Belgaurd, Gibbons Alternative Opening | Locksmith Blog
Topic: Bypassing

This is quite an old trick really but today I actually got to use it so have taken a few snaps just to show you how it works.

As any good locksmith will know these old Gibbons aka Belgaurd (rebranded in various forms) are an unusual 8 gauge curtain lock and are cheap and nasty inside making them a difficult pick.

There is however an easy alternative destructive bypass that makes life easier than drilling into the organs of the lock.

On the bolt side of the lockcase is a pre pressed hole that holds the curtain spring. It happens to sit directly in line with the bottom of the lever pack. Inserting a poke wire or small screwdriver you will be able to lift the lever bellies together which fall in line to open, all you have to do is provide a little tension via the curtain. If you aren't lucky enough to be bolt side of the door you can still access the same sweet spot by drilling yourself a 4-5mm hole in the case at this point: (approx one inch towards bolt from top of curtain)

Pictures below show belly of levers through the hole and then engaged with stump.

 

DE Solid Bodied Lock Cylinders | Locksmith Blog
Topic: Bypassing
No locksmith likes a destructive entry, however sometimes there is just no other options available.

Today I encountered a lockout at an apartment.

It was a decent setup of Arrone+ Cylinder and nightlatch that had phantomly popped into the deadlock position when slammed shut.



With no letterbox available I would normally 'mickey mouse' the cylinder from the door and use the snib removal method i discussed a few years ago.

However as you will probably know the Arrone+ is a solid bodied lock cylinder and attempting to take out the retaining screws in the usual fashion would'nt be a smart move and could get messy.

I decided that the best way to attack this lock would be to use a rod style snapping attack, taking a bit of a gamble that the retaining screws were the clippable type and not the solid thread version.

So i drilled a decent hole into the meat of the lock body making sure to miss all pins and any anti-drill protection the lock might have had .



Using a tight fitting hardened rod; ala screwdriver i rolled around the edges of the hole applying force in both clockwise and anticlockwise motion and eventually fractured the retaining screws which as i gambled on, had snip off points making them considerably weaker than a solid thread screw.



Cylinder out the way, i drilled for the snib button and released the deadlock in the usual manner.

If you do suspect that the lock cylinder is fitted with a solid type screw then i would advise drilling diagonally through the lock body as to hit the retaining screws just behind the cylinder and weaken them enough for this to work. Id recommend a 1/8" drill bit for this as to leave enough meat in the cylinder for the snapping attack.

Mul-t-lock G Series Alternative Destructive Opening | Locksmith Blog
Topic: Bypassing

Glued or damaged padlocks can be a nightmare to open when used with a good hasp and staple.
Higher security models usually feature a closed shackle and hardened bolt usual Boron.

A few years back I had to devise a way to open the mul-t-lock g series padlocks for a non-locksmith friend who dealt with a lot of these on their sites.

Bolt cutters are useless and using a grinder would have been particularly dangerous at these warehouses. BOOM!

As a lot of locksmiths know, drilling for the traditional sheer line is hard on a loose hanging padlock. Throw in the usual antidrill measures that multlock incorporate into their cylinders and you are looking at a major ballache!

So I took a few padlocks to play with and heres what i came up with:

The g series padlocks incorporate a special half cylinder in the padlock body making lock changes particularly easy once the lock is open.



The cylinder is held in place by the usual retaining screw down the shackle hole and a small split pin through the side of the padlock body.

The split pin is not hardened steel as you would expect a 1/8th" drill down it puts you bang on target for the retaining screw.

Run down your pilot hole with a larger diameter drill bit until you hit the retaining screw and remove as much material from the threaded portion of the cylinder as possible.

I have also used the drain hole as an extra pilot hole so that you may bring another angled drill to the rear portion of the cylinder.

You may find a little bit of thread holding the cylinder in but a screwdriver or similar can be used just to break the last part and push the cylinder from the padlock body.

Obviously this method is only preferable when picking is not possible and the lock has been vandalised. They are in fact not a bad pick when in a favourable position and not kneeling in a puddle at the bottom of a roller shutter.

Videx attack - Locksmith Blog
Topic: Bypassing
I have decided not to post the details of this particular attack for now, but can now confirm that the Videx Cyberlocks are definately vunerable to a certain bypass method that is mentioned in various dark corners of the web.

Magnetic attacks - Locksmith Blog
Topic: Bypassing

So as of late, the latest must have tool for your locksmith toolbag is the large neodymium magnet.

Marc Tobias has just released an official document regarding the missing C-clip on certain models of the Kaba simplex combination locks. (a good summary can be found here)

Its an attack that has been known about for quite some time but was most commonly conducted via a small hole in the left hand side of the lock case to allow a pulling wire in and pull the plate manually.

With the increasing availability of high powered magnets almost anyone can perform the ultimate NDE bypass on these locks throwing this vulnerability into the spotlight and will undoubtedly cost the makers a considerable sum of money if not cripple them financially.

Locksmiths: Make sure you order the largest magnet you can afford, I tried using a 50x50x25mm magnet which was not sufficient to pull the plate on the larger unican models, but was fine for the smaller 7000 series.

