Have a 3D printer? You can make your own TSA master key, thanks to online photo
[embed]
[/embed]
Last November, the Washington Post published a story called "The Secret Life of Baggage: Where does your luggage go at the airport," a piece that explained exactly what happens when travelers check their suitcases at the airport. The article covered the TSA's screening and inspection process and discussed how agents handle bags that have been secured with a TSA-approved lock:
"It’s locked? No problem, the inspector has a key ring full of master keys for TSA approved locks."
Actually, there was a problem: the Post published a photo of those master keys online and – although it has been removed from the website – the Internet didn't forget it. Security experts and lock picking enthusiasts dug up the photo in August and began either shaking their collective fists toward the sky or attempting to exploit it. And, so far, the lock-pickers are winning.
According to WIRED, earlier this week, a set of files were posted to the website Github that could be used to print exact 3D copy of those TSA master keys – and at least one person with a 3D printer has followed the instructions and demonstrated that they work. A self-described "security geek" named Bernard Bolduc posted a video to Twitter showing his printed plastic key opening a Travel Sentry TSA-approved lock.
[embed]
[/embed]
[embed]
[/embed]
"Xylitol," the Github user who published the files, told WIRED:
"Honestly I wasn’t expecting this to work, even though I tried to be as accurate as possible from the pictures. I did this for fun and don’t even have a TSA-approved lock to test. But if someone reported it that my 3D models are working, well, that’s cool, and it shows [...] how a simple picture of a set of keys can compromise a whole system.”
According to Travel Sentry's website, more than 250 million Travel Sentry Approved locks and luggage are currently in use by travelers today. Travel Sentry TSA-approved locks are sold under a long list of brand names, including Master, American Tourister and Samsonite – pretty much anything you're going to find in the luggage aisle at your closest big box retailer. Travel Sentry certainly isn't at fault for the vulnerability; it just might not have been a great idea for TSA to allow its master keys to be photographed. When Road Warrior Voices contacted Travel Sentry for comment, a spokesperson referred us to the TSA.
In a statement to Road Warrior Voices, TSA spokesperson Mike England said:
“The reported ability to create keys for TSA-approved suitcase locks from a digital image does not create a threat to aviation security. These consumer products are 'peace of mind' devices, not part of TSA’s aviation security regime. Carried and checked bags are subject to the TSA’s electronic screening and manual inspection. In addition, the reported availability of keys to unauthorized persons causes no loss of physical security to bags while they are under TSA control. In fact, the vast majority of bags are not locked when checked in prior to flight.”