As a Firefighter, I can not put into words how absolutely valuable your videos are for myself. My whole crew watches your videos sometimes when we are doing forcible entry training. We come across such a broad variety of barriers/locks to overcome.. Having you show how to defeat various mechanisms is incredible. THANK YOU!
As someone who installs these on federally secured buildings on at least a weekly basis, as well as repairing/replacing, this knowledge would have saved me dozens of hours on an angle grinder cutting old locks that had failed off.
I'm looking at the screen then looking to my right side at my office door, yep same lock and it's the old version. My office use to be a research lab, humm guess I'm bringing my neodymium magnet to work tomorrow. Ok, year later and an update, they put a card key at the main entrance to the area where we had many of these locks about 9 months ago. Since then I started picking as a hobby and hooked up with the company locksmiths and found boxes and boxes of these old ones ready for disposal. On a happy note they gave me a bunch of Schlage cores of differing difficulty along with a follower and a few blank keys so I could try out making my own. We still have a few around but they are for non critical areas so it's not so bad and they're replacing them all slowly but surely. And have a nice day :)
Currently I’m being chased but luckily only (insert lock here) is blocking my escape route but it can be picked with the pick Bosnian Bill and I made quite easily!
A year after this video and people where I work still freak out when I demonstrate all our "secure facilities" are a magnet away from being "publicly accessible facilities". The old version of these locks are everywhere.
That probably includes the hospital I work at - around 50% of the internal doors (and two external doors) use a very similar lock, though ours have velociraptor-friendly handles rather than knobs. Between these locks and the fact that every padlocked door is a Master Lock, I'm probably the only one on staff who knows just how insecure our facility really is.
With the easy availability of a Mag Switch today even easier to defeat. At the University where I worked (before retiring) we had one that was definitely NOT modified, ever.
They had these on the Sheriff's office/jail here and on some communications vaults, too. We carried magnets in our toolbags since combos would be changed (especially on equipment rooms that doubled as storage) and we are not always notified.
Post Office I worked in 2008 had all the locks replaced with these. I showed the post master just how easy it is to open these locks. Postal inspectors came and looked at them and nothing was done. The US postal service bought and had installed thousands of these locks. (They were/are not inexpensive)To my knowledge, none were changed that I know of. A friend who is a car dealer had this K 1000 on his key room door. I showed him how easy it was to open and he had a local locksmith change it out for a Kaba 5000. I understand lots of legal issues with this lock.
That just shows the difference between government vs private businesses. Business owner alerted to a problem and just fixes it if possible. Government alerted to a problem and it needs a dozen forms in triplicate to get an inspector out to verify that yes its a problem and send the forms off to a comity somewhere to ignore the problem for the next decade or untill the problem bites them in the ass.
@@merendell It also holds true with massive corporations as well though, big businesses don't give power to the people who can make change and the people who can don't give a shit.
@@merendell It's not that they don't understand the problem. What's it gonna cost if they don't replace the locks? For most places, nothing. The security of a government building does not come from locks. The businesses however have to worry about theft more than government.
Our post office had a P.O. Box door pried partway out from the frame. Postal Inspector was called, looked at it, and figured it since it was still locked, and only partway open, no actual theft had occurred so no further investigation was called for. Easy!-except that it was obvious you could simply push a screwdriver into the opening and retract the latch. Customer of that box later reported several checks missing. One lazy goof, or are all PO Inspectors of that ilk? I dunno.
My old office had one of these on a back door. Knowing that they typically use a 4 digit combination and that the digits can't repeat makes brute forcing the combination easy. I was able to brute force it in about 3 minutes one day.
@@aitismarka9483 not really, it takes probably 2 seconds or so to put in a code and turn the handle. three minutes is 180 seconds which means he could easily have put in 90 combinations in that time. Actually means he was unlucky lol, most of the time you would get it at or before 60 combinations, or about 2 minutes.
@@itisinfactpaul2868 It is really difficult to come up with that many permutations without repeating ones you've already tried. You can test it yourself. Try to come up with as many non-repeated four digit codes out of the numbers 1, 2, 3, 4 and 5 as you can. Absolutely no way anyone's going to be able to come input 90 of those in 3 minutes. Without pen and paper that would be almost impossible to do even with unlimited time.
@@aitismarka9483 All you need to do is count up from 1234 lol. Just skip any number greater than 5 or that's already in the code. I certainly hope you could do that quickly in your head lmao. Once you get to 4321, you've listed every code. Like this: 1234 1235 1243 1245 1253 1254 1324 1325 It would be even faster to do in front of the lock since there are only two final digits possible for any set of three initial digits and you could easily see which ones hadn't been pressed.
@@itisinfactpaul2868 Oh shit, I hadn't thought about such a clean way to do it systematically. Just a little correction: you gotta do it up to 5432 and then you've inserted all 120 permutations. Thanks, mate. Gotta admit I was wrong.
I have seen this lock (and the 12 button version) used on a lot of homes too, especially homes with younger children prone to losing keys. First responders in some areas in and around New York City used to use this trick when responding to a location with one of these locks so that they wouldn't have to break the door or wait for a locksmith.
haha okay Mr hobby locksmith, go get one and you'll see what's up. It's not like I know what I'm talking about or anything.. I only do this for a living 🤷♂️
@@crestonriley6481 Literally missing the point of the post. First responders would use the trick shown by LPL, On this specific lock, and a variant of it. Not any other brand. Not any other model. Your comment adds nothing to the original statement.
I don’t know why but I love watching these videos. It would be hilarious if there was some kind of Expo or a Lock Sales Convention that you could go to and ruin each exhibitor products by unlocking their locks and showing them all their design flaws.
Alternatively you could also shield it by installing a (“U” shaped) ferrous shield cover around the mechanism, but remanufacturing the part to be nonferrous is the simplest and most economical solution.
In the 60's when designed the magnet needed did hang on the shelf at or hardware store or in a massive online catalogue for next day shipping. Also master has done much worst blunders than this.
@@GilesWendes In order for a magnet to scramble a magnetic strip, it's pretty much going to have to come in direct contact with it. As a matter of fact, the magnetic field emitted by a cell phone can actually demagnetize a credit card if it's allowed to be in direct contact with the magnetic strip for a long enough period of time.
My first job was in maintenance at a facility with similar push-button locks (10-key though) on each of two doors into a secure area. I was just a summer temp, so I wasn't given the codes to either door, but I was escorted with a senior member of maintenance in several times. One day he was already inside, sent me out, and I was supposed to come back with something but of course the door was locked. I glanced at it and realized there were 3 numbers entered every time and there were different levels of wear on the buttons. I pushed the 3 most worn from most worn to least worn and it opened. I don't know how long it had been there, but obviously it was overdue for changing the combination.
This reminds me of a situation which happened when I was young. We lived in an apartment complex with an electronic combination lock and I had taken apart a push-button lighter and was playing with the little piezo electric ignitor (the thing which you press and it makes a small zap). Out of curiosity I put the wires from it up to the lock, which was completely metal. To my surprise, when I zapped the lock it opened. It worked every time, and this was the standard combination lock in my entire city. I did not try it on other houses so it might have just been a flaw in this particular lock, but I'm wondering if anyone else has had a similar experience with electronic combination locks.
We had those on our classified shop doors in the air Force. Absolute trash. We had to turn the knob twice to get it to clear the valid code. They also break all the time
I was at work one Saturday when the plant locksmith decided it was a good time to change the combinations on all the basement labs without notice, which would force the users to go to the locksmith first thing Monday morning to register for the combo. I called his office and left a message that I had something in the oven that was time sensitive, and to get down the basement ASAP. He left for the day. A pipe wrench makes these locks absolutely worthless. I got in the lab and removed my part from the oven with minutes to spare. Never heard a word on the damaged lock.
