Hacking modern cars and car locks

August 18th, 2006

Testing is fun. Especially testing locks and tools. And it is even
more fun when people claim locks can not be opened and you show it can
be done. Without damaging the locks of course.

autobild

I received a mailing (PDF) from the Wendt lock tools company in Germany. As
far as I know they are the biggest and most complete lock opening tool
supplier in Europe (in the world?). I try to visit their yearly ‘open
house’ meeting as often as I can. Walking around there and looking at
all these magnificent tools is always a great pleasure. And their catalog (PDF) is a ‘must read’.

wendt case

They supplied tools and expertise for a big test on cars and car locks
for the famous Auto Bild magazine in Germany. My German is a little
rusty, but here is a rough translation from part of the mailing Wendt send
around a couple of days ago:

“together with us Auto Bild tested in what time modern cars could be
‘hacked open’. The challenge was to open the cars free of damage. We will
not give the exact details of the test but on ten tested models the
results where rather shocking.”

wendt deluxe

I do need to get my hand on this magazine of course. So stay tuned for
a scan. (update 17:00 the magazine was sold out, will try other ways)

An for the people in Europe: an item on German television about this test will be aired Sunday.
To be more precise: Sunday 20.08.06, RTL, SPIEGEL-TV Magazin 22:35

The ‘Russian lock’ ….

August 16th, 2006

I bet you have never seen this lock before.

russian lock

If you have you are either a Russian ‘diplomat’, have worked as a high ranked officer on a
Russian nuclear submarine or operated a nuclear plant there. Or you are a member of Toool or Ssdev.

Little is known about the lock, only that it is (was?) in use at the
most critical parts of the Russian government and military. Fact is
this lock is extremely rare. A US DOD lock specialist has been trying for
years to get his hands on one, without success. He only located three
of these locks in the world. Safe technician Paul Crouwel owns one of
these three locks. He will show you on the ins and outs of this very
special lock in an exclusive blackbag video (wmv 77 Mb).

russian lockinside out

The lock has a seal function. It does not take much force to
break the lock open. The design goal was obviously to prevent
unauthorized and surupticious access. The story we heard was that the
lock was in use at Russian embassies. Instead of importing heavy safes
from Russia they just bought a decent model on the local market. They
secured the entrance of the original key hole with this lock. So in
order to open the safe you first need to get passed this ‘seal lock’.
To open it you need to dial a combination and use a key. So it can also be
used in a system where two people are needed to open a specific safe.
One person knows the combination and will dial it while the other
person only has access to the key and operates it. The other story we
heard was that is was used in nuclear facilities and submarines. But
we do not know for sure. We do know it is a lock with a strong ‘spy vs
spy’ smell.

If you know more about this specific lock we would love to hear from you!

(* More info is available here )
(** and you might want to read the comments …)

Assa Twin key depth decoder

August 10th, 2006

I had my eye on this one for a long time. As always it is a simple and
small thing and it is not even expensive. But it can turn out to be
pretty handy from time to time. Especially if you are a big ASSA fan
like myself.

assa twin key card decoder 

This stainless steel card can be used to decode (or ‘read’) ASSA Twin
keys. Just stick the key trough the hole of the card and see how far
down you can slide it. If it will not go any further you have decoded
the cut and can move to the next cut to read it. After having read all
six cuts you decoded the key and can make perfect copies on a
computerized machine. What I like about this card is that it does not
only let you decode the key but will also inform (or remind) you about
the specific characteristics of this ASSA Twin key. Take for instance
rule number seven: Maximum Adjacent Cut (MAC) = 5. I assume this means
two pins next to each other are not allowed to jump up or down more
then 5 depths. I was not aware of that. What about the last line:
Sidebar code on Assa Twin key is always pre-cut at factory. As a
collector of their sidebar profiles I did notice that before …

Besides decoding 600 and 6000 keys this card can also be used to
decode other sidebar key like the Twin2, V10, Twin pro, Max and
Maximus.

If requested I could shoot some video decoding a key for you …

Digging for gold in the patent database

August 8th, 2006

There is a lot of people smarter then you. And most of them are dead.
At least that is my impression when digging trough the goldmines of
the USPTO (United States Patent and Trademark Office). Just search for
‘Lock AND pick AND decoder’ or other queries. The results are amazing.
Especially if you go back before 1950.

lock decoder 

(lock decoder 1937 by H. Abrams)

Unfortunately it is not possible to save or print these pieces of
art. Or maybe I am just lazy and did not invest enough time. So I just
took advantage of the ‘analog loophole’ and took a picture of my
screen to show you what to expect on that site. For hours and hours of
fun and education visit: http://patft.uspto.gov/netahtml/PTO/search-adv.htm

Happy hunting!

Bumping locks

August 4th, 2006

Without looking at my stats I clearly see global peeks in awareness of
the bump key problem. All of a sudden I receive a bunch of mail asking
if I am am willing to test locks for company X, whether I am available
for presentations, or if I sell bump keys or the ‘Tomahawk’
bumphammer. Especially the Tomahawk, designed and made by 92 year old
German engineer Kurt Zühlke, seems to be what most people are looking
for. And very often I have to disappoint them. Kurt does not make a
whole lot of them, and the ones I get my hands on I trade or give
away.

tomahawk by kurt

In my latest presentations I also demonstrate a new type of hammer by
Jens Andrews. This so called ‘power hammer’ is made of … shoe sole.
It has turned out to be an excellent tool for the job. I like it and
need it sometimes when that little ‘extra power’ is needed to let pins
jump. Jens uses a rather expensive and delicate technique to glue
multiple strips of shoe sole together to create a hammer this accurate
and almost indestructible. I will relay mail to him if you are interested in one.

 power hammer by jens andrews

The lock (tools) industry has also discovered money can be made
selling bump hammers. At the ALOA locksmith tradeshow in Las Vegas
last month I noticed some vendors where selling commercial bump
hammers. Some of them even sold complete keyrings with 999 keys for
the most popular US lock brands. Peterson manufacturers designed a
hammer called ‘Tommy Hawk‘. This nylon hammer has two holes in the
back. These holes can be filled with lead or sand to give it extra
weight. At first I was afraid the hammer would not have the mass
needed to transfer the right amount of energy. But it proved to be
almost as good as the original Tomahawk.

tommy the hawk

Consumers in the US are starting to realize there is a problem with
their locks. Newsweek did an article on bumping and it is causing a peek here….

Let the games begin!

August 1st, 2006

Steffen Wernéry, chairman of the German sportgroup Ssdev, is a busy man
these days. He is organizing the German lockpick championships. And
that is quite a task. I know what it is like because I am responsible
for organizing the ‘Dutch Open‘ lockpick championships. And it always
takes more time and energy as you might expect.

Anyway, the German sportgroup invites you and the rest of the world to
come and compete in their ‘open’ game. And who knows … you could be
the new German lockpick champion!

games (Dutch Open 2005) 

 

The location they picked is really wonderful: the worldfamous lock
museum in Velbert
(Germany). This year the event is extra special
since it will be the tenth anniversary of the games and the seventieth
of the museum .

Hope to see you there October 14th and 15th (10 am to 6 pm)

Read more about the location, type of games, hotel arrangements etc in this invitation.

Against voting computers

July 31st, 2006

It is not only the lock industry that we upset from time to time.

Recently Rop Gonggrijp and myself decided to set up a campaign against
voting per black-box computer in The Netherlands. The campaign is
already a success. Instead of calling them ‘voting machines’ now
everybody is talking about ‘voting computers’. Because that is what
they are: computers. And we all know computers can make mistakes and
can be manipulated. So we want the paper ballots back!

We are retrieving documents from Dutch Government concerning voting
computers trough ‘WOB‘, the Dutch FOIA. Documents we have retrieved
are already on our site. It now seems the Dutch producer of Black-Box
voting computers SDU is unhappy about some of them. And they should be
because they clearly show voting per computer is more expensive and
less reliable. Introducing voting computers in Amsterdam was 1 million
euro more expensive compared to voting on paper ballots. A lousy 3
euro per vote extra for a completely non-transparent system.
Wonderful.

But tough luck for them… The information remains on our site and
(worst of all) is generating a lot of publicity and awareness…

 
gris

Our site is written fully in Dutch, including a comic by Koen
Hottentot. Even without understanding Dutch I think you will
like it and get the point.

Lockpick Village

July 28th, 2006

At lockpick village you can learn the art of lockpicking and other clever way to bypass locks.

Maybe one day there will be a real lockpick village on this planet.
For now it is a mobile village, that travels from conference to
conference. The village does get more professional over time and so do
the people that run it. Thanks to people like Eric Michaud, Eric
Schmiedl, LSI, Renderman, Deviant Ollam and many others the Hope
number Six lockpick village was a great success.

For those who missed it some exclusive video. If you are on this video
and would like to be edited out please send me a private message.

lockpick village hope number six 

(Video WindowsMedia, 17 Mb)

 

 Next stop for the mobile lockpick village is Defcon

13 song’s tool

July 27th, 2006

It is a funny company name, 13 song’s tool.

But these Korean people know what they are doing. Their website is
simple and basic, and I only recognized the quality of their tools
when I met them a couple of weeks ago in Las Vegas.

They developed some nice and elegant picktools for the most modern
‘laser track’ car locks. The tool on the images is for opening Opel locks.

opel pick by 13 songs tool

 
More close up, high resolution images of the tool can be found here (zip 4 Mb)

close up of 13 songs toool 

I like their design of the hollow car key with the drilled holes. This
will prevent you from from slipping between the levers while picking.

All I need now is some Opel locks to start practising …

Hope number six pickset

July 23rd, 2006

The Hope number six conference in New York is great and it is a pitty
today is the last day.

The lockpick workshop with Marc Tobias went ok. Not the best ever (due
to bad video display) but it still went fine.

 

(Image by Jake Appelbaum)                       The conference deserves
a compliment for outsourcing the camera work to www.ncrsusa.com.
Trough magic these folks sell a DVD of the presentation the moment it
is finished. And for just $10. A great service. It is nice to hear the
lockpick workshop sells real well. I did not have time to visit all
the presentation I wanted to see so I bought some DVD’s myself.

At hope number six there are lots of nice people who are into locks,
and there even is a complete lockpick village set up. But more about
that later.

And I wanted to share the design of our new pickset. It was made to my
specifications, and people who know me will tell you I like
hook/finger picks. The more finger shapes and sizes the better. But
you can not live without rakes for speed-opening, so I threw in a
couple of them too. And four different size tensioner ends on the
classic Toool tensioners. 

hope number six pickset

The steel if the best material I have seen so far. Thin yet very strong.

Hope vistors seem happy with it. And so am I ….