WTB74
From What The Wiki?!
(This is the Bumping Revisited transcription, tape 74. It is part of Transcribing the Rehash videos, aka What The Book.)
What The Hack - Bumping Revisited
2005-07-??
Han Fey (HF), Barry Wels (BW)
[74/04:00]
BW: OK. Welcome to the 'Bumping Revisited' workshop. I'm glad that you all found this an interesting topic to come and have a look. 'Bumping Revisited' will be held by Han Fey, which is the gentleman on my right (hi), and myself, Barry Wels.
How many people know what 'Bumping' is about? How many people actually have an idea..
HANDS UP
OK. So about 90% of the people already know what this is about. For the other 10% I will try to explain what 'Bumping' is. Bumping is a vulnerability that's discovered, that can open almost any lock. Any mechanical pin tumbler lock. Without damaging it. In little time. With very little training. And using very inexpensive tools: very easy to make, cheap tools.
As far as I'm concerned this is one of the biggest threats for mechanic lock security as we know it. There are people who think it's not. We will go into that a little bit later. But if you get enthusiastic after or during this workshop and you want to try the technique that I'm going to describe yourself, visit us at the Lock-pick Village. There's a big, white tent near the entrance on the left. That's the Lock-pick Village. There will be bump keys, there will be locks. You can see for yourself how dangerous or how easy it is to actually open the locks.
I've learned about this technique in Germany when we visited our German Sportsfreunde der Sperrtechnik, which is a German lock sport group. One of their members, Klaus Nog, did a demonstration there about this bump key technique. And my mouth dropped when the impact hit me like 'OK this is something really major'.
Back in Amsterdam I tried it myself, because I'm someone who likes to know for sure that something works. I mean: somebody can give a presentation and it looks very interesting an very easy, but I would like to know it myself. And I was really really shocked by the amount of locks that I could open easily like that. It was amazing.
I wrote an English white-paper about this technique. This technique was described in German quite a lot, but in English there was almost no documentation about it. So I decided with my friend an business partner Rob Gongrijp to write a white-paper about it. That has been out since December 2004 and in December 2004 I also did a presentation at the Chaos Communication Congress. The video of that presentation is online. I still get a lot of positive comments from everybody all over the world. That they didn't know that this existed and that they tried this themselves. I get a lot of mail from people who succeeded in opening locks themselves.
When the white-paper was published on our website, toool.nl, the Dutch media got it. The Dutch media paid some attention and there was an item in a program called Nova TV. Nova, if you're not from Holland, is actually not a bad program. Normally 50% of the program is about politics. They are really into the news. They are considered to be very serious media, so when Nova contacted me and said 'we want to do an item about bump keying' I said 'well, that's OK'. I don't think I would just have agreed with any media, but Nova sounded like a good, trustworthy match to bring this into Dutch media.
[74/08:00]
They made a 7 minute item, which is also available on our website. You can download it. I subtitled it, so if you're not from Holland, you can still see what's it about. And I was a little bit disappointed that, even though Nova had quite a good reputation, they did make a little bit of a show out of it. They found a locksmith that had some pretty bold statements. I cut some video from this 7 minute clip and I hope that, if the technique doesn't fail, that you can see what this is all about. And you can maybe see what impact it had on the Dutch public when they saw it.
NOVA CLIP START
Speakers in clip: presentator (P) locksmith (L) questioner (Q) Barry Wells (BW) unknown man in suit (S)
P: The 'safe housing' approval stamp of the police seems to have lost its value. By now keys can be ordered on the Internet or from the local key shop with which almost any lock can be open without a trace. You shorten the key and make the cuts a little deeper, hit it with a hammer and that's it. The more expensive the lock, the easier it opens.
L: And there is your bump-key. And there it is. Q: How long did it take you? L: Ten seconds. Q: What can you do with this key? L: I can knock open any lock in which this key fits. Q: Are you sure? L: Perfectly sure!
Q: You researched this method, what's the most important conclusion? BW: The main conclusion is that we have a problem with mechanical locks and I was really shocked by the number of locks I could open just like that in the hand. Q: Every lock here can be opened? BW: Without a problem. BW: We begin with a simple lock, although simple it's got a very narrow key way. It's a five-pin lock, but with one blow it's open.
L: And here we have a DOM-key, a Niemef-key and a Lips-key. Q: Here are 10 keys, with them... L: We can bump open 90% of all doors.
Q: And it's open? L: And open it is. For locks currently on the market this is the end of safety by means of keys. Q: Wonderful! L: A 10 dollar lock protects just as well as a 100 dollar lock. It offers the same protection.
Q: You wake up, your TV, everything is gone and your door is locked: what does the insurance company say? S: Probably they refuse to pay because there are no traces of burglary. Q: That's a pity. S: Yes that's a pity.
J: Police approval 'safe housing' mark, what does it mean? L: It means your house meets certain standards and is burglary-proof. J: And then the bump key shows up. How long does it take to get inside? L: A couple of seconds. J: Can you show us please? L: Here's a lock and bump key. Tick tack it's open. J: What's the use of the approval mark? L: If this method gets known (and it _is_ already in use), this approval mark becomes obsolete and you might as well leave your door open.
NOVA CLIP END
[74/12:15]
BW: Ahem. You can understand that the police seal of approval was not too happy with this statement.
LAUGHTER
BW: I don't think it's a rightful statement. I think it's a little bit too aggressive. But he _is_ right. The problem is pretty serious. If you see the reactions from other parties, for instance the chief of the institute that certifies locks. They are the authority putting a stamp on the lock itself. In Holland that's S.K.G. The chief of S.K.G. himself went on television and made some statements, and in the media made some statements.
The most interesting statement that even made me smile a little bit said 'this is Hans Kazan at work'. Hans Kazan is a famous Dutch magician who does tricks. So he said 'yeah, you know, this is all a trick, this is not serious, this cannot be done'.
[74/13:19]
One other statement
