It looks like it's a manufacturing thing. The bent over part must be "cut in" to stay flush with the rest of the metal sheet after being bent 90°. (not talking about the drain hole, but the inner inlay sheet metal)
@@plpGTR It doesn't necessarily need to be single-function. If they need to have that indentation anyway for ease of manufacturing, then they can arrange the assembly in such a way that it "just so happens" to point downwards so it also functions as a drain hole for accumulated condensation. And _additionally,_ it can serve the extra purpose of being an emergency mechanical bypass for when the lock fails and it needs a way to be opened. I have to wonder what the installation instructions mention; do they specify to position the hole in such a way to make it more cumbersome to enact such a bypass? Are there additional fittings included in the installation kit to block access to the hole while still allowing it to do its drainage job and be available for emergency bypass when needed by removing said fitting? I'm reminded of when, iirc, an Air Force budgetary committee asked for justification on why a particularly expensive power wrench was needed. The response was that it was a multi-function tool: it could not only tighten bolts, but loosen them as well.
@@plpGTR this metal doesn’t appear to be bent though it would most likely be cast. Meaning the slants were intended and I agree with other users it’s most likely designed as a bypass.
It's a thing in the locksport community. When you're videoing yourself opening a lock, you're not allowed to edit the video to prevent accusations of shenanigans.
@@h.a.9880 Isn't that how bank vaults work? If you try to break into the vault, you'll either raise the dead with the noise or take all night. I think.
@@TheQuark6789 idk, the issue is easily solvable on the consumer side and it has avoided the common flaw among its genre. That means it’s effectively defended itself against an industry wide exploit that someone targeting the genre in general would tend to use Basically they passed the electronic version of the bump key test
This is my concern too, surely people will use these exploits faster than fixing them, though it is necessary since this technique must be quite well known already before Anon tells LPL about this. Plus the drain design kinda sus as if it was intended. Nometheless I think it is better to know about your lock rather than not.
@@the_kombinator The drain hole is there for a reason - to protect the electronic components inside. Blocking it could fry the internals if water builds up. Then you have a useless lock that can't be opened at all.
There's a story about a man who was tasked by a wealthy noble to make a lock that could never be picked. The story goes that a particularly audacious thief would pick the lock on the front door at night and make off with a variety of jewelry and silver utensils which irritated the noble to no end, so he went to the town blacksmith and tasked him with designing a lock that would be 100% unpickable, then install it onto ever exterior door in his home. The blacksmith tried to tell him that no lock was completely impenetrable, but the nobleman would not relent, so the blacksmith agreed. Days went by, and the nobleman received word that the blacksmith had completed his task, and that he should take a stroll while the new locks were installed. When the nobleman returned, he found a rather impressive looking lock installed on every door. "No one will ever be able to get through this lock, milord" the blacksmith said. "Splendid" the nobleman replied, "but where is the hole for the key?" "Hole? For a key?" the blacksmith asked. "Yes, a keyhole, so that I can unlock my door." "Sorry milord. A lock that can never be picked, is a lock that can never be opened." The noble was furious. "How am I to enter my home, then!?" The blacksmith scratched his head for a moment, then said "Wait for the thief. When he breaks in through a window, ask him to unlock the door from the other side"
@@zcabage In the UK, we have a House of Lords. Some of those in the House of Lords, are nobles. Thus, a nobleman can be referred to as my lord, and be correct. However, quite simply it could be a case that: 1) The blacksmith is just engaging in good customer service 2) The nobleman is the owner of the land that the blacksmith lives on, hence making him the lord over the blacksmith.
You can't tell me they angled that drain hole towards a gap in the housing on accident. That was a backdoor intentionally put in there by the manufacturer. It's not a flaw, it's a feature.
you know I'm sort of inclined to agree that its a back door of sorts... that batteries clearly go on the inside of the door, what happens if they are stone dead... sure the lock will warn you the batts are going flat but what if you just don't act on it?
@@yandyyay Those two metal dots on the front towards the bottom are there for you to hold a 9V battery to it. This powers the electronics and allows you to scan your credentials and get inside in the event the internal batteries died. If anything, it is there for if the motor/electronics fails.
Those would both be marketing and tech support arguments. Design team would mention the no pick excuse but focus on redesigning the labyrinth navigated by the wire. A more fundamentals focused engineer would redesign the motor linkage to not be pushable.
A pick: Object(s) inserted into the internals of a lock and manipulated in a nondestructive manner that allows unauthorized entry. I see an unpickable lock that was just picked.
The biggest flaw of all is that the part that does the unlocking is on the outside. On an electronic lock, in a good design, it should always be on the inside.
Yep. The bypass isn't hard to prevent (at least, you're trying to prevent non-destructive entry easy) but there's no fix for vulnerable components like that.
Drill a hole to the right of the drain hole (as seen from the rear). Put as long of a machine screw as you can in, with a nut on the inside, to prevent a wire from going straight to the opening. Test it; Add nuts if necessary.
@@troy3456789 Now it can be opened with a bit of wire + a screwdriver. Easiest option is to just fill that void with tightly packed steel wool. It'll still drain water so you don't end up with a short after months or years outside collecting water, but it'll block that wire so long as it's packed tightly enough
@@vakieh4381 I'm thinking the nut on the inside will turn if you use a screwdriver from the outside. A nylock (locking nut) would help too. The idea is to cause the wire to divert to the wrong angle. (Hole drilled on the side of where the wire goes up; not blocking the important drain hole) Steel wool seems messy and won't stop a stiff wire like what he used in my opinion.
The “drain hole” is actually angled towards the mechanism that unlocks it so it’s easier to get something in there to unlock it. After this video, price for the whole lock kit is going to be on sale for $19.99 and infomercials at 2 am 😂🤣
But wait! There's More! Buy 1 lock, get a second lock FREE! and as a special TV only offer if you call in the next 125 minutes, get a free bottle of epoxy seal to stop the exploit for only a $1.99. But wait! There's More!... ...Tiny super fast legalese text scroll with a fast voice over explaining shipping costs and no liability if the lock is picked....
I would assume because of the shape of the hole and the slit that allows the wire to reach the inner part that is is actually a "feature" that allows the lock to be opened with a special tool e.g. when the battery is empty or the key card broken.
Holy crap! This one is huge. I can see lawsuits if Schlage doesn't bring out a retrofit kit to block where the wire slips between the guard and the screw post. Wow, when a company like Schlage misses such an obvious exploit for years on such a critical product, Master Lock doesn't look so bad any longer.
All I can think of is some guy with Autocad running designing that housing and being told "there needs to be a drain hole" and then saying "but then someone can stick a piece of metal up there and bypass the lock". And an argument ensuing in which the engineer tries to take a stand, but the product manager is like "overruled" and then the guy just says fuck it and goes to lunch.
@@rmyers99 Nah, it's the engineerings fault in this case. The stamped steel piece is supposed to be shielding against this exploit (after they forgot that in the casting), but they chose the one manufacturing technique that wouldn't actually work because the radius they need for the srew hole leaves this one hole through which LPL could fit the wire. Had this shield been made any other way (molded plastic for example) it would have worked. Should instead have made the actuator that sees machanical load out of steel.
@@BL-yj2wp I'll certainly never bet against cost reduction; but my assumption was that the plastic component was plastic, in surroundings that were mostly metallic, because that's one way to keep otherwise trivial magnetic manipulation from being an issue. Probably not a coincidence that plastic, rather than one of the more expensive nonferrous metals, was chosen for the job; but still a questionable place for steel.
I agree! I have for a long time been impressed at how very professional his videos are. Of course, one would hope that a court lawyer who practised in commercial litigation would be able to do a clear, professional presentation in "one take"; judges aren't impressed if a court lawyer asks for a do-over!
@@GigaBoost It's to maintain integrity, or at the very least, prove without a shadow of a doubt that he isn't manipulating any of the locks when he reviews them. It's also why he often picks locks multiple times, to prove his success wasn't a fluke. The benefit of being allowed to be lazy is just a nice bonus.
for college dorms, it would prolly be feasible to 3D print a small high-infill insert that fits in the area between the two bottom screw holes that still allows the drain hole work as a drain but blocks access to the mechanism by being braced against the casing ...but most colleges will prolly spend hundreds of thousands to replace the locks and charge students for it 🙃
Yea they wouldn't have put a drain hole unless they found it necessary during testing. Especially if these are mounted on an external door more subject to the elements those electronic components would likely stop functioning correctly.
