The Lockdown: Locked, but not secure (Part I)
Noted security expert Marc Weber Tobias contributes a new column, The Lockdown, exposing the shoddy security you may depend on.
The Bump Key: A new old threat to the security of mechanical locks
The most popular locking mechanism in the world utilizes the pin tumbler design, first developed 4000 years ago in Egypt and then rediscovered and perfected a century and a half ago by Linus Yale. There are billions of these locks in the world and they come in all sizes, configurations, and security ratings. Some are secure; most are not, and even some high security rated cylinders can be easily compromised. All that is required to open many times of pin tumbler cylinders -- the kind of lock that probably keeps the bad guys out of your home -- is a bump key and a tool for creating a bit of force. The bump key shown above opens an extremely popular five pin lock, and the plastic bumping tool is produced by Peterson manufacturing, although many others are now being offered for sale. With these two cheap implements, anyone -- and I do mean anyone -- can get into your home or business in a matter of seconds.
In 2004, this relatively old technique of opening locks was rediscovered by the European locksmith community in Germany and other countries. As the word spread as to the ease with which certain locks could be bypassed, several sports lock picking clubs and notably the members of TOOOL began to examine the issue more closely. Subsequently, tests were conducted by the prestigious consumer research organization in the Netherlands in 2006 and published last March. In early April, we issued a security alert on security.org with regard to the vulnerability of United States Postal Service and Mail Boxes Etc. locks. Two White Papers were also posted, dealing with the security threat and legal issues involving bumping: A detailed technical analysis of bumping and Bumping of Locks: Legal issues in the United States.
There is significant misunderstanding about the bumping technique, what locks are affected, and which products will provide real security against this threat. Barry Wels and I discussed bumping during a panel at HOPE in New York in July, and Matt Fiddler and I presented the same topic at DEFCON 14. A great deal of international media attention resulted from these talks because of the apparent simplicity of opening cylinders that were previously believed to be secure. The photograph to the right shows an eleven year old girl that opened a popular five pin cylinder in seconds at Defcon 14. She had no prior experience or expertise. You can watch a video (WMV) of her opening the lock here, it's actually a little scary.
I interviewed and videotaped the eleven year old girl at the lock picking village at DEFCON who demonstrated how she could quickly open a popular cylinder. She had no prior experience with locks and did not understand the underlying theory. Her parents simply thought that she might be intrigued with the challenge of opening locks. And they were correct! All she had was a pre-cut bump key and a "tomahawk" kinetic energy tool, like the one pictured above. The Kwikset that she opened is sold in every hardware and DIY store in the country, and is believed to be secure by the public. It is far from it, and that is at the crux of the security issue at hand. The manufacturers have failed to warn the consumer that certain cylinders can potentially be opened in seconds with this technique.
Definition of terms and how a pin tumbler locks works
You should become conversant with a few terms that are used to describe the critical components of a pin tumbler lock.
In the modern pin tumbler lock, each chamber contains a spring, top pin and bottom pin. If the lock is master-keyed, then one or more additional pins will be inserted into each chamber to provide for additional unlocking combinations. In the standard cylinder, a rotating portion, called the plug, is the part that is controlled by the key and actuates the bolt when it is turned. The plug is normally prevented from moving because there are normally five, six, or seven pin tumblers that protrude from the fixed part of the lock, called the shell, into the plug.
In order for this lock to be opened, all of the bottom pin tumblers must be raised precisely to the shear line, (the exact point at the top of the plug), so that it can rotate freely. If any pin is even a couple thousandths of an inch above or below the shear line, then the plug is stopped from turning.
In the diagram above (we slapped it in a second time so you don't have to keep scrolling up), all of the bottom pins are aligned at shear line. They are shown in green. The depths for four of the pins are shown. Note the shortest bottom pin corresponds with the shallowest cut of the key and is given the code value of "0" by the manufacturer. There is a direct correlation between the depth of the pin and its number. All lock makers assign values to each pin depth so that keys can be replicated by number rather than requiring the physical key. The deepest pin in this lock is 9. This is an important concept to understand when discussing bump keys, because the proper bump key requires that all of the bitting positions be cut to the lowest depth. In this example, that would be 999999 (see: the topmost picture).
We need to understand two concepts: what keeps the lock from opening, and more importantly, how can we unlock our cylinder? The first question is simple to answer. Without any key inserted, each top pin will occupy space in the chambers of both the shell and the plug. This will prevent the plug from turning. When the wrong key is inserted, one or more tumblers are either above or below shear line, depending upon the key bitting. Either way, the plug is prevented from rotating because the pin forms an obstruction that binds the plug to the shell. The lock can only be opened only when there is no obstruction crossing the shear line. This can happen in one of several ways.
