August 7, 2006
Physical Security Threat: Bump Keys
Our normal scope here is on information based security, but this you gotta see. A new lock-picking technique called “bumping” renders almost all traditional tumbler locks useless with very litte skill or tools.
A bump key is a key in which all the cuts are at maximum depth. The picture below shows bump keys for various locks. Bump keys are sometimes called ‘999′ keys because all cuts are at maximum (9) depth.
Once you get a properly cut key ($10 on eBay) they are easy to copy, and it takes about 1 minute to train someone how to do it. Most importantly this technique works on most very expesive locks as well. Also, it seems to be virtually undetectable:
Given that the insertion of a bump key isn’t much different from inserting a regular key, we’d suspect no special scratch marks would be found other than maybe some miniature dents and deformations caused by the impacts. Until more is known, we think it is diligent to assume that any lock that can be bumped can also, with some care, be bumped without leaving any telltale traces.
This YouTube Video shows bumping in action because we had to see it to believe it:
Bumping locks (pdf) [Netherlands Open Organization of Lockpickers]
Very cool stuff but far from new. The movie “Heat” with DeNiro and Pacino showed them bumping a lock back in 1995.
It was the scene where they were trying to break into a building from an alley but were being surveilled by the cops. Sizemore’s character climbed the telephone pole with a laptop and Val Kilmer bumped the lock on the back door.
I always thought that was a bit of ‘Hollywood,’ opening a lock with a tap from a hammer, but now I know what they were doing.
August 9th, 2006 at 7:36 amI’ve never seen the movie “Heat” but I have seen \ modified keys to make them work as bump keys.
August 26th, 2006 at 10:53 amIt’s actually pretty easy to modify the shoulder \ tip so you can use the key as a bump key. I’ve used http://www.bumpkeyforum.com for their guides and what not. They’ve got some good info (some not so good too) about bump keys.