EEVblog #762 - How Secure Are Electronic Safe Locks?

[Fungus]

I did not see a big capacitor inside. It may be possible to override the lockout by disconnecting and reconnecting power, unless the safe does not open for 10 minutes after "replacing the battery".

It doesn't reset, I tried that.

Yep, that's a very obvious attack. Not surprising that they thought of that.

[helius]

Reminds me of the "you can't print money with your color inkjet/laser printer, cause there is a chip inside there that will stop you."  Anyone ever tried it?  There's another myth for Dave to bust!

Not wishing to derail this topic, but that's actually true and I verified it on my Lexmark scanner a couple of years ago. It got about one third of the way through a ten Euro note before packing it in. I can't remember exactly what error message it gave, although I think it did spell out that it had detected currency.

https://en.wikipedia.org/wiki/EURion_constellation

[Fungus]

Not a fan of membrane codepads at all as they dont last long in a fire

If it got hot enough to melt the keypad then all the internal cables and connectors have probably gone anyway.

And if your house has burnt down then having to angle-grind the safe is the least of your problems.

Some manufacturers have a back door in and this I have witnessed, but they wont tell.

No way. Not happening.

The entire company is at stake and no back door will remain secret forever. The last thing you want is for every single safe you ever manufactured to be worthless.

Hotel safes? That's a different story. Guests can easily forget their super-secret number so there has to be a way to open them. The safes usually have a hidden RS232 port so the staff can connect up a special unlocking gadget.

Manufacturers aren't stupid though, there has to be a system to stop people figuring out how to open any hotel safe in the world with just a smartphone and an FTDI adapter. Presumably each hotel has its own hardware dongle, etc.

[Deathwish]

Reminds me of the "you can't print money with your color inkjet/laser printer, cause there is a chip inside there that will stop you."  Anyone ever tried it?  There's another myth for Dave to bust!

Long ago circa 1999 I recall a file / hack for photoshop that allowed this to happen. Cant recall the name of the file but it does work as far as I can remember ....

[Fungus]

Reminds me of the "you can't print money with your color inkjet/laser printer, cause there is a chip inside there that will stop you."  Anyone ever tried it?

Yes.

There's another myth for Dave to bust!

It's not a myth.

If you want to do an experiment you can try erasing parts of the note in Photoshop until it decides to print it. See how much you have to remove.

[Deathwish]

OR you can just get the following file.... http://forum.exetools.com/showthread.php?t=3301

[EEVblog]

Manufacturers aren't stupid though, there has to be a system to stop people figuring out how to open any hotel safe in the world with just a smartphone and an FTDI adapter. Presumably each hotel has its own hardware dongle, etc.

Simple, you buy a quality brand hotel safe. But they cost money, hundreds, not $50.

[george graves]

There's another myth for Dave to bust!

It's not a myth.

You and I may know that(actually never tried, but a quick google search shows some 10M pixels scans of the US $100 bill)....but, it makes a good video for Dave.  It's all about the link bate!

[Hydrawerk]

https://www.stream.cz/adost/10003120-trezory-ktere-otevre-i-dite

[HighVoltage]

There is a "fix" for Adobe Photoshop, so you can scan banknotes directly in to the software.

 

[David_AVD]

you could theoretically give on the supply a massive pulse to break the mosfet, and then power the solenoid directly through the shorted mos.

I have never seen a mosfet that's shorted from drain to source - all blown up mosfets that I have seen are always shorted from drain to gate. Also, IIRC I have seen a blown up bipolar transistor that was shorted, but it was probably due to overheating or too high current, not overvoltage.

I haven't watched the video yet, but just a comment on the above.  If it did use a MOSFET, could you take advantage of it's inbuilt protection diode with a reverse polarity supply?  This could not work if there was a diode in series with the supply of course.

[Hole]

Hmmmm. It is clocked with 4 Mhz. Datasheet shows that the majority of opcodes needs 4 clock cycles for execution.

At 30:00 in the video we see that the processing minimum is about 40 ms long, maybe take 5ms. Whatever.

With 40 ms and 4 cycles per opcode at 4 MHz I assume we have about 40.000 executions in that 2 cm of screen resolution.

Do we really expect to see something?

[Supercharged]

How is the Keypad connected to the processor? maybe they screwed something up there and you could access some data thru there.

[Howardlong]

Well, I embarrassed myself by laughing out loud on the tube this morning at the FAIL! Still chuckling about it now.

If only I had a dollar for every time I put something back together and missed something. There are those who have, and those who will.

Luckily my commute is temporary and only 20 odd minutes, so I'm looking forward to the second half this evening on my way home.

[eV1Te]

Dave, what happens if you push the number sequence: 9123456, does it open when you press the last digit (6) or does it fail on (5)?


Sent from my SM-G900F using Tapatalk

[justanothercanuck]

Would a big electromagnet be enough to energize the solenoid and unlock the door?

[TheAmmoniacal]

Would a big electromagnet be enough to energize the solenoid and unlock the door?

The case would shield the insides completely.

