Tuesday, March 24, 2009

Sneakey, Scary.

As a security analyst, I feel I am a little more paranoid (careful?) than most people about, well most things, and this little article I read today really helped to add to my ever-expanding list of things to watch out for.
It seems that a group of computer programmers at the University of California San Diego have developed a piece of software which they've dubbed "Sneakey". Sneakey is capable of taking a digital image of a physical key, like the kind most people use to unlock their houses, and produce an exact working copy within minutes. The application can use the digital image of a key from nearly any angle to measure out the depth of each cut and string together the information into what locksmiths call the key's bitting code. This is typically a five or six digit number that the locksmith uses to cut into the blank keys. This bitting code along with the basic key shape/information is all that is needed to make a duplicate key.
In one experiment by the Sneakey team at UCSD, they installed a camera on their four story department building (77 feet above the ground) at an acute angle to a key sitting on a café table 195 feet away. The image (shown above) was correctly decoded and duplicated. They say that it works so well that a low resolution picture from a cell phone is enough to get the job done.
The way it works is quite simple, for someone versed in MatLab and computer vision techniques, that is. Utilizing a reference image of a key and its bitting code, the application adjusts the angle of the target key and overlays it on the reference key. Once there, the software compares the bitting code to the reference control, and calculates the differences.
The Sneakey team says that this software won't be leaked into public, but now the idea has, and that seems possibly bad enough. Their advice is good advice "Keep your keys in your pocket", and you may want to go and pixelate all of your photos where you're sitting somewhere with your keys on the table while you're at it.

0 comments: