Blog

Lambert, a Toool Eindhoven member, was kind enough to send me a DVD
with the German RTL item I announced but missed myself. It covers some
interesting car opening techniques. One of them is decoding a brand
new BWM X3. I also demonstrated this German tool at hope number six. I
assume most of you missed that presentation so I combined some video
and mixed in some fresh close ups from the tool. See for yourself:
 http://blackbag.toool.nl/video/bmw.wmv (WMV 76 Mb )

The problem with these wafer locks is that they have sloppy
tolerances. Theoretical each individual lever could be in four
different positions. If this really was the case all eight levers in
the lock would create a keyspace of 65.536 possible keys. The big
weakness is that if you cut a key to ‘one and a half’ it will open
both a 1 and a 2 cut. And a key cut to ’three and a half’ will open
both levers 3 and 4. So instead of four combinations we now have only
two, limiting the total keyspace to a lousy 256 possible keys. To make
things worse each side of the key will only operate four levers
instead of eight. Normally four levers would be good for 256 different
combinations but now that is reduced to 16. This is why it is possible
to have a set of 16 setup keys simulate all key combinations possible
on this specific BMW lock.

Testing is fun. Especially testing locks and tools. And it is even
more fun when people claim locks can not be opened and you show it can
be done. Without damaging the locks of course.

I received a mailing (PDF) from the Wendt lock tools company in Germany. As
far as I know they are the biggest and most complete lock opening tool
supplier in Europe (in the world?). I try to visit their yearly ‘open
house’ meeting as often as I can. Walking around there and looking at
all these magnificent tools is always a great pleasure. And their catalog (PDF) is a ‘must read’.

They supplied tools and expertise for a big test on cars and car locks
for the famous Auto Bild magazine in Germany. My German is a little
rusty, but here is a rough translation from part of the mailing Wendt send
around a couple of days ago:

“together with us Auto Bild tested in what time modern cars could be
‘hacked open’. The challenge was to open the cars free of damage. We will
not give the exact details of the test but on ten tested models the
results where rather shocking.”

I do need to get my hand on this magazine of course. So stay tuned for
a scan. (update 17:00 the magazine was sold out, will try other ways)

An for the people in Europe: an item on German television about this test will be aired Sunday.
To be more precise: Sunday 20.08.06, RTL, SPIEGEL-TV Magazin 22:35

I bet you have never seen this lock before.

If you have you are either a Russian ‘diplomat’, have worked as a high ranked officer on a
Russian nuclear submarine or operated a nuclear plant there. Or you are a member of Toool or Ssdev.

Little is known about the lock, only that it is (was?) in use at the
most critical parts of the Russian government and military. Fact is
this lock is extremely rare. A US DOD lock specialist has been trying for
years to get his hands on one, without success. He only located three
of these locks in the world. Safe technician Paul Crouwel owns one of
these three locks. He will show you on the ins and outs of this very
special lock in an exclusive blackbag video (wmv 77 Mb).

The lock has a seal function. It does not take much force to
break the lock open. The design goal was obviously to prevent
unauthorized and surupticious access. The story we heard was that the
lock was in use at Russian embassies. Instead of importing heavy safes
from Russia they just bought a decent model on the local market. They
secured the entrance of the original key hole with this lock. So in
order to open the safe you first need to get passed this ‘seal lock’.
To open it you need to dial a combination and use a key. So it can also be
used in a system where two people are needed to open a specific safe.
One person knows the combination and will dial it while the other
person only has access to the key and operates it. The other story we
heard was that is was used in nuclear facilities and submarines. But
we do not know for sure. We do know it is a lock with a strong ‘spy vs
spy’ smell.

If you know more about this specific lock we would love to hear from you!

(* More info is available here )
(** and you might want to read the comments …)

I had my eye on this one for a long time. As always it is a simple and
small thing and it is not even expensive. But it can turn out to be
pretty handy from time to time. Especially if you are a big ASSA fan
like myself.

 

This stainless steel card can be used to decode (or ‘read’) ASSA Twin
keys. Just stick the key trough the hole of the card and see how far
down you can slide it. If it will not go any further you have decoded
the cut and can move to the next cut to read it. After having read all
six cuts you decoded the key and can make perfect copies on a
computerized machine. What I like about this card is that it does not
only let you decode the key but will also inform (or remind) you about
the specific characteristics of this ASSA Twin key. Take for instance
rule number seven: Maximum Adjacent Cut (MAC) = 5. I assume this means
two pins next to each other are not allowed to jump up or down more
then 5 depths. I was not aware of that. What about the last line:
Sidebar code on Assa Twin key is always pre-cut at factory. As a
collector of their sidebar profiles I did notice that before …

Besides decoding 600 and 6000 keys this card can also be used to
decode other sidebar key like the Twin2, V10, Twin pro, Max and
Maximus.

If requested I could shoot some video decoding a key for you …

There is a lot of people smarter then you. And most of them are dead.
At least that is my impression when digging trough the goldmines of
the USPTO (United States Patent and Trademark Office). Just search for
‘Lock AND pick AND decoder’ or other queries. The results are amazing.
Especially if you go back before 1950.

