Comb Pick: The Over-Lifting Attack, Its History, and Standards

Definition

The Lock Industry Standards and Training (LIST) Council's Professional Locksmith Dictionary defines a comb attack as "a pin tumbler defeat tactic using a series of straight pins or teeth on a single tool, intended to push the pin stack past the shear line." The tool takes its name from that row of teeth.

Over-Lifting Versus Picking

A correct key lifts each stack of pins so that the gap between pins lines up with the shear line, the boundary between the turning plug and the fixed housing. Picking, in the LIST definition, manipulates the tumblers through the keyway toward that same alignment without the key. See pin tumbler locks for how the parts work.

A comb attack has a different goal. Rather than aligning the gaps at the shear line, it tries to move the whole pin stack past it. That is why the comb is often described as an over-lifting attack and grouped with bypass methods: it exploits how the lock is built rather than manipulating each pin into its correct position. The LIST dictionary's general definition of a by-pass tool, "a device that neutralizes the security of a locking device, or its application hardware, often taking advantage of a design weakness," captures the idea.

An Early Patent

The idea is old. US Patent 2,064,818, "Means for unlocking locks," was filed by Francis Buday on September 29, 1934, and granted on December 22, 1936. The patent states its object as letting a person open a pin tumbler lock "where the person has mislaid his key," "preferably without mutilating the lock or dismantling it." Its described approach holds the pins "in upward or unengaging position... out of contact with the rotatable cylinder," which is the over-lifting concept in its earliest documented form that Pin and Ward has found. The patent's operating details are not repeated here.

Older reference material sometimes gives "1934" as the patent's date. That is the filing year. The grant came in 1936.

How Locks and Standards Account for It

Lock standards do not name the comb specifically. They test whether a lock resists non-destructive entry by any method, and they grade the result.

• Padlocks. ASTM F883, the US performance specification for padlocks, states that it includes "forcing tests, and surreptitious entry tests" and grades levels of performance so buyers can select suitable padlocks. The European padlock standard, EN 12320, sets six security grades "based on performance tests that simulate an attack."
• Door and cabinet locks. UL 437 (Key Locks) covers cabinet locks, door locks, locking cylinders, and security container locks. A 2007 DEF CON summary by Marc Weber Tobias and Matt Fiddler lists its timed covert-entry tests, including picking and impressioning.
• High-security cylinders. The LIST dictionary defines a high-security cylinder as one with greater resistance to two or more of picking, impressioning, key duplication, drilling, or other forced entry. ANSI/BHMA A156.30 grades such cylinders in levels and cautions that its tests "are performed under laboratory conditions."

Standards describe results under test conditions. They do not promise that a particular lock resists every method in every installation.

Detection

The LIST dictionary distinguishes covert entry, which "can only be detected via disassembly and/or detailed inspection," from surreptitious entry, which cannot be detected that way. Tools inserted through a keyway generally leave marks. TOOOL Netherlands notes that picking tools "make scratches in the lock in places a key would never come into contact with." See forensic locksmithing.

Ethics and Law

Locksport clubs, where comb attacks are discussed as examples of design weakness, require permission. TOOOL Netherlands says its most important rule is "to only open locks that you have permission for to open from the owner." Possession of entry tools can itself be an offense in some places. Virginia Code § 18.2-94, for example, makes possessing burglarious tools with intent a Class 5 felony. Laws vary. See lockpicking for more documented examples.

Related Topics

• Bypass
• Lockpicking
• Pin tumbler locks
• Padlocks
• Security pins
• High-security locks
• Forensic locksmithing

Sources