SlideShare une entreprise Scribd logo
1  sur  43
OPENING LOCKS IN FIVE
SECONDS OR LESS:
Is it a real threat to security?
Bumping as a method of covert entry
©2006 Marc Weber Tobias
LOCKS PROVIDE SECURITY
♦ Protect doors, safes and barriers from being
  opened
♦ They control movement of barriers to entry
♦ Relied upon as first level of security
♦ Most popular: pin tumbler designs
TYPES OF LOCKS
♦ WARDED
♦ LEVER
♦ WAFER AND DISK TUMBLER
♦ PIN TUMBLER
♦ HYBRID: COMBINED TECHNOLOGIES
♦ COMBINATIONMOST OFTEN
  UTILIZED
♦ LEVER (Europe)
♦ PIN TUMBLER
PIN TUMBLER LOCK

♦ 4000 year old Egyptian design
♦ Re-invented by Linus Yale in 1860
♦ Modern pin tumbler: split pins
♦ 95% of locks
♦ Low to high security applications
♦ All based upon Yale design
   – Billions of locks
   – Many different configurations
OPENING LOCKS:
Covert Methods of Entry
♦ PICKING
♦ IMPRESSIONING
♦ DECODING
♦ EXTRAPOLATION OF TMK
♦ BUMPING
  – Move all pins to shear line together or
    separately
  – Allow plug to turn without obstruction
CMOE AND SECURITY RATING
♦ SPECIAL TOOLS
♦ TRAINING AND EXPERTISE
♦ TIME REQUIRED
♦ RELIABILITY AND REPEATABILITY
  OF RESULTS
♦ DAMAGE TO LOCKS
♦ FORENSIC TRACE
WHAT IS SECURITY IN A LOCK
♦ Perfect world: cannot open without correct
  key or code;
♦ Reality: Levels of difficulty or resistance to
  forced and covert entry techniques
  – Type of mechanism
  – Secondary locking systems
  – Security enhancements
BUMPING: A METHOD OF
COVERT ENTRY
 –   METHOD TO OPEN LOCKS IN SECONDS
 –   FASTEST AND EASIEST WAY TO OPEN
 –   VIRTUALLY NO SKILL REQUIRED
 –   EASY TO LEARN
 –   NO SPECIAL TOOLS
 –   95% OF LOCKS CAN BE BYPASSED
 –   OPEN SOME HIGH SECURITY LOCKS
 –   USUALLY NO TRACE OR DAMAGE
 –   RELIABILITY OF RESULTS
 –   REPEATABILITY OF THE PROCESS
YALE + NEWTON = BUMPING
♦ VIRTUALLY ALL TRADITIONAL
  YALE LOCKS CAN BE OPENED BY
  BUMPING
♦ RELIABLE
♦ REPEATABLE
♦ SIMPLE TO LEARN
THE PHYSICS OF BUMPING:
SIR ISAAC NEWTON: 1650
♦ THE FATHER OF
  BUMPING OF
  LOCKS
♦ THIRD LAW OF
  MOTION:
  – “For every action,
    there is an equal and
    opposite reaction”
1860: YALE PIN TUMBLER
LOCK
♦ Modernized the
  Egyptian single pin
  design
♦ Utilized two pins for
  locking
♦ Double-detainer
  theory of locking
♦ Created shear line
MODERN PIN TUMBLER LOCK
BUMPING: BACKGROUND
♦ DENMARK, 25 YEARS AGO
♦ 999, CODE 12, PERCUSSION KEY
♦ DEVELOPED BY LOCKSMITHS TO
  RAP OPEN A CYLINDER
♦ ORIGINAL TECHNIQUE HAS BEEN
  IMPROVED UPON TO MAKE
  BUMPING A SIGNIFICANT THREAT
BUMPING: SIX CRITICAL
ELEMENTS
1. KEY WITH CORRECT KEYWAY
2. CUT TO ALL “9” DEPTHS
3. BUMPING TECHNIQUE
4. METHOD TO APPLY ENERGY TO
   PINS
5. TORQUE AND TIMING
6. TRAINING
1: KEY WITH CORRECT
KEYWAY
♦ SOURCES
   – COMMERCIAL STORES
   – LOCKSMITHS
   – INTERNET
   – KEY TO ANY LOCK IN A FACILITY
   – MODIFIED KEY: MILLED BLANK
2: CUT TO ALL “9” DEPTHS
♦ HAND-CUT WITH FILE
♦ CODE CUT WITH PUNCH OR MACHINE
♦ INTERNET SITES
   – ALL KEYS OF SAME KEYWAY CAN BE
     MADE TO WORK
NEGATIVE SHOULDER
BUMP KEYS
3: BUMPING TECHNIQUE
♦ TWO TECHNIQUES FOR BUMPING
   – WITHDRAW KEY ONE POSITION
    • NO MODIFICATION REQUIRED
  – NEGATIVE SHOULDER METHOD
    • REDUCE SHOULDER BY .25 mm