 

(lock decoder 1937 by H. Abrams)

Unfortunately it is not possible to save or print these pieces of
art. Or maybe I am just lazy and did not invest enough time. So I just
took advantage of the ‘analog loophole’ and took a picture of my
screen to show you what to expect on that site. For hours and hours of
fun and education visit: http://patft.uspto.gov/netahtml/PTO/search-adv.htm

Happy hunting!

Without looking at my stats I clearly see global peeks in awareness of
the bump key problem. All of a sudden I receive a bunch of mail asking
if I am am willing to test locks for company X, whether I am available
for presentations, or if I sell bump keys or the ‘Tomahawk’
bumphammer. Especially the Tomahawk, designed and made by 92 year old
German engineer Kurt Zühlke, seems to be what most people are looking
for. And very often I have to disappoint them. Kurt does not make a
whole lot of them, and the ones I get my hands on I trade or give
away.

In my latest presentations I also demonstrate a new type of hammer by
Jens Andrews. This so called ‘power hammer’ is made of … shoe sole.
It has turned out to be an excellent tool for the job. I like it and
need it sometimes when that little ‘extra power’ is needed to let pins
jump. Jens uses a rather expensive and delicate technique to glue
multiple strips of shoe sole together to create a hammer this accurate
and almost indestructible. I will relay mail to him if you are interested in one.

 

The lock (tools) industry has also discovered money can be made
selling bump hammers. At the ALOA locksmith tradeshow in Las Vegas
last month I noticed some vendors where selling commercial bump
hammers. Some of them even sold complete keyrings with 999 keys for
the most popular US lock brands. Peterson manufacturers designed a
hammer called ‘Tommy Hawk‘. This nylon hammer has two holes in the
back. These holes can be filled with lead or sand to give it extra
weight. At first I was afraid the hammer would not have the mass
needed to transfer the right amount of energy. But it proved to be
almost as good as the original Tomahawk.

Consumers in the US are starting to realize there is a problem with
their locks. Newsweek did an article on bumping and it is causing a peek here….

Steffen Wernéry, chairman of the German sportgroup Ssdev, is a busy man
these days. He is organizing the German lockpick championships. And
that is quite a task. I know what it is like because I am responsible
for organizing the ‘Dutch Open‘ lockpick championships. And it always
takes more time and energy as you might expect.

Anyway, the German sportgroup invites you and the rest of the world to
come and compete in their ‘open’ game. And who knows … you could be
the new German lockpick champion!

 

 

The location they picked is really wonderful: the worldfamous lock
museum in Velbert (Germany). This year the event is extra special
since it will be the tenth anniversary of the games and the seventieth
of the museum .

Hope to see you there October 14th and 15th (10 am to 6 pm)

Read more about the location, type of games, hotel arrangements etc in this invitation.

It is not only the lock industry that we upset from time to time.

Recently Rop Gonggrijp and myself decided to set up a campaign against
voting per black-box computer in The Netherlands. The campaign is
already a success. Instead of calling them ‘voting machines’ now
everybody is talking about ‘voting computers’. Because that is what
they are: computers. And we all know computers can make mistakes and
can be manipulated. So we want the paper ballots back!

We are retrieving documents from Dutch Government concerning voting
computers trough ‘WOB‘, the Dutch FOIA. Documents we have retrieved
are already on our site. It now seems the Dutch producer of Black-Box
voting computers SDU is unhappy about some of them. And they should be
because they clearly show voting per computer is more expensive and
less reliable. Introducing voting computers in Amsterdam was 1 million
euro more expensive compared to voting on paper ballots. A lousy 3
euro per vote extra for a completely non-transparent system.
Wonderful.

But tough luck for them… The information remains on our site and
(worst of all) is generating a lot of publicity and awareness…

 

Our site is written fully in Dutch, including a comic by Koen
Hottentot. Even without understanding Dutch I think you will
like it and get the point.

At lockpick village you can learn the art of lockpicking and other clever way to bypass locks.

Maybe one day there will be a real lockpick village on this planet.
For now it is a mobile village, that travels from conference to
conference. The village does get more professional over time and so do
the people that run it. Thanks to people like Eric Michaud, Eric
Schmiedl, LSI, Renderman, Deviant Ollam and many others the Hope
number Six lockpick village was a great success.

For those who missed it some exclusive video. If you are on this video
and would like to be edited out please send me a private message.

 

(Video WindowsMedia, 17 Mb)

 

 Next stop for the mobile lockpick village is Defcon …

It is a funny company name, 13 song’s tool.

But these Korean people know what they are doing. Their website is
simple and basic, and I only recognized the quality of their tools
when I met them a couple of weeks ago in Las Vegas.

They developed some nice and elegant picktools for the most modern
‘laser track’ car locks. The tool on the images is for opening Opel locks.

 
More close up, high resolution images of the tool can be found here (zip 4 Mb)

 

I like their design of the hollow car key with the drilled holes. This
will prevent you from from slipping between the levers while picking.

All I need now is some Opel locks to start practising …