Locksport Competitions: Compete in the Olympics of Locks

Locksport Competitions: Compete in the Olympics of Locks

Speakers: Matt Burrough, Red Team Manager, Co-organizer Seattle Lock Sports; Jos Weers, Security Professional, Former President tool.nl

Conference: DEF CON 32

YouTube: https://www.youtube.com/watch?v=j3A5zQAAwcc

Overview

This talk, presented by Matt Burrough and Jos Weers at DEF CON 32, offers a comprehensive introduction to the world of Lock Sport competitions. Far from being a mere hobby, Lock Sport is presented as a formalized discipline involving the non-destructive opening of locks using methods unintended by the manufacturer, all against the clock. The speakers, both accomplished practitioners and co-authors of the book "Lock Sport," aim to demystify the competitive landscape, guiding newcomers on how to participate, excel, and understand the various events that comprise this unique "analog hacking" pursuit.

The presentation delves into the history, motivations, and technical methodologies behind the primary Lock Sport disciplines: lock picking, impressioning, and safe manipulation. It highlights the community aspect, the drive for personal improvement, and the thrill of competition that draws enthusiasts from around the globe. For security professionals, understanding Lock Sport offers invaluable insights into the vulnerabilities of physical security mechanisms, providing a crucial analog to digital penetration testing and red teaming.

Background

▶ Watch: Introduction to Lock Sport and its definition (0:00)

The fascination with opening locks without a key is as old as locks themselves, with locksmiths historically employing these skills as part of their trade. However, the formalization of this practice into a competitive sport, or Lock Sport, has a more recent history, tracing its roots back to the 1960s with the Model Railroad Club at MIT, where members began exploring lock bypass techniques. This early curiosity laid the groundwork for a burgeoning global movement.

Europe saw a significant rise in Lock Sport in the late 1990s, spearheaded by groups like SS Dev in Germany, founded by members of the Chaos Computing Club. This cultural exchange eventually brought Lock Sport to the United States through interactions at conferences like Hope. A pivotal moment in the Netherlands was the formation of the Dutch NVHS (Dutch Association for Hinges and Lock Sport), which later evolved into tool (Technical Open Organization of Lockpickers) NL in 2002. tool NL hosted its first Lock Con that same year, establishing a major annual gathering and competition. The momentum crossed the Atlantic, leading to the establishment of tool US around 2006, coinciding with its presence at Hope and DEF CON. Thus, Lock Sport has been flourishing as a recognized competitive activity for well over two decades.

The motivations driving individuals to participate in Lock Sport are multifaceted. At its core, locks are viewed as engaging puzzles—challenges to be overcome, much like digital systems for hackers. This pursuit fosters continuous skill improvement, pushing competitors to refine their techniques and achieve personal bests. Beyond personal satisfaction, the competitive arena offers opportunities for recognition, bragging rights among peers, and even a degree of fame within the community, exemplified by well-known figures like LPL (LockPickingLawyer). Competitions also offer tangible rewards, ranging from trophies and specialized lock picking gear to coveted high-security locks themselves, providing further incentive for participants to hone their craft.

Key Findings

▶ Watch: Motivations and brief history of Lock Sport (2:00)

The primary "findings" of this talk for an audience largely unfamiliar with the competitive aspects of Lock Sport are the detailed descriptions of the various competition types and the structured environment in which they occur. The speakers emphasize that Lock Sport encompasses more than just lock picking, defining it broadly as the non-destructive opening of locks in a manner the manufacturer never intended. This distinction is crucial, as it broadens the scope to include methods like impressioning and safe manipulation.

The talk highlights three main competitive disciplines:

1. Lock Picking: The most recognized form, involving manipulating the internal components of a lock to open it without a key.
2. Impressioning: The intricate art of creating a functional key for a lock from a blank, purely by analyzing marks left by the lock's internal pins.
3. Safe Manipulation (Safe Cracking): The process of discerning the combination of a mechanical safe lock through tactile and auditory feedback, often involving mathematical calculations and graph analysis.

