EEVblog #762 - How Secure Are Electronic Safe Locks?

[GoneTomorrow]

Safe cracking can be hard or easy. Lock picking as well, you find a lot of smaller cheaper locks that can be picked with very simple tools, often stuff that you can carry around without anybody being the wiser. Small locks are easy, I have done them with no more than 2 wire paper clips, which are common things. Was easier than walking over to get the key in some cases to just pick them open, do the work in the cabinet then lock them again with that.

This lock would like a word with you  O0

[SeanB]

Don't try the lock. just cut the hasp it is attached to. Otherwise I will introduce it to my little friend Mr Afrox.

Note the steel of many shackles suffers from cold embritterment, so you can simply freeze them with lN2 and then shatter them.

[Fungus]

Don't try the lock. just cut the hasp it is attached to. Otherwise I will introduce it to my little friend Mr Afrox.

I think he was referring to picking it, not breaking it.

I did a web search and it seems like that lock has never been picked (on camera at least). Quite surprising given dedication of people like tool.

Note the steel of many shackles suffers from cold embritterment, so you can simply freeze them with lN2 and then shatter them.

'Many' doesn't include that particular lock:

(Go to 3m28s for the liquid nitrogen test)

And Cutting? Good luck with that. That's some seriously hardened steel.

Still... they cost $265 each so they better be good.

PS: While I was looking up that stuff I also found this. A chain which they guarantee is impossible to bolt-cut.
http://securityforbikes.com/security-chains.php

[SeanB]

500g Semtex, 2 detonators, 100m of detcord and an initiator and whatever it is securing is guaranteed to be either open or spread all over the landscape.

200kg of HE, a half inch housing and an appropriate delivery method ( and aim it right) and you will never find that lock, level 10 rated or not.

[Fungus]

500g Semtex, 2 detonators, 100m of detcord and an initiator and whatever it is securing is guaranteed to be either open or spread all over the landscape.

Yep. Exactly the sort of things being carried around by the average thief.

PS: Keep your head down when that lock comes flying towards you.

[helius]

He said cut the hasp. You know what a hasp is don't you?

This type of padlock looks very formidable but it does not protect the hasp from the front. Some padlocks do, like the S&G 833 or 951 or the cylindrical hidden shackle type.

[Fungus]

This type of padlock looks very formidable but it does not protect the hasp from the front. Some padlocks do, like the S&G 833 or 951 or the cylindrical hidden shackle type.

The Abloy 362 isn't supposed to protect hasps - it's a chain lock.

If you really want to lock a door with a padlock then use something designed for the job, eg:



(Or use one of those hidden shackle types you mentioned ... or any of the other stuff that appears when you google "high security hasp")

PS: Speaking of "looks very formidable but...", here's the famous S&G 833 being picked in a couple of minutes with very basic tools (no semtex required!)



The Abloy has never been picked even by the guys at toool (who will happily take locks apart and manufacture whatever special tools/picks it takes to pick them).

[helius]

The video ends without showing the pins, meaning the sidebar could have been missing the whole time.  fail.

[Fungus]

The video ends without showing the pins, meaning the sidebar could have been missing the whole time.  fail.

If it was the only video on Youtube you might have a point. But it isn't, there's loads of them.

eg. This video has more detail, including dismantling the cylinder at the end (with sidebar!):



Edit: And he didn't even use special Medeco picks, which would have made the job a lot easier...he even admits out loud that he "sucks at rotating pins" and just hacks away at it until it opens. They're also not bump-proof.

[Towger]

500g Semtex, 2 detonators, 100m of detcord and

All readily available at a price from your local King?

Sounds experience.  Over here a 30 euro grinder from the local Aldi/Lidl and a spare pack of disks would do the job. Semtex is of course available to the breaded brethren in the north of the country.

[vinicius.jlantunes]

Dave, to you plan on trying out the chip whisperer on this lock? Could make for an interesting video perhaps?

[SeanB]

500g Semtex, 2 detonators, 100m of detcord and

All readily available at a price from your local King?

Sounds experience.  Over here a 30 euro grinder from the local Aldi/Lidl and a spare pack of disks would do the job. Semtex is of course available to the breaded brethren in the north of the country.

There are still lots of hidden arms caches around, and some are still known of by living people, though most who knew of the locations are dead, either from old age or other causes. Most have been either destroyed or have degraded to nothing, though if you go north onto Mozambique there are still large areas with signs saying Perigo Minas, and a lot of people missing arms and legs.

At one time SA was the third largest producer of mines, after the USA and USSR. Now PRC is the only producer.

[max666]

Is there even a padlock that exhibits any resistance against something like this:


If I were a thief, this would be the first tool in my bag.

[Fungus]

Is there even a padlock that exhibits any resistance against something like this:

Yes. eg. The S&G 833 mentioned earlier has layers of blade-blunting ceramics inside it.

https://securitysnobs.com/Sargent-Greenleaf-S-amp-G-833-Padlock.html

Nobody's going to mark you "+1 Insightful" for that though. Obviously there's tools that can break anything if you go prepared, you're left undisturbed for long enough and have no problem making a lot of noise/sparks.

[max666]

Nobody's going to mark you "+1 Insightful" for that though. Obviously there's tools that can break anything if you go prepared, you're left undisturbed for long enough and have no problem making a lot of noise/sparks.

Yeah sure. It just feels to me that there aren't many demonstrations that show how things hold up against an angle grinder, but I'm not particularly seeking, so I may be biased here.
And they all love to show a huge ass sledgehammer pounding away, which isn't quiet as well, but looks good on video I presume.

[FrankBuss]

Some electronic locks have backdoors, like a manufacturer or master code. Once I was in a hotel and forgot the safe number, and someone entered the master code to open it. Would be interesting to see the assembly code of the chip.

There is a company who claims they can read the code of the ST62T25 (I assume that the read protection bit is set, or the OTP device can't be read at all usually). They don't write how expensive it is (but "low cost"), but I've heard that such services are expensive.

Regarding the power analysis: Dave, you are using 20 ms resolution. The chip is probably running at 8 MHz. You might not see the interesting things. If you measure it after the voltage regulator at the Vcc pin of the CPU on the control board, it might be possible to measure more high frequency signals (I would like to see how the chip whisperer works for this). Then you could try to build a selective amplifier for interesting frequencies to try to detect it at the battery contacts as well.

[Fungus]

It just feels to me that there aren't many demonstrations that show how things hold up against an angle grinder

Sure there are, you just haven't googled it.

eg. Angle grinder vs security chain:




Here's some people testing a safe. It's a "TL30" safe so they get 30 minutes to do whatever the hell they like to it:




PS: A cutting torch works better/quicker on padlocks than an angle grinder. Much quieter, too.

[apis]

Not very practical though! 

[SeanB]

Pretty easy to make a thermal lance though, with only a modest budget for the right tools and common supplies. Will open almost all small non thermally isolated safes in a very short time with little noise. With a little finesse you can open the small safe without cooking the inside contents as well.

BTW, just how do you cut that grinder proof chain?

[Fungus]

Not very practical though! 

Yeah, I saw that episode. The idea is good but I think they used a bit too much explosive there...

Here's a fun one I just saw (this thread has got me watching these sort of videos. There's thousands of them, this is a really imaginative attack on a particular brand of padlock)

[Fungus]

BTW, just how do you cut that grinder proof chain?

Which one? There's plenty of bolt-cutter proof chains but I don't think there's a grinder-proof chain.

Bolt cutter proof, Rockwell hardness 63 chain:



Cutting it with an angle grinder:



It takes two minutes to cut (compared with a couple of seconds for an ordinary hardware store chain) but he manages it.

[Fungus]

OK, just one more - the metal vapor torch - for when you absolutely need to get it open in two seconds:



 

[VK5RC]

Mr 'Cordless vs security chain' mustn't like his Mill or Lathe, grinding near one is REALLY bad for the bed, you can't get carborundum dust out of it.

[max666]

Thanks for the links Fungus.

And am I missing something or why is Mr 'Cordless vs security chain' pushing the grinder? He must not use it very often, otherwise he would have figured out that if he pulls it, he'd get on faster and it wouldn't seize that much.

[kcozens]

Interesting video. Thanks for the reminder about the concept of power line analysis of electronic devices. I don't think it would yield any useful information in this situation. The simple way to write the program is to save the buttons being pressed. Once the 6th button is pressed then you would do a go/no-go check to see if the correct code was entered. "It would make the lock immune to power line analysis.