@@Joe45-91 The case is metal, so when the temperature drops, all the moisture from the air inside is going to condensate on that metal. Without that wall, you'll get a small puddle on the bottom.
@@Jake420 Yes, it is, hes saying that he would have never thought from now till ten years in the future he'd watch lockpick videos for fun but he is now. Also the sobbing emoji doesnt mean Im actually crying, its used in this context as a way to say "bro what is this/what are you saying/bruh"
If you look closely to that drain hole, it has an angle pointing directly on that plastic block, as if it WAS designed for that exact purpose of bypassing lock mechanism.
@@zuttoaragi8349 - Most likely, but it is a very terrible bypass system when even the most unskilled thief can easily learn this, or get it to open accidentally by a little prodding. Much better to just add a good secondary bypass keyhole if the electronic shorted.
LPL: "Hey, honey, how's college going?" LPD: "Great, dad! They just upgraded our dorm locks to these fancy new smart locks." LPL: "I'll be right there 😐"
I just tried it on my apartment lock and it worked, it is a slightly different model and outdated, but that is literally terrifying. I had no idea what I was doing but I did it on the first try
My father was a carpenter and was hired to fix a door to a house that was broken into. When he arrived, he found the door with about 4 deadbolt locks still locked, however the thieves had just removed the outer casing and pulled the door, still in it's jambs, right out of the building, set the door and jambs next to the house, and walked in. Your locks are only as good as the jambs in which the door is mounted. Front door jambs need to thick and set into the house frame with large nails, though bolts are better.
@@edward1927 You could just take a sawsall to the wall next to the door. After all, it;s just some vinyl or aluminum siding, a sheet of OSB or plywood, some 2x4s, and a sheet of drywall. My dad told me a robbery he saw on the news where the burglars used a cordless circular saw and just cut the wall open.
I had a mountain side cell site to work on and the Supra dead bolt had a dead battery on the door. Hinges were outside and just popped the pins and in we go.
Generally speaking, you don't have a lot of thieves showing up to your front door with power tools and looking to saw through the wall for the obvious reason that it's not worth the time, effort, and risk to do something you can accomplish by just kicking the door in.
"I can open this in just a few seconds with nothing but a thin piece of wire" Now we can debate the meaning, but "open using only a thin piece of wire" seems like a decent definition of "picking" to me.
right at 4:10 where he says "you turn the wire", that wire is passing over a perfectly placed recess in that inner metal bracket. between that and the way the "drain hole" is angled perfectly to feed the wire right where it needs to go, this _has_ to be a deliberate feature not a bug
would it be dumb to assume that its a "secret" way for a lockpicker that specializes in these locks to get it open if the owners lose their credentials to open it?
Exactly what I was thinking. This has to be intended, although they meant it to only be known to locksmiths and security personnel so that they can let people into their apartments. It was definitely not intended to go beyond professionals/intended people.
@@kasper_429 that’s the issue, it’s like having a master code that’s the same for every safe of a particular model. Those out of the loop won’t know but the second information breaks out it’s just free hunting.
@@kasper_429 But that's not how security works. It takes one person to know the secret to share it maliciously or accidentally and the whole security falls away.
That’s what happens when pool of qualified engineers who can design locks keeps shrinking and brands only rely on their legacy brand names to market products to mass consumer.
I bought a similar kee pad version that uses the same mechanism earlier today. Upon opening it up I was happy to see that Schlage had included a sturdy piece of plastic that blocks the drain hole while still allowing water to get out. Now I leave it to you to find a way around this new feature.
4:09 that security flaw is entirely because that's a stamped piece of metal. I can see that there was clearance made for when the round segment got bent down in the press. If it was a solid piece of material there would be no gap for the wire to fit through.
One solution would have been to just extend the length of the guard piece so it could be bent 180° at the end to block off the opening left by the screw tab.
@@HarveyDangerLurker it's just a part of the manufacturing process. Stamped parts are cheap when you need hundreds of thousands of them, and regrettably you need clearances built in for it to work.
The whole design is very weak for a 300 dollar product. One can just drill a little hole at the bottom until they see some plastic shavings and then easily manipulate the lock with any stick that fit through the hole.
Im kinda hesitant to call this a design flaw. The way that it works makes me think Schlage left it there on purpose,just that they were also hoping people aren't aware of it
@@riku861 I thought the same thing at first, but if you look at the outer face of the lock, you see there's two little rubber circles below the doorknob, indicating under those are terminals to supply power in case of dead batteries.
@@juukyll That should work assuming the unit retains all its passkey programming with a dead battery. Those terminals should also be protected with a diode, should the polarity be applied in reverse by accident, or if someone mischievous presses a 9v battery to the terminals.
ive been a thief for about 2.5 years now and i want to thank you in how much youve helped me throughout these years! i love it when you upload and each upload gives me more progress in my journey 🙌
It's not as if water cares if the hole is angled or not - and a simple barrier over the drain hole and under the plastic bit (so that any water would flow around it) could have prevented this...
The worst thing is that this is clearly a feature meant to be opened from that hole if the batteries are death, so probably not going to be changed by the lock creators any time soon.
It looks like the lock has a spot on the front to hold a 9V battery to the lock to power it in a dead situation, that is probably coupled with an installer RFID fob that is default and doesn't require registering. (For which cloning that fob might be another vector)
No it's clearly a drain hole. They expect the lock may get mounted on the outside of a exterior door. The PCB is clearly potted to help with water resistance. The hole in the bottom is to drain the water so that the lock mechanisms don't get eaten up by water too fast.
I can't explain why I like these videos, other than that I like tech... Where I live in Thailand, I haven't locked my car, house or bike in 20 years. Here there is a community vibe that is way more secure than any lock design.
We had these all over the one large condo complex I worked at to keep guest out of employee only areas. Sometimes we would find stuff rearranged or missing after spring break groups came through. I'm guessing more than a few people already knew this trick. But truth be told there is no such thing as a Pick-Proof lock. Any lock can be opened if the thief is determined and has enough time. Locks are only there to slow them down.
A lot of the time you only need to wait for someone to come out, nod to them with a straight face, and just walk in as if you're supposed to do that. Not in small places, but the more employees there are (or residents in an apartment building), the less likely they are to say anything.
This seems a very easy problem to solve too. Just change the shape of the drain hole to be 'Z' shaped. I.e. a couple of back and forth returns, and you wouldn't be able to get a wire to trace into the area it needs to be in.
@@pontoancora The hole on the bottom of a padlock allows water to drain. This prevents the padlock's internal mechanisms from rusting, so they can continue to function properly.
It seems like electronic are the worst because they need a physical bypass that's different from their main security features, so they're usually skimped on.
Seems like the quick fix for Schlage here would be to just whip up a small metal plate that slips into the base of the lock body there, and would be held in place with a couple of bent tabs that fit over the screw holes.
"Sir, good and bad news. the Lockpicking Lawyer has a video about our lock up. Good news, it's over five minutes". "That's great, usually bad locks are opened in like a minute. What's the bad news?" "The lock is opened in 5 seconds".
I worked security at a high end apartment complex, one of the residents asked me to switch their FOB from a card to a key chain. When I went into the system I found out that this resident had FULL ACCESS to every single room in the building. The minimum wage security guard who set up the FOB accidently selected Master Key status instead of Resident.
It’s not a drain whole, because it is sloped in the direction the wire needs to aim. It is a bypass, like the one designed into interior lock sets for bedrooms and bathrooms; so the lock can be breached in case of an emergency or accidental lockout. In the scenarios where this lock would be used, it circumvents lockout due to a dead battery. Likewise, the internal gap next to the screw is intentional. That is where I would block the intrusion, if I preferred to cut a hole in the door or wall when the unit is faulty or the battery dies. What this unit needs is an ability to connect an external power source, like induction with no holes, when the battery dies.
