this is the lockpicking lawyer and the
video you're about to watch is the
culmination of a series of events that
started
about six months ago that's when shane
at the
excellent youtube channel stuff made
here posted a video build
of an unpickable lock that video which i
will link below
also challenged me to open it i
obviously accepted because the lock is
here
but shane wanted to improve his design
first and by
improve he seems to have meant
completely redesigned
from the ground up because what i
received was the original lock
and a second lock which bore no internal
resemblance to the first
and i have to say i had a great time
with these because
both mechanisms are to the best of my
knowledge completely original
and in my opinion quite good fortunately
for me though shane doesn't have a lot
of experience with locked defeat methods
so there were a few minor oversights
that i was able to exploit
however each of the issues i found can
be fixed with very little effort
which would result in formidable lock
designs
before we pick these i want to explain
what i'm going to do so my actions don't
look
too cryptic that will require some
reference to the internals
but if you want a detailed look at
what's inside
you need to check out the stuff made
here youtube channel and all the
appropriate links are below
the first lock this one looks something
like this
on the inside when you insert the key
the pins in contact with the key will
lift these
upper pins that are shown in gold those
pins then lock into place and
rotate until they're in contact with
this fin
there are gates in the fin and only if
these upper pins are in the correct
position
will they pass through notably however
when that test phase occurs when those
upper pins encounter the fins
they are no longer in contact with the
key pins
that's what makes this unpickable in
theory
what i'm going to do is lift all of the
upper pins as
far as they will go lock them in place
rotate them until they're in contact
with the fin
and then drop them down until they fall
into their gates
it usually takes a few attempts for it
to work but the method
seems to be reliable
second lock is even more complex than
the first
it actually has two cores attached with
an internal connecting rod
if we look at the back we can see the
bottom core the top core
and a connecting rod the sheer line that
matters
is the one on the upper core which we
can't access to tension
it's behind this area of the lock
by the time that upper core actually
turns the bottom core is offset by about
45 degrees
which means you can't move the pins
that's why
this lock is at least in theory
unpickable
put differently when you can access the
pins you can't tension the lock
and when you can tension it you can't
access the pins
i'm going to try to get around that by
inserting a
thin piece of metal between the door and
the lock housing
then slide it up until we're over the
top of that
upper core and then pull down which
should
tension the upper core once that happens
i should be able to pick this as i would
a normal lock
there are two other potential
vulnerabilities
the first arises from a combination
of this core rotating 45 degrees in
either direction until it seizes up
and the tail piece being misclocked by
about 45
degrees when we pick you'll see
why that makes a difference but i think
you'll get a chuckle
when you see how they interact the
second vulnerability
is decoding and we can do that because
all of these
upper driver pins are the same length
a tool can be fashioned to lift all the
pin stacks
to the stopping point fully compressing
the springs
that's an indirect way of measuring the
key pins which would allow us to cut a
key i did not create that tool because i
had another way to open this
but that's something that used to be
common before manufacturers started
varying these lengths okay i have been
talking for
too long the jig that shane sent me to
pick these in
is way too big to fit on my desk so we
are going to mount these up
head down to the garage and try to open
them
okay we are down in the garage both
locks are mounted in this mock door
and the frame is secured to my workbench
we're going to start with the newer of
the two locks and discuss a
vulnerability
enabled by the fact that this core will
turn about 45 degrees before it seizes
that creates an issue as the lock
interacts with the deadbolt
now under normal circumstances a
deadbolt that is fully
extended can't be pushed back into the
door however
if we turn this core as far as it will
go it's
just enough to disengage the
anti-retraction mechanism
that's something we can certainly take
advantage of while the door is locked
all we need to do that is something that
will turn the core
and something pointy like the tip of my
pocket knife
so i'm going to turn this as far as it
will go
then use the point of the knife to walk
the bolt back
might as well let them know we're here
next we are going to attempt a picking
attack though certainly not a
traditional one we discussed it upstairs
but what i'm going to do
is attempt to slip this between the door
and the housing so we can tension the
upper core
pushing this in will do damage to the
door however
i don't think it'll be a lot of damage
and i don't think it'll be very
noticeable because it'll be
on the bottom however i will show you
the damage after we're done
the hard part will be getting this into
position so let's do that
now
i am pushing the tool against the door
so it doesn't deform
okay i might have it but the only way to
be sure
is to pull on these pliers and see if
the pins are binding
there we go click out of one little
click on two
nothing on three little click on four
little click on five one
two another click on three click on four
nothing on five
i don't feel anything else let's see if
we have this open
okay now let's work on the older lock
once again i discussed the theory of
what we're going to be doing
while we were upstairs however it's a
little bit harder in practice
first we need to lock it
okay i'm going to use this pick to lift
all the pins
to their highest position
and when i release these i'm going to be
tapping on the housing with this mallet
it allows for a little bit more control
as the pins come down
and it increases the chances of success
from
about one in every 10 times to one in
every two or three
i think we've got it
okay folks let's bring all this stuff
back upstairs i will show you the damage
underneath
and we will sum everything up okay folks
we are back upstairs and i'm going
to briefly address how to fix each of
the exploits i demonstrated
but first let's take a look at the
damage to the door
it's certainly noticeable once the lock
is removed though
much of the damage is covered by the
lock and the part that isn't
is probably obscured because it's
underneath the bulky housing
frankly even if i saw that i'd probably
attribute it to sloppy installation
and not to an attack while we're looking
at the door
note that shane welded both of the hinge
pins
probably to stop me from popping the
pins and declaring victory
and i've got to say he did the right
thing because i definitely would have
done that
moving on to the locks the issue with
the first lock can be fixed easily
by decreasing the angle of the fins so
there's no slope for them to rest on
frankly a reverse rake would probably be
advisable
with the second lock the first exploit
can be fixed with
a slight modification to this moving
tail piece
re-clocking that cutout by about 45
degrees
there are about a dozen ways to fix the
picking exploit and deny
access to the back of the lock but when
i told shane about it
he precision machined a back cover
which is probably the most expensive
solution but
certainly one that works so i hope you
all enjoyed this
shane excellent work on these locks and
thank you so much for sending them my
way
to everyone else that's all i have for
you today if you do have any questions
or comments about this
please put them below if you like this
video and would like to see more like it
please subscribe
and as always have a nice day thank you