options on any unit, the better to test software. I quickly abandoned that idea - let the master key get out, and it's game over. Sure, it may make my life slightly more difficult as a developer, but it also means that no one, not even me, can cheat the system.

    When I had to write the system up for export permission, I described it in detail - algorithm, file formats, I even had to include the source code for the relevant sections. I suppose you could get that information with a FOIA request. Knock yourself out - if you don't have the private key of the keypair, you won't be able to create the options file.

    Say it with me, kids - "master keys and back doors are BAD - JUST SAY NO!"
  • "There's no way to warn the good guys without also alerting the bad guys," Mr. Blaze said. "If there were, then it would be much simpler -- we would just tell the good guys."

    But as ever, one person's good guy is another person's bad buy.

  • security (Score:5, Funny)

    by v(*_*)vvvv ( 233078 ) on Thursday January 23, 2003 @09:25AM (#5142428)
    This is hilarious.

    I mean, anyone can break a window and jump right in!!

    We can call that a "backdoor", and the plywood to cover them "patches".

  • by dmoen ( 88623 ) on Thursday January 23, 2003 @09:28AM (#5142444) Homepage
    This technique was discovered by a grad student at a certain Canadian university back in the late seventies. As a result, when I was a student in the eighties, I and several of my friends had a master key that opened pretty near every door on campus. We had a lot of fun exploring the steam tunnels and dodging security guards.

    The funny thing is, the lock system was not designed to have a single master key. Instead, there was supposed to be a different master key for each building. The campus wide master key was an "emergent property" of the similarities between the various building master keys. Only students possessed this master key :-)

    I still have the key, but it's not so useful any more, as they've changed many of the locks.

    Doug Moen

    • It's possible to make a lock system with hundreds of thousands (in a 6 or 7 pin system) of "change keys" and a thousand or so "sub master keys" in one or two levels of hierarchy, and still have a "grand master" for the whole system. It may be that the campus was designed exactly that way to ensure that no "change key" could accidentally be a valid key (possibly even a "sub master") of another building. They simply would not create an actual "grand master key". But that wouldn't have prevented deriving it's code since it would be part of the design. The only way to have really avoided a grand master would have been to use a whole different blank for each building, and that might have been ruled out as too costly to stock blanks in whatever department was making the keys.

  • by grahamlee ( 522375 ) <{iamleeg} {at} {gmail.com}> on Thursday January 23, 2003 @09:29AM (#5142450) Homepage Journal

    Xerox PARC have issued an advisory stating that any combination lock can be "cracked" by a malicious terrorist with a finger. Due to the digital [sigh...] nature of this crime, it is now illegal to own a finger under the terms of the DMCA and patriotic Americans are being asked to remove all their fingers in a show of solidarity. U.S. President, George W. Bush, is said to be having some difficulty removing his finger from his arse. £:-)

    BTW did the original story remind anyone else of the safe-cracking chapter in "Surely you're joking, Mr. Feynman"?

  • I read it... it's great satire. I mean, come on, who doesn't know about "master keys", and the delta algorithm for finding them? I've known about it for at least 10 years, if not more, does that make me a terrorist?

    Or, do I now fit in the same category with persons who posess a PhD in Nuclear Weapons?


  • by Malc ( 1751 ) on Thursday January 23, 2003 @09:32AM (#5142470)
    Does anybody remember the MIT Guide to Lockpicking (PostScript file??) that was readily available on the internet in the past? We downloaded it back in '94 and friend used it to make some lock picks by filing down some nails. Let me tell you, some fun was had on campus with the practical jokes that followed ;)
    • Ah that guide was great fun back in high school. How did that guy running for president get flyers in the faculty bulleting board? Simple says I, Ninjas!
      The MIT guide mentions the file down master key trick, that was 1991.

      With this new article I may have to try again, the last time I tried to do something with the a master key at my university I ended up matching the right pattern for the key that pulled the cylinder (used to change the lock). It was not fun to explain why my dorm lock had 'magically' come out of my door to the Office of the Physical Plant.
      Lesson learned don't pick your own nose if it is exposed, err locks I mean locks.
  • I don't understand... Why do locks have/need master keys? I though you could only have one lock tied to a specific key. Are we talking about "Yale" type cylinder locks here?

    Why would someone produce a lock for which a master key could be made anyway? Surely crimials would just steal or make a master key and they'd be laughing...

    Is a master key an accidental side effect of the way a lock works, or are most locks intended to have a master key?

    • by gorilla ( 36491 )
      Most locks aren't. Some locks are, for when you've got a big building and don't want to have the security guards lugging around 100kg of metal.

