back to article Physical locks are less hackable than digital locks, right? Maybe not: Boffins break in with a microphone

A computer scientist at the National University of Singapore claims to have demonstrated how recording the sound of a lock turning can be sufficient to make working replica keys. In March 2020, Soundarya Ramesh, a third-year PhD candidate at the National University of Singapore, published a paper [PDF] co-authored by security …

  1. Michael B.

    LockPickingLawyer

    The headline writer has obviously never seen the LockPickingLawyer destroy lock after promising lock to know that physical locks are absolutely hackable and digital locks are usually far worse.

    1. simon@simonrosephotography.co.uk

      Re: LockPickingLawyer

      You beat me to it. LPL and BosnianBill have proven that time and time again a poorly made physical lock (e.g. of the Master Lock brand) can be defeated with minimal tools and skill.

      1. This post has been deleted by its author

        1. Anonymous Coward
          Anonymous Coward

          Re: LockPickingLawyer

          Actually, the headline implies any of this makes sense... it doesn't.

          Strangely, the student is going for a PHD and is not only writing about something they've apparently never done, but worse for their education, never even heard someone do. How in the hell do you get that far along and yet are still clueless about the practical application...?

          1. Phil O'Sophical Silver badge

            Re: LockPickingLawyer

            How in the hell do you get that far along and yet are still clueless about the practical application...?

            You've already answered your own question: "going for a PhD"

            1. swm

              Re: LockPickingLawyer

              Cal Tech has a course on lock picking.

            2. DCFusor

              Re: LockPickingLawyer

              Dilbert on the topic:

              https://dilbert.com/strip/2019-01-21

              All too true.

        2. Paul Hovnanian Silver badge

          Re: LockPickingLawyer

          "AR-15 Lock Defeated With LEGO Astronaut!"

          There ought to be a law! Ban LEGO Astronauts now!

          Slippery slope argument: They'll come for your Playmobil next.

    2. Anonymous Coward
      Anonymous Coward

      Re: LockPickingLawyer

      As it so happens I just bought an Arduino kit to try an idea for an electronic dial lock I had, which sort of qualifies as electronic except for the mechanical bits (duh :) ).

      I really miss the dial locks we had on safes and MoD secure cabinets (Chubb Manifoil Mark IV for the obsessed), and as they're almost impossible to obtain (weird, given that MoD must have disposed of them by the boatload when they went electronic) I decided to make an electronic one that works more or less like it, but naturally augmented with the ability to reprogram it, set multiple codes of far greater length and do all sorts of other mad stuff that that fine bit of mechanics couldn't offer.

      And it won't have the satisfying "clunk" when you open it. Oh well. Anyway.

      I have done sod all coding for the last 40 years and what I used to do was in assembler, Turbo Pascal and Paradox so I'll be facing a bit of a learning curve, but that's exactly the fun part of it - it would be boring if there wasn't anything new to learn. Not worried about the electronics and mechanics, though, for me, that's the easiest part (which is why I already worked out power management - power independence is kinda vital here :) ).

      I still wouldn't mind buying a working Mark IV. Some bits of mechanics are just *fun* - even though we had someone on a team I worked with who could open these things at any time, code unknown. I know Matt Blaze wrote a manual for it, but he worked it out on long, boring night shifts. I know there are also tools that just dial every combination - something an electronic lock won't have trouble coping with..

      1. Citizen99

        Re: LockPickingLawyer

        I've seen The Saint do it on telly - how hard can it be ?

    3. MachDiamond Silver badge

      Re: LockPickingLawyer

      Harry is too brilliant for words. A huge YouTube following for making 2 minute videos.

      I found the channel when I was down with the flu and just binged the whole library. Now I leave it for a while so I can dip in for a half hour.

      Look for presentations by Deviant Ollum if you have been bitting by the pentesting bug.

    4. Anonymous Coward
      Anonymous Coward

      Re: LockPickingLawyer

      Hi-viz, hard hat, lorry jack, wood.

      Stretch doorframe, pop door open, walk in lights on full.

      locks are for *!%?s

  2. Whitter
    Pint

    Excellent work

    What a great, proper, idea for a phd!

    Well done that student!

  3. Fading

    So we need to upgrade the physical locks....

    To include a random resistance to key insertion and pin engagement - I'm thinking something with magnets (not for any other reason than I think magnets are still pretty damn cool)......

    1. ibmalone

      Re: So we need to upgrade the physical locks....

      A few already do, avocet abs keys for one, https://www.youtube.com/watch?v=zq5rGjt-9rQ you don't really need to go that far though, this will probably only work easily with straightforward in-line pin tumbler locks, there are a host of other types once you get to slightly more secure models, including locks with multiple locking systems (say, combined dimples and cuts for one), which this would have great difficulty disentangling.

      1. PeeKay

        Re: So we need to upgrade the physical locks....

        Just replied below - we also have the Avocet lock system. Good (secure) purchase.

        1. simon@simonrosephotography.co.uk

          Re: So we need to upgrade the physical locks....

          Agreed. Avocet ABS is the minimum standard for domestic security, IMHO.

          1. Anonymous Coward
            Anonymous Coward

            Re: So we need to upgrade the physical locks....

            What is the normal standard for domestic security, I thought the 3 star, secure by design etc were the highest levels of security not the minimum?

            1. Anonymous Coward
              Anonymous Coward

              Re: So we need to upgrade the physical locks....

              What is interesting is that China also has a lock security qualification, and the cutouts I have seen of their Class C suggest they would be indeed utter *swines* to pick or bump although I would agree with another commenter that adding magnets could make it even more entertaining - I liked those padlocks that only had magnetic keys.

              Given that they have EU-sized cylinders I might just get a set and send it off to those who entertain themselves with bypassing these locks. If the diagrams are correct they may find it a challenge.

              In any case, fitting a Chinese lock (well, a proper Class C, that is) may confuse wannabe lock pickers enough to go elsewhere.

          2. 89724102172714182892114I7551670349743096734346773478647892349863592355648544996312855148587659264921

            Re: So we need to upgrade the physical locks....

            > Avocet ABS

            Sadly, there's an opening tool for all Avocet locks, a few seconds:

            https://www.sks.co.uk/g-j-avocet-abs-pick

      2. Anonymous Coward
        Anonymous Coward

        Re: So we need to upgrade the physical locks....

        Ah, the ones popularly circulated in the euro cylinder that requires the application of a 7$ hammer to remove? Pretty common example of the weakest link principle in design.

        Try a mogul or drop the bills for an OG lever lock. Just don't lose your keys or you may need to cut a hole in the wall.

        1. ibmalone

          Re: So we need to upgrade the physical locks....

          If you're using a euro cylinder on an external door it should be TS007: anti-snap. Typically this is done by having a sacrificial portion on the front that will come away separately but leave a locking portion. However, the avocet abs I mentioned actually has an additional active anti-snap protection; taking off the external cylinder locks the cam to the internal cylinder (which is inconvenient, but for that to happen they have to have persisted in trying to get it apart after snapping). Yes, you can get cheap euro-cylinders, but they should only really be used internally. A decent secure euro-cylinder may easily cost more than a lever lock.

          Incidentally, I'm not really promoting the avocet (or even euro-cylinders), as mentioned there's a defeat device for it (a much more specific tool than a hammer), but all locks have their vulnerabilities, and lever locks are pickable too (there are also other ways around them). A lock's job is to hold up an intruder, in most cases if it makes going via the door harder than going via a window then that's mission accomplished. That said, having a mix of types on the door (where I come from lever deadlock and rimlock latch is pretty common) means somebody needs to come prepared to attack both, just don't have the back door secured with string...

    2. Allan George Dyer
      Boffin

      Re: So we need to upgrade the physical locks....

      How about a lock with a loudspeaker that plays white noise when touched by a key? Just drown out the clicks.

      1. CommanderGalaxian
        Boffin

        Re: So we need to upgrade the physical locks....

        With a modest level of signal processing you'd be able to pickout the clicks from the background white noise. What you would actually want is something that puts our random fake clicks.

      2. Jellied Eel Silver badge

        Re: So we need to upgrade the physical locks....

        How about a lock with a loudspeaker that plays white noise when touched by a key? Just drown out the clicks.

        Don't go giving them ideas. Coming soon, the 'smart' lock that will seize the key and refuse to turn until it's played you a 30 second advert. Could even combine it with your phone and car location data so it won't let you in until it can prove you've made a purchase.

        1. Anonymous Coward
          Anonymous Coward

          Re: So we need to upgrade the physical locks....

          It'll be a subscription-only key as well, forcing you to pay monthly to get in..

          1. Anonymous Coward
            Anonymous Coward

            Re: So we need to upgrade the physical locks....

            Thank you for contacting our subscription lock support team.

            At this time we are experiencing technical difficulties due to a ransomware event.

            We expect to be able to let people into their houses and cars within 72 hours.

            If you are not able to access your locked service after that time, please contact us again to open a support ticket.

            PS; hope you don't have to go to the bathroom soon as you got home from work.

            1. Anonymous Coward
              Anonymous Coward

              Re: So we need to upgrade the physical locks....

              "Dear customer, from next week onwards, we will be discontinuing our cloud key service. Please buy another house to continue to take full advantage of our products"

      3. Stoneshop
        Boffin

        How about a lock with a loudspeaker that plays white noise ?

        Nope, not white noise. Record the actual clicks that lock makes. and play them back in random order, sped up, also randomly but not shifted in pitch, and repeated to fully overlap the actual insertion.

    3. Stoneshop
      Boffin

      Re: So we need to upgrade the physical locks....

      The key switch for the alarm system we had at the record library I volunteered at (installed 1981) had such a key. Just cylindrical magnets set in the short sides of the blade, no other features such as dimples or cutouts, or any sort of keyway, but I don't doubt those could be added..The cylinders were magnetised radially, and as far as I could determine they were set in 45 degree steps.

      No way to copy them from just a picture, which is old hat by now for conventional, shaped keys.

  4. keithpeter Silver badge
    Coat

    WD40?

    Advanced lubricants to reduce click level below ambient noise? Self-lubricating surfaces a la Harrison's watch?

    I'm thinking the 10cm radius mentioned was to do with gaining sufficient S/N.

    Coat: off out in the wind. No picking tools packed.

    1. This post has been deleted by its author

      1. Chris G

        Re: WD40?

        WD40 is not a lubricant, at best it will provide some temporary lubrication due to dissolving oxides but that is likely to disappear as soon as it dries out, something that is usually a question of minutes.

