Physical locks are less hackable than digital locks, right? Maybe not: Boffins break in with a microphone
- Reference: 1598002265
- News link: https://www.theregister.co.uk/2020/08/21/spikey_paper_acoustic_lock_pick/
- Source link:
In March 2020, Soundarya Ramesh, a third-year PhD candidate at the National University of Singapore, published a [1]paper [PDF] co-authored by security researcher Harini Ramprasad and Professor Jun Han on the topic of "acoustics-based physical key inference".
"Since March, we have heard back from a security company that was interested in converting our research into a product, and also an amateur lockpicker who wanted to improve upon our initial idea," Ramesh told The Register .
The paper presents "SpiKey, a novel attack that utilizes a smartphone microphone to capture the sound of key insertion/withdrawal to infer the shape of the key, i.e., cut depths (referred to as bittings) that form the 'secret' of the key, solely by the captured acoustic signal."
The software works by using the time difference between clicks made as the key contacts the pins in the lock to infer the distance between the ridges of the key. The theory is that it would then be possible to manufacture a replica key using a 3D printer, for example.
The researchers explained that there will be more than one "candidate keys" rather than a single one that fits the pattern, but that in the case of the particular six-pin key analysed, "SpiKey guarantees reducing more than 94 per cent of keys to less than 10 candidate keys" with three candidates being "the most frequent case".
There are several mitigating factors. Some types of key create "overlapping clicks" that are hard to analyse so only around 56 per cent of keys are vulnerable. In addition, the software assumes a constant speed of key turning, which is not the case in the real world – though by recording multiple instances this might be overcome. Future work might include "other approaches of collecting click sounds such as installing malware on a victim's smartphone or smartwatch, or from door sensors that contain microphones," said the researchers.
How close does the microphone have to be to the lock for this to work? "Currently, we are investigating short distances at about 10cm from the lock for scenarios such as smart doorbells where an attack seems plausible," Ramesh told us. "At a farther distance, the attack should be feasible with a parabolic microphone, although we've yet to confirm this."
Is it not easier just to pick a lock with traditional tools – alarmingly easy for an expert to accomplish? "We wanted to explore the possibility of a novel attack on physical lock-key systems that can remove human expertise out of the equation, while also keeping the attack completely surreptitious," Ramesh said. "Lock picking, although quite effective on various lock types, still requires meddling with locks and human expertise. Further, lock picking also leaves traces on the lock's interior that can be identified by forensic experts."
While the research is largely theoretical, it is a reminder that sensors combined with software can overturn assumptions about physical security.
If a physical lock can be cracked with a microphone, are digital locks, such as those operated by cloud-controlled security systems, more secure? Ramesh has little patience with the idea. "There is no reason to believe that digital locks provide better security given the number of cyber attacks we witness. While attacks on physical locks require the attacker to be present, digital attacks allow for remote attacks as well, which is quite horrifying. Inspired by the two-factor authentication of the digital world, maybe a combination of both physical and digital locks for our doors can be a safe way forward."
The purpose of the research? "We hope that our work inspires other security researchers and professionals to pay more attention to the security of our door locks," said Ramesh. ®
Get our [2]Tech Resources
[1] https://soundaryaramesh.github.io/papers/spikey_hotmobile.pdf
[2] https://whitepapers.theregister.com/
Re: LockPickingLawyer
You beat me to it. LPL and BosnianBill have proven that time and time again a poorly made physical lock (e.g. of the Master Lock brand) can be defeated with minimal tools and skill.
Excellent work
What a great, proper, idea for a phd!
Well done that student!
So we need to upgrade the physical locks....
To include a random resistance to key insertion and pin engagement - I'm thinking something with magnets (not for any other reason than I think magnets are still pretty damn cool)......
Re: So we need to upgrade the physical locks....
A few already do, avocet abs keys for one, https://www.youtube.com/watch?v=zq5rGjt-9rQ you don't really need to go that far though, this will probably only work easily with straightforward in-line pin tumbler locks, there are a host of other types once you get to slightly more secure models, including locks with multiple locking systems (say, combined dimples and cuts for one), which this would have great difficulty disentangling.
Re: So we need to upgrade the physical locks....
Just replied below - we also have the Avocet lock system. Good (secure) purchase.
Re: So we need to upgrade the physical locks....
Agreed. Avocet ABS is the minimum standard for domestic security, IMHO.
Re: So we need to upgrade the physical locks....
How about a lock with a loudspeaker that plays white noise when touched by a key? Just drown out the clicks.
WD40?
Advanced lubricants to reduce click level below ambient noise? Self-lubricating surfaces a la Harrison's watch?
I'm thinking the 10cm radius mentioned was to do with gaining sufficient S/N.
Coat: off out in the wind. No picking tools packed.
Security Locks for the win
Was worried for a moment there, but it looks like my fetish for security locks has payed off. No ridges to listen to, just magnets attracting the pins instead. One key for all secure doors in the building. Nice.
Re: Security Locks for the win
Ah, so it will generate a weak RF signal as you withdraw the lock. I'll need to replace the microphone with an aerial.
Abloy is still keeping my stuff secure. I don't think their locks have ever been picked in situ. I wonder if the method described could infer the mass of each disc as the key is pushed in or withdrawn?
My lock's fine then
My old knackered lock requires me to jiggle the key to just the right spot. I've got it down to a fine art now but it certainly fools the "constant speed" assumption.
Also it sounds like it would be trivially easy to confuse this by jiggling any key as you insert it?
Re: My lock's fine then
Jiggling is a lock-picking technique. You might find that jiggling with another similarly shaped object will also open your lock.
Re: My lock's fine then
One of the muppets here managed to lock the keys in his drawer but searching through the BIG box of 'spare' keys didn't turn up any with the matching serial number... but it turned out one of the most common spares worked if you didn't fully insert it then j-j-j-jiggled it
(after a couple of repeats I finally figured out how he was managing to do it. He would unlock the drawer but was turning the key back to the 'locked' position before withdrawing the key... then he put the keys inside and pushed the drawer shut and 'click!')
Re: My lock's fine then
Jingling keys would make a different sound than pins pushed by springs, so in theory it might be possible to filter for the correct frequencies. In practice, probably not.
But just inserting and pulling the key very slowly ould make the pins slide along the ridges instead of jumping, so that should also work.
One reason NOT to jingle your keys is that hackers can already make duplicate keys using a photo taken from long rane with a powerful tele lens.
Damned if you don't and damned if you do.
Random background noise?
Mechanical upgrade to generate back ground noise when the key is inserted?
Really?
Since we're in the "totally unpractical but yet probably possible attacks" category, I have an even better method: Insert a tiny camera inside the lock and film the key as it is inserted, allowing you to make a perfect copy - Voila!
I really don't know why people still use crowbars and car jacks to force doors open...
Opening a mechanical lock by recording its sound and translating that into a duplicate key (no doubt 3D printed)... I wonder when that's going to show up at CSI or one of the spin-offs. I give it a few months on the outside.
LockPickingLawyer
The headline writer has obviously never seen the LockPickingLawyer destroy lock after promising lock to know that physical locks are absolutely hackable and digital locks are usually far worse.