Videos: picking tubular bike locks with a bic pen

[Chucklz]

I'm sure most people here have realized that this impressioning/opening technique stems at least, in part from the security.org aticle on Kensington locks, and of course from Barry Wels' demonstration at HOPE. Obviously people were/are paying attention and have been thinking and extending techniques. And now, I have read an article in the Boston Herald which assumes that the "thieves" were the ones to develop and share this technique. Looks like we all might have some interesting times ahead. Lets take the time to educate the currently fearful public about what it is that we actually do, and what we don't do. If we don't, well our treatment, and already tenuous acceptance in some parts of the world will surely suffer.

[Romstar]

The American news media has always had an "Us vs. Them" attitude, and a very tennuous idea of who constitutes "THEM".

The real issue has always been sales and driving those sales with paranoia.

The "Us" group believes that nice, normal upstanding citizens have no business, or right to know how to open locks without a key. That sort of "dangerous" knowledge is only for police, locksmiths and Oooohhhh, theives. The notorius "THEM".

The average middle age, middle class, middle American white person is scared out of their mind on a constant basis purely because we have created a nation of fear. A nation that is just as afraid of their neighbors as they are of terrorists.

The media has been promoting that attitude for over 100 years, and maybe longer precisely for two reasons.
1. It sells advertising time, and
2. It reassures the scared folks that there really IS a reason to be afraid.

As a direct result of this inate paranoia, and the business of fear any activity that is outside of the so-called norm is purely the realm of the mysterious and scary "THEM" that you read about every day in the paper, and see on the news in the evening.

Never mind that these locks were poorly designed, and even pooly built. The simple fact is that the "Us" crowd very much want to believe that they are safe being closed doors, and their locks. Recently in many jurristictions new laws have been put into palce to deal with the huge increase of injurous and sometimes deadly home invasions.

The crux of the matter though doesn't lie with the hacker community, the lock picking hobby community, locksmith's or worse thieves (who by the way, did NOT figure this out on their own) but more accurately with the lock makers themselves.

I said these locks were poorly designed, but I didn't say why. It wasn't a mistake. It was a consession made to ease of manufacture, and all done in the name of saving 15 cents on the cost of each lock at the time of manufacture.

The simple facts of the matter are plainly there for anyone who wants to see them. Businesses attempting to make a few ore dollars all at the cost of the safety and security of their own product. The worst example of security through obscurity.

To make matters worse, the news media will never actually focus on the company and their greed, but rather on the shadowdy "THEM" and their constant efforts to undermine the safety and security of law abiding Americans. More fodder for the already scared and nervous out there. Never mind that the average thief is at a complete loss as to how to figure out opening a lock.

To me, it's not shocking, or even laughable. It's just plain sad.

Romstar

[MrB]

Hmmm. First it was shown how how anyone could easily defeat a Kensington lock and people smiled, because, hey, those locks are not really intended for security, are they? They are just to stop casual walk-offs.

Then, following the same idea, people found this trick with Kryptonite locks and now people gulp and take notice, because these locks are used to secure expensive personal property. Maybe the locks do have sloppy manufacturing tolerances, but if so nobody seems to have pointed it out before now. I have read that "Kwikset locks are crap" but I have not read (before now) that "Kryptonite locks are crap." On the contrary, I have read about fairly complex tubular lock picks that are needed to pick such locks. (Slightly contradicting myself, I am quite amazed that the plastic pen trick was reported back in 1992, but overwhelmingly ignored.)

Is it really the case that the same impressioning technique won't work on other, more expensive tubular locks? Maybe it will take longer and a bit more skill, but perhaps it is just that no-one has really tried it yet. Perhaps someone should.

Regarding the press angle, I will find it amazing if the press can really find a way to report this other than "Kryptonite have been selling really poor quality locks to the unsuspecting public." But perhaps you are right, and "Those bad guys have ingeniously figured out a way to defeat high quality locks with just a platic pen and have opened the door to thieves" will win the day.

That would indeed be truly sad.

[Romstar]

Impressioning a tubular lock of any kind has been a well known trick for a long time.

The fact of the matter is that the lock makers have been told this over and over for years.

It just so happens that the computer locks, and some other locks are built in just such a way as to make this easier than it should be.

The crux of the matter is that the companies KNEW. They knew about the weakness, and they did nothing.

Recently, more locks have been released with this very same flaw. That has created a situation where the vulnerability has become more and more widespread.

