Safe Cracking 101, 102

Post Reply
User avatar
DNR
Digital Mercenary
Digital Mercenary
Posts: 6114
Joined: 24 Feb 2006, 17:00
15
Location: Michigan USA
Contact:

Safe Cracking 101, 102

Post by DNR »

I guess my first experience at safe cracking was when I was a kid and got a small safe 'piggy bank' to keep change in.
The safe was made out of metal, had a combination lock, and even a ringing bell that goes of when the door is opened. It was 8"x8"x6".
So when I was bored and wanted to learn, I worked on the safe. I used tools to try to jimmy the lockig mechanism, I learned to peel the safe open as well. I learned to atack the safe by other than the front door (to bypass alarm).

When I worked in various places doing security, I always took the time to examine the lockboxes and safes used. The big safes - are almost designed exactly like the small safes. They have a strong outer casing, they have a secure locking mechanism that uses bars or rods to lock the door, and then a keypad, combo, or key lock (or two). People also tend to behave the same way around safes - how they memorize combos, hide keys, leave the safe open or unlocked.

Working in the crime lab I got to see safes that were from crime scenes - real safes taken and cracked by various levels of skilled crackers.

A safe is just like any other locking or control device - it only delays and makes theft visible. Any safe can be cracked - given enough time and tools. without a combo or key, the person is left with attacking the structure or stealing the entire safe.

Stealing the safe is almost tactic #1 - the smart theif knows he needs time and a private place to bust the safe open, so he will remove the safe from the premises. The first rule of any safe owner - is to securely install their safe so it cannot be removed!

Tactics used: ( discussed in detail below)
1. You can try to locate the key or combination lock number by searching the vincinity of the safe.
2. You can try to guess the combination lock numbers by tactile feel and playing with the combo dial.
3. You can drill.
4. You peel.
5. You explode the safe.

Tactics
1. People factor - looking for the code or keys

Most people, especially businesses that have a high turn over rate of employees, high number of employees that need to access the safe - people will write the combo number down nearby. they will hide the emergency safe key, on the keyring with all the other keys! observing people using the safe can tip you off. Safe combination numbers are at least 3 - two digit numbers, some higher security safes will use 4 - two digit numbers.
For emergencies - like a forgotten combination code, there can be a key hidden nearby to unlock the safe. Some people are lazy and use the key almost full time. Since safe keys are not standard, they appear to be high security keys - they are short, multi pin, possibly double sided keys or barrel keys. *it is possible to try to pick the lock on a safe - but double sided locks are almost impossible. Barrel key locks are easy to pick, if you have the correct tool for attacking barrel key locks.* Some business safes have a DAY LOCK, this is a setting that is switched on inside the safe door - this allows the business to use the safe quickly during business hours - they only need to enter the last digit of the combo. Instead of entering all three or four codes on the dial or keypad - they can simply enter the last code while it is in DAY LOCK mode. This is better than simply leaving the safe door unlocked, as they might on older safes. With DAY LOCK, some people will forget and leave it on overnight - thus, you only have to crack one code, a two digit number - either on the keypad or combo lock.

2. Touch and Dialing for dollars...
Image
*contact points make 'noise' when you turn the dial. Drive cam will click and drag discs drive pins.
Image
* the drive cam, or drive disc is attached to the dial, as you spin it, it catches on the locking discs pins depending on which direction you spin the dial.

The design of the combination lock gives inherent defects that make it possible to guess combination locks by feel. The combination lock, especially on a safe is noisy. The combination lock has disc and slots that allow a lever to fall in place and unlock the door. You can spin the disc and try to feel for the clicks made by the slots (contact points) as they contact the lever. Manufacturing tolerance are sloppy on cheap safes, they almost allow you to use the wrong combination lock by as much as 5 digits (ie "20" can be anywhere from 16 to 24 - so people can easily unlock the safe. More expensive safes with higher tolerance, you will have to be 'right on' the number to unlock it.
You will have to understand the basics of the combination lock to understand why you need to spin the dial a certain direction first (usually start spinning left), why you have to spin a certain number of times (4 spin for first number, 3 for second number, etc)
As you spin the dial, you can feel the drive disc drag on the other disc, clicks and bumps (bumps are when the lever catches and causes the dial to jump as the lever falls in place - this is the lever catching the slot on the disc)(clicks are disc nubs contacting each other). As you spin the dial left or right, you feel for the drive disc contact points, then you feel for it catching the nubs on the lock disc as you go left or right. This is where hands on experience is important, I can't explain this any other way.

A good primer on safes and their locks
Safe cracking for the computer scientist "Safe and vault security: a computer science perspective" 2.6mb
http://digitalnomad.suck-o.net/DNR/red/safelocks.pdf" onclick="window.open(this.href);return false;

Electronic key pads can be ulttaviolet marked (use black light to detect), anyone touching the keypad will leave fingerprints on the keys they used to unlock the safe.
Image
In some cases, the lock is so worn and dirty, you can see visibly the numbers used on a keypad.
Be aware - many safe's electronic keypads WILL LOCK YOU OUT, after failed attempts within a certain time period - this means you cannot try more than 2- 3 codes during a time frame of usually 3 to 15 minutes! If you activate this security system lock out, the owner will know as he might have to use the emergency key to unlock the safe.
I would also try attacking the electronic keypad, if you can remove it intact on the safe, you would try to find the trigger wire to cause it to unlock. You would have to know voltages/wire colors so you don't fry the system when probbing it. Reading up on the specfic safe's model and manufacture will help you understand the wiring diagram for that safe. Safe scematics are harder to find than exploits for web servers, security through obscurity is in effect here.

**************in progress

JUMP

Ok, here is a collection of safes I picked up. Real hackers know that hands-on learning is the best - these safes were brought at stores, pawn shops, and found in old buildings.
Image
You have a plastic bodied fireproof safe, a metal cased fire proof safe, a floor mounted safe door (sitting on breifcase), and a fireproof briefcase.

The plastic bodied fire proof safe is common, most losses are by fire - not safe breaking - so insurance companies want fire proof more than theft proof.
Image
door lever is in unlocked position, and has 100 number dial. Under the dial is a round cover for the emergency key unlock.

Inside you can see the thick walls, which contain fire retardant materials. While the safe can protect contents from swiping, it will not resist a safe break too long.
Image
yea you can see what DNR might keep in his safe.

Here the cover on the door mechanism has been removed.
Image
You can see the discs controlled by the combo dial, the locking bars, and the round black device on the lower part is the locking mechanism.
If you look at the insides of most safes, they all share almost the same design. Check out the bank safes, they are just bigger, heavier, stronger versions of what you see here.

You can see the dials, the locking bars, the mechanism that moves the locking bar - but the mechanism that unlocks the locking bar is hidden behind it. The white lever is the arm that unlocks this mechanism. the white lever has to fit in the slots on the dial to unlock. The white lever is in unlock position, in the dial slots.
Image
The white lever is now in lock position, the dials moved it out of the slots.
Image
the outermost disc is the drive disc, note its slot is different than the lock discs.

The white lever is important, not the disc. The white lever controls what unlocks the door mechanism.
Image
The lever is locking a round wheel at the bottom of the locking bars. The White bar has to be moved (by fitting into the disc slots) to unlock the round wheel. Many safes utilize locking bars and a durable locking system - the combination lock is not meant to be very technical - the door lock is. If you can defeat the door lock mechanism - you can bypass the combination lock! The system is designed so defeating the comination dial itself - will not unlock the safe alone - you have to attack the door lock mechanism. Smart safe crackers will bypass the combination dial and just drill a hole in the door - to punch out the lever or its springs.

Lastly, this is a plastic safe - peeling it, hammering it - can probably defeat this safe and gain its contents within an hour or so.

