SoylentNews is people
SoylentNews
One of the unintended consequences of cheap 3-D printing is that any troublemaker can duplicate a key without setting foot in a hardware store. Now Andy Greenberg reports that clever lockpickers are taking that DIY key-making trick a step further printing a "bump key" that opens even high-security locks in seconds, without seeing the original key.
A bump key resembles a normal key but can open millions of locks with a carefully practiced rap on its head with a hammer. Using software they created called Photobump, Jos Weyers and Christian Holler say it's now possible to easily bump open a wide range of locks using keys based on photographs of the locks' keyholes. As a result, all anyone needs to open many locks previously considered "unbumpable" is a bit of software, a picture of the lock's keyhole, and the keyhole's depth. "You don’t need much more to make a bump key," says Weyers. "Basically, if I can see your keyhole, there’s an app for that."
Weyers and Holler want to warn lockmakers about the possibility of 3-D printable bump keys so they can defend against it. Although Holler will discuss the technique at the Lockcon lockpicking conference in Sneek, the Netherlands, next month, he doesn't plan to release the Photobump software publicly and is working with police in his native Germany to analyze whether printed bump keys leave any forensic evidence behind.
Ikon maker Assa Abloy argues 3-D printing bump keys to its locks is an expensive, unreliable trick that doesn’t work on some locks whose keys have hidden or moving parts but Weyers argues that instead of dismissing 3-D printing or trying to keep their key profiles secret, lockmakers should produce more bump resistant locks with electronic elements or unprintable parts.
"The sky isn't falling, but the world changes and now people can make stuff," says Weyers. "Lock manufacturers know how to make a lock bump-resistant. And they had better."
(Score: 3, Interesting) by hankwang on Tuesday September 02 2014, @09:51AM
Like in every large hotel? I can think of other reasons besides the ones you mention:
Avantslash: SoylentNews for mobile [avantslash.org]
(Score: 0) by Anonymous Coward on Tuesday September 02 2014, @03:55PM
Hard keys are not really as secure as 'soft' keys (ie: proximity cards). With soft keys you can arbitrarily assign and revoke keys conveniently simply by changing a setting in a computer, you can control who has access to what doors and easily change access parameters at will, and you can audit who came into what door when (or at least what badge was used). You can also program the key reader to beep whenever someone places a card next to it which alerts those around it that someone is here and attempting to enter. With a hard key if someone duplicates it then you would have to physically change all the locks to revoke the key and who wants to do all that.
As far as the battery needing replacement you can have a battery that can be replaced from the outside. Have a dual battery system, one set of batteries from the inside and one set of batteries from the outside. If either of the batteries are working the door will open upon someone punching in their pin or using their card. If one set of batteries dies the system can beep a certain way upon someone putting in a pin or using their card to inform the person that the battery is low and needs replacing. A light indicator can indicate which set of batteries is low. This is useful because it gives time to replace one set of batteries while the other set is hopefully still good. If the inside and outside batteries are both dead and someone is locked outside they simply need to go to the store and get a standard 9 volt battery (or whatever standard batteries are sold) and replace it from the outside and then punch in their pin or use their key reader to get in. They still can't get in without their pin/key reader but they still have a backup plan in case the battery dies. The key reader can also optionally be plugged into a power source so that power can be drawn from the power source when there isn't a power outage. The inside battery can even be a rechargeable battery that automatically stays charged during times that there isn't a power outage. If there is another (back) door with a key reader and the front key reader isn't working someone can simply go to the back door and use their key reader to get in from there. Problem solved.
(Score: 1) by malloc_free on Wednesday September 03 2014, @02:30AM
Valid points. However NFC cards can't be copied that easily. Well, not the cards I have used. You can use public key encryption to prevent interception of transmitted data. However that is probably not the case for all cards.
(Score: 2) by hankwang on Wednesday September 03 2014, @04:21PM
I was thinking of an attack where one guy holds an NFC reader next to your pocket and another one an NFC card emulator next to your door. With a mobile internet connection, that could work, if the allowed latencies of NFC are not too strict.
Avantslash: SoylentNews for mobile [avantslash.org]
(Score: 1) by malloc_free on Wednesday September 03 2014, @08:41PM
With the right card and proper encryption, this should not work. The cards I have used allow for public key encryption and, using that, creation of a shared secret key.
M.
(Score: 2) by hankwang on Wednesday September 03 2014, @10:14PM
How would that prevent this from happening? It's a known problem anyway:
https://en.wikipedia.org/wiki/Relay_attack [wikipedia.org]
https://en.wikipedia.org/wiki/Near_field_communication [wikipedia.org]
Avantslash: SoylentNews for mobile [avantslash.org]
(Score: 1) by malloc_free on Thursday September 04 2014, @12:37AM
OK yeah there is little you can do about this if the system you use only requires one method of authentication - just the card itself. I see most of the solutions attempt to detect delays in transmission/relpy. So one way to fix this would be to use two-factor authentication, where a pin is required as well as the card. Then there is shoulder surfing I guess...
M.