Not to mention that this became news because of the kensington locks are the most vulnerable, and they are in much more widespread use today than ever before.

Why you may ask? Simply because more and more people have laptop computers. These things are still expensive, and ready targets for theft.

The re-introduction of this flaw was not for the edification of theives, nor for the bragging of those in the know. It was, quite simply a wake up call to the manufacturers. Because they choose AGAIN to ignore the warnings, Barry, and Marc as well as others choose to make this information public. If polite and discrete warnings won't work, perhaps outright embarassment will.

Thus far, it seems that it may be making a difference.

The real problem though isn't that the companies are fixing this, but the fact that the news business refuses to focus on the culprits here.

It wasn't locksmiths, hobbiests, or even theives who are to blame for anything. It rests purely on the companies making these locks, and their willingness to sell garbage to the average consumer and bill it as high security.

The media will never focus on this aspect. They are only interested in making more money, and selling more advertising time. That means, just like it always has, scaring people witht he threat of the mysterious "THEM" and all the bad things they do to US.

It's sad, and it has to stop. Sensationalistic journalism doesn't inform, it misinforms, and in the long run will cause more damage than the actual problem itself.

Romstar

[MrB]

Thanks for the further enlightenment about tubular locks.

On this whole media thing, it is also enlightening. I don't watch television or read a newspaper, so I'm not much exposed to it. (Perhaps the way the media operates here is why I don't watch television or read a newspaper- -I certainly did both in England where I grew up and lived all my life.) Does Canada follow the same pattern as the USA in this regard?

I can't say the British media are perfect, but to me they are much more digestible than the American media.

[Romstar]

To a lesser degree Canadian news media have this same problem.

The difference I think comes from the inate conservatism of most Canadians.

While many radical ideas have come from here, and some really cool stuff, the media is still mostly conservative.

Despite a slight slant in that direction at times, it results in some more balanced journalism with less sensationalism.

The problem everywhere though is that the news media are fighting a battle they are doomed to lose. One of reporting the news opposite entertainment shows.

Papers don't publish themselves. TV vans don't roll on their own. Something has to pay for the paper, and the ink, and the cameras and the people. That thing is advertising.

Advertisers put their money where they will get the most return. So, do you get the most return from the 6:00 news, or from the latest episode of CSI?

Then we have the entire issue of socio-politico-economic burden. We've created a society that needs these things. Not from any sadistic point of view, but as a reassurance that there are people worse off than they are.

We're run too hard, we work more, gain less, and laugh little. We've created a society that is falling apart under the weight of it's own creations and the pressures they create. Everything we have was supposed to reduce the amount of time the working man had to be at his job. Then they decided that rather than you having a 20 hour work week, you would stay the same 40, and do more because you had the machines to do more with.

What they didn't realize was all the extra effort that would be involved in dealing with this increased productivity. Then there is the competative issue to deal with. More work put into getting people to buy your particular product or service.

At this point, the amount of time a married couple actually has to spend with each other is believed to be less than 10 hours per week to have any meaningful or constructive activity. Taking into account sleep, 40 hours of work and commuting alone, that leaves 58 hours in 7 days. This does not take into account any associated activity you may have.

Beacuse of these professional, and personal burdens, we have little time to be involved in our communities. We rely on other people to tell us what is going on not just in the world at large, but also in our own neighborhoods. The result is a situation where you don't even know your neighbors. This isolation, and the need for reassurance allows the media to sensationalize things to such a degree that we simply can't cope with setting it all straight.

In the province of Nova Scotia, it is estimated that over 50% of the population actually smoke. Yet, they managed to pass legislation making smoking illegal, and then told us that it was for the majority of people.

Special focus groups, lobbies, pannels, and pudits toil each day finding new ways to twist the truth, and make the average person a little more isolated. There never was an increase in domestic violence, if anything it's gone down. We simply sensationalize it more. The war on drugs is now, and always was failing. Not simply because of the expense, but because of the demand, yet there has never been an increase in the flow of illegal narcotics. We just sensationalize it more.

Police brutality is a direct result of media manipulation of everyone from criminals to the people who are supposed to protect us. Tell the cops that every crook is armed, and they will shoot first, and ask questions later. Tell the people that cops are gun happy, and over worked, and you create a populace that is afraid of law enforcement. Turn three convenience store robberies into a crime spree, and the local council will be screaming for increased police funding.