Of course, a key can raise all of the lower pins to the shear line, which will in effect make the plug into a solid block of round metal, free to turn. Note, I said "a key" rather than the "correct key," because in a master key system, many different keys will open a given cylinder. In our simplest of examples, we raise the lower pins to shear line with the correct key, and the lock opens.
One form of bypass is picking, which actually simulates a key. Pins are individually raised to shear line and trapped there. Once all tumblers are "set" at this position, the plug is free to rotate and the lock can be opened. Another form of bypass, and the subject of this article, is bumping.
Earlier I stated that there can be no obstruction at the shear line for the plug to rotate. That means that the pins must be split precisely at the shear line, as would be the case in the normal operation of the correct key. But, there is another way, and that involves not only splitting the pins but creating a gap that crosses the shear line. This is what bumping is all about. The top and bottom tumblers are separated for a brief moment; just long enough for a gap to be created at shear line which allows the plug to be turned. As I will explain, this method is perhaps the simplest and fastest way to compromise a pin tumbler mechanism. The problem is integral to any lock that employs split pins in each chamber. Many have asked me if this means that the lock is defective. The answer is no; it is just a built-in problem that needs to be understood and addressed.
Theory and history of bumping
The technique of utilizing a specially cut key to open pin tumbler locks has been known for at least twenty-five years and appears to have been first developed by locksmiths in Denmark to disassemble cylinders quickly in their shops. It actually began by "rapping" a lock on the work bench while applying slight pressure to the back of the plug. If done properly, the movable portion of the cylinder would be forced slightly forward, and could be rotated and removed. Locksmiths then figured out that a key cut to all "9" depths (deepest value) could be used to simultaneously transmit energy to the pins to cause the bottom and top tumblers to separate.
The theory of bumping is quite simple and was actually formulated by Sir Isaac Newton around 1650, long before modern pin tumbler locks were invented. Energy is created and used to split the bottom and top pin, thereby allowing the plug to rotate. The original method of bumping, which required the key to be withdrawn by one tumbler position and then slammed forward, was replaced in 2004 by what I have referred to as the "negative shoulder" method. This new process made opening some locks quite a bit simpler and more reliable than the original method. In an instant, almost all of the conventional locking mechanisms became vulnerable.
As shown in the diagram below, a bump key is inserted fully into the lock. Because of the removal of a slight bit of material from the shoulder, the key is free to move forward when struck with a mallet (tomahawk), plastic-handled screwdriver, piece of wood, or almost any other weighted item. All of the pins are violently forced upward by making contact with the ramps of the key. This causes the top pins to move and creates a momentary gap between the two within each chamber. If the timing is correct, the plug is free to turn and the lock is open. It is just that simple!
Although I learned the Denmark technique almost fifteen years ago while in Copenhagen, I did not pay a great deal of attention to it in the first edition of Locks, Safes, and Security because it was not thought to be applicable as a covert method of entry. Since 2004, that has all changed. As I have noted in several articles, bumping is perhaps the fastest and easiest way to open a conventional pin tumbler lock, but there are caveats that the reader must understand. The bottom line: a high percentage of the locks in the world are pin tumbler mechanisms. A significant number of those can be compromised by exploit of Newton's Third Law of Motion, "For every action, there is an equal and opposite reaction."
Mechanical Locks: what constitutes security against covert entry?
Security against covert entry can be measured by what I refer to as the 3T-2R rule. All locks can be gauged by this standard, and all standards organization, UL included, essentially employ the same formula. Simply stated, it relates to the amount of time, the sophistication of the tools and the amount of training that is required to open the lock. Then, the reliability and repeatability of the process must be assured. The lower the requirements for the 3Ts, then the greater the threat to security. The problem is compounded if the reliability and repeatability of the process of compromising the lock is relatively high.
Bumping poses a serious security threat because the training to bump open a lock is minimal to non-existent. This was evidenced by three separate experiences that I had: a reporter that interviewed me in a recent television story, a correspondent for Newsweek, and the eleven year old at DEFCON were all shown the basic technique of bumping, and within a couple of minutes each was able to open five and six pin cylinders. The tools required are readily available. I have opened thousands of locks using screwdriver handles, a plastic mallet, and even wooden sticks.
Finally, the time to open a cylinder can range from two seconds to more than a minute. As a lawyer, my view is that if a cylinder, any cylinder, can be compromised in under a minute, there is a serious security issue and potential legal ramifications. But this is not the end of the story, because there are certain technical issues that you need to understand. All locks cannot be opened by this method. As noted in my White Paper, there are certain obstacles to success. Unless you have a pre-cut bump key for the proper keyway, the process can prove more difficult or even impossible.
In the second part of this article, I will talk about locks that are secure and which are not. You might be surprised!
Additional materials can be found on security.org and toool.nl. Bumping is thoroughly detailed in LSS+, the multimedia edition of Locks, Safes and Security by the author.
