Skip to main content

Lockpicking: Wafer Lock, AMA – Part 2

Wafer locks are simple at heart, they try as best they can to protect the assets of their owners. With a little careful skill, they can be cajoled into handing over the assets they are sworn to protect.

Image of a wafer lock on the inside and how it functions, image from Wikipedia used by white oak security https://en.wikipedia.org/wiki/Wafer_tumbler_lock#/media/File:Disc_tumbler_locked.png
Image of a wafer lock on the inside and how it functions, image from https://en.wikipedia.org/wiki/Wafer_tumbler_lock#/media/File:Disc_tumbler_locked.png

I Am A Wafer Lock: Ask Me Anything!

They are composed of wafers, springs, a rotatable plug, and a cylinder. The plug is encased in the cylinder, and when locked, springs push wafers into the groove in the body, preventing its rotation by blocking the shear line. The correct key aligns all the wafers with the shear line by pushing against the opposite side of the wafer. This action retracts the wafer end that is supposed to get stuck in the groove and prevent the plug from turning. Each key has a ridge cut for each wafer that is the correct height to align the wafer with the shear line. When lock picking you utilize the tensioner and the pick in unison to imitate the effect of a correct key.

Wafer locks are not as fancy as the pin tumblers. They do not have any variations to their wafers that make it more difficult to pick them. Some of them do have double-sided grooves in the outer cylinder, which require someone to pick the bottom and the top of the keyway.

The same rules apply regarding tension with wafer locks as with pin tumbler locks, less is more! The one good bit of news is that it is harder to overset a wafer than to overset a pin.

How To Pick A Wafer Lock

When picking a wafer lock, it’s essential to first understand the fundamentals of the lock. Familiarize yourself with the number of wafers and their possible arrangement. Identify if it is a single- or double-sided wafer lock. Inserting a key and turning it slightly can give a preliminary feel of the wafer arrangement during practice. 

When the plug is turned without the correct key inside, the wafers will contact the shear line and prevent further rotation. Although all wafers in the lock are aligned in a straight line, due to unavoidable imperfections during the manufacturing process, one wafer will always contact the shear line first. This is referred to as the binding wafer, and it makes picking a wafer lock possible.

The tensioner may be the most difficult tool in your arsenal to learn how to use properly. It’s placed at the bottom or top of the keyway (BOK/TOK) to apply rotational tension to the plug. Many keyways are extremely difficult to pick with the bottom of the keyway tensioner, so every beginner lockpicker should purchase both top and bottom of the keyway tensioners. 

The amount of tension is critical when picking. The aim is to apply just enough pressure to bind the first binding wafer, making it slightly harder to move than the others. There are times when applying more tension will give you better feedback, but at the beginning aim to use the least amount of tension possible, as beginners will almost always over torque the plug. The goal is to use light to moderate tension, allowing the binding wafer to move while keeping the plug slightly turned.

What do wafers look like & why do I have to pick the opposite side of the groove?

Image of a wafer lock on the inside and how it functions, image from link used by white oak security
https://www.r1200gs.info/cdn-cgi/image/format=auto,onerror=redirect,width=1920,height=1920,fit=scale-down/https://www.r1200gs.info/attachments/bmw__new_vario_pannier_lock_key_config_002-jpg.27771/

First, the reason you have to pick the opposite side of the groove is that the wafer lock spring pushes the wafer up/down into the groove on the housing of the lock.

When dealing with a double-sided wafer lock, it is often best to utilize a snowman pick (like the photo below) so that you do not have to remove the pick and flip it over to pick the opposite side wafers.

Image of snowman pic from https://cdn11.bigcommerce.com/s-h9n64je4/images/stencil/1280x1280/products/4004/16051/FS-GSPSMALL__39165.1551549551.gif?c=2used by white oak security cybersecurity and penetration testing company

Insert the pick into the keyway and gently feel each wafer by pressing them. The binding wafer will feel different – it won’t spring up as freely as the others because of the binding force. This wafer is your first target.

Once you’ve identified the binding wafer and perfected the tension, gently press the binding wafer with the pick. Once the wafer has been pulled below the groove and in-line with the shear line, you’ll feel a slight rotation on the plug and hear a faint click. This means the wafer is set, and there is now a new binding wafer preventing rotation. After setting the first wafer, adjust the tension to locate the next binding wafer by applying slightly more tension. If you reduce the tension while performing your picking attempt, you run the risk of losing the first binding wafer. Always remember that the required tension may differ from wafer to wafer. Repeat the process, paying close attention to the tension applied, ensuring it’s not too much to prevent the wafers from setting or too little to let them fall back down.

Once all wafers are set at the shear line, the plug will turn freely, and the lock will open. If the plug doesn’t turn, recheck each wafer to ensure they are all set correctly.

If you missed part 1 check that out and here’s more of our lockpicking blogs.

Lockpicking Tips & Tricks

  • Be gentle: Beginners often start with high tension. Start lighter than you think you need, gradually increasing if necessary. Gentle does it.
  • Use all of your senses: Pay attention to the feedback. A click sound and a slight turn of the wrench can indicate that a pin is set.
  • Be flexible: Not every pin requires the same amount of tension. Be ready to adjust the tension as you move from pin to pin.
  • Practice makes perfect: Finding the right amount of tension is a skill developed over time. Practice patiently, and don’t force it.

Lock picking is a skill! Which means it takes some time to master. We will keep writing blogs to help you along the way.

MORE FROM WHITE OAK SECURITY 

White Oak Security provides deep-dive offensive security testing. We are a highly skilled and knowledgeable cyber security and penetration testing company that works hard to help organizations strengthen their security posture by getting into the minds of opponents to try to protect those we serve from malicious threats through expertise, integrity, and passion. 

Our unique industry experience allows us to offer a wide range of services to help analyze and test information security controls and provide guidance to prioritize and remediate vulnerabilities.

Read more from White Oak Security’s pentesting team.