full-disclosure - [FD] Master Lock random key code generation/distribution Fails

Open Source and information security mailing list archives

Message-ID: <CAM9CpTeCXUaCPFgz7wFyts+C4LCTy+DCx8Z0cAviF=VX7DHMzw@mail.gmail.com>
Date: Wed, 26 Mar 2014 14:17:51 -0500
From: Jimb0 Hon1nbo <hon1nbo.list@...il.com>
To: fulldisclosure@...lists.org
Subject: [FD] Master Lock random key code generation/distribution Fails

First this is not a physical finding in the normal sense, but a finding
that Master Lock does not properly generate key codes differing in each
batch, or that they do not randomize distribution of said key codes.

After visiting a home depot, I found the following problem: among every
model of padlock with a key, each model was matched in key codes for the
entire model stock. I walked in for one set of matching locks (a little
three or four pack), and I walked out with multiple sets all matched (will
I trust these locks, no). WE checked every lock in stock and they all had
the same issue.

Example, every if buying Master Lock model "A", every model "A" would have
the same key code.
If model "B," every model "B" has the same key code.

This means that with every stock a store like Home Depot receives, there is
only one key combination for each model of lock. If a store only receives a
few shipments a month, then there are only a few possible keys. If that
store happens to be a large, if not only, source of locks in the area, then
you have the probable key combination at each store

attached is a photo I took showing a matched set I pulled off the shelf to
buy when I found it.

PS: This is not the special order contractor stuff that is designed to have
the same key code, but individual packaged products on the shelf.

-Hon1nbo

Download attachment "master_lock.jpg" of type "image/jpeg" (2177926 bytes)

_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives