Bump Key Attack on Schlage Primus

Many people, myself included, did not think this could be possible... a bump key attack against a Schlage Primus lock. Protected by a sidebar that interacts with finger pins which lift and turn... this lock seemed almost impregnable. But one of the individuals in our local TOOOL chapter came up with a bump method.

After explaining it and demonstrating it to us, we all dove right in... and without fail we were able to bump the Schlage Primus open, as well!

See for yourself... and learn how to protect your locks from this sort of attack.

http://toool.us
http://toool.nl
http://deviating.net

Category:

Science & Technology

Tags:

• TOOOL
• lockpicking
• bump key
• key bumping
• schlage
• primus
• Deviant Ollam

[jsmonk]

But if you have a bump key with the proper sidebar groove, don't you essentially have the proper key to begin with? I mean, how would you know what the sidebar groove should be without obtaining the key? And if you have the key, why do you need to bump the lock?

[DeviantOllam]

@jsmonk Well, on all Primus keys there is (1) the primary bitting along the blade and (2) the sidebar code cut into the flat surface. On lower levels of Primus the sidebar is the same nation-wide, on mid levels the sidebar can be region-specific. And even on a restricted system, if you work in -say- the same building... your key will almost always have the sidebar for that building's system. So obtaining the sidebar code isn't all that difficult.

Bumping then attacks the primary pins.

[jsmonk]

@DeviantOllam Thanks for clarifying that. I thought the sidebar would be different for each lock; I didn't know it served a generic purpose like that.

[DeviantOllam]

@jsmonk Well, the higher level Primus locks are indeed unique. Locksmiths who want to vend at that level have to buy-in with Schlage for a specific quantity and volume of business, etc... so many smaller shops have to deal only in the lower levels.

[DeviantOllam]

@jsmonk So, yes, the sidebar code is often thought of as the "more difficult" portion of the Primus to manipulate, duplicate, etc. Thus having that code (or blanks cut to the proper code) can allow for lots of attacks... bumping, picking, impressioning, master key decoding.

Bumping is just the fastest and the one involving the least use of skill and finesse when you're standing right there at the door.

[zhixea]

So if I get this right... the process is to have a key with the proper side bar coding, and then just file that down into a bump key and it will work with minimal tension? Do you still pull the key out just one notch and then bump it back in? Also, is the tension applied counter or clockwise?

[DeviantOllam]

@zhixea yes, that is the idea. we do use the "pull" method for the attack. you can tension and turn the lock in either direction, and that matters since it depends on whether you're trying to open a left-handed or right-handed door. it depends which way you need to turn.

[zhixea]

@DeviantOllam I like understanding how the lock works on the inside. Does the addition of this second set of side pins affect the tension that we have to apply? In other words, are these sidebar pins the reason why you can't just put the key in the lock, pull it back a knotch, apply some torque, and bump it?

[DeviantOllam]

@Mw2M4oA3 wow. somehow you totally failed to understand what we were saying, or the video was unclear. no, you can't "buy" one of these keys because you need a key cut to the proper sidebar code, which varies in nearly all situations. any, in any case, TOOOL does not sell bump keys to the public... nor do we really think it's great for others to do the same. it's rather like posting pre-compiled exploit binaries to BugTraq as opposed to proof of concept code. ;-)

[Mw2M4oA3]

can i buy one of these bump keys from you? seriously.