FAQ  •  My feedback  •  Feedback
UKLockpickers.co.uk Lockpicking supplies such as Lockpicks, tools, and more! COMMANDOLOCK.COM Military grade padlock systems lockpickshop.com A source for lockpicking supplies such as lockpicks, locksmith tools, and more!

Medeco Bumpkeys.

<<

barbarian

Active Member

Posts: 347

Joined: Thu Mar 27, 2008 9:08 pm

Post Wed Nov 25, 2009 2:30 am

Medeco Bumpkeys.

There are four types of Medeco locks that you might find as a deadbolt or mortise lock.

Classic.
Biaxial.
M3.
Bilevel.

The Medeco Classic came out around 1970 or so and remains a very hard lock to pick. It uses chisel point pins that can be rotated 20 degrees by angled cuts on the key. Proper rotation of the pins allows a sidebar to retract and if the pins are also at the proper shearline, the lock can be opened. There are several tools that a lock picker can use to help rotate the pins in the Classic, the Medecoder, groove grabbers and some others. Several expert pickers have demonstrated their ability to rotate the pins with an ordinary pick.

The Biaxial came out about 1985 and is very similar to the Classic. The big difference is that the chisel point on the pins is not on center, rather it is before or after the center and the pins are called Fore or Aft. The Biaxial gave Medeco another 20 years of key patent protection and allowed for a large number of bitting differs. This allowed Medeco to do some very complex master keying, and it would seem to be higher security. However these locks are susceptible to code setting and bumping with properly cut keys. They are also susceptible to groove grabbing tools like the Classic lock.

The M3 came out around 2003 and is essentially a Biaxial lock with the addition of a slider. The slider sits at the front of the sidebar and prevents the sidebar from retracting. The key has a special shoulder that moves the slider and this gained Medeco another 20 years of key patent protection. The patent on the M3 key expires in 2021. The slider can be easily bypassed with a bent paper clip and the lock offers no more security than a Biaxial. They can also be bumped or code-set and then picked.

The Bilevel is a low security lock that takes the same key as the M3. It is designed to be a cheaper lower security lock that is integrated into an M3 system. Medeco suggests it be used on closets and lunch rooms. It can be bumped and picked.

In 2005 Marc Weber Tobias began looking very seriously at Medeco locks. He along with several others discovered a number of flaws in the design that they were able to exploit to create bumpkeys and code setting keys. They give the details of their efforts in the book “OPEN IN 30 SECONDS”. Great read for anyone interested in Medeco locks. Tobias also discovered a few destructive entry methods for Medeco locks. Some are VERY simple and use easily available tools. We won’t talk about those methods here. However, Medeco locks are not as secure as some people believe.

In an effort to remove several vulnerabilities, Medeco introduced ARX pins to prevent groove grabbing and they allowed some additional pin rotation angle combinations. The ARX (Attack Resistance Extended) pins feature a sidebar slot that is milled into the side of the pin and does not extend all the way to the chisel point. There is nothing for the groove grabber to hook into, so it can’t be used to rotate the pins. The ARX pins are supposedly put in only at the request of the customer, or for high security applications.

The additional rotation angle combinations are included in the generation 3 code book and these locks require 16 code setting or bumpkeys rather than the 4 keys required for the generation 2 locks.

To use the code setting keys, you should determine if the pins in position one and two are fore or aft. Doing this can reduce the number of keys you need to try to open the lock. There are several ways to probe the pins and see if they are fore or aft, and then refer to a table and choose your code setting key or keys. Put the code setting key in the lock and wiggle it a bit so that the pins are seated in the cuts. Put a slight amount of tension on the lock with a suitable tension tool and the sidebar will set. Hold the tension and withdraw the key, then pick the lock as you would pick any normal lock. That’s it. Be aware that there will be a couple of mushroom or other security pins, and that Medeco locks are sometimes very hard to pick even without the sidebar.

Interesting to note that once the pins are rotated to the proper angle, the tension can be released and the pins won’t rotate unless they are physically disturbed by a pick or other tool. Also, these code setting keys are made to work on the Biaxial and M3 locks, not the Classic. In this respect the Classic actually has higher security than the M3.

After I made these keys, I tried one of the bumpkeys in a six pin Biaxial. It took me about six hits before the lock popped open. I’m no expert in bumping, I think this might be the third time I ever bumped a lock open. If anyone wants to know the cuts I can give you a chart for the 4 keys or the 16. I’m not sure if I should post the charts in the open.


