Analog Hacking Blog

Recently in a Barry “The Key” Wel’s blog entry, he describes a German Discovery channel show featuring FBI agent Ed Tickel. In the 1970s and early 1980s, Mr. Tickel was the ‘go-to’ guy anytime the FBI needed entry into a locked area. In the video (an excerpt is available on Barry’s blog) Mr. Tickel not only talks about his adventures fighting crime but also demonstrates his favorite lock opening method “impressioning”. Using skills like these he legally broke into various Mafia strongholds allowing agents to gather information and plant bugs without anyone knowing.

It appears, however, that Mr. Tickel didn’t limit using his impressioning skills to helping bring the Mafia down. Instead, Mr. Tickel maintained a luxurious lifestyle featuring a large boat and multiple sports cars through theft. To find out more about the adventures of Mr. Tickel and his eventual downfall, check out the following book references/news articles:

Here is a link to a summary of the Washing Post story:
Former FBI Agent Gets 8 Year Term

An excerpt from “The Bureau: The Secret History of the FBI” that has a little more detail than the Post story:
The Bureau: Secret History of the FBI excerpt

And finally, after being convicted he claimed that the FBI used his talents illegally in several cases and this was used by a couple of Mafia members to file appeals:
Time Magazine Article

On October 13, 2007 lockpicking101.com reached it’s 50,000 member. Below is a graph showing the growth of LP101 since it’s inception (click to enlarge):

As you can see, since about July of 2006 LP101 has been growing at about 1,000 new members every 12-18 days.

Dean recently published on his blog (& YouTube.com) instructions for making your own handy under-the-door-tool (watch the video if you are not sure what that is). While information about these tools have been around for a while (for example, check out Hans Conkel’s book on Amazon: How To Open Locks With Improvised Tools) it’s ready availability on sights such as YouTube and the Make Magazine Blog are pushing this information out into the public like never before.

How do you defend against this sort of attack? Well since reverting back to round knobs is not really an option (due to ADA regulations) you might possibly try to mount the door handle facing straight down (as is suggested in one of Dean’s subsequent blog entries). However even if the door hardware made this change possible, this strategy could be easily defeated with a variation of the same tool. You could also look at limiting the gaps around doors to make using such tools more difficult (however, doors tend to sag over time making this difficult to maintain). Therefore it is critically important that you always design your security plan to defend against a single point of failure. Incorporating additional elements such as alarms and CCTV, which depend on radically different technologies than locks and doors, won’t suffer from the same weaknesses as these other security devices. Of course, even these technologies can sometimes also be bypassed or defeated, but having to remove multiple layers of defense greatly increases the difficulty in executing a non-destructive entry.

The Medeco M3, the new UL 437 and ANSI 156.30 certified lock (which specify protection from covert entry for 10-15 minutes), can easily have one of its three primary security features bypassed. The feature in question is the new slider mechanism which can be retracted with any piece of wire (including a paperclip) as is shown in this video by Marc Tobias:

YouTube Video

While this bypass technique doesn’t open the lock by itself, it paves the way for existing Medeco attacks including illicit key duplication and bumping.

A detailed written description is also available at:
The Medeco M3 Meets The Perilous Paper Clip

Skills like lock picking and illicit key duplication are rarely used in thefts. The reason is simple, it is a lot quicker & easier to simply kick the door in or pry open a window. Also the thief doesn’t need to try to hide the fact that here has been a break-in, the missing TV & stereo speaks volumes.

If someone is stealing mail for identify theft purposes, however, the crooks don’t want anyone to know that things are missing. If, for example, your locked mailbox had been pried open you would immediately suspect that checks or credit card information may have been stolen and cancel them. That is why ‘arrow keys’ are the Holy Grail to mail thieves. What are arrow keys? They are the master keys the U.S. Post Office uses to open all of the locked mail boxes along a certain route (a confiscated set is shown above). The post office tries to keep close track of the keys (they are supposed to be checked out and back in by Postal workers each time) but that hasn’t stopped criminals from obtaining the keys in various ways.

In fact, the methods used to get arrow keys range from as simple as a Postal employee gone bad (like the rural mail carrier who sold stolen postal keys) to sophisticated methods such as the ones used by Joseph Lau.

It appears that sometime around 2005 Mr. Lau graduated from using simple mailbox ‘fishing’ methods (using a sticky block of wood on a wire to retrieve letters from a drop box) to creating his own arrow key production technique. The method he used was to secretly video tape Postal Workers opening mail boxes along their routes. He would then enlarge still photos of the key and use that to cut a home-made duplicate. In all, Mr. Lau produced 23 counterfeit arrow keys and obtained almost $500,000 in stolen checks before being caught.

Mr. Lau is not alone, however, in the ‘custom’ arrow key creation business. A quick search of the Internet turned up several others, including Wendy Trail in 1999, Steven Gregory Freitas, also in 1999 (after a similar arrest in 1996), Craig Alden St. Clair in 2002 and Michael Hannah in 2006.

Barry ‘The Key’ Wels is a co-founder and noted leader of the ground breaking TOOOL.NL locksport organization. Based in the Netherlands, TOOOL not only practices lock picking as a sport, but also actively researches locks & lock security. This places Barry on the cutting edge of lock picking & bypass techniques, as well as, giving him access to locks & devices that the average person would never see. Fortunately for us, Barry takes us along in his journey at his blog, Black Bag.

Although I have mentioned several times the most popular lock picking forum online today, LockPicking101.com, here are several others that I have come across:

Yahoo Locksports Group

Lock Pickers Network

EZ Picking

Toool.us (TOOOL members only)

The recent attention in the local and national media about lock ‘bumping’ (a quick, low skill lock opening technique) has caused the ALOA (Associated Locksmiths of America) to release a statement condemning the release of such information by “attention seeking individuals”. They also state that by publicizing the situation a serious security problem is being created: ALOA Statement

In turn, Marc Weber Tobias, a noted lawyer in the security field, has responded with his own statement regarding the rights of consumers to know about potential flaws in the products they buy. He also points out that knowledge about this technique had ‘leaked out’ to the Internet long before any of the recent news reports occurred and is readily available to anyone: Marc Tobias Statement

Recently there has been a rash of ‘bumping’ (a simple lock opening technique using a specially cut key, see the photo to the right) and lock picking in the news media. Here are links to several of the articles and reports:

Newsweek Article

Channel 5 in Cleveland Article

YouTube Video of CW11 News

NaplesNews Article (Wall Street Journal)

YouTube.com, the popular, online amateur video site, hosts more than 24,000 (mostly bad) karaoke videos. However they also have over 200 lock picking videos. Here are snapshots from just a few: