i had this idea a while ago but lacked the resources and knowledge required. im glad someone finally at least attempted it. no combo lock is safe from this attack either, which makes it practical.

Posted at 11:36 am on Jul 21st, 2009 by eggman

Inside the safe is a smaller safe

Posted at 11:43 am on Jul 21st, 2009 by Jack

lol… why not rip a servo apart, tap off the motor and feed the drive to a larger drive chip to drive a second motor. that should work :)

alternatively use the existing pcb and sub in any old multiturn pot, a small gearbox and suitably power (koff vcr eject mechanism /koff) motor, this works well for small robots.

regards, -A

Posted at 11:46 am on Jul 21st, 2009 by andre

seems like that could take a while…

Posted at 11:52 am on Jul 21st, 2009 by blang

i don’t know how many different cams it has, but assuming 3 cams, the lock appears to have 50 digits, and and you cannot use the same number in the combination more than once. that leaves approximately 110544 combinations to try i know that isn’t a ridiculous number compared to amount of tries it can take to crack a password. but this requires physical movement. it could take many weeks to open a safe in this manor.even at 1 second per combination it would take 30 hours. to go through combinations… i think i could work for a lock smith… but anybody looking to “crack” your neighbors safe in this way may want to rethink their choice in crimes…

really cool hack though. why pay a smith to open it when you can build this guy

Posted at 11:57 am on Jul 21st, 2009 by camerin

Who cares if it’s slow? The safe would just sit in his garage anyway. This is a perfect example of using a ‘non-optimal’ technique when you’re not rushed.

Plus if the PC keeps track of attempts, he learns the combination and he gets to use the safe in the future.

Posted at 12:04 pm on Jul 21st, 2009 by Dirk

I read an article a couple of years back that explained weaknesses in common combination locks. Basically, the number of operations needed to brute-force the combination could be reduced from approximately 50^3 (125000) to 2*50*3 (300). If I recall correctly, it had something to do with feeling the amount of backlash for different combinations.

I think it would be a whole lot more difficult to automate, because the algorithm would be a lot more complicated, and you would need some kind of sensor to measure the backlash or torque, but it would also find the combination much faster, if it would work, ofcourse.

I recall that many of these locks have so much backlash that you could be 1 digit off, and it would still open. In that case, a regular brute force would “only” take some 7813 combinations on average for a 3-cam lock.

Posted at 12:12 pm on Jul 21st, 2009 by Sparky

a video of the motor moving would be nice.

Posted at 12:17 pm on Jul 21st, 2009 by joeku

It would be nice to make a video :)

Please show us!

Posted at 12:29 pm on Jul 21st, 2009 by Thireus

@sparky: that was for masterlock combination locks (and their imitators), and relied on pulling out the bar to stop the lock from moving backward after a certain amount. im assuming this safe packs a much more sophisticated locking mechanism. i know that when i used to work retail, the safe we had for cash and fine jewelry wouldn’t open if you were off by as much as a millimeter.

pre-submission edit: here you go http://hackaday.com/2005/06/22/master-lock-picking/

Posted at 12:31 pm on Jul 21st, 2009 by the_Twiz

reading into it some more… some locks are machined to have a 3 digit slip. in order to account for human error. there by decreasing it from 50^3 to 17^3 that would be way nicer to deal with. also the technique mentioned was to leave the last cam and eliminate the first 2 then move the last cam to the next digit. in my first post i was assuming moving constantly… in their information they estimated about 2-4 hours for a 60 number lock. i can see it getting Practical for a lock smith…

Posted at 12:44 pm on Jul 21st, 2009 by camerin

The way he has the lock preloaded will not work. You can only pull on the door once the correct code has been entered. He needs to build a solenoid to try and open the door after each code is entered.

Posted at 12:54 pm on Jul 21st, 2009 by LukeS

Lukes: could he just leave it up side down? Like suspend it in the air.

Posted at 1:01 pm on Jul 21st, 2009 by french t0ast

i don’t think the coding would be to bad to make this a stand alone unit. it would be fun to build one that mounts on a padlock with a solenoid that bumps the shackle after every code. it would be fun to have it write off to some external memory. have the user input the digits (calculate the degrees per digit). put a little lcd on it. be a neat little project.

