Upload
alicia-singleton
View
216
Download
0
Tags:
Embed Size (px)
Citation preview
Decoding the Kwikset SmartKey™
Shmoocon 2009
Shane LawsonFraternal Order of LockSport
(FOOLS)
FOOLS?
FOOLS is a locksport group primarily from Bloomington, Indiana
We run the lockpicking attractions at Notacon
Also helped with the lockpicking village at DC16
About the SmartKey
ANSI Grade 1 Deadbolts
Resists bump attacks Re-Keyable on
demand Anti-drill bearings in
cylinder
Operation
The mechanics of the key do not function like standard pin tumbler locks
Pins have a ledge The ledge interfaces with sawtooth wafers The wafers engage the sidebar
Cylinder Dissection
Side view shows pins, springs, and wafer ledges which hold the wafers during the re-keying process
Pin Ledges
Wafer Ledges
Wafers
Right-hand notch is for the sidebar
Left-hand notches fit on the pin ledges
Wafer Housing
Fits to the pin housing Completes the
cylinder inside the lock
Also houses the sidebar
What makes the re-key function work
ReKeying
Turn the key 90 degrees Insert the 'learning tool' Pull the tool and key out Insert new key Turn back to normal Remove key The new key works, old one doesn't
The 'Learning Tool'
Can be replaced by: Paperclip Toothpick Plastic Anything that fits in
the hole and can push the wafer housing back.
How it Works
When the lock is turned and the tool pushes in, the wafers are pushed off of the pin ledges
The new key goes in setting new pin depths Turning the lock back snaps the wafers back,
and the teeth engage at the new depths.
Supplies
KW1 Blank Sewing Needle Anti-Theft tag Alligator Clip Super Glue JB Kwik/JB Weld
Tools
Dremel Cutting wheel Shaping tip Vice Scissors (for shim)
Decoder Prototype
Decoder Operation
The pennant on the needle acts as a feeler By shifting the angle of the needle, the pennant
can easily move past the housing Once free, the pennant will touch against any
free saw teeth By counting the teeth, the key depth is
discovered
Concept of Operation
Extended Operation
Note the anti-drill bearing in the cylinder
Highlighted
Decoder Chart
Ridges Depth0 61 52 43 34 25 1
Cost Summary
KW1 Blank = 1.50 Sewing Needles = 1.50 Aluminum Shims = free Superglue/Epoxy = free if you have it, if not $2
at a dollar store Total cost = 5.00
What that $5 buys
This works on all of the smartseries locks
Each one has the same cylinder design
Subdermal fingerprint readers and numbered keypads make no difference if you can decode the manual override.
Thanks
(Demos available)
bloomingtonfools.org