Lockpicking.

Lockpicking

Using lockpicking as a lens to understand physical security, access control, and the hacker mindset. Lockpicking can also be a great example of how we attack systems, the implications of security controls, defense-in-depth, and mitigating single points of failure.

Why Do People Lockpick?

Lockpicking can be associated with nefarious activities, but many adopt it responsibly. We also use it as an analogy for how attackers approach systems — and why security must be thought of holistically.

• Locksport, security researchers, emergency responders, locksmiths, puzzlers, survivalists
• Some use it as a tactile hobby — like a fidget spinner you can actually learn from
• Different goals: speed, completion, research, or covert bypass
• An analogy for attacking and defending digital systems

Why Not Just Break It?

Many people immediately think brute force is the answer. But covert entry has real advantages — in both physical security and cybersecurity, being quiet is powerful.

• Breaking things can be expensive to repair or replace
• Visible damage alerts others that someone has been there
• Some locks serve as integrity checks — breaking them defeats the purpose
• The challenge and finesse of picking is its own reward for many practitioners

Lockpicking 101: How Locks Work

A pin tumbler lock has a central plug (core) inside a cylinder. Pin stacks are spring-loaded downward. When picking, we apply tension to the core (causing non-uniform pressure on pins), then manipulate each pin to the shear line one at a time.

• No key inserted: top pins block the core from rotating
• Correct key inserted: pins lift so top/bottom pins align at the shear line, core rotates freely

The Methods: Raking vs SPP

Two primary picking techniques — each suited to different locks and situations.

• Raking: rake + tension tool — manipulates multiple pins at once, fast on cheap locks, unreliable on quality ones
• Single-Pin Picking (SPP): hook + tension tool — sets one pin at a time, slower but effective on any lock
• SPP is required for high-security locks and locks with security pins
• Raking is a good starting point; SPP is what separates beginners from skilled pickers

Raking

Raking is the more common approach for many when dealing with less secure and cheaper locks (e.g., most Master Locks, common deadbolts). This process uses a tension wrench/tool and a rake. The rake is used in a "brushing" motion with the "peaks" moving against the bottom of the pins.

• Typically won't be as effective on higher security or nicer locks.
• Can wear down the inside of the lock quickly.
• Remember, pins move up and down. Side-to-side and twisting motions are not needed with picking (most of the time).

Security Measures

There is always a back-and-forth between lock manufacturers and lockpickers. With that said, there is almost always a way to bypass security devices — for lockpickers, the more complex the lock, the bigger the challenge.

• Security pins: spool pins, serrated pins, mushroom pins
• Side-bars (common in high-security cylinders like Medeco and ASSA)
• Magnetic pins
• Bi-axial pins

Other Types of Locks

In addition to pin tumbler locks, there are many other types of locking mechanisms. These range in complexity, security levels, and cost. Each one typically has specific use cases and in many cases, have unique ways of picking them or require specialized tools.

• Disk Detainer - Commonly used for bike locks or other high security locks
• Safe Dials - Used for safes and combination locks
• Wafer Locks - Seen in cabinets, drawers, other lower security use cases
• Dimple Locks - Similar to pin tumbler but the keyway is rotated 90 degrees and typically requires a different type of pick

Beyond Picking: Other Bypasses

Picking is just one way past a lock. Many bypasses require no picking skill at all — which is exactly why security has to be layered, not just "use a better lock."

• Bump keys: a specially cut key is struck to momentarily set all pins — works on most standard pin tumbler locks
• Shimming: a thin metal shim slips past the shackle latch on padlocks — no picking required
• Under-door tools: a hook-and-lever tool can depress a door handle from under the door in seconds
• Loiding: a credit card or thin shim can retract a spring latch on an improperly installed door