Looks very fixable to me, both by the user and by the manufacturer, either by replacing that metal shield, or by adding one small part that will obstruct the path. It doesn't even need to completely block the drain hole.
yea, I'd slip that metal back plate, that's held with the Torx screws, in a vice, and bend the bottom just enough so anything put into the drain hole would have to do some kind of reach around to make it in.
You could also re-engineer the plastic "clutch" for the knob with a stiffer spring or something else to prevent a slight push from a wire being enough to pop it into place.
As others have said, this looks entirely intentional, most likely as an emergency backup for when the batteries (only accessible from the inside) inevitably die when there is no one inside the room to open the lock.
Those two little posts at the bottom are to hold a 9V battery against. That's how you get Schlage models to work when the battery dies. (I guess the theory being that it's better to hide a battery than a key.) :-)
Why would it be intentional if they never even provide users or the locksmiths with documentation. Schlage is not coming to your house to unlock it for you. This is 100% bad designing. The 9V terminals are for the “emergency” backup function
True, the pins being there for the 9v battery to powerup the unit in the case of dead batteries would help in the case of that but I could see this "water drain" being used to unlock the door in the case of electronics failure. Which would help aid the owner gaining entry, but also leaves a opening for it to be exploited, but if this is used in a business sense someone using this to exploit the lock to gain access to an area they don't have access to is gonna have alot of explaining to do which is most likely gonna end with them being fired, plus security cameras would also be watching most likely.
My building in NYC had relatively secure Mul-T locks/deadbolts for years... Then 6 months ago the management co. decided to put something just like this on all our doors.. without an option. I actually went to the office to complain saying they were ridiculously unsafe but they didn't want to hear it. Too bad this video wasn't out then.
I'm a big fan of Schlage for run of the mill locks. But only their old style mechanical locks because I'm also a big fan of the "KISS" principle ;) I see a separate issue with that little plastic piece. I live in a VERY cold part of the country where winters are not at all kind to flimsy little plastic parts. They've got a spring coupler between the solenoid and the plastic piece but just the same I wonder what some -30F weather will do to that plastic when the solenoid activates. You may need to know that bypass to get into your own property.
I'm maintenance at 2 multi unit apartment buildings. Only had to drill one lock out so far. But I'm trying this on the FE410F model. It seems to be next to impossible to accomplish. But I'm going to be trying it out. Problem is that you have limited range of motion when it's mounted. And the backplate is recessed a little bit. Only other problem with these locks is the plunger part that moves the plastic locking mechanism. If the building is settling, it effects the doors most noticeably at this part because there is friction between the door jamb and the barrel bolt. Forcing it to work weakens the metal ring the plunger is attached to and it eventually fails.
I just picture all the upper management and design team in a conference room sitting around a huge table with their head’s down and the CEO just red faced yelling at them with this video running in the back ground.
For that price point, they could put a little more space between the drain hole and the plunger point and make a maze where a wire can't go through but water can drain.
I could see this being fixed by a little plug like the ones Sparrows sells for other Schlage locks that had a similar exploit. They looked like a funky hairpin, but they'd snap in and still allow it to drain, let the parts move, but prevent things from reaching the important bits in a lock.
Yes but, i can't drill just another hole besides it? Who looks there? And how often? After what time might this new hole be detected? Could this then be traced to my person? If i would detect such of course I would first say nothing but build a trap for the exploiter, he may come again.
Once the exploit is known, it would be easy as piss to drill a small hole in the bottom of the enclosure, open the lock and then cover the hole with grey/silver putty and no one would ever know.
I see design flaw#2! Double A batteries are prone to leaking when left in long storage unless you use rechargeable batteries. I can definitely see the casing covered in that crusty battery acid leakage because someone actually believed the "Extra Heavy Duty" claim on their Dollar Tree Sunbeam battery package! "Old grandma Betty got locked out because she ruined her lock, better use the wire trick! "
There is a way to power the lock from the outside (9v terminals), and it appears as though all of the electronics are actually on the outside of the door, so the only thing leaky batteries would do is destroy the battery compartment on the inside
Hey there, maintenance technician here. That "Drainhole" might not really be a Drainhole but an access point. We use those on electrical boxes on Lage machines. Normally, you can't open then without turning it off, but if you jam a small hexkey or a thin piece of wire into the access hole on the main power switch, you can turn it without actually turning the machine off My theory is that in this case, it's here if the lock has, say, a malfunction and doesn't read any outside info. A locksmith or a maintenance personel might be able to open it up in case of this happening that way. Better to have a hidden access point than to have to tear down the doors if someone gets locked out of their room
So basically adding a bit a of bent outward L shaped tongue above the drain hole would allow humidity to drain AND cover the way in for any wire or tool. A simple design optimization that the manufacturer should add quickly. And then they should ship that new backplate to all existing customers ASAP
It feels like such an obvious thing to make the one hole in your "pick proof" product secure. It would have only taken a little bit more metal to prevent this exploit
The angle of that “drain hole” tells me that this was supposed to be a super secret way to actuate this device when it fails. It literally points you at the exact position where the wire needs to go.
A couple of things come to mine. Why is the drain hole angled so as to make this easier, and why is there a cutout conveniently located by the pillar for the screw so that a wire would be bent in the correct direction to push that bar? Simply slanting the drain hole in the other direction would make this impossible, because you'd not be able to get the wire to bend back on itself.. I find it hard to believe that this isn't deliberate.
I agree and saw the same thing. I believe it was a safety feature to give access in if the system bricks as it is electronic and so you'd need a backdoor in without having to smash the whole thing apart. This is the flaw with electronic locks and I bet all electronic locks have similar flaws that can be easily exploited by those in the know.
@@crackajacka87Alternatively, lock makers could design in a destructive bypass that can be inexpensively repaired. Any sledgehammer operated bypass method doesn't reduce security, as the sledgehammer itself is sufficient to gain entry. This obviously would require a complete redesign and would cost more, but making it such that destroying the bottom of the lock only damages the case and inexpensive components. Then selling a repair kit with a new case and those components. Unfortunately, this would only make sense if the repair kits were sold at a reasonable price and that the electronics were so reliable that bypassing is rarely required. I can't imagine any existing company building sufficiently reliable lock electronics, such that a very low cost bypass isn't required.
@@crackajacka87 Whilst what you say is true, a destructive attack is detectable. This one, not so much. And it's better to know that your lock has been defeated than to not know.
What's stunning is why the whole mechanism isn't in the back leaving only the inductance antena and the knob in the outside part. They left it like that on purpose.
As a mechanical design engineer, it's almost impossible for me to imagine what could have possibly led to this design flaw. It has to be a joke or some kind of revenge by an ex-employee right?
As one of the other commenters pointed out, it seems like the metal is a stamped plate. I'd presume that the initial design was probably "over engineered" from the executive perspective, so they changed manufacturing processes to cut costs - rarely does cheaper mean better overall
@@TeaObvious I agree with that. Regardless of whether the part in question is stamped, cast, or forged: a repairman is going to want a physical work-around- if the lock fails electronically.
@@TeaObvious Actually, yeah. It seems like something that's supposed to make the lock easy to open for "people who are in the know". Hard to imagine the people who engineered this lock weren't aware of this.
Nope. They know its there and don't care as they are selling these locks by the boatload to building managers who just want to check a box and what me worry :)
Hey Lockpick Lawyer, you may want to try those Showa Meissner keycard locks that employ magnetism, the manufacturer claims that you can't pick them but you can always try to bypass them in some way.
The problem with these smart locks (and similar devices) is, that they are usually made either by mechanical engineers that don't know a lot about electronics and digital devices OR by electronics engineers and IT professionals that don't know much about mechanics. Usually one part is outsourced or the whole product is bought from a third party. In both cases customers don't get what they expect from a traditional brand.
I'm curious LPL, that seems more like a designed bypass for lock failure since the device doesn't have a manual backup for electronic issues. What would you be your design correction for that. Or do these locks have a backup redundancy that didn't come up in the video?
a step up would be to have a key lock for emergencies, but that could be picked too. the thing is, no lock is perfect, nor they are meant to be. locks only act as deterrents. a well placed kick will still open a door
I love this channel. It really shows the lengths a lock manufacturer will got to, or in most cases not, in the manufacture of their products. With a that said you, LPL, profile so many locks that are inferior. How about some locks you might recommend or if you are uncomfortable with that maybe locks that are too difficult for a would be attacker to try and attempt. Perhaps a video on deadbolts then padlock, if any. Just a thought. I wise old man once told me that “locks and gates were made to keep the honest people out”. Thanks for all the good info.
They just installed this lock on my front door today, 1/11/24. My lock has a very robust metal grille just inside the drainage hole to prevent anything from being shoved up inside it. I even mentioned this specific video to the maintenance guy and installer. They were well-aware of the old issue and Schlage has specifically addressed it with the newer locks. As a side note, if anyone is worried about being locked out in case of power outage, the lock has internal power supply with 4 AA batteries. It is supposed to give ample warning when the batteries are getting low, but we shall see about that. The 2 round contact spots you see on the bottom front on the lock are in case the batteries do die. A 9 volt battery can be used by you or maintenance to give the lock enough juice to temporarily regain functionality, but will not open the lock without the usual FOB verification.
This is not a security flaw, it's a feature! In the case of the lock having no power, use the emergency wire (sold separately) to open the lock to gain access to your apartment. 😂
Unbelievable! I've been watching your videos for a while now. But it never ceases to amaze me how you can get away with such fluidity errors for years. You could have discovered something like this before the product was launched, or at least corrected it over time. Why don't they test their own locks?!!!
I have to question whether that really is meant as a "drainhole". Note the angles of the slot predispose it to doing exactly as Mr Picking does. My posit? There was a 'master mechanical key' issued to by-pass the lock in the event of battery or board failure, and it inserted exactly into that slot. It is a massive weakness however...
![[1453] VERY Clever “Loki” Puzzle Padlock Solved](http://i.ytimg.com/vi/OFvTzppfJnA/mqdefault.jpg)
![[1453] VERY Clever “Loki” Puzzle Padlock Solved](/img/tr.png)
![[1422] Did I Cheat On This Challenge? (Tamper-Sealed Abus)](/img/n.gif)
A surefire way to have your products featured on this channel is to include "pick proof" as part of the sales pitch
Just asking for a bone to be picked with lol
Lord Voldemort hasn't been featured yet and it looks like his nose should be "pick proof".
@@Najolve Riddle's "nose" isn't a product… ;-)
@
Probably because it's not in stock..
Or as the brand name, if only for humor value.
I can just imagine Schlage's top executive having an emergency meeting after this video dropped 😂
Tomorrow morning at Schlage HQ will be "interesting", yes.
Arr you kidding? They'll leave as is, its been 8 years already, they aren't going to change it
Houston we have a LPL problem... 😂
lol i like calling them schlang :)
Is Schlang, Schlage's man part ?
That seems less like a "drain hole" and more like a "security bypass." That exploit is so ridiculously obvious that I can't believe it was a mistake.
It looks like it's a manufacturing thing. The bent over part must be "cut in" to stay flush with the rest of the metal sheet after being bent 90°. (not talking about the drain hole, but the inner inlay sheet metal)
I like how the drain hole is even slanted - to make the exploit even easier.
@@plpGTR It doesn't necessarily need to be single-function. If they need to have that indentation anyway for ease of manufacturing, then they can arrange the assembly in such a way that it "just so happens" to point downwards so it also functions as a drain hole for accumulated condensation. And _additionally,_ it can serve the extra purpose of being an emergency mechanical bypass for when the lock fails and it needs a way to be opened. I have to wonder what the installation instructions mention; do they specify to position the hole in such a way to make it more cumbersome to enact such a bypass? Are there additional fittings included in the installation kit to block access to the hole while still allowing it to do its drainage job and be available for emergency bypass when needed by removing said fitting?
I'm reminded of when, iirc, an Air Force budgetary committee asked for justification on why a particularly expensive power wrench was needed. The response was that it was a multi-function tool: it could not only tighten bolts, but loosen them as well.
Definitely not a drain hole, otherwise it would not be slanted that way. It's a real life backdoor...
@@plpGTR this metal doesn’t appear to be bent though it would most likely be cast. Meaning the slants were intended and I agree with other users it’s most likely designed as a bypass.
I'd like to take a moment to appreciate that LPL videos are always without cuts, just single-take perfection. What a Legend.
It's a thing in the locksport community. When you're videoing yourself opening a lock, you're not allowed to edit the video to prevent accusations of shenanigans.
@@Alacritousgood point
@@Alacritouspeople still accuse him of faking though
420 likes, not messing that up
not quite true, there's ONE video with a cut in it. but the ice cream lock was a damn funny cut lol
That drill took longer to get those screws out than you did to unlock the door... major props
No kidding, a giant screw, that takes a minute to unscrew, would be a better locking mechanism.
@@h.a.9880 lmao just a bunch of 10 foot screws
@@h.a.9880 Isn't that how bank vaults work? If you try to break into the vault, you'll either raise the dead with the noise or take all night. I think.
For once, a smart lock not defeated by a magnet?! I LOVE IT!
That is tomorrow's video.
I don't think this is better....
@@TheQuark6789 Yes, but the fix for this is something anyone could knock out
I was going to comment "hands up if you thought he was going for the magnet", but the second I saw the comment section I knew I was far too late.
@@TheQuark6789 idk, the issue is easily solvable on the consumer side and it has avoided the common flaw among its genre. That means it’s effectively defended itself against an industry wide exploit that someone targeting the genre in general would tend to use
Basically they passed the electronic version of the bump key test
Wow. I expected you were shorting the solenoid. I didn't expect it was going to be nearly as simple as, "I nudged a piece of plastic up."
My thoughts too until I noticed no batteries in the unit and the cable wasn’t connected either
I expected a strong magnet.
Shout-out to LPL for showing the entire planet how to break into my home
This is my concern too, surely people will use these exploits faster than fixing them, though it is necessary since this technique must be quite well known already before Anon tells LPL about this.
Plus the drain design kinda sus as if it was intended. Nometheless I think it is better to know about your lock rather than not.
Better to know your home is easy to break into, rather than believing it is secure.
Schlage already reacted and out out an information to all the customers how to fix it. That's because if the pressure such videos create.
Take some epoxy and cover the hole. He just showed you the vulnerability, fix it.
@@the_kombinator The drain hole is there for a reason - to protect the electronic components inside. Blocking it could fry the internals if water builds up. Then you have a useless lock that can't be opened at all.
There's a story about a man who was tasked by a wealthy noble to make a lock that could never be picked. The story goes that a particularly audacious thief would pick the lock on the front door at night and make off with a variety of jewelry and silver utensils which irritated the noble to no end, so he went to the town blacksmith and tasked him with designing a lock that would be 100% unpickable, then install it onto ever exterior door in his home. The blacksmith tried to tell him that no lock was completely impenetrable, but the nobleman would not relent, so the blacksmith agreed.
Days went by, and the nobleman received word that the blacksmith had completed his task, and that he should take a stroll while the new locks were installed. When the nobleman returned, he found a rather impressive looking lock installed on every door. "No one will ever be able to get through this lock, milord" the blacksmith said. "Splendid" the nobleman replied, "but where is the hole for the key?"
"Hole? For a key?" the blacksmith asked.
"Yes, a keyhole, so that I can unlock my door."
"Sorry milord. A lock that can never be picked, is a lock that can never be opened."
The noble was furious. "How am I to enter my home, then!?"
The blacksmith scratched his head for a moment, then said "Wait for the thief. When he breaks in through a window, ask him to unlock the door from the other side"
😅😅
Brilliant!!
@@zcabage Not like it actually happened bro it's just a story
@@zcabage not with that attitude he doesn't
@Cabage and only the uneducated use the word "bruh" so you kinda cancel yourself out there
@@zcabage In the UK, we have a House of Lords. Some of those in the House of Lords, are nobles.
Thus, a nobleman can be referred to as my lord, and be correct.
However, quite simply it could be a case that:
1) The blacksmith is just engaging in good customer service
2) The nobleman is the owner of the land that the blacksmith lives on, hence making him the lord over the blacksmith.
You can't tell me they angled that drain hole towards a gap in the housing on accident. That was a backdoor intentionally put in there by the manufacturer. It's not a flaw, it's a feature.
