Make:

I've always ignored my current front door lock, as someone could just break the (very nice, acid etched) window and turn the lock by hand.

I was idly considering replacing it with a double-key deadbolt, but the only reason to do so now is for insurance purposes, if this information is for real.

I'm curious if the lock I have can be bumped open. I suspect not, because it's one of those sprung bolt external boxes. Easy to defeat in other ways, but it looks like this method requires physics that a bolt under tension would disturb.

What is really ironic is how long the last joker took to scratch at the lock and door with a screwdriver. Once I _finally_ woke up I called the police but he must have heard me moving around.

That TOOOL group are pretty geeky lock freaks, though! There is a long tradition of smart people defeating locks and safes for fun, which I admire.

Reply to this comment

The mechanical keys are interesting, but the magnetic ones are even more. I'd like to try out the magnetic ones. I didn't think they were as easy to overcome as the mechanical ones. It's pretty easy to get into most homes, the method depending on location of the house and construction. I heard once that new homes sometimes have wallboard inside and only vinyl siding with no wood siding between, so entry was possible thru a wall with a sturdy box cutter. Security systems send alarms, but don't offer physical barriers, just psychological. Locks, or security devices, do just keep honest people honest and offer challenges to other folks. Bump keys, like other devices, are useful when keys are lost/misplaced(inside a car perhaps) or locked objects are bought at auctions. Of course police, security and intelligence outfits as well as locksmiths can use them. It's interesting to hear about the tool group and useful to honest folks to know about this stuff because local police oftentimes don't and you may be able to educate them should your home, shed or car be burgled without being forced. Might even be of use to someone on a jury!

Reply to this comment

There have always been the gun style lock picks:
http://www.lockpickshop.com/p-Lockaid.html

But this method is super cheap and looks like no skill is required, if this catches on I think electronic locks will become more common:
http://www.nokey.com/safbiomfinlo.html

Reply to this comment

Bought the set you linked to. I'll comment here again after I get them and test all my locks around the house.

Reply to this comment

I also sell keys if you cannot find them on ebay. Email me at mrdoody55@hotmail.com with the subject line "Bump Keys" and ill get back to you with more information. :)

Reply to this comment

Articles that encourage illegal activity shouldn't be on here.

Bad for you Make

Reply to this comment

Articles that encourage illegal activity shouldn't be on here.

Bad for you Make

Reply to this comment

MetroSonus - i don't think being aware of security risk encourages illegal activity. locks are for honest people. i'm glad all the other comments here are from folks who are going to test their homes/locks and explore this potential flaw.

Reply to this comment

MetroSonus:

There is NO security through obscurity.

Not publishing articles on this does not make the vulnrability go away.

It is logically fallacious to accuse Make of 'encouraging illegal activity' by bringing this security problem to general public attention.
Thieves already know of this technique and have probably been using it for many years.
They are the ones that want no-one to know about it as it makes their 'job' easier.

By knowing of this technique you can make intelligent choices on how to secure your property and person, rather than naievely trusting what the lock manufacturers marketing departments tell you.

I for one commend Make for this article.
I hope they continue to write articles on such topics and do not fall victim to the myth of 'security through obscurity'.

Reply to this comment

If there's really "no security through obscurity" then, if you please, share with us your login & root passwords, your IP address, and any interesting services you have running on your computer.

What, you'd rather keep this info private?

How about your social security number, or your driver's license number, care to share those?

No?

There's nothing at all wrong with security through obscurity. The trick, which this slogan completely misses, is to be aware of the tradeoffs you're making, minimizing your exposure and being aware of your risks and of who you are trying to protect yourself from.

The vast majority of people are honest, and will not try to break in to your home whether or not you lock it or they have a bumpkey; you don't have to worry about them.

A vanishingly small number of people will be able to break in no matter what you do, either because they don't mind leaving behind a smashed window & a wailing alarm, or they have the expertise & the resources to get around any measures you could come up with; there's little point worrying about them, as most people are powerless to stop such intruders, but most people aren't interesting to such intruders.

