Design Changes to the Kwikset SmartKey
ฝัง
- เผยแพร่เมื่อ 31 ส.ค. 2016
- This is not a picking video. Kwikset has dramatically changed the design of their SmartKey system, making it much more difficult to pick. I evaluate those changes and strategize on an approach to picking it.
- บันเทิง
![[153] Kwikset SmartKey Rim Cylinder Picked and Gutted](http://i.ytimg.com/vi/l0q0hNHZYsg/mqdefault.jpg)
Very Interesting & Cool To See The Two Designs. Keep up the great work. Nick.
Nice video. A couple thoughts: 1- Your idea is very similar to datagram's attack on the old style MT5+ sidebar (with which I had some very limited success). Though he did it so you could progressively tension the sidebar (i.e., bind one slider at a time). 2- Do the sidebar springs have enough tension to create audible feedback when lifting the pin/slider assembly? If so, that might be a good way to decode the lock... That particularly true since the true gate is HUGE, so close should work. 3- How new is that lock? I got a SK at Home Depot a couple months ago, and it had the old style sidebar.
Thanks for your thoughts on this, LPL! I didn't know about datagram's attack, so I'll have to look into that. I hadn't thought to check for audible feedback when lifting the pins, but you make a great point. I'll put a stethoscope on it this evening and see. I can imagine how it might, given there is always some pressure on the sliders being exerted by the captured springs. As for how old the lock is, I'm not sure. +Chad Royer sent it to me, so perhaps he can chime in on when he purchased it. He and I started talking about it in mid August.
to answer #3, I purchased this lock at Home Depot on Aug 1. It's the 985 series deadbolt. I found a blog post on the Kwikset site from January that mentioned an improved design that they were introducing in select models, and would be rolling out to all of the smartkey models gradually, so it's quite possible they haven't reached them all yet - it was rather vague. I just picked the right one out of dumb luck (and it was the cheapest with two cylinders)... I watched tumbl3r and a few others pick it easily and couldn't figure out why I couldn't feel anything at all in mine, so took it apart and saw it was different, and here we are now. If you want to get the same one, mine is Model #985-3-SMT-CP-K4, UPC: 883351025386
to answer #2, the sidebar springs are VERY light, and don't really give any feedback at all. I talked more about it in my other comment on this, but the pin springs are much stronger, so there's no chance of the sidebar springs providing enough tension to hold the wafers up once the gate is aligned. Adding pressure to that sidebar does give audible clicks when set (I barely noticed the false gates) but there's still a bit of springy movement when they are set because of the wide V shape in the gates until they're all set.
Chad Royer Great info... thanks. I'll have to try and track one down.
Thanks for the callout, I'm glad you're having the same fun with this that I have been. You're going at it slightly differently than what I've been trying with shims... I was trying to shim between the housing and the cylinder with a flat shim folded or curled on the end to try to put tension on the bar in that open slot about midway down the length. The problem I had with that is I could get a small amount of pressure on the sidebar - enough to feel the gates click into place, even - but not enough to overcome the pin spring pressure, so they'd immediately drop after I set them. I hadn't tried going thru the ball bearing hole there, but seems like that could work. The only way I've managed to pick it so far is with the cylinder out of the housing, and rubber-banding a small metal rod against that exposed part of the sidebar... cheating, obviously, but it proved that adding pressure there would work. I've killed a lot of shims trying to find a way to fold or curl it in such a way that it would snap in there and deform when pushed or pulled... I'm convinced if you could get one to roll up on the end as it's pushed into that opening, effectively creating a little barrel spring, it would work, but I couldn't quite get a shim to roll that small once it had been straightened again to get it into the slit from the front - there's only about .065" of space to work in there.
I really like your idea of rolling a shim up on the ned, Chad! A little like one of those New Years Even party blower things. I've got no idea how to achieve that, but I agree with you that it would almost certainly work. Some guys and I were tossing around ideas yesterday and one guy mentioned a two piece shim system that deposited a wedge inside the core and was then removed. I think this idea stands a chance, but an incorrect placement would be disastrous, and if it didn't work, it would probably become impossible to fix the lock.
Thanks for the great explanation. Looks like Kwikset has done a pretty good job here. I wonder if they did these changes to make the lock more secure against picking (what is probably a rare attack in real life) or for other reasons. Looking forward to see it getting picked someday. Cheers :-)
Here's an idea! Try bend shaping the pin with the corresponding depth entries, using a needlenose plyer and shaping it into the shape of the sidebar entryway, so that the tip of the pin will fall into place when it reaches the sidebar. Then when the pin is turned it'll put the sidebar in place.
After installing and messing up the re-keying process on my brand-new Kwikset deadbolt, I found tumbl3r video. I discovered that the plastic cover on the bottom half of the cylinder, was VERY lightly attached to the cylinder. When you insert the key in preparation to re-fitting the wafer-side of the cylinder, the key pressure on those little springs can cause the plastic shell to pop off and the 5 little springs to fly out. Be very careful here.
Hi. Very nice video. I recently had a smart key lock installed on a new door at home. I have been interested in locks for decades. So I did some research to see how the smart key system worked. I just viewed your video. It looks like the revised kwikset smart key system is a "dead ringer" for the general motors steering column ignition locks used on their cars from 1969 until probably the 1990's. These were the column locks that had the "ears" that were used for the rotational force. The keys back then were thin and weak against rotational force. The side bar was squared off to prevent it from being picked down by rotational tension. The quick picking method was using profile keys. Locksmiths would have a set of about 10 and the process was trial error. The other method was more destructive. It involved drilling a hole in the end of the lock face to access the end of the side bar. Then use a pin (such as you are trying) to provide force on the side bar to pick it down. The GM locks were not rekeyable so the wafers were a simple one piece design. Of course all of these anti pick devices took a back seat to the VATS lock systems that came along in the 90's.
Good eye! I didn't know it at the time, but Kwikset certainly did copy the GM design. Interestingly, some versions of these locks are vulnerable to force attacks too. It's a clever design, but without high-quality, hardened materials it's going to be difficult to make a lock that cannot be overcome by manipulation or force.
@@tumbl3r Good point about the lack of use of hardened materials. I guess, at the end of the day, the lock still needs to be affordable by being mass produced using diecast metal parts. Back in the day, another GM bypass method (even more destructive) was a slide hammer connected to a "cork screw" that was threaded into the keyway. A few good yanks and the plug came right out. One long screw driver was then used to start the car and unlock the steering.
Totally agree the AssaTwin is the machinist treasure to have beaten. I was never a fan of Kwikset because it’s lack of tolerances and builder grade evolution. The early versions of the Kwikset smart key were easily defeated. Now, The Square side bar under spring tension is what GM has done from the 1960’s. As a locksmith we would use Wiggle jiggle keys or more modern techniques were to use set of rockers blades. With GM you would use car opening tools and to make the ignition key, pull the wheel and lock and just replace it. As for the Kwikset, this newest design, it lends real locksmiths called in for a lockout two choices, rake and rock for 3 or so minutes, then drill. I don’t see how a bump key would ever work - so for that, I applaud Kwikset. I would be very interested in tumbler 3 non destructive pick or manipulation of this lock. I say, exploit the tolerances and gaps.
Just a thought could you take the reset tool and apply pressure once you have it picked to release your tension wrench so the side bar will drop and thus allowing the cylinder to rotate???
i was going to buy a new schlage or kwikset deadbolt at menards. any recomendations on model? its for residential.
Anyone know if this design change with the squared side bar, will strengthen the core against force tool attacks ??
No telling but theirs the decoder from locktech for any series of smartkey so least for the pro that wants to spend the money on the decoder wouldn’t matter much if it’s titanium
It seems however that if u used a kwikset rekey tool to put tension on the wafers and then proceed to pick, u could then get an open on the lock.
I've got an old Gen2 SmartKey that is sticky and wonky and absolutely refuses to cooperate. If you apply ANY tension whatsoever everything binds up like it's welded together. Even if you get some set and remove tension, nothing releases until you apply reverse tension. And if you try to manipulate in just the right way, the wafers will slip and change the keying so the key won't even work. It's an absolute beast to work with.
