EEVblog 1484 - Kaba Mas X-09 High Security Electronic Lock Teardown

[@grimninja2004]

to me whats even more interesting, is that this shows pretty much the exact way and bit placement to destructively open the lock, they drilled the handle pin, drilled out access to the setscrews and then drilled exactly tho the latch to free the bolt, then they may have drilled a second time into the bolt area to push the bolt open. of course there would have been a door of plate steel in the way between the inside and outside, so probably a bunch of carbine bits were involved i guess.

[@garywiens8625]

The only carbide involved would be in the safe door, present in the form of hard plate (basically a steel that is designed to be impossible to drill). They use probably 5-10 40 USD per piece long diamond hole saws to get through them. Source: There's a guy that wants to hire me that drills these safes for the US govt for a living.

[@EEVblog]

Locksmiths usually have access to drill templates for safes and locks like this.

[@kissingfrogs]

@@EEVblog I believe some safes have the safe locking mechanisms mounted on a sheet of glass within the door so an attempt at drilling from the front shatters the glass which collapses all making it even harder to withdraw the locking pins. It also means that slamming the big heavy door risks shattering the glass.

[@garywiens8625]

@@kissingfrogs IIRC the X-08 did. It was discontinued very quickly because it was such a b**ch.

[@DanBowkley]

@@kissingfrogs that's an option for the safe door; that glass plate attaches to cables that keep spring loaded latches called relockers retracted. If you try to drill the lock out like what happened here, the glass shatters and the relockers drop in and that locks the main bolts in place so the normal safe mechanism can't retract them. They're potentially a real PITA because if the door gets slammed or just hit hard enough you can get locked out of your safe even with the right combo. As far as I know at that point you'd be stuck having to drill out every single relocker individually.

[@aquatrax123]

This lock is one of the most secure locks ever build. I have one of these on my desk at work to remind of of what proper security looks like. It inspires me to keep the computer system I am responsible for secure. This lock was designed by the same people that created the mas hamilton soft drill. Many experts on the subject like Marc Tobias have said that there is no way to open this lock without drilling it out. There is so many security features in the lock that are amazing. For example, the screen has a limited view angle to prevent a camera from recording the code. The lock will shut down if the dial is rotated for more than so many rotations to prevent robot dialing. Each time you rotate the dial in the opposite direction, the number jumps to a random location in the dial. The PCB has UV particles in the conformal coating that create a "fingerprint" of the lock that is photographed during the manufacturing process so if the user feels the lock was tampered with the photo can be compared. There is an internal counter that shows how many times the lock was opened. This lock is truly amazing.

[@SureshotCyclonus]

Yes, spinning the knob will generate power for the lock and will start with a new random (number) position each time it powers on. If you spin it too fast, it will lock you out even if you enter the combo correctly. If you enter too many incorrect combos, it will make you wait to try again. These features are designed to prevent automated attacks such as a robot.

[@BillAnt]

That power generator is pretty clever, it provides pretty much fail safe power.

[@logmeindog]

I've been working on these X-0 locks for nearly 20 years now. Fascinating and well thought out for sure but quite simple once you've dealt with them for a bit. The X-09 you have is an earlier one and they had a common issue where the generator would crap out on them and no longer power up or generate enough power to actuate the unlocking catch paw. Kaba somehow avoided a recall and I'd wager what is what happened to your lock.

[@coyote_den]

The building I used to work in had many X-09s die like that. It was always a game of "well, is it going to be our room today?" because of course none of them got replaced until everyone was locked out.

[@arthurmoore9488]

Question. Couldn't you just replace the front part instead of drilling the whole thing out?

[@michaelpingleton776]

We have these locks where I work. I swear I have PTSD from that damn lightning bolt.

[@krux702]

That pin is an anti-tamper mechanism that prevents opening the back of the lock without tampering. "The Lock On Back Cover (LOBC) feature provides a locking mechanism that locks the back cover in place after installation. The design is such that the back cover cannot be removed without visible damage unless the combination is known, regardless of whether the lock is locked or unlocked" The two pin connector is used when you change the combination. There's a special tool you get with the lock that lets you do that The combination on these style locks usually get changed frequently.

[@krux702]

If I remember correctly when that pin is pulled out, it also prevents the lock from locking.

[@EEVblog]

@@krux702 Yes, looks like it does some mechanical interlock type thing.

[@GlutenEruption]

Look like when the locking bolt it in the locked position, that gets caught in that hole in the mechanism, locking the cover in place

[@logmeindog]

@@krux702 When the pin is pulled out, it allows you to remove the back cover. It might not've been designed this way but in my experience, you can only remove the LOBC as you are unlocking and spinning the dial. They are finicky and most locksmiths hate the LOBC. The X-10s did away with the LOBC.

[@Mike--K]

@@logmeindog Correct, the LOBC pin can only be pulled out as the dial is turned to open the lock, but before the dial stops. If you wait until the dial stops, you can't pull out the LOBC pin because the gate in levers close. The X-10 doesn't have a LOBC pin because there's no need to remove the back cover to install the lock.

[@BrianRossman]

The 2 pins are for changing the combination. The button is to unlock it from the inside, when installed on a door. They can be set up for 2 combination, supervisor mode (1 code 1/2 unlocks it so the user code can open it), or single combination.

[@EEVblog]

That makes sense, thanks.

[@Anamnesia]

The *_Two Pins_* are used to place the lock into Program mode, to program the combination. However, don’t got too excited, the Programming “tool” is just a plastic holder, with a bent piece of copper wire. It’s just a jumper to set the combination while the door is open. You remove the jumper “tool” when the combination has been programmed.

[@Anamnesia]

Spinning the dial powers the device. Spinning Left to XX three times, Right to YY two times, then Left to ZZ one time, places the combination into 'Unlock' mode, then you rotate the tumbler Right until OP & you hear the 'Click'! Something along those lines. We have KABA X-10's at my work, but I don't use them much. The X-10 is the only SCEC Endorsed combination lock, suitable for "Protected" (or Negative Vetting level 1, or NV-1) security classification.

[@Mike--K]

Not exactly. The older mechanical locks required the multiple passes for each combination segment. With the X-07, -08, -09, and -10, you go directly to the next number when you change dialing direction. You can pass the next number multiple times as long as you stop on it before changing direction and don't reach the timeout limit. The locks will also give you an "oops" attempt if you miss the number by a few digits and allow you to back up to the correct number before going to the next number. Mechanical locks won't allow this, so you have to reset the wheel packs and start over.

[@fox0ps22]

8051 controller, nice. Enough to do the job, and so simple that a programmer can hold the complete design in his head while working on it.

[@Ddevilislovely]

gsa certification has a ton of info related to these as these are typically a government lock. to drill remove anything like that you have to be certified typically because of the government protocols. ie if most of the time you allow them to get the items out then they throw out the container, its very costly but extremely secure. when you spin them up and pick your first number ie 50, then begin to spin the other direction it starts at a completely random number and repeat for the 3rd portion. This was introduced to prevent people from reviewing camera footage and being able to determine spin estimates to guess the combo. just be glad they typically don't use the glass walls in the safe.

[@cpnscarlet]

These were used on doors. OMG I hated these! Worked in a closed facility for decades. There was a requirement to mount them a certain height above the floor and if you were short, you had to stand on your toes to see the unlit display. Also had a non-linear, random rate sensor so that you had to spin the dial at different speeds to get the same number rate of change - actually clever for defeating some cracking mechanism.

[@BillAnt]

Modern safe cracking robots have can be programmed with random rate spinning, but the wrong combination timeout feature of the lock would prevent a successful cracking within a reasonable amount of time.

[@mrt1r]

We use these locks where I work. Its pretty cool to see a teardown.

[@MrDoneboy]

Never say it can't be defeated, Dave. There is a lockmaster born, every minute, I would guess.

[@Anamnesia]

Locks only stop "honest" people... Most locks are rated in minutes - minutes it takes a good locksmith to defeat the mechanism!

[@Mike--K]

The only way to defeat this lock is to destroy it or whatever it is protecting. Unlike the older combination locks, you can't use an autodialer to go through the one million possible combinations. After ten consecutive failed attempts to enter the combination, the lock enters the "penalty mode" which requires keeping it powered up for three minutes before attempting the next combination. After 15 consecutive failed attempts, the penalty mode increases to four minutes.

