Tweet
So during our Black Hat training this summer, one of my students passed me a lock that he'd purchased at a local retailer not long before. It was a Master Lock combination dial piece (the ubiquitous "gym locker" type lock) which we would normally just shim open.
This lock, however, featured a note on the package stating that it came with "anti-shim" features. I'd heard of this, and was curious to see how it functioned. We looked at the mechanism and were able to instantly tell two things...
1. This lock did indeed have features designed to make it resistant to shimming attacks
2. This lock could still be vulnerable to a skilled shimming attack
2. This lock could still be vulnerable to a skilled shimming attack
We gave it a shot and got it open on the first attempt. Now, some of that i chalk up to luck... but it is possible. In the video that i just uploaded (see URL above) you can get a better look at the mechanism and see how Master Lock has modified the padlock's internals to resist typical shimming attacks.
I say "typical" because the technique we normally suggest (insert down on the outside of the shackle, pinch, and rotate around to the inside) will not work against these locks. However, a slightly varied technique (shown in my poorly-shot video) will fare quite better.
These locks don't have super-duper market penetration yet, but if you come across one and are interested i encourage you to pick it up and give it a shot. Heck, for $5 you're not really gambling much... and you might just impress yourself!
So... what have we learned? These locks are still well-suited to keeping non-valuables "safe" if you are interested in storing a pair of stinky sneakers or drab workout clothes somewhere and you don't want young hooligans throwing them in the pool or some such. For anything of greater worth (wallet, phone, keys, gun, etc) i would go with something that is totally shim-proof (like a double-ball mechanism found in modern ASSA/Abloy products or even just "Pro Series" locks by companies like Master and Schlage.
Of course, there's also the new "Speed Dial"* padlock which i have shown off in the Lockpick Villages here and there because i think it's pretty decent. As i and others have shown, this is a lock that is totally resistant to shimming, but still comes in a simple, affordable package and doesn't rely on a physical token to operate. Not bad for $9.99.
If i ever were to go to a gym, maybe that's what i'd be using. Ah, who are we kidding... i don't think i'll be hitting the gym anytime soon.
Stay safe out there.
* ugh, sorry for that awful marketing drivel video... it was simply the best one i could find that showcases the way the lock works.
Comment