        Liquid lubricants in locks such as grease or 3in1 type oils accumulate dust which over time will clog up in a lock.

        I had an acquaintance, many years ago who ran a small locksmiths shop, he was the go to guy whenever the plod needed to get past a lock or into a safe.

        He learned his trade on the other side of the law but made more money that he was allowef yo keep by opening locks legally.

        7 pin mortice locks, insurance rated padlocks an Abloy types of lock etc were not a problem for him.

        1. ibmalone

          Re: WD40?

          I had an acquaintance, many years ago who ran a small locksmiths shop, he was the go to guy whenever the plod needed to get past a lock or into a safe.

          Sounds like a useful person to know. My experience so far includes two different types of locksmith.

          I encountered the first when I got locked out of a first floor flat with a street door. The neighbours were kind enough to lend me a phone, but as it was a weekend and the only other person with keys was away, I had to call a locksmith. The people I ended up using (something like all service 3 u) had a generic branded websites of the type you'll recognise if you've ever looked for cleaning services. As most of the ones I could find were of this type, no call-out charge and seemingly quicker to get hold of than the more traditional looking ones, I made the mistake of calling them out. The guy turns up, takes a look at the pretty standard (5 pin, I've still got one of the spares) rim-lock for the latch (the lever deadlock hadn't been used) and announces, without even touching it, that he can do nothing with it and the only option is drilling it (incidentally, tries to convince me to do a weird thing about agreeing the lock is faulty when I've actually lost my keys, and despite me saying no to this still invoices me as such). So he drills it (takes a couple of minutes) and I get charged for two hours labour and a new lock at about 200% mark up on retail price. Overall cost about £250, should have argued more, but I'd been wearing wet running gear for a couple of hours at this point and it was 8pm with work the next day.

          The second one I never actually met. Got home one day (to a different first floor flat, with a somewhat more sophisticated latch lock and euro cylinder deadlocks), to discover a letter from SGN (the gas distribution company) on our kitchen table. A leak had been discovered at the external meter (while testing some installation for another flat), so they had shut off our gas at the meter and apparently had to enter the flat for some reason, leaving a letter to tell us what had happened. Our landlord did not know about this, there was no forced entry, and no other key-holders. The most likely explanation is they got a competent locksmith (rather than a guy with a black and decker and a van full of yale locks) to let them in.

          There's a moral to this story that shouldn't be too hard to spot... If you look at the master locksmiths association guidance, a weekend evening call-out rate for one of their members might be up to £120 hourly, so maybe when I got locked out I could have ended up paying one of them about the same amount of money instead. But I wouldn't have been stuck with someone I wasn't certain I could trust drilling out my front door lock, and I'd have had a better idea beforehand what I was actually going to pay. (Having not thought about the cowboys for a while, I had a quick look on google, and if the one-star reviews are to be believed it seems their prices have doubled since then in any case.)

          1. This post has been deleted by its author

            1. Anonymous Coward
              Anonymous Coward

              Re: WD40?

              "You charge £90 just to spend 5 minutes inserting a 10 quid item?"

              "£10 for the item, £10 for the time, and £u0 for knowing where to put it"

            2. Persona

              Re: WD40?

              Hmmmm ..... I had a new boiler installed the other week. On the back of the installation manual the plumber has written the date, the boiler inlet pressure, the meter outlet pressure and the boiler fan pressure. I think he was a Mario.

        2. Anonymous Coward
          Anonymous Coward

          Re: WD40?

          WD40 is not a lubricant, at best it will provide some temporary lubrication [...]"

          My uPVC double-glazing windows have a complicated three position mechanism for closed, open sideways, tilt on bottom hinge. After about 25 years the interlocking mechanisms were getting very stiff. Liberal sprays of WD-40 not only made them smooth running - but they are still smooth after 5 years.

      2. wkk2

        Re: WD40?

        Don't use graphite on high security locks. Graphite is hygroscopic and may lead to jams caused by dust accumulation. If you have used graphite, wash out the lock with isopropyl spray and then use Proxylube CP-200. It can be purchased with a needle tube for easy application.

        1. This post has been deleted by its author

    2. EveryTime

      Re: WD40?

      Know how the lock is lubricated before applying anything.

      Automotive locks are typically lubricated with clear waterproof grease. Applying graphite will gum them up horribly. Lock de-icer works great to rinse out dirt and redistribute the grease, although you'll need to re-grease after a handful of uses.

      Residential locks are typically brass with hardened pins. They are lubricated with a few percent of lead in the brass, not an external fluid. Graphite powder will help temporarily but lead to long-term clogging.

      Back to the article: most locks above entry level have features on the driver and key pins that will defeat this approach. These features are a trivial additional cost.

      1. Man inna barrel

        Re: WD40?

        WD40 worked fine for me on a stiff barrel lock. I was concerned that eventually it would latch up altogether and lock me out. This happened to my neighbour across the corridor. The local locksmith drilled out the barrel. I don't think he could have picked that lock even if he knew how. My lock still has a noticeably more free action than it used to, so I think WD40 was the right stuff to use. The advantage of WD40 is that it penetrates the mechanism. There are limited routes for getting lubricant into a barrel lock.

  5. PeeKay
    Pint

    Security Locks for the win

    Was worried for a moment there, but it looks like my fetish for security locks has payed off. No ridges to listen to, just magnets attracting the pins instead. One key for all secure doors in the building. Nice.

    1. Jan 0 Silver badge

      Re: Security Locks for the win

      Ah, so it will generate a weak RF signal as you withdraw the lock. I'll need to replace the microphone with an aerial.

      Abloy is still keeping my stuff secure. I don't think their locks have ever been picked in situ. I wonder if the method described could infer the mass of each disc as the key is pushed in or withdrawn?

      1. This post has been deleted by its author

        1. PeeKay

          Re: Security Locks for the win

          Probably due to the inductance caused by drawing the magnets (in the key and lock) over a metal surface (again, the key and lock). Using different metallic materials would reduce the "signal" I would imagine, but it's an interesting idea and I might just plug in my SDR and run a couple of experiments to check.

          1. Ken Hagan Gold badge

            Re: Security Locks for the win

            I think you missed the point about frequency.

            "Allo, allo. Is that an aerial the size of a small town in your pocket or are you just *really* pleased to see me?"

        2. Jan 0 Silver badge

          Re: Security Locks for the win

          I'm well aware of the lock picking lawyer and special tools for picking locks in a workshop environment. By "in situ", I was thinking about my front door or my bike chained to a wall anchor.

          1. Anonymous Coward
            Anonymous Coward

            Re: Security Locks for the win

            "[...] or my bike chained to a wall anchor."

            The Gordian solution is a portable angle-grinder - also used as a deterent against any passer-by who tries to interfere.

        3. Anonymous Coward
          Anonymous Coward

          Re: Security Locks for the win

          Main benefit of Abloy being that they really benefit from dedicated tools that most people don't have. Especially stateside. With the tools and proper training very pickable and not a lot harder then other good locks.

      2. Jim Whitaker

        Abloy?

        Have a look a the LockPickingLawyer YouTube videos. He laughs at Abloy!

  6. FatGerman

    My lock's fine then

    My old knackered lock requires me to jiggle the key to just the right spot. I've got it down to a fine art now but it certainly fools the "constant speed" assumption.

    Also it sounds like it would be trivially easy to confuse this by jiggling any key as you insert it?

    1. katrinab Silver badge
      Unhappy

      Re: My lock's fine then

      Jiggling is a lock-picking technique. You might find that jiggling with another similarly shaped object will also open your lock.

      1. Anonymous Coward
        Anonymous Coward

        Re: My lock's fine then

        One of the muppets here managed to lock the keys in his drawer but searching through the BIG box of 'spare' keys didn't turn up any with the matching serial number... but it turned out one of the most common spares worked if you didn't fully insert it then j-j-j-jiggled it

        (after a couple of repeats I finally figured out how he was managing to do it. He would unlock the drawer but was turning the key back to the 'locked' position before withdrawing the key... then he put the keys inside and pushed the drawer shut and 'click!')

        1. Stoneshop

          Re: My lock's fine then

          Those locks tend to be wafer tumbler locks that can be opened by waving a rusty hairpin in their general vicinity.

        2. FatGerman

          Re: My lock's fine then

          Oh now desk drawer locks are to locks what play-doh is to cement. I keep the drawers in my desk locked at all times. I do not have the key. To the best of my knowledge, nobody has the key. I do, however, have a piece of cardboard cut to exactly the correct width.

          One summer job at an office furniture company and I can open anything with less that 5 levers with whatever I can find lying about.

        3. Anonymous Coward
          Anonymous Coward

          Re: My lock's fine then

          Our office under-desk cabinets merely needed rolling out and then turning upside down to release the lock.

          1. DiViDeD

            Re: My lock's fine then

            We had those in <<major security conscious merchant bank>>. I used to keep a steel ruler to whack the locking bar on any under desk cabinet that needed attention. Or you could lift up the middle drawer to slide it over the locking bar, then unlock it with your thumb.

            Not as satisfying as the early morning thwack of steel on steel though.

      2. Alan Brown Silver badge

        Re: My lock's fine then

        "You might find that jiggling with another similarly shaped object will also open your lock."

        in the case of _really_ worn locks, a screwdriver sometimes works (old Toyota Corona ignition.....)

    2. Trygve Henriksen

      Re: My lock's fine then

      Jingling keys would make a different sound than pins pushed by springs, so in theory it might be possible to filter for the correct frequencies. In practice, probably not.

      But just inserting and pulling the key very slowly ould make the pins slide along the ridges instead of jumping, so that should also work.

      One reason NOT to jingle your keys is that hackers can already make duplicate keys using a photo taken from long rane with a powerful tele lens.

      Damned if you don't and damned if you do.

      1. This post has been deleted by its author

        1. Mage Silver badge
          Black Helicopters

          Re: make duplicate keys using a photo

          Done maybe 30 or 40 years ago in Belfast using a Victorian photo of a prison warden. He obtained an identical uniform button to scale the image of the keys. Amazingly the locks had never been changed.

        2. Anonymous Coward
          Facepalm

          Re: My lock's fine then

          > "make duplicate keys using a photo" That could never happen. Wait...

          That story's hilarious. Not so much that they escaped but that the response from the authorities was to remove all copies of the magazine and change the locks.

          Changing the locks is clearly necessary as more than one key may have been made. But why remove the magazines? The key in the photo on the cover no longer matches the new locks.