♦ DESIGN OF KEY DEPENDS UPON
 TECHNIQUE OF BUMPING
BUMPING: INSERT THE KEY
BUMPING: APPLY ENERGY
HOW BUMPING WORKS
♦ DOLEV MODEL
4: METHOD TO APPLY ENERGY
♦ STRIKE HEAD OF KEY
   – “TOMAHAWK”
   – SCREWDRIVER HANDLE
   – WOODEN OR PLASTIC MALLET
   – WOODEN STICK
   – OTHER TOOLS
5: TORQUE + TIMING
♦ TWO METHODS TO APPLY TORQUE
♦ REQUIRED TO TURN THE PLUG AT THE
 RIGHT MOMENT
  – TORQUE + ENERGY TO KEY
  – ENERGY TO KEY THEN TORQUE
6: TRAINING
♦ EASY TO LEARN
♦ LESS THAN ONE HOUR
♦ NETHERLANDS TESTS
♦ KELO-TV REPORTER, TEN SECONDS
BUMPING DEMONSTRATION
♦ INSERT BUMP KEY
   – TWO METHODS OF BUMPING
    • Withdraw one position and strike
    • Negative shoulder method
♦ APPLY TORQUE
♦ APPLY ENERGY TO HEAD OF KEY
♦ BOUNCE PINS
♦ TURN THE PLUG
PIN TUMBLER LOCKS THAT
CANNOT BE BUMPED
♦ SIDEBAR LOCKS
   – SCHLAGE PRIMUS
   – ASSA
   – MEDECO
   – OTHER SIDEBAR DESIGNS
SIDEBAR LOCKS - ASSA
SIDEBAR LOCKS - PRIMUS
EVVA 3KS SLIDER
MUL-T-LOCK INTERACTIVE
GENERIC LOCKS THAT
CANNOT BE BUMPED OPEN
♦ WARDED
♦ LEVER
♦ WAFER AND DISK WAFER
♦ COMBINATION
WARDED, LEVER, WAFER
COMPLICATING FACTORS
♦ SECONDARY LOCKING MECHANISM
   – SIDEBARS
   – INTERACTIVE COMPONENTS
♦ DIRT AND DEBRIS
♦ SPECIAL PINS
♦ BROKEN SPRINGS
♦ PIN STACK LENGTH
♦ RESTRICTED BLANKS
♦ REQUIRES MORE THAN ONE MINUTE
REAL WORLD: USPS & UPS
♦ POST OFFICE AND MBE RENTAL
  BOXES WORLDWIDE
♦ MILLIONS OF USERS AT RISK
♦ INTEGRITY AND SECURITY OF MAIL
 –   ID THEFT
 –   SURVEILLANCE OF MAIL
 –   INTERCEPTION
 –   EXPLOSIVES AND DANGEROUS
     CHEMICALS
USPS: 38,000 LOCATIONS
5,000,000 USPS RENTED BOXES
POSTAL LOCK SECURITY
♦ RESTRICTED BLANKS BY FEDERAL
  STATUTE
♦ FIVE PIN TUMBLER LOCKS
♦ INSIDE OF POST OFFICE OR UPS
  –   BLANKS AND LOCKS ON EBAY
  –   ONE DOLLAR LOCKS
  –   EVERY KEY CAN BE A BUMP KEY
  –   NO INTERNAL SECURITY
U.S. LAWS
♦ 60 YEAR OLD FEDERAL STATUTE
  CONTROLS “NON-MAILABLE
  MATTER”
♦ BUMP KEYS EXEMPTED
♦ INTERNET SITES SELLING PRE-CUT
  BUMP KEYS AND “TOMAHAWK”
THE THREAT FROM BUMP
KEYS
♦ IF CAN OBTAIN A KEY THAT FITS
 THE LOCK THAT HAS ALREADY
 BEEN CUT
  – EASY TO LEARN BUMPING
  – ANYONE CAN OPEN A LOCK
PREVENTING BUMPING
♦ SPECIAL PINS (DOLEV AND OTHERS)
♦ SECONDARY SECURITY: SIDEBARS
♦ SPRING BIAS DIFFERENCE
♦ SHORTER BORES
♦ EMPLOY CERTAIN HIGH SECURITY
 LOCKIS
NEEDED LEGISLATION
♦ PREVENT TRAFFICKING IN PRE-CUT
  BUMP KEYS
♦ CHANGE POSTAL REGULATIONS
© 2006 Marc Weber Tobias
         mwtobias@security.org
ADDITIONAL REFERENCE MATERIAL
www.security.org
   – OPENING LOCKS BY BUMPING IN FIVE SECONDS OR
     LESS: IS IT REALLY A THREAT TO PHYSICAL
     SECURITY?
       • www.security.org/bumping_040206.pdf
   – BUMPING OF LOCKS: LEGAL ISSUES IN THE U.S.
       • www.security.org/bumping_legal_mwt.pdf
♦ Locks, Safes and Security: An International Police
  Reference, Marc Weber Tobias, 2001
♦ LSS+ The Multimedia Edition, 2006
www.toool.nl