I mean, of course, how else could a locksmith charge $200 for getting into it for them......
you know I'm sort of inclined to agree that its a back door of sorts... that batteries clearly go on the inside of the door, what happens if they are stone dead... sure the lock will warn you the batts are going flat but what if you just don't act on it?
@@yandyyay Those two metal dots on the front towards the bottom are there for you to hold a 9V battery to it. This powers the electronics and allows you to scan your credentials and get inside in the event the internal batteries died. If anything, it is there for if the motor/electronics fails.
@mrgw982 no way that's pretty smart if that's true. I'm sure it's just a pair of lights but meh
I was thinking the same thing.
a 5 minute LPL vid? and he explained how the bypass worked? this is gold, guys.
5 minute vid only because he had to undo 38 screws 😂
Half the time he showed how an electric screwdriver works :)))
Yeah he doesn't usually include so much screwing around.
Schlage: "Lockpicking Lawyer agrees: this lock is strictly pick and bump proof!"
Reminds me of Cold-FX
Yeah, just like when high carb and sugar junk food is advertised as “fat free.”
They are technically correct, the best kind of correct.
But not hack proof, is it, Schlage?
@@shura0107 beat me to it
I love how this is literally a mechanically unpickable lock except for a small hole in the bottom.
The only thing that's 100% secure is a black hole.
Literal security hole
It’s like the Deathstar.
@@Josh-fh5ox That's actually a good example lmao
Schlage Design Team: "He didn't use a pick."
Schlage Marketing Team: "Good as advertised."
Lol
Those would both be marketing and tech support arguments. Design team would mention the no pick excuse but focus on redesigning the labyrinth navigated by the wire. A more fundamentals focused engineer would redesign the motor linkage to not be pushable.
A pick: Object(s) inserted into the internals of a lock and manipulated in a nondestructive manner that allows unauthorized entry.
I see an unpickable lock that was just picked.
@Chris Strizver this is exactly how I would define a lock pick. After all a paper clip is the cliche pick to get out of handcuffs.
The biggest flaw of all is that the part that does the unlocking is on the outside. On an electronic lock, in a good design, it should always be on the inside.
Yep. The bypass isn't hard to prevent (at least, you're trying to prevent non-destructive entry easy) but there's no fix for vulnerable components like that.
Yep. The turning lever on the outside should be on a shaft all the way through the door that free spins, then put that solenoid inside
Drill a hole to the right of the drain hole (as seen from the rear). Put as long of a machine screw as you can in, with a nut on the inside, to prevent a wire from going straight to the opening. Test it; Add nuts if necessary.
@@troy3456789 Now it can be opened with a bit of wire + a screwdriver. Easiest option is to just fill that void with tightly packed steel wool. It'll still drain water so you don't end up with a short after months or years outside collecting water, but it'll block that wire so long as it's packed tightly enough
@@vakieh4381 I'm thinking the nut on the inside will turn if you use a screwdriver from the outside. A nylock (locking nut) would help too. The idea is to cause the wire to divert to the wrong angle. (Hole drilled on the side of where the wire goes up; not blocking the important drain hole)
Steel wool seems messy and won't stop a stiff wire like what he used in my opinion.
The “drain hole” is actually angled towards the mechanism that unlocks it so it’s easier to get something in there to unlock it.
After this video, price for the whole lock kit is going to be on sale for $19.99 and infomercials at 2 am 😂🤣
Bahahahaha
But wait! There's More! Buy 1 lock, get a second lock FREE! and as a special TV only offer if you call in the next 125 minutes, get a free bottle of epoxy seal to stop the exploit for only a $1.99. But wait! There's More!...
...Tiny super fast legalese text scroll with a fast voice over explaining shipping costs and no liability if the lock is picked....
you know, doesn't sound like a drain hole at all.
More like an intentional backdoor for security experts or those that glow in the dark.
Nah, anyone who knows will just fill the hole with epoxy, and anyone who doesn’t know wouldn’t be replacing/selling these.
I would assume because of the shape of the hole and the slit that allows the wire to reach the inner part that is is actually a "feature" that allows the lock to be opened with a special tool e.g. when the battery is empty or the key card broken.
Finally picked the file cabinet in my office with a paper clip after watching these videos. Feeling pretty confident lol.
Nice
Holy crap! This one is huge. I can see lawsuits if Schlage doesn't bring out a retrofit kit to block where the wire slips between the guard and the screw post. Wow, when a company like Schlage misses such an obvious exploit for years on such a critical product, Master Lock doesn't look so bad any longer.
All I can think of is some guy with Autocad running designing that housing and being told "there needs to be a drain hole" and then saying "but then someone can stick a piece of metal up there and bypass the lock". And an argument ensuing in which the engineer tries to take a stand, but the product manager is like "overruled" and then the guy just says fuck it and goes to lunch.
Imagine the anonymous tipper was master lock themselves lol
It is on purpose. The slot is even diagonal to facilitate the pathway. It is just a hidden bypass feature, like CD players have lol.
@@rmyers99
Nah, it's the engineerings fault in this case. The stamped steel piece is supposed to be shielding against this exploit (after they forgot that in the casting), but they chose the one manufacturing technique that wouldn't actually work because the radius they need for the srew hole leaves this one hole through which LPL could fit the wire. Had this shield been made any other way (molded plastic for example) it would have worked. Should instead have made the actuator that sees machanical load out of steel.
@@BL-yj2wp I'll certainly never bet against cost reduction; but my assumption was that the plastic component was plastic, in surroundings that were mostly metallic, because that's one way to keep otherwise trivial magnetic manipulation from being an issue.
Probably not a coincidence that plastic, rather than one of the more expensive nonferrous metals, was chosen for the job; but still a questionable place for steel.
LPL's dedication to doing his videos in one take is impressive. It is especially obvious in this video.
I agree! I have for a long time been impressed at how very professional his videos are.
Of course, one would hope that a court lawyer who practised in commercial litigation would be able to do a clear, professional presentation in "one take"; judges aren't impressed if a court lawyer asks for a do-over!
That's just laziness lol
His dedication to refuse to learn video editing. Respect, too complicated for me as well. Also makes it harder to accuse him of faking stuff I suppose
@@GigaBoost It's to maintain integrity, or at the very least, prove without a shadow of a doubt that he isn't manipulating any of the locks when he reviews them. It's also why he often picks locks multiple times, to prove his success wasn't a fluke. The benefit of being allowed to be lazy is just a nice bonus.
@@stinkyballsmeller Agreed
for college dorms, it would prolly be feasible to 3D print a small high-infill insert that fits in the area between the two bottom screw holes that still allows the drain hole work as a drain but blocks access to the mechanism by being braced against the casing
...but most colleges will prolly spend hundreds of thousands to replace the locks and charge students for it 🙃
3D print? no, just a bit of superglue.
@@darwinwins You need that hole, because otherwise it's gonna get damped when the temperature falls.
They should really just change the mold. It's an easy fix, just add a pocket that will block tool insertion, but won't block water.
Yea they wouldn't have put a drain hole unless they found it necessary during testing. Especially if these are mounted on an external door more subject to the elements those electronic components would likely stop functioning correctly.
@@Joe45-91 The case is metal, so when the temperature drops, all the moisture from the air inside is going to condensate on that metal. Without that wall, you'll get a small puddle on the bottom.
Never in ten years would I have ever thought I'd watch lockpick vids for fun yet here we are.
You type alright for a ten year old.
@@phattjohnson Bro he didnt say he was ten he said never in ten years, so ten years into the future 😭
Move on to penetrative testing videos and Deviant Ollum teaching you how to fold fitted sheets 😂😊
@@Jake420 Yes, it is, hes saying that he would have never thought from now till ten years in the future he'd watch lockpick videos for fun but he is now. Also the sobbing emoji doesnt mean Im actually crying, its used in this context as a way to say "bro what is this/what are you saying/bruh"
If you look closely to that drain hole, it has an angle pointing directly on that plastic block, as if it WAS designed for that exact purpose of bypassing lock mechanism.
Several other commenters have pointed out it was probably added as a bypass for when the electronic systems fail
Now the secret has been leaked!
it was.