      It's done by installing master wafers into the lock. A normal cylinder lock has pairs of pins, touching each other with a spring pushing them into the hole where you put the key. When you put the key in, the pins all line up, and the cylinder can turn, opening the lock. The length of each pin varies, in the same pattern that you see on the key. By putting in master waters you instead have 3 pins, meaning that each set has two possible positions, and therefore two different keys work in the same lock. By making the second key the same in every lock, you have a master key. The master key for each building or complex would be different, so there is no universal master key.

      Adding master wafers increases the cost of the lock, so it's only done when the lock is going to be used in a master key situation.

  • by Lethyos ( 408045 ) on Thursday January 23, 2003 @09:37AM (#5142491) Journal
    I think that the manufacturer of the locks should sue AT&T under the DMCA for exposing weaknesses in an access control device. Furthermore, AT&T are terrorists for releasing this sensitive security information to the Net before other sites using the same locks are able to correct the vulnerability. I demand that the perpetrators that discovered the weakness with these locks be sentenced to life in prison. We can't have these hackers running free, finding security holes and disrupting national security!
  • by Theodore Logan ( 139352 ) on Thursday January 23, 2003 @09:37AM (#5142496)
    The most common arguments computer security full disclosure advocates face are based on real world analogies. Usually the so called debunking of these proceeds as in this hypothetical dialogue:

    Foo: Why should we disclose computer security vulnerabilities when we don't disclose, say, lock vulnerabilities?

    Bar: Because if a way to break a common lock would be disclosed 1. it would be very difficult to "issue a patch," or upgrade the locks 2. it would be very expensive to "issue a patch," or upgrade the locks 3. locating and telling all people who use the lock that the security of that lock has been compromised would be nearly impossible, or at least much more difficult than in the equivalent computerized situation. Therefore it seems it is not worthwhile going public with a lock vulnerability, but from this it does not follow that one shouldn't disclose computer security vulnerabilities.

    If this line of reasoning is one that computer security full disclosure advocates finds compelling, and I think it is, one would expect them to condemn the disclosure of this vulnerability. Note the "would" in that sentence.

    I'm not sayin', I'm just sayin'...
  • by rosewood ( 99925 ) <rosewood AT chat DOT ru> on Thursday January 23, 2003 @09:40AM (#5142506) Homepage Journal
    Am I the only one that wants bluetooth everywhere, including on my door locks, so that I can unlock my door either auto (when my cell phone + my key get close) or by entering a password (user preference)?

    Among all the other cool data sync things I think bluetooth enables, the death of keys is the other cool thing I really want bluetooth for.
  • by Bob9113 ( 14996 ) on Thursday January 23, 2003 @09:51AM (#5142576) Homepage
    A Schlage employee, on condition of anonymity, said that they were consulting with their legal team on the feasibility of invoking the DMCA against Matt Blaze and AT&T. "Schlage locks are frequently used as a technological measure to protect copyrighted materials. By trafficking in information which allows the compromise of these locks, Mr. Blaze and AT&T are clearly violating the Digital Millenium Copyright Act."
  • by cybergibbons ( 554352 ) on Thursday January 23, 2003 @09:56AM (#5142608) Homepage

    Ok, there are a lot of replies here that seem to be saying that physical security, especially regarding locks, is not that important. You would be surprised.

    Let's look at places that have master keyed systems:

    • Schools
    • Universities
    • Office blocks
    • Residential blocks
    • Shopping centres
    • Airports
    • Entertainment complexes
    • Etc.

    So, it shouldn't be taken lightly that many master key systems are vulnerable to attack.

    You can talk about your electronic lock systems all day, but most (at least in the UK) have a normal lock as part of them, with the electronic system for convenience and being able to tell who is where and when. If they don't have a normal lock in them, then they quite often have fire crash bars on the other side.

    I haven't had a chance to read the paper yet, as the crypto.com site is slashdotted, as is the mirror I found. However, a lot of master key systems have vulnerabilities. For example:

    Some keys have ridges down the sides. Sub master keys only differ from master keys in that they have these ridges, preventing them from being used in other parts of the building. File off the the ridges, and off you go.

    Get two or more keys from a mastered building. Notice similarities and differences. It is often very easy to deduce the master key from this, because often the mastering works by pins having several splits in them.

    These are extremely simple ways of finding masters. There is of course the fact that keys are often badly controlled, and unlike passwords, are not easy to change from a central location.

    Security through obscurity is often a method used with locks. And it works reasonably well. I would say that lock picking is a far rarer skill than being able to use a computer well.

    Some of the more recent lock systems (Assa, Schlage etc.) are very hard to copy, sometimes involving three separate mechanisms in the lock which all need to work. This is if you can obtain blanks. Some even involve small magnets. They are hard, if not impossible to pick as well.