          1. The commentard formerly known as Mister_C Silver badge

            Re: My lock's fine then

            Changing the locks on a budget:

            Take a lock from an unused area. Got to the next door. Take the lock off and put it in your bag. Install the previous lock. Rinse Repeat until you get back to the first lock. Everybody has seen all the locks changed and all it cost was the labour time that was needed anyway.

            Works best on a suited set of locks.

            For security, remove all the magazines. And cross your fingers that none of the warders ask "why do our keys still work if they changed all the locks?"

            Screwfix sold me a keyed-alike set of padlocks. Very useful for garden gate and shed. I did wonder about going into B&Q and asking if they did keyed-alike locks so that when they asked "how many" I could reply "just the one please"...

  7. TrumpSlurp the Troll
    Holmes

    Random background noise?

    Mechanical upgrade to generate back ground noise when the key is inserted?

  8. ThatOne Silver badge
    Facepalm

    Really?

    Since we're in the "totally unpractical but yet probably possible attacks" category, I have an even better method: Insert a tiny camera inside the lock and film the key as it is inserted, allowing you to make a perfect copy - Voila!

    I really don't know why people still use crowbars and car jacks to force doors open...

  9. frankvw

    Opening a mechanical lock by recording its sound and translating that into a duplicate key (no doubt 3D printed)... I wonder when that's going to show up at CSI or one of the spin-offs. I give it a few months on the outside.

  10. Anonymous Coward
    Anonymous Coward

    Door Locks....Bah!.....much easier ways of getting in.....

    1. Use a chainsaw to cut out the middle of the door.

    2, Use a chainsaw to cut out the drywall NEXT TO THE DOOR.

    3. Go to the utility box/room/cupboard and pull out the location fuse. (This is the IoT attack).

    4. Open the letter box and shout "Alexa open the front door". (Another IoT attack).

    *

    Compare the complex (and error prone) procedure described in this article with the items above, especially items #1 and #2. No contest!!!!

    1. My-Handle

      Re: Door Locks....Bah!.....much easier ways of getting in.....

      5: Stick your hand through the letterbox and turn the lock.

      Found that one out the hard way when getting locked out of my student digs a number of years ago. Looking up and down the street, I was shocked at how many houses were vulnerable to that particular trick.

      1. Mage Silver badge
        Devil

        Re: Door Locks....Bah!.....much easier ways of getting in.....

        We had to change the lock, screw in a block of wood etc. Stupid combining letter slot and lock. The big lad was lifting up his small sister to open the door.

        Also we fitted deadlocks front and back.

        A common technique is to use the cheap one of 30 keys on back door, or break a rear window and simply carry everything out the front door to the large van. Neighbours just assume you are moving or redecorating.

        A friend in Chubb once pointed out that extra bolts on the door doesn't help unless they go through the frame, or the frame has serious fixings into serious masonry. One decent swing with a ram or a big sledge and the entire frame falls in.

        1. Nick Ryan Silver badge

          Re: Door Locks....Bah!.....much easier ways of getting in.....

          Many old doors/locks can be opened using a suitable piece of plastic, sometimes something as simple as a credit card or some other similar tool that would fit into the door frame to push the latch bolt open.

          1. Anonymous Coward
            Anonymous Coward

            Re: Door Locks....Bah!.....much easier ways of getting in.....

            Neighbours have had problems with internal room door locks. In one case it merely needed a standard handle shaft to open one.

            In the other case the wind had slammed the door closed - and the shock had broken the handle shaft's internal mechanism. That solution required a strong neighbour and a large jemmy.

          2. Stoneshop
            Holmes

            Re: Door Locks....Bah!.....much easier ways of getting in.....

            At one time our temporary computer room had a door into our temporary office.It was fitted with one of those mechanical 10-button locks. And despite us having to have access to said computer room, Facilities rejected our requests for the lock code.

            With the door opening outwards, the hook on the serrated knife of a Leatherman Charge is quite suited to shifting the latch in the absence of an access code.

            1. Alan Brown Silver badge

              Re: Door Locks....Bah!.....much easier ways of getting in.....

              "And despite us having to have access to said computer room, Facilities rejected our requests for the lock code."

              That calls for an "irate 3am call" to the facilities manager from the computing manager via higher ups demanding access "right bloody now or you needn't bother coming in tomorrow morning"

      2. Anonymous Coward
        Anonymous Coward

        Re: Door Locks....Bah!.....much easier ways of getting in.....

        "5: Stick your hand through the letterbox and turn the lock"

        I keep an old walking stick and some wire clothes hangers in the hallstand for that letterbox approach. Several times now have had to open neighbours' front doors when their kids have let them close behind them. Obviously doesn't work if there isn't a door handle as such inside.

        One regular offender was relieved recently that she had finally taken up my offer to store her spare key.

  11. Kubla Cant

    Smart doorbell

    When I read the quote about smart doorbells I wondered why a doorbell, smart or otherwise, would have a key. Then I guessed he was suggesting that you might hack a smart doorbell to pick up the key clicks from the lock. Now I wonder why a doorbell, smart or otherwise, would have a microphone. Do you have to say something to the doorbell to make it ring? Why?

    1. My-Handle

      Re: Smart doorbell

      Doorbells with an integrated webcam / microphone so you can see and talk to someone arriving at your front door. Amazon Ring is an example.