[mikerj]

Love the sticker on the inside - "Inspected by: Clint".

Perfect name for a safe inspector.

What I did find interesting is that the label shows the model as an 'H2C' (C=combination lock) but it's clearly an H2D with a digital lock.

[EEVblog]

What I did find interesting is that the label shows the model as an 'H2C' (C=combination lock) but it's clearly an H2D with a digital lock.

Obviously retrofitted after manufacture. Not uncommon.

[Rasz]

Bumping works on very expensive safes and locks.


There is a pin = your safe can be bumped, but you need to practice to know when to rotate, its a skill. Sure pin is small and needs a big bump, but its doable. The secret to bumping is you dont need whole movement in one bump.

"you cant attack this in any other way" is pretty naive. They left hole for another plug in the lock, and three additional holes in front plate. You could jam a wire bend exact way in front plate hole and poke inside the lock until you land on one of selonoid pins, you already control ground over power cable, this will give you direct control of solenoid. It sounds impossible until you see guys from TOOOL doing it casually with coat hangars.

Lockout after 4 bad attempts - you had whole pcb outside and you didnt test it?!?!?!?!  By sniffing I2C while entering bad combinations you would learn if it writes to eprom every key press or every 24 key presses (4x6), or if it writes to eprom at all? You didnt even power cycle to see if that clears the lockout. HELL, you didnt even test if the lock part is responsible for decoding the pin at all by sniffing keypad connection

 If it writes after 4 bad attempts (4x6 presses) it would allow for power cycling after fewer digits(23). And if it writes after every bad key press(stupid) it will be that much more visible in the power analysis.

"there is nothing in that, it comes down to noise" hehe no. 10ms per division is too long and you wont see anything at that scale, you are dealing with micro at 4MHz, data IS in there, you extract it with statistical methods. You didnt even capture and compare whole correct code+opening versus bad sequence.

"I didnt expect vuln, they designed it well" hahaha, nothing is uncrackable.

Some comments: My assumption is that the first longer "dip" in the trace (for example at 27:01 in the video) is just the keypress and some currentflow through a pull up/down resistor. Did you check that maybe by holding the button a bit longer?

There are two micros in this safe. First one in the keypad, second one in the lock. You can get to the keypad easily, that means it can be bypassed cleaning up the trace further (at least the beep).


All in all interesting video, but without the climax (as always ). Proper followup would make an even better one. Team up with Colin O'Flynn (or at least voicechat for advice), and use ChipWhisperer properly overcoming your laziness (cmon, we all know you didnt use ChipWhisperer because it needed learning, setting up, programming, blablabal).

The software most likely compares the last 6 digits entered with the passcode, so 248123456 would unlock it, otherwise the owner may have to enter the passcode more than once. It also makes it impossible to do the power line attack, since all that is happening is

12 keys x 6 long = ~3 mil combinations. If it is testing last 6 digits it is susceptible to De Bruijn sequence attack. If it writes to eprom after 24 bad presses you can reset every 23 ones, that leaves ~130000 sequences to try. Few hours of bruteforcing?

[max666]

Bumping works on very expensive safes and locks.


There is a pin = your safe can be bumped, but you need to practice to know when to rotate, its a skill. Sure pin is small and needs a big bump, but its doable. The secret to bumping is you dont need whole movement in one bump.

The reason why bumping doesn't work on this lock is because of the mass loaded pin opposed to the solenoid pin:



Any acceleration that would move the solenoid pin out of the way would also move the other pin in the way. I'm not saying it's impossible, but this makes this very difficult I guess.

But I have a question, what's the strange cut-out in the latch for?

[kyndal]

Loved the epic fail. And safe cracking part!

Looks to me like you can take the lock apart with a very long screwdriver from the back.

If you can get to the holes anyway
Just like you cant bump or tilt it. If its bolted down.

Also..  i agree that if the software was poorly made.  And you could detect correct keys.  They would be in the right order.

But likely they store all 6 keypresses.
And THEN verify if its "a" correct code.
Could have several..

so you might detect the "success" routine /solenoid...  Which defeats the purpose

/Kyndal

[gman4925]

It's simplified and theoretical but https://microcorruption.com is an online lock debugging/cracking programming challenge, good fun.

[Neddie]

Almost EVERY mosfet I've come across that is blown is short Drain to Source and Gate. Whole this is one big short no matter where you measure.
In an offline power supply circuit , it's a real PITA, as everything connected to the mosfet gate gets 320Vdc and all the smoke comes out :0(

[ivan747]

Come on Dave, you didn't try hard enough! It was a very interesting prospect.

 If you're still interested, you could use a lower value resistor, amplified, to shift up in frequency the -3dB point of the RC filter you're effectively creating. Also, I saw some pulses after the buzzer, maybe you could try analyzing and comparing that. Finally, you could try some digital notch filtering on the buzzer pulse and/or FFT analysis.

Higher vertical resolution and an amplifier would definitely help (I think you have some specialty probes for that, don't you? You also have the guys at Trio Smartcal).

Sent from my XT1063 using Tapatalk