`Safe cracking' article and matt Blaze

Roger, how many AR mortice locks do you see with the extra piece on theback of the cylidner that prevents snakepicking, or how many Americal Padlocks have you seen to be rekeyed and either don't have the extra peice that protects against the vulnerability they have either not there, or discarded by the locksmith that is doing the rekeying? FWIW how many AR cylinders do you see installed with no collar? It would appear that forget the conveneince, it is eihter flat out not being done, or circumvented for convenience sake. When security becomes inconveneint lazyness takes over. I seem to remember a place that forced password changes with excessive regularity so people started usign passwords like A1b2 then changing them to B2c3 etc to meet the standard and not forget them. I guess it is similar.

The problems with informing people about stuff that they will invariably not correct is probably that is gives a feelingof insecurity that wasnt there before. Let us preserve the illusion of security :) It is not hard to reason that a guy with a 300,000 USD house with a $9 Tylo and no deadbolt, is either A. not concerned with security, B. Depending on the power of his insurance policy or C. not properly educated by his locksmith (if he even has one). However, if we show him how easily it is bypassed inorder to upsell him to somethign better are we doing him a disservice by showing him how unsecure he really is, or perhaps we are doing society a disservice by showing one guy how easily he can break into his neighbors house. What's the point?

Locksmiting is such a miniscule industry that as soon as you put "locksmith" or "safe" onto a product or description, it would seem that you have license to charge double. Then when some of these companies try and peddle there wares to other industries "tow truck", "law enforcement" etc.. Lockies get incensed and try to stage boycottes and such. The prevailing thoughts is we'll just charge the lockie more and they can pass it on to their customers.

Blaze is not a pioneer in revealing the secrets. Many other people have shared many other things. Look at Bill Phillips, or anythign by Paladin press, the "MIT guide", or the "Amateurs Guide to Impressining"

Just some thoughts :)

There's nothing magical about a college degree, certainly.

The fact that you can make money doing something doesn't necessarily make that thing either right or good. Many people have made lots of money selling shoddy goods and passing them off as valuable. That is exactly what the lock industry is doing today, and has been doing for a long time now. Matt Blaze is just shining the same bright light on your industry that has been focused for some time now on the data security industry, and the flaws he's finding are significant.

It should surprise no one that there are problems... if we've learned anything at all about security in the world of computers its that secrecy *hurts* security, rather than helping it.

What is surprising is that locksmiths are responding so badly to the problem. Rather than beginning to develop new designs that address the discovered flaws, and rather than organizing "white hat" lock and safebreaking organizations to evaluate designs and discover and publish weaknesses so that they can be *fixed*, locksmiths are complaining that Blaze is the problem.

Blaze is not the problem, he and people like him are the only solution that is really going to overcome the entrenched inertia of the lockmakers.

I do think it's worth keeping in mind that physical security is not exactly the same as most computer security: You can fix a computer security hole, in most cases, by installing new software. That's a far less expensive operation than replacing a lock, or a safe. On the other hand, locksmiths do a great disservice to their customers when they allow people to believe that locks and safes are more secure than they really are.

What we need to achieve is a balance. The physical security industry needs to construct an internal, competitive process for the creation and analysis of new designs, similar to the way cryptographers operate. In addition, it needs to develop a way to objectively describe the security of a given lock design, and to implement procedures for notifying lock owners when the industry and/or manufacturer discover that the design is less secure than previously thought. That will allow lock and safe owners to intelligently make decisions as to when or if a security device should be replaced, or augmented. With that sort of infrastructure in place, it will be reasonable to suppress the free publication of cracking information -- because even without publishing the details, the industry will still be making consumers aware of security problems.

Until that happens, Blaze and others have a moral obligation to publish this information.

Shawn, I agree with most of your comments. What you and others are failing to understand is that, in the real world, no matter how much we TRY and tell our customers about their inadequate security. Most of them let their wallet make their decisions for them. They do NOT or will NOT spend the needed $$$'s to upgrade.

my2

Same down here, and I reckon the world over. I stock very little upper market locksets anymore. It sits on the shelf month after month. Government & big end business are the only ones that are interested in 'the good stuff' and even then their wallets are pretty tight.

go look at the industry and see who 'owns it' S& G and Safemasters were recently BOTH bought out, according to what I read in one of the trade magazines.. who bought them?? you go look..