Contenu connexe

Dernier

The basics of sentences session 2pptx copy.pptx
The basics of sentences session 2pptx copy.pptxThe basics of sentences session 2pptx copy.pptx
The basics of sentences session 2pptx copy.pptx
heathfieldcps1
 
Beyond the EU: DORA and NIS 2 Directive's Global Impact
Beyond the EU: DORA and NIS 2 Directive's Global ImpactBeyond the EU: DORA and NIS 2 Directive's Global Impact
Beyond the EU: DORA and NIS 2 Directive's Global Impact
PECB
 
Russian Escort Service in Delhi 11k Hotel Foreigner Russian Call Girls in Delhi
Russian Escort Service in Delhi 11k Hotel Foreigner Russian Call Girls in DelhiRussian Escort Service in Delhi 11k Hotel Foreigner Russian Call Girls in Delhi
Russian Escort Service in Delhi 11k Hotel Foreigner Russian Call Girls in Delhi
kauryashika82
 

Dernier (20)

APM Welcome, APM North West Network Conference, Synergies Across Sectors
APM Welcome, APM North West Network Conference, Synergies Across SectorsAPM Welcome, APM North West Network Conference, Synergies Across Sectors
APM Welcome, APM North West Network Conference, Synergies Across Sectors
 
Call Girls in Dwarka Mor Delhi Contact Us 9654467111
Call Girls in Dwarka Mor Delhi Contact Us 9654467111Call Girls in Dwarka Mor Delhi Contact Us 9654467111
Call Girls in Dwarka Mor Delhi Contact Us 9654467111
 
Mattingly "AI & Prompt Design: Structured Data, Assistants, & RAG"
Mattingly "AI & Prompt Design: Structured Data, Assistants, & RAG"Mattingly "AI & Prompt Design: Structured Data, Assistants, & RAG"
Mattingly "AI & Prompt Design: Structured Data, Assistants, & RAG"
 
Q4-W6-Restating Informational Text Grade 3
Q4-W6-Restating Informational Text Grade 3Q4-W6-Restating Informational Text Grade 3
Q4-W6-Restating Informational Text Grade 3
 
social pharmacy d-pharm 1st year by Pragati K. Mahajan
social pharmacy d-pharm 1st year by Pragati K. Mahajansocial pharmacy d-pharm 1st year by Pragati K. Mahajan
social pharmacy d-pharm 1st year by Pragati K. Mahajan
 
The basics of sentences session 2pptx copy.pptx
The basics of sentences session 2pptx copy.pptxThe basics of sentences session 2pptx copy.pptx
The basics of sentences session 2pptx copy.pptx
 
9548086042 for call girls in Indira Nagar with room service
9548086042  for call girls in Indira Nagar  with room service9548086042  for call girls in Indira Nagar  with room service
9548086042 for call girls in Indira Nagar with room service
 