[@IanScottJohnston]

"Philips microcontroller 87C something"........likely 80C51 based, thus tried, tested and well proven 8-bit micro.

[@christopherguy1217]

These locks being self powered make them the choice for government equipment. The S & G electronic dial locks had a battery that needed changing. You got ample warning but if the battery went flat you'd need to drill it open.

[@monzav8]

These are mostly used on doors by military / govt for “top secret” areas of a building but can also be used on “Security Container” (a filing cabinet that’s made to deter entry) This is an older one. The newer X10 has been in use for quite a few years. Ultimately these aren’t meant to be as secure as a bank vault, just secure enough to give the guys with guns time to get to the location of forced entry.

[@dylantowers9367]

We have KABA locks on the trains where I work. They're simple keyswitches, nowhere near as big and fancy as these X-09 ones.

[@azurehydra]

It takes like 2hrs (if you are dead on precise) to drill the kabamas open. No criminal has that time. Most likely, the users forgot the password or failed so many times it died permanently. Needing a drill out to place a whole new one.

[@TheTallGirl]

Exactly, everything can be drilled after a long enough time. What is the rule for entry door 5 or 10 minutes? If it takes longer to pass criminals will just avoid them as it causes too big a risk and chooses another victim.

[@jfbeam]

Or the generator failed. "Locks only keep the honest people out." With the right tools, and time, anything can be opened.

[@McTroyd]

I wonder if the UI relies on change of direction (edit: of the knob) to know the selected number. Mechanical combination locks that I've seen have to spin in reverse to specify the next number. Plus, it generates that much more power for that super cap.

[@BrianRossman]

If you move more than 3 numbers in the other direction it treats the number as entered. You can go back up to 3 if you over shoot. When it decides you changed direction it randomizes what number you are starting from so nobody observing can gain any information.

[@EEVblog]

@@BrianRossman Similar to mechnical tumbler locks that have a window of tolerance on the number, which is around 3 IIRC.

[@McTroyd]

@@BrianRossman Thanks for the clarification. I never knew the tolerance was THAT high; I wouldn't have expected more than 1. But, I guess some hysteresis is called for to deal with those imprecise humans.

[@Helloworld-lg6zm]

7:08 did somebody on the factory forgotten to heat up the heat shrink?

[@theteenageengineer]

The only problem I see with this mechanism is you could possibly brute force the combo a lot like an automatic safe dialer if you knew the what data protocol the system uses. And it would probably go a lot faster as well due to you not having to use a stepper motor to spin the dial.

[@DanBowkley]

The lock disables itself after a few incorrect combinations or if you dial a combo too quickly. It's something like a five minute wait for every three incorrect attempts.

[@logmeindog]

You can find a few videos on youtube who have build robotic dialers to attack the X-0 series. Even with many optimizations to avoid spinning too consistently, navigating lockouts, and many other variables, it still takes forever to guess the correct combination.

[@jfbeam]

@@logmeindog That's why you take the dial off, and put a skimmer inside it. Putting the encoder outside the lock is a major flaw. (but it's only meant to resist attack for 30min.)

[@duckfacts777]

the two pins on the back of the pcb are for the change key jumper

[@88tx]

it would be fun if it generates a random number every turn. for example a normal good old lock goes like 1-2-3-4-... in a sequential fashion when you turn it, but it will be good if it shows random number every turn like 24-19-98-44-... and so on. it will potentially takes forever to get to the correct number for the combination and annoy the heck out of the user.

[@Adamisgood24]

That has to be the most interesting lock, I have ever seen!

[@Pyrolock]

What you call the "encoder" is actually the "generator" to make electricity, the "springy pin thing" is the LOBC Pin (Locked On By Combination / Locked On Back Cover) so you cannot remove the back cover without having the lock open (i.e., know the combination). Noting a real "hack job" by whoever drilled it.

[@tx5brent]

These locks can be a bit painful. The screen can only be read from the perfect viewing angle (that's a feature), you need to spin the knob first to power it, but don't spin it too fast or you'll be locked out. They are great when you use them regularly, but if you're not that used to them they are tricky to use

[@Just_A_Gun_Guy]

These are by far easier than a standard tumbler

[@Joe-bm4wx]

Every classified room or safe I’ve ever been in uses X-09 locks

[@MrKornnugget]

Wouldn’t that be classified. 😂

[@leland818]

@@MrKornnugget GSA requirements are published

[@Obinjess]

Excellent video! These are very high quality locks.

