Lockpickers took advantage of US Transportation Security Administration breach in which photos of its ‘approved’ locks were posted online

Anyone with a 3D printer can now unlock every single TSA-approved padlock, thanks to a security lapse by the American government agency.

The Transportation Security Administration, created following the 9/11 attacks to ensure the safety of travellers into and around the US, requires any lock on bags to be branded as “travel sentry approved”, to enable them to carry out searches without having to break the lock or bag.

The master keys for those locks are kept under close guard – but a photograph of seven of them accompanied a Washington Post article about the TSA published in November 2014. It took almost a year for anyone to notice, but once they did, lock pickers moved fast to take advantage of the breach. The Washington Post took the picture down in August, but it was too late.

While copying a key from a photograph remains tricky, one security researcher, going by “Xyl2k” has lowered the barrier to entry considerably. They posted the necessary files to 3D print all seven master keys on code-sharing site Github – and others who have printed them off confirm they work.

Bernard Bolduc (@bernard) OMG, it's actually working!!! pic.twitter.com/rotJPJqjTg

Xyl2k used the breach to preach against the use of master keys in general, citing a research paper by AT&T’s Matt Blaze. “Virtually all master keyed mechanical lock systems are at least theoretically vulnerable,” Blaze wrote in 2003. “Unfortunately, at this time there is no simple or completely effective countermeasure that prevents exploitation of this vulnerability short of replacing a master keyed system with a non-mastered one.”

Security researchers have also highlighted the breach as a reason to be wary of calls for a similar approach to cyber security. Just a month before it published photos of the TSA’s master keys, the Washington Post called on tech companies to “invent a kind of secure golden key they would retain and use only when a court has approved a search warrant”. Following the call, the Electronic Frontiers Foundation warned: “There is no way to put in a backdoor or magic key for law enforcement that malevolent actors won’t also be able to abuse.”

The campaign group continued: “Any key, even a golden one, can be stolen by ne’er-do-wells. Simply put, there is no such thing as a key that only law enforcement can use – any universal key creates a new backdoor that becomes a target for criminals, industrial spies, or foreign adversaries.”