      1. Mage Silver badge
        Coffee/keyboard

        Re: Smart doorbell

        "Amazon Ring is an example" and is is a daft thing to fit.

        There is no problem having a camera and intercom that is only feeding by wire inside the house. Anything "smart", i.e. connected to the Internet is a huge risk and also can be bricked by the supplier.

        So called "smart" heating, security, locks, doorbells are products for the gullible or those unaware of the risks.

        1. Anonymous Coward
          Anonymous Coward

          Re: Smart doorbell

          It's a trade off. We have Nest cameras outside including the Hello doorbell but, like vampires, I'd never invite one into the house. The advantage is that the video is recorded in the cloud, the disadvantage is that the cloud is Google's.

          I've reached an interesting point though - rather Google than Amazon.

          1. My-Handle

            Re: Smart doorbell

            The downside there is that by attaching it to your WiFi network you've already invited it into your house. Any vulnerability present on your doorbell may compromise the security of other devices on the WiFi.

            The paranoid git on my shoulder (no, not that shoulder, the other one) wants to bet whether your doorbell microphone is sensitive enough to hear what's going on inside your front hall, any nearby rooms with conveniently open windows etc...

            1. Stoneshop
              Holmes

              Re: Smart doorbell

              The downside there is that by attaching it to your WiFi network you've already invited it into your house. Any vulnerability present on your doorbell may compromise the security of other devices on the WiFi.

              Something something VLAN something.

    2. Anonymous Coward
      Anonymous Coward

      Re: Smart doorbell

      Eh? You don't know what a smart doorbell is or were you trying to make a different comment?

      A smart doorbell has a camera and microphone so you can record possible intruders, see who's at the door before answering to a cold caller/politician or answer is when not at home and ask the delivery driver to leave the parcel next door etc. Without a microphone the person ringing the doorbell wouldn't be able to talk back to you?

      I don't have one, btw.

    3. Jan 0 Silver badge

      Re: Smart doorbell

      "Smart" as in "festooned with unnecessary additional devices and services". So a toothpick, gel dispenser, video camera, speak your weight floor pad, microphone, keyboard, Ethernet, InfiniBand, WiFi, WiMax, Bluetooth, ANT+, .... . You get the picture, this is the 21st Century!

      1. Stoneshop
        Thumb Up

        Re: Smart doorbell

        So a toothpick

        Does it have usage instructions on the packet?

        1. Anonymous Coward
          Anonymous Coward

          Re: Smart doorbell

          "Does it have usage instructions on the packet?"

          The dental hygienist told me I had been using the Glide Flosspicks incorrectly. Apparently the idea is to rub the floss bit hard against the tooth's gap sides - right down into the gum line.

    4. Stoneshop
      Facepalm

      Re: Smart doorbell

      Do you have to say something to the doorbell to make it ring?

      "Okay Google/Alexa/Whoever, please wake up occupant. Repeat until acknowledged."

      Why?

      Because no idea is too daft to be integrated into a product, once Marketing hears of it.

  12. fidodogbreath

    Or just use the proverbial XKCD-branded $5 wrench (or similar) to break a window.

  13. Anonymous Coward
    Anonymous Coward

    Optional

    Lock Bumping opens most house doors as fast as the real key. Boring.

    Cordless drill, almost as fast. To barbaric, almost like a pry bar.

    James Bond using a laser to get the sounds of a lock to have his 3d printer in the ashtray supply him a key so the security guards don't get suspicious as he walks into the enemies head courters - priceless.

    1. J27

      Re: Optional

      Most houses have ground floor windows and/or sliding glass doors. Houses as a whole aren't very secure.

      1. Anonymous Coward
        Anonymous Coward

        Re: Optional

        " Houses as a whole aren't very secure."

        Roman door locks were very simple affairs. The principle of any security is to persuade an opportunistic burglar to go to an easier target. The police use portable battering rams for speed of access. Then they apologise that they have the wrong address.

        1. Alan Brown Silver badge

          Re: Optional

          "The police use portable battering rams for speed of access. "

          No they don't. A decent locksmith is much faster at opening doors. Battering rams are about sound and fury

  14. David Shaw

    KEYS + LOCKS

    after I'd apparently annoyed a major opponent or two, [doing what I was asked to do], after the bank notifying me of my needing to sign for the "routine" anti-terrorism check of my finances, I went on holiday to Spain. 5 years ago.

    Strangely, the night that I arrived in Alicante, all my domotic IoT sensors went out. The vibration sensors stopped, the face-recognition cameras didn't.

    the dual (seperate ISP) internet feeds cut out ADSL & microwave, entirely coincidentally.

    On my return to Italy, after a pleasant time in those old days when viral pandemics weren't, I noticed that the garden IR cameras illuminators had been physically moved, even the one under the garden shed, that needs approx 9.8 Reg Standard Norris's of force to move.

    I'd been visited! or very large garden Squirrels

    Presumably, having gone to the effort of dismantling the infrastructure, then putting most of it , but not enough of it, back - I'd had internal visitors. (They missed the tiny chinese PIR GSM SMS matchbox) That means that my top of the line CISA un-bumpable/toothbrush resitant, unsplittable lock system, obviously has a national security theatre passkey. And my basic B&Q supermarket alarm system obviously has a national security theatre pass-pin. Which is fine.

