How to open mechanical (high-security) locks with the "bump key" method

[nummi]

http://deviating.net/lockpicking/images/06.05-bump_keying_slow.gif


There are funny posts on how to open/blast locks with picks/AP on the forum, but I couldn't find any mention of a very smart method that's well-known in some European countries but practically unknown on other continents. It's called "bump key" method (aka "power key" method). I saw a demonstration of this method on TV last year, a few weeks later you could buy the first "bump key" sets via the internet :D


pros: works quiet, fast, without effort, no skills required... even opens lots of high-security locks (e.g. 15-pin locks with 5 pins at 3 sides or dimple locks)

cons: requires an appropriate bump key


A bump key (http://www.mb7.net/rap.jpg) is a key in which all the cuts are at maximum depth (position 9), that's why any used key or a key blank for a given lock can be converted into a bump key (e.g. with a file or a dremel).

Or you can buy bump keys via the internet: http://www.multipick-service.com/en/tools/36100_en.htm


With a right bump key set that covers all locks used in your area (e.g. LIPS, LITTO, NEMEF etc. for the Netherlands or ABUS, BKS, DOM, ZEISS-IKON for Germany) you can open more than 90% of the doors in your area... without any traces... within just a few seconds. Cool, eh? :D



All you have to do is... take an appropriate bump key, insert the key and using the handle of a screwdriver gently tap the back of the bump key. This forces the upper pins to jump above the shear line allowing you to turn the bump key and open or close the lock/door.


Here's a slide-show that explains the "bumping" method very well: http://deviating.net/lockpicking/06.01-bump_keying.html


And here you can download two very interesting files about "bump keys". If you are interested in opening locks the download is a MUST!

http://www.toool.nl/bumping.pdf 0.5 MB PDF
"... how to open MUL-T-Lock (pin-in-pin, interactive, 7x7), Assa (600 Twin), DOM (ix, dimple with ball), LIPS (dimple), Evva TSC, ISEO (dimple & standard) and other expensive mechanical locks..."

http://www.toool.nl/bumpkey-alert.wmv 60 MB, 7 minutes TV video including English subtitles

----------------

Besides the bump key stuff here are two funny videos from the same site:

http://www.toool.nl/kensington623.wmv 7.6 MB, video on how to open a Kensington laptop lock with a toilet roll

http://www.toool.nl/competitie.wmv 19 MB, raking a lock in 0.5 seconds and picking a Medeco Biaxial in 2 minutes.

-----------------

Since I'm a newbie, I cannot see my post in a formatted form until it's been released by an admin.
If a posted link doesn't work well... shit happens :)

[nummi]

http://deviating.net/lockpicking/images/06.05-bump_keying_slow.gif


There are funny posts on how to open/blast locks with picks/AP on the forum, but I couldn't find any mention of a very smart method that's well-known in some European countries but practically unknown on other continents. It's called "bump key" method (aka "power key" method). I saw a demonstration of this method on TV last year, a few weeks later you could buy the first "bump key" sets via the internet :D


pros: works quiet, fast, without effort, no skills required... even opens lots of high-security locks (e.g. 15-pin locks with 5 pins at 3 sides or dimple locks)

cons: requires an appropriate bump key


A bump key (http://www.mb7.net/rap.jpg) is a key in which all the cuts are at maximum depth (position 9), that's why any used key or a key blank for a given lock can be converted into a bump key (e.g. with a file or a dremel).

Or you can buy bump keys via the internet: http://www.multipick-service.com/en/tools/36100_en.htm


With a right bump key set that covers all locks used in your area (e.g. LIPS, LITTO, NEMEF etc. for the Netherlands or ABUS, BKS, DOM, ZEISS-IKON for Germany) you can open more than 90% of the doors in your area... without any traces... within just a few seconds. Cool, eh? :D



All you have to do is... take an appropriate bump key, insert the key and using the handle of a screwdriver gently tap the back of the bump key. This forces the upper pins to jump above the shear line allowing you to turn the bump key and open or close the lock/door.


