Brian A. Thomas .com

New stories are below this one. This is so important I thought it should stick to the top for a while.
There is a technique for opening locks that is gaining popularity. Unlike lock picking, it requires no special skills and can be used on pretty much all locks, from the normal pin-tumbler, dimple locks, Mul-T locks, ball locks, locks that combine those and many more, on locks from $10 to over $100. Bumping keys can be obtained fairly easily (they are legal to buy and ship), or made with ease.
The media is in a catch-22 on this one. The more they talk about it, the more exposure the technique gets and then the criminal minded people can do a bit of research and figure out how to do it and get the stuff they need. However, at the same time, exposing this weakness in locks also motivates people to demand better lock systems, giving the lock makers an economic incentive to make bump proof locks, which probably means electrical of some type.
The bad thing. Odds are if somebody breaks into your house using bumping, unless they leave clear forensic evidence that they were there, insurance won’t cover the loss. Generally, bumping, performed correctly doesn’t leave evidence that the lock was bumped.
There are solutions out there.

Of course, some of the more complicated locks, Mul-T, Medeco and the like may be harder for most key bumpers to get past, since the blanks are a bit more expensive. (Manufacturer links at the end of the article.)

There are keys that are suposedly imune. From the digg forums:

Luckily, there are a number of locks immune to bumping:
The classic abloy detainer disc lock is immune, has been since 1917.
Medeco3 definitely (and I *think* any Medeco lock using the double-locking sidebar system) is immune to this, because bumping this will likely result in the sidebar going into a false notch rather than a real one.
Mul-T-Lock Cliq is immune, but expensive (USD $700+ per cylinder) because it incorporateds the mechanical part of the Mul-T-Lock, and adds an electronic element. Its nice because you can rekey easily without requiring wiring all the doors to a central console. All the electronics are in the cylinder, and the battery powering the system is in the “quartz” key. Of course, the battery is replacable in the key.
IMHO, the future of locks will tend to stuff like the Cliq series, Medeco3 which incorporates multiple directions and mechanisms, or the Abloy Protec series. The Cliq series, once it comes down in price, is especially nice, because it uses an electronic key as well as a mechanical mechanism.
Of course the US gets *none* of the high-end locking systems like Mul-T-Lock Cliq or Abloy’s Protec series, unless you order your locks (and keys) from an overseas vendor. However stateside, people don’t seem to care at all about people picking locks, rather they are more scared of home invasion burglaries and tend to back up the easily pickable Kwikset locks with alarms, dogs, or high caliber firearms.

If indeed these systems are not available in the US, perhaps they soon will as bumping gets more exposure and people demand a way past it.
Further, from Security.Org’s PDF paper on Bumping:

Secondary locking technology cannot be bumped because a traditional shear line is not created. This would include sidebars employed by Medeco, Assa, Schlage and others that rely upon the rotation of pins (Medeco), or rotation and/or lifting of secondary elements (Assa and Schlage Primus), or interactive elements (Mul-T-Lock and DOM). Sliders that control sidebars (Evva) cannot be bumped either. For a lock to be a target of bumping there must be at least two pin tumblers in each chamber that, in normal operation, are split at the shear line by movement of the proper key and otherwise block rotation of the plug.
Some models of locks produced by Mul-T-Lock, DOM and other manufacturers have incorporated certain features that are designed to make it more difficult to replicate a key. Interactive elements that change their position and which are embedded within the key are usually placed in one or more defined locations, rather than randomly. So long as the bump key contains the identical elements, it may be possible to open the lock, although the difficulty may increase. The underlying physical theory of bumping does not act upon these added elements.
They merely add another variable and may prevent a successful opening because their primary function is interfered with by the forces that are created during bumping.
These interactive measures were not designed as an anti-bumping technology but for key security and to make picking more difficult. The Dutch test demonstrated that these elements can prevent locks from being compromised (Mul-T-Lock interactive and DOM-IX could not be opened during the formal test), but the DOM 6SR, the flagship of the DOM product line, was opened within
seconds, even though this particular lock was equipped with anti-bump pins, two sidebars and one interactive floating disk which is active at a 45 degree angle straight through the key. There have been a number of independent reports and demonstrations from different countries regarding the ability to bypass these interactive measures and in fact some of these locks have been successfully opened by bumping. The real issue is the repeatability and reliability of such actions for a specific manufacturer. As has been emphasized in this report, the ability to open a lock one or more times is far different than opening that lock repeatedly with a high probability of success every time.
The members of Toool and others continue to develop methods to bypass these high security cylinders, based upon their specific design parameters. The issue in such cases raise three interrelated and relevant questions: (1) what is the required expertise, in terms of knowledge and tools, to produce a working bump key that may contain unique or modified geometry, (2) what is the skill set required to open these locks, and (3) what is the repeatability in such cases.
Although some models of some manufacturer’s locks with sidebars or other security enhancements can be opened through the bumping process, there are caveats that must be understood in order to make this claim anywhere near truthful. Physically, the sidebar portion of a locking system cannot be bumped open. It does not matter whether it is a Medeco with its rotating and elevated pin tumbler design, or an Assa with its vertical finger pins, or a Schlage Primus with finger pins that are similar to the action of a Medeco pin tumbler and provide a completely separate locking system, requiring both rotation and lift of the finger
pins. In the case of Mul-T-Lock, DOM and others, their interactive elements can make bumping difficult or impossible, but these locks have been opened by bumping. However, in the view of the author, such occurrence may not be reliable or repeatable and are dependent upon a number of variables that may be specific or unique to each target lock.
If locks that contain secondary systems such as sidebars and interactive elements are to have a chance of being opened by bumping, then the precise character and dimension of these elements must be replicated within the bump key. That means that the correct sidebar code or interactive element must be present as well as the position of any moving piece or ball bearing. These
elements must not be adversely affected from forward movement of the key during the bumping process. When the only variable is the shear line and the pin tumblers that cross it, then the lock will likely be opened. The moment that complicating variables come into play, the chances of successfully bumping diminish in proportion to the complexity of the secondary locking system.
Although some high security cylinders may indeed be subject to bumping, it is usually as a result of a combination of factors within specific locks and bitting patterns. Such a combination of variables are generally not present in all locks, which explains why only certain ones can be opened.
…
Other high security lock designs may also frustrate bumping attempts. The Mul-T-Lock is a pin tumbler dimple lock that utilizes telescoping pins and in some designs, interactive pins. In the Netherlands test, certain models of Mul-T-Lock were bumped open, while others with interactive pins could not be opened during the test, but reportedly have been opened, but not consistently or with repeatability. Other dimple designs will likewise prevent bumping. Kaba, for example, produces locks with multiple rows of pins, set at different radial angles.
These locks are virtually impervious to bumping, while in contrast normal dimple locks are quite simple to open.

I should note that I believe the above refers to Mul-T’s regular lock, which is an interactive design, not their new Interactive CLIQ which does seem to add a chip to secure the key.

Some manufacture links:
Medeco - Mentioned in both quoted items. They even talk about bumping on their front page.
Mul-T-Lock - Mentioned in both quoted items. Make the CLIQ, the lock with the chip in it that costs about $700 a cylinder.
Abloy - Also mentioned in the above two quoted bits. This is for their US site. They indeed don’t seem to make home door locks however for the US market. Why? I don’t know. They do seem to make a Protec series for other markets like the UK and Australia.

Tags: General