'lockMAKERS', which is NOT the lockSMITHS. you are beating the bush at the wrong end..which YOU finally said here. WE the locksmiths DO NOT MAKE THE LOCKS.. we need 2 changes made.. basically..

IDIOT architects CANNOT say what hardware. thats one, and would stop a LOT of problems.. 1 sub A, is the guys that build houses can NO LONGER build them. they are a big part of the 'security hole' as well.

1. all customers MUST buy by the BEST, MOST secure, available, no matter the cost..

then you got security..

will that take place? no.

example.. new high school.. 115 doors.. FEDERAL LAW says HANDICAPPED LEVERS.. Architect put in the hardware list.. HANDICAP LEVERS. nothing else.. (other than keyed) so, locks were installed by the hardware provider-NOT a locksmith.. building gets done..

first week- 3 broken locks on 3 doors.. guarantee says one year.. so new locks installed.. next week, 2.. again replaced.. and so on, averaging 2 a week for 6 MONTHS. I got a call from the building maintenance man, what could be done.. I went and looked what was installed.. GRADE 3 locks.. home owners grade.. the architect did NOT say what GRADE.. but what TYPE. they asked me and I quoted a price of over $250 apiece to replace with some grade ones..

the hardware supplier ended up, replacing all of the locks, at a cost of over $300 each. at HIS expense.. school paid nothing

then he put in grade 1..

it IS??? most of the computer geeks around me (and am in a POOR part of the country, wage wise) are charging DOUBLE my hourly rate.. need the computer fixed? $1-2 hundred plus software.

On the

go back and talk to the CUSTOMER.. if its a commercial 'bid' building, we CANNOT say whats used, that the designers area, HE says, USE THIS... and we cannot change that. if its a house- again, talk to the builder.. we can sell a REAL good lock for $50, but the local Home depot sells a knob for $7.50.. guess which he buys..

no, we need a change of building codes.. no hollow core doors, NO glass ANYWHERE near a door., residential OR commercial.. NO glass store fronts on a building.. etc..

the 6730 mentioned as being 'able to open'.. sure, it can be, but you dont see too many of them on 'home safes' either.. you see instead a push button, 6 number combo, that cannot be 'manipulated'..they even got them on cracker box gun safes now.. Did I say cracker box? wonder why...

With that

its a trade off- WHAT can the person afford, vs, what is he willing to put up with??? if you are making $8 an hour, which in MY area is decent pay, you cant buy a fancy smancy high grade door knob.. for what reason? someone gonna break it? kick the door in, the frames arent worth anything.. they will break in an instant..

like I said 3-4 times PREVIOUS.. Matt picked on a SMALL part of the problem.. he just wanted to write articles, its publish or perish up in those realms..

--Shiva--

and all of the 'computer security fools that come her, CANNOT get that point through their heads..

--Shiva--

Does that now place the onus on the consumer to upgrade their security at a cost? Surely a product known to be unfit for the purpose due to (for want of a better word) 'bugs' in the development and manufacturing process should be updated/upgraded at minimal to no cost to the consumer. This does not mean that Locksmiths are responsible and should bear the cost. THe manufacturer should be covering costs, including instalation or replacement, the same as defects in cars are replaced at manufacturers expense.

A couple more questions (so that we 'computer security fools' might understand more clearly)...

Do lock manufacturers consistently blame outside forces for the insecurity of their products? It seems that in the IT industry, software developers (especially the larger ones...M$...$ymantec etc) blame hackers, crackers and software pirates for the insecurity of their code. A combination of poor programming and the Internets ease of data transfer makes finding and exposing weaknesses in software easy due to the many unknown attack vectors within a given piece of software. However, when one of these outside entities demonstrates an insecurity and makes it public knowledge, the software developer fixes the bug and makes a fix available. Granted, the delivery process of said fix is logistically easier than moving a physical product all over the planet. However, it could be argued that for a physical lock replacement (or patch...whatever), the install base would be far smaller than for a software product such as 'xxx anti-virus or M$ Windows.