Marc Weber Tobias is an investigative attorney and security specialist living in Sioux Falls, South Dakota. He represents and consults with lock manufacturers, government agencies and corporations in the U.S. and overseas regarding the design and bypass of locks and security systems. He has authored five police textbooks, including Locks, Safes, and Security, which is recognized as the primary reference for law enforcement and security professionals worldwide. The second edition, a 1400 page two-volume work, is utilized by criminal investigators, crime labs, locksmiths and those responsible for physical security. A ten-volume multimedia edition of his book is also available online. His website is security.org, and he welcomes reader comments and email.
The most popular locking mechanism in the world utilizes the pin tumbler design, first developed 4000 years ago in Egypt and then rediscovered and perfected a century and a half ago by Linus Yale. There are billions of these locks in the world and they come in all sizes, configurations, and security ratings. Some are secure; most are not, and even some high security rated cylinders can be easily compromised. All that is required to open many times of pin tumbler cylinders -- the kind of lock that probably keeps the bad guys out of your home -- is a bump key and a tool for creating a bit of force. The bump key shown above opens an extremely popular five pin lock, and the plastic bumping tool is produced by Peterson manufacturing, although many others are now being offered for sale. With these two cheap implements, anyone -- and I do mean anyone -- can get into your home or business in a matter of seconds.
In 2004, this relatively old technique of opening locks was rediscovered by the European locksmith community in Germany and other countries. As the word spread as to the ease with which certain locks could be bypassed, several sports lock picking clubs and notably the members of TOOOL began to examine the issue more closely. Subsequently, tests were conducted by the prestigious consumer research organization in the Netherlands in 2006 and published last March. In early April, we issued a security alert on security.org with regard to the vulnerability of United States Postal Service and Mail Boxes Etc. locks. Two White Papers were also posted, dealing with the security threat and legal issues involving bumping: A detailed technical analysis of bumping and Bumping of Locks: Legal issues in the United States.
There is significant misunderstanding about the bumping technique, what locks are affected, and which products will provide real security against this threat. Barry Wels and I discussed bumping during a panel at HOPE in New York in July, and Matt Fiddler and I presented the same topic at DEFCON 14. A great deal of international media attention resulted from these talks because of the apparent simplicity of opening cylinders that were previously believed to be secure. The photograph to the right shows an eleven year old girl that opened a popular five pin cylinder in seconds at Defcon 14. She had no prior experience or expertise. You can watch a video (WMV) of her opening the lock here, it's actually a little scary.I interviewed and videotaped the eleven year old girl at the lock picking village at DEFCON who demonstrated how she could quickly open a popular cylinder. She had no prior experience with locks and did not understand the underlying theory. Her parents simply thought that she might be intrigued with the challenge of opening locks. And they were correct! All she had was a pre-cut bump key and a "tomahawk" kinetic energy tool, like the one pictured above. The Kwikset that she opened is sold in every hardware and DIY store in the country, and is believed to be secure by the public. It is far from it, and that is at the crux of the security issue at hand. The manufacturers have failed to warn the consumer that certain cylinders can potentially be opened in seconds with this technique.
Definition of terms and how a pin tumbler locks works
You should become conversant with a few terms that are used to describe the critical components of a pin tumbler lock.
- Bitting: The actual cuts of the key.
- Center-to-center measurement: The required spacing between each cut.
- Chamber (or bore): A series of holes are drilled through the shell of the lock and into the plug, one for each set of tumblers (the pins that keep locks shut). Each chamber contributes to the overall security of the lock by housing a set of pin tumblers and springs that can individually prevent the plug from turning without the proper key.
- Code value for each depth: The number that the manufacturer assigns to each individual bitting depth.
- Keyway: The combinations of obstructions (wards) at the front of the plug that allows or prevents a specific key from entering.
- Pin Tumbler: A round pin that moves up and down within each chamber and whose purpose is to block the ability to turn the plug unless it is raised to shear line.
- Plug: The round center core of a lock that is activated by the proper key and is utilized to turn the bolt.
- Shell: The fixed portion of the lock that contains the springs, top pins and plug;
- Shoulder of the key: The portion of the key that abuts against the face of the plug. The purpose of the shoulder is to stop the key from forward movement, once fully inserted into the plug.
In the modern pin tumbler lock, each chamber contains a spring, top pin and bottom pin. If the lock is master-keyed, then one or more additional pins will be inserted into each chamber to provide for additional unlocking combinations. In the standard cylinder, a rotating portion, called the plug, is the part that is controlled by the key and actuates the bolt when it is turned. The plug is normally prevented from moving because there are normally five, six, or seven pin tumblers that protrude from the fixed part of the lock, called the shell, into the plug.