@@zuttoaragi8349 - Most likely, but it is a very terrible bypass system when even the most unskilled thief can easily learn this, or get it to open accidentally by a little prodding. Much better to just add a good secondary bypass keyhole if the electronic shorted.
@@inisipisTV Oh fully agreed. I'm only explaining it, not at all defending it. I'm certain there's a better way to make a bypass.
LPL: "Hey, honey, how's college going?"
LPD: "Great, dad! They just upgraded our dorm locks to these fancy new smart locks."
LPL: "I'll be right there 😐"
Lol, Lock Picking Daughter
😆
Lmao
Nice assumption LPL's partner is in College
@@conArtistAUS His partner is his daughter? Dude, you watch too much porno.
I just tried it on my apartment lock and it worked, it is a slightly different model and outdated, but that is literally terrifying. I had no idea what I was doing but I did it on the first try
My entire apartment building has the same locks. That is so frustrating.
My father was a carpenter and was hired to fix a door to a house that was broken into. When he arrived, he found the door with about 4 deadbolt locks still locked, however the thieves had just removed the outer casing and pulled the door, still in it's jambs, right out of the building, set the door and jambs next to the house, and walked in. Your locks are only as good as the jambs in which the door is mounted. Front door jambs need to thick and set into the house frame with large nails, though bolts are better.
You could just take a sawzall to the bolts, or just break a window. Locks just keep honest people honest.
@@edward1927 You could just take a sawsall to the wall next to the door. After all, it;s just some vinyl or aluminum siding, a sheet of OSB or plywood, some 2x4s, and a sheet of drywall. My dad told me a robbery he saw on the news where the burglars used a cordless circular saw and just cut the wall open.
@@vwbug1975 granted that's an issue bricks would solve alas not the way Americans like to build houses
I had a mountain side cell site to work on and the Supra dead bolt had a dead battery on the door. Hinges were outside and just popped the pins and in we go.
Generally speaking, you don't have a lot of thieves showing up to your front door with power tools and looking to saw through the wall for the obvious reason that it's not worth the time, effort, and risk to do something you can accomplish by just kicking the door in.
"I can open this in just a few seconds with nothing but a thin piece of wire"
Now we can debate the meaning, but "open using only a thin piece of wire" seems like a decent definition of "picking" to me.
technically it is a bypass tool, not a pick. He didn't pick the lock, he bypassed the credential needs.
right at 4:10 where he says "you turn the wire", that wire is passing over a perfectly placed recess in that inner metal bracket. between that and the way the "drain hole" is angled perfectly to feed the wire right where it needs to go, this _has_ to be a deliberate feature not a bug
would it be dumb to assume that its a "secret" way for a lockpicker that specializes in these locks to get it open if the owners lose their credentials to open it?
Exactly what I was thinking. This has to be intended, although they meant it to only be known to locksmiths and security personnel so that they can let people into their apartments. It was definitely not intended to go beyond professionals/intended people.
@@kasper_429 that’s the issue, it’s like having a master code that’s the same for every safe of a particular model. Those out of the loop won’t know but the second information breaks out it’s just free hunting.
@@kasper_429 But that's not how security works.
It takes one person to know the secret to share it maliciously or accidentally and the whole security falls away.
@Kyle White it's also something that looks relatively easy to deduce if you disassemble this lock and look for weaknesses in its design
If you look at the drain hole, it's even angled towards the screw post where the wire travels up into the plastic block.
That's why it looks more like a backdoor than a design flaw to me.
What do they say if you're locked out?
exactly. it is made to have this way of opening.
You might actually be right. But honestly, that only makes it worse.
It is most definitely an intended backdoor, not a design flaw.
Lol. This channel is such a treasure trove of ingenious ways people find to pick locks. Even the unpickable ones. 😂
It’s crazy the quality of these brands. I feel safe for not having locks.
That’s what happens when pool of qualified engineers who can design locks keeps shrinking and brands only rely on their legacy brand names to market products to mass consumer.
naked man fears no pickpocket
Locks keep honest people out tbh
@@E1nsty 😂😂😂😂😂
@@E1nsty LEGO bricks though...
I was waiting for the mention of the drill/driver: ‘And this drill is part of the Genesis’ set that I sell on Covert Instruments…’
😂
Or the wire.
@@JerryWilliam63 So i'll take this wire that Bosnian Bill and I made...
A documentary length LPL video, nice
Was expecting the magnet, but nope it’s worse
@@LHJC10 he did have me in the first half.. I wasn't expected the drainhole exploit.
@@LHJC10 Soon enough, LPL will show us a lock you can either shake to unlock or just turn upside down. It will be made by Master lock obviously.
This must've been an intentional back door into this lock. The drain hole is in perfect alignment for this exploit.
I bought a similar kee pad version that uses the same mechanism earlier today. Upon opening it up I was happy to see that Schlage had included a sturdy piece of plastic that blocks the drain hole while still allowing water to get out. Now I leave it to you to find a way around this new feature.
4:09 that security flaw is entirely because that's a stamped piece of metal. I can see that there was clearance made for when the round segment got bent down in the press. If it was a solid piece of material there would be no gap for the wire to fit through.
Jeez. That is insane how bad this exploit is.
One solution would have been to just extend the length of the guard piece so it could be bent 180° at the end to block off the opening left by the screw tab.
@@HarveyDangerLurker it's just a part of the manufacturing process. Stamped parts are cheap when you need hundreds of thousands of them, and regrettably you need clearances built in for it to work.
The whole design is very weak for a 300 dollar product.
One can just drill a little hole at the bottom until they see some plastic shavings and then easily manipulate the lock with any stick that fit through the hole.
@@NicosM51 at that point your leaving evidence that there is tampered with the lock. You might as well smash the door in by then
Im kinda hesitant to call this a design flaw. The way that it works makes me think Schlage left it there on purpose,just that they were also hoping people aren't aware of it
I agree, but are there locksmiths out there that will divulge this security flaw?
Yes. It is on purpose. The slot is even angled to help with the exploit.
it's a battery powered lock with no mechanical back up, this is a backdoor. If this wasn't there and the batteries died you'd be locked out.
@@riku861 I thought the same thing at first, but if you look at the outer face of the lock, you see there's two little rubber circles below the doorknob, indicating under those are terminals to supply power in case of dead batteries.
@@juukyll That should work assuming the unit retains all its passkey programming with a dead battery. Those terminals should also be protected with a diode, should the polarity be applied in reverse by accident, or if someone mischievous presses a 9v battery to the terminals.
ive been a thief for about 2.5 years now and i want to thank you in how much youve helped me throughout these years!
i love it when you upload and each upload gives me more progress in my journey 🙌
The drain hole is where the credibility of the company flows out.
They even angled the drain hole towards the sneaky corner.
Yeah like they did it on purpose.
we are not fools
that's a backdoor for sure
It's not as if water cares if the hole is angled or not - and a simple barrier over the drain hole and under the plastic bit (so that any water would flow around it) could have prevented this...
The worst thing is that this is clearly a feature meant to be opened from that hole if the batteries are death, so probably not going to be changed by the lock creators any time soon.
It looks like the lock has a spot on the front to hold a 9V battery to the lock to power it in a dead situation, that is probably coupled with an installer RFID fob that is default and doesn't require registering. (For which cloning that fob might be another vector)
@@xaosflux Maybe then it is there incase the motor fails?
@@mrgw98 Nothing a grinder won't solve.
No it's clearly a drain hole. They expect the lock may get mounted on the outside of a exterior door. The PCB is clearly potted to help with water resistance. The hole in the bottom is to drain the water so that the lock mechanisms don't get eaten up by water too fast.
@@MessyPointedBlob Somebody in another comment pointed out the drain hole is *angled* to make this exploit easier.
I can't explain why I like these videos, other than that I like tech... Where I live in Thailand, I haven't locked my car, house or bike in 20 years. Here there is a community vibe that is way more secure than any lock design.
Lock your doors don't be an idiot
Lucky that you live in a safe area with honest people
Not everybody does, especially in the US, Mexico, and countries further south.
If I ever own something that I want no one to ever touch, you're the guy i'm going to call.
