Full Disclosure mailing list archives
Re: Master Lock random key code generation/distribution Fails
From: Richard Chycoski <rac () cisco com>
Date: Wed, 26 Mar 2014 15:38:13 -0700
Keycodes on padlocks do not (normally) have the bitting code numbers on them. The keycodes have no relation to the bitting codes. Master locks that I've seen certainly don't, and even the cheap locks on our cabinets in the office do not either.
When I had a set of locks custom-keyed for a previous house, the locksmith put the bitting code on one key of each time to make it simpler to set up if/when I needed more keys. I never carried these keys around, since anyone spotting the bitting code could easily make a copy. I recommend that people never carry keys with the bitting code on them, put them away in a safe place.
For my current house I keyed it differently. There is a master key that opens everything. There is a front-door-outside key that only opens that one lock, so that if someone (read - some kid :-) ) loses that key I only have one lock to change. There is an 'inside' key that only opens the inside deadbolts, and when the house is occupied we leave inside keys in those locks - and if someone wanders off with one, they're not useful for getting into the house. For these keys, the locksmith did not stamp bitting codes on any of them. It depends on the locksmith.
- Richard On 3/26/14 3:17 PM, Daniel Miller wrote:
On 03/26/2014 05:03 PM, Jon Hart wrote:This is definitely an interesting finding. I'll admit that I don't know what the key code actually does or how it is used, but at the risk ofstating the obvious this is physical world equivalent of problems we face daily in the infosec field -- randomization is hard, small key spaces are bad, and vendors will continue to make this mistake (hopefully) until it isdisclosed. -jonJon,The key code is used to identify locks that share the same key. For a pin tumbler lock, it usually corresponds exactly to the height of each of the pins in order. So the key code 2685 in the image probably looks something like this:|^\ |..| |..\___ |......| |......\_ |........| |......_/ |.....| ******* Dan _______________________________________________ Sent through the Full Disclosure mailing list http://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
_______________________________________________ Sent through the Full Disclosure mailing list http://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
Current thread:
- Master Lock random key code generation/distribution Fails Jimb0 Hon1nbo (Mar 26)
- Re: Master Lock random key code generation/distribution Fails Daniel Miller (Mar 26)
- Re: Master Lock random key code generation/distribution Fails Jon Hart (Mar 26)
- Re: Master Lock random key code generation/distribution Fails Daniel Miller (Mar 26)
- Re: Master Lock random key code generation/distribution Fails Richard Chycoski (Mar 26)
- Re: Master Lock random key code generation/distribution Fails Jeff Kell (Mar 26)
- Re: Master Lock random key code generation/distribution Fails Deviant Ollam (Mar 27)
- Re: Master Lock random key code generation/distribution Fails Jon Hart (Mar 26)
- Re: Master Lock random key code generation/distribution Fails Steve Pordon (Mar 27)
- Re: Master Lock random key code generation/distribution Fails Daniel Miller (Mar 26)