EEVblog

How secure are electronic locks used on safes?
Part 3 is where I show 5 ways to crack into a cheap safe! • EEVblog 1494 - FIVE Wa...
Dave tries a basic first attempt power line analysis attack on a standard La Gard (LG) 3740/3750 Basic electronic digital lock on a CMI home safe.
Can you crack an electronic digital safe lock with just a resistor and an oscilloscope?
All sorts of safe cracking techniques are discussed - thermal camera imaging, bumping, drilling, and spiking the solenoid.
And naturally there is a complete teardown of the La Gard lock and a demonstration on how it works.
And then Dave does something incredibly dumb, and has to fix it the old fashioned way, Hollywood style.
It's a tail of epic fails and stunning wins.
Part 2 is here: • EEVblog #771 - Electro...
Forum: www.eevblog.com...
www.kaba-mas.co...
ST ST62T25 OTP Microcontroller
www.alldatashee...
AT93C46 www.atmel.com/I...
EEVblog Main Web Site: www.eevblog.com
The 2nd EEVblog Channel: / eevblog2
Support the EEVblog through Patreon!
/ eevblog
EEVblog Amazon Store (Dave gets a cut):
astore.amazon.c...
T-Shirts: teespring.com/s...
Donations:
www.eevblog.com...
Projects:
www.eevblog.com...
Electronics Info Wiki:
www.eevblog.com...

[@marko247]

When you pulled out the 4-pin my first thought was "I bet he's going to talk about the lock for a bit then forget to plug it back in!" :D Well done sir!

[@pierQRzt180]

I see a person that puts a personal fail online, I respect it and I like it. Few can do that.

[@GadgetUK164]

Had me laughing my a** off a few times there, especially when you closed it with the power disconnected - doh! Brilliant work getting back into it, it was worth doing the video just for that!

[@mpforste]

Rather than cutting holes he could have gone in through the mounting holes and not damaged the safe using rods from the back

[@Beaches_south_of_L.A.]

You don't think he thought of that? Mmmhmph. I think it's safe(theres a pun if you want it) to assume that that(cool a double that) is the first thing he looked into, considered, investigated thoroughly concluding that the only way was via drilling. I have to say that it's a little scary that you wouldn't immediately assume that as well and in fact felt it would be prudent of you to comment pointing that option out. You really do look kinda silly. Your comment is congruent with "I have to breath air in order to survive" or "grass is green" watch I'll prove it "Instead of drilling new holes he should have used the existing ones" see no difference "the sky is blue" it's just silly.

[@hawaiipunch4192]

I can open that faster than he can punch in the code. Pure trash

[@Sevalecan]

"You bloody ripper!", "Beauty!", "Bob's your uncle!","In like flin!", "Bobby dazzler!", "Winner winner chicken dinner!"

[@nightshademagia]

Sevalecan It's "I'm in like Flynn" (probably, I don't know)

[@Sevalecan]

Probably. I guess I wasn't braining hard enough.

[@Ezric2]

Dave should sell shirts with those sayings!

[@Desi-qw9fc]

“Just like a bought one!”

[@69mrsteveo]

Yeah, he got off a few times this video.

[@sghost128]

You could also defend from power line attacks by programming the micro controller correctly. I suspect that since this lock strictly requires 6 digit pin all it does is store the numbers into memory regardless if correctness and when it sees six digits it compares the full string with the value stored in EEPROM. I could be wrong but this is how I would do it.

[@supersat]

sghost128 You would need to do the string comparison properly (i.e. checking each digit and not bailing out on the first incorrect digit) but I assume they would do the right thing.

[@666Tomato666]

sghost128 yes, you'd need to use a constant time algorithm

[@aylons]

sghost128 Actually, it can be even more secure than that: it can always hash the new code, no matter how long it is, and compare with the stored hash. This way, there is no need to lock to a specific the number of digits while still making the same process every time a new digit is typed.

[@PeregrineBF]

Aylons Hazzud You still have to make sure your hash comparison is constant-time. That's not hard though.

[@aylons]

Also, having a different time for each number of digits inserted is not a problem, because this is information the attacker already has (after all, they are inserting the digits ). It must only not change according to the correctness of the code so far.