Do lock manufacturers blame safe crackers, ram raiders and petty crims for the insecurity of their locking hardware? In the case of locks, the attack vector is a relatively well known entity ( eg sledge hammer, drill bit...) and therefore shouldn't all locks account for this? Forget cost for a moment. In an ideal world, all locks should - due to the specific purpose they are employed for - be able to resist most known attacks. If this practice were employed, it would stand to reason that the manufacturing cost of a safe and associated lock (with high end security features) would drop dramatically.

right, and read that $$$.. I got paid a nice sum, manufacturer set the rate, for driving 12 miles, installing a new wiring harness, and a box, in a safe, at their nickel.. the reason it COULD be done, was that the manufacturer knew the 'end user', and had that info available.. It was a VERY high dollar safe, electric combo lock.. this assumes that there IS a 'registration' done, with each unit sold AND that its filled in and returned TO the manufacturer.. this doesn't happen in the real world.. and BTW, there is probably no way otherwise, that one could trace the 'end user' on a lot of items, due to their mass marketing. the 'higher dollar' things can more easily done.

I had to drill an almost new gun safe one, with a gold plated dial. man just bought it, and then moved and never sent in the registration card.. during the move the serial number tag was rubbed off.. no way of getting the combo, unfortunately.

no.. they KNOW the 'recommended limits of the product'.. and if one goes beyond that, and its used in an unacceptable manner.. it happens. but its the customers doing.. I had a case here of a 'stolen $100 sentry safe'.. I was asked how long it would take to break into and I said, given what conditions? they answered and i said 20 minutes MAYBE..probably less.. the 'end user' had $15,000 in cash in it. AND was using it IN a business setting, knowing that NOWHERE in the advertisements was it stated suitable as a burglary resistant safe. it had a 30 minute fire rating..he lost..

In the case of locks, the

and how would you negate this? nothing above the surface of the door allowed.. no key ways allowed.. OH CRAP, the power to the house was 'disconnected, I cant get in'.. LOL

correct.. all you got to do is change umpteen thousand building codes, etc, across the world.. good luck, call me when it happens..

but lets go ONE STEP FURTHER... in the IDEAL WORLD, no one would steal anything.. there is NO NEED for a 'lock'

A policeman was asked one time if he trusted his fellow officers on the force.. he replied 'WITH MY LIFE''... then, asked the lawyer, 'WHY DO YOU LOCK YOUR LOCKER, at the police station'?

--Shiva--

Pray tell us what brand / type of lock do you have installed on YOUR front door. ???

So, please tell us what brand and model / type of locks YOU have fitted to your home. Bet you have $10 Kwiksets on hollow core doors. You people are all the same, full of hot air, and live in computer / fantasy land. You geek types need to get a grasp on the real world. No flame intended, as you are no doubt a nice fellow, just a bit over educated & misguided. :-)

In the vast majority of cases the lock is perfectly fit for the purpose it serves. Even the lowest security pin tumbler lock is harder to defeat than the window right next to it, and frequently harder to defeat than the door and jamb. There have always been different levels of security. The customer chooses what they want.

This does not mean that Locksmiths are responsible and should

That is only true of the most glaring and unsafe of 'defects'. With regard to security there is one makers line of cars the vast majority of which manufactured over a ten year period can be started sans keys in less than 30 seconds with the simplest and most commonly available of tools. There has never been any recall of the vehicles and I am talking the majority of an entire manufacturers vehicles.

Nope the insecurities in most cases are unavoidable when the realities of the market place and manufacturing costs are considered.

Yeah? Try arguing that for a common lock like Kwikset.

No because the public does not want to pay for locks that do and in many cases why should they? My house has just under two dozen windows any of which is a perfectly good point of entry. How much real security do I get from the locks on my doors no matter what they are?

LOL As soon as you say that your argument has lost all contact with reality.

In an ideal world, all locks should - due to

The world is not now and never has been ideal. Nor will it ever be.

If this practice were employed, it would stand to reason

No it wouldn't because there will always be low end manufacturers that don't adhere to the higher level of security and customers that will buy the cheaper product, as often they shoud. Money spent on a good alarm system and monitoring service will give virtually all residential installations a hell of alot more security than any lock they put on their door.

Why? Much more secure hardware already exists. The 6730 and similar locks are typically used on safes that can be breached quicker than the lock can be manipulated. If you can go through the container itself and access it's contents in 15 minutes who is going to spend 60 or more minutes trying to manipulate the lock?

Nope. Nothing defective about it for it's intended pupose. If you need a higher security lock you buy a higher security lock.

