It’s been proven that 3D printing can be used to create 3D printed key duplicates, but a more universal key generator has yet to be developed. Two skillful lock-pickers, however, have now proven that, even without the original set of keys, they can 3D print their own skeleton key to almost any pin tumbler lock.
Jos Weyers and Christian Holler have taken a method invented in the 1920s and updated it with 21st Century technology, 3D printing a “bump” key, that can pick almost any variety of pin tumbler lock with little effort. The bump key looks ordinary, but, by inserting it into a keyhole and bumping it with a hammer, the key pushes the pins inside of a lock upwards, forcing it open with each tap. You can watch Holler break open an Abus E20 lock with his 3D printed bump key below:
Bumping open a lock requires some important information in order to generate the skeleton key. To fabricate theirs, Weyers and Holler wrote a piece of software called Photobump. To make a bump key for a specific lock with Photobump, users need a photo of the lock’s keyhole, as well as the keyhole’s depth. Additionally, lock-pickers need to know the position of each pin in a lock, but Holler suggests that the layout of the lock can be found in pretty ubiquitous key-cutting software. Weyers further argues that the pin positions can be determined by sliding a thin tool into a keyhole and marking how far in the pins are situated. Then, the key can be 3D printed on an ordinary desktop 3D printer or ordered from a 3D printing service bureau. Weyers explained to attendees of the Hackers On Planet Earth conference, “You don’t need much more to make a bump key. Basically, if I can see your keyhole, there’s an app for that.”
Despite the fact that bump keys have been around for awhile, they are difficult to fabricate for locks that use complex key blanks, trademarked and distributed only to a lockmaker’s own customers. With a photo and information about the lock’s depth and pin positioning, Photobump can create a 3D printable model easily enough that Weyers and Holler believe lock manufacturers should take note. Holler says of the fact that lockmakers rely too heavily on their restricted “key profiles” that, “It’s a kind of false sense of security. If a protected profile is your only protection, you should be aware that’s no longer enough.”
Holler will be presenting the technique at LockCon in the Netherlands next month, but as an educational demonstration. Instead of releasing Photobump to the public, Holler is working with police in Germany to research the possible forensic evidence deposited by a 3D printed bump key. Assa Abloy, manufacturer of one of the Ikon locks that the duo cracked, believes that their 3D printed technique won’t be able to replicate advanced keys with obscured or moving parts. The company’s research and security director told Wired, “We view this as an interesting exercise, but not particularly representative of the real world of covert entry by criminals and burglars. Yes, you can open some locks, some of the time with bump keys, even made with hard plastic. But…the use of such keys depends on many variables and is not particularly reliable.”
The lockpickers, however, argue that, with time, fabricating bump keys will become easier and more sophisticated. As for the cost, Holler’s nylon keys were printed for less than €5 each. Shapeways has yet to restrict the 3D printing of bump keys, with a representative saying that Shapeways ““doesn’t have any specific policies around printing keys or lock picking tools, but it is up to our users to responsibly comply with our overall guidelines.” i.materialise, on the other hand, commented on a previous use of their services for key duplication, “i.materialise rejects any use of its services to promote activities or to create products which pose a safety or security risk to others. Had the intentions of David Lawrence and Eric Van Albert been known to i.materialise, the key would not have been printed.”
Before simply regarding 3D printed bump keys as an “interesting exercise”, Weyers thinks that lock manufacturers should make their locks bump resistant, using electronics or unprintable components, concluding, “The sky isn’t falling, but the world changes and now people can make stuff. Lock manufacturers know how to make a lock bump-resistant. And they had better.”