Will this new core design fit the old SmartKey locks and will Kwickset provide them as a warranty replacement?
How can I tell if a Weiser SmartKey lock is the second generation? Without disassembling the core. I bought it in 2013.
Matt P the box will be black. were the old ones were red
Wondering why a squared off side bar was not done in the first place. Also, is there a lesson here of something added to the manufacture of a plain pin tumbler lock to similarly deny tensioning.
awesome video (from 6 years ago no less)
My first thought is: is that bar made out of a ferric metal?
What about the springs used?
Will a strong magnet on the side of the lock be enough to retract the bar?
Or at least take the push out of the springs?
Justin Sidder like sparrows magneto rare earth magnet
I lost one of the little round springs that gets trapped between the c-clips what can I do
I wonder how much it would add to the cost and help to plate the surface with titanium so that drilling isn't possible without an expensive drill, bit and a lot of strength and time. That should even save the lock from that attack almost every time.
what if you ground down a kw1 key to the bottom and left some of the bow. on the key and used it as your tension to control the sidebar
Good idea
Hey, i think i may have a solution to your tensioning problem, i been trying to pick this thing for a while and i "accidentally" rekeyed mine to something other than the key i had for it, as i was pulling it out, the sliders got stuck on the outercore and as i pulled on it, they would bind and i would pick them one by one until i got the core out and rekeyed it again manualy. However it gave me the idea to use the rekey mechanism as a tension device, it seems to work, you push on it with force and it bind the pins but not the sidebar, give it a try, i have not been able to pick it, but the pins do bind
Were you ever able to pick it w the rekey device or any method / tool?
please could you tell me the name of this law it did not mention it other than that it was a Kwikset Lock..
. but does it have a name or an order number or anyting to identify it that you can purchase it thank you
For hobby pickers, please consider posting more detailed picking hints that define that lock's Kwikset Smartkey generation.
I've looked at these posts:
Charles builds crap
Michael Gilchrist # L21
Jamie's locks #25, 29
loupgarou21
Artemis picks #21
tumbl3r (post and "design changes")
Cordially,
Gary Bowman
the other posts didn't get listed. They are: Michael Gilchrise L21, Jamies locks #25, 29, loupgarou21, Chris Ahrens #68, 139, 21, lockapalooza #4, MrBlack-magic #57. From looking at the face of the lock how can one tell if it's a gen 3 needing the shim to pick?
Also, would using the shim make picking gen 1 and 2 easier?
What about that tiny hole at the front left to the key hole
dose a screwdriver still work? seems like a lot of work and time and effort for a design still plagued with force flaws.
Hi Wayne! Thanks for your comment :) I'm not sure how effective the force attack would be on this generation. Am I correct that the force operation wedged the sidebar into the slider / wafers, deforming them? If that's the case, I don't believe a force attack would work, at least in the same failure mode as the previous generation. All the force of the rotation would be driven into the body by the squared off sidebar. The plug and body are still made from very cheap metal (zinc?) and it seems likely that you could apply enough force deform those parts sufficiently for the plug to turn. It might just not continue operating in most cases as I'm told it did with the previous generation. Anyhow, that's all speculation... I've wondered the same thing myself, but haven't gone down and bought another one to play with. This one was on loan to me so I didn't want to damage it. Thanks for watching, Wayne! I'm a big fan of your channel and videos, by the way!
Thanks! I like your channel too! I think the plugs on the new ones gust sheer and break away in the new ones. Annoying and more difficult to force but still plausible. I actually have a bunch better bypass for the deadbolts but can't post it here 😉
I'm sure you know by now that using the Kwikset smartkey inserts to actually change the key code depresses the sidebar and will allow you to tention lock and pick it.
I agree and have partialy tested, but due to a lack of a vise or 3 hands I couldn't use a pick from the front, only poke the waffers into alinement from the side and then turn it , I wiil fully test when I get a vise.
If kwikset were to block access to the reset carriage until it is in the unlocked position, this would not be usable.
if they made a lock that was only designed with the side bar, sliders and dummy pins, that was solid brass it would be unbeatable.
Isn't it funny how the locks you pick that you're proud of aren't that popular? Man, I feel it... Nice pick on the Assa!
plug spinner? get it picked (can you pick it to operating sheer?) then use a plug spinner
Does the keyblank and bar still work to brute force the lock?
Wow! Fancy ass locks!
Hi tumbl3r, I have not been able to find anything else more recent on your channel about the redesigned Kwikset SmartKey. Would I be wrong in assuming this video stands for now; that you still conclude the new SmartKey design is extremely hard to foil? For the record, I googled Assa Ruko Twin 6000 and it's very hard to find for sale! (No I am not asking you to talk about the Assa... quite the opposite, smile.)
Edit: I just called the Kwikset 800#, the rep said that any box dated Sept. 2016 or later (on the bottom) will definitely be generation 3 SmartKey. For all products, all ANSI levels. So this is something I could look for. [UPDATE: ANOTHER KWIKSET REP SAID THIS IS WRONG, only Uptown and Downtown deadbolts are gen3 as of March 2017 with no current plans to extend it to others. See my reply to tumbl3r's reply, below.] He also said gen. 2 cylinders have a black plate on the side for quick fixes by locksmiths, but gen 3 does not have that. I guess he is talking about the little bar you remove at 6:01 of your 10:19 video "Kwikset SmartKey - SPP Pick & Gut"?
I might add that as soon as I asked the Kwikset rep about the lock you said was tough, he said he knew of you, and launched into a spiel about how you manipulate the locks so you can pick them. I had to talk over him to get him to stop telling me how you're wrong... the reason I was calling to find out their latest generation was because tumbl3r is saying they're quite good! So if tumbl3r is wrong, the Kwikset rep must be saying SmartKey is quite bad! lol
For the record, I don't believe a company that won't simply say when they made a mistake. Everybody can make a mistake; everybody can improve. But you should not make a mistake *and* say the other person is wrong about it. So I don't buy it when they say someone else is wrong.
Thanks so much for your videos! They really help inform us. We can't all be good at everything, so we all help each other. (Also, we don't all want a work of art... just a smart choice acknowledging ease of use and budget.)
Hi Mike,
As far as I know this is the most current work done with this version of the SmartKey. I was working with a borrowed lock, and I have not gone out and picked up another one to work on. There are a few ideas that I think will ultimately prove viable, but for now I've been focusing on locks that I find more interesting. I don't know of anyone who has managed to pick open this version of the SmartKey and it is 100% correct to say that this lock is extremely pick resistant. That does not necessarily mean they are "good" though. I am not a locksmith, and I cannot speak to the wholistic security of the system, but I will say that the SmartKey is composed of what appears to be potted metal, which is almost certainly not as strong against forcing attacks as more conventional pin tumbler systems made from brass.
The previous generation SmartKey was susceptible to a forcing attack that worked while often leaving the lock in a semi-functional state. The materials do not appear to have changes substantively in the current generation, so that would definitely be a concern for me if I were considering them for my home. Wayne Winton is a very good locksmith and has made a video about the differences between the SmartKey and the Schlage systems (th-cam.com/video/J9pgqBSGD0s/w-d-xo.html). He also has some other good videos about how to select the best lock for your home. Criminals almost never actually pick locks, so resistance against bumping, forcing, cutting or smashing is a much more important consideration.
It's funny that the rep got all spun up, LOL. Having lock companies frown on what we do and claim that we are faking it or otherwise "nerfing" the lock is just part and parcel for the sport. All I can really do is be as transparent as possible. One shot, no cuts, disassemble the locks and show detail of their components. There will always be doubters and I'm certain that the person you spoke with genuinely believed what he was saying. These companies (and their employees) have a financial interest in this stuff, and I can respect that. My intention is never to poke fun at lock companies or criticize them. On the contrary... If you see me working on a lock, it's because I find it interesting. On the other hand, it would be nice if those who say it can't be done would kindly step out of the way of those of us who are actually doing it, LOL. Oh well :)
Thanks for your comment and for your kind words :) Hopefully the thoughts above are helpful to you. Like I said, all I really do is pick locks and I don't spend a ton of time thinking about the overall security of the entire system. I've been very impressed with Wayne's work in this area, so between the two of us, hopefully you will have enough good information to select the right product to protect your home. Take care and thanks again for your comment.
Thanks so much for the reply tumbl3r. I see what you're saying. It makes a lot of sense.
In case you or other locksmiths care, I found out some more info. In a second call to Kwikset, a guy in their Warranty department said that actually only the Uptown and Downtown single-cyl. deadbolts are gen3 (and have been since July 2016). He says you can check their site and see that they are the only SmartKey locks saying this. They call it Advanced SmartKey security as you can see on their site (kwiksetpresskit.com/ibs-fact-sheets-2016/uptown-and-downtown-contemporary-deadbolts-fact-sheet) or on Amazon (www.amazon.com/dp/B01BUG6KBU?th=1). He said all other locks have been gen2 since 2012, and he said they have no plans to phase gen3 into other locks "unless these ones catch on". He sounded pretty lackluster on that, as in, don't hold your breath. Finally, he said the previous Kwikset rep was wrong.
Thanks again for your holistic advice. I hope this helps a little, too.
@tumbl3r The link to the Wayne Windon video doesn't work. 404 Error.
Love your video on the changes to the kwikset.
tumbl3r That video is almost certainly a paid product endorsement (or another marketing strategy) for Schlage. A door can be kicked in just as easy using each lock, but using a Kwikset gen 3 keeps picking novices out and doesn't take 1 minute to pick.
MrCarGuy20, That's why there is advice available to make your door more kick resistant. If your door frame and door is installed properly, with an inexpensive upgrade, even the toughest burglar would rather go through a window, or even the wall. Even if they have to climb a tall ladder outside to get there.
Just bought this lock to try and pick and am struggling
@S T oh I have a ton of old locks that I practice w .. Just run to these a lot at customers homes and wanted to just try.. Good advice tho
Can this lock still be forced open as the others? Thanks
I don't actually know. I suspect not in the way that the previous revisions can be. Probably with enough force the zinc housing would deform, allowing the lock to open. It would not, however fail from inward pressure on the wafers because of the squared off sidebar.
You will see many changes with Kwikset and Weiser since they are now owned by Black and Decker. Weiser was instantly changed to Kwikset and can no longer get original parts.
My kwikset keeps loosing the ability to use original key...y?
Too bad the spring cap is now plastic. also what's with the huge gap between the end of the housing and where the clip sits?
I'm pretty sure the spring cap was always plastic. I agree it would be nice if they'd use a better material for that. The gap is to allow the slider carriage to be slid back in order to rekey the lock.
odd that the housing needs to move with the carriage.
the housing/cylinder doesn't move, just the carriage. there are two spring clips, one that holds the plug in the sleeve, and one that connects holds the core assembly in the outer housing.
The plastic spring cap really isn't important, as it's encased in the metal housing in real-life use, so it's supported/contained and doesn't warp like you see it with the core removed.
so there is one spring clip holding another?
The side bar has the two clips already applying down ward pressure, so using the pin forced into that side bar slot will only bind the lock more causing you to use even more pressure needed to turn the cylinder. Try to use the lightest turning pressure possible and lubricate the lock first. A heavy hand is the true failure of picking most locks.
This is incorrect. Chris Ahrens has proven out the theory of this exploit and used it to defeat the Gen3 SmartKey about a year ago. We worked together on the project. Since then many others have defeated it the same way.
The "use light tension" mantra represents a somewhat viable approach to open one very specific type of fairly mediocre lock. Sadly, that dogmatic approach to tension became pervasive, and actually prevents a lot of people from defeating anything other than average locks. The correct tension is that which gets the lock to respond. Sometimes it's light, sometimes it damn near breaks your tension wrench.
Do you have a video of that by pass? I would be interested in seeing it. I am still and have been a locksmith for 34 years, but any tips are always welcome.
