What is a bump key (Schlagschlüssel), and why was it considered a major security wake-up call?
A bump key is a key blank cut to the maximum depth at every position ("999..." key). Insert it, pull it out one click, then strike it with a hammer while applying tension. The percussion bounces all driver pins above the shear line — same Newton's-cradle effect as a pick gun, but with no special tool.
The technique:
1. Buy or file a "999..." key (deepest cut at every position)
2. Insert into the lock
3. Pull back ONE click (so the key cuts hit the BOTTOMS of the
key pins, not their middles)
4. Apply slight rotational tension with the same hand
5. STRIKE the bow of the key with a small hammer or mallet
6. Pins bounce → driver pins clear shear line → tension rotates
the plug → lock opens
Why this was a 2005 panic:
Bumping was demonstrated publicly in 2005–2006 by TOOOL members (the "999 key" attack). It revealed that the vast majority of pin-tumbler locks worldwide were vulnerable to a 30-second attack with a $1 key blank. No special skill, no expensive tool, no marks beyond what the original key would leave — much harder to detect forensically than picking.
The video "Bumping Locks" by Marc Tobias hit YouTube and went viral. Lock manufacturers scrambled to release "bump-proof" cylinders.
The countermeasures:
| Defense | How it works |
|---|---|
| Anti-bump pins | Modified driver pin with a "neck" that catches on the housing under percussion |
| Magnetic pins | Pin must be magnetically aligned by a special magnet in the key — bumping does nothing |
| Disc detainer (Abloy) | No spring-loaded pins to bump → totally immune |
| Electronic locks | Pins are virtual; physical bumping is irrelevant |
Why it's a cyber-relevant lesson:
Bumping is the physical-security equivalent of a timing attack — exploiting a side-channel (kinetic energy in this case) that the system designer didn't account for. The lesson is universal: a security mechanism is only as strong as its assumed threat model.
Tip: If you're at a hardware store and see a "Yale 5-pin" cylinder for CHF 19.90 — assume it bumps in 5 seconds with a $5 key. Anything important goes behind a cylinder explicitly marked as "anti-bump" / "bump-resistant" (Abus Granit, Mul-T-Lock, Kaba penta, etc.).
Go deeper:
Lock bumping — the 999/rapping-key mechanics, the 2002–2003 disclosure that caused the panic, and the anti-bump countermeasures.