Posted at 1:19 pm on Jul 21st, 2009 by camerin

not sure what kind of safe you have there but most safes are *easily* accessible through either the back or bottom sides, depending on the style of safe, etc. My dad has a gun safe that weighs like 750lbs and if you can get to the back of it, you can damn near open it with a can opener.

also, a rack and pinion type of setup might be a better option. glue a pinion with many teeth(hopefully an equal number of teeth as numbers on the dial) on the dial and then use a rack attached to something akin to a printer or scanner rail. The only problem I see with that is if you have to turn more than 1 turn but that could be solved with 2-3 times more teeth on the rack than the pinion.

Posted at 1:33 pm on Jul 21st, 2009 by ehrichweiss

i would drill into that so fast. im just too curious

Posted at 1:36 pm on Jul 21st, 2009 by Samuel

I’ve seen a locksmith use a unit like this on an small atm machine (convenience store style). The unit was manufactured as opposed to hacked. I stopped to observe the machine in action and asked him how long it takes. He said 20 minutes to 6 hours. That would lead me to believe that the total amount of combinations is not really derived from the numbers on the face but perhaps another division of the degrees. I’m not sure how the device got the feedback to tell it when it had found the proper combination and I didn’t have the 6 hours to wait ;)

Posted at 1:46 pm on Jul 21st, 2009 by texan

After reading the comments I’m surprised that only one other individual suggested a manual means of opening it. Don’t attack the lock the way the lock designer intended: be inventive and you could have this open in a couple of hours, if that.

Locks are notoriously vulnerable. One safe I opened, only had a spring holding the bolt into the door jam of the safe, so if you could slip a sliver of plastic into the jam it would pop open with literally no effort – and no guessing of the combination. Every lock has flaws. Exploit them!

Chances are you’re looking at a 4 number lock with an anti-forcing mechanism inside. The mechanism will give away clues as to what numbers are likely to be part of the combination but you’ll have to use your *hands* and your *ears* – not a servo – to find out what they are. Once you’ve narrowed the range of numbers and thrown out all of the numbers that are too close together to be valid, your chances improve significantly. Finally, you can literally throw out the 4th number because most of these locks will automatically stop the dial when the correct combination is entered. Essentially, you don’t even have to try turning the handle to know that you’ve gotten it right.

Read a book on safe cracking. I don’t mean to be a wet blanket, but this isn’t really a good electronics project. Your own senses and a bit of knowledge will have it open much faster than a computer could do the same.

Posted at 1:51 pm on Jul 21st, 2009 by signal7

One of my friends left a safe at our place after moving out, as he had lost the key and didn’t care enough about leaving his crap for other people to pick up… Anyway, i was going to learn how to crack it, but decided instead to just use a milling machine to open up a hole in it. It cut really easily, but all i found inside was a bunch of old VHS tapes! It was laaaaame.
-Taylor

Posted at 1:53 pm on Jul 21st, 2009 by Taylor Alexander

looks like a pretty old safe. i’d say try manipulation, but i get this feeling the mechanism sucks enough at this point that it’ll be difficult to do that, especially given that he says he needs no torque–you usually need almost nothing to turn these guys. Also, it’s not clear exactly how you dial in the number.

Actually, if you’re going for this, you REALLY need to figure out the correct method of dialing in the number. Let’s just say I’ve gotten screwed over by this. In case you haven’t realized yet, dialing in a master combo lock isn’t the same as dialing in a safe lock at all.

Also, you don’t need anything to push open the door. The way safe locks work, turning the combo lock will actuate the bolt once you get the right combo. If anything, you need some means of sensing that the wheel won’t turn anymore (wheel gets stuck after actuation in one direction)

Drilling is probably a lot easier. The locksmith had to use one of these guys on an atm machine probably because ATM machines use significantly more secure locks and are probably class I manipulation proof locks.

The best way to drill this guy is to probably pick the drill point on one of the four sides of the lock. Unfortunately I’ve got no clue which direction the assembly is mounted, but if you’re lucky you’ll be able to read off the combo from the discs. If not, you’ll probably at least get to drill out the fairly soft bolt/actuator and get the thing open.

Another hint (VERY IMPORTANT)–if you’re not going for the drill point, don’t go through the front. It’s a total trap and waste of time. Trust me, I’ve been there.

Posted at 1:56 pm on Jul 21st, 2009 by threepointone

some time ago there was a program on german tv, with locksmith, security expert using excatly such a thing to test his client safe after he had bypassed all of the other security things in the house, it was very fast at turning that wheel. He was given 4 hours for the whole thing, and onces he was inside the safe there was a mobile phone he had to awserer for the client to know he had done it.