@@B0MYT+ It was a Blue M process oven, and I was vacuum curing an out of autoclave graphite epoxy part. We routinely would set a part up to run, being recorded by a DigiStrip recorder. When we worked weekends, you had three or four irons in the fire at a time. I'd be working in the machine shop machining test specimens, then in the QC lab for a 24 hour non-volatile test sample, and in between eating lunch. My Blue M oven was only turned off when the power went out, otherwise it ran 27/7/365.
So, in other words, your extremely high duty pizza oven - www.thermalproductsolutions.com/brands/blue-m-industrial-ovens-lab-ovens-steady-state-test-chambers-and-lab-furnaces
Fun fact, these things are used at almost every apartment complex around here, and as a delivery person I was trained to carry a magnet around specifically to bypass these locks.
“Sir! We have a number of reports about the Double Decker Toilet Wrecker” “How does he keep getting in here and what does he eat to take massive dumps?!”
We have these at work on the bathroom doors to keep nasty contractors from wrecking our already dirty bathrooms. After a while the contractors seem to know the combo so we keep changing the combos then it takes a few weeks to remember the new numbers. Sometimes I have to crap really bad when i find the numbers were changed. Its a LOOOOONG walk to begin with and then have to walk to a different bathroom. I will hide a magnet close by from now on
@@InvadersDie well the Aliens spoke about 1.7 million languages from all over the Galaxy including Spanish. They actually invented all 6,000 languages on Earth.
@@MindzEnt forgive me if I am wrong but this must have been some time ago, are they not just called mexicans when confined in their respective geographical area?
After working with thoes locks for several years I feel fairly confident to point out 2 important things. 1 is i have never seen or put the bypass leaf on any combination unit intended for a lockset that didn't have the bypass switch for the secure side of door, I think it was even a different part numbers for a combination chamber with and without the bypass leaf......2 I also believe that if the bypass switch is installed, the cam that activates the leaf would also keep it from being manipulated that way. That being said, I had never tried that bypass technique on any of the units we had lying around but I always thought it was trying to pull on the comb inside the combination chamber itself. Anyway love what you do, keep it up
Oh man, we had this lock on the outer door of our SCIF in Iraq when I was there in 2010. Crazy vulnerability! We had another electronic keypad further in, but you could have gotten access to all our servers and equipment in the back with this.
I find that bizarre. Even in 07 in Afghan we(RAAF) were specifically forbidden from using this lock type on anything requiring even a modicum of security.
Now hang on. If it's a SCIF, then this dinky button lock is just used for access control when the room is occupied and there should be a high-security combo lock engaged when nobody's in there. Was that not the case?
changing that requires a key to extract a cylinder, then a tool to move a change-collar, then a careful sequence of action, then putting it all back. If you get the key sequence wrong, you have to take apart that long rectangular piece and reset it. Been there. So most folks don't bother.
I personally love using these locks. It super easy to maintain and I've come to lock the simplicity of the design. Kaba makes some good locks, but this one is always been a favorite of mine.
They used these locks inside the Pentagon, too. During Desert Shield, I was an Analyst/Terminal Operator supporting the Joint Chiefs of Staff, in the J-4 Logistics Readiness Center. This was early days, and they had just brought on some new staff. This was the first day of the new Team Chief on Duty. He was five minutes away from doing his briefing for the Chairman of the Joint Chiefs when he locked himself out of his own office, and the combination is only supposed to be known to the Team Chiefs. Needless to say, I was an eager young GS-5 civilian just a year out of college, and I could do the math on how long it would take me to brute force the locking mechanism by simply trying all possible combinations - tick, tick, tick, turn. Tick, tick, tick, turn. Tick, tick, tick, turn. Only it took me extra long, because I got to the end with no luck - that was when the Executive Officer on duty whispered to me that he thought he always saw the normal Team Chief turning the door knob the other way. So, I go at it again, and after a few tries, I’m in. I tell the XO the combo, and then I recommend to them that they change it to something else. And yes, the Team Chief did still make it to his briefing on time, with his slides.
I just commented about this, because it seems the order of the numbers doesn't matter, which means (if I've done my math right) even without the magnet exploit, there are only 29 combinations possible.
I don’t know about this particular model but most of the style of locks you can only use each of the 5 buttons one time in the combo. No repeats. This means if you have a 4 number combo the permutations possible are actually not that large. Like 120 combos. Especially if you can see wear on the buttons you can tell of a digit is not used. Then it’s like 24 combos. You can guess it fairly easily if you have a minute or two…. In the event you forgot your magnet. I’ve done it.
That's it, you win. I have no interest in locks or lick picking but for some unknown reason I keep watching your videos, and now it's finally happened, I've ordered a cheapo starter set, absolutely no idea why. I did listen carefully to your video #318 and used that information to hopefully choose a cheap kit that might actually work a little bit.
You got me a weekend off that I probably wasn’t going to get. My work had one of these until i brought a magnet and showed my boss their lock sucks. He was shocked but grateful.
Agreed. We had these on our dorms when I was in college circa 1990. The codes were normally 4 digit but sometimes involved pressing 2 buttons at once. Would like to see how that works internally
We had those on the doors to the TV studio and TV production room on the air craft carrier I was assigned to from 2004-2006 (I was a Navy Journalist). Occasionally the mechanisms would simply wear out and they would have to be replaced. I took one of the broken ones apart to see if there was an easy way to fix it. I managed to get it to work for a couple days, but then it failed again, and we had it replaced.
I grow up with that type of lock all over the place, for me, this isn't about Lock picking it's more like a blast from the past, Thank You for this video Mr. Lawyer
@ZaC kWinz - Austenitic stainless steel or brass would be my guess, as both are non-magnetic. Both are relatively cheap, though brass is less expensive and weaker. Since it doesn't look like there is any stress placed on that part, I would presume the replacement part is brass.
Kaba wouldn't acknowledge there was a problem for a long time and you had to buy the upgrade. They would not retrofit. There is info on this if you google it. The US gov't purchased tens of thousands of these.
There's an agency in my work building, that deals with sensitive information, that occupies an entire three floors that use these locks. I mean... even if you could get in on one floor you have access to all because there's an open access staircase between the three. But knowing how cheap they are, even if I were to recommend a lock upgrade it'd just fall on deaf ears. Prior to seeing these there, I'd remembered them from the laundry room in my old apartment complex when I was a kid in the early 90s. Was surprised any place would still be using them.
We had these in many of the labs and offices at school way back when. I didn't know about the magnet, but I did see that the combinations were quite limited, and any button could not be pushed twice in a row, so that there were only 80 combinations possible with the typical 3 digit combinations used there. You could go to any of these when nobody was around and simply try the possible combinations sequentially until you found the right one. I did this on one or two doors and it was quite easy - I think the longest one took about 20 tries. But I didn't really need to go into any of them, it was just the fun of finding the combo. There were other doors that had similar mechanical combination locks, but with 9-key buttons and 6 digits, but I never tried those.
There are 541 combinations if you use all five buttons. If you add the number of combinations that can be achieved by using 4 buttons or less, brings the total to 1082 combinations. This does not include the number of combinations that can be achieved by depressing two or more buttons at the same time, when included in the combination. Results from the Simplex Lock Problem
This was the same lock on my dorm room. If you have a few minutes free with it you can guess the combination easily too. They would always change the combo every semester, but they would only rearrange four of the five numbers, so if you know which is the unused number, it can cut your guess time down quite a bit, and it was always four numbers so you could start there too. There was a plant where I worked more recently where they had one of these locks on one of their storage buildings. When I needed to enter for a part but it was a half a mile back across the plant to the guys office who knew the combo, it was quicker to guess it than to go get it.