In order for this lock to be opened, all of the bottom pin tumblers must be raised precisely to the shear line, (the exact point at the top of the plug), so that it can rotate freely. If any pin is even a couple thousandths of an inch above or below the shear line, then the plug is stopped from turning.
In the diagram above (we slapped it in a second time so you don't have to keep scrolling up), all of the bottom pins are aligned at shear line. They are shown in green. The depths for four of the pins are shown. Note the shortest bottom pin corresponds with the shallowest cut of the key and is given the code value of "0" by the manufacturer. There is a direct correlation between the depth of the pin and its number. All lock makers assign values to each pin depth so that keys can be replicated by number rather than requiring the physical key. The deepest pin in this lock is 9. This is an important concept to understand when discussing bump keys, because the proper bump key requires that all of the bitting positions be cut to the lowest depth. In this example, that would be 999999 (see: the topmost picture).
We need to understand two concepts: what keeps the lock from opening, and more importantly, how can we unlock our cylinder? The first question is simple to answer. Without any key inserted, each top pin will occupy space in the chambers of both the shell and the plug. This will prevent the plug from turning. When the wrong key is inserted, one or more tumblers are either above or below shear line, depending upon the key bitting. Either way, the plug is prevented from rotating because the pin forms an obstruction that binds the plug to the shell. The lock can only be opened only when there is no obstruction crossing the shear line. This can happen in one of several ways.
Of course, a key can raise all of the lower pins to the shear line, which will in effect make the plug into a solid block of round metal, free to turn. Note, I said "a key" rather than the "correct key," because in a master key system, many different keys will open a given cylinder. In our simplest of examples, we raise the lower pins to shear line with the correct key, and the lock opens.
One form of bypass is picking, which actually simulates a key. Pins are individually raised to shear line and trapped there. Once all tumblers are "set" at this position, the plug is free to rotate and the lock can be opened. Another form of bypass, and the subject of this article, is bumping.
Earlier I stated that there can be no obstruction at the shear line for the plug to rotate. That means that the pins must be split precisely at the shear line, as would be the case in the normal operation of the correct key. But, there is another way, and that involves not only splitting the pins but creating a gap that crosses the shear line. This is what bumping is all about. The top and bottom tumblers are separated for a brief moment; just long enough for a gap to be created at shear line which allows the plug to be turned. As I will explain, this method is perhaps the simplest and fastest way to compromise a pin tumbler mechanism. The problem is integral to any lock that employs split pins in each chamber. Many have asked me if this means that the lock is defective. The answer is no; it is just a built-in problem that needs to be understood and addressed.
Theory and history of bumping
The technique of utilizing a specially cut key to open pin tumbler locks has been known for at least twenty-five years and appears to have been first developed by locksmiths in Denmark to disassemble cylinders quickly in their shops. It actually began by "rapping" a lock on the work bench while applying slight pressure to the back of the plug. If done properly, the movable portion of the cylinder would be forced slightly forward, and could be rotated and removed. Locksmiths then figured out that a key cut to all "9" depths (deepest value) could be used to simultaneously transmit energy to the pins to cause the bottom and top tumblers to separate.
The theory of bumping is quite simple and was actually formulated by Sir Isaac Newton around 1650, long before modern pin tumbler locks were invented. Energy is created and used to split the bottom and top pin, thereby allowing the plug to rotate. The original method of bumping, which required the key to be withdrawn by one tumbler position and then slammed forward, was replaced in 2004 by what I have referred to as the "negative shoulder" method. This new process made opening some locks quite a bit simpler and more reliable than the original method. In an instant, almost all of the conventional locking mechanisms became vulnerable.
As shown in the diagram below, a bump key is inserted fully into the lock. Because of the removal of a slight bit of material from the shoulder, the key is free to move forward when struck with a mallet (tomahawk), plastic-handled screwdriver, piece of wood, or almost any other weighted item. All of the pins are violently forced upward by making contact with the ramps of the key. This causes the top pins to move and creates a momentary gap between the two within each chamber. If the timing is correct, the plug is free to turn and the lock is open. It is just that simple!
Mechanical Locks: what constitutes security against covert entry?
Security against covert entry can be measured by what I refer to as the 3T-2R rule. All locks can be gauged by this standard, and all standards organization, UL included, essentially employ the same formula. Simply stated, it relates to the amount of time, the sophistication of the tools and the amount of training that is required to open the lock. Then, the reliability and repeatability of the process must be assured. The lower the requirements for the 3Ts, then the greater the threat to security. The problem is compounded if the reliability and repeatability of the process of compromising the lock is relatively high.
Bumping poses a serious security threat because the training to bump open a lock is minimal to non-existent. This was evidenced by three separate experiences that I had: a reporter that interviewed me in a recent television story, a correspondent for Newsweek, and the eleven year old at DEFCON were all shown the basic technique of bumping, and within a couple of minutes each was able to open five and six pin cylinders. The tools required are readily available. I have opened thousands of locks using screwdriver handles, a plastic mallet, and even wooden sticks.
