Cybersecurity
By Marc Weber Tobias
Noted security expert Marc Weber Tobias contributes a new column, The Lockdown, exposing the shoddy security you may depend on. Locks that are not at riskIn yesterday's column, I set up key bumping -- what it is, how to do it, what it means for most anyone who relies on a lock for their safety and security. Now, let's get into generic locking mechanisms that cannot be bumped. There are several and all share a common trait; none of them have a split set of moving components, like pin tumblers do. Thus, warded, lever, wafer, magnetic, and disk locks cannot be bumped open. (Neither can laser-track vehicle locks, as they're really made of sliders, disks or wafers.)Warded locks are used in cheap padlocks and old hotel room doors. They are neither secure nor very prevalent.Wafer locks are used in many low security applications, mainly on cabinets, desks, showcases, inexpensive padlocks, alarm panels, vending machines, elevators, filing cabinets and many other venues. Interestingly, they can be easily picked but are immune to bumping. Lever locks can be found on blue postal collection boxes and access for groups of mailboxes and key keepers in apartment complexes that are accessed by the postal service. They are also the primary lock for safe deposit boxes and high security safes and vaults, primarily in Europe and other countries. Again, lever locks cannot be opened by bumping but may be picked and decoded.Disk locks, such as employed by Abloy, likewise cannot be bumped. Their internal design resembles a combination lock and they can be very secure, although there are decoding tools for some models. Like Bic pens.Locks that employ sliders, such as the Evva 3KS are immune from bumping. I note the 3KS which is produced in Austria and very popular in Europe. This and similar slider locks are particularly secure against most forms of attack. Similar technology is employed in several automobiles. Locks that are at riskWhat are the types of generic locking mechanism that can be opened by bumping? The answer is simple: almost any conventional pin tumbler lock. So what does that mean? Virtually any lock that employs split pin tumblers can be rapidly compromised by bumping. That list would include low to high security conventional designs, but what does "conventional" mean? It denotes any pin tumbler mechanism that does not employ secondary locking systems, such as sidebars. Remember that sidebars in and of themselves do not prevent the lock from being bumped; they just may make it more difficult and require additional information. It all depends upon the mechanical design of the lock.As I stated earlier, any pin tumbler lock that utilizes two or more moving pins within each chamber is at risk. Door locks, post office locks, file cabinet locks, access control override locks, and padlocks. All of them can be bumped if you have the key that will fit the keyway and has been properly cut to all "9"s. Are there exceptions? Yes. Can every conventional lock be bumped open? No, but statistically, a very high percentage can. As detailed in my white paper, there are complicating factors which may make the process difficult or impossible.You may be asking if conventional lock manufacturers have implemented designs to stop or frustrate bumping. Might these include measures such as the use of security pins (mushroom, spool, serrated or other designs), increasing the number of pin tumblers within a given cylinder, employing removable core locks, or increasing spring bias on some or all of the pins? What about making one or more of the bores shorter than the rest? How about employing interactive elements like are used by Mul-T-Lock? Don't worry if you don't know what any of that means, because the simple answer is that none of these countermeasures are really effective. There have been some patents granted for anti-bumping pins, notably to Moshe Dolev, the co-inventor of Mul-T-Lock in Israel, and to Evva in Austria. Some locks do have anti-bump technology, but some of these schemes can often be defeated. In fact, my original White Paper on this subject has been revised after I did extensive testing on some cylinders and found that what was believed to present an obstacle to bumping in fact did not. So, the short answer is that not much is effective against the problem, unless you utilize certain high security mechanisms.
By Marc Weber Tobias
Read More