I worked with one of these locks (a newer model) at my first internship in college. It fascinated me because, as a computer engineering student, I had just taken discrete math (inc. counting, permutations, etc.) and I was curious how susceptible to brute force attack it was. This lock's combinations are one to five step sequences where each step can have one to five buttons each, but no button can be used in more than one step ever. This lock has 6475 possible combinations. That sounds like a lot, until you realize that if they found a way to allow buttons to be reused for any of five steps it would have 24,883,200,000 combinations. In my experience, this lock has no lockout for multiple attempts, and if you press a wrong button, you simply have to start over without pressing a reset button. In other words, the only thing that matters is that the last steps you entered match the steps of your combination. As a result, if you don't make use of the ability to select multiple keys in a single step (common in my experience), your combination can always be brute forced in at most 153 button presses, or, fewer button presses than trying 31 length-5 random codes, by using a superpermutation of 5 characters. If you don't make use of the ability to press multiple buttons in a single step, and the attacker knows how many steps (buttons) your combination is (say they are a coworker who can hear you enter the code, or even a delivery driver who hears you do it once), then, say your combination has n steps (1
There was one of those on a marina gate where I used to live. I found that rattling the door really hard would cause it to unlock. It was faster than using the combination and it really annoyed me that it was so easy, so that's how I went in and out from then on. One day the marina manager was walking up the ramp when I did it. He was pretty unhappy with me for being so rough with his door, then I showed him why. The entire mechanism was changed that afternoon. I'm not a picker or anything, so I have no idea if the new one was any more secure, but I do know that rattling the door wouldn't open it!
I worked at a medical coating factory in 2012-2014 that had these locks. I wonder if they were the old ones. Haven't worked there for a while and they've since moved into a new building so I'm sure the locks are new now at the very least.
*in 3 years* “Hi this is the lockpicking lawyer and we have here a full size 20x40 JP Morgan bank safe, I’ll be showing how easy it is to fool the guards and failsafe and...”
We used these locks quite a bit in the Military. In fact, there is a variation of this lock on almost every bunk locker drawer on US Navy Ships. The locker version is not vulnerable to this attack but, I use to help people all the time that would forget or not know the previous owners code. I would just stick a pick into that slot to open it because I could access the drawer from behind. I could just reset the code or remove the back plate and decode it by watching the wheels. I did not know about the magnet trick back in the 90s but I did discover really quick that in Government buildings, spaces controlled by the same departments almost always used the same code. I stood a building security watch on night and tried codes to spaces I had legitimate access to. My codes work on other doors about half the time and I only knew 3.
A client of mine had the 1st gen Simplex on a warehouse and were supplied the kit years ago to fix the vulnerability. The replacement pieces were plastic. The problem is the plastic broke recently possibly due to the door facing a western exposure and daily sunsets, along with Chicago summer and winter variations from 100F to -20F. A few years of that abuse and the mechanism totally broke and the door could no longer be opened from the outside. They replaced it with a DL2700.
We had these on medium-security doors, such as conference rooms, where I worked as DoD contractor. 7 times out of 10, someone would have written the combination in tiny print on the wall beside the doorframe. These locks were effective in keeping spies under the age of 4 out of such rooms - they weren't tall enough to read the combination. I have never seen these 1000 series locks used in high-security applications. Those doors used multiple locking mechanisms, usually badge readers with pin code keypads in conjunction with a Kaba X-10.
0:31: yeah, "they are very easy to operate" :) Also what's the entropy on the key combination? I bet it used 3 digits from 1 to 5. Plus something tells me that digits 2, 3, and 5 were used on that particular lock :)
I expected that was the vulnerability he was going to talk about. That the digits became obvious over time, AND (at least in the ones I've used) the digits could only be used once. So it was 5x4x3 if you couldn't see the wear, and 3x2x1 if you could tell the digits.
Willing to bet that was used here at the 911th Airlift Wing located at the Pittsburgh airport, prior to the installation of our current cypher locks. Seen that exact unit at every Air Force base I was stationed at prior to 2013 or so.
You also failed to mention that there is a default number combination that is 99.9% of the time never changed.... that is press 1 and 3 at the same time then 2 then 5... opens up almost all the time. I had one of these at my old office and it worked there. It also worked on the apartment complex pool down the street from my house I would go hang out at.
I'll be bringing this to the attention of the school district I work for. Thank you, sir. Many schools in our district use this style of lock and haven't been upgraded/remodeled since at least the early 2000s.
I don't know if it applies to this specific lock but I used to figure out the combo on a number of doors using this type of lock very easily. They typically only used three digits for convenience (I'm talking about private bathrooms at golf and boat clubs, not high security facilities) and since each number could only be used once the possible set of combinations was fairly small (I don't know how to do the math but in the 100's anyway). It was usually just a matter of a few minutes of trying every possible combo in order.
I think you forgot to mention how the lock was supposed to work. Like how many numbers on a combination, how would the lock unlock once the right combination is used, etc. Still nice to watch
Ye that or plastic, don't see why it couldn't be made out of fairly decent plastic, not that aluminium is expensive but I'd assume at a large scale plastic is even cheaper lol. I'd imagine someone coming up with a portable blowtorch and melt it from the outside :D
@@huldu Thing is a blowtorch would work on Aluminium too they can produce flame temperatures significantly in excess of 1000C Aluminium melts at just 660C. Granted you have the layer of air inside but the metal lock body would be a very effective heat transfer mechanism to heat up the relatively enclosed air inside, probably getting the lock body up to Orange/Yellow hot (around 1000C) would do the trick. Then again stainless steel has a much higher melting temperature and is usually nonmagnetic granted certain processing can convert some of the Iron into the magnetic phase and some alloy mixtures fail to eliminate it completely, but if a nonmagnetic alloy mixture were chosen and it was properly handled this would do the trick. Processing that can trigger conversion includes things like cold working this makes manufacture a little more expensive as you need to make the parts in a foundry not just cut and fold sheet steel but doable.
I had no idea about the magnet thing, but there's another problem with these locks. There just aren't that many combinations, and with practice you can get it purely by trial and error in just a few minutes. Especially if it's an old lock and the buttons are worn down so you can see what numbers are in use. Of course the first one to try is the factory default combination.
Thanks for showing how the rare earth magnet disabled the lock. It was much simpler than it was in my imagination. I am a happy fellow today. My first picks, tensioners, and practice locks arrived from Sparrows today. The adventure begins.
We had one of these on the walk in beer cooler at work. The inside, of course, had a never-lockable handle so you could always get out. But to get in from the outside, this is what was used.
In my military gig, a lot of these were certainly in use in our facilities. Circa 2010 most of these were changed over to electronic key card entry systems. Now I wonder if this was an unrelated tech upgrade for a credentials based security system, or about this security flaw.
The other vulnerability these have are polishable metal keys. After a few months of usage, it makes it really obvious which keys are being used. Used that to 'brute force' the correct code in about five minutes when a customer forgot their door code.
@@JC-11111 Shush! LPL hasn't figured out how RUclips's algorithm works yet, but Bill has. Videos longer than 10 minutes get promoted more by the algorithm. So don't tell LPL that or we'll end up with a 10-minute video picking Master's shittiest lock ever.
@@bdf2718 Exactly. nothing worse than a minutes worth info info stretched out for 10. LPL is spot on with time for info. its why i watch his vids. no bullshit. well, except for some of the products he reviews that is!