Finally, the time to open a cylinder can range from two seconds to more than a minute. As a lawyer, my view is that if a cylinder, any cylinder, can be compromised in under a minute, there is a serious security issue and potential legal ramifications. But this is not the end of the story, because there are certain technical issues that you need to understand. All locks cannot be opened by this method. As noted in my White Paper, there are certain obstacles to success. Unless you have a pre-cut bump key for the proper keyway, the process can prove more difficult or even impossible.
In the second part of this article, I will talk about locks that are secure and which are not. You might be surprised!
Additional materials can be found on security.org and toool.nl. Bumping is thoroughly detailed in LSS+, the multimedia edition of Locks, Safes and Security by the author.
Marc Weber Tobias is an investigative attorney and security specialist living in Sioux Falls, South Dakota. He represents and consults with lock manufacturers, government agencies and corporations in the U.S. and overseas regarding the design and bypass of locks and security systems. He has authored five police textbooks, including Locks, Safes, and Security, which is recognized as the primary reference for law enforcement and security professionals worldwide. The second edition, a 1400 page two-volume work, is utilized by criminal investigators, crime labs, locksmiths and those responsible for physical security. A ten-volume multimedia edition of his book is also available online. His website is security.org, and he welcomes reader comments and email.
Reader Comments (Page 2 of 2)
Kevinsky @ Aug 26th 2006 7:25PM
All this is rather trivial, I took quickly to the hobby of picking and its a simple and easy process. As the old saying goes, locks are for HONEST people.
I will say this, I have 4 security cameras on my home, monitored security system and a dog plus everyone in my house is competition pistol competitors thus we shoot and know how to shoot fast and accurate. I never worried about my home even when I am not there, its a tight neighborhood and Katrina really made that much tighter as we stayed and fought looters :) The problem I do see with the article is it introduces this process to noobs with no experience required. Its only going to raise issues with unauthorized access and petty crap like that. The vast majority of people have alarms on their homes and businesses and cameras are getting very popular now too.
Sometimes things like this need to be kept within the community unless they are going to be nation wide media issue.
By the way - to Obiwan, you just made your material public domain so whoever gets to the patent office first wins. Do you have your PTO Number? I do.. you need it to even start to deal with them. Better run fast :) You also need to have the finances to challenge a patent as well as defend one, its very very expensive.
Tom @ Aug 26th 2006 7:56PM
No rocket-scientist here, but just looking at the concept would make it seem as though it would be a big step toward bump-proffing a lock to just install it UPSIDE-DOWN.
Allen Murphy @ Aug 26th 2006 10:07PM
Go tell that to the Europeans, who have profile cylinders that are mounted "upside down" as a matter or regular use.
Nice try.
The idea of sticky "security oil" is nice, right until it causes the lock to jam from dirt and dust collecting in it-or the oil freezing in cold weather or running out in hot weather.
Nice try #2
Magnetic top and bottom pins have been patented years ago and for this purpose are ineffictive against "bumping"
Nice try #3
Allen Murphy
Kevinsky @ Aug 27th 2006 5:24PM
Someone who knows their business! nice Allen :)
I imagined the problems with the oil when I read the post, did not know about the magnetic inserts however.
Now think about the Federal government and those branches of government we dont hear much about and the technology they possess for opening locks and such. I know our simple Sheriff's office here has specialists on duty that make covert entries into alarmed homes, through locks and bypassing alarms. Now think about the big bro and their abilites. I cant help wondering about the classified technologies we dont know about.
Like I said, for honest people. There is nothing like some good big dogs for security. Its a good backup.
WScruggs @ Aug 28th 2006 6:18PM
It appears that 'bumping' can only happen if you have both bottom and top pins. I have only ever seen top pins used in master systems, so unless I missed something, this technique cannot be used to open most homes and small businesses.
Schuyler @ Sep 19th 2006 1:36AM
Hi,
Actually, that's not the case. You can think of master keyed systems of having 3 pins in each chamber, rather than the usual two.
In a normal lock you have two pins, the bottom pin that your key connects to and the driver pin above it, which is what actually blocks the sheer line and keeps the lock from turning.
In a master keyed system you have an additional "master wafer" (just a very thin top pin, basically) that creates two different points at which the lock can clear the sheer line. That way more than one key can work in one lock.
You can see visuals of either idea here: http://deviating.net/lockpicking/01.04-regular_binding.html
and here:
http://deviating.net/lockpicking/14.01-master_keying.html
Enjoy!
