Home :: The Bumping Threat

The Bumping Threat

It should be noted that many of the images on this page were provided courteously by Marc Tobias (from Security.org ) and his LSS book. If the image says LSS in it, its reproduction rights belong to Marc Tobias.

Lock bumping is a very old technique of opening locks and something that many locksmiths have used for quite some time. While it has been making the news in the US since around 2005, it was better known overseas where it was a public threat for many years before that. The earliest documented example dates back to the 1920's. In short, for most standard pin tumbler cylinders and some high security cylinders, if a key is obtained or manufactured that fits the system, it can be cut in a specific way to turn it into a bump key. It is important to note that in virtually all non-bump proof systems, any normal key can be turned into a bump key. Bump keys for many common systems can be ordered online where there also many instructional videos on how to bump locks. Once a bump key is obtained, with only a few minutes of practice, one can frequently open the lock with nothing more than the key and a blunt instrument like a shoe. Bumping leaves very little sign of being used on the lock (rarely damaging it in any way) and can open a lock in seconds - almost as fast as using the proper key. Neither our Abloy, EVVA, or BiLock product lines are vulnerable to bumping.

While bump keys have been used internationally in burglaries, they appear to be less commonly used in the US as a method of entry. However, bumping leaves virtually no evidence to suggest that it was used, so many cases of bumping are simply attributed to the door having been left unlocked, when in fact the lock may have been bumped open (leading to gross under-reporting). There have been several robberies in the US which have been tied to bump keys. Specifically, in a few different areas in the US, there have been large sets of apartment complexes that have been robbed. Apartment complexes are often targeted as all of the door locks are the same, so only one type of bump key is required to open all of the doors. Many modern locks advertise bump-resistance, but in reality this simply requires the user to have additional practice in opening the locks, so they are still very vulnerable to bump attacks. In fact, several locks that claim to be bump proof are still vulnerable to the attack if done correctly. On our "choosing a brand" page we cover what locks are truly bump proof and what locks are not.

Below is a video (one of many) talking about lock bumping. The video says that locks like Medeco cannot be bumped, however, this is incorrect. The video does provide some good general information:

Get the Flash Player to see this video.

How Bumping Works

This picture shows a normal lock at rest on the left. The blue pins are blocking the shear line and preventing rotation of the plug in the lock. On the right, you see the key inserted. The key brings each of the pin pairs to the proper height so the gap between each blue/green set of pins is exactly at the shear line. Different height pins require different cuts in the key. Bumping exploits the fact that as long as a gap exists between the green pin and blue pin pair at the shear line, the lock will turn.

Here we see one method of bumping. The key is inserted all the way and then pulled out by one position. At this point the pins are all at the lowest possible position, in the valleys on the key, and each red pin has a peak to the right of it. The attacker then hits the key with a quick blow, which could be from a shoe, a banana, or a specialized bump hammer. This causes the peaks on the key to quickly hit the bottom pins causing them to move slightly but the top pins shoot up. Before the top pins are forced back down due to the spring pressure and gravity, the attacker quickly turns the key and is able to open the lock.

Bumping was originally explained as follows: This principle is much like a Newton's Cradle. A force is applied to one side of the cradle and, rather than all the balls moving, only the ball on the other side moves as the force is transferred through the other balls. Bumping is very similar - instead of balls we have pins. When the bottom pin has a quick force applied to it, it does not move greatly, but the top pin shoots up. While this concept is fairly easy to understand bumping is actually far more complex. Masterlock did a large amount of research into bumping and the actual mechanics are somewhat different than previously believed.

As said earlier, even some locks that were once advertised as bump proof, like Medeco or Mul-T-Lock, can now be bumped under certain situations. High security locks that implement a pin on top of pin mechanics implement bumping counter measures but unfortunately many can be bypassed. For more details, see our Choosing a Brand page.