We used to open these type of locks easily at the VTA station next to Great America in California. Inside the light rail station was a bathroom for use of VTA drivers and if there was no train in the station it meant we could sneak a pee break.
I don't remember if it was the same exact lock but there used to be many of those around when I was a telecom tech. Even though I had a slide card to work in a major bank's data center, I was able to open those locks on other doors because the bank never bothered changing the default combination for the buttons!
Had a lock like one of these at a hospital where I used to work; policy was to change the code every month, so nobody every remembered it, so instead just told each other to tap it hard on one side while turning the handle and it would open without the code (and that was only if the porters hadn't just left it in the unlocked position on the other side to save them hassle when they had to make multiple trips). Not sure if it was a similar exploit to this, but it feels like it, probably just a less sturdy spring so hitting it was enough to move it? My conclusion from skimming through videos on this channel is that I'm going back to the good old method of a portculis, a sturdy door, a bar and someone on the other side who has to open all of it when I need in.
Locks are for the most part, a deterrent. They're only an actual defense if there's really no other practical way around them (going through Windows, breaking down the door etc.) and they have to be picked or destroyed. At that point, you want a strong pickproof lock. Something like the Bowley lock.
To be fair, there's very little you can do to stop someone who is determined enough to get to your stuff. Locks are meant to deter would be criminals who are more opportunistic than determined - most people looking to steal something aren't going to risk exposing themselves or drawing attention to their actions if they have to deal with a lock that's going to take a lot of effort/time/noise to get past; they'll pass on that one to find a "softer" target.
Because most people don't carry rare earth magnets around in their pockets? A burglar could easily break a window too. So? You just need to understand security, know that any lock can be cracked, and security measure can be overcome, and act accordingly. There is no way to live a 100% safe life.
Thanks for yet another awesome video! This is great for old simplex locks. But it’s now 2024, can you please make an updated video that addresses the newer simplex locks?
I checked twelve of them at the bank where I have my account (with the bank president along to watch) and ALL of them popped right open! He was totally surprised! He said he was calling the lock smith immediately. He said that including all the bank branches there were probably over 100 of these pieces of junk installed! (it only takes a 20 cent piece of iron bar with a piece of double sided tape to fix the lock)
I really enjoy your videos. They're really entertaining and I always learn something. For example I've learned not to use TSA pad locks on anything important.
We had one on an office I worked in. The combination was something like 2-4-3-5. One April 1st, I sent an email telling everyone the combination had been changed to 2-4-2-4-2-3-4-5-2-5-3.
Actually, the biggest security flaw on this lock is that most people leave them set to the default combination. Changing requires a process many people find tricky and intrusive, so they don't bother.
![[1177] Australian High Security: BiLock Version 2 Picked and Gutted](http://i.ytimg.com/vi/f5uk6C1iDkQ/mqdefault.jpg)
![[1177] Australian High Security: BiLock Version 2 Picked and Gutted](/img/tr.png)
![[1001] The ITL Robotic Safe Cracker! (ITL-2000)](/img/1.gif)
As a Firefighter, I can not put into words how absolutely valuable your videos are for myself. My whole crew watches your videos sometimes when we are doing forcible entry training. We come across such a broad variety of barriers/locks to overcome.. Having you show how to defeat various mechanisms is incredible. THANK YOU!
Thanks for saving lives.
Seriously, thank you for doing what you do!!
You don't just start and finish with an axe?
@@dfeuer axes don't work well against metal doors
@@jhonthewolf you just need a better axe.
As someone who installs these on federally secured buildings on at least a weekly basis, as well as repairing/replacing, this knowledge would have saved me dozens of hours on an angle grinder cutting old locks that had failed off.
Good to see qualified journeymen on government jobs............ 😂
@ADEBISI ADEBISI because he didnt know about this incredibly niche fact
@ADEBISI ADEBISI He acknowledged his ignorance of the matter. No need to insult him.
Whatever, bill the fed more $$$$ took you longer
Why were you grinding anything off just drill the core.... then remove from the back
I'm looking at the screen then looking to my right side at my office door, yep same lock and it's the old version. My office use to be a research lab, humm guess I'm bringing my neodymium magnet to work tomorrow. Ok, year later and an update, they put a card key at the main entrance to the area where we had many of these locks about 9 months ago. Since then I started picking as a hobby and hooked up with the company locksmiths and found boxes and boxes of these old ones ready for disposal. On a happy note they gave me a bunch of Schlage cores of differing difficulty along with a follower and a few blank keys so I could try out making my own. We still have a few around but they are for non critical areas so it's not so bad and they're replacing them all slowly but surely. And have a nice day :)
William Borgeson is that the only magnet that will work?
@@lagspresso well, it's gotta be strong and neodymium is hella powerful. Could open up an old hard drive and use those
Yeah, let us know what happened.
please update us op
Olaf Miklas The HD from older computer had bigger, 4X, magnet. The newer one may be not strong enough.
All his videos are just 'full'. They never have unnecessary footage, and go straight to the point. I love it.
It's not a design flaw, it's a suprise opening mechanic.
Didn't expect to see this here. Love it.
"Wait 20 minutes to open door or pay $2.99 to enter now"
Master lock is EA of LPL Saga
Gonun You mean lootdoor?
It's quite ethical.
This is the Lock Picking Lawyer and today I'm being hunted down by the heads of every lock manufacturing company in the world :)
Problem is, they can't keep him in jail. He keeps picking the lock, plus I hear he has a great lawyer.
Rod H omg best comment
@@rodh1404 oh my god plz!!
Currently I’m being chased but luckily only (insert lock here) is blocking my escape route but it can be picked with the pick Bosnian Bill and I made quite easily!
The good companies need to pay him as an advisor.
Masterlock is already spending millions on a new plastic version of this
At least plastic would not react with a magnet....
@@hq3473 yeah it would open with a lighter😂
Funny enough, that would actually work better than this would surprisingly
You are mistaken, Sir, it's papier mache.
@@hq3473 - Certain types of stainless steel is non-magnetic; specifically austenitic stainless steel.
A year after this video and people where I work still freak out when I demonstrate all our "secure facilities" are a magnet away from being "publicly accessible facilities". The old version of these locks are everywhere.
That probably includes the hospital I work at - around 50% of the internal doors (and two external doors) use a very similar lock, though ours have velociraptor-friendly handles rather than knobs. Between these locks and the fact that every padlocked door is a Master Lock, I'm probably the only one on staff who knows just how insecure our facility really is.
With the easy availability of a Mag Switch today even easier to defeat.
At the University where I worked (before retiring) we had one that was definitely NOT modified, ever.
Thanks LPL! This inspired me to add a big neo magnet to my pick kit!
I now have a chaotic stuck-together ball of picks and tensioners. :-/
@Cheryl: Wow, that worked well! And thanks for the warning. I hid behind the wife and kids.
The funerals are next Tuesday.
Just get a non magnetic magnet, that should solve all your problems.
Thanks Obama!
Obama care was never the answer
JamesG a
They had these on the Sheriff's office/jail here and on some communications vaults, too. We carried magnets in our toolbags since combos would be changed (especially on equipment rooms that doubled as storage) and we are not always notified.
Post Office I worked in 2008 had all the locks replaced with these. I showed the post master just how easy it is to open these locks. Postal inspectors came and looked at them and nothing was done. The US postal service bought and had installed thousands of these locks. (They were/are not inexpensive)To my knowledge, none were changed that I know of. A friend who is a car dealer had this K 1000 on his key room door. I showed him how easy it was to open and he had a local locksmith change it out for a Kaba 5000. I understand lots of legal issues with this lock.