Pins.jpg

Keys.jpg


>> Edit. I can't find the original pictures. The pictures above should be pretty close. <<
You do not have the required permissions to view the files attached to this post.
Last edited by barbarian on Sun Apr 25, 2010 1:27 am, edited 1 time in total.
<<

awol70

User avatar

Mentor - 1st Class / Research & Development Kingpin / Prolific Videomeister / Global Moderator / The Guy You Wish You Were
Mentor - 1st Class / Research & Development Kingpin / Prolific Videomeister /  Global Moderator / The Guy You Wish You Were

Posts: 1653

Joined: Tue Mar 25, 2008 10:05 pm

Location: CANADA

Post Wed Nov 25, 2009 2:33 am

Re: Medeco Bumpkeys.

great writeup! thank you.
" I Love the smell of napalm in the morning!....."

Image
<<

jruther2

User avatar

Captain Contributor / Pick Synthesis Fabrication Process Execution Specialist / Global Moderator
Captain Contributor / Pick Synthesis Fabrication Process Execution Specialist / Global Moderator

Posts: 522

Joined: Fri Nov 21, 2008 6:05 pm

Location: United States

Post Wed Nov 25, 2009 3:28 am

Re: Medeco Bumpkeys.

GREAT POST! That is a great background and summary...very well done! The keys are just awesome as well. I would love to see a medeco bumping video. ;)
"An honest man is one who knows that he can't consume more than he has produced."
<<

aarpazthelockpicker

Familiar Face

Posts: 155

Joined: Mon May 05, 2008 11:46 pm

Post Wed Nov 25, 2009 4:21 am

Re: Medeco Bumpkeys.

simply amazing
<<

whizdumb

User avatar

Active Member

Posts: 370

Joined: Mon Oct 12, 2009 5:28 am

Location: NJ, USA

Post Wed Nov 25, 2009 6:16 am

Re: Medeco Bumpkeys.

Awesome write-up. I think that was the most clearly stated review of Medeco locks that I have ever read. Great Job. I think that this should be a sticky in the Medeco sub-forum. It's all the info you could really ever need in one convenient location.

Happy Picking,
Whizdumb
Image
Whizdumb81 wrote:You can't handle the DCAP
xe0 wrote:how about a peterson gov steel baseball bat so i can thwap motherfuckers
ecksdee wrote:To learn to pick locks is to learn how to speak a language spoken only in whispers and riddles.

http://www.youtube.com/user/HobbyPicker
<<

uklockpicker

User avatar

The Supply Guy - Honored Benefactor
The Supply Guy - Honored Benefactor

Posts: 1232

Joined: Tue May 27, 2008 7:38 pm

Location: United kindom Uk

Post Wed Nov 25, 2009 10:00 am

Re: Medeco Bumpkeys.

Great review...Dam i wish my printer was working :roll:

Thanks for the post - ill be looking at this again sometime ;)
Image
<<

s1deshowmick

User avatar

Contributor
Contributor

Posts: 634

Joined: Fri Aug 08, 2008 11:31 am

Location: Western Australia

Post Wed Nov 25, 2009 10:32 am

Re: Medeco Bumpkeys.

Awesome post, i enjoyed that very much.
If you can't be good, Be good at it.

http://au.youtube.com/S1DESHOWMICK
<<

barbarian

Active Member

Posts: 347

Joined: Thu Mar 27, 2008 9:08 pm

Post Wed Nov 25, 2009 3:34 pm

Re: Medeco Bumpkeys.

Thank you all for the positive response !!

:D
<<

HallisChalmers

Lord Emeritus of Keypicking HallisChalmers

Posts: 2070

Joined: Mon Apr 28, 2008 8:46 pm

Location: Hell

Post Wed Nov 25, 2009 8:31 pm

Re: Medeco Bumpkeys.

barbarian wrote:Thank you all for the positive response !!

:D


Good work - greatly appreciated and BTW, you've been stickied! (woohoo) (Cookie)
<<

elbowmacaroni

User avatar

Site Owner

Posts: 1353

Joined: Mon Nov 16, 2009 9:28 pm

Location: Florida

Post Tue Dec 01, 2009 4:46 am

Re: Medeco Bumpkeys.

That was quite interesting. I think I'll have to remember to look back here once I improve ALOT.
"Cave ab homine unius libri" - Beware of anyone who has just one book

(2014.02.09 - 23:26:03) huxleypig: i freaking love cream
(2014.02.09 - 23:27:11) huxleypig: hey, come on, cream is nice
(2014.02.09 - 23:27:37) huxleypig: aww, i suddenly feel very sick

(23:37:46) LocksmithArmy: you should see my school girl outfit
(23:37:50) LocksmithArmy: wait... what

(13:19:50) xeo: that chick will never be satisfied by a real dick
(13:19:54) NNFAK: I would man...

