LAS VEGAS – Locks that are used in millions of homes and residential buildings worldwide and that are designed specifically to thwart hacking are easily opened with both a screwdriver and wire, two researchers say. Kwikset smartkey locks are certified Grade 1 security for residential use by the Builders Hardware Manufacturers Association and are advertised by Kwikset as being invulnerable to being hacked with wires, screwdrivers, or anything else inserted in the keyway. But that’s not the case, as two noted lock hackers, Marc Weber Tobias and Toby Bluzmanis, demonstrated for WIRED and plan to show attendees today at the Def Con hacker conference. Tobias and Bluzmanis have been cracking locks at Def Con for years, demonstrating the ability to defeat high-security electronic locks used at the White House and other government offices, electro-mechanical locks, deadbolts, and even electronic safes used by millions of consumers. But the Kwikset smartkey locks, which Kwikset introduced in 2008, have the widest distribution of any locks they’ve tested — Kwikset sells more than 20 million a year.
The locks cost between $20-$40 and come with several features that make them appealing — the main one being a reprogrammable cylinder that gives owners the ability to reprogram the locks on the fly to any key. The latter feature can be used by apartment managers to change a door lock after a resident vacates a unit or a building manager is terminated, without having to swap out the actual lock or call a locksmith. It can also be used by homeowners to provide temporary access to construction workers, gardeners or someone else who needs to gain entry for a certain time period, after which the locks can be changed back to fit the original key. But the researchers say the lock design is inherently insecure. The locks can’t be bumped, but they can be cracked in other ways. “It’s very clever because the consumer can instantly reprogram the key, but it’s also insecure,” Tobias says. “There’s a lot of positives for Kwikset, but the problem is they can be opened in 15 seconds with a screwdriver and a paper clip.
It’s not a pin-tumbler lock so that it doesn’t have the inherent physical strength to block the plug from turning when you do certain things.” He and Bluzmanis developed a number of techniques to compromise the locks, including one that lets them thwart it with a four-inch screwdriver and torque wrench, and another that lets them crack the lock just as easily with a wire. Tobias says the BHMA rating is misleading to consumers, fooling them into believing the locks are secure when they aren’t. He filed a formal complaint with the BHMA two years ago, but says the standards body has ignored it. The standard requires that a lock like this can withstand 300 pound inches of torque, but the researchers say they used much less than this to open the locks. Kwikset did not respond to requests for comment from WIRED, but Tobias, in phone calls to technical support for Kwikset, was told repeatedly that the locks were impervious to screwdrivers or wires, and that a screwdriver wouldn’t even fit in the keyway.
“With these ones you cannot even put a flat screwdriver in there,” a technician named Satima on the company’s support line told him during a recent phone call, which Tobias recorded. “There’s racks from up and down direction, not just up” that make it impossible to align the springs in the lock, she said. “There’s no tool that you can just put in the cylinder and pop it open. You can’t put any type of wire or anything like that.” Another technician told him, “If it was that easy to pick a Kwikset lock, they would be having us doing recalls, [but] there’s nothing like that. It’s business as usual.” Without the key, there’s no way to open the locks, the technician asserted, and “sticking anything foreign inside of the keyway is just going to make it that much harder to open up.” The smartkey is a five-pin lock and has 6 depth increments (the height and depth of the mountains and valleys on a key). It can be reprogrammed by placing the original key in the lock and inserting a tool into a slot in the lock face, which moves the assembly back about an eight of an inch and separates the pins and slider and holds them apart while a new key is inserted.
The lock then registers the impressions on the new key and resets the relationship between the pins and slider to correspond to the new key. They demonstrated six different ways of defeating the locks, including inserting a piece of blank with a sharp end into the keyway then, using a hammer, punch out the cap on the back of the plug — a thin piece of metal. Then they inserted a wire with a looped end into the keyway to turn the tailpiece, which rotates independently of the plug, making a key irrelevant. The method works in just 30 seconds and leaves no damage and no trace, since the original key still works in the locks. In a second attack, Bluzmanis inserted a 4-inch screwdriver into the keyway, grasped it with a wrench and turned it to open the lock in just 15 seconds. According to the standard, the lock should be able to withstand 300 pounds-force-inch of torque, but they used only a little more than 100 pounds-force-inch to open the lock. Another attack involved decoding the lock by using a series of keys that are a single depth to determine the depth of each of the pins inside the lock.
We have worked to test August on many different types of single cylinder deadbolts. Below is a list that we have tested. If you have suggestions, or have a question about compatibility, please click "contact us" below. We'd love to help make sure August is the right solution for you. This list will be continuously updated. Grade 3 Single Cylinder Grade 3 One Sided half boreGrade 2 Single Cylinder DL 61 (2014 and before. 2015 and newer Defiant deadbolts are not compatible) Solid Brass Grade 2 Traditional Collection Grade 2 Italian Collection Single Cylinder Contemporary Collection Single Cylinder Arts and Crafts Style Tuscany Srt Nouveau Style One Sided Half Bore Commercial Grade 1 Single Cylinder Commercial Grade 2 Single Cylinder Nostalgic All - Custom UL 60 Minutes Rated 871If the knob/bolt is easy to operate with the door open, then there's probably an interference/misalignment with the hole in the door jam (wall) that the latch/bolt goes into.
(This hole is called a strike recess and the metal cover called a strike plate.)If the knob/bolt is hard to operate with the door open and has been since the lock was installed, it may have been installedLoosen the screws slightly and see if it helps. here if you can't find the screws.] If it's not one of the above, spray "Tri-Flow," a spray lubricant with Teflon, into the keyhole. Depress the spring latch-bolt and spray into it, or extend a deadbolt and spray it and the crack around where it comes out of the door. If it's outdoors and frozen--thaw it first (hair dryer?). If this doesn't fix it, carefully take off a cover plate on one side of the lock and spray the innards.Remove the entire lock from the door. You'll probably have to remove a couple of screws on the edge of the door to remove the bolt. [You'll want to pick a time to do this when you can recover if you can't get the lock back in and working.] If the lock seems to work smoothly while removed, the hole for the bolt (the small hole/tunnel in the door going from the big hole
to the edge of the door.) may have been drilled wrong--too small, at an angle, etc. If none of this works the lock is probably defective. If you replace it, that well known consumer product rating magazine rates National and MasterLock (I've about concluded Master has quit making deadboltsbest deadbolt and Schlage best for other styles, such as entry locksets, etc. NOTE: Graphite should be used sparingly. Too much, or repeated use, can build-up inside and If you have to relocate the strike plate Mr. Fixit has this advice: From: "Mr Fixit" Subject: Re: Deadbolt hard to turn 28 Sep 1997 You will need to determine where the bolt is rubbing and adjust the strikeplate (in the jamb). possibly chisel the hole on one side or top or bottom to clear the way for the bolt to slide in freely. You may find yourself trying to move the plate screws 1/2 hole-space or less and the screws will want to go back into the original holes.