That just shows the difference between government vs private businesses. Business owner alerted to a problem and just fixes it if possible. Government alerted to a problem and it needs a dozen forms in triplicate to get an inspector out to verify that yes its a problem and send the forms off to a comity somewhere to ignore the problem for the next decade or untill the problem bites them in the ass.
@@merendell It also holds true with massive corporations as well though, big businesses don't give power to the people who can make change and the people who can don't give a shit.
@@merendell It's not that they don't understand the problem. What's it gonna cost if they don't replace the locks? For most places, nothing. The security of a government building does not come from locks. The businesses however have to worry about theft more than government.
@@merendell Yea, private businesses never make stupid mistakes /s
Our post office had a P.O. Box door pried partway out from the frame. Postal Inspector was called, looked at it, and figured it since it was still locked, and only partway open, no actual theft had occurred so no further investigation was called for. Easy!-except that it was obvious you could simply push a screwdriver into the opening and retract the latch. Customer of that box later reported several checks missing. One lazy goof, or are all PO Inspectors of that ilk? I dunno.
My old office had one of these on a back door. Knowing that they typically use a 4 digit combination and that the digits can't repeat makes brute forcing the combination easy. I was able to brute force it in about 3 minutes one day.
The number of permutations is still 120. It definitely is not easy to brute force that manually. You got very lucky.
@@aitismarka9483 not really, it takes probably 2 seconds or so to put in a code and turn the handle. three minutes is 180 seconds which means he could easily have put in 90 combinations in that time. Actually means he was unlucky lol, most of the time you would get it at or before 60 combinations, or about 2 minutes.
@@itisinfactpaul2868 It is really difficult to come up with that many permutations without repeating ones you've already tried. You can test it yourself. Try to come up with as many non-repeated four digit codes out of the numbers 1, 2, 3, 4 and 5 as you can. Absolutely no way anyone's going to be able to come input 90 of those in 3 minutes. Without pen and paper that would be almost impossible to do even with unlimited time.
@@aitismarka9483 All you need to do is count up from 1234 lol. Just skip any number greater than 5 or that's already in the code. I certainly hope you could do that quickly in your head lmao. Once you get to 4321, you've listed every code. Like this:
1234
1235
1243
1245
1253
1254
1324
1325
It would be even faster to do in front of the lock since there are only two final digits possible for any set of three initial digits and you could easily see which ones hadn't been pressed.
@@itisinfactpaul2868 Oh shit, I hadn't thought about such a clean way to do it systematically. Just a little correction: you gotta do it up to 5432 and then you've inserted all 120 permutations. Thanks, mate. Gotta admit I was wrong.
I have seen this lock (and the 12 button version) used on a lot of homes too, especially homes with younger children prone to losing keys. First responders in some areas in and around New York City used to use this trick when responding to a location with one of these locks so that they wouldn't have to break the door or wait for a locksmith.
trick doesn't work on codelocks or similar sabat locks
C Riley He said they used the trick on one of these locks... read the comment first....
haha okay Mr hobby locksmith, go get one and you'll see what's up. It's not like I know what I'm talking about or anything.. I only do this for a living 🤷♂️
@@crestonriley6481 Literally missing the point of the post.
First responders would use the trick shown by LPL, On this specific lock, and a variant of it. Not any other brand. Not any other model.
Your comment adds nothing to the original statement.
@@olejniczak12 There just has to be one guy like that in every YT comment section xD
I don’t know why but I love watching these videos. It would be hilarious if there was some kind of Expo or a Lock Sales Convention that you could go to and ruin each exhibitor products by unlocking their locks and showing them all their design flaws.
I like that.
Presumably the fix is to change the part to a non-ferrous metal, like brass.
It's now stainless with a very low magnetic profile.
Alternatively you could also shield it by installing a (“U” shaped) ferrous shield cover around the mechanism, but remanufacturing the part to be nonferrous is the simplest and most economical solution.
Glued on an small iron plate may work, it will spread out the magnetic force.
So now you just need a REALLY big magnet.
In the 60's when designed the magnet needed did hang on the shelf at or hardware store or in a massive online catalogue for next day shipping.
Also master has done much worst blunders than this.
"Your sense of security in life is a lie. As always, Have a nice day!" - LPL
Speak softly and carry a strong magnet. No memory or key required.
Cameras! So, wear the hoodie or your polar shades and fedora.
Be careful not to break your watch, wipe your credit cards... etc
@@GilesWendes In order for a magnet to scramble a magnetic strip, it's pretty much going to have to come in direct contact with it. As a matter of fact, the magnetic field emitted by a cell phone can actually demagnetize a credit card if it's allowed to be in direct contact with the magnetic strip for a long enough period of time.
@@patmarcy1210 are you talking about NFC? cell phones dont "emit" magnetic fields anymore than most objects do.
Blox117: Nope they emit - and receive - electromagnetic fields......
My first job was in maintenance at a facility with similar push-button locks (10-key though) on each of two doors into a secure area. I was just a summer temp, so I wasn't given the codes to either door, but I was escorted with a senior member of maintenance in several times. One day he was already inside, sent me out, and I was supposed to come back with something but of course the door was locked. I glanced at it and realized there were 3 numbers entered every time and there were different levels of wear on the buttons. I pushed the 3 most worn from most worn to least worn and it opened. I don't know how long it had been there, but obviously it was overdue for changing the combination.
really missed the "nothing out of one, small click out of two, . . ."
Here you go.
First I align the magnetic pick and...
nothing on the first twist
and there we have it open on the second twist.
I thought it was "nothing out of one, nothing out of two, small click on three . . ."
4 is binding
Counter rotation on 5
Feels like a false set on five
This reminds me of a situation which happened when I was young. We lived in an apartment complex with an electronic combination lock and I had taken apart a push-button lighter and was playing with the little piezo electric ignitor (the thing which you press and it makes a small zap). Out of curiosity I put the wires from it up to the lock, which was completely metal. To my surprise, when I zapped the lock it opened. It worked every time, and this was the standard combination lock in my entire city. I did not try it on other houses so it might have just been a flaw in this particular lock, but I'm wondering if anyone else has had a similar experience with electronic combination locks.
We had those on our classified shop doors in the air Force. Absolute trash. We had to turn the knob twice to get it to clear the valid code. They also break all the time
I was at work one Saturday when the plant locksmith decided it was a good time to change the combinations on all the basement labs without notice, which would force the users to go to the locksmith first thing Monday morning to register for the combo.
I called his office and left a message that I had something in the oven that was time sensitive, and to get down the basement ASAP. He left for the day. A pipe wrench makes these locks absolutely worthless. I got in the lab and removed my part from the oven with minutes to spare.
Never heard a word on the damaged lock.
Gunga Dinn I wonder what kind of oven would be used in an industrial manner like this.
you can see him having to turn the knob twice too at 1:15 and 2:31
@@B0MYT+
It was a Blue M process oven, and I was vacuum curing an out of autoclave graphite epoxy part.
We routinely would set a part up to run, being recorded by a DigiStrip recorder.
When we worked weekends, you had three or four irons in the fire at a time. I'd be working in the machine shop machining test specimens, then in the QC lab for a 24 hour non-volatile test sample, and in between eating lunch.
My Blue M oven was only turned off when the power went out, otherwise it ran 27/7/365.
So, in other words, your extremely high duty pizza oven -
www.thermalproductsolutions.com/brands/blue-m-industrial-ovens-lab-ovens-steady-state-test-chambers-and-lab-furnaces
This design flaw was discussed at a DEFCON in Las Vegas. After which the design was changed. Praise be to hackers.
Fun fact, these things are used at almost every apartment complex around here, and as a delivery person I was trained to carry a magnet around specifically to bypass these locks.