These things, and so many, many more have contributed to a situation where the people who inform us, are themselves misinformed. The worst problem here is that they are just as busy with their lives as we are and simply don't have the time to poke their heads up out of their own private holes.

Look at many of the reports and projects in todays schools, and you will see references to the internet, and few if any references to good solid reference materials. The result of course is that later the material may not be able to be verified, or worse it was never accurate in the first place.

It's a credit to the American (and Canadian) people that their leaders felt they needed to lie to them.
It's a shame they were so easily mislead.

I have to get off this topic before somebody thinks I am a nut.
Romstar

[DeadlyHunter]

I like the quote from the news article someone posted:


Currier said he was amazed that someone figured out how to pick the lock, given that ``generally, thieves have not been the brightest bulbs in the pack.''

[raimundo]

What I read about the bic pen was that it works with some models of kryptonite, but not with older models, I haven't tried this yet, but I suppose the difference between the new models and the older models is the diameter which is smaller on the new models, and from the posts I have read, it seems that these new models have fewer pins. possibly using a razor blade to slit the pen barrel in about eight evenly spaced places will help the technique, I intend to try that later today. the slits could accomodate the larger diameteres,

[thertel]

The adding of slits workes really well. So now it's time to replace my bicycle lock. oh well I knew I was buying a cheap lock.

Romstar is on the money.

Thomas

[poisoned]

I suppose the difference between the new models and the older models is the diameter which is smaller on the new models

-Thats true, u have no idea how angry I was when I found out that my hpc's smallbore pick didn't fit in the newer models

from the posts I have read, it seems that these new models have fewer pins

All the kryptonite bicycle locks I have seen have 7-pins.. And I took a look at www.kryptonite.com and didn't find any bicycle lock that wouldn't have 7-pins...

I have to try that impression thing thought.. If it seems to work I will add a pen in my pick set

[MrB]

I went to a Master 7-pin tubular cycle lock I have in my garage. The key has cut depths of 4, 2, 2, 3, 1, 1, 3 (32ths inch). The lock has MiZ on the barrel and the key number is 2113.

The pen barrel wouldn't fit, too narrow. Cutting slits in the end did not help; it weakend the plastic too much and it got broken apart by the lock pins.

The pen cap, however, was a perfect fit (larger diameter, thinner plastic). I pushed the cap firmly into the lock, wiggled and turned a few times, and the lock opened in seconds. After this, the newly impressioned 'key' would open the lock immediately.

As an engineer, this makes me mad. These locks are basically self-picking. It is typical of the poor design and engineering that goes into so many every-day objects these days.

The basic issue here is that the pins are used both to turn the lock and to key the lock. Inserting the pen cap pushes down all the pins by friction, and turning the cap clamps the pins against the shear line. Now, slight wiggling of the cap allows each pin to rise slowly against the outer rim of the pen cap until the driver pin reaches the shear line and binds. It takes very little time for all seven pins to do this since all pins are being picked/impressioned simultaneously.

Even if manufactured with very tight tolerances this lock design is vulnerable, since the pins always turn the lock, and all the pins remain exposed and accessible. Basically a disaster. And I bet someone got a patent on the stupid thing too.

[mbell]

Is it just regarded that Kryptonite bike locks and Kensington locks (or at least some of the range of locks) can be opened in this way because of their poor manufacturing tolerances, or whatever other reason? Or can other tubulars be opened in this way.

I'd be surprised to find that the majority of tubular locks are open to this attack, infact I'd be quite worried.

Even with many, many hours of practice and a $140 HPC tubular pick with a totally sound understanding of the mechanism and the ways in which they are picked, I still can't open quite a few of the tubular locks I own.

[MrB]

The very question I have.

Can you list some of the tubular locks you can't pick? Manufacturer, application, size, cost, etc.

Do some tubular locks have deeper, better warded keyways? Do they have anti-pick features that these easily-opened cycle locks don't have?

[MrB]

This reminds me of the Thunderbirds episode where they installed a brand new electronic vault at the Bank of England after Parker had been able to open the old one after hours of work with a stethoscope. Later, Parker opens the new one in moments using just a hairpin!

(http://www.thunderbirdsonline.co.uk/episodes/vault/index.htm)

[toomush2drink]

I know what you mean mbell my fiancees steering wheel lock (metro stoplock) has a so and so of a tubular on it, i think its an ace2. Thing is you need to get the tension on the sliding pins just right or it wont work. Yet i have tried other tubulars and they fall open, bit like cylinders really i suppose.