Bumping
Key Bumping
Key bumping (or bumping, rapping) is a covert entry technique used to quickly open pin-tumbler based locks. Key bumping is a method of using a modified key that fits a target lock to create a kinetic energy transfer between top and bottom pins in the lock. Essentially, top pins are "bumped" above the shear line allowing the plug to rotate. Key bumping is similar in function to a pick gun.
History
The first known mention of a "bump key" is in Hiram Simpson's 1926 patent "LOCK DEVICE"[1]. Though the technique was known, it appears use was limited because it was considered a trade secret by many locksmiths.
In the 1970s, locksmiths in Denmark shared a technique for knocking on a lock cylinder while applying slight pressure to the back of the lock plug. When the pins would jump inside of the cylinder, the plug would be able to slide out freely, thus enabling the locksmith to disassemble the lock quickly. The use of a bump key was not recognized as a potential security issue until around 2002–2003 by Klaus Noch. After further research, a white paper was drafted in 2005 by Barry Wels & Rop Gonggrijp of The Open Organization Of Lockpickers (TOOOL) detailing the method and its applicability.[2]
The technique attracted more attention in 2005 when a Dutch television show, Nova, broadcast a story about the method.[3] Bumping received further publicity from TOOOL presentations at security conferences. TOOOL and Dutch Consumentenbond, a Dutch consumer group, analyzed the technique on 70 different lock models with trained and untrained users in 2006.[4]
At the same time, several people in the United States began to talk publicly about the technique and its security implications. In 2006, Marc Tobias released two white papers regarding key bumping and its possible legal ramifications.[5][6][7] In 2008 Tobias also proved that various Medeco locks, thought to be "bump-proof," could in fact be bumped.
Since then, continued locksport interest in bumping has encouraged many vendors to modify lock designs in order to combat bumping techniques.
Principles of Operation
Add to me!
Bump Key Creation
Once a lock is identified as vulnerable a bump key can be made for it. Prior knowledge of the keyway is necessary to make a key that fits into the keyway and has properly spaced cuts. The number of pins within the lock is also important; many manufacturers may use the same keyway but have different key blanks depending on how many pin chambers are used (normally 5 vs 6 pin keys).
Once a key blank is obtained the lowest depth cuts for the given lock are identified. This can be done through manufacturer specifications or with manual key gauges. Key specifications also contain other helpful information, such as the acceptable cut angles to help avoid back cutting. The key can then be cut to a bump key, with all cuts to the lowest position (usually 9-10 in most keys). This process completes a pull-out key; a bump key that must be withdrawn one pin position before being struck. To produce a minimal-movement key, the tip and shoulder of the key must have 0.25-0.75mm of material removed. This will allow the key to be fully inserted and then bumped. To confirm this was done correctly the bump key will be pushed back to normal position by the pressure of the springs, this effect should be visible and provide tactile feedback.
Bumping Process
- Insert the bump key into the lock, withdraw one pin position if the key is not a minimal-movement key.
- Place slight tension with a finger on the bump key.
- Strike the key with the bump hammer. Ensure the strike is directly on the back of the bow of the key. Do not strike from an angle.
If done properly the top pins will jump, and the plug will turn if they are all caught above the shear line. This may take several tries to accomplish. Consider lightly tapping the bow of the key after the initial hit to gently dislodge any bottom pins that may be binding.
Bumping Hammers
A tool is used to strike the bow of the bump key into the lock. Specially designed bumping "hammers" are available that aid in efficient energy transfer to the key. Bumping hammers are characterized by their hard plastic tip and flexible handle. Some hammers include accessories, namely weighted inserts to vary the striking power of the hammer.
Technically any striking tool can be used, but the bump hammers provide a more efficient energy transfer when compared to traditional striking tools such as a rubber mallet or steel hammer. Use of a steel hammer or similarly hardened tool may also cause unnecessary damage to the lock face or the bump key.
Bumping Defenses
Various defenses against bumping exist, some more effective than others. Following heightened media attention many companies began touting bump-proof or bump-resistant technologies.
- Shadow Drilling
- A random pin chamber is drilled higher than the others to prevent a bump key from touching all pin stacks. May cause problems with rekeying unless the position and height of the shadow chamber can be identified by the locksmith.
- Top Gapping
- Top pins are tapered to prevent them from completely falling into the plug. This prevents a clean energy transfer between top and bottom pins.
- Trap Pins
- The shell contains a pin that triggers when the plug is rotated without holding the bottom pins in place (a function of the working key). Problematic because a lock must be drilled once the trap pin is triggered.
- Auxillary Locking Mechanism
- Additional locking mechanisms, such as sidebars or sliders, may thwart bumping. In many cases a bump key can be produced if the sidebar code is known. Other mechanisms provide little to no bumping resistance because of their design. For example, the Schlage Everest side-pin is of no help because it is a natural feature of all Everest keys.
- Non-pin Mechanisms
- A non-pin tumbler primary locking mechanism is enough to stop bumping. Disc-detainer, combination, wafer, warded, and lever based locks are all immune to bumping.
Bumping vs. Pick Guns
Key bumping and pick guns are based on similar entry principles, but there are various pros and cons to using a bump key over a pick gun. Both are similar with respect to skill requirements, noise created during entry, and forensic evidence.
Pros:
- A bump key aligns in the keyway naturally. Pick guns may have difficulty being inserted due to warding or keyway shape.
- Bump keys can naturally include methods to bypass auxilliary locking mechanisms, such as the Schlage Everest side-pin.
- Keys are relatively inexpensive to obtain and modify compared to pick guns (especially electronic or vibrational pick guns).
Cons:
- Finding a key for the lock may be difficult due to patent laws or distribution restrictions.
- Bumping causes pronounced deformation to the face of the lock. May be mitigated with various techniques.
- Bump keys are not universal due to keyway restrictions.
See also
References
- ↑ Simpson, Hiram. Bump key patent (1926).
- ↑ TOOOL NL. Bumping.
- ↑ Nova broadcast on key bumping.
- ↑ TOOOL NL & Dutch Consumentenbond. Report on key bumping.
- ↑ Tobias, Marc. Locked but not secure.
- ↑ Tobias, Marc. A detailed technical analysis of bumping.
- ↑ Tobias, Marc. Bumping of Locks: Legal Issues in the United States.