What? I can finally
Use the bathroom in some of these buildings with a magnet lol
Just look at the wear on which buttons were used and start guessing. It's worked for me at several locations.
“Sir! We have a number of reports about the Double Decker Toilet Wrecker”
“How does he keep getting in here and what does he eat to take massive dumps?!”
@@Abdega LMFAO 😂😂😂😂😂😂
Free toilet paper too thats a bonus
We have these at work on the bathroom doors to keep nasty contractors from wrecking our already dirty bathrooms. After a while the contractors seem to know the combo so we keep changing the combos then it takes a few weeks to remember the new numbers. Sometimes I have to crap really bad when i find the numbers were changed. Its a LOOOOONG walk to begin with and then have to walk to a different bathroom.
I will hide a magnet close by from now on
LPL: ... look at one of the greatest lock design blunders of all time (0:03)
Every lock maker ever: Please don't let it be one of ours
MasterLock: "Ooh, free publicity! … wait, that ISN'T one of ours!"
We used to have those at area 51 where the reverse engineering shop was, the Aliens kept breaking in we didn't know how. Now everything makes sense.
Did no one at your workplace know how to speak Spanish? Guess there was no way to find out how they got in from just "no hablo ingles".
@@InvadersDie well the Aliens spoke about 1.7 million languages from all over the Galaxy including Spanish. They actually invented all 6,000 languages on Earth.
@@MindzEnt forgive me if I am wrong but this must have been some time ago, are they not just called mexicans when confined in their respective geographical area?
I guess we should bring magnets on September 20th
@@PronteCo that will not bypass any high-security locks.
After working with thoes locks for several years I feel fairly confident to point out 2 important things. 1 is i have never seen or put the bypass leaf on any combination unit intended for a lockset that didn't have the bypass switch for the secure side of door, I think it was even a different part numbers for a combination chamber with and without the bypass leaf......2 I also believe that if the bypass switch is installed, the cam that activates the leaf would also keep it from being manipulated that way. That being said, I had never tried that bypass technique on any of the units we had lying around but I always thought it was trying to pull on the comb inside the combination chamber itself. Anyway love what you do, keep it up
Oh man, we had this lock on the outer door of our SCIF in Iraq when I was there in 2010. Crazy vulnerability! We had another electronic keypad further in, but you could have gotten access to all our servers and equipment in the back with this.
I find that bizarre. Even in 07 in Afghan we(RAAF) were specifically forbidden from using this lock type on anything requiring even a modicum of security.
Very bizarre. However, the right way is rarely the Army way. To be fair, it would be difficult to exploit anything in a 24hr shop
Now hang on. If it's a SCIF, then this dinky button lock is just used for access control when the room is occupied and there should be a high-security combo lock engaged when nobody's in there. Was that not the case?
@@Xezlec 24hr ops the entire time, so there was never any time the scif was unoccupied, and no other security on this outermost door.
@@ThatoneLich so why change it then, especially if there is another one further in
From my experience with these, the factory lock setting is 2 and 4 simultaneously then 3
Yes, and a lot of them were never changed from the default.
This
it was the code to the kitchen
Yep, that's always the combo lol
changing that requires a key to extract a cylinder, then a tool to move a change-collar, then a careful sequence of action, then putting it all back. If you get the key sequence wrong, you have to take apart that long rectangular piece and reset it. Been there.
So most folks don't bother.
I personally love using these locks. It super easy to maintain and I've come to lock the simplicity of the design. Kaba makes some good locks, but this one is always been a favorite of mine.
They used these locks inside the Pentagon, too. During Desert Shield, I was an Analyst/Terminal Operator supporting the Joint Chiefs of Staff, in the J-4 Logistics Readiness Center. This was early days, and they had just brought on some new staff. This was the first day of the new Team Chief on Duty. He was five minutes away from doing his briefing for the Chairman of the Joint Chiefs when he locked himself out of his own office, and the combination is only supposed to be known to the Team Chiefs. Needless to say, I was an eager young GS-5 civilian just a year out of college, and I could do the math on how long it would take me to brute force the locking mechanism by simply trying all possible combinations - tick, tick, tick, turn. Tick, tick, tick, turn. Tick, tick, tick, turn. Only it took me extra long, because I got to the end with no luck - that was when the Executive Officer on duty whispered to me that he thought he always saw the normal Team Chief turning the door knob the other way. So, I go at it again, and after a few tries, I’m in. I tell the XO the combo, and then I recommend to them that they change it to something else. And yes, the Team Chief did still make it to his briefing on time, with his slides.
I just commented about this, because it seems the order of the numbers doesn't matter, which means (if I've done my math right) even without the magnet exploit, there are only 29 combinations possible.
I don’t know about this particular model but most of the style of locks you can only use each of the 5 buttons one time in the combo. No repeats. This means if you have a 4 number combo the permutations possible are actually not that large. Like 120 combos. Especially if you can see wear on the buttons you can tell of a digit is not used. Then it’s like 24 combos. You can guess it fairly easily if you have a minute or two…. In the event you forgot your magnet. I’ve done it.
Man I'm sure this guy will be on some type of hit list if the lock companies ever created a unified association. Keep up the good work
Literally just woke up and it says "uploaded 4 minutes ago", oh boy what a great start to the day!
You should try waking up in a pile of your own shit and vomit.
im not into locks, or picking, or anything of the sort... but i cant stop watching these videos... soothing, pleasing to the ears voice.
That's it, you win. I have no interest in locks or lick picking but for some unknown reason I keep watching your videos, and now it's finally happened, I've ordered a cheapo starter set, absolutely no idea why. I did listen carefully to your video #318 and used that information to hopefully choose a cheap kit that might actually work a little bit.
@@Willam_J Thanks!
You got me a weekend off that I probably wasn’t going to get. My work had one of these until i brought a magnet and showed my boss their lock sucks. He was shocked but grateful.
Could you do a teardown of the mechanism please? It would be interesting to see how it works.
Agreed. We had these on our dorms when I was in college circa 1990. The codes were normally 4 digit but sometimes involved pressing 2 buttons at once. Would like to see how that works internally
Yevhenii Diomidov Yes, and an online user manual.
We had those on the doors to the TV studio and TV production room on the air craft carrier I was assigned to from 2004-2006 (I was a Navy Journalist). Occasionally the mechanisms would simply wear out and they would have to be replaced. I took one of the broken ones apart to see if there was an easy way to fix it. I managed to get it to work for a couple days, but then it failed again, and we had it replaced.
Magnets. That's why I'm attracted to these videos 😂
I grow up with that type of lock all over the place, for me, this isn't about Lock picking it's more like a blast from the past, Thank You for this video Mr. Lawyer
Maybe not the worst, but definitely a serious one. I bet the only change they did was changing that metal piece for a non-magnetic one
@ZaC kWinz - Austenitic stainless steel or brass would be my guess, as both are non-magnetic. Both are relatively cheap, though brass is less expensive and weaker.
Since it doesn't look like there is any stress placed on that part, I would presume the replacement part is brass.
Kaba wouldn't acknowledge there was a problem for a long time and you had to buy the upgrade. They would not retrofit. There is info on this if you google it. The US gov't purchased tens of thousands of these.
Reminds me of the police cruiser shotgun rack hack you demonstrated with a similar magnet. Great video LPL, Keep it up!! Fascinating--
There's an agency in my work building, that deals with sensitive information, that occupies an entire three floors that use these locks. I mean... even if you could get in on one floor you have access to all because there's an open access staircase between the three. But knowing how cheap they are, even if I were to recommend a lock upgrade it'd just fall on deaf ears.
