如何在八次尝试或更少的次数内破解许多主锁组合

发布于 2015-04-29

Vulnerability in Master Lock padlocks: Allows anyone to learn the combination in 8 or fewer tries in less than 2 minutes with minimal skill.
- Exploit process: Lift locked shackle with one hand and turn combination dial counterclockwise from 0. There are 3 points of resistance before 11, ignore one between whole numbers. The remaining 2 are locked positions. Then lift with less force and turn clockwise until resistance. Record these positions on a specific Web page.
- Page response: Gives first digit and 2 possible last digits. By testing "give," correct last digit is found. Eliminating the false digit populates 8 possible second digits.
Creator and related hacks: Devised by Samy Kamkar, a serial hacker. He has created stealthy keystroke-pilfering USB chargers and DIY stalker apps. In 2005, he unleashed the Samy worm.
How the exploit was devised: Started with a known vulnerability that allows cracking in 100 or fewer tries. Physically broke a lock and noticed resistance caused by lock parts. Also observed that the first and third digit divided by 4 always have the same remainder. Combined these insights to create the attack.
Other security measures: Came a few years after Master Lock engineers developed new padlocks resistant to attacks using shims from soft drink cans. Samy Kamkar has tried his exploit on more than a dozen Master Lock combination locks and it worked on all. He plans to unveil more details including an Arduino-based robot.
Ars staff test: Updated post to change "any" in the headline to "many" and includes a link to watch Ars staffers put the hack to the test.

阅读 4