Key note speaker Neum_Admir Softic_ENG.pdf
Key note speaker Neum_Admir Softic_ENG.pdfKey note speaker Neum_Admir Softic_ENG.pdf
Key note speaker Neum_Admir Softic_ENG.pdf
 
Beyond the EU: DORA and NIS 2 Directive's Global Impact
Beyond the EU: DORA and NIS 2 Directive's Global ImpactBeyond the EU: DORA and NIS 2 Directive's Global Impact
Beyond the EU: DORA and NIS 2 Directive's Global Impact
 
Mattingly "AI & Prompt Design: The Basics of Prompt Design"
Mattingly "AI & Prompt Design: The Basics of Prompt Design"Mattingly "AI & Prompt Design: The Basics of Prompt Design"
Mattingly "AI & Prompt Design: The Basics of Prompt Design"
 
microwave assisted reaction. General introduction
microwave assisted reaction. General introductionmicrowave assisted reaction. General introduction
microwave assisted reaction. General introduction
 
Introduction to Nonprofit Accounting: The Basics
Introduction to Nonprofit Accounting: The BasicsIntroduction to Nonprofit Accounting: The Basics
Introduction to Nonprofit Accounting: The Basics
 
Russian Escort Service in Delhi 11k Hotel Foreigner Russian Call Girls in Delhi
Russian Escort Service in Delhi 11k Hotel Foreigner Russian Call Girls in DelhiRussian Escort Service in Delhi 11k Hotel Foreigner Russian Call Girls in Delhi
Russian Escort Service in Delhi 11k Hotel Foreigner Russian Call Girls in Delhi
 
BAG TECHNIQUE Bag technique-a tool making use of public health bag through wh...
BAG TECHNIQUE Bag technique-a tool making use of public health bag through wh...BAG TECHNIQUE Bag technique-a tool making use of public health bag through wh...
BAG TECHNIQUE Bag technique-a tool making use of public health bag through wh...
 
Presentation by Andreas Schleicher Tackling the School Absenteeism Crisis 30 ...
Presentation by Andreas Schleicher Tackling the School Absenteeism Crisis 30 ...Presentation by Andreas Schleicher Tackling the School Absenteeism Crisis 30 ...
Presentation by Andreas Schleicher Tackling the School Absenteeism Crisis 30 ...
 
SOCIAL AND HISTORICAL CONTEXT - LFTVD.pptx
SOCIAL AND HISTORICAL CONTEXT - LFTVD.pptxSOCIAL AND HISTORICAL CONTEXT - LFTVD.pptx
SOCIAL AND HISTORICAL CONTEXT - LFTVD.pptx
 
Sports & Fitness Value Added Course FY..
Sports & Fitness Value Added Course FY..Sports & Fitness Value Added Course FY..
Sports & Fitness Value Added Course FY..
 
Accessible design: Minimum effort, maximum impact
Accessible design: Minimum effort, maximum impactAccessible design: Minimum effort, maximum impact
Accessible design: Minimum effort, maximum impact
 
A Critique of the Proposed National Education Policy Reform
A Critique of the Proposed National Education Policy ReformA Critique of the Proposed National Education Policy Reform
A Critique of the Proposed National Education Policy Reform
 
Nutritional Needs Presentation - HLTH 104
Nutritional Needs Presentation - HLTH 104Nutritional Needs Presentation - HLTH 104
Nutritional Needs Presentation - HLTH 104
 

En vedette

Social Media Marketing Trends 2024 // The Global Indie Insights
Social Media Marketing Trends 2024 // The Global Indie InsightsSocial Media Marketing Trends 2024 // The Global Indie Insights
Social Media Marketing Trends 2024 // The Global Indie Insights
Kurio // The Social Media Age(ncy)
 

En vedette (20)

AI Trends in Creative Operations 2024 by Artwork Flow.pdf
AI Trends in Creative Operations 2024 by Artwork Flow.pdfAI Trends in Creative Operations 2024 by Artwork Flow.pdf
AI Trends in Creative Operations 2024 by Artwork Flow.pdf
 
Skeleton Culture Code
Skeleton Culture CodeSkeleton Culture Code
Skeleton Culture Code
 