Other locks worth mentioning here would be the Avocet ABS, currently being heavilly marketed throughout the UK which incorporates a magnetic pin of which is easilly overcome using a small magnet (I use a piece of rubbery fridge magnet) inserted into the keyway above the pinstack or using a magnetised pick blade.

There are many good sites out there to buy high quality magnets. There are two that i will recommend, as are both cheap and ship quickly:

First4Magnets

E-magnetsuk

So, happy experimenting folks and let me know if you discover anything interesting, its a new dimension to lock manipulation and im sure theres plenty of new lock vulnerabilities that remain undiscovered.

ps: Watch your fingers!

Testing the Cyberlock - Locksmith Blog
Topic: Bypassing

Im sorry it has been a while since i updated my locksmith blog.... My new home and DIY have been keeping me busy.

Anyhow...

I recently met with a UK Videx distributor for a demonstration of the Cyberlock.

Im always wary of new technology and the claims made by their sales representitives, however im happy to report that i was quite impressed with what i was shown.



Encrypted lock technology is definately the way forward and is on offer by various companies in different forms; Kaba Locks for example should be a serious competitor offering similar management capabilities with their range of access control products.

Basically these systems now allow the real time management of access to doors/locks/whatever.

The cyberlock is the only product i have seen so far that retrofits existing hardware, making it especially appealing.

As with all new technology price is an issue and systems can be very pricey, although could be cost effective for large business customers with massive key collections and management issues.

Its certainly a system id be interested in installing and i hope to deal with the supplier in the future.

Multipoint locks flaw - Locksmith Blog
Topic: Bypassing

I still find it hard to believe that multipoint lock manufacturers still havent effectively dealt with the hole bypass problem that these locks suffer from.

It seems all that is required to unlock the doors is a small hole and a bent wire to act as the cam. (shown here on a Winkhaus lock case)

It seems all that is required to prevent such an attack is a hardplate escutcheon around the vunerable area.

Most of the new range of euro-deadlock lock cases are now supplied with a hardplate escutcheon for this very reason and locks such as the chubb viper deadlock come with considerable protection to prevent this easy bypass.

Others such as the London Line deadlock have a non manipulatable mechanism that can only be unlocked with a tight fitting cylinder. (in fact my cam turner wont even budge them).

Opening an MT5 - Locksmith Blog
Topic: Bypassing

I recently aquired a small box of mul-t-lock euros of various types including a few MT5 cylinders.





Having never encountered these before i naturally spent a short time picking the lock which i found to be pretty challenging. The telescopic pins lacked the sloppy feel of the classic style lock.

In defeat i decided to open her up and see what I was up against.

Each driver pin is a self contained spring and inner pin as usual but of smaller diameter and inner driver slightly serrated on the end.

Main pins consist of inner and outer pins again of smaller diameter than the classic.

The sixth pin in the back of the lock is a special shape with a protruding conjoined piece that  sits out of line with the other pins and is located at the rear right hand side of the keyway.

The particular model of MT5 i have i assume is not the plus (+) model incorporating the sidebar as no sidebar was present and the plug does not look machined to take any finger pins.

I really needed a way to defeat this lock without drilling should i ever encounter one. (Note the MT5 has the usual halfmoon hardened drillplates that sit under the plug and hardened pins so drilling could be awkward).

You may remember a few weeks back i toyed with the idea of frontal shimming. As the MT5 has such a thin plug face and no aparent protection against this attack i decided to give it a shot.

So i hacked away with a junior hacksaw right to the hardplate in the lock which was sufficient to expose the locks sheer line.



...and slowly worked the shim through the lock by overlifting the pins one at a time to progress deeper with the shim, it was a little fiddly as the serration on the inner driver tends to catch but reversing up a fraction and then manipulating the center pin easilly overcomes this.

 You will be able to shim the first five pins in the lock but the special 6th pin didnt seem to want to know so instead i used a tension wrench and just picked it. It is located at the back right hand side of the keyway.

Hey presto one open lock.

Ok, its techinically a semi-destructive method but works a treat and is something i would definately use in a real world situation as oppose to trying to pick this lock which would take considerably longer in my opinion.

Im sure the MT5+ will be a different story but i cant really comment til i get my hands on one.

Lever Lock Bible - Locksmith blog
Topic: Bypassing
For those with a particular interest in lever locks click here (You will need powerpoint).

Theres not everything in there, but most of the five lever locks i ever encounter.

Note: this is something i created for my own personal use and id prefer it not to be distributed outside of this site as intended solely for hobbiest/locksmith reference.

If you have no understanding of lever locks id strongly suggest you dont risk drilling a lock!

Measurements taken from top center of keyway and for lever picking only.

Amusing Destructive Entry - Locksmith Blog
Topic: Bypassing
Heres another old video worth sharing:

This was supposed to be a plug puller demo for a local locksmith training course... but didnt end as planned.

You couldnt make this stuff up!

Alternative DE Methods - Locksmith Blog
Topic: Bypassing

Looking through some of my old pictures I came across a few i took whilst experimenting with drilling certain locks.

