Abus 72/40 Padlock Bypass

[MacGyver101]

I assume that Kryptonite was the only company that changed the locks for free (correct me if I'm wrong)

ABUS had a problem with their bicycle locks (their 48 and 4800 series) about five years ago, and replaced them all for free. AXA had a similar problem with their bicycle locks (but a model that had been out of production for 2+ years at the time the vulnerability was discovered) and they offered a 50% discount on replacement locks. Onity has been sending out replacent kits for their vulnerable hotel locks after the exploit was announced late last year. There wasn't a recall, but there was some good dialog between Medeco and the locksport community around the time that Marc Tobias started publishing his exploits. ABUS made some product changes in response to Jaako's ABUS Plus pick. My understanding is that Cyberlock made a few component changes after bumping issues were reported to them last year. I'm sure there must have been a few other full-on product recalls and other positive changes for consumers in the past few years that I just can't think of at the moment.

This sort of interaction between lockpicking hobiests and manufacturers has actually had a reasonable track record the past few years -- and folks like Stanton Concepts and Commando Lock have clearly seen the benefit, as they're actively reaching out for people to evaluate their products for suggestions on how they can be improved.

Anyhow, I do absolutely agree with your sentiment that companies should be rewarding people's work in bringing these issues forward in a constructive way... but, "security bounties" aside, many manufacturers (ABUS included) have actually responded in fairly cooperative terms lately.

[10ringo10]

Well i did not know about this bypass... and am not surprised at all to the response or message you received D from ABUS
nice work and great write up!

[Oldfast]

Adrain. You know, at first I guess I really wasn't all too surprised with the lack of action in response to your discovery.
I'm still not ALL that surprised.... but the more I think about it, I AM in a way. In my mind, I suppose ABUS has always
been one of those names/brands/products, that seemed to hold themselves to a certain standard. And many of their
products and designs I think reflect my sentiment. So for them to allow (or refuse to remedy) such a flaw IS surprising.

I guess what made me think of you again was finding a wafer in this ACE lock (made in China). And we all know that American Lock has implemented a similar design in their locks for sometime now. Even if their wafers are too thin... AT LEAST they've addressed the issue! And then I thought to myself... even Masterlock has adapted to deter this simple bypass! You can see this 141 has a small pin at the back of the plug that runs diagnally across the keyway.

So for a company like ABUS to overlook such a flaw in the first place... let alone ignore it after-the-fact....
I just dunno. Overall, I guess it doesn't surprise me. But at the same time.... it does a little.