Hackers Can Now Pick Your Physical Door Lock Using Audio

Every time you turn your key in a lock, it emits subtle acoustic clicks. Researchers have shown that hackers can eavesdrop on and decode these sounds.

While human ears cannot detect the minute acoustic variations produced by different key ridges hitting lock pins, software has been developed to analyze each unique acoustic signature.

An adversary would only need to capture this audio—for instance, via a compromised smartphone microphone—and feed the recording into the software to reverse-engineer and replicate the key.

First detailed in research published by Soundarya Ramesh, Harini Ramprasad, and Jun Han at the National University of Singapore, this attack vector relies on compromising an everyday smartphone or smartwatch.

For example, if a mobile game or utility app requests microphone permissions and you approve it, you could unwittingly expose physical access to your home to hackers. Furthermore, the microphone does not even need to be in immediate proximity to the lock.

SpiKey

Named “SpiKey,” this attack framework records the audio emitted as the key ridges interact with the lock pins during insertion. The inter-pin timing and acoustic peaks allow the software to deduce the relative heights and combinations of the key bittings.

Upon processing the audio, the software narrows the potential candidate keys down to an average of just 5 candidates, virtually guaranteeing that one of them will unlock the door.

Diverse Lock Systems Introduce Friction

In real-world scenarios, the biggest hurdle for attackers is knowing the exact model of the target lock cylinder. Given the vast array of pin-tumbler systems and corresponding key blanks on the market, the software cannot reliably manufacture a blank without reconnaissance.

Nonetheless, an intruder planning a break-in can often visually inspect the door lock beforehand to identify the manufacturer and keyway profile.

Insertion Speed Considerations

Naturally, people do not insert keys into locks at a uniform speed. The researchers accounted for this variance; the algorithm correlates acoustic timings against varying insertion speeds, which is why a small set of 5 candidate profiles is produced rather than a single deterministic key.