First

A method you can use to open the Kaba dimple cylinders:

The Kaba cylinders consist of a self contained unit housed in the lock body. This is held in by a hard steel grub screw. (This is usually sealed over with a resin)

Once that is removed the whole unit will turn, regardless of being picked or not.

As you can see above, the grub screw in a traditional shaped cylinder is located at approx 45 degrees clockwise. In a euro/oval profile the grub screw is directly beneath the plug.

You will need a hard plate drill or two to break the grub screw as its hard grade steel, drill using slow drill speed with plenty of force!

Once the grub screw is out of the picture the lock can be opened with a flat blade screwdriver. It may take a little force as the end of the grub screw may remain in tact but will fall loose quite easilly.

Proof that it works: A jammed/broken key situation, it required a little drilling in the keyway just to make room for the screwdriver blade

---------------------------

Secondly

A relative; a locksmith for a large gaming firm gave me a few abloy knockoff cam locks a while back to see if there was a better way to open them quickly, without running a huge drill down the center and ripping out the guts.

As most rear tensioning disk detainers these little locks were almost impossible to pick so a neat destructive bypass technique was needed.

I decided the best method would be to locate the sidebar position, drill a small 1/8th hole and remove from the lock.

After dismantling the lock i located the sidebar:

 

Rick | Walsall Locksmith

Worn Lever Lock Opening - Locksmith Blog
Topic: Bypassing

 

Sifting through some old videos I have and i came across this one i filmed for a local locksmith training school.

This is a locksmith called Shane teaching students how to open lever locks suffering from long term wear and tear.

Bumping a lever lock!?

Watch the video for an excellent demonstration of this handy little trick that can save you a lot of time!

Digital lock Permutations - Locksmith Blog
Topic: Bypassing

There are many forms of the mechanical digital lock. Although a lot of them are quite vunerable to manipulation techniques such as button feeling. This Guide for example shows how to manipulate the combo dial padlocks by Master.

Most locksmiths carry around a list of permutations (linked below) for the xyz digital locks, it can take a while but it will work providing the lock isn't faulty.

However i discovered a nice little web-tool that allows you to calculate all the permutations for other variations of  mechanical locks. (Or any other mathematical problem)

If you encounter a lock that has no distinguishing button marks you can write next to them in pencil for reference

...and just for your info heres the list for the xyz locks, remember to prefix with a C

Another alternative is the xyz tool but from experience i have found it awkward to use and can make a mess of the door being so sharp round the edges.

What i have noticed when dismantling and code changing is that 90% of the time you have three active buttons on the right set of digits and two on the left (When looking from the rear of the lock). This means our code list could be optimised with those combinations first in our list to save time! However i havent found the time to re-arrange the list yet so you'l have to wait for that one.

Im also working on a list for the simplex codes but as there are so many permutations im re-ordering that in order of most likely first. Its going to take a while but will be well worth it.

NOTE: This has been abandoned upon discovering alternative bypass techniques!

Bypassing Gerda Locks - Locksmith Blog
Topic: Bypassing

A while back i sat down with a Gerda high security deadlock to see if i could pick it open.

Alas i was beaten... just couldnt seem to set all the pins although im sure it is possible.

I needed to find a way around this lock so dismantled it in order to understand the workings.



The back of the lock cylinder is attatched to a cam:



Once turned this cam lifts and slides the lock bolts via this spring loaded plate mechanism:

It just may be possible to bypass this lock if we can create entry to this plate, lift it (thus freeing the bolt) and then throwing the bolt back.

The ideal drill points to achieve such a bypass would be either side of the gerda cylinder angled inwards as to reach behind it.

It would require two separate lifts at each end as each end is spring loaded and ideally a thrid tool to move the bolt.

This would require the anti-drill excutcheon to be removed but often they arent secured properly anyway.

Note that this lock has a double bolt throw so the action may need to be repeated twice.

As of yet this is an untested method as id borrowed this lock from a fellow locksmith in Wolverhampton. As soon as i get my hands on another, its on like donkeykong!

Unlocking jammed uPVC Doors - Locksmith Blog
Topic: Bypassing

Its quite common in this weather that uPVC doors swell up, mechanism starts going stiff and eventually the user forces the handle and breaks the spindle in the backbox.

These can be a complete nightmare to open if you arent equiped with the right tools.

My father in law is a council locksmith and encountered this problem quite often so decided to sit down and design a tool for opening them.

And here it is: The bent screwdriver

firstly you will need to remove the cylinder from the door, preferably from the inside to make life easier.

This now gives you access the the multipoint locking rail.
Inserting the tool into the lower corner of the lock case will usually put you directly under the rail and allow bypassing of the spindle mechanism.





Rotating the tool will push the rail upwards and retract all the hooks and rollers in the door. This may require a little more force on some occassions where a roller may have gone the wrong side of its keep or the mech is very rough and stiff.



...and once its all unlocked the usual mica or airbag will be enough just to pop the latch.

Heres a quick 'one handed' video demo i made.

Shimming cylinders - Locksmith Blog
Topic: Bypassing