Here's a slide-show that explains the "bumping" method very well: http://deviating.net/lockpicking/06.01-bump_keying.html


And here you can download two very interesting files about "bump keys". If you are interested in opening locks the download is a MUST!

http://www.toool.nl/bumping.pdf 0.5 MB PDF
"... how to open MUL-T-Lock (pin-in-pin, interactive, 7x7), Assa (600 Twin), DOM (ix, dimple with ball), LIPS (dimple), Evva TSC, ISEO (dimple & standard) and other expensive mechanical locks..."

http://www.toool.nl/bumpkey-alert.wmv 60 MB, 7 minutes TV video including English subtitles

----------------

Besides the bump key stuff here are two funny videos from the same site:

http://www.toool.nl/kensington623.wmv 7.6 MB, video on how to open a Kensington laptop lock with a toilet roll

http://www.toool.nl/competitie.wmv 19 MB, raking a lock in 0.5 seconds and picking a Medeco Biaxial in 2 minutes.

-----------------

Since I'm a newbie, I cannot see my post in a formatted form until it's been released by an admin.
If a posted link doesn't work well... shit happens :)

[nummi]

The link to the slide show has been changed. It's now:

http://deviating.net/lockpicking/08.01-bump_keying.html

[nummi]

The link to the slide show has been changed. It's now:

http://deviating.net/lockpicking/08.01-bump_keying.html

[kld1648temp]

I think I uploaded (I scanned, at any rate) "How to Open Locks W/ Improvised Tools" by Hans Conkel.

It covers bumpkeys, along with MANY alternate, non-destructive methods to bypass locks. There are about three pages on bumpkeys, in particular.

If it isn't on the FTP, let me know and I'll post it somewhere for someone else to upload (the place I steal wireless internet has port 990 blocked, or I'd check myself).

[kld1648temp]

I think I uploaded (I scanned, at any rate) "How to Open Locks W/ Improvised Tools" by Hans Conkel.

It covers bumpkeys, along with MANY alternate, non-destructive methods to bypass locks. There are about three pages on bumpkeys, in particular.

If it isn't on the FTP, let me know and I'll post it somewhere for someone else to upload (the place I steal wireless internet has port 990 blocked, or I'd check myself).

[nbk2000]

From Locks, Safes, and Security 2nd ed., Vol. 1, pg 503

1.5.2.6 Marks from 999 Rapping
Rapping of a lock using a "999" style key is common in some countries, notably Denmark. The procedure involves the insertion of a specially cut key described in more detail in Chapter 29, followed by the application of rapping or repeated shocks to the end of the key using a mallet, plastic screwdriver, or similar instrument. The rapping motion is transmitted to all tumblers (at a 45°-90° angle to the bottom pins) simultaneously. In theory, much like the pick gun, the forward motion of the key will momentarily cause the driver tumblers to be bumped upward above shear line. With the proper timing, a lock can be successfully rapped open in a couple of attempts.

The design of a 999 key would preclude its normal use. It would rarely if ever be encountered except in suspicious circumstances. Possession of such a key would warrant further inquiry. A 999 key will have all cuts at maximum depth and will often contain long ramps between cuts. These ramps will serve to catch each lower pin as rapping is applied.

The procedure will leave evidence in two areas: on the sides of all tumblers and on the plug. There will be marking where the shoulder strikes the face of the plug because the key is often hit too hard. If there is a visible indentation, the technique should be suspected. However, such could also represent a lock with heavy use. The pins should be closely examined; they will appear as if struck with a brass chisel. A radial mark will be present because the angle of the key is not the same as on the pin. Scratches on the sides and bottoms of the pins can show that a 999 rapping technique was applied, or that there was too steep a ramp angle on a key that was forced into the lock.


It's nice that there are people looking around the net for interesting things. However, newbies should always do a search before creating a new topic, as this has already been mentioned and some of the same links provided (by me), in other topics.

