Hacking a magnetic lock
Where
Community Stage
Disobey 2023
Duration
55 min
Shows how a magnetic lock's sliders can be read, copied and bypassed, including recovering its master key.
Summary
The talk looks at a Miwa (Anker 3800) cylinder, a lock design from Japan sold in Europe that combines ordinary pins with magnetic sliders. The magnets sit in the key, so the key has to match both the pin depths and the magnet layout. The speaker, a professional lock picker, sets out the threat model: open the lock without damaging it, or copy a key that someone has only briefly held. He describes building a magnetometer to read the magnet layout, then printing replacement keys. Early attempts with hand-built setup keys and tiny magnets failed, and a resin printer produced brittle keys before a filament printer worked.
The middle of the talk covers other routes into the cylinder. Single-pin picking works but proves surprisingly hard. Bumping opens the lock in a few strikes once the magnets are matched. Impressioning is possible but impractical. The speaker then turns to master keying. By comparing the fixed magnet positions across several cylinders, and by disassembling a half cylinder to reveal the pin heights, he narrows down the master key and then the individual user keys through process of elimination.
The closing section draws practical lessons. Once a key is available, copying it with a 3D printer is quite easy, while a photo of a key reveals much less than a reading taken from the cylinder itself. Manufacturers try to resist printing by adding movable parts to keys. The speaker recommends testing only on your own cylinders, and notes that the manufacturer shared factory access and sample keys during his research.
Related talks
Main Stage·34 min
windytan
Shows how HDMI display signals leak radio emissions that can be captured from another room to move data across an air gap.
Cryptocurrency Village·27 min
Do Truong Giang · Sadiq · Arjun Suresh
Explains how a Cryptohack badge signs crypto transactions on-device and walks through the hardware attack surfaces an attacker with physical access could try.
Main Stage·49 min
Mickey Shkatov · Jesse Michael
Shows how a roughly $45 FPGA can impersonate a discrete SPI TPM on Windows 11 and sit between a real TPM and the motherboard, challenging hardware trust assumptions.


