Bump Key Crisis - What Are You Doing About It?

Avatar
Brian Rhodes
Jun 28, 2013
IPVMU Certified

I am curious to see how many of our members consult on or install door locks in addition to electronic access control hardware/alarms/video. The 'crisis' of bumpkeys has opened up vulnerabilities on a huge swath of the door lock market:

(This is one of thousands of similar videos online...)

While the video above is focused on alarming the residential market, there often is not any difference in the function of 'commercial grade' locks and many properties are vulnerable to the same exploit.

As 'security professionals', do you consult your customers on door hardware? Do they ask for your help? Are keyed door locks in the scope of your 'security' business?

JH
John Honovich
Jun 29, 2013
IPVM

Is this new? Why is this a crisis now? What changed?

Avatar
Brian Rhodes
Jun 29, 2013
IPVMU Certified

It's not new, because it uses a fundamental flaw that most every 'pin tumbler' lock is designed with in the last hundred and fifty years.

It's a 'crisis' only because guys like Marc Tobias and lockpicking websites have demonstrated 'lock bumping' to the masses, yet it remains unaddressed by many. In my experience as an integrator, customers appreciated an audit of their lock hardware because they either didn't know enough to be alarmed, change things, or really care about the risk.

The locksmith in the story above paints the picture in the correct way; most people invest thousands in high-security surveillance and alarm systems, but don't heed the glaring vulnerabilities in their commodity-grade door locks!

If nothing else, it shows that the types of threat or danger most concerning to security managers aren't people breaking in by bumping locks...

JH
John Honovich
Jun 29, 2013
IPVM

So basically the Internet not only got the word out, it made it easy for anyone to buy them online for a few dollars?

Avatar
Daniel S-T
Jun 30, 2013

We had a guy from Wiser/Kiwikset Locks come in and state they have "Bump Guard" in a lot of their locks, how ever I have heard it's not as effective as the salesman likes to make me think it was.

Atleast they're trying to addres the issue though?

CS
Carl Schroeder
Jun 30, 2013
Whenever doing an access system we upgrade all cylinders and locks to Medeco high security cylinders which is a different breed than anything you see being bumped. There's no sense in trying to control access with a card when you can bump, pick or basically walk through a door with a screw driver.
JH
John Honovich
Jun 30, 2013
IPVM

Thanks, Carl.

Brian, what's the price differential between a 'bumpable' lock and a non-'bumpable' one?

Avatar
Brian Rhodes
Jun 30, 2013
IPVMU Certified

Re: Price difference - a high security lock costs $100 or more, while commercial grade builder's hardware may cost $10 or less.

However, like Daniel hints at, a product that claims 'bump proof' or 'pick proof' is similar to a camera that claims '0.000001 Lux'.

It's a nonsense claim that needs to be explained more deeply than simple marketing, because not every product claiming to hedge against bump risk solves it in the same way. This, coupled with the fact there are legions of 'sport lockpickers' that would rather do nothing else that post Youtube demos of 'bumping' marketed bump-proof locks.

Features of 'bump resistant' locks include additional design features like shaped top pins, locking sidebars, and trap pins. See image below for the least expensive feature: shaped top pins -

These features are part of 'high security locks' like Medeco or Primus, but those products don't claim to be 'bump proof' on factory literature. Rather, they make the 'high security' claim that contrasts them against other locks and partially explain why they cost hundreds rather than tens of dollars.

Anti-bumping design features do not eliminate the bumping risk, but just confound it or make it very difficult. Like most security equipment, adding time to defeat a 'security layer' is invaluable to hardening it against exploit, but may never eliminate the risk.

JG
John Grocke
Jul 01, 2013

My son worked in a hardware store for years. He was amazed how many times he was asked to duplicate a "bump key". They are pretty easy to spot with the naked eye, just do a GIS for it. I would imagine if you are suspected of breaking & entering with one of these on your person, it wouldn't be a good thing.

This has been around for years, not sure why it's a "crisis" now...

Avatar
Brian Rhodes
Jul 01, 2013
IPVMU Certified

Needing to duplicator to reproduce a bump key is the epitome of laziness. Usually it takes nothing more than 30 minutes, a set of small metal files, and a bad attitude.

<alleged> Thieves these days...

Avatar
Ethan Ace
Jul 01, 2013

Yeah, but why spend 30 minutes if someone could do it for you for $2 in 5 minutes? That sounds like an efficient potential criminal to me.

JG
John Grocke
Jul 01, 2013

That would take mechanical skill... Most kids today can't change a flat bicycle tire innertube.

The hardware store my son worked at would refuse to duplicate these keys and warn the person that next time they would report them to law enforcement. Within a few weeks, the requests for bump keys went away.

Most hardware stores and locksmiths don't sell blanks for this same reason.

Although I would suspect that automated key cutting kiosks like "Minute Key" would be the perfect avenue for the lazy burglar, unless thier machine recognizes bump keys.

One other possible solution would be to use some off brand of locks for your house where keys were not as available. Any "bumper" has a key for most of the major brands such a Schlage, Yale and Kwikset.

Avatar
Brian Rhodes
Jul 01, 2013
IPVMU Certified

Great question. I'll ask MinuteKEY (see our update on the machine) if they have a method of dealing with bumpkeys.

Avatar
Brian Rhodes
Jul 03, 2013
IPVMU Certified

MinuteKEY responds:

There is nothing special about a bump key. If its the correct keyway, our kiosk will duplicate it. Because there really is nothing special about a bump key, in our opinion, mass retail key duplications centers would also copy them.

JG
John Grocke
Jul 03, 2013

Nothing special? A bump key is pretty easy to spot with the naked eye and some cuts that have to be made deeper than normal keys. I'm surprised MinuteKey's optical comparitor can't pick that up and it would make the deeper cuts.

Lazy burglars don't even have to go grab a file, go to the hardware store or key cutting kiosk, now they can just go to Amazon or Ace Hackware. Of course that leaves a paper trail... ;-)

But to answer the "What am I doing about it?" quesiton: an alarm system, two dogs, a pistol and a shotgun.

CP
Carlton Purvis
Jul 03, 2013

You can find them for pretty cheap at flea markets too around here too. No paper trail.

JE
Jim Elder
Jul 06, 2013
IPVMU Certified

I teach a regular class on locks as part of a basic crime prevention course to police officers. During this course I show this video on lock bumping:

(Note that it has well over 2.5M views). I can count on one hand the number of officers who know about this trick. But then again, how would you know? I point out that if an officer catches a person with these keys in his/her possession, its probably probable cause for an arrest for burglary tools. Locksmiths will typically pick the lock rather than bump it open (picking looks a lot cooler).

JS
Jack Sink
Jul 10, 2013
IPVMU Certified

Bump key attack is an example of a social media frenzy because of 2 issues: 99.9 % of people never heard of it before YouTube and 2) social cripples still living in Mom's basement want status and recognition for "uncovering a vulnerability" that's only existed since pin tumbler locks were developed by Mr. Yale himself.

We always look at the quality of doors and lock hardware during risk assessment/threat mitigation surveys but the easiet to compromise builders-quality locks are sometimes found. Those same locks can usually be opened with a credit card or laminated card inserted to slide the bolt out of the strikeplate ...again a technique that's over 100 years old and a lot quicker than making a bump key.

Nobody ever bump-keyed a maglock!

New discussion

Ask questions and get answers to your physical security questions from IPVM team members and fellow subscribers.

Newest discussions