Here's the video Chris made picking it with this exploit. th-cam.com/video/H-9_3gIQwPw/w-d-xo.html&t
My fiancee got me a Smartkey padlock for christmas. After watching Bosnianbill's vid on raking it, I gave it a whirl. After a few hours it cracked open, but couldn't recreate it since. I didn't realize that there was a potential change until I saw this video so I tested the lock by torquing the key while inserting it and the lock was jammed up so it's Gen 2. How could I have done this? My only thought is that my triple peak almost lines up with the key's bidding at the right angle and I got really, really lucky. Have you had any luck with the Gen 2 since this vid was posted?
If you put tension on the core and the pins bound up, it's a Gen 1. This is because the triangular shape on the outside edge of the sidebar is attempting to ride out of its corresponding groove and jamming itself into the sliders (which are, in tern, connected to the pins). If it were a Gen 2, you would tension the core and the pins would all be springy and unresponsive. The this is the distinguishing feature of the Gin 2... Tensioning it does nothing that translates to the actual slider / pin subsystem.
huh... The pins are binding when I put tension on the core while picking, but the key won't turn if I put tension on the core first then insert the key completely. It's not until I turn the key counterclockwise that it resets and it will freely move clockwise to open.
I wonder if maybe one or more of the pins are being overset as you put the key in under tension? Seems like if a binder is a low cut, it would just stay at the position of the highest cut on the key.
Good for a challenge but it's a Kwikset. Drill and replace .... done!
I'd like a lock that requires you to stick your hand in a hole, reads biometrics, asks for a passkey that needs to be typed on a pad (which is unmarked, automatically cleaned and thermally evened out immediately after each use, with access blocked until finished so no scanning tools can be used) hidden in that hole, another you have to speak and a restraint behind the hole holds onto you until police and an authorized person arrive if you are not authorized to enter.
like to find a bypass for the smart key... seen the destructive bypass but need 1 thats not destructive
Yeah, I don't find destructive bypasses to be all that interesting, so I don't really focus on them much. I'm far more interested in non-destructive techniques, be they bypass or picking. I'm honestly surprised that Kwikset has put this much time and energy into pick prevention, although as I think about it, its possible their primary goal with squaring off the sidebar was actually bypass prevention... Not sure.
For sure there Zombie, And that is the reason the Kwikset smartkey is your most popular video is because you are catching people in general as well as pickers that want a better way in. Most pickers can't stand that kwikset is getting so much better plus it is the big rage at the Box Hardware Stores. Well that is why I think it has so many veiws.
You're probably right, but I'm not sure why pickers would be upset that the SmartKey system is improving. Don't we generally attack these systems with the rationale that doing so contributes to the overall improvement of security writ large? From where I sit, this is pretty cool and innovative solution. Sure it has its problems, but it also doesn't share the century plus history of the pin tumbler design.
+tumbl3r Yeah I agree with you, there are many different types of locks that were the best in there time. So a lock getting better is the best thing for pickers... Increase the challenge.
I'm pretty sure the changes were to prevent the forced entry (screwdriver) attack. Improvements to picking seems like a nice by product. I'm now wondering with these improvements if it's good enough to use on my house? (I'm specifically interested in the Kwikset SmartCode 916 - hoping it has the updated cylinder.)
I love kwikset it’s the best largest manufacturer in the world and their new smart key is invincible other than reading it with the camera inside you basically can’t pick it. I had somebody tell me they can drill it, but why bother you can find other means of access
Yes tensioning the side bar is the trick until a countermeasure blocking the shim entering past the ball bearing into the side bar is designed. Imagine bumping is technique of choice for nefarious characters and this lock seems better at resisting that.
Is it unpickable?
No. It can be SPPed. All generations can.
I would had loved to had seen Schlage prevail in the lawsuit brought against them by Black & Decker; frankly it was stupid because there was a prior art from over thirty years ago, and the Schlage SecureKey was a better design than the SmartKey to begin with.
No, just, no. Schlages SecureKey was garbage. Almost all of them failed on their own during regular use.
Chessguy125 : ... Agree 100% .. they were very fragile ... retail return rate exceeded100% because of multiple returns ...