7 ms·

Picking Locks with Audio Technology

55 points by MindGods 6y ago

londons_explore 6y ago
If your home is broken into, but there is no smashed window, most home insurance policies won't pay out. This sort of research will hopefully allow more homeowners to get payouts they are entitled to.
- amelius 6y ago
  Questionable if it's not in the insurance agreement.
- Fezzik 6y ago
  This is not even remotely true. Please point to any legitimate insurance provider that has this exception.
  - londons_explore 6y ago
    There isn't a written exception for it in the policy, but when the claims adjuster comes round they'll use it as an excuse to not pay anything because there's no evidence of theft.
- Chirael 6y ago
  Depending on the value of the claim, if you believe the lock was picked, there are people/companies that can check the lock for forensic evidence of that [1] since picking, raking or bumping leaves very different marks on the pins than normal key usage. [1] https://www.blackhat.com/presentations/bh-usa-09/DATAGRAM/BHUSA09-Datagram-LockpickForensics-PAPER.pdf https://www.blackhat.com/presentations/bh-usa-09/DATAGRAM/BH...
segfaultbuserr 6y ago
Acoustic side-channel attacks on mechanical locks, I guess it's possibly more effective than an acoustic side-channel attack on an electronic lock running inside a computer. Side-channel, side-channel everywhere.
amelius 6y ago
Or make clicking noises when you insert your key?
craftinator 6y ago
Interesting. I wonder if a laser/receiver pointed on the door would give a good enough vibration noise/signal ratio to get the required detail level audio to print a key?
- williamtrask 6y ago
  ... from space ...
petee 6y ago
Given some isolation from prying eyes, a good non-technical method of making a key is to use a blank and grind it by hand. By binding the cylinder and wiggling the key, it leaves marks for each pin that is bound up; grind a little and repeat. Obviously not going to work for certain lock styles with security pins, or Medeco locks (but nor will audio work either, unless you can somehow hear a pin rotating a specific direction)
- Chirael 6y ago
  For anyone who’s interested in this, it’s called impressioning and is really cool. It basically uses the design of the lock (pins pushed down into the keyway by springs, preventing the cylinder from turning) in the attack by using the marks those pins make on a key, to gradually fashion a working key.
CMay 6y ago
The talk on this is here: https://www.youtube.com/watch?v=bxyAa_txM34 https://www.youtube.com/watch?v=bxyAa_txM34
deleted 6y ago
[deleted]
adrianmonk 6y ago
> work out how to surreptitiously acquire the audio from a key insertion Another way: hang a flyer or bag on their door knob. Include a free pen that has a hidden microphone/transmitter in it. People stick things on doors all the time for marketing purposes, so probably not too suspicious.
brudgers 6y ago
Last week some comment linked to a LockPickingLawyer YouTube video and I’ve been binge watching since. Odds are, it is faster just to pick your lock for anyone who knows enough about the type of lock to know the right blank to cut. And access to set up a microphone means access to set up a camera and work from a picture of your key. But with that kind of access, traditional impressioning is probably practical. Anyway https://m.youtube.com/channel/UCm9K6rby98W8JigLoZOh6FQ/videos https://m.youtube.com/channel/UCm9K6rby98W8JigLoZOh6FQ/video...
GuB-42 6y ago
That's an interesting attack. However, it looks like they used it on rather simple lock. These locks could be picked quickly by a moderately experienced picker, and with the right tool, decoded. But most high security locks have some kind of trick: sliders, rotating pins, pin in pins, or simply a rediculous amount of pins. It would be interesting to know how exciting security features in locks could prevent that attack. For example, if two pins are lifted at the same time, how to tell which is which by sound?
jeffbee 6y ago
I hate the way journalists try to make things sound scarier by throwing in 3D printing, as if a new world of criminal technology is upon us. Surely 3D printing is the very worst, and slowest, way to make a key. Nobody has been waiting for 3D printing to enhance their breaking-and-entering game.
noodlesUK 6y ago
I’m not sure what the threat model that this brings is. It’s certainly very cool research, but nothing particularly scary to even the highest security facilities... I can’t really imagine a situation where you can install an audio bug where you can’t also install a video bug to grab a picture of the key...
ipi 6y ago
This is ingenious!