[@zushiba]

Man I love these videos. I have no actual idea what's going on but it's fun as hell to watch. I find myself wishing I had even a quarter of this guys knowledge of electronics.

[@aarontooth]

If you really want to know, you can go to engineering school.

[@GadgetAddict]

Do the same with a $50 safe. I know they can be physically bumped and some simple short circuit attacks but I wanna see more advance techniques!

[@o0julek0o]

Pretty sure this was the best episode ever, Dave. I've been watching your videos for about a year and a half now, and being the noob that I am, most of them were hard to follow, but this one? This one was perfect! Understood every single bit! 🙌 Real bobby dazzler.

[@liquidthex]

This is like my favorite episode ever

[@EEVblog]

liquidthex Glad you liked it!

[@int53185]

I thought at first that you fried the processor! Then I remembered the plug..LOL.

[@coreliner8972]

I wonder if you could just use a neodym magnet on this one too. Many electronic safes can be opened by a big magnet to trigger the solenoid inside. Takes on average 5 secs.

[@jaseastroboy9240]

Some of the magnets that are readily available today were probably not available when this safe was designed. Would be interesting to see what a crazy powerful magnet could do. That little pin might not move with gravity assistance (dropping it) but if even a small amount of magnetic field was able to penetrate it may move it. Not only would it be quick but it would also be non destructive. Might also be a handy rescue for those times when you forget to plug the solenoid cable back in. :)

[@Teth47]

Eeh, I don't need a safe. I live in Canada, our burglars call ahead to let us know they're dropping by, don't want to interrupt dinner or anything...

[@kjaxky]

Teth47 they apologize as they rob you too

[@BigEntTV]

Yeah I’m telling you

[@stevegarroutte8947]

Thats toooo funny i like Canadians except the French speaking one are kinda stuck up it seams, but i like the rest just fine i ve known alot and all have been good folks (except the Frenchies sorry just my experience most French speaking people are stuck up except the cagons from the southern us ive met

[@Ehadley69]

Whenever I get a new mobile I program into my dictionary: "aboot- about (Canadian)" and "soory- sorry (Canadian)" ... it makes me feel worldly.

[@DownTownDowns]

You must not be from Toronto or Quebec lmao

[@h11angel]

this is bloody brilliant! rarely have I been so entertained. I love you, Dave!

[@userPrehistoricman]

There's a video on KZbin called DEF CON 21 - Melissa Elliott - Noise Floor Exploring Unintentional Radio Emissions If you have a safe-shaped antenna, you should be able to "hear" the IC checking against the known combination, even through all that metal. Hey, you could even stick an antenna inside the safe through a bolt hole and use the safe as shielding from background crap. Every time a button is pressed (or 6 numbers are entered), there will be a check in the form of a loop. During this loop, you should be able to inspect numbers inside the IC from the intensity of emissions from the data lines. Enter 4 random codes, and inspect what frequencies are the same in each emission. This should be the correct code.

[@toonv4023]

Prehistoricman Yeah, those DEFCON speeches are really awesome and interesting. They trigger your inner hacker mentality.

[@reggiebacci]

Prehistoricman I've seen her before, she's really good. Think that's the one where she uses software defined radio to listen to the display bus on a laptop and reconstructs the screen. SDR compatible dongles are dirt cheap on ebay too.

[@frankfahrenheit9537]

Prehistoricman Only an idiot programmer would check for (in)correct digits BEFORE the 6th digit has been entered. This check would probably consume different power depending on the result. So, only do one final check, and nobody can intercept intermediate results (since there are none).

[@toonv4023]

Frank Fahrenheit Wether to check during or after entering doesn't matter. When you loop trough an input buffer and break out at an incorrect digit, the parsing time gets altered too. As long as your checks don't break the loop and the difference between correct or wrong doesn't show up on the powerline either, you are safe.

[@remuladgryta]

Toon v Loop and break is also an unsafe method of comparing the code in this instance. The smart thing to do is add the inputs up into a single number, and compare that to the correct code. Doing so in the same number of instructions regardless of correct or incorrect code is fairly trivial.

