Safe cracking via stepper motor

[DTJ]

I found this little gif on reddit and figured others here might like it too.

https://imgur.com/gallery/Sr7RMdq

The story that linked to it said it took 2 days to open the safe. I'm not sure how the system determines the correct code has been entered.

[Avacee]

The Lock Picking Lawyer has a review of one and explains how it works.

Hilarious channel if you like watching bad design and implementation failures around safes, padlocks and other security 

[Fraser]

The ITL 2000 and later versions have been around for decades. They can get you out of a jam like a user forgetting their combination but they are by no means perfect. They need to be left running for long periods of time as running them too fast can destroy the lock without opening it (combination locks are not designed for high speed rotation).

Such opening techniques look easy in Hollywood films but real life is not so simple with decent security tested and rated combination locks

Remember..... a lock is just a delaying tactic, it will eventually succumb to attack if enough time is made available.

Fraser

[fcb]

I seem to remember these taking about 2 weeks on a Manifoil IV!

[StillTrying]

I didn't know such things existed.
If it's going to try every combination, I wonder if there's a way to try all the quickest/shortest travel combinations first.

[German_EE]

James Bond in 'On Her Majesty's Secret Service' seemed to do this in the time required to read through a copy of Playboy magazine. What's changed?

I once read that the Russian Secret Service watched each of the James Bond movies very carefully as they believed the movies were based on real life.

[fcb]

You could also use these to torture diplomatic staff who forgot combinations... imagine having one of those going for even a day in the back of your office.  You usually started with a rough guess, but if someone screwed up a combination change 

[IanB]

The ITL-2000 is basically a brute force approach. It doesn't have any intelligent feedback from the lock.

To speed the process up you can do it the old fashioned way with a stethoscope. Here is Bosnian Bill having a go. He said it was very tedious and took him hours even with a "beginner friendly" lock:

https://youtu.be/k5qNMTzyGGE

[fcb]

Stethoscope won't work on anything vaguely modern and security rated. Manifoil's have mechanisms inside to to frustrate audio attacks.

[edy]

If it's going to try every combination, I wonder if there's a way to try all the quickest/shortest travel combinations first.

Brute force attack but it doesn't have to try EVERY combination. For example, for some padlocks there are certain restrictions due to the mechanical implementation that do cause some limits to the range of the 2nd digit (based on the 1st) and 3rd (based on the 1st and/or 2nd).

There is also a tolerance level which means that if you are "close" you may be able to round. So you may not need to try 1, 2, 3, 4, 5, ... you may be able to effectively do 1, 3, 5, etc... or 2, 4, 6, depending on the mechanical design.

I don't know with these ultra-expensive high-end combination safes, maybe there are no restrictions and every possible combination is possible (earlier digits don't predetermine or restrict allowable subsequent digits) and tolerance may be very high so that it has to be EXACTLY on the tick.

NOTE also that if you have physical access to a safe like this for such a long time to use this device, then you could probably cut your way into it faster... i.e. REAL Brute Force.    This is not something you sneak into the corporate boss office at night and expect to open in a few hours before morning staff shows up. 

[Bicurico]

Since being a kid I am fascinated with locks and especially safes.

What I did not understand with this cracking process is how the system knows that it has found the correct code.

In my safe you need to turn the key after setting the right combination. The key will only turn is the combination is right. This would require a second stepper motor and would definitely slow down the process. Not to mention that you would pf courae need the key.

Moste combination safes I have seen require always a second switch or key to open the safe after successfull combination entry. So how is this done in the video?

Or is this a silly safe where the door pops open after the last number of the combination has been inserted?

Regards
Vitor

[BradC]

I didn't know such things existed.
If it's going to try every combination, I wonder if there's a way to try all the quickest/shortest travel combinations first.

It's a lot easier than that. Roughly 2/3rds of domestic safes are still on the default code.

[IanB]

What I did not understand with this cracking process is how the system knows that it has found the correct code.

In my safe you need to turn the key after setting the right combination. The key will only turn is the combination is right. This would require a second stepper motor and would definitely slow down the process. Not to mention that you would pf courae need the key.

Moste combination safes I have seen require always a second switch or key to open the safe after successfull combination entry. So how is this done in the video

With this kind of lock there are three (or more) rotating wheels with gates. When you line up all the gates under the locking lever it drops down and latches with the wheels so the dial will no longer turn freely (all the wheels have become immobilized). In this lock the dial is then used to pull the locking lever across and open the safe.

It is true there are more advanced mechanisms than this, but the example here is a simple and basic safe lock used for entertainment purposes.

[Bicurico]

Thanks! I now understand.
Doesn't sound very secure through. This would definitely not work with my safe.

[Domagoj T]

NOTE also that if you have physical access to a safe like this for such a long time to use this device, then you could probably cut your way into it faster... i.e. REAL Brute Force.    This is not something you sneak into the corporate boss office at night and expect to open in a few hours before morning staff shows up. 

Not necessarily.
Imagine a night guard or janitor in an empty building. Assume they have daily access to the combination lock. They can install the device every night and let it run for a few hours, then the next night continue where they stopped. This is a non destructive method and leaves no obvious trace.
Once they have the code, they lock the safe and arrange the heist at the most convenient moment, perhaps months in the future.

[CCitizenTO]

Yeah and some padlocks only have a limited number of combinations too... I believe the popular 'Master' locks used to secure lockers in schools and the like have a total of like 90 combinations that are used... If you have information like that then brute forcing it becomes even easier...

Not sure I think with 0-39 the number of combinations is 40 * 40 * 40 which would be 64,000 potential combinations but as they said on this device there is a limit in the geometry for example the code probably cant be any repeating number