Researchers Can Duplicate Keys From the Sounds They Make In Locks (kottke.org) 33
Researchers have demonstrated that they can make a working 3D-printed copy of a key just by listening to how the key sounds when inserted into a lock. Slashdot reader colinwb writes: While you cannot hear the shape of a drum it seems you can hear the shape of one type of key from the sound it makes in the lock. That says it all really, but [here's how Soundarya Ramesh and her team at the National University of Singapore accomplished this feat]: "[The NUS team developed and tested what it calls SpiKey, an end-to-end attack technique for, as its name suggests, spying on Yale/Schlage type keys and using signal processing software to infer their correct shapes.] Once they have a key-insertion audio file, SpiKey's inference software gets to work filtering the signal to reveal the strong, metallic clicks as key ridges hit the lock's pins [and you can hear those filtered clicks online here]. These clicks are vital to the inference analysis: the time between them allows the SpiKey software to compute the key's inter-ridge distances and what locksmiths call the 'bitting depth' of those ridges: basically, how deeply they cut into the key shaft, or where they plateau out. If a key is inserted at a nonconstant speed, the analysis can be ruined, but the software can compensate for small speed variations.
The result of all this is that SpiKey software outputs the three most likely key designs that will fit the lock used in the audio file, reducing the potential search space from 330,000 keys to just three. 'Given that the profile of the key is publicly available for commonly used [pin-tumbler lock] keys, we can 3D-print the keys for the inferred bitting codes, one of which will unlock the door,' says Ramesh." The article has a link to a 15-minute video presentation of the research and to another article on the research.
The result of all this is that SpiKey software outputs the three most likely key designs that will fit the lock used in the audio file, reducing the potential search space from 330,000 keys to just three. 'Given that the profile of the key is publicly available for commonly used [pin-tumbler lock] keys, we can 3D-print the keys for the inferred bitting codes, one of which will unlock the door,' says Ramesh." The article has a link to a 15-minute video presentation of the research and to another article on the research.
Does this work for other types of locks? (Score:2)
Would this work for, say, a disc detainer lock?
Or something like a Schlage Primus? Or a BiLock? Or any of the other higher security locks on the market?
Its not like there aren't already many easy ways to get into these cheap insecure locks...
Re: (Score:3)
Re: (Score:2)
If you mean the type of lock that has sliding discs instead of pin tumblers, yeah probably - the edge of the disc hitting the key ridge probably makes a similar sound and by amplitude you can figure out how deep the cut is.
On tubular tumbler locks, the technique is probably worthless, as all the tumblers hit the key at the same time.
Take a Medeco - they have 3 rows of pin tumblers at differing angles so again the technique is probably useless on them. Trying to figure out which row is making which sound ef
Re: (Score:3)
Re: (Score:2)
"Would this work for, say, a disc detainer lock?"
No, you need the "Lockpick that Bosnian Bill and I made" from the Lockpicking Lawyer.
Pretty darn niche... (Score:5, Insightful)
I applaud these guys for their research, but the number of scenarios in which this is relevant is super super small.
For even a semi-experienced person, picking a simple tumbler lock is a 3-10 minute operation. For a really experienced person, it's a good deal faster.
Then there's bump keys.
And lock rake guns.
And going under/over the door.
But sure, with this, you can walk up with 3 potential keys and about 5-20 seconds after stepping up, you're in the door.
You just need a high-quality recording of the key being used in the door. However, the number of times when you can get that recording, but you can't just get a quick photo of the key are pretty few and far between.
Plus you need a 3D printer and the know-how to use it (this is getting more common all the time, of course).
Basically, if someone needs to be ninja-like enough to make use of this method, both from a timing and effort standpoint, then you probably already should have upgraded that lock to something other than a simple pin tumbler setup.
Still, it is super neat.
Re:Pretty darn niche... (Score:5, Informative)
> picking a simple tumbler lock is a 3-10 minute operation. For a really experienced person, it's a good deal faster.
Indeed. LPL (LockPickingLawyer) picked a disk detainer core in less then 30 seconds [youtube.com]. With the right tools and some experience SpiKey sounds (pardon the pun) to be extremely inefficient.
Still neat proof of concept.
Re: (Score:2)
Re: (Score:3)
Have you seen his video about his wife's beaver [youtube.com]? He talks at lengths about the importance of lubrication.
Re: (Score:2)
Re: (Score:2)
HAHA!
Mod parent +1 Funny as hell.
Re:Pretty darn niche... (Score:5, Insightful)
Sometimes the point is to get a key made. So that future entries can be made in full view of people who will assume that your possession of a key makes you 'authorized'. An orange vest and clipboard help as well.