---

Floor safe/money drop safe

Image
This is a heavy motherfucker, it was designed to be a money drop for a bar, to leave money overnight. So it's body was sunk into a cement floor (thats why I don't have it) and the safe door removes when you unlock it with a combination code. The dial is missing. The slot is for dropping money into the safe. It weights about 30 pounds.
you can see the locking bars sticking out the sides of the safe door.

Image
The back of the safe door you can see the strong steel design, even for the money drop slot. The key hole is to quickly unlock the safe door so it can be placed on to the safe while opened.

Just like the last safe, its internals look similar - the drive disc and locking disc, the locking bar are visible. After the combination is entered, pressing in the dial causes the spring loaded locking bars to retract.
Image

The locking bar removed, you can see the slots in the locking discs
Image
shown with locking bar in place, in locked position (not engaged in slots)
Image

Since I had the back cover off, I could play with the dial to figure out the combination numbers for the slots - because I can see the disc moving. This is another tactic by safe crackers - to drill holes into the safe to use a snake camera to view the disc as you manipulate the combination dial or jimmy the locking lever.
Image
holes can be drilled in the front or back of the safe to insert a snake camera and attempt to manipulate the lock.

-----------------------

Electronic safe

Image
electronic safes don't have a combination lock, but instead a keypad. For backup - these safes will have a key unlock in case the power fails. This is also the emergency key unlock in case people forget the code. This safe is a better theft proof safe, while fireproof, it has a metal body and heavy steel door. This safe electronics will lock you out after 3 failed attempts, and then chirp 15 minutes later.

Inside the safe
while it has a stronger design, the locking mechanism is not as good as the above plastic safe. It only has one locking bar! The locking bar inside the door, is fake. The chrome bar is the only locking bar. The fake locking bar is to resist prying at the door to pop it off or cutting off the hinges to pop off the door.
Image

Inside, cover off
here you can see the code reset button, the circuit board, wires, and actuator.
Image
The wires come in through the front,
Image
The front panel is only part of the electronics to unlock the safe - secondary parts are contained inside.
Image
Wires are not color coded or even numbered - making it hard to figure out what wire is which if you were outside the safe. You can see the two red wires that would control the actuator - but there is apparently another actuator inside the door to push the door lock open. This exposed actuator only moves out of the way to allow the mechanism to unlock. This means electronically - you have two actuators to move, one moves out of the way, the other slides the locking bar back.

If you drilled a hole - you could simply move this lever down (key unlock direction, not electronic unlock direction - see screwdriver (the electronic actuator moves in opposite direction than key or screwdriver)
Image
by pushing or pulling this knob down, the door is unlocked
Image
This design of the locking mechanism being moved in a different direction than electronic unlock mechanism was maybe to prevent the electronic lock from locking the key out as well. Now, it caused a bypass to the combination keypad and electronics - you simply move the lock in the direction the key would move it.

more later...

DNR
)*photos are mine, graphical images are from "howstuffworks.com" fuck 'em
-
He gives wisdom to the wise and knowledge to the discerning. He reveals deep and hidden things; he knows what lies in Darkness, and Light dwells with him.

User avatar
DNR
Digital Mercenary
Digital Mercenary
Posts: 6114
Joined: 24 Feb 2006, 17:00
15
Location: Michigan USA
Contact:

Re: Safe Cracking 101, 102

Post by DNR »

Safes are only meant to delay theft. Like any lock, safes will fail after enough time during an attack. Safes use other tactics like alarms, cameras, and physical location to make it harder to 'crack a safe'. Again, a criminal would try to remove a safe to another location to crack it at his time. without being able to move the safe, he now has to crack it on location. noise can alert neighbors. the safe can be physically mounted or installed to make cracking harder. encasted in cement or even mounted on a metal frame that will bend under attack, protecting the safe. Each safe is not going to be the same as another because of not just models and types of safes, but how they are installed.

Cracking, Peeling, Cutting
Metal will fatigue after a while of hammering, high quality safes are made of higher quality metal that resist fatigue better. But, once metal fatigue happens, cracks develop that allow tools to be inserted to break open the safe. Common metal fatigue areas can be the corners and edges where the safe was welded together. Here you can crack the seam and insert a chisel to break open the safe. Noisy, takes physical energy.

It helps to know a bit about metals, which ones resist drill bits, which ones cannot be cut with a torch.

Thick glass can be used inside the safe - for two reasons - 1. glass resist drilling with normal drill bits. 2. the glass can be designed to break and permanently lock the safe, requiring a locksmith.

Peeling is usually done with a compressed air pneumatic tool, for auto body metal work - it cuts away light to medium thickness steel. Very Noisy.

Cutting is using a torch - a plasma cutter being my first pick. Obviously a small safe is not ideal for using a flaming torch on - you'll damage the contents. On larger safes, the contents are further away and even in metal drawers. You will primarily use the cutter to attack the hinges, the door (if its not heavy), or the side or back of the safe. Trying to cut the door can risk preventing you from using that option of safe cracking - you will have melted the door components. Maybe even locking the safe permanently. In the crime lab, we found lots of safes that were burned up, because they used a torch on a small safe. Not all metals are the same, thus what kind of cutting flame you use is important.

Cutting with other tools,
Go visit a pawn shop, there are bolt cutters, handheld grinders that can be fitted with metal cutters, there are cement cutting tools that can be handheld against a safe, metal expanders, sledge hammers and wedges. Use your imagination, and fit it to the scenario - the type of safe, and its location.

This video is a great, typical tactic used by most thieves - they know the body of the safe is weaker than the front door. In the video, they simply use a circular saw with a regular blade to cut open a safe.
[youtube][/youtube]

Electric Handtrucks -
These are used to lift heavy appliances and move them. These can be used to strap a safe onto and get it out of a building, including down or up stairs! They can lift 900 pounds. Get one at a tool rental shop or steal an appliance truck!

Cracking 103 -
This is what I would do.

Drill a hole into the safe, about the diameter of a 12 gauge shotgun barrel.
You will have a single shot 12 gauge shotgun sawn down to 12" and the end of the barrel threaded -
so you can screw it into the hole you drilled and threaded in the safe!

You then fill the safe with water, fill it all the way up to the top.

Screw on the 12 gauge shotgun to the threaded hole in the safe.
Tie string to shotgun trigger, get standoff distance of at least 25 feet.

When the shotgun goes off - it will create hydrostatic pressure. Since the water is already pressed against the sides of the safe, it is 'under pressure', firing the 12 gauge shell will cause the safe to 'over pressure' and crack open.

Haven't tried it yet!
----------------

Dropping a safe

One crime team used a high rise parking garage to drop safes from a tall height to crack them open.

----------------

ATM machines - are basically safes. Inside the console is a real, heavy metal safe - combo/key lock, and small port for the machine to take money out. Besides weighting 900 pounds, they can have cellular with battery backup - so while you are trying to pull the ATM off the floor, it is calling a security monitor station. Once you do get an ATM away, you have a professional grade safe that many amatures have failed to get into. People usually try cutting with a tourch as the safe is mounted inside a metal frame that makes hammering and cracking almost impossible. You would have to peel away the ATM to finally get at the safe, then begin cracking the safe. All that work, and you hope it has $2,500 to $7,000 in it.
I found an NCR exploit for the NCR 5010 machines - you can enter maintence mode by pulling the console cover forward - it tripped a switch that puts the console in maintence mode. Here you can see what the remaining balance is in the ATM!

While you are not robbing a bank, the FBI still investigate any crime involving a cash/ financial device.


DNR
-
He gives wisdom to the wise and knowledge to the discerning. He reveals deep and hidden things; he knows what lies in Darkness, and Light dwells with him.