- Schuyler, TOOOL US
Another Finn @ Aug 29th 2006 6:44AM
To the Finn:
If I were designing a security system, I'd assume any lock could be opened by an unauthorized person, including Abloys. Keys (mechanical and electronic alike) get lost and stolen, so the lock doesn't have to get picked to gain entry - thus no single access control system can ever be deemed sufficient. I'd make a reasonable attempt to deter unauthorized entry, but I'd also make an effort to detect unauthorized persons inside the secured area.
--another Finn--
3logie.com @ Aug 29th 2006 12:00PM
Pour les francophones, voici un article qui tente de reprendre la situation sur les clés sauteuses :
http://3logie.com/perso/autre/2006/08/29/La-s-eacute-curit-eacute-un-miroir-aux-alouettes-1.html
Grant Schultz @ Aug 30th 2006 1:03PM
I recall reading that Harry Houdini used a technique called "rapping" to open locks. The source (long-forgotten--this must have been 30 years ago) did not give any details, but I wouldn't be surprised if he had independently discovered the technique of bumping.
Schuyler @ Sep 19th 2006 1:36AM
Rapping was actually the original form of bumping. It was an old locksmith secret, as it's been explained to me. I imagine a fellow like Houdini would have known all about it :)
Jake @ Sep 3rd 2006 11:04PM
Medeco keys can be copied. I borrowed my friends keys (from work), took the keys to a mom and pop locksmith shop and three medeco keys were copied, no questions asked. They were a little more expensive than the other no-brand keys but they work just fine. Oh yeah, and the keys that say "DO NOT DUPLICATE" ... those duplicates work just fine too. Nothing nefarious going on. I just lost my keys while camping and needed a new set.
chris @ Sep 4th 2006 9:05PM
you can check out bumping in more detail :http://ukbumpkeys.editboard.com/index.forum
Dont Worry @ Sep 11th 2006 10:44PM
This article is just rediculous to even publish. For, one the only people who are probably going to try this would be a bunch of unmature kids. Secondly, if a criminal or burgular or whatever we are calling them these days, they are not going to mess around with a lock if they want in they are going to get in. example, kicking the door down shootin the lock (wells thats to loud), walking in because the doors unlocked or the most common lately through a window so pretty much I think people have absolutly nothing to worry about. I work for a company that sells locks and people are making such a big deal out of this and freaking out and wanting secure locks but trust me it does not matter what lock you have on your door if people want in they are going to get in. I suspect that whom ever wrote this article knows someone who is a locksmith or in the locksmith business and that person said business was slow and asked them to write this article and bring it out of the dark ages so when people read this article the first thing they do is freak out and call there local locksmithes I have already had tons of calls. Great Job thanks for keeping the day job alive...
hal thompson @ Feb 10th 2008 4:27PM
I have 2 Mul-t-locks which I have had re-keyed twice because they had been opened, without an authorized key each time. Once I had only 1 key and no key duplication card to prevent accidentally leaving either to be somehow taken, and it was also entered. I know who the person is...she has stalked me entering my apartments for 4 years, and a mutual friend told me this woman (the stalker) told her she had a lock-picking kit. Also now I have an ADT alarm system and I see evidence that she still enters my home in my absence.
I'd like to see comments.
Trakgalvis @ Oct 8th 2006 2:32PM
There is now a variant bumping method that uses a slightly different
key, and for which no bump hammer is needed. This is being tried and
tested by some members of
http://forum.lockpicker.net/
See
http://www.benslow.org.uk/LPN/LowImpact.avi
and
http://www.benslow.org.uk/LPN/LowImpact.jpg
for a better look at a low-impact bump key.
Get in touch if you are interested in more information about this technique.
JOHNA @ Oct 28th 2006 1:56PM
After reading this article, I thought I'd give it a try. I have never even tried to pick a lock once in my life. Also, I don't have the correct equipment, I just tried bumping my front door with another key on my keychain that has deeper cuts than the correct key. I hit the key with the handle of a soup ladle. It worked on the first time!! I just sat there and stared at the unlocked deadbolt for a minute in disbelief!! Amazing!!
L Lalonde @ Nov 7th 2006 8:51AM
I have an abloy lock and I have had a lot of trouble with petty thieves because I am a woman who lives alone and I do some pretty good art. I was interrested in finding out if these more expensive abloy locks are really pick proof.
Because when I first bought them when I was getting picked over he was not able to pick them so he used some kind of thing that he wedged up against the door and door frame and it kind of wowed out the center of the door and then he just pushed his way in and must have made himself a key because he just kept on coming for more stuff. And after you could see daylight in the center part of the door when it was closed and he forced the lock somewhat and it finally seized up and had to be replaced. And whatever key he made for himself worked on the new abloy locks. So I am needing some inspiration on how to keep these lazy creeps from freeloading. Because as the locksmith who sold me the locks told me if they want to get in they will and it does not help when you have entire web sites selling picking tool sets for as low as 29.95 complete with a manual that claims to be great for beginners.