PEPSICO Presentation to CAGNY Conference Feb 2024
PEPSICO Presentation to CAGNY Conference Feb 2024PEPSICO Presentation to CAGNY Conference Feb 2024
PEPSICO Presentation to CAGNY Conference Feb 2024
 
Content Methodology: A Best Practices Report (Webinar)
Content Methodology: A Best Practices Report (Webinar)Content Methodology: A Best Practices Report (Webinar)
Content Methodology: A Best Practices Report (Webinar)
 
How to Prepare For a Successful Job Search for 2024
How to Prepare For a Successful Job Search for 2024How to Prepare For a Successful Job Search for 2024
How to Prepare For a Successful Job Search for 2024
 
Social Media Marketing Trends 2024 // The Global Indie Insights
Social Media Marketing Trends 2024 // The Global Indie InsightsSocial Media Marketing Trends 2024 // The Global Indie Insights
Social Media Marketing Trends 2024 // The Global Indie Insights
 
Trends In Paid Search: Navigating The Digital Landscape In 2024
Trends In Paid Search: Navigating The Digital Landscape In 2024Trends In Paid Search: Navigating The Digital Landscape In 2024
Trends In Paid Search: Navigating The Digital Landscape In 2024
 
5 Public speaking tips from TED - Visualized summary
5 Public speaking tips from TED - Visualized summary5 Public speaking tips from TED - Visualized summary
5 Public speaking tips from TED - Visualized summary
 
ChatGPT and the Future of Work - Clark Boyd
ChatGPT and the Future of Work - Clark Boyd ChatGPT and the Future of Work - Clark Boyd
ChatGPT and the Future of Work - Clark Boyd
 
Getting into the tech field. what next
Getting into the tech field. what next Getting into the tech field. what next
Getting into the tech field. what next
 
Google's Just Not That Into You: Understanding Core Updates & Search Intent
Google's Just Not That Into You: Understanding Core Updates & Search IntentGoogle's Just Not That Into You: Understanding Core Updates & Search Intent
Google's Just Not That Into You: Understanding Core Updates & Search Intent
 
How to have difficult conversations
How to have difficult conversations How to have difficult conversations
How to have difficult conversations
 
Introduction to Data Science
Introduction to Data ScienceIntroduction to Data Science
Introduction to Data Science
 
Time Management & Productivity - Best Practices
Time Management & Productivity -  Best PracticesTime Management & Productivity -  Best Practices
Time Management & Productivity - Best Practices
 
The six step guide to practical project management
The six step guide to practical project managementThe six step guide to practical project management
The six step guide to practical project management
 
Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...
Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...
Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...
 
Unlocking the Power of ChatGPT and AI in Testing - A Real-World Look, present...
Unlocking the Power of ChatGPT and AI in Testing - A Real-World Look, present...Unlocking the Power of ChatGPT and AI in Testing - A Real-World Look, present...
Unlocking the Power of ChatGPT and AI in Testing - A Real-World Look, present...
 
12 Ways to Increase Your Influence at Work
12 Ways to Increase Your Influence at Work12 Ways to Increase Your Influence at Work
12 Ways to Increase Your Influence at Work
 
ChatGPT webinar slides
ChatGPT webinar slidesChatGPT webinar slides
ChatGPT webinar slides
 
More than Just Lines on a Map: Best Practices for U.S Bike Routes
More than Just Lines on a Map: Best Practices for U.S Bike RoutesMore than Just Lines on a Map: Best Practices for U.S Bike Routes
More than Just Lines on a Map: Best Practices for U.S Bike Routes
 

Abrir Cerraduras en 5 segundos (English)