We had these all over the one large condo complex I worked at to keep guest out of employee only areas. Sometimes we would find stuff rearranged or missing after spring break groups came through. I'm guessing more than a few people already knew this trick. But truth be told there is no such thing as a Pick-Proof lock. Any lock can be opened if the thief is determined and has enough time. Locks are only there to slow them down.
A lot of the time you only need to wait for someone to come out, nod to them with a straight face, and just walk in as if you're supposed to do that. Not in small places, but the more employees there are (or residents in an apartment building), the less likely they are to say anything.
This seems a very easy problem to solve too. Just change the shape of the drain hole to be 'Z' shaped. I.e. a couple of back and forth returns, and you wouldn't be able to get a wire to trace into the area it needs to be in.
Why does it need a drain hole to begin with?
@@pontoancora The hole on the bottom of a padlock allows water to drain. This prevents the padlock's internal mechanisms from rusting, so they can continue to function properly.
@S H so I assume the water enters the system from above even without any visible opening, right?
Didn't expect that.
@@pontoancora different areas have different weather conditions. Condensation is an issue in many.
@@thekillerbunny It's not a drainhole, it's an intentional backdoor. You can even see how its angled toward the exploit.
this mans the real mvp, not only showing us what locks are cheap and crappy but showing us why they're crappy and what to look for in a good lock
It’s unbelievable how simple some of these “fancy” locks are to get past….
It seems like electronic are the worst because they need a physical bypass that's different from their main security features, so they're usually skimped on.
I mean this is an extremely specific attack on a lock someone studied for vulnerabilities.
That's because they engineered the bypass in, purposely. (that ain't no drain hole)
Seems like the quick fix for Schlage here would be to just whip up a small metal plate that slips into the base of the lock body there, and would be held in place with a couple of bent tabs that fit over the screw holes.
Or fire the lock developer🤣
The problem is that for maintenance reasons the electronics can't be fully waterproofed, and this lock will be out in the rain.
"Sir, good and bad news. the Lockpicking Lawyer has a video about our lock up. Good news, it's over five minutes".
"That's great, usually bad locks are opened in like a minute. What's the bad news?"
"The lock is opened in 5 seconds".
I worked security at a high end apartment complex, one of the residents asked me to switch their FOB from a card to a key chain. When I went into the system I found out that this resident had FULL ACCESS to every single room in the building. The minimum wage security guard who set up the FOB accidently selected Master Key status instead of Resident.
I like that he acknowledged that it wasn’t his own discovery, but that he is showing the problem to the rest of us.
A recall for a few tens thousands of these locks would be very interesting to see.
It’s not a drain whole, because it is sloped in the direction the wire needs to aim. It is a bypass, like the one designed into interior lock sets for bedrooms and bathrooms; so the lock can be breached in case of an emergency or accidental lockout. In the scenarios where this lock would be used, it circumvents lockout due to a dead battery. Likewise, the internal gap next to the screw is intentional. That is where I would block the intrusion, if I preferred to cut a hole in the door or wall when the unit is faulty or the battery dies. What this unit needs is an ability to connect an external power source, like induction with no holes, when the battery dies.
Looks very fixable to me, both by the user and by the manufacturer, either by replacing that metal shield, or by adding one small part that will obstruct the path. It doesn't even need to completely block the drain hole.
I was thinking angling the drain hole in the opposite direction would do the trick.
yea, I'd slip that metal back plate, that's held with the Torx screws, in a vice, and bend the bottom just enough so anything put into the drain hole would have to do some kind of reach around to make it in.
You could also re-engineer the plastic "clutch" for the knob with a stiffer spring or something else to prevent a slight push from a wire being enough to pop it into place.
Basicly just need a little drill to open up that drain hole if its blocked.
@@martinlatvian5538 Good luck getting it at the right angle when it's installed
As others have said, this looks entirely intentional, most likely as an emergency backup for when the batteries (only accessible from the inside) inevitably die when there is no one inside the room to open the lock.
Those two little posts at the bottom are to hold a 9V battery against. That's how you get Schlage models to work when the battery dies. (I guess the theory being that it's better to hide a battery than a key.) :-)
@@markhohmeister7273 It's still locked when you use a battery, so the battery is not like a key.
@@gibbogle9486 exactly. You power with a 9V to open with a valid key fob
Why would it be intentional if they never even provide users or the locksmiths with documentation. Schlage is not coming to your house to unlock it for you. This is 100% bad designing. The 9V terminals are for the “emergency” backup function
True, the pins being there for the 9v battery to powerup the unit in the case of dead batteries would help in the case of that but I could see this "water drain" being used to unlock the door in the case of electronics failure. Which would help aid the owner gaining entry, but also leaves a opening for it to be exploited, but if this is used in a business sense someone using this to exploit the lock to gain access to an area they don't have access to is gonna have alot of explaining to do which is most likely gonna end with them being fired, plus security cameras would also be watching most likely.
Every time he goes, "Let's do it again to show it's not a fluke" I do a literal LOL. I think he should sell that on a T-Shirt.
My building in NYC had relatively secure Mul-T locks/deadbolts for years... Then 6 months ago the management co. decided to put something just like this on all our doors.. without an option. I actually went to the office to complain saying they were ridiculously unsafe but they didn't want to hear it. Too bad this video wasn't out then.
I'm a big fan of Schlage for run of the mill locks. But only their old style mechanical locks because I'm also a big fan of the "KISS" principle ;) I see a separate issue with that little plastic piece. I live in a VERY cold part of the country where winters are not at all kind to flimsy little plastic parts. They've got a spring coupler between the solenoid and the plastic piece but just the same I wonder what some -30F weather will do to that plastic when the solenoid activates. You may need to know that bypass to get into your own property.
I'm maintenance at 2 multi unit apartment buildings. Only had to drill one lock out so far. But I'm trying this on the FE410F model. It seems to be next to impossible to accomplish. But I'm going to be trying it out. Problem is that you have limited range of motion when it's mounted. And the backplate is recessed a little bit.
Only other problem with these locks is the plunger part that moves the plastic locking mechanism. If the building is settling, it effects the doors most noticeably at this part because there is friction between the door jamb and the barrel bolt. Forcing it to work weakens the metal ring the plunger is attached to and it eventually fails.
“Blocking the drain hole in whatever way you see as appropriate” 😂
I just picture all the upper management and design team in a conference room sitting around a huge table with their head’s down and the CEO just red faced yelling at them with this video running in the back ground.
For that price point, they could put a little more space between the drain hole and the plunger point and make a maze where a wire can't go through but water can drain.
Great bit of info, I’ve had those apart many times. Never thought about doing that
I'm convinced this man can find a way to open a bank vault with nothing more than a coat hanger, and a Neodymium magnet 🧲 😂😂😂
Both of which he sells over at Covert Instruments...
I'd say those are probably made to be actually secure
But I wouldn't be too surprised if they weren't
I could see this being fixed by a little plug like the ones Sparrows sells for other Schlage locks that had a similar exploit. They looked like a funky hairpin, but they'd snap in and still allow it to drain, let the parts move, but prevent things from reaching the important bits in a lock.
Yes but, i can't drill just another hole besides it? Who looks there? And how often? After what time might this new hole be detected? Could this then be traced to my person?
If i would detect such of course I would first say nothing but build a trap for the exploiter, he may come again.
Has anyone looked to see who owns Sparrow? And is familiar with the aphorism, "First create a problem, then sell a solution"?
Once the exploit is known, it would be easy as piss to drill a small hole in the bottom of the enclosure, open the lock and then cover the hole with grey/silver putty and no one would ever know.
I see design flaw#2! Double A batteries are prone to leaking when left in long storage unless you use rechargeable batteries. I can definitely see the casing covered in that crusty battery acid leakage because someone actually believed the "Extra Heavy Duty" claim on their Dollar Tree Sunbeam battery package!
"Old grandma Betty got locked out because she ruined her lock, better use the wire trick! "
There is a way to power the lock from the outside (9v terminals), and it appears as though all of the electronics are actually on the outside of the door, so the only thing leaky batteries would do is destroy the battery compartment on the inside
Hey there, maintenance technician here. That "Drainhole" might not really be a Drainhole but an access point. We use those on electrical boxes on Lage machines. Normally, you can't open then without turning it off, but if you jam a small hexkey or a thin piece of wire into the access hole on the main power switch, you can turn it without actually turning the machine off
My theory is that in this case, it's here if the lock has, say, a malfunction and doesn't read any outside info. A locksmith or a maintenance personel might be able to open it up in case of this happening that way. Better to have a hidden access point than to have to tear down the doors if someone gets locked out of their room
I was expecting a magnet lol, quite surprised.
they almost had a good lock, almost.