Even with a cheap, easy to pick lock, you are busted if the door is in view of other people. Somebody fiddling with a pick set is going to attract attention.
Re: (Score:2)
The advantage of this technique is that if you can make a recording, you can make a key. Making the recording can be tricky if you don't want to be seen, however, once you have it, you can make a key at home.
And once you come back you just open the door normally, with the key, something you can do in broad daylight without raising suspicion.
The use case I can think of is if you want to enter something like a storage room or a locker box in a busy office building. Have a good microphone on you, be there when
Re: (Score:3)
Or an old-fashioned key cutting machine; or a blank key, a file, some calipers or reference keys, and patience.
The question I find more interesting is to what extent the attack can be hindered by using a mix of springs of different strengths in the lock. Or would that help by essentially giving you multiple sets of data once you untangle them?
Re: (Score:2)
That's because most locks are terrible. Of Master Lock type security (there's a reason Master Lock 3/5 is a beginner practice lock - to practice raking attacks). Master Locks in general are a good practice lock - they are consistently crappy so they make great training locks as you can buy them anywhere and know they will be the same difficulty. You can't say the same for cheap Chinese made locks which are wildly inconsistent in quality.
The front door of your house is no better for the most part unless you
So what they are saying is ... (Score:3)
If you have the correct key, you can record audio of it and infer the cut by the sound. Maybe. Instead of just going and getting the key copied.
or
A nefarious nerd bugs your door lock with a recorder and waits in the shadows until you use your key. Really? Instead of just picking the lock or better yet, breaking a window?
or whatever.
No matter how you imagine it, sound inferring shape is a bit of fun but it ain't any kind of a security threat to locked doors that isn't already out there. This is really just "I can get in if I have physical access".
Show me this works on a high security lock from 50 m away even with a human body standing between the recorder and the lock, then I will be impressed.
Re: (Score:2)
Show me ... then I will be impressed.
Wow, you totally don't get it. This is "news for nerds". It was an awesome hack. It does not need to be useful to be interesting.
Re: (Score:2)
Hey, I get it. The pin has a characteristic tone depending on length and shape which infers key shape. Cool. Not surprising but cool. Fun stuff and this is a good forum to talk about it. Neat things you can do with physics.
However, the researchers present it as a security vulnerability which it really isn't, or if you must: it is a threat at less than the lowest category.
Re: (Score:2)
Look at it from the positive side - this research will probably create a movie franchise or three, with key sound being the main feature. One, a blind woman can do it and... Two, a kid can do it and... Three, zombie Bruce Willis can do it with his eyes closed and Stallone is called up from the grave to get him...
Re: (Score:2)
YES! My thoughts exactly. A cheesy plot device!
I think Stallone would master the art of acoustical lock picking but still be out to lunch about the three seashells.
Re: (Score:2)
You mean he'll be served lunch in the three seashells.
Do Not Duplicate (Score:2)
Allegedly there was this locksmith shop, that, if you brought in a key stamped "Do Not Duplicate", they would make a copy of the key anyway and then stamp "Do Not Duplicate" on the copy.
In the end it didn't matter because master keys were easy replicated using just a file and a (*** cough ***) Yale Y4 blank.
Re: (Score:2)
Allegedly? I've done it several times at two different locksmiths, once while I was still a high schooler with a purloined janitor key.
Re: (Score:2)
What is this "Do Not Duplicate" shit, and if it is real, how could it ever have stopped keys from being duplicated?
Re: (Score:2)
Re: (Score:2)
Interesting.
Apparently, it is a "pretty please" in most of your country as well.
https://firstquarterfinance.co... [firstquarterfinance.com]
Re: (Score:1)
I wanted a spare key for my apartment, just in case I got locked out. (It happens.) I kept one at work.
When I went in to get they key copied, I didn't know it had that stamped on it. The lock smith told me, and followed up with, "I don't care, it doesn't matter to me -- but you probably signed a contract saying you're not allowed to copy this key. It's not on me, it's on you."
If you're close enough to listen in... (Score:3)
...couldn't you just take a picture of the key? Maybe a high end camera with a good zoom lens?
Re: (Score:2)
The conceit (Score:2)
The conceit is you need to somehow get a quality audio recording of the proper key being inserted into the lock in a quiet location. I'm not clear how one can manage to get the recording without taking possession of the key, and if you've gotten even temporary possession of the key, wouldnt it be easier to jam it into a ball of clay sideways to get the cut pattern?
As a hack, it's clever - as a security vulnerability, it's nearly useless.
Re: (Score:2)
Many places are quiet, so you just need a listening device.
For that matter, a second listening device a little further away could record ambient noise, then used to cancel it out from the primary recording.