[@viesturssilins858]

Dave, could you please check the patern when entering the last digit? I wouldnt expect any comparing beeng done before all digits are entered, they would just be saved. But it is possible, if the programer was lazy, that when the input string of digits is compared with the saved passcode, the comparison rutine breaks as soon as a difference is found, so you could se which of the entered digits was the first incorect one.

[@cyrex686]

Viesturs Siliņš I like this idea, seems plausible.

[@userPrehistoricman]

Viesturs Siliņš So we can tell via the scope if the digits entered are correct? Wow, this seems useful. Anyway, there definitely will be a different power draw when the correct digits are put in because the solenoid is powered.

[@WeAreGRID]

Viesturs Siliņš Doesnt matter, once you put in all the digits if all it does is compare, theres no variation to tell you what digits are right, and you already know that it will be wrong, because its the wrong numbers. This method would be just as fast as just putting in all the possible number combinations, because thats all youd be doing.

[@viesturssilins858]

WeAreGRID Not quite! If the comparison is of a straightforward implementation, meaning you can tell which digit is the first not to match by examining the running time, then you can tell if the digits you entered match _by individual digit_ as opposed to _by the whole string_ . And that means that instead of trying 6 digit variations (10^6 = 1 000 000), you only have to try 10*6 = 60 as the worst case! In average it would be 5*6 = 30 tries, and, if the safe has 5 minute timeout after 4 tries, you get average cracking time of about 40 min. Not fast, but doable! It all depends on the comparison routine, it would be very easy yo implement a special comparison algorithm that takes a constant time no matter how soon the comparison fails.

[@viesturssilins858]

Prehistoricman If the comparison routine is of a standard implementation then possibly yes! Unfortunately the easily measured solenoid current can not be used because it only operates if all the digits ar correct, but we want to know which digit is first in the string to be false. For example, if the comparison is not secured, the scope could give us the following information: Lets say correct string is 123456 and the CPU spends 50us doing various housekeeping tasks that make up for a constant overhead and additional 5us for every digit comparison At first we try entering 000000. And the scope shows 55us CPU activity - that means that the very first digit is wrong. Next we try 100000. Now the activity period is 60us long. From that we can learn that at least one more digit matched because the CPU had to process more of them an took longer. Now we know to try only 1xxxxx variations and move on to guessing the second digit by looking which one gives at least 65us delay. We don't need to know how long exactly he CPU does the comparison, we just try out every digit in first position until the activity time increases and then move on.

[@benshaw2770]

"Bob's your your uncle!" This video was really informative and fun to watch. I look forward to catching up on your other videos mate! Thanks!

[@samthenerf]

I never thought I would see Dave Jones break into a safe laparoscopically.

[@EEVblog]

samthenerf Word of the day!

[@tcpnetworks]

I have one of those cheap, Bunno's safes! I use it as a DECOY! :) My CMI floor safe (concreted in!) is elsewhere...

[@raymundhofmann7661]

As the battery connection is exposed, maybe it can be hacked by applying weird over-/undervoltages, negative voltages or combinations of that? You also could use near field antennas (near the keyboard) used for emv probing to sniff. You could make use of a more elaborated (low R) current sensing with higher bandwidth. You could use more elaborate data processing on the captured signals, you could correlate antenna signals and wired signals (power current). BTW, how does disconnecting the battery affect the safety lock out time? Even if it is stored in eeprom, one may detect a false attempt prematurely and shut off the power just before it can store the failed attempt lock out time in eeprom, if it does that anyway. And then you can probe the circuit at any point if you get a "sample" but not limit yourself to working with the TUA (Target Under Attack). You see, if you want to spend the time, there is a lot more one could do... May not be worth it except for the experience gained.

[@quincy8557]

The safe was inspected by 'Clint', must be 100% secure

[@userPrehistoricman]

quincy8557 Probably an internal alias.

[@SONOFAZOMBIE2025]

Prehistoricman no, it is definitely Mr. Eastwood

[@quincy8557]

Son of a Zombie I did think that Mr Zombie

[@mahound9]

quincy8557 I know Clint, he inspected my shit. He's solid. Solid bro.

[@nightshademagia]

Who, Mr Clint Basinger of Lazy Game Reviews? I would definitely feel secure if my safe was inspected by him.

[@s0r0s]

I would try to capture lock's behavior after entering all 6 digits. It's doubtful that controller compares every entered digit. I bet it reads them in a buffer and then compares. This is the time to catch it.

[@brianwild4640]

That would tell you when the 6 digits are wrong or right but we would know that anyway it would open or not

[@Si74l0rd]

Yeah, I'd have looked at correct key followed by incorrect and all the permutations upto the full six correct numbers Vs six incorrect or five correct and one incorrect. Seems like a bit of a half arsed job unless there was a lot edited out..or unless he found a good powerline exploit lol. Not everyone is LPL showing everyone the hidden secrets right out in the open. Didn't end so well for Barnaby Jack :/

[@EricDenny]

I genuinely love your channel sir! That said, I don't ever have time to finish one and find myself skipping through them trying to catch the good parts. If you would filter your words to just the interesting parts, I bet you could reduce your 45 minute (average) videos down to about 20 minutes. Then, I could actually manage to finish one of your videos! You pick great topics but PLEASE maybe try to make them a reasonable length! Most people in this line of work, including myself, simply don't have hours a day to spend on KZbin. Just a polite suggestion

[@JordanBartholme]

Eric Denny watch it on 1&1/2x

[@ShALLaX]

I’m exactly of the same mind. Very interesting videos, admirable with regards to how faults of the user are admitted, but a good percentage of the video goes by with “yes, I understand, please move on” in the back of my mind. One thing to keep in mind is you’d miss all of the Australian “charm” if these were shortened ;) Maybe a “digest” version of each video?

[@ThoughtCrimeCriminal]

EEV: This lock is pretty damn secure Lock Picking Lawyer: Hold my beer

[@patc4624]

Watch his account longer and it would be "hold my gun" seems like hes a hell of an avid collector.

[@revrev1679]

Angle Grinder Guy: Hold my extra batteries

[@NoxMarcus]

Well this turned out to be a fun episode. The road to success truly IS paved with failure.

[@FranLab]

Love that FAIL button!

[@tenshi7angel]

The sad part is, I can relate to that level of dumb. :(

[@46bovine]

I think it's dumb and overused!

[@Snatcha14LP]

This channel is so interesting! You just know exactly what you're talking about, and it's very informative, even though I hardly know anything on the subject. Thanks!

[@ChrisPVille]

The code is always 6 digits, so I assume they are comparing the input with the secret key only when all digits are entered. With a sensitive enough power analysis, you should be able to detect which digit was incorrect as the micro iterates over the input and key. Even with a constant time comparison of the two, some flag or register in the micro will be set on the first wrong digit (otherwise your comparison would never fail).

[@aarontooth]

Can a power analysis realistically discriminate a single bit difference, presumably SRAM or whatever this thing has? I assume the "loop" would compare or subtract or xor each position and then add/or them up.

[@pepe6666]

dude! that was one of your best videos. you turned a fail into a fun and educational. detour thanks for your time and your energy

[@EVguru]

Tim Hunkin has some interesting mechanical safe cracking stuff on his website and his 'Secret life of Machines' stuff is well worth tracking down. There are also some safe/lock cracking anecdotes in 'Surely you're joking Mr Feynman'.

[@7177YT]

Safe saga was riveting indeed. Cheers!

[@OhSoddit]

I've been watching this 90 seconds, and I'm already 100% behind you. A friend described his Sandleford EZ75 as "not worth the cardboard box it came in" after being burgled. Thieves just bashed it open.

[@oholimoli]

Try to find the resonance frequency of the little spring and use a suboofer with this frequency. The pin should then vibrate and if you are lucky you can open the safe or damage the spring an turn it on its side. :-)

[@oholimoli]

Update: To find the right frequency try to disconnect the battary and measure the power pin for some induced current

[@ExtantFrodo2]

I love it when a push button lock has been in use for years and the buttons for unlocking it are all worn. Vegetable oil on the buttons would reveal which buttons were pushed without necessarily being noticed by the owner. This trick also works in some cases to detect if something was disturbed in your absence.

[@bsvenss2]

*ROFLMA* Epic! Priceless! One of the funniest thing I ever seen on KZbin! I wish I had 1000 thumbs up to give you Dave... but you only have 860 videos or so. ;-)

[@maykevin5]

i think the wave form drop is from storing the number in memory. The validation is when the last number is pressed. The wave form will change depending on if the validation is wrong or correct.

[@graemegets478]

I would not expect to see much on the power line for digit entry. The software would (should) just store each digit without any judgement on the individual number until it has all six numbers and then it would do a compare in which case its too late. Its not going to decide as you type each number in. There will be a time-out between numbers so that you do need to type them in with in a certain time period before it trashed what's already been entered. But great video - loved the cheesy version of mission impossible :-)

[@OliverCovfefe]

11:50 YOU HAD ONE JOB. ONE!

[@gigicaly]

yeah you screwed up on the wire but watching you putting it back was very entertaining..it was way better than those Hollywood movies :)

[@EmirErcanAyar1]

The best electronics video I've ever seen on youtube.

[@finnigan16]

Dave, You mention that you can replace the keypad in the event that it breaks, so you must be able to do so without access to the interior of the safe, is that correct? If so, would it be possible for someone to replace the keypad with one containing some kind of keylogger? That individual could potentially return after the safe owner has accessed the safe and obtain the code.

[@TheAmpair]

finnigan 16 That is a devil of a lot of miscreant effort to access some cat photos. (Likely content after owner estimates this safe's ability to protect the contents in the event of fire.) ;-)

[@Si74l0rd]

I've used a larger capacity, thicker armoured safe with the same keypad/knob combo, in a medium sized retail business and that was storing the Christmas takings, as well as the rest of the year when there wasn't much worth having lol. It was however bolted to the floor, and was cut through with angle grinders in one memorable instance, mostly because they used our own stock from the shelves to do it! It's a common enough set up, though the quality of the internal circuitry may have changed over time or between models.

[@BoB4jjjjs]

That was quite a good experiment and very funny when you locked yourself out. First time I have discovered your channel, but I'll be back.

[@EcProjects]

This was very interesting to watch ! :) Great video, Dave!

[@josh3580]

EEVblog - This was an incredibly entertaining and informative video. Great job rolling with the punches... I loved it!

[@Aussie50]

I wonder how those $300+/- ebay gunsafe locks fair, I know the safe has to be bolted to the wall and floor by law but if the crooks managed to get it loose I bet they could bang it on the floor a few times and release the lock. i will have to take a poke at mine before I install it and store valuables in it, might have been a waste of money.

[@EEVblog]

Aussie50 No new safe costing $300 is any good. First step is, if it's not (oz only) a CMI, Chubb, Lord, Guardall, or Burg Wachter then it's likely crap. Only La Gard, Chubb, or S&G locks are worth their salt.

[@BenjaminEsposti]

What you ultimately need is a dog! Even just putting a warning sign that says "Beware of dog" can deter thieves ... yet there are those who don't even have half a brain :P They likely wouldn't be able to figure out how to get it open any way xD

[@moqmar]

MrJohnny56789 If you didn't store it correctly, that's completely reasonable I'd say.

[@araibirshad8294]

Damn. I didn't know Dave's audience consisted of insecure Ameritard gun nuts.

[@SnapBrandy]

@Mr. Morningstar You are so right. I hate the gun laws in Australia. Notable three hours away in New Zealand my friends are using suppressors and we cant they are all shooting semi auto M16s and we cant. All the anit gun lobby people cite the shootings in the usa as the reason we cannot change. They are seriously phuked in the head and have no idea what they are talking about. I love my shooting for sports and just wish i could have a few more toys that would make it even more fun.

[@JosefdeJoanelli]

I couldn't stop laughing when I realised what happened (at around 8-9 min mark). We have all been in a situation like that at least once, where you just feel like the ultimate noob lol and Dave Jones' reaction was priceless :)

[@AureliusR]

He thinks he's detected a packet -- it's just the beeper! LOL!

[@RickSaffery]

No vulnerability discovered in the old electronic safe. Fail-to-connect cable to main-board vulnerability detected in Dave! Thanks for making another totally enjoyable video. I really enjoy how you manipulate your scope and make it look so effortless. Future video tangent using this clip as springboard. Create a powerful magnetic field outside the safe. Perhaps you could replicate the solenoid action and pull that rod to clear the little locking block.