  • 1. OPENING LOCKS IN FIVE SECONDS OR LESS: Is it a real threat to security? Bumping as a method of covert entry ©2006 Marc Weber Tobias
  • 2. LOCKS PROVIDE SECURITY ♦ Protect doors, safes and barriers from being opened ♦ They control movement of barriers to entry ♦ Relied upon as first level of security ♦ Most popular: pin tumbler designs
  • 3. TYPES OF LOCKS ♦ WARDED ♦ LEVER ♦ WAFER AND DISK TUMBLER ♦ PIN TUMBLER ♦ HYBRID: COMBINED TECHNOLOGIES ♦ COMBINATIONMOST OFTEN UTILIZED ♦ LEVER (Europe) ♦ PIN TUMBLER
  • 4. PIN TUMBLER LOCK ♦ 4000 year old Egyptian design ♦ Re-invented by Linus Yale in 1860 ♦ Modern pin tumbler: split pins ♦ 95% of locks ♦ Low to high security applications ♦ All based upon Yale design – Billions of locks – Many different configurations
  • 5. OPENING LOCKS: Covert Methods of Entry ♦ PICKING ♦ IMPRESSIONING ♦ DECODING ♦ EXTRAPOLATION OF TMK ♦ BUMPING – Move all pins to shear line together or separately – Allow plug to turn without obstruction
  • 6. CMOE AND SECURITY RATING ♦ SPECIAL TOOLS ♦ TRAINING AND EXPERTISE ♦ TIME REQUIRED ♦ RELIABILITY AND REPEATABILITY OF RESULTS ♦ DAMAGE TO LOCKS ♦ FORENSIC TRACE
  • 7. WHAT IS SECURITY IN A LOCK ♦ Perfect world: cannot open without correct key or code; ♦ Reality: Levels of difficulty or resistance to forced and covert entry techniques – Type of mechanism – Secondary locking systems – Security enhancements
  • 8. BUMPING: A METHOD OF COVERT ENTRY – METHOD TO OPEN LOCKS IN SECONDS – FASTEST AND EASIEST WAY TO OPEN – VIRTUALLY NO SKILL REQUIRED – EASY TO LEARN – NO SPECIAL TOOLS – 95% OF LOCKS CAN BE BYPASSED – OPEN SOME HIGH SECURITY LOCKS – USUALLY NO TRACE OR DAMAGE – RELIABILITY OF RESULTS – REPEATABILITY OF THE PROCESS
  • 9. YALE + NEWTON = BUMPING ♦ VIRTUALLY ALL TRADITIONAL YALE LOCKS CAN BE OPENED BY BUMPING ♦ RELIABLE ♦ REPEATABLE ♦ SIMPLE TO LEARN
  • 10. THE PHYSICS OF BUMPING: SIR ISAAC NEWTON: 1650 ♦ THE FATHER OF BUMPING OF LOCKS ♦ THIRD LAW OF MOTION: – “For every action, there is an equal and opposite reaction”
  • 11. 1860: YALE PIN TUMBLER LOCK ♦ Modernized the Egyptian single pin design ♦ Utilized two pins for locking ♦ Double-detainer theory of locking ♦ Created shear line
  • 13. BUMPING: BACKGROUND ♦ DENMARK, 25 YEARS AGO ♦ 999, CODE 12, PERCUSSION KEY ♦ DEVELOPED BY LOCKSMITHS TO RAP OPEN A CYLINDER ♦ ORIGINAL TECHNIQUE HAS BEEN IMPROVED UPON TO MAKE BUMPING A SIGNIFICANT THREAT
  • 14. BUMPING: SIX CRITICAL ELEMENTS 1. KEY WITH CORRECT KEYWAY 2. CUT TO ALL “9” DEPTHS 3. BUMPING TECHNIQUE 4. METHOD TO APPLY ENERGY TO PINS 5. TORQUE AND TIMING 6. TRAINING
  • 15. 1: KEY WITH CORRECT KEYWAY ♦ SOURCES – COMMERCIAL STORES – LOCKSMITHS – INTERNET – KEY TO ANY LOCK IN A FACILITY – MODIFIED KEY: MILLED BLANK
  • 16. 2: CUT TO ALL “9” DEPTHS ♦ HAND-CUT WITH FILE ♦ CODE CUT WITH PUNCH OR MACHINE ♦ INTERNET SITES – ALL KEYS OF SAME KEYWAY CAN BE MADE TO WORK
