Archive for oktober, 2022

Czech Lockpicking Championships

maandag, oktober 31st, 2022

The Association of Czech Lockpickers held their yearly competition last weekend. Starting up after COVID, they offered a limited program without impressioning championships, but still included a padlock competition, blitz, cylinders and freestyle.

I (Walter) went over to participate. There were competitors from Czechia, Germany, Austria, Hungary and I was the representative for the Netherlands. The championships were held at a nice and cosy facility, giving ample room for socialising and catching up with old friends.

Some of the ‘usual suspects’ were absent due to work or for other reasons, but still there were plenty of people participating

Padlocks

First up was the padlock competition. The padlocks were provided and differed quite a lot in difficulty. You are allowed to test your tension wrench before the clock starts. For one particular lock, it was hard to test the tension wrench without accidentially already opening the lock.. on the other side of the spectrum, some of the Tokoz padlocks proven impossible to open in the allotted time.

I had a tool stuck in a lock which I why I didn’t make the A-finals. But all for the best, because in the B-final I then became second. There were 7 people in the A-final, 9 in the B-final.

Blitz

The blitz competition requires opening locks within a minute. Each participant brings their own lock. I was a bit confused here.. I’ve done such competitions before. I fondly remember the one held by SSDeV in 2003. People would give me the lock and tell me exactly how to open, because the goal here is not to bring a difficult lock, but to encourage beginning lockpickers to have success. It is a competition that should also show the audience that lockpicking is a sport that can be done by anyone. However, at this competition, there were very difficult locks, I even saw a Mul-T-Lock with the pin-in-pin system. It was no surprise that it take not long for most of the people to be out of the game, me included.

Cylinders

For me, the cylinder opening is the most interesting competition and I was looking forward to it, after the Blitz. For this competition, people take their own locks that they need to open within 5 minutes or they cannot participate. I took an Ivana Necoloc (rebranded Anker Infinity) that was used in the Toool championship finals (nobody opened it there in 15 minutes). For the first time, I prepared for a competition, because I practiced opening this lock within 5 minutes. I managed to do so here under stress as well (about 1’20) and could participate. The competition saw some very difficult locks, such as the EVVA ICS.

I made it to the A finals, even though I did not open the FAB lock. Later, I learned it has a very deep pin because of bump protection, which I somehow missed in the stress.

In the final, I openend a cheap lock (Legallais) and a Winkhaus, but left the EVVA ICS and Cisa SB (similar to Abus XP1) closed. The Cisa was almost completely picked until I made a mistake and had to start over. Jascha had the same happening to him. The last round I got Jascha’s Yale dimple lock which had dimples and sliders. I destroyed my lockpick on it, but opened it in 14’58! That, in the end, was enough for fourth place overall. I though my Ivana lock would be difficult enough to give me an advantage, but it turned out everybody in the A-finals opened it within the 15 minutes.

Freestyle

For the freestyle competition, the locks were once more provided. They needed to be opened within 5 minutes. I did not bring any electropicks or other ‘freestyle’ tools, so reverted to normal picking. I again made it to the A-finals. There, I opened 3 EVVA locks and 2 Euro Plus locks. Once I figured using the Bogoto was the way to go, I opened these in seconds, but unfortunately the first EVVA and Euro Plus took me 1’49 and 2’14. THere were 2 Mul-T-Lock interactive cylinders that “talked” to me but wouldn’ open in the end, a FAB 400 I had opened in the first round but wouldn’t open in the final and a Kaba Gemini that was only opened by the winner using an electropick (and a bit of luck). I think it was due to my time that I only became 7th here.

Overall it was a very nice competition with a good atmosphere. Thanks to the organisers!

Photos CCBY4.0 Walter @ Toool Blackbag

Continued work on MIWA/Anker 3800

maandag, oktober 3rd, 2022

I had spent quite some time on the Anker 3800 cylinder. This system was originally patented by the Japanese firm MIWA. It contains just 4 pins, each of them having 4 possible depths. But, there’s also 4 sliders that are magnetically operated by magnets in the key.

An Anker 3800 Eurocylinder
The keys

This system was sold in the Netherlands by Dutch firm Ankerslot and is still used in many large, high security setups.

I made a magnetometer to decode the magnets in a key or in a cylinder, made a 3D model of the key to be able to print it and figured out how to get the master key of a system. My talk at Disobey is available online.

At LockCon, Han provided me with a set of five cylinders, all keyed differently but all part of the same masterkey system. No keys were provided.

I started by reading out all the magnets in the sliders. Each slider can have one or two magnets. If there are two, one is for the user key, one for the master key (we’ll ignore submasters for the moment). By knowing the magnets in the cylinder, it is possible to figure out which magnet should be in the key. For master keyed systems, there might be two possible magnets to operate the slider, where one will be in the master key, the other in the user key. With this information, I could determine the magnets in the master key and in the individual user keys (for each slider, there was only one possible magnet that would open all cylinders, so it was clear that that particular magnet should be present in the master key).

The correct bitting is another story. I had no key to start with. It is possible to create 256 keys and try them all to find all possible bittings. I was lucky however to have gotten one half cylinder.

What I did is create a bump key (so four times the deepest cut, which I will call a ‘4’), containing the correct magnets. With the bump key, I could open a cylinder and disassemble it. The half cylinder was my luck, as that can also be re-assembled. For this task, I used a 3D-printed plug follower.

This gave me all the correct bitting positions for this one cylinder (pin 1: 3 or 4, pin 2: 1 or 3, pin 3: 2 or 3, pin 4: 4). Since I did not have the original key, I did not know which depth belongs to the user key and which to the master key. The configuration allows for 2^3=8 possibilities. By creating 8 keys and trying them on the other cylinders, I could find out the master key bitting. With 3D printed keys, it is possible to print, say, a 3/1/2/4 key and if it doesn’t work, file a bit away to get a 4/1/2/4 key. That is exactly what I did and 4/1/2/4 worked on all cylinders, giving me the correct master key.

Next, I wanted to create the user keys. I could have created user keys by only using different magnets and keeping the bitting the same, but that would not give me the keys as they would originally be made for these cylinders. Since I now had a working master key, I could easily probe each pin position for all depths in sequence. I started with a 1/1/2/4 key, trying that on the 4 remaining cylinders and writing down the results, then filing it to a 2/1/2/4, trying again and then 3/1/2/4. With four keys to start with and 4*3=12 filing actions I was able to decode all the bittings.

Decoded cylinders, ‘G’ and ‘R’ are north/south poles (my magnetometer uses green/red light as an indicator)

Here, I have put squares around the magnets and bittings of the master key. If there are other bittings or magnets, they must be in the user key. The first pin of cylinder 2 for instance has possibile depths 3 and 4, and the master key has depth 4, so the user key must have depth 3. Note that in this system (and in this instance), user keys can have a bitting that can be filed down to the master key, as long as the magnets are different. Cylinder 2 shares the middle two magnets with the master key, the outer two are different.

With that information, I knew all the individual keys and printed them.

The user keys only open one cylinder each

And I have the master key.

The master key is golden of course

In fact, with this collection of cylinders, it is now also possible to make submaster keys for certain subsets of cylinders, even if that was not intended originally.

Thanks for reading! -Walter.

Photos CCBY4.0 Walter @ Toool Blackbag