Prior to seeing these there, I'd remembered them from the laundry room in my old apartment complex when I was a kid in the early 90s. Was surprised any place would still be using them.
just keep entering without keys or combination, eventually they will fix it
We had these in many of the labs and offices at school way back when. I didn't know about the magnet, but I did see that the combinations were quite limited, and any button could not be pushed twice in a row, so that there were only 80 combinations possible with the typical 3 digit combinations used there. You could go to any of these when nobody was around and simply try the possible combinations sequentially until you found the right one. I did this on one or two doors and it was quite easy - I think the longest one took about 20 tries. But I didn't really need to go into any of them, it was just the fun of finding the combo. There were other doors that had similar mechanical combination locks, but with 9-key buttons and 6 digits, but I never tried those.
There are 541 combinations if you use all five buttons. If you add the number of combinations that can be achieved by using 4 buttons or less, brings the total to 1082 combinations. This does not include the number of combinations that can be achieved by depressing two or more buttons at the same time, when included in the combination.
Results from the Simplex Lock Problem
What's the thickness of that magnet-pick in thousandths?...
Looks to be roughly 875 to 1000. It appears to be a seriously beefy magnet.
Stupid imperial system...
@@xoniq-vr Better than the stupid french system.
@@CptJistuce pretty sure that when one is defined by the other it is the inferior one
@@InvadersDie Typical francophile. Do them one little favor and they act like you owe them forever.
This was the same lock on my dorm room. If you have a few minutes free with it you can guess the combination easily too. They would always change the combo every semester, but they would only rearrange four of the five numbers, so if you know which is the unused number, it can cut your guess time down quite a bit, and it was always four numbers so you could start there too.
There was a plant where I worked more recently where they had one of these locks on one of their storage buildings. When I needed to enter for a part but it was a half a mile back across the plant to the guys office who knew the combo, it was quicker to guess it than to go get it.
I worked with one of these locks (a newer model) at my first internship in college. It fascinated me because, as a computer engineering student, I had just taken discrete math (inc. counting, permutations, etc.) and I was curious how susceptible to brute force attack it was.
This lock's combinations are one to five step sequences where each step can have one to five buttons each, but no button can be used in more than one step ever.
This lock has 6475 possible combinations. That sounds like a lot, until you realize that if they found a way to allow buttons to be reused for any of five steps it would have 24,883,200,000 combinations.
In my experience, this lock has no lockout for multiple attempts, and if you press a wrong button, you simply have to start over without pressing a reset button. In other words, the only thing that matters is that the last steps you entered match the steps of your combination. As a result, if you don't make use of the ability to select multiple keys in a single step (common in my experience), your combination can always be brute forced in at most 153 button presses, or, fewer button presses than trying 31 length-5 random codes, by using a superpermutation of 5 characters.
If you don't make use of the ability to press multiple buttons in a single step, and the attacker knows how many steps (buttons) your combination is (say they are a coworker who can hear you enter the code, or even a delivery driver who hears you do it once), then, say your combination has n steps (1
CatoSierra can’t we just use the magnet?
There was one of those on a marina gate where I used to live. I found that rattling the door really hard would cause it to unlock. It was faster than using the combination and it really annoyed me that it was so easy, so that's how I went in and out from then on. One day the marina manager was walking up the ramp when I did it. He was pretty unhappy with me for being so rough with his door, then I showed him why. The entire mechanism was changed that afternoon. I'm not a picker or anything, so I have no idea if the new one was any more secure, but I do know that rattling the door wouldn't open it!
I worked at a medical coating factory in 2012-2014 that had these locks. I wonder if they were the old ones. Haven't worked there for a while and they've since moved into a new building so I'm sure the locks are new now at the very least.
I never knew I cared about locks till I found this channel now I’m hooked.
No mistakes, just happy accidents ~ Bob Ross
This applies to everything but my children.
Finally! An informative video that doesn't have 8 minutes of fluff to make a 10+ minute video!
Thanks LPL!
*in 3 years*
“Hi this is the lockpicking lawyer and we have here a full size 20x40 JP Morgan bank safe, I’ll be showing how easy it is to fool the guards and failsafe and...”
We used these locks quite a bit in the Military. In fact, there is a variation of this lock on almost every bunk locker drawer on US Navy Ships. The locker version is not vulnerable to this attack but, I use to help people all the time that would forget or not know the previous owners code. I would just stick a pick into that slot to open it because I could access the drawer from behind. I could just reset the code or remove the back plate and decode it by watching the wheels. I did not know about the magnet trick back in the 90s but I did discover really quick that in Government buildings, spaces controlled by the same departments almost always used the same code. I stood a building security watch on night and tried codes to spaces I had legitimate access to. My codes work on other doors about half the time and I only knew 3.
That's pretty wild, nice for maintenance guys.
A client of mine had the 1st gen Simplex on a warehouse and were supplied the kit years ago to fix the vulnerability. The replacement pieces were plastic. The problem is the plastic broke recently possibly due to the door facing a western exposure and daily sunsets, along with Chicago summer and winter variations from 100F to -20F. A few years of that abuse and the mechanism totally broke and the door could no longer be opened from the outside. They replaced it with a DL2700.
I've encountered many of these left at the factory default combination I'm not really sure if security is a concern at all for some people.
We had these on medium-security doors, such as conference rooms, where I worked as DoD contractor. 7 times out of 10, someone would have written the combination in tiny print on the wall beside the doorframe. These locks were effective in keeping spies under the age of 4 out of such rooms - they weren't tall enough to read the combination.
I have never seen these 1000 series locks used in high-security applications. Those doors used multiple locking mechanisms, usually badge readers with pin code keypads in conjunction with a Kaba X-10.
Hi, this is the lock magnet lawyer!
I have seen this done before. I’m glad your putting this out here. I agree, there are probably many still in use right now.
0:31: yeah, "they are very easy to operate" :)
Also what's the entropy on the key combination? I bet it used 3 digits from 1 to 5. Plus something tells me that digits 2, 3, and 5 were used on that particular lock :)
I expected that was the vulnerability he was going to talk about. That the digits became obvious over time, AND (at least in the ones I've used) the digits could only be used once. So it was 5x4x3 if you couldn't see the wear, and 3x2x1 if you could tell the digits.
Willing to bet that was used here at the 911th Airlift Wing located at the Pittsburgh airport, prior to the installation of our current cypher locks. Seen that exact unit at every Air Force base I was stationed at prior to 2013 or so.
You also failed to mention that there is a default number combination that is 99.9% of the time never changed.... that is press 1 and 3 at the same time then 2 then 5... opens up almost all the time. I had one of these at my old office and it worked there. It also worked on the apartment complex pool down the street from my house I would go hang out at.
Yep, all the supply rooms and (frighteningly) med closets at my local VA hospital can be bypassed with this technique
I'll be bringing this to the attention of the school district I work for. Thank you, sir. Many schools in our district use this style of lock and haven't been upgraded/remodeled since at least the early 2000s.
Many locks still have this type of flaw.
I don't know if it applies to this specific lock but I used to figure out the combo on a number of doors using this type of lock very easily. They typically only used three digits for convenience (I'm talking about private bathrooms at golf and boat clubs, not high security facilities) and since each number could only be used once the possible set of combinations was fairly small (I don't know how to do the math but in the 100's anyway). It was usually just a matter of a few minutes of trying every possible combo in order.
I think you forgot to mention how the lock was supposed to work. Like how many numbers on a combination, how would the lock unlock once the right combination is used, etc. Still nice to watch
Thanks so much for keeping us informed on which locks not to buy. 👍👍👍👍
What was the fix? make that problematic part out of aluminum?
