Back in August of last year, we covered the leak of the keys used by the US TSA to control luggage. Hackers created seven clones from high-resolution photos, and the only key they were missing was reproduced without any major issues. The latest news presents the project of Dave Pedu, who decided to attack the five-pin Kwikset standard, using parametric copies in OpenSCAD as a base.
Why High-Resolution Photos Are a Security Risk
High-resolution images are excellent, but in very specific cases they represent a security risk. Some objects can be reproduced without too much trouble, and the best example currently circulating on the Web is the traditional key. All the attacker needs is a photo of the key to copy, robust software, and a 3D printer with sufficient precision. The worst part is that most people ignore the potential for leakage. The HD photos of the TSA keys were taken during an interview for the Washington Post, and the agency's official response left much to be desired. The reproduction methods do not stop advancing, and thus we arrive at Dave Pedu's project.
Dave Pedu's Parametric Key Project
Pedu's work focuses on the standard of the American manufacturer Kwikset, which has been on the market for more than 70 years. Previous versions of Kwikset use a total of five pins, with seven different cut values on the key (value 1 has almost no cut, while 7 is the deepest). Instead of reproducing the keys directly with his 3D printer, Pedu created a parametric model of a "blank" Kwikset key within OpenSCAD. By entering the pin values, the generator creates the key model and the printing file.
From what I have been able to find out, the new variants of Kwikset adopt a six-pin pattern, and Pedu admits that his test lock is "old and loose", therefore it is probable that a lock in optimal conditions would break the ABS plastic copy. However, as a proof of concept it is compelling. I imagine that it shouldn't take long for other standards to fall in the same way, and "molds" of metal keys could be created.