We also actively discourage posting animated GIFs and such, simply because they tend to be rather distracting. A link would have sufficed.

Oh well...

Anyways, it's an interesting technique and has utility when you know the target locks are vulnerable to it. If you have the blanks, or the ability to make them, then making a 999 key is doable by hand if you're patient. Don't expect a locksmith to make 'em for you. :o

Being found in possession of 999 keys is prima facia evidence of intent to commit a burglary, or possession of a burglary tool, either of which gets you jacked up, so hide them.

Next is the fact that the technique can just as easily fail as succeed. It has as much to do with the condition of the lock as with the skill of the operator. Some locks are impossible to pick or rap, no matter how many others of the same model you've opened using the same technique, simply because of the variances created by manufacturing tolerances and user ab/use.

And, yes, it does take skill and practice, same as anything in life. It may not require as much skill as picking the lock, but it still takes practice to know when to apply the turning torque, otherwise you bind up the pins in the cylinder and the lock stays locked.

According to RTPB "Plan for Failure", you'd be best served by bringing along another means of bypass if the 999 rap doesn't work.

There are people selling modified locks that will 'Fail Secure' when attacked by a picking or rapping attempt. There's a link on the Toool.nl site.

As an experiment after reading about that, on one of my test locks, I modified it so that it would lock the plug in place if it was picked open in the wrong direction (common mistake/deliberate technique), while remaining locked, requiring it to be opened from the inside, removed from the door, and replaced, as the spring-loaded pin, once fired, permanently locks the plug in place.

One should always modify locks securing their possessions in such a way as to foil sneak thieves and, more importantly, sneaky pigs.

The principle behind RTPB 51:

"Police operate by knowing the pattern of criminal behavior. If you don't fit the pattern, you are that much harder to catch."

works in the reverse:

"Criminals operate by knowing the pattern of victim behavior. If you don't fit the pattern, you are that much harder to rob."

Locks that lock shut, and make further manipulation impossible, are not what lock pickers are expecting, hence they'll be stymied/flummoxed/pole-axed by it. :p This was used in the old days in such estimable locks as the Bramah Detector Lever Lock, but the concept has faded into obscurity.

At the very least it now requires them to either overtly break-in, making it obvious, or retreat in defeat, while your tamper-evident lock lets you know about the attempt. :D

Locks that use sidebars, such as Medeco, are immune to rapping, since the pins must not only be lifted to the shear line, but also rotated to the proper position before the lock will open, a condition that will not occur from rapping.

[PYRO500]

As a locksmith in the usa, I have to say that I have never ever needed bump keys, as for making them.... you have to figure out what lock you are going to use them on, and find out the depths for that lock.... for example on a standard kwikset lock there are 7 standard depths, tell a locksmith you have to get a key that has the key depts cut at 7,7,7,7,7 and they will look at you funny, and ask if your key is flat with little peaks, tell them yes, and they can easily punch one out with a machine most decent shops have. If you want to avoid most suspicion, you can order a "depth and spacing" key set, they contain a set of keys for a particular lock that have cuts of all depths, for example you'd get a key with the cuts 11111 and 22222 and so on, you could use the last one in the series as a bump key.

As far as house locks work, dont bother look for a place that has kwikset key in knob locksets, if they have a deadbolt, 90% of the time they arent used when the people leave the house, take a metal bar and weld a self taping screw to the middle making a T handle, twist the sucker into the lock and pull out the rim cylinder

[Meawoppl]

I have worked extensively w/ bump keys (b/c we had some break in problems associated with one) and there is a number of rather elegant methods by which bump keys can be easily defeated.

First, you can add a third tumbler to your row of two. This will cause the top one to be thrown instead of the one crossing the shear line. If you put one or two of the smallest length pins in your already small pin line, this is very effective.

