Crack any Master Lock combination lock in eight tries or less

by
in security on (#853A)
There's a vulnerability in Master Lock branded combination padlocks that allows anyone to learn the combination in eight or fewer tries, a process that requires less than two minutes and a minimal amount of skill to carry out.

The exploit involves lifting up a locked shackle with one hand while turning the combination dial. Before the dial reaches 11, there will be three points where the dial will resist being turned anymore. The three positions are then input to a web page that streamlines the exploit. The page responds with the first digit of the combination and two possible digits for the last digit. By testing which of the possible last digits has more "give," an attacker can quickly figure out which one is correct. By eliminating the false digit from the Web form, the page will automatically populate the eight possible numbers for the second digit of the combination.

It's by no means the only way to break the security of a popular padlock. It comes a few years after Master Lock engineers developed new padlocks that resisted a popular form of attacks using shims made from soft drink cans.
Reply 6 comments

exercise clothing opportunity? (Score: 0)

by Anonymous Coward on 2015-04-30 21:11 (#85GP)

So, this seems like the end of cheap gym locker locks.
Maybe it makes more sense to have one or two secure zipper pockets built into workout clothes and keep valuables on your person? They could be sport specific...padded/reinforced phone pockets in different places so they don't get smashed, etc.

Re: exercise clothing opportunity? (Score: 0)

by Anonymous Coward on 2015-05-01 05:22 (#863V)

Really, similar methods have been around for years. This is just the streamlined web 2.0 version. Just don't be the easiest or best looking target in the locker room and you'll be fine.

Naive user to date (Score: 2, Interesting)

by rocks@pipedot.org on 2015-05-01 13:54 (#86Z2)

So I confess to being a naive user of Master Lock combo locks at the gym for years now without knowing how weak their protection actually is. I would like to know what a slightly more challenging alternative would be for a replacement? I've seen the recommendation for an American 1105? Any others?

Old news (Score: 1)

by reziac@pipedot.org on 2015-05-02 16:51 (#88ZV)

When the user can feel the innards working, the user can figure out where to stop dialing. I didn't realise there was a specific procedure, but when I was a kid I'd snag "lost combination" locks from the trash and work it out by feel. Mind you this was 40 years ago. Apparently combination locks haven't changed much.

Re: Old news (Score: 1, Interesting)

by Anonymous Coward on 2015-05-02 19:20 (#890H)

My guess, based on vague memories of looking inside new and old Master locks (old from ~40 years ago, like you) is that it's even easier now--due to cost reductions. For example, what used to be machined from a block of steel, is now made from stamped out plates that are stacked up.

Re: Old news (Score: 1)

by evilviper@pipedot.org on 2015-05-03 05:40 (#898B)

I did that with the very cheap combination (and bike) locks myself, but it didn't work with master locks... The later would lock the dial and not allow turning it while there was any pressure on the latch/shackle. I guess they've changed that design in the decade since I last bought one.

Not to say that they're very good... The latch (was?) only spring-loaded, so that they could be closed without putting in the combination, which means either shims or one good swing with a hammer and the shackle would dutifully pop-free. That experience is why I NEVER consider ever using combination locks; I can carry a key around just fine, thanks.