So if David Li who made the comment on the abloy locks knows of one that is worth it help me out please. dansingleaf@hotmail.com that is with an "s". I have spoken to local locksmiths and they all claim that they are pick proof and I know for a fact that they are not. If fact one had the audacity to ask me if I was taking my meds. Ah if only I were a man for a moment.
Dennis McEntire @ Dec 13th 2006 4:03PM
Just wanted to let everyone know -- I became a locksmith because of the bump key problem. I sell high security locks at reasonable prices in my online store. If you'd like to learn more about the bump key, and browse products that are safe from the bump key, visit:
http://www.bayarealocks.com
Thank you
locksmith @ Feb 6th 2007 6:06PM
i agree with the bumping making it wsy for thieves to bump there way in. i ordered a set from bumpkeyed.com for 30 bucks shipped. makes my job a lot easier. i refuse to let customers watch because its so easy to do.
Tom @ Feb 2nd 2007 1:19PM
What about wafer tumblers, like Schlage, as opposed to pin tumblers? And two sided keys like many automobile leys that can be inserted up or down?
David Westlake @ Feb 5th 2007 11:16AM
In my experience, those round barrel locks have been pretty good. I know they used to be opened with the mouth of a tube of toothpaste but the newer ones are larger. I worked in the LA County jail for several years and inmates LOVE talking about how "their friends" break into places.
In response to Greg:
Leaving your door unlocked in not an issue in all 50 states as to whether or not your house has been burglarized. You can remove your doors and leave on vacation and if your stuff is gone when you get back, it is a burglary. Burglary isn't "breaking and entering" like TV shows depict. Most states classify burglary as "unlawful entry". If your insurance won't cover you unless a point of entry is easily identified and proven, then get a new insurance company. Having been in law enforcement for 11 years, this is the first I heard about insurance companies not filing a claim if the lock was picked.
lokman @ Feb 20th 2007 2:10PM
ive been a locksmith for 21 years and have been noticing the bump key craze if you want a lock that will stop someone from using this method on your business or home email me at lokman38@comcst.net
John Doe @ Mar 6th 2007 12:51PM
They have websites out there that sell these keys. I did a google search and like four of them came up. One is http://www.bump-j.com. This guy has instructions on how to use them, and 15 keys for like $20.
Is this legal? Can these pages be taken down?
tom @ Mar 24th 2007 3:13AM
I have been a locksmith for 13 yrs. and have opened alot of locks but this lock bumping is a bunch of hype. they are bumping kwikset locks which are the easiest locks to pick in the world. you dont have to buy these high security locks to prevent it. just put high security spool pins in the top. i keyed a kwikset lock with spool pins in the top and could not bump it. no need to spend hundreds on the medico or primus, just beef up your locks!!!!!
bolorerdene @ Apr 2nd 2007 12:41AM
how can i get this,
lee @ Apr 2nd 2007 2:39PM
Your comments indicate that 9 is the deepest cut on the key but your diagram shows it to be the shallowest. What am I missing?
Paul @ May 3rd 2007 1:03PM
We run a 114-unit apartment building so this news is serious stuff to us. We had 3 unforced breakins in the last month!
We're considering adding lockable chain locks that would at least surprise and slow these robbers down. Any comments?
kraut @ May 27th 2007 11:00AM
How about using stronger return springs for the pins(if one can get them)it will wear out the key and pins faster due to increased friction but if the springs a strong enough there won't be a momentary gap.But where can one get the springs.
some say not to worry, I call that BS.Tell that to the people who have been broken into by this method.
Mentioning Kicking in doors, bracking windows that is BS too, Thiefs who do that had YOU as a target no no matter what they get in even with Cameras and Alarm systems.Mentioning this and dismissing the weakness of a lock set seems to me a way of trying to discurage people from protecting them selfs better.
I agree if my home is more secured then my neighbors they will choose his. Most Brake ins are done by Opportunitiest.Being able to get bump key makes way more people Opportunitiest espacially Minors who think it's a joke.There for why not take the opportuity away and install a bump proof lock or make yours bump proof.That puts us at least back to square one before the world knew about bumping.
Installing an alarm system and using yard signs will further lower the risk of being an oportunity.
In my new home I also will be instaling a Video Intercomm to see who is at the door withut opening it. I'm not paranoid nad scared myself but I'm thinking about my wifes safty while I'm not at home.I do not want her do become an opportunety
neither.
It actually did hapen before that a door sales person held the door open and did not want to leave.