Second, add a top pin of different compsure. Because I am a wee bit paranoid (and have access to a nice machine shop), I have a lead pin and a magnesium pin in my 8 tumbler lock. This causes the shear line to be clear at different interavals of time, because they all get the same keinetic energy imparted and thusly complete their travel at different rates.

Third, toughen one or two springs. Replace a couple of the the springs in the lock w/ heavier ones. Streach your springs out a bit to make them push harder at their natural position. Put one on top of another!

I have also heard some things about "fragile pins" pins that are designed to break when axial force is applied. This causes the lock to bind if tampered with.

Just some wisdom for all you paranoid folks out there.

[nbk2000]

Finally! A n00bie with something intelligent to add! :D

[nbk2000]

One of the countermeasures to bumpkeying is to 'short drill' one of the pinholes, so that the bottom of the pin doesn't reach all the way down into the keyway like the rest of the pins do.

So, in a normal lock, the pins might all be:

*****
*****
*****

But, in a short pinned lock, the pins would be like:

*****
*****
***_*

*=pin lengths

So, in the above example, pin 4 (1>5, L>R) would be the short pin.

When you try bumping such a lock, only 4 out of 5 pins is being hit, so the short pin keeps the lock locked. :p

Assuming one of the pins only went to the 7 depth, instead of the normal 9, but at random between the 1>5 pinholes, you'd need bumpkeys of the following profile in order to successfully continue using it.

79999
97999
99799
99979
99997

Then throw in pins of tungsten and titanium (very heavy and very light), and now the problem for a would-be bumper becomes exceedingly complicated. :p

But then you've got air-bumping...

[nbk2000]

An interesting russian site that shows many different locks being bumped or bypassed, with video. :)


http://www.locks.su/bump/index.shtm

[InfernoMDM]

I have a question. Has anyone created a bumpkey template? Something maybe printable that you could take blank keys and use this stencil of sorts to fashion your own key. I am not sure if that is even possible, but I would love to create a bumpkey myself without the difficulty of detailed manuals about depths etc. My knowledge of bumpkeys are very limited so please forgive me if this is a dumb question. I tried to look it up but I couldn't find the information, or my search-fu is weak.

[PYRO500]

(damnit lost a huge post)

Simply take a lock apart, and use a kw 10 instead of the normal KW1 (for kwitset, sc4 for schlage as opposed to sc1) keyblank in the 5 pin lock.

Take the pins out of the lock, push the longer key in all the way, and put the longest pin back in one of the holes, tap it with a hammer, and do the same for the rest. This gives you the spacing between the pins that you need to file down directly down on. Once you have filed down the first 5 pin locations to the maximum depth (usually to the start of the grove in the key, taking down all of the "blade") you can pull it out one spot, put 2 pins, and mark the 6th spot. This way you dont have to pull out the key a little bit, you just put the key in one depth short and slam it home.

The use of bump keys is limited and can be limited by many things including pins that are very deep as they can spring up into the sheer line (drivers dont matter if the pin is too high) and keep the cylinder from turning.

As far as NBK's idea goes, I dont see how you would keep the pin from dropping all the way to the wards in the lock unless you had an undersized hole drilled in the back of the lock with a pin lathed in a dremil drill to where it would be T shaped with a long fat head to keep it from going all the way into a countersunk hole. Still, the best way to prevent bumping IMO is to use a key with angled cuts such as a medeco bi axial lock with sidebar. (pick one of those and your a champ).

Also there is a lock brand called schlage primus that has pins aligned along the side of the lock that have to be moved in addition to those that normally move up and down. I haven't even tried to pick one of those but I hear they are very difficult and with a sidebar next to impossible to bump with side "bumps" in the track running down the side.

[nbk2000]

The Primus, and similiar side-bar locks where the side bar pins are activated by a parallel key track, are still bumpable, as most sidebars are regionally common, with only the conventional keyway providing individualization.

This is done as a means of allowing replication by locksmiths without requiring a huge stock of unique sidebar key blanks.

So if you can identify the sidebar used by the target lock, you can likely obtain a similiar sidebar key from any locksmith in town, and cut it down into a useable bump key. :)

[Eoin]

As I posted elsewhere ,I've been in India for the past 9 weeks and from one end of the country to the other I noticed that almost universal use was made of the Godrej brand of 7lever padlocks. These are turning key locks of what appears to be a very old design.
India being a country that is not free of thieves, far from it! !, so why the popularity of what appears to be a simple padlock?

I might add that these locks along with a hefty hasp and staple are used on the doors of flats in apartment buildings as well as Government offices etc.

Are they hard to pick?

[PYRO500]

Usually when locksmiths do a job involving HS locks they order a set of them to the system. Those primus keys are just a regular schlage key blank with a track cut into the side. They can be duplicated on a regular schlage blank but you need a special expensive side mill key cutter, thus most locksmiths don't cut the keys, but rather order them by code, and key the cylinders accordingly. One of the advantages of that is that you can have a master key system with the top pins, and use a master key system you devised (difficult to work out a new system with many possible key changes planned) with a different side cut, thereby making another local person's key with the same top bitting not work due to the side bitting. But in short the side bitting is unique to each cylinder. The keyway is a difrent matter entirely.

Not all of those high security schlages use the common key blank we are all used to, you can have: a key with normal bitting (couple hundred to thousand combinations) to unique side bitting (probably a few hundred combinations) and if you want to pay extra to go the next mile you get a secure keyway.

However, if you had a master key system in the area, and you had one key of a lower authority it might be possible to make a bump key that had the same track as the rest of them. but you might bump the sidebar pins higher than they are supposed to go normally.

http://protections-vol.com/schlage-details.jpg

thats a picture to show how the thing goes together, but if someone can get one to bump I'd like to hear about it.

Edit: I just checked the precut keys we have for primus rekey jobs and the side bitting is different on each one :(

[PYRO500]

I didn't see the above post by Eoin. Lever locks can be anywhere from very easy, to deceptively difficult to pick. Look up chubb detector locks. On some of them, if any lever is moved too far in the wrong direction, it locks in position and can't be moved again without inserting the correct key and moving all the levers into position at the same time. Those are the same kind of locks still used on most safety deposit boxes.

If you are lucky, your lock will have some sort of weakness allowing it to be bypassed such as a heel toe locking mechanism (compared to ball bearing) witch lets you shim the lock open. Otherwise you need to have a completely different set of picks to even attempt to pick lever locks, assuming they aren't of the well built high security models.

*(note, there is a bypass tool for 7 lever safety deposit box locks, your indian locks might just be clones of them, or they could be totally different. I cant tell without seeing it)

[nbk2000]

Last night I made the accidental discovery that the key for an ABUS Buffo padlock will fit in a Kwikset deadbolt keyway, and move the pins. That's what you discover when trying to open locks in the dark. :p

Hmmm...a 999 Kwikset key would be obvious to a pig, but would a 222 ABUS key be? ;)

Any key that would fit in the keyway, and have enough of a cut on it to provide the needed lifting impact to the pins, would work as a bump key, without needing to carry around recognizable burglar tools.

[PYRO500]

I don't stock abus buffo, but from a web search brought up several links to pictures of disc style padlocks http://www.keymateinc.com/abusBuffo.jpg
if that is the one you are referring to, then it appears to be a Y6 (yale 6) keyway, which is designed to be somewhat difficult to pick, they are usually hard to impression and the way the blade of the key curves a bit at the top (paracentric) makes them difficult to cut with some old style key punches. I don't know if thats the exact keyway you had, I've never tried to fit a Y6 into a kw1 keyway but I can say for starters that with soft brass keyblanks and a hammer, you can force many keys into the wrong keyhole (such is the bane of my job...) I'll see if one fits a standard kwikset next time I visit the shop and see if they are even long enough to make a kw1 bump key with.