CLIQ and other "unpickable" locks pwned at DefCon

Lockpicking legends Marc Weber Tobias, Toby Bluzmanis and Matt Fiddler demo'ed a series of ingenious hacks for opening "unpickable" locks at Defcon last weekend. Included is a hack that opens the expensive electronic/mechanical CLIQ lock, which requires an electronic handshake between the key and the lock, and which logs every open/shut event) by simply vibrating the key:

Bluzmanis demonstrated an attack by taking an Interactive CLIQ electro-mechanical lock made by Mul-T-Lock and inserting a mechanical-only key cut to the same keyway. After inserting the key, he does something to vibrate the key for a few seconds until the mechanical motor in the cylinder turns and lifts the locking element to release the lock. He asked Threat Level not to disclose the precise method, other than to say it involves no special tool or skill.

"There's no audit trail that the lock has been opened," Tobias says, "because there are no electronics [involved]." If the attacker entered the room to steal documents or sabotage the facility, the last person who entered before him and who showed up in the audit log, would presumably get the blame if the thief wasn't caught on surveillance camera or the video surveillance was also sabotaged.

Electronic High-Security Locks Easily Defeated at DefCon