Ye that or plastic, don't see why it couldn't be made out of fairly decent plastic, not that aluminium is expensive but I'd assume at a large scale plastic is even cheaper lol. I'd imagine someone coming up with a portable blowtorch and melt it from the outside :D
@@huldu Thing is a blowtorch would work on Aluminium too they can produce flame temperatures significantly in excess of 1000C Aluminium melts at just 660C. Granted you have the layer of air inside but the metal lock body would be a very effective heat transfer mechanism to heat up the relatively enclosed air inside, probably getting the lock body up to Orange/Yellow hot (around 1000C) would do the trick. Then again stainless steel has a much higher melting temperature and is usually nonmagnetic granted certain processing can convert some of the Iron into the magnetic phase and some alloy mixtures fail to eliminate it completely, but if a nonmagnetic alloy mixture were chosen and it was properly handled this would do the trick. Processing that can trigger conversion includes things like cold working this makes manufacture a little more expensive as you need to make the parts in a foundry not just cut and fold sheet steel but doable.
Duped comment?
Replace with the non-passage combo chamber
I had no idea about the magnet thing, but there's another problem with these locks. There just aren't that many combinations, and with practice you can get it purely by trial and error in just a few minutes. Especially if it's an old lock and the buttons are worn down so you can see what numbers are in use. Of course the first one to try is the factory default combination.
*When your hand is not enough for a facepalm for this*
so you use the wall instead
The lock is in sale since the 80's, back then neodymium magnets didn't exist outside of research labs...
I use the ground... The biggest wall of all.
@@wtfiswiththosehandles But a rod wrapped in wire with a 6v battery was.
@@LiezerZero You can try it for yourself, it will definitely not be as powerful as one of those neodymium magnets you can find nowadays
@@LiezerZero nowhere near enough power...
Thanks for showing how the rare earth magnet disabled the lock. It was much simpler than it was in my imagination.
I am a happy fellow today. My first picks, tensioners, and practice locks arrived from Sparrows today. The adventure begins.
I remember as a kid my dad had one of these on the shop he worked at
We used to just put in random three digit codes and be in in less than a minute
We had one of these on the walk in beer cooler at work. The inside, of course, had a never-lockable handle so you could always get out. But to get in from the outside, this is what was used.
I'm here so fast that the lock hasn't been picked yet.
Darkrukiaz now that’s fucking rare
It didn't get picked, there was no need.
I'm here more than a year late & it's still not been picked lol ;)
In my military gig, a lot of these were certainly in use in our facilities. Circa 2010 most of these were changed over to electronic key card entry systems. Now I wonder if this was an unrelated tech upgrade for a credentials based security system, or about this security flaw.
It's not a design flaw.
It's a feature.
Featuring desing flaw.
Depends on who's accessing it...
Wireless door opener
Let me show you its features!
@@JohanKylander Jeorge would make a lock that shoots you if you try to pick it
The other vulnerability these have are polishable metal keys. After a few months of usage, it makes it really obvious which keys are being used.
Used that to 'brute force' the correct code in about five minutes when a customer forgot their door code.
First thing i do now is look at the length of video, that way you have an idea of the quality of the lock about to be picked...
The quality of the lock is proportional to the length of the video but the giggle factor is inversely proportional to the length of the video.
Just don't apply that logic to Bill's channel 🤣 even the shitty locks have 25 minute videos most of the time
@@JC-11111
Shush! LPL hasn't figured out how RUclips's algorithm works yet, but Bill has. Videos longer than 10 minutes get promoted more by the algorithm. So don't tell LPL that or we'll end up with a 10-minute video picking Master's shittiest lock ever.
@@bdf2718 Exactly. nothing worse than a minutes worth info info stretched out for 10. LPL is spot on with time for info. its why i watch his vids. no bullshit. well, except for some of the products he reviews that is!
We used to open these type of locks easily at the VTA station next to Great America in California. Inside the light rail station was a bathroom for use of VTA drivers and if there was no train in the station it meant we could sneak a pee break.
2:45, the left and right side of it looks like a drawn cartoon. That’s some dope lighting.
I don't remember if it was the same exact lock but there used to be many of those around when I was a telecom tech.
Even though I had a slide card to work in a major bank's data center, I was able to open those locks on other doors because the bank never bothered changing the default combination for the buttons!
I love how he always ends his videos like “...anyway that’s how the locks at Fort Knox can be bypassed. Do with that information what you will.”
Had a lock like one of these at a hospital where I used to work; policy was to change the code every month, so nobody every remembered it, so instead just told each other to tap it hard on one side while turning the handle and it would open without the code (and that was only if the porters hadn't just left it in the unlocked position on the other side to save them hassle when they had to make multiple trips). Not sure if it was a similar exploit to this, but it feels like it, probably just a less sturdy spring so hitting it was enough to move it?
My conclusion from skimming through videos on this channel is that I'm going back to the good old method of a portculis, a sturdy door, a bar and someone on the other side who has to open all of it when I need in.
This channel now has me saying...why bother with locks at all?!
Locks only keep out non criminals.
Locks are for the most part, a deterrent. They're only an actual defense if there's really no other practical way around them (going through Windows, breaking down the door etc.) and they have to be picked or destroyed. At that point, you want a strong pickproof lock. Something like the Bowley lock.
@@XavianBrightly yup locks just keep the honest person honest.
To be fair, there's very little you can do to stop someone who is determined enough to get to your stuff.
Locks are meant to deter would be criminals who are more opportunistic than determined - most people looking to steal something aren't going to risk exposing themselves or drawing attention to their actions if they have to deal with a lock that's going to take a lot of effort/time/noise to get past; they'll pass on that one to find a "softer" target.
Because most people don't carry rare earth magnets around in their pockets? A burglar could easily break a window too. So? You just need to understand security, know that any lock can be cracked, and security measure can be overcome, and act accordingly. There is no way to live a 100% safe life.
Thanks for yet another awesome video! This is great for old simplex locks. But it’s now 2024, can you please make an updated video that addresses the newer simplex locks?
Note to self: carry a magnet with me when I’m cruising government facilities.
Very cool video that showed us the internal mechanisms.
I checked twelve of them at the bank where I have my account (with the bank president along to watch) and ALL of them popped right open! He was totally surprised! He said he was calling the lock smith immediately. He said that including all the bank branches there were probably over 100 of these pieces of junk installed! (it only takes a 20 cent piece of iron bar with a piece of double sided tape to fix the lock)
Worked on a lot of these years ago. First thing before installing we would remove that part. Not many left anymore.
Somewhere I hear Jesse Pinkman scream: "Yeah b*tch! Magnets!"
Wow.. I know many people relying on this type of door lock. Thank you for this.
They were also all shipped with the same combination, and no one ever changed them!
Was is 2 and 4 simultaneously, then 3?
@@lord_hemp yes.
I really enjoy your videos. They're really entertaining and I always learn something. For example I've learned not to use TSA pad locks on anything important.
MIT uses some of these in their physics building... bathrooms, at least.
Wow. I am pretty sure we used to have that lock on the grad offices where I am a few years ago, until they were replaced with an electronic lock.
What type of rare earth magnet was that again? Just curious (ahem)
Probably neodymium
Neodymium
darude - sandstorm
Big ones like that are pretty expensive from China.
One can buy them on fleabay very reasonably. Be aware there are strength grades.
We had one on an office I worked in. The combination was something like 2-4-3-5. One April 1st, I sent an email telling everyone the combination had been changed to 2-4-2-4-2-3-4-5-2-5-3.
Actually, the biggest security flaw on this lock is that most people leave them set to the default combination.
Changing requires a process many people find tricky and intrusive, so they don't bother.