(22:59:49) PhoneMan: how do you let a forum die if users keep using it? kill the servers?

May those who love us, love us; and those who don't love us, may God turn their hearts; and if He doesn't turn their hearts, may he turn their ankles so we'll know them by their limping

If someone had prince albert in a can, does that mean they'd have a killer codpiece?

(00:52:02) WolfSpring: elbow could sell a sandbox to an egyptian
<<

sebby

Newbie

Posts: 2

Joined: Fri Apr 23, 2010 7:38 am

Location: Gboro, NC

Post Tue Apr 27, 2010 4:28 am

Re: Medeco Bumpkeys.

hahaha thanks for re-uping the pics, and congrats on being stickied
<<

barbarian

Active Member

Posts: 347

Joined: Thu Mar 27, 2008 9:08 pm

Post Fri May 07, 2010 7:55 pm

Re: Medeco Bumpkeys.

Here is a little follow up about the Medeco code setting or bump keys.

The vulnerabilities of the Medeco Bi-Axial locks were made public by Marc Tobias in his book “Open in thirty seconds”. There was just enough information included in the book to allow someone to reproduce the cuts for the keys without actually having the charts from Mr. Tobias. The charts that showed the cuts were published in a supplement to his LSS+ books and were not available to the public. Medeco responded to the publicizing of this information by changing the pinning of their locks and allowing locksmiths to use certain combinations of angles that had been previously reserved for Medeco factory use only.

When looking at the charts you can see the progression of cuts and how certain sequences repeat for the different keys. The older generation of keys should work on any lock pinned to the standard code book prior to December 2007. The newer generation allowed additional angle combinations in code space one, three, and five. This required sixteen keys instead of four.

The code setting keys only work on the Bi-Axial or the M3 locks. These are the ones with the chisel point on the key pins off center towards the front or back of the lock. The code setting and bump keys feature some cuts at the Medeco standard 20 degrees and some at 10 degrees. This 10 degree cut allows the key to function on pins at 20 degrees ( left or right )and also on pins at zero degrees ( center). The code setting keys are produced on a safe deposit type flat key blank. Almost any flat blank will work. The key is thinned down to about .030 of an inch (about the same as a standard pick thickness) to allow it to slip between the wards of the lock and function on pretty much any keyway Medeco has. Nice bypass of their key control ! The bump keys have to be produced on the correct key blank for the lock.
Letters are used to designate the angle cuts on Medeco locks. Originally they were L,R,C for Left, Right, and Center cuts. With the Bi-Axial locks they added Fore and Aft spacing. So for Bi-Axial locks the letters in the alphabet just before L,R,C were used to indicate Fore cuts with Left, Right, and Center rotations. These are K, Q, and B. The letters just after L,R,C in the alphabet were used to indicate Aft cuts. These are M,S, and D.

So:
K means Fore Left
Q means Fore Right
B means Fore Center
M means Aft Left
S means Aft Right
D means Aft Center

We can combine letters to indicate a special 10 degree cut. For example DS means an aft cut at 10 degrees right, half way between a D cut and an S cut angle wise.

Cuts are from Bow to tip. Double cut keys. Generation two.

Key A = Q-D / B-S / KB-S / Q-DM / K-DS / QB-M
Key B = Q-D / B-M / KB-S / Q-DM / K-DS / QB-M
Key C = K-D / B-S / KB-S / Q-DM / K-DS / QB-M
Key D = K-D / B-M / KB-S / Q-DM / K-DS / QB-M

You can see the progression through the chart. The cuts in positions one and two are the only ones that change. The cuts in the other positions are the same for each key. If you can determine the Fore and Aft pinning of the first two pins in the lock, you can choose the correct key.

For the newer generation three Medeco locks, sixteen keys are needed.

Key 1 = Q-DS / B-S / KB-DS / Q-DM / K-DS / QB-M
Key 2 = Q-DS / B-S / KB-DS / Q-DM / Q-DM / QB-M
Key 3 = Q-DS / B-S / KB-DM / Q-DM / K-DS / QB-M
Key 4 = Q-DS / B-S / KB-DM / Q-DM / Q-DM / QB-M
Key 5 = Q-DS / B-M / KB-DS / Q-DM / K-DS / QB-M
Key 6 = Q-DS / B-M / KB-DS / Q-DM / Q-DM / QB-M
Key 7 = Q-DS / B-M / KB-DM / Q-DM / K-DS / QB-M
Key 8 = Q-DS / B-M / KB-DM / Q-DM / Q-DM / QB-M
Key 9 = K-DM / B-S / KB-DS / Q-DM / K-DS / QB-M
Key 10 = K-DM / B-S / KB-DS / Q-DM / Q-DM / QB-M
Key 11 = K-DM / B-S / KB-DM / Q-DM / K-DS / QB-M
Key 12 = K-DM / B-S / KB-DM / Q-DM / Q-DM / QB-M
Key 13 = K-DM / B-M / KB-DS / Q-DM / K-DS / QB-M
Key 14 = K-DM / B-M / KB-DS / Q-DM / Q-DM / QB-M
Key 15 = K-DM / B-M / KB-DM / Q-DM / K-DS / QB-M
Key 16 = K-DM / B-M / KB-DM / Q-DM / Q-DM / QB-M

According to Mr. Tobias the appropriate keys from the generation three chart can be used in generation two locks. So a number 1 key replaces the “A” key from the set of four. Also a number 5 key can be used in place of a “B” key and key 9 instead of a “C” key, and key 13 instead of a “D” key. If you compare in the charts above you will see the difference is only a couple of 10 degree cuts instead of 20 degree cuts on the older keys. My personal belief is that all of the 20 degree cuts can be replaced by 10 degree cuts and the keys will still function. I haven’t tested this yet.

For the code setting keys there is also a bit of tinkering required on the depth of the cuts. You want a nice cut for the pins to sit in so the proper angle will be set. You also need to withdraw the key from the lock while it’s under tension, without over lifting a number six length pin. If the cuts are left with sharp points on them after cutting, then the points are easily bent or mushed a bit when the key is used repeatedly. I find the best thing is to use some sandpaper held on a flat surface and gently sand some flats on to the points of the cuts. You also need to pay attention to the depth to avoid overlifting. A Medeco number six pin is about .350 in length. If you drop the pin into a Medeco plug and measure, you will see it only sits about .020 below the shearline. That is how much your code setting key can lift the pin while you withdraw the key from the lock. If the pin gets lifted much more than that amount it will be trapped above the shearline and the lock won’t open.

There is another factor in the size of the code setting keys. The Medeco plug is about .510 in diameter. Since we know from our measurements taken above that the pin drops into the plug about .370 (.350 + .020) We can see that the code setting key has to be at least .140 to even touch the bottom of the keypins. If we add on the .020 that we are allowed to lift a number six pin, then we can determine the thickness of the blade and the depth of the cuts for the code setting keys. The tips of the keypins actually sit on one of the side wards of the lock. The height may vary depending on the specific keyway in use on your lock, and how vertical your code setting key is when it slips between the wards. My codesetting keys measure about .150 at the bottom of the cut and seem to work well on my locks.

Pointed-tops.jpg


flat-tops.jpg
You do not have the required permissions to view the files attached to this post.
<<

sandman

I've Been Banned!!
I've Been Banned!!

Posts: 345

Joined: Sun Aug 08, 2010 11:43 pm

Location: Texas

Post Sat Nov 06, 2010 6:59 pm

Re: Medeco Bumpkeys.

i love these fucking posts! thank you so much for writing them!
<<

MrPharmer2012

User avatar

Doctor... Contributor
Doctor... Contributor

Posts: 369

Joined: Tue Oct 11, 2011 12:10 am

Location: San Diego CA

Post Sat Oct 29, 2011 12:47 am

Medeco Comprehensive How To Code Setting and Bump Keys Guide

I Put everything on here in a much easier read PDF Document. I have also included a chapter in one of my Locksmith Books on High Security Locks Mainly Medeco in Chapter, Hope you Guys Enjoy
:longhook: MrPharmer2012
You do not have the required permissions to view the files attached to this post.
Image
<<

macgng

User avatar

Contributor / I Fought Tooth and Nail to Acquire BO...
Contributor / I Fought Tooth and Nail to Acquire BO...

Posts: 915

Joined: Sun Jan 23, 2011 3:38 am

Location: MD, USA

Post Sun Oct 30, 2011 2:33 am

Re: Medeco Bumpkeys.

freakin awesome!

edit: someone wanna make me some? i got goodies to trade for them!!!
Nibbler: The poop-eradication is but one aspect of your importance.
Image
Next

Return to Medeco

Who is online

Users browsing this forum: CommonCrawl [Bot]

Don't forget to visit our sponsors for all of your lockpicking needs!
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Grop
"CA Black" theme designed by stsoftware