[@djaysenpai]

wow this fail button couldn't be more appropriate, damn

[@Baerchenization]

djaysenpai Imagine it had been locked in the safe ! ;)

[@nightshademagia]

8-bit EEVBlog Mission Impossible. Words I never thought I'd say.

[@lincolnproctor1555]

LoL I bet there was a Schrodinger's connector moment for a bit...

[@jackneff179]

LOL Dave, as a locksmith here's how I would do it. You already have holes in the back. What we usually do is take a light or camera as you have with a long screwdriver and disassemble the lock from the back. That will usually give you access to the deadbolt mechanism and using long screwdrivers manipulate the bolt mechanism opening the safe!!!

[@gabest4]

I liked the part where Dave changed into a gynecologist.

[@ExEvolutionGaming]

Thumbs up for getting the safe to work again

[@Gexpgaming]

Bear Grills ?

[@ivanhansgaardhansen2675]

GexpGaminG Vidste ikk' du så sådan noget! Btw. det der build sammen med Asus og Corsair, bliver det til noget? Så et Corsair 760T i bagrunden på et tidspunkt :-D

[@ORIONGaming]

GexpGaminG I thought Steve Irwin lol

[@rookiemcm77]

+V Singularity Three things... a sticky note reminding you not to lock yourself out...

[@kararam]

there is an anti-bump mekanism next to the solenoid. its the brass thing with also a spring that sits "above" the solenoid. if you bump it so the solenoid springs away, the brass rod also spring the same direction and takes its place.

[@piranha031091]

How about trying to remotely move the pin by moving a big neodymium magnet against the door?

[@lordsauron2487]

Considered a neo mag but idk where to get a large one

[@sik3xploit]

I was choking on some laughter here. A fine video sir.

[@FennecTECH]

They are pretty damn secure when you forget to plug the keypad in

[@johneastmond9092]

Sweet video. I do post failure investigations. As part of that I find that recreating or researching possible scenarios to be extremely useful. This is exactly the sort of thing I do. To spend 3 months throwing crash test dummies out of vans to figure out the restraint failure. or a couple months on some G.F.C.I fault is pretty common.

[@Istanislav1]

Это наикрутейший канал! Спасибо! Как жаль, что у меня в округе нет таких преподавателей, как вы!

[@CaptmagiKono]

Is there a lot of break-ins where you live?

[@EEVblog]

CaptmagiKono No, quite rare.

[@CaptmagiKono]

EEVblog That is good, I would never personally need a safe like this for my junk. All of my money is with the bank, I only hope they have TDR safes with my money :P

[@ZenerDragon]

CaptmagiKono It's Australia, they're too busy avoiding death from scary animals to steal from each other.

[@EEVblog]

CaptmagiKono I don't need a security safe either. But the fire proof ones are handy for important documents etc.

[@ninjaroo882]

CaptmagiKono Actually your money isn't safe at the bank. When you make a deposit you have given the bank an unsecured lone and permission to do what they will with it. Read the fine print.

[@keriksen2749]

Old fabrication or Machining trick if you're drilling through steel or hardened steel and cast iron is to use Dawn dishwashing liquid instead of oil or cutting fluid the drill bit will last quite a bit longer love the channel man

[@glenwoofit]

Could you not apply a voltage directly to the solenoid the same way you replaced the plug?

[@EEVblog]

glenwoofit No, that's called spiking, and this lock is protected against that.

[@GraydonTreude]

EEVblog you where able to get to the pins so you could spike the pins.

[@TheHuesSciTech]

Graydon Treude He got to the solenoid pins after opening the safe, and then opening the lock mechanism... the safe is kinda already compromised at that point *facepalm*

[@GraydonTreude]

TheHue's SciTech when he reconnected the pins from the out side he had total access to the pins from the out side

[@TheHuesSciTech]

Graydon Treude Those were the keypad pins, not the solenoid pins. For goodness sake, he *specifically* went over this in the video, try watching the video.

[@11202]

The noise of protest the safe makes against being inspected at 1:29 is hilarious to me even months later.

