Pierluigi Paganini September 12, 2015

On gitHub there are available for download the blueprints for the TSA master keys, every lock which is ‘TSA recognized’ is at risk.

In November 2014, The Washington Post published a story  about “the secret life of baggage” showing the secret work the Transportation Security Administration officers.

The article was only briefly accompanied by a photo of the master keys the Transportation Security Administration uses to open what it calls “TSA recognized” luggage locks.

The TSA master keys are designed to allow 0rthe TSA security officers to inspect luggage without having to cut off any locks protecting it. The TSA master keys only work with locks created specifically for to protect luggage during the trips, they were designed thanks to partnerships between the agency and lock manufacturers.

Although the photo was promptly taken down, it was already circulating over the Internet. Unfortunately, a number of reports about the leak were observed last month, but are the two events correlated?

According to the investigators, the reports began after detailed blueprints of the “TSA Travel Sentry-master keys” were published on GitHub. This means that anyone can download the blueprints and create its copy of the TSA master keys by using a 3D printer.

“Security researchers have long warned of the dangers of using master-keyed locks,” wrote Xyl2k, the GitHub user who posted the detailed plans.

Now, anyone with a 3D printer can create their own copies of the TSA master keys — and create them they have, according to reports from exuberant users.

The security geek Bernard Bolduc published on Twitter a video where it is demonstrated how to use the master key printed starting from the blueprints leaked online.

OMG, it’s actually working!!! pic.twitter.com/rotJPJqjTg

— Bernard Bolduc (@bernard) 9 Settembre 2015

“TSA has worked with several companies to develop locks that can be opened by security officers using universal “master” keys so that the locks may not have to be cut. These locks are available at most airports and many travel stores nationwide. The packaging on the locks indicates whether they can be opened by TSA.” the TSA noted in a blog post early last year. 

Stay Tuned!

Pierluigi Paganini

(Security Affairs – 3D TSA master keys, Android)