    I've left them in place, tho I might look at some ASSA Abloy, sorry CryptoAG door-lock, for more fun - I guess the likelyhood percentage of them being back-doored is around....

  15. sitta_europea Silver badge

    "A computer scientist at the National University of Singapore claims to have demonstrated how recording the sound of a lock turning can be sufficient to make working replica keys."

    Please pay attention. This is about the 'Yale' style of key and it's not the sound of it turning in the lock which gives the game away, it's the sound of the ket being inserted into the lock.

    This is the equivalent of that the pros call 'bumping'.

    Don't ask me how I know this, nor about the interview with the two policemen who, a long time ago, confiscated my, er, kit and left me with just a warning.

    1. MachDiamond Silver badge

      "This is the equivalent of that the pros call 'bumping'."

      Nope, bumping is using a 'bump" key to get the pins to jump up while putting a little pressure on to they lodge into place. This person is using the sound to be able to decode the key so to originate the correct key to fit in the lock.

      All of my house locks have varying spring strengths so they can't be bumped, but maybe this sound approach might work.

      Knowing some basic locksmithing is handy. Ask the Weasley twins.

  16. Version 1.0 Silver badge
    Thumb Up

    But is this a risk?

    He deserves a PhD for showing that it's possible but since it only works if you are close enough to the lock to pick up the sound as someone opens it with a key then I suspect that it's not a big risk. I expect the sound issue could easily be defeated with a few design tweaks.

    I remember many years ago having to help a guy who's daughter had hacked into his account on the family PC - she did it by listening to the sound that the keys made as he typed his password. Then she sat down and typed herself while she listened to the keystrokes and easily hacked his account - he thought it was a digital hack, not an audible hack.

  17. Blackjack Silver badge

    Uh...

    In a lot of cases is just cheaper to break the lock.

    1. Stoneshop

      just cheaper to break the lock.

      and also just a little more conspicuous, both during the breaking as well as afterwards.

      What burglar cares about the cost of a lock he's breaking, anyway?

    2. MachDiamond Silver badge

      Re: Uh...

      Agreed. This sort of attack is only useful if you need to get in in a way that doesn't leave much of a trace. Burglars don't care as the burgle will be found out PDQ anyway.

      I like low-tech approaches. A photo of the key and knowing the brand/model of the lock will let you make a duplicate. Even a crappy photo can be used to decode a key since having relative distances can be just fine given some key mods.

  18. a_yank_lurker

    Pile It Higher and Deeper

    While the technique will work in the lab, out in the real world mechanical locks can be picked very easily. If you do not have the tools or skill to pick a lock there is always busting the door down which also works. The people I am worried about breaking in are not going to use such a technique but something more traditional like kicking the door down. Great for a thesis (or feces) but not of much use in the real world.

    1. Stoneshop
      Holmes

      Re: Pile It Higher and Deeper

      Sometimes one just wants to enter a premise, take one particular item or copy one particular physical document, and leave again without a trace.

      1. MachDiamond Silver badge

        Re: Pile It Higher and Deeper

        "Sometimes one just wants to enter a premise, take one particular item or copy one particular physical document, and leave again without a trace."

        How many tries can you take? If you need lots of samples to smooth out any anomolies, you have to be nearby too often and could be noticed. If trying the lock multiple times with postulated keys will be noticed, you need to have a correct key on the first go. Maybe two tries if you are lucky.

        A few pen testers with videos on YouTube say that bypassing security is generally easier than picking a lock or spending the time to file up a key by trial. The number of ways to blow right past locked doors without picking the lock is pretty amazing.

        1. Stoneshop

          Re: Pile It Higher and Deeper

          It'll get suspicious if it's the outside entrance to some building, much less so for a room or a closet in a corridor that you regularly pass through.

          But impressioning is the better method there, as you don't have to be around to record the sound of the key being inserted. Downside is that it does take as least as much attempts as the lock has tumblers.

  19. Peter Clarke 1
    Childcatcher

    Really? No one?

    I've just read through 60 odd comments and not one mention of a Sonic Screwdriver?? Guess I win the bag of Jelly Babies

  20. MachDiamond Silver badge

    Activated Alexa with a laser

    I watched a video where a laser was used to send voice commands to an Alexa. It appears that MEMS microphones can be sensitive to light.

    This is an interesting study, but a very impractical application. There are similar systems where an acoustic "lens" is used to check if large metal presses/tooling are operating correctly. All humans can hear is bang, bang, grounch but a computer can pick the signal apart and compare the sound to what it should be. In any real environment, getting a good signal to noise ratio is going to be hard to do without being spotted.

    Locks have to be relevant to the system as a whole. If you have an underground bunker that can only be accessed via to vault doors, a super duper lock is a way to do since the only other way in is by driving a tunnel. I'm not going to fit a £200 lock to my front door as a burglar is just going to break a window or even make a hole it the side of the house. A much more economical lock would be just fine with the balance of the budget being spent on securing the window and adding an alarm.

    I'm remembering the photo of a steel gate across a drive and how obvious it was that everybody was just driving around it until there was a rut in the lawn making the gate rather pointless. They have the same thing in my town. They put in some bike paths and added removable bollards to keep people from driving on them. The problem is that between the road and the bike path is a patch of flat dirt level with both. The cost of the bollards and their locks is totally wasted tax money.

    1. MachDiamond Silver badge

      Re: Activated Alexa with a laser

      I should add that the bollards on the bike path are only at intersections. Easy to drive around.

  21. Pedro_ding_dong

    The discussion on perceived security reminds me of a sales rep that came round our company years ago, eager for us to buy a password protected screen saver. I watched him set up his laptop, and he duly demonstrated his product.

    Rep: "Right, get past that."

    "50 quid I can."

    Rep: "But you won't."

    "50 quid if I can."

    Rep: "But you won't."

    "That's okay then isn't it, your money is safe. So you won't mind placing the bet?"

    Rep: "Okay then, 50 quid you can't."

    I turn his laptop off.

    Rep: "What are you doing?"

    "I've turned it off."

    There's a silence while I look at him and he looks back. I turn his laptop back on.

    Rep: "What are you doing?"

    "I've turned it back on."

    The laptop lands on the desktop again, with no screen saver in sight.

    "Can I have my 50 quid?"

    Rep: "No."

    Rep: "I'll set the admin password, that'll cure that."

    "That's okay, Petter Nordahl will sort that out."

    Rep: "Who's Petter Nordahl?"

    1. Alan Brown Silver badge

      "Can I have my 50 quid?"

      Rep: "No."

      At which point you've established the reliability of the entire organisation

  22. Anonymous Coward
    Anonymous Coward

    So todays lesson is...

    ...probably that the people who make locks and doors should not be trusted to make locks and doors.

    Much like the people who build ATMs or "Smart" anything. Sadly the through line of these story's seem to be that the companies that are selling these products are perfectly willing to keep selling crappy products that are basically snake oil. Worse, they are demonstrably worse than vintage tech like a Chubb or Hobbs lever lock from a century ago.

    The electronic locks, more often than not, are even worse, as both the mechanical electronic portion is weak. Most cant stand up to a hammer or screwdriver, and often the electronics can be bypassed as well. As a bonus they are usually huge, eat batteries, and require either bluetooth or 2.4ghz wifi to operate.

    Probably the worst part of the whole thing is that 85% of the locks these companies sell are total crap, inferior in every way, and most people have no idea, and spend as much as a much more robust lock for not much benefit.

    I had a great experience where someone let themselves into my condo during the coronavirus lockdown, probably with a screwdriver or butter knife as the latch(facing the wrong way) and deadbolt(bolt hole not quite deep enough for reliable lockup) were poorly installed. There were tool marks on the outside of the door jam when I looked outside. I heard the intruder fiddling with the latch while I was sleeping upstairs, and it was only a couple of seconds. I barely had enough time to put my pants on before I had to shout them back out the front door. Getting a locksmith out was a PITA too.

    Because it's a rental there wasn't much I could do about the locks, but I upgraded to a brace bar tied into the floor, which will rule out a repeat performance while I am home at least, barring the use of power tools.

    1. Stoneshop
      Devil

      Re: So todays lesson is...

      I barely had enough time to put my pants on before I had to shout them back out the front door.

      Bah.

      One night a good couple of years back I was woken by the sound of someone trying to open the back door. This was an ex office building, and that (double) door had no outside handles or locks, instead one of those panic bars on the inside. Also, glass panels plus windows next to it, but the guy clearly was trying for the unobtrusive approach.

      So I got out of bed, walked over to the doors, stark naked, watched him for ten seconds or so from less than a meter away, and as he still hadn't noticed me I tapped on the glass and as he looked up, I flipped him the bird.

      Funniest was that as he turned around he kind of looked displeased that he wasn't allowed to break in.

      Another burglar (same building) was trying to get into an open first floor window via a PVC rainpipe. With little progress, amusedly being monitored by the upstairs neighbour from another window ten meters over, who had called me to inform us of this rather pathetic intrusion attempt. Got out that back door, went to stand more or less behind this dimwit, a fairly small and scrawny guy. (I'm 1m97, and weighed at least twice as much as him), held my hands in an "I'll grab you by the next" position, took a deep breath and bellowed RRRAAAAAARRRRGGGGHHH. Dimwit dropped into the flower bed from having managed to climb the pipe about a meter, looking utterly scared, jumped sideways and set a new Olympic record 50m sprint-with-soiled-trousers.

      1. Nick Ryan Silver badge

        Re: So todays lesson is...

        In a previous life we had somebody break into our office buildinf using a garden fork through the window. The office the broken into had locked doors so they couldn't get any further - it was part of the closing the office every night procedure to lock all the internal doors. If they had broken into one of the windows around the back, or even the neighbouring window they would have had free access to the warehourse where vaguely valuable stuff was kept.

        Quite often some of our engineers didn't bother shutting the vehicular access door asuming that somebody else would do this. On occasion I only noticed this when driving away from the car park.

      2. Alan Brown Silver badge

        Re: So todays lesson is...

        "So I got out of bed, walked over to the doors, stark naked, watched him for ten seconds or so from less than a meter away"

        I had something similar

        Apparently a naked, bearded man holding a 14 inch long boning knife and _grinning_ is a rather scary thing to find when you've just let yourself into someone else's property in the middle of the night

  23. TRT Silver badge

    He can still go into the university during lockdown though...

    apparently he's a "key worker".

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Other stories you might like