Posted at 2:09 pm on Jul 21st, 2009 by Rachael

I just want to know what’s inside…

Posted at 2:41 pm on Jul 21st, 2009 by AllThatJazz

lots of people are saying drill it but what if he wants to use it again? or it has an anti-drill pane. My dads safe has panes of glass on all sides that if they break a bolt locks the door permanently. you have to call the company and have them come in and literally cut it in half.

Posted at 3:15 pm on Jul 21st, 2009 by metalicaman8

Brilliant idea! Not only will it not damage the safe, and give you the combination so you can use it again, but it’s just so much more fun! Mindless repetition is a perfect task for a robot.

If the torque is lacking, can’t you connect the servo to a gearbox and tinker with the driving for the servo? That’d probably be cheaper than getting a tougher servo. It’d just take longer to move through a certain angle, and increase the torque.

Posted at 3:26 pm on Jul 21st, 2009 by 314159

quality safes are designed such that the mechanism will wear out well before all the possible combinations have been attempted. specifically to counter this sort of process. mind you, there is always the chance you could fluke it. very interested to hear how this turns out.

Posted at 4:01 pm on Jul 21st, 2009 by geoff

When we bought our old house, the basement had a safe built into the concrete foundation wall, and the door was not attached. The old owner did not have the combination, but the door was in the house. It had a pretty thick front to it, but the back was held on by two screws and the locking pins. By removing the two screws, I was able to pull the back cover off enough to look at internal mechanism of the lock and figure out the combination.

The thing was old (1958 maybe) and was really just a giant version of a school locker masterlock combo lock.

Posted at 4:53 pm on Jul 21st, 2009 by cde

@ Geoff: That does not make much sense unless the combination is on the far end of the combo spectrum (42-50-20-49 on a 4 pin 50 spot lock), and the attack starts at the very beginning (0-0-0-0). Reduce the number of possible combinations by the variance in the numbers (pin 1 is 42, but 41 and 43 will trigger it), and it would seem that the mechanism would need to wear out very soon into the life of an often used combination lock (Think store lock box that has a daily pickup)

Posted at 4:57 pm on Jul 21st, 2009 by cde

1/2 inch drill, 5 minutes, open! Probably has that missing anthrax sample in a leaky vial.

Posted at 5:44 pm on Jul 21st, 2009 by VonSkippy

i have always wanted to build that, since i was a little kid

Posted at 6:16 pm on Jul 21st, 2009 by psycodrew

is this a chatwood & milner style lock or a sargent & greenleaf? each combination would have to be tried for both styles if you don’t actually know.

Posted at 6:50 pm on Jul 21st, 2009 by geoff

if billy mayes can use it, why not modify some magic putty to create a mold and line it with a rubber coating to hug the dial…..somehow rig up a sensor to a scope to ‘listen’ for the click…wasn’t there a electro-stesthoscope somewhere on the site that is highly sensitive…..maybe it not so much as torque you are looking for…just another angle of attack…good luck

Posted at 7:54 pm on Jul 21st, 2009 by fluxster

Did he introduce some mechanism to try the door? If he’s just trying combinations, chances are he’ll get it right and if he doesn’t try the door he’ll pass right over it. Good luck dude! I’m waiting for the high-torque writeup if not just to see what’s inside.

Posted at 8:13 pm on Jul 21st, 2009 by M4CGYV3R

thats awesome! the little face is cool and the idea and implementation is very well done. good job!

Posted at 10:57 pm on Jul 21st, 2009 by highpitcheric100

@geoff – no widely available combination lock I have heard will wear out that quickly. It’s certainly not designed into the lock – most have anti-manipulation features which pretty much avoid this.

Listening for the clicks rarely works. What you need to do is feel for the “contact points”, and from this you can infer certain information about the wheels. It’s not nearly as simple as just feeling the points and saying that is the combination.

The problem is that only mid-range locks are susceptible to manipulation, especially by unskilled hands. The really low end locks mask the contact points with grinding. High end locks have mechanical features to mitigate the attack, as well as being made to tighter tolerances.

This paper explains it more thoroughly:
http://www.crypto.com/papers/safelocks.pdf

Posted at 11:24 pm on Jul 21st, 2009 by Cybergibbons

i hear stethoscopes work like magic.

Posted at 11:26 pm on Jul 21st, 2009 by sunjester

Plasma cutter.

The only advantage would be the fun.