For everybody that think there is no need to Improve lock and think they are invincible, why even have a lock at all. Do not dismiss others safty concern
Kraut
Lock Bumping @ Jun 10th 2007 12:09PM
Public service site about lock bumping and how to protect yourself against it!
http://LockBumping.org
Dennis McEntire @ Jul 5th 2007 1:48PM
Actually, spool pins make no difference at all. If you bump a lock with spool pins and can't open it, it's not the spool pins, it's the way the bump key is cut. Since the pins are forced UP and out of the way, spool pins make it no harder to bump than regular pins. I have confirmed this many times over, as well as trying to come up with some means to modify a Kwikset or Schlage to make it bump proof. The locksmith community in general has not come up with a good method that is bump-proof.
TexMex @ Aug 13th 2007 10:25PM
Part 2: http://gadgets.engadget.com/2006/08/25/the-lockdown-locked-but-not-secure-part-2/
James Thornton @ Aug 20th 2007 5:12PM
There is a company called Antibump Locks that specializes in selling bump-proof locks. The website is http://antibumplocks.com
William Antonio @ Jan 24th 2008 8:33AM
Great article Marc,
I wanted to know if any of you can suggest me a good locksmith in New York. So far I've only found them:
http://www.locksmithnewyorkcity.com
Kiwisweeti @ Jan 29th 2008 11:02PM
I know this might sound like a dumb question but, I don't understand all of this lock lingo. So, can you tell me which doorlock for the house I can buy that is the safest, and the key can't be replicated anywhere but only certain places? And where can I buy this lock? Please help. Thankyou so much!!!
Lock Bumper @ Feb 27th 2008 10:23AM
www.LockBumpingShop.com for all your Lock Bumping Needs
Arthur @ Mar 12th 2008 9:27AM
Although bump keying, raking, pick guns, and other mechanical lock defeating techniques are obviously security threats, they pose very little danger to the average person. The average home break-in is performed by unskilled criminals using speed and force as their primary strategies. Smashing locks, breaking windows, and shimming doors are all faster and easier than even the slickest lock-defeat strategies. The only purpose of criminal lock-picking is to silently enter and exit a place without leaving a trace. The criminal already intends to leave a trace- you are probably going to notice when you come home and your TV/Blackberry/PC/jewelry is missing. Lock-picking has few practical applications outside of legitimate locksmithing, and the few people who do pick locks- mostly professional high-value burglars and spies- have advanced techniques and equipment and are unlikely to be deterred by anything that we average people can muster. So, in conclusion, this is an interesting read but it isn't really a matter of concern to us.
keyman @ Jul 7th 2008 2:44PM
It seems that almost any lock can be defeated in some way or another. It’s all a matter of time. So the only thing u can do is delay the burglar so long that he does not have enough time to steal your things. A good way to do this is to install a hidden floor safe like these ones http://www.a1qualitysafe.com/site/408162/page/91221
Hopefully the crook will not find it hidden in the floor and if he does safe locks are always much harder to pick than door locks
keyman @ Jul 7th 2008 3:03PM
It seems that almost any lock can be defeated in some way or another. It’s all a matter of time. So the only thing u can do is delay the burglar so long that he does not have enough time to steal your things. A good way to do this is to install a hidden floor safe like these ones http://www.a1qualitysafe.com/site/408162/page/91221
Hopefully the crook will not find it hidden in the floor and if he does safe locks are always much harder to pick than door locks
Morgan @ Dec 1st 2008 12:06AM
Pickbuster makes your locks bump proof with one application. It is endorsed by the ICL, is used in their locks, and has been proven to make lock bumping completely impractical when to you locks. You can learn more about it at http://www.unbumpable.com.
Thanks!
clintditto @ Feb 27th 2009 10:51PM
i ordered a set of bump keys this weed from http://www.bumpmylock.com just got them today and going to try it out.
Seth Winter @ Mar 20th 2009 11:02PM
This is in reply to Hal Thompson. A female has been stalking me and breaking into my home as well for 15 years. Egyptian, from Cairo, an electrical engineer, very thin, muscular, 62, natural dirty white hair, 5'4", thin lips, olive complexion, brown eyes, middle eastern accent, highly educated, can speak as if very well to do. She never puts anything into her name and only rents rooms. I used Medeco locks for years which she got in constantly, then I added Mul T locks, and some Primus locks, but, it did not help any. She still enters even though I have an ADT system. She picks or bumps her way in, steals my car alarm pads (then devises remotes to control my car alarms), bank deposit lock box keys, keys to the house (extra ones), reaks havoc inside the home and car, with very small but, continual vandalisms and thefts. How does she bypass the ADT system!!!!????!!! Are there devices which negate ADT systems? Which locks are recommended?? She told me she would never do anything traceable. She doesn't knock doors down, shoot locks out, bust through glass or climb through open windows (I keep all windows secured from the inside with locks and nails). She just goes in through the doors.
Dave @ May 21st 2009 6:06PM
Why not make the pins out of srong little magnets? Then the upper and lower pins would stick together when bumped. This shouldn't affect the use of a normal key.