[@FGuilt]

"this is, the lock picking lawyer, and I'm here today because i could smell this video before it actually got uploaded."

[@scottyTy]

I doubt he knows who the Lockpicking Lawyer is and probably does not care anyway. Of course, someone needs to bring up Lockpicking Lawyer since it deals with a lock. Come on dude, get a clue and maybe post something that is useful to the conversation and not try and be clever with a stupid Lockpicking Lawyer reference. So F!@#Guilt, get a clue and get a life you MORON!

[@AynkaranRamachandiran]

@eevblog you are correct. Knob act as power generator and user interface. First rotate the knob to generate some change. Then display comes up with a number. This number should be the key for generating the one time pin. Usually the user will inform the number displayed to call center and get the pin and enter the pin using the knob

[@azurehydra]

I use to work with the newest kabamas. Those things are top notch security.

[@michel5148]

what if you inject liquid metals or chemicals to dissolve or weaken the materials?

[@kissingfrogs]

You think they could have put all the gizmos in the rear bit with just the display up front to improve security

[@Chris-rg6nm]

All the gizmos are in the rear. The only thing out front is the lcd and generator

[@kissingfrogs]

@@Chris-rg6nm I was referring to the generator and as Dave suggests it doubles as an encoder. Have absolute minimum out front to improve security - just the display.

[@logmeindog]

@@kissingfrogs I'm wondering if the engineers hoped that if the generator died, you could destroy the knob and remove the two screws that hold the front cover on. Then, you could reattach a functioning generator and spin the hub to get the lock open. I have seen this done once.

[@petersage5157]

I think most safes this would be used on would have a glass relocker; if the drill comes anywhere close to the locking bolt, the glass breaks and another mechanism engages the locking pins. It's a shame the locking bolt is broken; I'd love to see TheLockpickingLawyer have a go at this.

[@CmdrKien]

I don't think LPL would have any success at this.

[@klarusboy]

interesting pattern on the display at 7:47 it looks like its seen some action of some type

[@mduvigneaud]

Great teardown, Dave! I'm kinda curious about the rotary encoder. The 2 I have are optical and don't give any output without input power.

[@azurehydra]

Back two pins is for when user opens vault and has to reset all PW or add more pw+user.

[@trevormurphy7041]

I opened up my body safe one time with my taser I’m pretty sure it was 100,000 V taser four prong one I also used to mess around with street lights with it zap that little tiny black box they use for wireless control or Monterey It makes it flash red lights came in handy a few times

[@alch3myau]

Waiting for the other tear down!

[@kaysb80]

I'm no expert, but that lock seems to have been drilled by a expert; one hole to release the bolt, and another hole to move the bolt?

[@azonicrider]

not very expert. It can be done with one hole.

[@TheAdminist]

Would have liked more detailed dive into the board, thanks anyway Dave!

[@EEVblog]

There isn't anything more to talk about really.

[@jaro6985]

This is the lock picking electrical engineer, and today we are going to look the Kaba X09.

[@ctbrahmstedt]

Surprised that super cap has enough skook to drive a solenoid after a few cranks of the dial. I would’ve thought that’d take a few hundred turns to charge up from the dial.

[@tx5brent]

It does take a bit of a spin to power up, I have always assumed it was programmed to not power the LCD until it had enough power stored to open the lock

[@jfbeam]

Unlocking it (eg. entering the combo) is more than a few turns.

[@Anamnesia]

Locksmiths are often hired to go on 'raids' to premises where investigations have been approved to take place. It's possible the damaged X-09 tumbler you received came from such a raid

[@kissingfrogs]

I think the 2 pins are to download the access log.

[@NusaCat]

Nope, they're for changing the combination.

[@dgo4490]

LOL the profit margin on that thing. I am in the wrong business.

[@jfbeam]

Until you see how much certification testing costs...

[@dgo4490]

@@jfbeam That's an issue for those that participate in this form of racket. Turns out it is mostly money pocketing schemes and very little quality guarantee in practice. Someone's profit-above-all standards are not necessarily my personal quality-above-all standards.