    More worrying, however, is the lack of physical strength in most doors. If you aren't afraid of leaving traces, opening most doors by force is remarkably easy. Yale locks (front door latches) often only take one kick to open. Even mortice locks are often badly installed and not that strong. Even if the lock holds up, the door, most of the time, won't hold up to a crowbar, or in desperate situations, an electric saw of any kind.

    So, although I am sure that the technique presented in the paper has been around for years, it's going public big time now. We're going to have to welcome the script kiddies who practise on the real world soon.

  • I have a solution... (Score:3, Interesting)

    by ActiveSX ( 301342 ) on Thursday January 23, 2003 @10:32AM (#5142810) Homepage
    Longer keylength... [themacmind.com]
  • by aburnsio.com ( 213397 ) on Thursday January 23, 2003 @10:39AM (#5142842)
    Kevin's only been on the net a few days now, and look what happens!

    No need to "Free Kevin" anymore... he's got the master key!

    "No, Officer, I didn't steal the key to the prison, I didn't take any hostages, all I had to do to get out was use this file here that Randall sent me in a Perl 6.0 Birthday Cake..."

  • by Anonymous Coward on Thursday January 23, 2003 @10:53AM (#5142940)
    The so-called "little known" faults with locks have been around since the little things have been invented. There are books on how to circumvent locks.

    For centuries, locksmithing has been a sort of "black art" and the inner workings of them kept under tight control. But that only goes so far, as we all know from the Crypto industry.

    Locks are, in fact, absurdly easy to open if you know what you're doing. If you've got one key to a lock that is master keyed, you can easily figure out what the master key looks like. Without that initial key, it's only slightly more problematic.

    And don't think safes are any safer. Except for those that are specifically designed to thwart attack, most safes are designed to protect documents from fire and environmental hazards. They are not designed to keep intruders out. For those types of safes, anybody with a heavy hammer and a metal punch can open it. You'd be surprised how many people are stupid enough to put cash and valuables in them. In high schools, the combination padlocks on school lockers can easily be opened with a screw driver.

    As the old saying goes, locks are meant to prevent honest people from being tempted. The crooks don't care.

    I studied locks in depth when I was in high school and put that knowledge to good use when I needed quick cash as a starving student in university.

    Needless to say, I'm posting this anonymously.
  • by Skapare ( 16644 ) on Thursday January 23, 2003 @11:31AM (#5143163) Homepage

    This is not an unknown technique. I did this 30 years ago in college. And I only made adaptations to the technique described in a book on locksmithing which was checked out of the college library. I just didn't have any blanks to work with so I made do with one lost key I found. The campus used a type of blank not sold to the public.

    A grand master keying system is based on 5 to 8, but usually 6, tumblers, with typically 10 levels or codes for each tumbler. A simple master system will have at least 2 tumbers with double cuts (but the doubles cannot be cut too close). A more complex system with a level of submastering will have 4 tumblers double cut. A grand master system with potentially two or more levels of submastering will have all the tumblers double cut.

    Presuming it is a grand master system (and very large numbers of change keys generally are made this way even if no grand master key is produced), then you can presume that each position on the key is different between your key and the grand master. And not only is it different, but you can also rule out the level which is one above or below what your key has (the tumbler piece would be prone to pivot and jam, instead of slide, if cut too close). And even two levels apart is often avoided because a tumbler piece of those length can jam, although they insert a ball if the tumbler width is the same as 2 levels in that position (or 3 in some systems).

    So for a typical 6 tumbler 10 level system, you can rule out 3 levels (or 2 if your key is at the highest or lowest) at each position, and the levels 2 above and below are less likely (try them last).

    From your key, you can figure out about where all the levels are. Any additional keys (and I had one, and since this is a non-destructive step, I could also look at a friends' keys) can help. Now with the one spare key I had (extras help a little), you begin the step to find the master levels.

    When a key position is ground just a little bit too high, usually about 1/4 of a level interval, it can still engage the tumbler cuts, but it will be rough when doing so. The same thing happens when it's low, but that's not helpful, so make the cut a little high. Even if the other positions are wrong this can be done, but if they are right it's easier. Putting a bit of solder on the position to raise it really helps because now you can see an indentation formed due to the pressure. Attempting to turn the key in the lock will try to work in those positions just a bit off, but will leave a mark on the key, especially if the metal is soft like solder. If there is no indent, you didn't get the right level, so try another at that position.

