Medeco
Medeco is a high-security lock manufacturer, located in Roanoke County, Virginia, United States. Medeco is a subsidiary of the Swedish Assa Abloy Group.
History
Mechanical Development Company, a tool and die shop, originally started in the mid-1950s by Paul A. Powell and Roy C. Spain in his basement in the Cave Spring area of Roanoke County. Spain later designed and received a patent (No. 3,499,303) for his new lock, which subsequently began Medeco as a company. Medeco was established in 1968 named after "Mechanical Development Company" in Salem.
As a promotional campaign, Mr. Spain advertised that anyone who could pick his new lock would receive $50,000. Many tried and failed, except for one detective from New York City, who was able to pick the lock once but not twice.
Mr. Spain's unique locking principle of angled key cuts and elevating and rotating pin tumblers that provided millions of key combinations and a level of security that was unmatched in its time. The locks were highly resistant to most forms of attack. The company expanded rapidly and contracted its original name into Medeco. The company's present 130,000-square-foot (12,000 m2) facility was opened in the mid 1970s.
Mechanical Development Tool and Die Company founded by Mr. Powell and Mr. Spain, is located in Salem, VA. and still in business by the family members of Paul A. Powell.
In 1985, Medeco developed a new design under the trade name Biaxial. It provided high security and key control through the use of the elevating and rotating tumbler design and provided greater master keying capability due to double cuts on the keys and special offset tips on the pins. Additionally, hardened steel inserts were placed to defend against physical attack.
In 1995, Medeco introduced a product called Keymark for installations requiring strong patented key control without the need for additional drill and pick resistant features. The interchangeable core directly retrofits small format interchangeable cores (SFIC) followed by Medeco's latest high security product, Medeco3 in 2001.
In the early 1990s, Medeco started their electronic lock initiative by launching VLS, an electromechanical solution, which was heavily utilized in the payphone industry. Later in 1997, Medeco followed up with an EAC solution in Siteline, a contact/controller based product. With previous success in industrial applications, Medeco redesigned the VLS application to fit the parking industry in the late 1990s then launched their NEXGEN product geared toward parking, vending and other industrial applications in 2001. Medeco followed up NEXGEN late in 2006 with Logic using the ASSA ABLOY CLIQ Technology, and Hybrid Keys using Prox and IClass technology in 2007.
Medeco currently has over 250 employees. [1]
Design
Medeco's patented lock design requires the angled cuts of a key to elevate and rotate the pins inside the lock in order for a side-bar to drop, allowing the cylinder to turn. The pins are uniquely chisel-tipped which allows them to be rotated by the angled cuts on the key and have a slot along the length of the pin for the sidebar to drop into once the pin has been rotated to its correct orientation.
The off-centre chisel tip also allows 2 different offsets to the pin. This makes the keyway very secure. In theory, the number of different key combinations is 2,176,782,336 (6 pins, 6 heights, 3 rotational positions, 2 offsets), which does not include consideration of different keyways. This flexibility makes Biaxial attractive to large masterkeyed institutions.
Key control
Medeco uses patented key control systems, including patents on the keys and the cylinder, to prevent unauthorized copies of keys from being generated. The original patent No. 3,499,303, Roy C. Spain, inventor, filed April 17, 1968 and issued March 10, 1970 established the Medeco business. Two other utility patents, No. 4,635,455 issued on January 13, 1987 and No. 4,393,673 July 19, 1983 (Biaxial). Medeco obtained a new utility patent on their newest product named Medecom3; the patent is set to expire in 2021.
Cracking
A group of researchers presented a paper on cracking Medeco's locks at the 2007 DEF CON conference. Using computing power and mechanical know-how, the group developed a means to "bump pick" the lock needing fewer than six custom "bump keys", a paperclip, and a small hammer. Company officials are looking to verify the claim and have announced a new version of the lock, to soon be released, that they claim will be bump-proof.[2]
As of 2008, several new methods of cracking Medeco locks has been developed by Marc Tobias and Tobias Bluzmanis and were presented at the DEF CON 2008 and HOPE 2008. A simultaneous public release of a book detailing many of the exploits, called "Open in Thirty Seconds" detailed many of the attacks discovered. Some of their major findings involved the use of plastic keys (that can be made out of credit card plastic, or even generic safe deposit box keys) allowed for the copying of any Medeco M3 (current generation) or some of the Medeco Biaxial keys completely bypassing the key control of the systems. In addition they also detailed 4 keys that were able to set the sidebar on any factory codebook pinned Medeco lock prior to 2007, or 16 keys that would set the proper sidebar on any current factory codebook lock at the time of release. They further detailed the ability to bump current generation Medeco M3 locks.[3][4][5]
Many Medeco dealers continue to make claims about the Bump and Pick proof nature of their locks, however Medeco has retracted virtually all of its own press indicating such claims.
Creating a bump key does require the key being able to set pins to the proper rotation, so one bump key could not work for all locks. The Security.org team has shown that a relatively small number of keys (see above) could be used to do this.