For each discipline, the speakers outline the typical competition format, including rules, time limits, scoring mechanisms (most opens, cumulative time), and progression through rounds to determine finalists. This structured approach ensures a level playing field and allows for objective measurement of skill and speed. The talk effectively demystifies the competitive landscape, making it accessible to those interested in exploring this unique blend of puzzle-solving, precision mechanics, and analog hacking.

Technical Deep Dive

▶ Watch: Detailed explanation of Lock Picking competition format (4:00)

The core of Lock Sport lies in the technical mastery of various non-destructive entry methods, each with its own specific tools, techniques, and challenges. The talk provides a detailed look into the mechanics of the three major competition types.

Lock Picking

Lock picking is the most widely known discipline and forms the primary event at most Lock Sport gatherings. Competitions typically involve participants seated at large round tables, usually with five to ten individuals. Each competitor is provided with a lock and given approximately five minutes to attempt to open it. Upon success, the time is recorded; if unsuccessful, this is also noted. After the allotted five minutes, a "switch" command is given, and all locks are passed to the next person, rotating around the table. This continuous rotation exposes competitors to a variety of locks within a short timeframe.

Progression to the final round is determined by the number of locks opened. In the event of a tie, the competitor with the best cumulative time across all successfully picked locks advances. Final rounds follow a similar format but typically feature significantly harder locks, demanding greater skill and precision. The process emphasizes speed, consistency, and adaptability to different lock mechanisms.

Impressioning

Impressioning is presented as a highly specialized art, focused on the creation of a working key from an uncut blank key without prior knowledge of the bitting. The process begins by inserting a blank key of the correct brand and type into the lock. The competitor then applies force and wiggles the key, allowing the lock's internal pins to leave minute marks on the soft brass of the key blank.

After removing the key, these marks are carefully examined, often requiring magnification and specific lighting. The marks indicate where the key's depth is incorrect, corresponding to pins that are binding. Using specialized round files, a small amount of material is precisely removed from the marked areas. This iterative process—insert, wiggle, remove, examine, file, repeat—continues until the key perfectly matches the lock's internal configuration, allowing it to open.

In impressioning competitions, all participants typically receive key-alike locks of the same brand to ensure a level playing field, as differences in pin depths would unfairly disadvantage some competitors due to the increased filing required. A normal first round can last about an hour, with roughly half the field successfully opening their locks. The first six or so competitors to open their locks progress to the final round, where they face six different locks. The winner is determined by who opens the most locks, with time serving as a tie-breaker. Jos Weers, a "world expert in impressioning," highlights that using round files creates a smooth bottom to the key cuts, which makes it easier to hunt for the subtle marks left by the pins.

Safe Manipulation

Safe manipulation, often colloquially referred to as safe cracking, is another distinct competitive discipline. Unlike cinematic portrayals, competitions do not involve shipping entire safes. Instead, the focus is on the safe lock mechanism itself, typically mounted on a plastic stand for accessibility. The objective is to determine the correct combination and open the lock in the fastest possible time.

This method differs significantly from lock picking and impressioning. Instead of direct tactile feedback from pins, safe manipulation relies on a combination of sight and feel from the dial and its internal mechanism. Competitors meticulously listen and feel for subtle changes in the dial's resistance and clicks as the internal wheels align. This often involves a degree of "math homework," where participants build graphs to plot the gate positions of the wheels, allowing them to calculate the correct combination. The S&G 6730 (Sargent & Greenleaf 6730) is noted as by far the most commonly used safe lock in these competitions, indicating its prevalence as a benchmark for skill in this domain. The complexity arises from the precise interpretation of mechanical feedback and the analytical process required to decode the combination.

Demo / Proof of Concept

▶ Watch: Jos Weers explains Impressioning competition technique (5:20)

While the talk itself did not feature a live, interactive demonstration of lock opening techniques, the speakers effectively illustrated the competitive environment through descriptive narratives and visual aids. Instead of a "proof of concept" in the traditional sense of demonstrating a novel exploit, the presentation served as a comprehensive conceptual demonstration of how Lock Sport competitions are structured and executed.

Matt Burrough and Jos Weers provided detailed accounts of the typical setup: round tables for lock picking with participants rotating locks, individual setups for impressioning with specific tools like blanks and files, and specialized stands for safe manipulation locks. They showed images of themselves and other competitors actively engaged in these events at various conferences like Lock Con and Lock Fest, providing visual context to their explanations. These descriptions, combined with the detailed breakdown of rules, timing, and progression through rounds, served to clearly "demonstrate" the operational framework and challenges inherent in each Lock Sport discipline, allowing the audience to understand the practical application of these analog hacking skills in a competitive setting.

Defensive Implications

Though Lock Sport is primarily a competitive hobby, the knowledge and skills cultivated within this community hold significant defensive implications for physical security. Understanding the methods used for non-destructive lock bypass is analogous to how penetration testing and red teaming reveal vulnerabilities in digital systems.

Firstly, Lock Sport exposes the inherent weaknesses and design flaws in various locking mechanisms. Competitors, by constantly pushing the boundaries of what's possible with non-destructive entry, inadvertently act as a large-scale, distributed quality assurance team for lock manufacturers. Their successes highlight which locks are easier to defeat, which techniques are most effective, and where security features fall short. For physical security professionals, this provides critical intelligence. Knowing that a common lock, like the S&G 6730 in safe manipulation, can be consistently defeated by skilled individuals within a specific timeframe should prompt a re-evaluation of its suitability for high-security applications.

Secondly, the skills learned in Lock Sport directly inform better physical security practices. Security managers and designers can leverage this understanding to specify more robust locking hardware, implement layered security approaches, and recognize the importance of proper installation and maintenance. For instance, if a lock is easily impressioned, it suggests a need for tighter key control or the adoption of key systems that are more resistant to blank manipulation. Similarly, understanding the nuances of lock picking can inform decisions about pin configurations, anti-picking features, and overall lock complexity.

Finally, Lock Sport serves as an invaluable training ground for security professionals who need to understand analog threats. Red teamers, physical security specialists, and even law enforcement personnel can benefit from learning these techniques. It provides a deeper appreciation for the physical attack surface, allowing them to identify vulnerabilities that might be overlooked by those without hands-on experience. By engaging with the Lock Sport community, defenders can stay abreast of evolving bypass techniques and integrate this knowledge into their threat models and defensive strategies, ultimately leading to more resilient physical security postures.

Key Takeaways

• Lock Sport is Analog Hacking: It involves the non-destructive opening of locks in ways unintended by the manufacturer, serving as a physical counterpart to digital hacking and penetration testing.
• Diverse Competitive Disciplines: Beyond traditional lock picking, Lock Sport includes impressioning (making a key from a blank) and safe manipulation (cracking mechanical safe combinations), each requiring distinct skills and tools.
• Structured Competition Formats: Events feature clear rules, time limits (e.g., 5 minutes per lock for picking, 1 hour for impressioning rounds), and progression criteria (most opens, cumulative time) to determine winners.
• Skill, Practice, and Community: Success in Lock Sport is driven by continuous skill improvement, dedicated practice, and engagement with a global community that shares knowledge and fosters competition.
• Defensive Insights for Physical Security: The expertise gained in Lock Sport exposes vulnerabilities in lock designs and informs better physical security practices, enabling security professionals to strengthen defenses against analog threats.
• Accessible and Rewarding Hobby: Lock Sport offers a fun, challenging, and rewarding hobby with opportunities for personal achievement, recognition, and winning specialized gear or unique locks.

About the Speaker(s)

Matt Burrough is a prominent figure in the Lock Sport community, serving as a red team manager by day and a co-organizer for Seattle Lock Sports during his off-hours. He is a co-author of the book "Lock Sport" and has been actively competing in Lock Sport competitions around the world since 2016. His experience spans both the practical application of security skills in a professional context and the competitive arena of physical security bypass.

Jos Weers is a seasoned security professional with a long history in Lock Sport. He previously served as the president of tool.nl, the original Technical Open Organization of Lockpickers in the Netherlands. Jos is also a co-author of the "Lock Sport" book and has been competing in Lock Sport since 2006, achieving consistent wins since 2009. He is specifically recognized as a "world expert in impressioning," bringing a deep level of technical mastery to the discipline. Jos also shared the exciting news that the "Lock Sport" book is now available in braille format in Europe, with anticipated availability in American braille libraries.