New Technique To Open Lever Locks In Seconds???

[mmcc]

Its not like a glue. Its a non-newtonian fluid. Basically, it stiffens when it received a shock or impact. Once the impact is over, it returns to a gel like state. So, it will not stick to the mechanism. You can see the material here:

https://www.youtube.com/watch?v=vqDe0C4OKbM

[EmCee]

Just to clarify a bit more...the key bitting lifts the levers different amounts until all the gates are lined up so that the bolt stump can pass through. Whether the lever bellies (bottoms) are at the same or different heights relative to each other in the locked position does not directly relate to the key bitting/gate position.

[mmcc]

Emcee, I'm finding in most cases there is direct relationship. Further, the levers have a shape difference to accommodate the the rotation of the key. This shape difference may prove to be the key (excuse the pun) when using something like D3O. That is, it would impart different pressures on the fluid causing it to stiffen at different rates during the rotation.

Now, I admit, I have only one example of these type of locks, but playing with the mechanism, I'm quite confident it will work on this one.

Has anyone tried this with silly putty yet???

[Squelchtone]

mmcc,

I have to ask, and I didn't see your Introduce yourself here post, so I'm not sure, but are you a lockie in the UK or are you a hobbyist/hacker/maker/tinkerer? We have all camps well represented on this forum.

What sparked your interest in creative new ways of opening lever locks, and did you discover a liking for locks first or did you know about the D30 stuff first and are thinking up interesting applications for it?

Thanks,
Squelchtone

[mmcc]

squelchtone, it's just a hobby mate. I've only been playing around with it for a few weeks and the cost of the tools was pissing me right off. I mean, these things are just bits of wire and a handle and they want like 50 quid a time for them. Nuts. So, I was wondering what else I could use and I saw the D3O stuff.

[EmCee]

Hi mmcc

I'm not trying to be funny or insulting, but if you have only one example of a lever lock, how are you able to state that in most cases you are finding a direct relationship? If the lever bellies are level when at rest, how can there be a direct relationship?

If you look at the image you loaded and focus only on the top lever, you can see that the key bitting is touching the lever. You can see that the lever must be lifted until the gate is exactly level with the stump, no higher and no lower. Turning the key will cause the bitting to slide along the bottom of the lever and raise it until the gate lines up, at which point the bitting won't try to move the lever any higher. At what point during that slide, using your method, would the goo harden? How will you get the goo to harden just as the gate comes into position, and not before or after?

I'm still not sure how you'd get the goo into the lock. It would have to be supported on something, and that something would have to be able to turn the curtain. You have to slide the goo-covered carrier through the keyhole, turn the curtain and reach the levers without it dropping off or being scraped off before reaching the point where you want to force the key to set the goo.

I'm certain it won't work, even with your perspex cover enabling you to see inside, let alone when you can't see inside, but I would be happy to be proved wrong. If you get the goo, try it and take photos or even a video.

50 quid for a curtain pick? More like 150plus - can I ask where you've seen them for that price?

[mmcc]

EmCee, I have seen other lever locks, I just happen to only have one Mortice and a lever padlock here at the minute. As for the lever bellies, they are not generally flat as you suggest, each lever has a unique shape and rest position depending on which code it is for. In particular, playing with this Mortice lock, I notice that the teeth of key strikes the bellies of the levers in a particular way. My thought is, if I can impression this on to the D3O initially, when it comes to "giving it a kick", this will induce pressures at different points in the D3O causing it to stiffen into the key shape during the rotation. It won't stiffen into a blank key, but stiffen at different points in time as to recreate the bitting.

I stress that this is a theory, but it needs to be tested.

As for getting it into the lock, I would just use a blank key. Cut part of the tooth away and replace it with something a little flexible, but with enough resistance to stiffen the D3O. I don't know how easy this will be. Lots of experimenting to do. The D3O is not particularly runny, its more like a gel, so it won't drip off.

I wasn't talking about a curtain pick in particular, but why is it so expensive? Its just a small lump of metal. I've been playing around with this Mortice lock and if I understand the principle correctly, I think I could do it with a bobby pin and a handcuff key. Maybe I am missing something.

[MacGyver101]

As for the lever bellies, they are not generally flat as you suggest, each lever has a unique shape and rest position depending on which code it is for.

Hrm. That's not usual... or, at least, that's not usual for lever locks made in the past couple of hundred years, or for modern ones that are well-constructed. Let me try to explain...

These images were shot for another project, but they'll help to illustrate the point. This is a double-bitted lever lock, with the cover off so you can see the levers in their "rest" position:

When there's no key in the lock, you can see that the bellies of the levers (i.e., that part of the levers that interacts with the key) are smooth and flush with one another: there isn't any sign from measuring or looking at the bellies of the levers how much the first lever should be raised relative to the second or the third... they are all cut to the same shape and curvature where they meet the key.

The difference is where the notch is cut in the lever, to allow the fence to enter and the lock to open. Here's an example from an old safe lock:

It's a little harder to see, but when there's no key in the lock, the bellies of the lever are all resting at the exact same level. Here's a picture of two of the levers sitting on top of one another:

The curved sections that contact the key (bottom right) are identical, but the cuts in the lever (just above) are different. The key pushes the levers out of alignment to open the lock:

Here's one final example (and sorry: the levers are facing opposite ways in the two pictures). The levers in this Folger Adam all have the same dimensions, and are cut the same where the curved part at the bottom interacts with the key:

The only difference is where the cut is made for the gate to enter. You can't feel or see from the keyway how high each lever needs to be raised -- and the key needs to raise each lever by a different amount.

