Lockpickers 3-D Print TSA Master Luggage Keys from Leaked Photos
Lockpickers 3-D Print TSA Master Luggage Keys From Leaked Photos
Bolduc says he doesn't know the brand of the luggage lock he opened, but based on the "TSA" inscription on the bottom, he can conclude it is on the approved list. The problem likely extends well beyond one brand, anyway; the leaked master keys include those that open every type of TSA-approved lock made by companies such as Master Lock, Samsonite and American Tourister.Of course, none of those companies are to blame for following the TSA's master key guidelines. The real security blunder, as Berkeley computer security researcher Nicholas Weaver noted after the key photos were first published, was made by the TSA and the Washington Post, who released the photos on the Post's website. Publishing photos of sensitive keys, after all, is a well-understand screwup in the world of physical security, where researchers have shown for years that a key can be decoded and reproduced even from a photo taken from as far away as 200 feet and at an angle. Neither the Washington Post nor the TSA immediately responded to a request for comment.The Github release of those printable master key files, according to one of the lockpickers who decoded the master key photo, is meant to prove to anyone who uses the TSA-approved locks that they should no longer expect them to offer much security. "People need to be aware that even though someone says 'use these approved locks,' don't take their word for it," says Shahab Sheikhzadeh, a New Jersey-based security researcher who usually goes by the handle DarkSim905, and who helped Xylitol with his work on Github. "We’re in a day and age when pretty much anything can be reproduced with a photograph, a 3-D printer and some ingenuity."Even so, the TSA's master key leak doesn't exactly represent a critical security crisis, argues University of Pennsylvania computer science professor and noted lock picker Matt Blaze. The TSA-approved luggage locks were never very high security devices to begin with. "I’m not sure anyone relied on these kinds of locks for serious security purposes," he says. "I find it’s actually quicker to pick the TSA's locks than to look for my key sometimes." (Blaze also notes that he believes that a photo of TSA's master keys leaked earlier than the Post's story, though he can't recall where and doesn't believe they were actually published as printable CAD files until now.)But Blaze says that the photo leak and subsequent 3-D printing demonstration does show just how quickly a theoretical slip-up can turn into a real security compromise. And he says that the TSA should have known better than to allow its master keys to be photographed. Prisons, for instance, have long kept cell keys covered on guards' belts, he points out. "In high-security environments, it’s clear that you want people to not just take photos of your keys, but to not even look at them," he says. "We would hope the TSA would have taken better care of their keys than they have."1Updated 9/11/2015 6:23pm EST with a tweet from J0hnny Xm4s noting that the printed keys worked only after he rescaled them.