  • 19. 3: BUMPING TECHNIQUE ♦ TWO TECHNIQUES FOR BUMPING – WITHDRAW KEY ONE POSITION • NO MODIFICATION REQUIRED – NEGATIVE SHOULDER METHOD • REDUCE SHOULDER BY .25 mm ♦ DESIGN OF KEY DEPENDS UPON TECHNIQUE OF BUMPING
  • 22. HOW BUMPING WORKS ♦ DOLEV MODEL
  • 23. 4: METHOD TO APPLY ENERGY ♦ STRIKE HEAD OF KEY – “TOMAHAWK” – SCREWDRIVER HANDLE – WOODEN OR PLASTIC MALLET – WOODEN STICK – OTHER TOOLS
  • 24. 5: TORQUE + TIMING ♦ TWO METHODS TO APPLY TORQUE ♦ REQUIRED TO TURN THE PLUG AT THE RIGHT MOMENT – TORQUE + ENERGY TO KEY – ENERGY TO KEY THEN TORQUE
  • 25. 6: TRAINING ♦ EASY TO LEARN ♦ LESS THAN ONE HOUR ♦ NETHERLANDS TESTS ♦ KELO-TV REPORTER, TEN SECONDS
  • 26. BUMPING DEMONSTRATION ♦ INSERT BUMP KEY – TWO METHODS OF BUMPING • Withdraw one position and strike • Negative shoulder method ♦ APPLY TORQUE ♦ APPLY ENERGY TO HEAD OF KEY ♦ BOUNCE PINS ♦ TURN THE PLUG
  • 27. PIN TUMBLER LOCKS THAT CANNOT BE BUMPED ♦ SIDEBAR LOCKS – SCHLAGE PRIMUS – ASSA – MEDECO – OTHER SIDEBAR DESIGNS
  • 29. SIDEBAR LOCKS - PRIMUS
  • 32. GENERIC LOCKS THAT CANNOT BE BUMPED OPEN ♦ WARDED ♦ LEVER ♦ WAFER AND DISK WAFER ♦ COMBINATION
  • 34. COMPLICATING FACTORS ♦ SECONDARY LOCKING MECHANISM – SIDEBARS – INTERACTIVE COMPONENTS ♦ DIRT AND DEBRIS ♦ SPECIAL PINS ♦ BROKEN SPRINGS ♦ PIN STACK LENGTH ♦ RESTRICTED BLANKS ♦ REQUIRES MORE THAN ONE MINUTE
  • 35. REAL WORLD: USPS & UPS ♦ POST OFFICE AND MBE RENTAL BOXES WORLDWIDE ♦ MILLIONS OF USERS AT RISK ♦ INTEGRITY AND SECURITY OF MAIL – ID THEFT – SURVEILLANCE OF MAIL – INTERCEPTION – EXPLOSIVES AND DANGEROUS CHEMICALS
  • 38. POSTAL LOCK SECURITY ♦ RESTRICTED BLANKS BY FEDERAL STATUTE ♦ FIVE PIN TUMBLER LOCKS ♦ INSIDE OF POST OFFICE OR UPS – BLANKS AND LOCKS ON EBAY – ONE DOLLAR LOCKS – EVERY KEY CAN BE A BUMP KEY – NO INTERNAL SECURITY
  • 39. U.S. LAWS ♦ 60 YEAR OLD FEDERAL STATUTE CONTROLS “NON-MAILABLE MATTER” ♦ BUMP KEYS EXEMPTED ♦ INTERNET SITES SELLING PRE-CUT BUMP KEYS AND “TOMAHAWK”
  • 40. THE THREAT FROM BUMP KEYS ♦ IF CAN OBTAIN A KEY THAT FITS THE LOCK THAT HAS ALREADY BEEN CUT – EASY TO LEARN BUMPING – ANYONE CAN OPEN A LOCK
  • 41. PREVENTING BUMPING ♦ SPECIAL PINS (DOLEV AND OTHERS) ♦ SECONDARY SECURITY: SIDEBARS ♦ SPRING BIAS DIFFERENCE ♦ SHORTER BORES ♦ EMPLOY CERTAIN HIGH SECURITY LOCKIS
  • 42. NEEDED LEGISLATION ♦ PREVENT TRAFFICKING IN PRE-CUT BUMP KEYS ♦ CHANGE POSTAL REGULATIONS
  • 43. © 2006 Marc Weber Tobias mwtobias@security.org ADDITIONAL REFERENCE MATERIAL www.security.org – OPENING LOCKS BY BUMPING IN FIVE SECONDS OR LESS: IS IT REALLY A THREAT TO PHYSICAL SECURITY? • www.security.org/bumping_040206.pdf – BUMPING OF LOCKS: LEGAL ISSUES IN THE U.S. • www.security.org/bumping_legal_mwt.pdf ♦ Locks, Safes and Security: An International Police Reference, Marc Weber Tobias, 2001 ♦ LSS+ The Multimedia Edition, 2006 www.toool.nl