55 points by MindGods 6y ago

If your home is broken into, but there is no smashed window, most home insurance policies won't pay out. This sort of research will hopefully allow more homeowners to get payouts they are entitled to.

amelius 6y ago
Questionable if it's not in the insurance agreement.
Fezzik 6y ago
This is not even remotely true. Please point to any legitimate insurance provider that has this exception.
- londons_explore 6y ago
  There isn't a written exception for it in the policy, but when the claims adjuster comes round they'll use it as an excuse to not pay anything because there's no evidence of theft.
Chirael 6y ago
Depending on the value of the claim, if you believe the lock was picked, there are people/companies that can check the lock for forensic evidence of that [1] since picking, raking or bumping leaves very different marks on the pins than normal key usage. [1] https://www.blackhat.com/presentations/bh-usa-09/DATAGRAM/BHUSA09-Datagram-LockpickForensics-PAPER.pdf https://www.blackhat.com/presentations/bh-usa-09/DATAGRAM/BH...

segfaultbuserr 6y ago

Acoustic side-channel attacks on mechanical locks, I guess it's possibly more effective than an acoustic side-channel attack on an electronic lock running inside a computer. Side-channel, side-channel everywhere.

amelius 6y ago

Or make clicking noises when you insert your key?

craftinator 6y ago

Interesting. I wonder if a laser/receiver pointed on the door would give a good enough vibration noise/signal ratio to get the required detail level audio to print a key?

williamtrask 6y ago
... from space ...

petee 6y ago

Given some isolation from prying eyes, a good non-technical method of making a key is to use a blank and grind it by hand. By binding the cylinder and wiggling the key, it leaves marks for each pin that is bound up; grind a little and repeat. Obviously not going to work for certain lock styles with security pins, or Medeco locks (but nor will audio work either, unless you can somehow hear a pin rotating a specific direction)

Chirael 6y ago
For anyone who’s interested in this, it’s called impressioning and is really cool. It basically uses the design of the lock (pins pushed down into the keyway by springs, preventing the cylinder from turning) in the attack by using the marks those pins make on a key, to gradually fashion a working key.

CMay 6y ago

The talk on this is here: https://www.youtube.com/watch?v=bxyAa_txM34 https://www.youtube.com/watch?v=bxyAa_txM34

deleted 6y ago

[deleted]

adrianmonk 6y ago

> work out how to surreptitiously acquire the audio from a key insertion Another way: hang a flyer or bag on their door knob. Include a free pen that has a hidden microphone/transmitter in it. People stick things on doors all the time for marketing purposes, so probably not too suspicious.

brudgers 6y ago

Last week some comment linked to a LockPickingLawyer YouTube video and I’ve been binge watching since. Odds are, it is faster just to pick your lock for anyone who knows enough about the type of lock to know the right blank to cut. And access to set up a microphone means access to set up a camera and work from a picture of your key. But with that kind of access, traditional impressioning is probably practical. Anyway https://m.youtube.com/channel/UCm9K6rby98W8JigLoZOh6FQ/videos https://m.youtube.com/channel/UCm9K6rby98W8JigLoZOh6FQ/video...

GuB-42 6y ago

That's an interesting attack. However, it looks like they used it on rather simple lock. These locks could be picked quickly by a moderately experienced picker, and with the right tool, decoded. But most high security locks have some kind of trick: sliders, rotating pins, pin in pins, or simply a rediculous amount of pins. It would be interesting to know how exciting security features in locks could prevent that attack. For example, if two pins are lifted at the same time, how to tell which is which by sound?

jeffbee 6y ago

I hate the way journalists try to make things sound scarier by throwing in 3D printing, as if a new world of criminal technology is upon us. Surely 3D printing is the very worst, and slowest, way to make a key. Nobody has been waiting for 3D printing to enhance their breaking-and-entering game.

noodlesUK 6y ago

I’m not sure what the threat model that this brings is. It’s certainly very cool research, but nothing particularly scary to even the highest security facilities... I can’t really imagine a situation where you can install an audio bug where you can’t also install a video bug to grab a picture of the key...

ipi 6y ago

This is ingenious!