Images from ‘copying high security keys’

I do not like to depend on other peoples images, and try to create my own if I can. The images for my presentation at the ‘Last Hope’ conference were no difference.

Dutch phone phreak key

On this image (click on it for a high res version) you see a copy of a high security key, made by Dutch phone phreaks around 1995. Because these phreaks could not get the blank key for the target lock, they found a metalworker who ‘simply’ 3-D measured the key and cut a copy out of a solid piece of brass. What is special about this key profile is that the key has got ‘ribs’. These ribs are scanned by the lock, and on one spot there has to be metal, while on an other part there must not be metal. Sort of like checking for 0 or 1. If the expected value is not present, the lock will jam after 90 degrees and ‘eat’ the key. In most cases probing the side channel with a thin paperclip will release the lock again….

Unfortunately, for this photo-shoot I did not have the original key, so I photographed the brass copy next to a similar key (from a different system).

The bottom line I was trying to make with the presentation is that no matter how complex the manufacturer can create a mechanical key, a bad guy with enough time and motivation can create a copy.

I got a busy week ahead, so my next posting will most likely be from Las Vegas (Defcon).

9 Responses to “Images from ‘copying high security keys’”

  1. ax0n says:

    Looking forward to meeting you in person at DefCon, Barry! I haven’t been there since DefCon 9. I couldn’t miss this one.

  2. Jean-Claude says:

    Who says you have to be a bad guy to want to make a copy? 😉

    ‘Eating’ the key is funny as hell too.

  3. Jean-Claude says:

    Talk about captive key.

  4. Schuyler says:

    That was a great talk, Barry. Looking forward to DC.

  5. raimundo says:

    Looks like the key mentioned in some recent article in 2600 magazine, I hope they changed the locks since then, the thing only seems to address 4 pins along the top edge. ;~}

  6. Barry says:

    raimundo: It is the same brand and type as the one in the artcile, but this is the 5 pin version. The one from the article is a 7 pin one. The key on the image has a ‘0’ cut on pin number 5 (on the tip). So there are really 5 pins in the lock, and at least on pin on each side of the wing (sometimes 2). Good observation though 😉

  7. Jean-Claude says:

    Oh wait, I forgot. This isn’t LP101.
    Hell, I’m back (I never went anywhere)
    High security decoders/bypass for all!

  8. Jean-Claude, what exactly is your problem? You seem to be not very mature with your attitude.

    If you want to post decoders and bypass info in LP101, you have to apply for the advanced access. But as we there already saw your attitude and rude act towards other members in the community, I think you are not welcome there.

    There ae other forums where you can post whatever you want, so you don’t have to cry about not being able to post the info you want on LP101 open forums.

    To recap this shortly: Your problem is your attitude, hich is rude and immature.

  9. ben says:

    can i buy this thing???

Leave a Reply to ben