Duplicating Restricted Mechanical Keys

Presented at DEF CON 27 (2019), Aug. 9, 2019, 10 a.m. (45 minutes).

Secure facilities in North America use lock systems like Medeco, Abloy, Assa and Mul-T-Lock partly to resist lock picking, but also to prevent the duplication and creation of unauthorised keys. Places such as the White House and the Canadian Parliament buildings go so far as to use a key profile exclusive to that facility to ensure that no-one is able to obtain key blanks on which to make a copy. However, there are tens of thousands of unrestricted key blank profiles in existence - many match very closely to these restricted key blanks, and can be used instead of the real blanks to cut keys on. Moreover, keys are just pieces of metal - we will present numerous practical techniques to create restricted keys without authorisation - including new attacks on Medeco, Mul-T-Lock and Abloy key control systems. We will touch on all aspects of key control, including patents and interactive elements, and discuss how to defeat them and how facility managers can fight back against these attacks.

Presenters:

• Bill Graydon - President and Principal, Physical Security Analytics
  Bill Graydon is a principal at GGR Security Consultants, and is active in research in electronic surveillance and alarm systems, human psychology in a secure environment and locking systems analysis. He received a Masters in computer engineering and a certificate in forensic engineering from the University of Toronto, applying this at GGR to develop rigorous computational frameworks to model and improve security in the physical world. Website: https://ggrsecurity.com/DEFCON
• Robert Graydon - Principal, GGR Security
  Robert is a principal at GGR security. With a strong interest driving him forward, he is researching lock manipulation, picking, bypass, and other vulnerabilities, to discover and evaluate possible flaws or methods of attack. He has well-honed skills such as lock picking, decoding, locksmithing, as well as a thorough understanding of the mechanics and function of many types of high security locks, and electronic security systems and components, allowing him to effectively search for and test methods of cracking high security systems.

Links:

• https://defcon.org/html/defcon-27/dc-27-speakers.html#Graydon
• https://infocon.org/cons/DEF CON/DEF CON 27/DEF CON 27 video and slides/DEF CON 27 - Bill Graydon - Duplicating Restricted Mechanical Keys.mp4
• https://infocon.org/cons/DEF CON/DEF CON 27/DEF CON 27 video and slides/DEF CON 27 - Bill Graydon - Duplicating Restricted Mechanical Keys.srt (subtitles)
• https://www.youtube.com/watch?v=ij0c-236O0k

Similar Presentations:

• DEF CON 18 (2010) / Attack the Key, Own the Lock
• DEF CON 28 (2020) Virtual / Exploiting Key Space Vulnerabilities in the Physical World
• DEF CON 30 (2022) / Defeating Moving Elements in High Security Keys