I went to a brand spanking new subdivision yesterday. The homes were priced around 200,000 US. All the locks were those new style junk Dexter key in knob cylindrical locks with the SC1 keyway that are worse than Kwiksets and also they had grade three pot metal Dexter dead bolts. The locks turn to mush in the salt air down where this place is in about a year or two.

I was rekeying for the first new owner. The house was about 6 months old. It took a while to get the corroded plugs out of the shells on the knob locks and my plug retainer cap removal tool wouldn't fit the plug cap on the Dexter dead bolts. The dead bolts looked more like a Defiant than a Dexter. They had both been redesigned cheaper than the old style Dexter locks that you still see alot of and hold up fairly well.

The homeowner said he thought a few of the construction workers were going around breaking into the junk back doors and about 6 or 7 occupied homes had already been broken into over the last month. I told the customer that if someone wants in, they'll get in and after explaining the options, I installed a wrap around plate and strike plate with 3 inch screws to help with the doors. I told him to get a sign with a picture of a pit bull on it and put it in the window and get to know his neighbors.

When home builders buy cheap locks by the thousands and put them on cheap doors to build entire subdivisions, it's just crazy and it all boils down to the money saved by the home builder. The crooks can break in too easily without making much noise and drawing the neighbors attention.

Like you point out, unless the building codes are changed it wont change. If the codes change then it would be a good starting point. It wont do anything about the homes already out there except maybe help educate the owners about the quality of the locks they should have. Afterall most homeowners around here go to Home Depot and replace their own locks; most never see a locksmith for residential work. If the building code says cheap doors and locks are ok, then most people consider them up to par. They buy them and the circle continues.

Oh yea BTW, the home builders' or lock companies' master (construction) key system was using .015" number 1 master pins in this house. Think of all the trouble that'll cause the other homeowners in the subdivision after a little while especially with the locks being junk that wont hold up in the salt air down by the water. I dont even use .015" number 1 master pins on a grade 1 cylinder. I learned that the hard way when the key got jammed in the plug when the master pin got caught between the plug and the shell on an old style Dexter dead bolt I was rekeying one time.

Glen

No flame intended? Then why the did you? Has the tropical heat par-melted your brain Steve? Or did you have one too many Mango/Cane Toad skin smoothies? I thought you were describing Cairns when you stated "...full of hot air, and live in computer / fantasy land..." , but then I realised that no one in Cairns has the intelligence to switch a computer on, let alone type on a keyboard and have legible text appear on the screen. Please, don't troll and then apologise for it. Your entire post was specifically designed to elicit a reaction and congratulations, you succeeded. Just be honest about it next time rather than offering puerile apologies.

In answer to your assumptions:

My home security consists of:

If a burglar can make it onto the property and into any of the buildings while I am away without either being severely mauled or killed, then good luck to them. As you and your professional colleagues have stated over the past few days (quite possibly the past decade?), locks are insecure and the one lock I have is not worth mentioning. Suffice that it holds the door closed when the wind is blowing. Besides, I live in an unlined shed. If anyone really wanted to get entry, a saw or socket driver would do just fine.

I have an office in the city with (unfortunately) hollow core internal doors. However, the locks I employ are Schlage (Locknetics) programmable locks with BiLock manual keys. Expensive, provide next to no security, but they look impressive. The front door came from a tobacco warehouse in town (it's built to withstand most impacts and is fire rated to something or other...sorry not my field). The locks will eventually be monitored and managed from home...via a networked computer...if and when I decide that I'll risk using the Internet with all its insecurities to program my locks :o)

Now, on to this 'over-educated' and 'misguided' gibe. Please explain where you base your 'over-educated' statement. I left school at 15 and didn't start a Uni degree until the late 90's. I was nearly forty at the time. Prior to that I was a truck driver and before that I was a construction worker. Even earlier than that I was a hippy living on a commune in FNQ (Cedar Bay). Don't assume things Steve. I could assume you had no other education than locks and lock-picking and could make a statement such as, "you are a specialist, therefore you know a lot about a particular subject, but are just plain brain dead when it comes to thinking about anything outside the locksmithing industry". I could also make the assumption that you are an ex-Melbourne Heroin addict who went to Cairns because you owed too much money to drug dealers and were told drugs were easier to buy than toilet paper in Cairns. No doubt I would be wrong and you would be offended, so don't start with the name calling and assumptions please Steve. It reflects badly on you and the vocation you pursue.

Thankyou, Gryph

Lets look at it another way...

