130 likes | 533 Views
Decoding the Kwikset SmartKey ™ Shmoocon 2009 Shane Lawson Fraternal Order of LockSport (FOOLS) . FOOLS is a locksport group primarily from Bloomington Indiana We run the lockpicking attractions at Notacon, and helped out last year at Defcon. Who?. About the SmartKey .
E N D
Decoding the Kwikset SmartKey™ Shmoocon 2009 Shane Lawson Fraternal Order of LockSport (FOOLS)
FOOLS is a locksport group primarily from Bloomington Indiana We run the lockpicking attractions at Notacon, and helped out last year at Defcon Who?
About the SmartKey • ANSI Grade 1 Deadbolts • Designed to defeat bump attacks • Re-Keyable on demand
Operation • The mechanics of the key do not function like standard pin tumbler locks • Pins have a ledge • The ledge interfaces with sawtooth wafers • The wafers engage the sidebar
ReKeying • Turn the key 90 degrees • Insert the 'learn tool' (stick) • Pull the tool and key out • Insert new key • Turn back to normal • Remove key • The new key works, old one doesn't
The Learn Tool • This is a pokey stick
How it Works • When the lock is turned and the tool pushes in, the wafers are pushed off of the ledges • The new key goes in setting new depths • Turning the lock back snaps the wafers back, and the teeth engage at the new depths.
Supplies • KW1 Blank • Sewing Needle • Anti-Theft tag (from a DVD, CD, etc) • Alligator Clip • Super Glue • JB Kwik or JB Weld (if you want to wait that long)
Tools • Dremel • Vice
Decoder Operation • The pennant on the needle acts as a feeler • By shifting the angle of the needle, the pennant can easily move past the housing • Once free, the pennant will touch against any free saw teeth • By counting the teeth, the key depth is also known
Cost Summary • KW1 Blank = 1.50 • Needle = 1.50 • Aluminum Shims = free • Superglue/Epoxy = free if you have it, if not $2 for each at a dollar store • Total cost = 5.00
What that buys • This works on all of the smart series of locks • Each one has the same cylinder design • Subdermal fingerprint/keypads make no difference if you can decode the manual override.