User avatar
DNR
Digital Mercenary
Digital Mercenary
Posts: 6114
Joined: 24 Feb 2006, 17:00
15
Location: Michigan USA
Contact:

Re: Safe Cracking 101, 102

Post by DNR »

About metals
Metal hardness chart
http://www.calce.umd.edu/TSFA/Hardness_ad_.htm" onclick="window.open(this.href);return false;

Melting points of metals
http://www.muggyweld.com/melting.html" onclick="window.open(this.href);return false;

Metal Identification
http://www.man.lodz.pl/LISTY/ODLEW-PL/2 ... ady_20.pdf" onclick="window.open(this.href);return false;

DNR
-
He gives wisdom to the wise and knowledge to the discerning. He reveals deep and hidden things; he knows what lies in Darkness, and Light dwells with him.

User avatar
DNR
Digital Mercenary
Digital Mercenary
Posts: 6114
Joined: 24 Feb 2006, 17:00
15
Location: Michigan USA
Contact:

Re: Safe Cracking 101, 102

Post by DNR »

It is possible to make a machine crack a combo dial, it listens and then tries ranges of combo numbers. Computer scientist and hackers have tried methods to crack safes.

A device made to dial combo numbers like dictionary or brute forcer
http://www.kvogt.com/autodialer/" onclick="window.open(this.href);return false;

Thermal Imaging to crack safes
http://lcamtuf.coredump.cx/tsafe/" onclick="window.open(this.href);return false;

DNR
-
He gives wisdom to the wise and knowledge to the discerning. He reveals deep and hidden things; he knows what lies in Darkness, and Light dwells with him.

User avatar
DNR
Digital Mercenary
Digital Mercenary
Posts: 6114
Joined: 24 Feb 2006, 17:00
15
Location: Michigan USA
Contact:

Re: Safe Cracking 101, 102

Post by DNR »

Attack the lock mechanism and bypass the combo lock

[youtube][/youtube]

This is what I meant - people get focused on the combo/keypad lock, when really they just need to figure out how to defeat the door lock itself.

DNR
-
He gives wisdom to the wise and knowledge to the discerning. He reveals deep and hidden things; he knows what lies in Darkness, and Light dwells with him.

User avatar
DNR
Digital Mercenary
Digital Mercenary
Posts: 6114
Joined: 24 Feb 2006, 17:00
15
Location: Michigan USA
Contact:

Re: Safe Cracking 101, 102

Post by DNR »

Computer controlled safes

http://www.sargentandgreenleaf.com/pdf/ ... series.pdf" onclick="window.open(this.href);return false;" onclick="window.open(this.href);return false;



DNR
-
He gives wisdom to the wise and knowledge to the discerning. He reveals deep and hidden things; he knows what lies in Darkness, and Light dwells with him.

reparto
Fame ! Where are the chicks?!
Fame ! Where are the chicks?!
Posts: 288
Joined: 27 May 2013, 11:30
8

Re: Safe Cracking 101, 102

Post by reparto »

I don't think you have mentioned this but on most domestic safes that use a keypad (probably works on dial safes but I have never tried it on one), you can force the safe open if you slam the center of the front top edge whilst sharply twisting the handle to open the door.
Selling invisible pets:
Dogs - 0.5 Bitcoins
Cats - 0.7 Bitcoins
Unicorns - 10 Bitcoins
Chimpanzee - 2 Bitcoins

PM me if you are interested, will ship via priority airmail, will accept escrow services

User avatar
computathug
Administrator
Administrator
Posts: 2682
Joined: 29 Mar 2007, 16:00
14
Location: UK

Re: Safe Cracking 101, 102

Post by computathug »

One of my brothers was a safe cracker back in the 90's, a very good one too, he was also a very good car thief. Car alarms and locks were bypassed in a matter of seconds. He stole a Jaguar that was brand new as at the time at was said to be theft proof by shorting out the indicators and jacking the car up to certain angle so that the censors thought it was being towed away.
The devil can cite Scripture for his purpose.
-- William Shakespeare, "The Merchant of Venice"

Post Reply