This worked. My apartment maintenance staff hasn’t been answering all day. Took my problem to the LPL
I think I’ve watched every single one of your videos. Good work
So basically adding a bit a of bent outward L shaped tongue above the drain hole would allow humidity to drain AND cover the way in for any wire or tool. A simple design optimization that the manufacturer should add quickly. And then they should ship that new backplate to all existing customers ASAP
“Anonymous viewer” Honestly it’s just great to see LPL protecting his clients 😂
It feels like such an obvious thing to make the one hole in your "pick proof" product secure. It would have only taken a little bit more metal to prevent this exploit
I think it is an intentional "back door" to let owners into non-functional locks such as during a power failure.
would love to see some more "enterprise" systems like dormakaba and see where the faults lie with their products.
I enjoyed the video! It came in handy when a tenant didn’t let us know about the low battery status and tried it. Worked like a charm
The angle of that “drain hole” tells me that this was supposed to be a super secret way to actuate this device when it fails. It literally points you at the exact position where the wire needs to go.
A couple of things come to mine. Why is the drain hole angled so as to make this easier, and why is there a cutout conveniently located by the pillar for the screw so that a wire would be bent in the correct direction to push that bar?
Simply slanting the drain hole in the other direction would make this impossible, because you'd not be able to get the wire to bend back on itself..
I find it hard to believe that this isn't deliberate.
I agree and saw the same thing. I believe it was a safety feature to give access in if the system bricks as it is electronic and so you'd need a backdoor in without having to smash the whole thing apart. This is the flaw with electronic locks and I bet all electronic locks have similar flaws that can be easily exploited by those in the know.
I fully agree. It has to be deliberate. Which of course makes it even worse for them. Security by obscurity has never, and will never, work.
@@crackajacka87Alternatively, lock makers could design in a destructive bypass that can be inexpensively repaired.
Any sledgehammer operated bypass method doesn't reduce security, as the sledgehammer itself is sufficient to gain entry.
This obviously would require a complete redesign and would cost more, but making it such that destroying the bottom of the lock only damages the case and inexpensive components. Then selling a repair kit with a new case and those components. Unfortunately, this would only make sense if the repair kits were sold at a reasonable price and that the electronics were so reliable that bypassing is rarely required.
I can't imagine any existing company building sufficiently reliable lock electronics, such that a very low cost bypass isn't required.
@@hamjudo You're still ultimately making a backdoor into your lock and is still a massive security flaw in the system.
@@crackajacka87 Whilst what you say is true, a destructive attack is detectable. This one, not so much. And it's better to know that your lock has been defeated than to not know.
What's stunning is why the whole mechanism isn't in the back leaving only the inductance antena and the knob in the outside part.
They left it like that on purpose.
As a mechanical design engineer, it's almost impossible for me to imagine what could have possibly led to this design flaw. It has to be a joke or some kind of revenge by an ex-employee right?
Or a "backdoor" to be able to open the door if the lock fails.
As one of the other commenters pointed out, it seems like the metal is a stamped plate. I'd presume that the initial design was probably "over engineered" from the executive perspective, so they changed manufacturing processes to cut costs - rarely does cheaper mean better overall
My guess is that it was there for testing, and they left it there; either on purpose or forgot.
@@TeaObvious I agree with that. Regardless of whether the part in question is stamped, cast, or forged: a repairman is going to want a physical work-around- if the lock fails electronically.
@@TeaObvious Actually, yeah. It seems like something that's supposed to make the lock easy to open for "people who are in the know". Hard to imagine the people who engineered this lock weren't aware of this.
This is a massive discovery. I have a feeling that this is going to cause chaos at this Lock Company.
Nah low chance stuff like this is super common.
Nope. They know its there and don't care as they are selling these locks by the boatload to building managers who just want to check a box and what me worry :)
Thanks! This worked on my neighbors door and I now have a new microwave!
This dude is working with a maxxed out lock picking skill IRL.
I admire people that believe "security" is good for anything more than keeping honest people honest.
Hey Lockpick Lawyer, you may want to try those Showa Meissner keycard locks that employ magnetism, the manufacturer claims that you can't pick them but you can always try to bypass them in some way.
The problem with these smart locks (and similar devices) is, that they are usually made either by mechanical engineers that don't know a lot about electronics and digital devices OR by electronics engineers and IT professionals that don't know much about mechanics. Usually one part is outsourced or the whole product is bought from a third party. In both cases customers don't get what they expect from a traditional brand.
I'm still waiting for the day when LPL will announce his pickproof and in general secure locking mechanism that will go on sale.
If LPL were to make a lock, I really doubt "pick-proof" would be part of the advertising...😜
@@gunnern1 because he knows such a lock will never be invented 🤣
@@ChocoLater1 He did make such a lock, but he forgot to make the key first and now cant open it to make copies.
HE WILL!
He has posted about truly unpickable locks in the past - unpickable provided you didn't create a custom tool specifically for that lock, anyway
I'm curious LPL, that seems more like a designed bypass for lock failure since the device doesn't have a manual backup for electronic issues. What would you be your design correction for that. Or do these locks have a backup redundancy that didn't come up in the video?
a step up would be to have a key lock for emergencies, but that could be picked too. the thing is, no lock is perfect, nor they are meant to be. locks only act as deterrents. a well placed kick will still open a door
I love that it took longer to take it apart then it did to bypass the lock...
These videos are the strongest case against gun control
Schlage: Our lock is pick proof and bypass proof!
LPL: Hold my beer!
To be fair, I only heard "Pickproof" not bypass proof. so they were technically correct... but only technically.
I love this channel. It really shows the lengths a lock manufacturer will got to, or in most cases not, in the manufacture of their products. With a that said you, LPL, profile so many locks that are inferior. How about some locks you might recommend or if you are uncomfortable with that maybe locks that are too difficult for a would be attacker to try and attempt. Perhaps a video on deadbolts then padlock, if any. Just a thought. I wise old man once told me that “locks and gates were made to keep the honest people out”. Thanks for all the good info.
They just installed this lock on my front door today, 1/11/24. My lock has a very robust metal grille just inside the drainage hole to prevent anything from being shoved up inside it. I even mentioned this specific video to the maintenance guy and installer. They were well-aware of the old issue and Schlage has specifically addressed it with the newer locks. As a side note, if anyone is worried about being locked out in case of power outage, the lock has internal power supply with 4 AA batteries. It is supposed to give ample warning when the batteries are getting low, but we shall see about that. The 2 round contact spots you see on the bottom front on the lock are in case the batteries do die. A 9 volt battery can be used by you or maintenance to give the lock enough juice to temporarily regain functionality, but will not open the lock without the usual FOB verification.
This is not a security flaw, it's a feature! In the case of the lock having no power, use the emergency wire (sold separately) to open the lock to gain access to your apartment. 😂
I like how it was all one take
Looks like a little JB Weld in the drain hole is in order. If one did this cleanly enough, I'd bet the Landlord wouldn't even know it.
Imagine having such a glaring security flaw that could have been avoided simply with a thin metal liner.
This is the best youtube channel ever.
I love how you didn’t even bother to put batteries in the lock
Unbelievable! I've been watching your videos for a while now. But it never ceases to amaze me how you can get away with such fluidity errors for years. You could have discovered something like this before the product was launched, or at least corrected it over time. Why don't they test their own locks?!!!
I have to question whether that really is meant as a "drainhole". Note the angles of the slot predispose it to doing exactly as Mr Picking does.
My posit? There was a 'master mechanical key' issued to by-pass the lock in the event of battery or board failure, and it inserted exactly into that slot.
It is a massive weakness however...
The best way to block it without affecting drainage is a thin piece of flashing cut to contour the bottom from screw to screw.
I appreciate the instructions to block the drain hole in the short term for those managers up a creek.