Posted at 11:50 pm on Jul 21st, 2009 by snoopy

A more effective version of this hack?

http://web.mit.edu/kvogt/www/safecracker.html

Posted at 11:52 pm on Jul 21st, 2009 by Steve

I was thinking of doing a similar thing to quickly open those fiddly little combination locks on our school lockers. My device would already know the code, so you stick it on, count to 3 and open your locker.

Posted at 12:40 am on Jul 22nd, 2009 by Benny M

@signal7,

If it takes twenty hours to build a safe cracking dialer that can automatically open a safe in ten hours, or twenty hours of studying plus three intense hours of skilled labor to open it, building the automated dialer is already less effort than cracking it. Plus it’s reusable on the next safe with minimal effort, whereas you still have to expend serious effort on the next safe if you open it manually.

I’m not saying that learning how to manipulate a combination lock isn’t a worthwhile hobby, but it isn’t for everyone.

Posted at 5:03 am on Jul 22nd, 2009 by jaded

Don’t all such safes have a serial number which you can use to contact the manufacturer? Of course then the owner might lay claim to it, unless it’s stolen from some secret government place and they kill you for being near their secrets :)

As for alternatives, drill a small hole then fill it with water and a small explosive charge and boom it opens, been proven to be true.

What they do here with ATM’s is fill them with natural gas (or some such explosive gas) then ignite it and it cracks open, seems to work perfectly much to the chagrin of the banks who now had to close several ATM’s pending fixes like detectors and pumps that keep them free of gas and whatever counter-trick they can think up.

Posted at 8:07 am on Jul 22nd, 2009 by Wwhat

wow unbelievable idea i think it will work.

can you crack this safe?

Posted at 9:39 am on Jul 22nd, 2009 by sunny

@wwhat

Most combination locks can have the combination changed, pretty much all of them bar the cheapest ones. That means the serial number won’t gain you much – it is worth a try though.

My safe has a mechanical lock, and I made sure to change it on arrival as some safe companies keep records of the keys sent out with each safe. If I lose the key, I can get a locksmith to open it.

A box like this would be easy to physically break into using an angle grinder, probably less than a minute using a 300mm disc.

Posted at 11:07 am on Jul 22nd, 2009 by Cybergibbons

I bet there’s a mysteriously complex looking key inside, leading to still more frustration.
He could also take it to the airport and ask them to look inside btw.

Posted at 12:09 pm on Jul 22nd, 2009 by Wwhat

How does it know that it finished cracking the safe?

This reminds me of locker padlock cracking from back in high school. On the standard master-lock, you can lower the hundreds of thousands of combinations to 100 by a little bit of simple math (there is a few digits slip), then you can bruteforce it. Of course, the manual approach (a padlock shim) takes about 4 seconds, so….

Posted at 5:13 pm on Jul 22nd, 2009 by whargarbbl

Lightsaber

\thread

Posted at 4:35 am on Jul 23rd, 2009 by Colin

I like the eyes he drew on it. :3

Posted at 11:06 am on Jul 23rd, 2009 by epicelite

Uhhh why not use a stepper motor? I have a bad ass big one out of a laser printer its got some torque i see it as being perfect for this type of robot…. i might just go get my arduino and give it a try!

Posted at 3:24 pm on Jul 23rd, 2009 by tylerlavite

Here’s a thought. Hire a locksmith.

Posted at 1:06 pm on Jul 28th, 2009 by Scott

Lots of good ideas and speculation here but i can fill in some blanks for you.

I got your safe ‘robot’ right here: edssafeservice.com/openings.html
The top left image shows how you should try to open your safe first, manipulation. second, you use your ‘robot’. It’s a stepper motor that tries every two numbers and whatever information you gathered from manipulating the lock. it uses a lathe check to grasp the dial and large rare earth magnets to mount the motor to the safe. after trying each combination it turns the dial past the opening point. if the combination is correct, the dial will stop, tripping a microswitch to say ‘Ta Da! it displays the combination on a LCD readout. the whole thing fits in a nifty briefcase. if you can get a number during manipulation, say wheel #2 is 37, you program that in after setting up the autodialer, LockMastersITL2000, and your safe will be open in less than 2 hours. i’m a certified master safecracker and a certified ethical hacker. after i learned how to pick locks i just got carried away.

Autodialer, a.k.a. LockMasters ITL2000:
http://www.lockmasters.com/index.asp?PageAction=VIEWPROD&ProdID=49863

Posted at 5:28 am on Sep 17th, 2009 by safecracker