If that wasn't the case -- and if the bellies were all cut to different depths -- then you could do exactly what you're proposing... you could measure the different positions of the levers at rest, and you could then just find a way of lifting every lever by a 1/4" to open the lock. (You could also just start with a blank with wax on the side, try turning it, and file away anywhere that the wax had been indented... this is the approach for very old warded locks.)

Now, not to confuse the issue... but the sort of approach you're proposing does have a bit more application for standard wafer locks: there are a number of tools that exist for reading/picking those (in particular when it comes to automotive locks) that are all based on the principle that each of the wafers need to be moved up/down by exactly the same amount in order to open the lock, but I can't say much more about that here.

[mmcc]

MacGyver101, that was a brilliant explanation. I have never seen those type of lever locks and D3O would certainly never work. I posted an image of the Mortice lock I have and every Mortice lock I have seen so far has been similar. The link to the image can be found in the following post:

viewtopic.php?f=4&t=56373#p410341

So, it looks like this attack may only be viable against a particular sub-class of lever locks.

[MacGyver101]

I posted an image of the Mortice lock I have...

Ah, okay. I think [?] the confusion may be coming from the fact that the lock (as it appears in that photo) isn't actually fully locked. The stump (the silver rectangular piece that presses into the levers) should continue moving a bit further to the left... that allows the levers to drop fully to their resting position, and the mechanism is then fully locked when the key's removed. (Otherwise, you could just lift that first lever a bit, give the bolt a whack with your hand, and the lock would open.)

As your picture absolutely shows, you can insert something (or, as you propose, some casting compound) into the keyway to "read" the levers when the lock is part-way open... but, unless the lock's defective, the proper key should be needed in order to first align the levers before you can get to that point. With some locks you can also get a pretty good read of the levers when it's in the unlocked position. (But, at that point, you could also just remove the lock from the door and read them directly.)

[mmcc]

The key is just resting against the the levers for illustration purposes, the lock is fully locked and that is the way the levers look. Its the same way in every Mortice lock I've ever seen. So, its not a defect. Each of the levers is a slightly different shape and that shape is dictated by its code. For example, the 4 lever is slightly different to a 2 lever, etc.

Whilst impressioning the lock will not reveal the bitting, it can be used to decode the lock and produce a key. My hope is the pressures imparted to the D30 by striking the bellies of the levers will forge a temporary key, with the correct bitting, during the rotation.

I think that as a first step, I need to understand how wide spread these type of levers are and ascertain if there is a market for this exploit. Maybe I have just seen a number of odd examples.

[Capt_Tom]

Other than rebuilding/rekeying safe deposit box locks, I have never had the occasion to see another type of lever lock. This thread has been very informative. Thanks to all that posted on it.

Tom

[Teddy Picker]

I think the kinetics involved here overcomplicate things. If I remember correctly, there are fluids that solidify when a small electrical current is passed through them which might work better, because you don't have to worry about any forces except what you're using to turn the key.

[rphillips52]

Nothing wrong with trying to think new ideas.
'If a lock - let it have been made in whatever country, or by whatever maker - is not so inviolable as it has hithertoo been deemed to be, surely it is in the interests of honest persons to know this fact. ... It cannot be too earnestly urged, that an aquaintance with real facts will, in the end, be better for all parties.'
Several points arise from the OP's post.
As has already been noticed, there are 'adjustable keys' for lever locks. They generally have round wire pins for each lever step. And yes, they are generally made to suit an individual model, and they are not cheap.
Linus Yale Jnr succeeded in opening a lever lock by injecting a plastic material into the keyhole and then removing it. It is not a technique that, afIk, anyone else has had success using. Those locks continued to be used by a British Bank chain for decades without a problem or hint of security breach.
Mcgyver has shown some secure lever locks such as the man in the street is unlikely to encounter. It is true that in the past, some low security lever locks have used levers whose bellies at rest mirror the pattern of key steps, so that their heights can be easily measured by inspection. They are also easy to impression.
The lock the OP shows conforms to a British standard for 'thief resistant-locks for normal risks'. For a mass market lock, there is obviously a price consideration, but these are a great advance on what the public would buy previously. It is true that in such locks, the bellies are not all entirely flush - but they are in a few groups.
If a lever is not blocking the bolt when at rest, that is a 'dead lift lever'. Any key with a step not cut to the lowest depth for that step, will lift the lever so that it does block the bolt.
For the protection of a bank's assets, or state security, cost is not the primary consideration.
The locks shown are opened by force - admittedly, experts apply minimum force judiciously.
The maker of one of the locks was destroyed by the criminal activity of 2 corrupt employees, who passed duplicate keys to burglars. As use of a key was the only known means of NDE, suspicion initially fell on the keyholders. The locks are still secure.

If the OP's idea works, I look forward to seeing details.

[mmcc]

Actually, I could probably get into those secure levers. A small handheld radar may do the trick and it could be used to image the levers in real-time. It would be very similar to the output of sonar or an ultrasound. By controlling the power of the RF transmitter, an attacker could penetrate the mechanisms in layers. The problem is the penetration depth and wavelength of the photons, the higher the frequency the better the resolution (smaller wavelength) but the worse the penetration depth would be. I will need to do some calculations because I'm not 100% sure it is entirely feasible. The required power could be unbelievable at the right frequencies. We're certainly at the very high end of the microwave spectrum, but I will look into it.

rphillips52, that was an excellent post, thanks for all the additional information.

Teddy Picker, that post was a little bit of genius, I forgot about this class of material. I'm wondering if we could create a literal "brute force" key. Use an arduino, or some other i/o controller, to change the bitting on a key sequentially. I would really like to see this one!!!!!!!