I looked at wrought iron railings today for use as a hand rail for some steps. Clearly marked on the display and the brochure: "For ornamental use only. Not for use as a saftey device".

Why does he have a hollow core door? Because it's sold as an exterior door and has no disclaimers. Why does he have a Kwikset? Because the box or display said it was for "when security matters". No one is telling him that it's not suitable for security.

The person that lost $15,000 in a sentry probably did not realize that "not a burglery safe" meant that it was easily opened. The person that buys a low end TL-15 rated safe from a locksmith will probably think that it really takes a minimum of 15 minutes for the safe to be opened by the best safeman in the world. If the rules aren't changed, only the locksmiths and the crooks will know that it's easily breached in minutes with the right tools and knowlege.

I suspect that if the major flaws were publicly disclosed, itemized and published, there would be enough lawsuits to put kwikset out of business.

If the kid next to my dad knew enough to use channel-locks on my dad's door knob, I don't think that we are really telling the bad guys stuff they don't know. We would be telling folks like my dad stuff HE doesn't know.

If the sentry safe had the following warning, more people would avoid it and learn about burglar resistant safes. "Caution; this safe can be easily stolen unless properly secured. A determined attacker can open it in minutes by destroying the door, sides or back".

Daniel

Great reply Gryph, so I see your 'not' some hairy arsed smartalec kid who thinks he knows it all. I also see you have a fine choice in canines with our Aussie Cattle dogs, and Aussie BiLocks, Good on ya mate. I got a bigger bite than all your dogs put together eh, ha ha. :-)). But seriously, you must realise that most of the proponents of all this ka-fluffell, would, on closer inspection, have el-cheapo locks fitted to their own homes. WHY ?? because quality and top security costs 20 times as much as an off the shelf key in knobset, and 95% are not prepaired to pay for it. I know that when I advise my customers to up-grade their locks to a grade one or two, they say, "hey, thats why we have home contents insurance". All of the rental companies, Realtors, etc want cheaper type replacement locks, so that the owners of the properties don't whinge about the up-keep expence of their property. I use, in general, 'middle of the road' locks, and I will not fit crapp, ..... ever. The lock market is totally governed by what the average Joe wants to pay for a lock. Your old enough to know that in real life you only get what you pay for. And by the way, it's spelt "Griffin" not Gryphonn. :-) Give the Blue a pat for me, don't like reds much as I had a hunk taken out of my arse while on a job a few years ago. Their agro buggers.

no, there are 2 other reasons.. 1 was $$$... he didn't want to PAY for a good safe.. and 2, was VERY lazy.. within 1/2 mile, was 3 banks with night depository services that he COULD have used..

--Shiva--

All of the above still likely provide more security than his windows and door jamb.

Why not? It's pretty self explanatory.

The person that

In reality it will typically take longer since 15 min is net working time. The exception is if methods are used that the safe is not rated against like explosives, and although powerful shaped charge explosives are still relatively easy to buy commercially, as long as you have no criminal record, when is the last time you heard of somebody actually opening a safe with them?

If the rules aren't changed, only the

That's typically not true, unless, as I said methods are used the ratings don't cover. Typically you are not going to get in a TRTL15X6 or TRTL30X6 in less than 15 or

Nope. The flaws have been publicly disclosed here and on probably hundereds of other public forums. The fact is that in the vast majority of cases low security locks are fine as used and are nowhere near the weakest link in the security chain.

Kwikset has actually upped their security with mushroom pins which frequently makes their product beyond the capabilities of many casual lockpickers.

I guess it could have the warning: "Caution repeatedly smacking your head into this item can cause personal injury" as well but how stupid do we really need to assume people are? If they can walk out of the store with it it stands to plain old common sense reason that somebody else can walk out of their house with it. I might add that many if not most burglary safes can also be carried away if they aren't secured. I don't care what it weighs if it isn't bolted or otherwise attached and maybe even if it is somebody will find a way to move it. The best solution is hide it. They can't steal what they don't know is there.

Naw. No need for that. All the common Sentry models can be opened in minutes and still leave it easily repairable. That's OK though because it isn't intended to be a burglary safe.

Those are both great breeds. I'm trying to picture what the cross looks like.

Good security system. Most people won't even get out of the car at my house when mine are out.

Don't get too overconfident. Even the best dogs aren't bullet proof.