Then in the middle, between the honest & the resourceful, there's a few people that might try to break in opportunistically if they get a chance to do so, but would give up easily if they met any resistance. This fits the vast majority of the "bad people" one might have to worry about, and for them, "obscurity" is a reasonable deterrent. If they don't know about bumpkeys, you're better off.

But please, don't let thinking things through get in the way of yet another chance to parrot a catchy slogan.

Reply to this comment

The reality is, if it can be made by Man [Woman], it can be hacked be Man [Woman]. Anecdote - I grew up commuting from my home in one community to my Father's base in another. It involved traveling on a Ferry. There was more than one occasion when the captain would put out a page for 'One of the Smiths' to com to the aid of a driver who had locked themselves out of their car. Why? We always had the 'Tools' [Picks, Flatbars] and the skill.
The reality is, it is not the tool that makes the criminal, it is the mindset, and frankly I rather allow the access than have it disappear into the ether where only those with access, had access.
Lest you think this sounds like a variation on the Classic NRA argument, Email me and I'll clue you in.

Reply to this comment

The reality is, if it can be made by Man [Woman], it can be hacked be Man [Woman]. Anecdote - I grew up commuting from my home in one community to my Father's base in another. It involved traveling on a Ferry. There was more than one occasion when the captain would put out a page for 'One of the Smiths' to com to the aid of a driver who had locked themselves out of their car. Why? We always had the 'Tools' [Picks, Flatbars] and the skill.
The reality is, it is not the tool that makes the criminal, it is the mindset, and frankly I rather allow the access than have it disappear into the ether where only those with access, had access.
Lest you think this sounds like a variation on the Classic NRA argument, Email me and I'll clue you in.

Reply to this comment

cdevers:
You attack me for sloppy thinking by starting your argument with a straw man fallacy?

I agree that making your personal data public is both stupid and wrong.

That has NOTHING to do with the phrase "there is no security through obscurity".

This slogan is mearly used as a simplification for the idea that if a system is vulnrable that it is the responsability of the manufacturers/maintainers of the system to make its users aware of and fix said vulnrability.
And that manufacturers/mainainers that RELY on obscurity for the the perception of security are being duplicitous and naieve.

Your satement of "if they don't know about bump keys you are better off" is CORRECT.
But again it is nothing to do with the ideas behind said slogan.

The problem with your position is how do you guarantee that these opportunists don't know about bump keys?

The answer is that there is no effective way.

As soon as a vulnrability is known it is out there to be found out. Regardless of if Make, or anyone else, publishes the vulnrability.

The only solution to this problem is to fix the problem.

And the more users that are aware of the problem, the more likely that manufacturers will be motivated to invest the time and resources into finding a solution.

Perhaps the slogan should be changed for people like yourself, literalists, into:

There is no guarantee of security once a system has a vulnrability, regadless of how widely known the vulnrability is.

but it won't fit on a t-shirt and is not as catchy. ;-)

Reply to this comment

The best and most affordable solution that I have found to prevent the lock bumping of deadbolts is Lock Jaw Security (www.lockjawsecurity.com). Although it is engaged once you are in your home, which makes it portable, it works with virtually any single cylinder deadbolt. It is a good way to prevent home invasions that could result from someone even having the actual key to the deadbolt.

Reply to this comment

Public service site about lock bumping.

http://lockbumping.org

Reply to this comment

If you want some thing for lock bumping go to www.matlockllcc.com It works great, all you have to do is hang it on your dead bolt. It is cheap to buy, looks good on the door, easy to use and if you live in a apartment you can take it with you when you leave. I feel safe with it on the doors.

Reply to this comment

hey, i just got a set of bump keys from www.bumpmylock.com and noticed they have bump proof locks too, if they are as good as the keys i got that would be cool.

Reply to this comment