[@pokojnitozo2360]

why unlisted?

[@stevenbliss989]

I assume I am missing something, but there is WAY OVER THE TOP too much electronics in there!

[@JPK90]

That encoder looks a lot like a stepper motor.

[@ethanpoole3443]

I’m fairly certain it is as well.

[@Joe-bm4wx]

If the lock hasn’t been unlocked in a while (or is getting old) you have to spin the dial back and forth quickly until a little lightning bolt appears on the screen to show that it’s recharged

[@NusaCat]

Well, that works, but just spinning it left is the recommended procedure, since that is also the correct direction to enter the first letter of the combination.

[@logmeindog]

Lightning bolt means that the controls are locked out and you have two wait 3 minutes or more to try a combo. Spinning in one direction is the only way to power on and use the lock.

[@Joe-bm4wx]

@@logmeindog no, I always spin it back and forth until I get the lightning bolt, then immediately enter the combo and it works

[@logmeindog]

@@Joe-bm4wx Hmm, after re-reading the manual, the lightning bolt simply means that you entered an incorrect combination, not that a lockout timer has been applied. This increments the failed attempts counter every time you do this. I don't see much of a point in doing this as the direction that you spin the dial to generate electricity doesn't matter. You aren't creating the worlds slowest sine-wave or anything.

[@chris-mm6oh]

Shine a ultraviolet light at the mother board you will be surprised 😊

[@Anamnesia]

AUD$3,000 for the X-10

[@MrKornnugget]

I would like to see the lock picking lawyer take on one of these.

[@emmettturner9452]

There it is! ;)

[@FGuilt]

Why is the word "kornnugget" funny? I'm laughing and that bothers me. 😂

[@MrKornnugget]

@@FGuilt I have had that handle since Korn was a hit….1999 or so. It is always available and make me laugh.

[@jmcarp0]

Can you get the lock picking lawyer in on this one?

[@GeneralPurposeVehicl]

I would place a board in the knob that transmits "Fuck you" to those who try EMI based attacks when decoded.

[@walterpark8824]

Hoping you amd yours - and five million I’m Sydney- are Ok in this flooding. Seems to portend difficult, expensive futures coming soon in neighborhoods near all us. SYDNEY (AP) - More than 30,000 residents of Sydney and its surrounds were told to evacuate or prepare to abandon their homes Monday as Australia’s largest city faces its fourth, and possibly worst, round of flooding in less than a year and a half. Days of torrential rain caused dams to overflow and waterways to break their banks, bringing a new flood emergency to parts of the city of 5 million people. “The latest information we have is that there’s a very good chance that the flooding will be worse than any of the other three floods that those areas had in the last 18 months,” Emergency Management Minister Murray Watt said. The current flooding might affect areas that were spared during the previous floods in March last year, March this year and April, Watt added. and five million Sydney residents - are Ok. This does portend an annoying, expensive future coming soon to a neighborhood near all of us.

[@gower1973]

Lockpickinglawyer will have it open in three minutes or less 😂

[@aaronlow1977]

My understanding is that this model is not allowed in high security areas anymore.

[@trey1531]

nope these are still used a lot

[@logmeindog]

It most certainly is. All of the X-0 series of locks are still authorized (although more than likely all of the X-08's have long been thrown away). They barely worked out of the box. I actually prefer the X-07 as the ones I have used have outlasted many of X-08s and X-09s I've used. The last X-09 I had replaced only lasted 2 weeks.

[@lyricalnatty]

This was just pure comedy; 😂😂😂🤐 Trying to do a video on a security device and at the same time not trying to give too much away.. Favourite bits: " hmmm, eeeh, eeeh... not really sure, i think, em the thingy goes here and em, em no codes stored."....etc etc..🤣lolzzzz...PS, a little heads up, if you trying to keep things on the hush hush, you might want to keep the alan key nut on the lock dial away from camera shot...then it wont matter what thickness door was between that dial and bolt....did someone mention iron ox........😜😜🎇😎😎😎

[@LawpickingLocksmith]

OMG

[@emmettturner9452]

First to mention LPL.

[@emmettturner9452]

…unless Dave himself does. ;)