    Repeat for all positions. If you are good you can even work all positions in parallel and accomplish this in just minutes. Once you have a level for every position which is at a different height than your own key, you probably have the grand master. If your key was really a submaster, this could trip you up. But they generally try to avoid giving out submaster keys to students.

    There are two other ways to do this.

    You can remove the lock and pull the tumblers and measure them. Be very careful because when you tap out the slide to expose the tumblers, do so one at a time because there's always a spring on top to keep the tumblers under pressure. Of course don't lose the parts, and don't lose the order the tumbler pieces come out. Now you can simply see what levels for each position make up the grand master.

    Another method is to figure out all the levels and their distances. The micrometer caliper helps here. Write down the levels for your key. The next step is to examine other keys of other students. Of course they will think you're trying to make a copy of their key, but if they're your friends and you can trust them, you can reveal your real plan. Write down the levels for their key as well. This now lets you rule out some more levels at each position which the master cannot be. With enough keys you can narrow down just what the grand master key is.

    If all the keys you examine are part of the same submaster system, you'll notice that 2 or 3 or maybe 4 positions are just the same on all keys. The grand master will be different there, but if you just cut your new master key at those levels anyway, while you won't have a grand master, you will end up with a submaster which can be used on all the locks in area (usually a building or so) that the examined keys came from.

    A combination of having a few change keys (yours and a few friends' keys) to rule out more levels in some positions, and working with the first method to find the master levels, can speed things up for you.

    Like I said before, I didn't actually invent these methods; I read them from a locksmithing book. I merely adapted the solder techniques to make things a little easier. Real locksmiths can do it without solder.

    • by Skapare ( 16644 ) on Thursday January 23, 2003 @12:11PM (#5143442) Homepage

      Oh, one more thing. If you do decide to make yourself a grand master key, and are tempted to carry it around on your key ring, cut the hilt off so that the key will go in too far to work. Then only you will know that you have to put it in only part way. So if you get stopped and someone thinks you might have a master key and tries the keys on your ring, their natural human thing of "go all the way" will prevent them from detecting that your key works the lock.

      • ...cut the hilt off so that the key will go in too far to work.

        This is still too dangerous, since they can see that you cut off the hilt and they can just compare your key to theirs (if they have a master of their own.)

        Much better to cut the key backwards -- that is, the cut normally at the end appears next to the hilt, etc. Unless the master is symmetrical, they won't be able to compare it to theirs, and it won't work when they try it.

        Of course, you'll have to insert it from the back of the lock to use it, but that's a minor inconvenience compared to prison time.

  • by Skapare ( 16644 ) on Thursday January 23, 2003 @11:47AM (#5143248) Homepage

    And now for the secure solution. You're gonna like this [keso.com] (in German).

  • by lildogie ( 54998 ) on Thursday January 23, 2003 @12:07PM (#5143392)
    There's another aspect to this article besides the lock-hacking technique.

    The writer speaks of the familiar dilemma of whether to publish to the "Good Guys," which notifies the "Bad Guys" simultaneously, or keep the information secret, knowing the "Bad Guys" could be sharing it already. Same old story we know from cyber security.

    Then there's the "Locksmith" angle, "We've been teaching our students this for years, nothing new here." One wonders how the teachers sorted the trustworthy students from the evil students.

    Good guys, bad guys, locksmiths, students, trustworthy, evil.

    The enormous elephant here is whether people and their motives can be categorized this way. The truth is, these categories aren't cut and dried distinctions.

    Take your government agent, for instance. When we're thinking about wiretapping mad bombers, they look more like good guys. When we're thinking about wiretapping political dissidents, they're bad guys. Same people, same behaviors, different categories.

    Even discussing the distinction brings up more fuzzy categories: "bombers," "dissidents," "we."

    As long as security is addressed from a good-guys vs bad-guys distinction, the argument will go in circles, because you can't really sort out the good guys from the bad guys without a clear value context. If you're diligent, you'll get mired in the values debate, and if you're not, you'll end up drawing biased conclusions.

    The best stragegy in the good guys vs. bad guys debate is not to play the game.

    When making powerful tools like locks, master keys, and cryptography, you have to bite the bullet that you can't really manage the motives of the tool users.
  • by AftanGustur ( 7715 ) on Thursday January 23, 2003 @01:02PM (#5143842) Homepage

    The method as described on other comments, is just brilliant.. But there is one problem that nobody has mentioned..

    How do you get the blanks ?
    You see, with master-key systems the keys have other shapes than ordinary keys (often a mirror pattern if you look at the end of the key, so ordinary keys won't fit in master locks) Keys in master-key systems are often also a little longer than ordinary keys.

    And Joe sixpack just can't walk into any hardware store and ask for the blanks.. The hardware store has limited numbers (if any at all) and has to get the paper-certificate that was delivered with the key-system, before they will cut you a new copy.

    And, no, just bringing the master key to them and asking for a copy doesn't work (I already tried that ;-)

  • Complications (Score:5, Informative)

    by Dun Malg ( 230075 ) on Thursday January 23, 2003 @01:05PM (#5143863) Homepage
    Having worked as a locksmith on and off over the last 10 years, I can think of a few complications that would make this system less effective:
    1) interchangeable core locks (Falcon or Best types). In addition to having master pins for the master key, there will be additional pins for the alternate shear line for pulling the cylinder out. Basically, if you find another key cut that works, you don't know if you have found the master key or the cylinder removal key cut.

    2) MK? GMK? GGMK? Some key systems have multiple levels of keying. Though a well-designed system won't have too many stacked master pins, you still will likely end up finding a cut that works and not knowing if it's for the Master Key, Grand Master Key, Great-Grand Master Key, etc. Depending on the "resolution" of the key system, you could end up with a sub-master that only opens (say) five doors.

    3) restricted keyways. Medeco, Assa, Schlage, et. al offer numerous restricted keyways. Good like finding blanks.

    4) maximum adjacent cut differential. A Schlage key, for example, can have a depth from 0-9 on any given cut, but no two cuts that differ by more than 7 can be next to each other. If your office key is cut to 99333, and the master key is 51133, then one of the keys you'd have to cut using this system is 91333. A nine and a one are over the max differential, which would either obliterate the "1" cut, or the angle between them would be too steep-- in which case, good luck pulling this key out again.

  • by jridley ( 9305 ) on Thursday January 23, 2003 @01:33PM (#5144109)
    This is totally obvious. Anyone who knows how a master key system works can do this and probably already has. I did it myself in college; it took a copy of my dorm key and a chainsaw sharpening file, both picked up from the hardware store for about $2, and about 90 minutes of fooling around, and I had a master key to the dorm.

    The dorm management did discover it eventually. I didn't use it for anything but a little urban exploration, but I think I let a few too many people back into their rooms after their roommates locked them out and the RA wasn't around, and it became common knowledge that I had the key.

    They asked how I found out how to make master keys, but didn't seem to be too convinced when I just said "Well, it's obvious, isn't it? Just think for a minute and anyone could figure it out." Probably the wrong thing to say to someone who was probably a humanities major.

    My knowledge came exclusively from the Junior Worldbook Encyclopedia entry on how locks work, plus about 2 minutes of thinking about it.
  • by MickLinux ( 579158 ) on Thursday January 23, 2003 @03:03PM (#5144895) Journal
    Okay, I've read the full article [that's what RTFA means, isn't it?], and they say that to defeat priviledge escalation, you have to add to each lock pin a random additional pseudo-master-lock combination. However, they then note that this decreases the security of each individual lock.

    What they don't say, but is easily calculated, is that you can raise the security of each individual lock by increasing the number of pins.

    Specifically: if you have a single master key, then you have to go up from double-cut up to triple-cut. That means that I'll work with log-base-3 below (for triple cut).

    In that case, the number P of additional pins you must add, having formerly had N pins, and having x (let us suppose 9) possible cut heights, then

    P = N/[Log3(x)-1]

    So if you have 9 possible heights for each pin, single master key, and 5 tumblers, then you can prevent privelege escalation with no further loss in security by going to 5+[5/(2-1)]=10 pins. Not common today, but not impossible. Currently most locks run from 5 pins to 8 pins. Add two pins to an 8 pin lock, and you get your 10 pin security, privilege-protected.

    Or you can go open source.

  • Damn (Score:3, Interesting)

    by Cylix ( 55374 ) on Thursday January 23, 2003 @06:36PM (#5146616) Homepage Journal
    This isn't exactly news...

    I've known about the flaw in the master key system for a long long time.

    Actually, in many circumstances you can get by the mechanism by continually retrying and wiggling your key until the fit hits.

    Its not guranteed, but its a little better then using a file.
  • by blinq ( 638011 ) on Thursday January 23, 2003 @09:17PM (#5147577)
    You can find the "MIT Guide To Lock Picking" at http://www.lysator.liu.se/mit-guide/mit-guide.html [lysator.liu.se].

    And specifically read section 9.10 about Master Keys. This stuff is pretty old and well circulated. The entire guide makes for a great read if you're bored. If you're interested in mind teasers, puzzles, and such, you'll appreciate what the guide talks about, even if you never attempt to pick a lock.

"Don't worry about people stealing your ideas. If your ideas are any good, you'll have to ram them down people's throats." -- Howard Aiken