[@nitrobob89]

you have a 3d printer you could of made a tool for the job

[@gaelc13]

Hi Dave, I believe nowadays an attacker would at least use a differential analysis, since direct analysis is relatively easy to counter. The main problem in the case of a safe is that the data to analyse is rather scarce, but otherwise, since money and energy matter in the end there is a reason why safes are certified up to a certain value...

[@MrAlbedo39]

Perhaps the solenoid might be susceptible to a strong magnetic field. "DaveCAD" always cracks me up. :)

[@WeAreTwoDoorsDown]

I've always kind of wondered if digital safes are vulnerable to this or not. Just started the video, so it will be interesting to see how this goes.

[@stonail665]

These locks are breakable via RF analysis .but you need 2 hours.

[@EEVblog]

Jetset Willy This model in particular? Got any further info on that?

[@stonail665]

Its about the body thickness(and build material) not the lock mechanism. One of my colleagues cracked the code in isolation room not sure of the model but the same size and same body thickness.

[@cellmatedan1008]

don't know if I am correct (I never studied signals in such definition): if your keyboard sends analog signals, every key should show the same signal every time(diferent for each), if it's a digital transmision, the diference betwin 0 and 1 binary should be insignificantly small. considering the fact that you are on the analog side of the circuit, you had no chance from the start (correct me if I'm wrong, I don't have much experience at this level)

[@Marvinthecoinhunter]

Great analysis, you’re very skilled with the oscilloscope

[@daveys]

In our house you’d be described as a “spawny git” for getting that wire back into place! Well done.

[@supernova86]

Bob is not my uncle

[@unclebenis2540]

He is now. ( ͡° ͜ʖ ͡°)

[@TheAmpair]

The milkman again?

[@MegaGemoroy]

That was such a silly thing to do but that was extremely entertainijg to watch and good on You finding a solution!

[@td2691]

Far more entertaining then your usual videos, superb

[@Mickey-im3bg]

I wouldn't even bother breaking and I would just take the safe with me.

[@johnwattie1786]

But, what if you run into a scenario where its bolted down?

[@screengames5307]

+John Wattie run off with the room

[@ktmridersforlife6861]

NIGHTFOX you can mount them to the ground

[@Drew-py8kg]

Well now we know you're a thief

[@VictorRivarola007]

Dave... When you are designing any uc safe system that has a fixed digits... even a novice programmer would first collect all the digits and then process them.

[@mattharper890]

biggest fail ever lmao, fell over, love you dave keep up the awsome work. fan for life.

[@Desi-qw9fc]

This was a real roller coaster!

[@nickademuss42]

I service and install these locks and their older cousins, the code is stored in the lock body inside the safe. The main venerability is always in the users setup, did they change the master code from the default of 555555 after they added users? The next weakness is the solenoid, they wear out and get stuck a lot. The battery wires and the wires connecting the keyboard can break. Also the factory reset box has to be connected to the lock body to reset the lock, not from the outside. These happen to be pretty secure as long as the codes are kept secret. You can also set them up for more digits and dual control.

[@notanotherreviewer.]

I think an interesting approach would be to avoid the lockout mechanism after wrong codes and seeing if we can override it so we have infinite attempts, since maybe that signal does depend on the battery side and that's something that the manufacturer would not bother to invest time into protecting since it's a weak vector of approach to begin with. Looking for patterns in the keypad combos was a stretch to begin with.

[@MaciejWiercinski]

Comparison against stored pin code most likely happens at the moment when registry (shift one presumably) storing input digits is full. The methodology I'd try here would be to capture processor profile after sixth digit has been entered and compare results for incrementally growing number of good leading and trailing digits to see if the loop bails out early.

[@pmkwiek]

for the wires, if you do a "clock spring" type of "cable" the wear is minimized as this is what we use in our car steering wheel

[@PhuongNguyen-ui5mq]

Wow 12-year old design is still flawless to common side-channel attacks. Well done! 😎

[@leecwilkin]

you're the only bloke i've ever seen trying to break out of a safe :-) it must be the convict in you :-)

[@firstnamelastname-oy7es]

I _KNEW_ you would forget to put the pin back in! I just knew it at the time you left it dangling! Oh boy!

