Last year, the Washington Post published a story on airport luggage handling that contained unobscured images of the “backdoor” keys of the Transportation Safety Administration, along with many other security agencies around the world, used to gain access to luggage secured with Travel Sentry locks. These locks are designed to allow travelers to secure their suitcases and other baggage items against theft with a key or a combination, while still allowing the secured luggage to be opened for inspection—ostensibly by authorized persons only. The publication of the images effectively undermined the security of the Travel Sentry system, since the images were of sufficient quality to create real-world duplicate keys.
Because Travel Sentry locks are physical things, images of the keys showing the configuration of teeth and notches and shafts are more than enough to enable key makers to construct duplicates. The security of the system hinges on consumers being able to trust that only a properly authorized person can open their luggage, and that trust (even if it has always been hilariously misplaced) is gone. As Bruce Schneier commented a few days ago: “The whole thing neatly illustrates one of the main problems with backdoors, whether in cryptographic systems or physical systems: they’re fragile.”
Of course, the reason we’re revisiting this topic now, almost a year after the leaked images, is that a few enterprising hackers (in the correct sense of the word “hacker”) have put together 3D printable model files of the TSA keys and uploaded them to a GitHub repository. Now, rather than needing specialized skills and tooling to craft a duplicate Travel Sentry key, all you need is a 3D printer that can handle STL files (and that’s basically any 3D printer).
We’ve currently got a Buccaneer 3D printer on loan from the kind folks at Pirate3D, so we were all set to grab the files and go to work. The issue with the STL files in the GitHub repo is that they’re not quite correctly scaled—they need to be sized up by a factor of 1.57 on the X and Y axes, and reduced to 0.64 on the Z axis (hat tip to GitHub user johnnyxmas for nailing the scaling factors in this pull request). This is an easy fix with MeshLab or the 3D modeling application of your choice.
Actually producing high fidelity keys that worked took a day or so—it turned out that the number 2 key lacked a ward cutout needed to properly fit the number 2 lock, but the community quickly came to the rescue with a pull request. After fiddling with the keys’ orientation on the print bed, we eventually wound up with our own Travel Sentry keyring—one that effortlessly unlocked both of the Travel Sentry locks I had immediate access to.
Is this disheartening news? Not particularly. Locking your luggage has never provided any real additional protection against all but the most casual theft attempts (as evidenced by the fact that almost any piece of luggage with a zipper can be opened with a screwdriver or a pen regardless of how many locks are hanging off of it). The spreading of 3D printable Travel Sentry keys is more of a criticism of any kind of “backdoor” cryptography—be it one that involves physical keys or mathematical. The backdoor itself undermines any and all trust in the system.
Source:https://arstechnica.com/
He is a well-known expert in mobile security and malware analysis. He studied Computer Science at NYU and started working as a cyber security analyst in 2003. He is actively working as an anti-malware expert. He also worked for security companies like Kaspersky Lab. His everyday job includes researching about new malware and cyber security incidents. Also he has deep level of knowledge in mobile security and mobile vulnerabilities.
