Bump Keying HowTo

Edit: 7/7/08: Two years ago I posted this article with the intention of fueling the fire of public discontent with the existing lock technology, with the hopes that it would drive the lock makers to respond with better, more secure technology.

I’ve recently learned that the companies that make these products have, after literally decades of knowingly shipping insecure products, begun to respond to the challenge and actually build a safer product. Master Lock, in particular, has released what they call “bump stop” technology, with a specially crafted pin that makes lock bumping difficult if not impossible. Here’s a YouTube video describing the technology.

At the moment, this type of lock is difficult to obtain for residential use; and while technology rarely ever works as well as the manufacturer claims, the important thing here is that bump resistance has become one of the metrics by which the security of a lock is measured, and products are already available to some consumers that address this threat. In short, it we’re at least on the right track.

And now, on with the original article.

It Worked

I recently saw a report on bump keying and how it, in theory at least, makes pin-and-tumbler locks useless. I was a bit skeptical, so I decided to try it out.

Using nothing but the little information I had gained through some Internet searches and You Tube videos, I took an old, unused key, filed it down to the appropriate shape, and tried it in my front door.

It worked first try.

This is serious. Though I’ve been taught how to pick locks, I’ve never successfully opened anything other than a simple desk drawer lock. With this one bump key, I can open about 40% of the locks I encounter in my day-to-day activities. A second key gets will open another 30% of the locks I encounter in a day, and between the two of them, I can open nearly every residential lock I’ve ever seen. This has very serious implications in the world of home security.

Making a bump key is trivially easy, and costs about $4 to do (or free if you already have an old key and a file). It’s not a new technology, and has been used for a few years no by criminals to break into house without leaving obvious signs of forced entry.

Burying Our Heads in the Sand

Continuing to keep this technique hidden from the public is not serving our best interests. The more expensive locks you can buy at the hardware store are expensive because they’re more difficult to open with a lock pick. Those same locks, though, can be opened in under 10 seconds by a bump key; often, the more expensive the lock, the easier it is to open. Everybody knows about lock picking, so lock makers build locks resistant to that technique. Very few people have heard of bump keying, so lock makers don’t bother to make bump-resistant locks. (There’s good reason for them to drag their feet; bump keying is a very, very difficult technique to guard against without radical changes to the way keys and locks work).

Nonetheless, the problem is here, it’s serious, and it’s not going away. Our only hope for any sort security is to force lock makers to start selling bump-resistant locks. They’ll do that only when the general public finds out that they’re being sold snake oil, not security. Our only hope is raising awareness.

To that end, I’ve created a simple video showing the basics of how to create and use your own bump key. All you need is an old key and a file to cut it with. You’ll be opening doors within an hour.

http://www.youtube.com/watch?v=pwTVBWCijEQ

Refinement

I’m no expert at this. Not at lock picking, not at bump keying, not at anything I’ve talked about here. However, I know who is. Check out www.toool.nl/bumping.pdf for some refinements on this technique.

In particular, their “Minimal Movement” technique caught my attention. I was surprised to find that the directions in the referenced PDF file were all I needed to make that technique work. Unfortunately, in my zeal to create the most efficient bump key, I managed to file away too much and ruin the key.

However, and this is the point, making a new bump key is so easy that there’s really no way to guard against it. You can’t control through legislation any more than you can control lock picks (I’ve seen a lock picked with a screwdriver and a paperclip–you can’t outlaw that!).

So try it out, tell your friends. This is an interesting skill that you can master in just a couple of hours, and a great way to impress strangers at parties. More importantly, when word finally gets out that everybody knows how to bump locks, lock makers will have to respond with better security.

Update

I’ve recently added a follow-up article to this one that answers a number of questions and gives further information about how you can protect yourself. The article is (unremarkably) entitled Bump Key Follow Up.