[@robertohurtado6458]

"the gravity is a bitch" best phrase ever

[@draken1511]

The lock doesn't have a bump vulnerability because of the extra part on the other side of the solenoid and catch slide. When you bump it to drop the rod into the solenoid, that chunk on the other side drops a pin into the catch! Pretty simple yet smart way to prevent it from being bumped/dropped to open.

[@jetraid]

Maybe with a speaker resonating at the same frequency of the spring you can makes the pin to move.

[@38911bytefree]

Input rutine could just check the 6 digist at once. That is, it stores the keys you press (no matter if good ones or bad ones) and when you press the 6th one, then a comparison is done. So perhaps you get a difference at this point. But you need to input all valid 6 digits. Until the 6th, FW could just read and store and eventually time out this input and clear the code you pressed and retunr to wait state for a new set of key presses. Code path will be the same for any key (good or bad). The method is very interesting, even the thermal one. Sometimes, OBVIOUS things are overlook, that is Murphy at its best. But as you said, those guys haven been doing locks for years, and sure they they go through this issues before and patched them.

[@the_eminent_Joshua_E_Hrouda]

You could embed a circuit just above the battery compartment, a data logger. Let the rightful owner enter the correct code once or a few times. Then retrieve that data, and manually enter it. Would likely be a bugger to attach. But maybe not.

[@JohnDoe-qx3zs]

Some things he didn't try on the electronics side: 1. Use signal filtering and processing to undo the effect of the bypass caps (they only reduce the power draw AC amplitude, they don't remove it completely) . 2. Look for AC waveforms in the CPU clock range and above, then compare those. 3. Look at the total mAs consumed by different input conditions. 4. Compare a full 6 digit signal for right, slightly wrong and completely wrong codes. Look at what disturbances can be injected by applying high frequency noise (higher than CPU clock, maybe even GHz) on that power line. You may be able to destabilize the microcontroller. Next, figure out if destabilizing it at a specific time during the input sequence would open the lock. (Other obvious points have been mentioned by others in other comments) . Of cause, once an attack is found, it can be reduced to a smaller dedicated circuit so a safecracker won't need to carry around 10kg of lab gear.

[@thomasbonse]

What is even more effective from the manufacturer's side, and relatively simple in terms of implementation is to use a buffer approach. By this, I mean that as a manufacturer you load each keypress into a memory buffer and only process validity after the last buffer (fixed or configured) has been filled. This results in a much more difficult, albeit not impossible, method to mitigate an attack via the power source. This simple change from a per-digit calculation also minimizes the number of components required on the board (ie capacitors for decoupling purposes). Additionally, this approach wouldn't even be noticeable to a user and the calculation can be through a very simple == operation in a microcontroller or a series of gate-level operations if done through an ASIC or FPGA. With the gate-level operation, you would first perform an XNOR binary operation between the corresponding bits of the known key and the provided key. With the low output from each XNOR operation followed by a cumulative NOR operation (multiple OR gates to combine down the number of bits to a single NOR gate that performs the final calculation). In the case of solenoid operated safes like this, an even easier method would be to use a sufficiently strong electromagnet to pull the solenoid back manually from outside the safe, which then releases the catch, such that the 'knob' can be turned to open the safe.

[@davida1hiwaaynet]

That is a well built piece of machinery!

[@discreetfire]

Wow that was a fun video to watch! Nice work. I'm glad you had to drill and fish. That was super fun to watch you work! Awesome!

[@nickjonas9222]

he's such a classic Aussie mate!..

[@ExStaticBass]

That 4 khz signal your hearing is actually really close to the resonant frequency of the human ear. That's why they use that range. Because most people can hear it really well. As to your methods of cracking this bugger of a safe, I found this video really interesting.

[@khmerjamesgoodness8712]

Thanks for your time !

[@Gryzounours]

Amazing video, seriously. I loved it. It was like watching a good heist movie !

[@ethzero]

This video has a unique status being both on my Electronics and Funny playlists :D

[@jamesbryan7501]

i always use a pen to pres the buttons on a PIN entry keypad as a easy and resonable way to defeat a camrea based attack.